diff --git a/src/dotnet/QuantEngine.Web/Program.cs b/src/dotnet/QuantEngine.Web/Program.cs
index 29c94d40..b4c61b8e 100644
--- a/src/dotnet/QuantEngine.Web/Program.cs
+++ b/src/dotnet/QuantEngine.Web/Program.cs
@@ -1,3 +1,4 @@
+using Microsoft.AspNetCore.DataProtection;
 using QuantEngine.Infrastructure.Data;
 using QuantEngine.Infrastructure.Repositories;
 using QuantEngine.Infrastructure.Services;
@@ -22,6 +23,22 @@ try
     var builder = WebApplication.CreateBuilder(args);
     builder.Host.UseSerilog();
 
+    // Data Protection: without this, ASP.NET Core derives its key-ring
+    // discriminator from the app's physical content root path. Every
+    // deployment lands in a brand-new directory
+    // (~/deployments/quantengine_{tag}_{hash}/), so the discriminator
+    // changed on every single deploy and every previously-issued auth
+    // cookie became undecryptable -- forcing all users to log in again
+    // after each release. SetApplicationName pins a stable discriminator;
+    // PersistKeysToFileSystem points at a location outside the versioned
+    // deployment folders so the actual key material also survives restarts.
+    var dataProtectionKeysPath = Path.Combine(
+        Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData),
+        "quantengine-keys");
+    builder.Services.AddDataProtection()
+        .SetApplicationName("QuantEngine")
+        .PersistKeysToFileSystem(new DirectoryInfo(dataProtectionKeysPath));
+
     // Authentication & Authorization
     builder.Services.AddAuthentication(opts =>
     {