diff --git a/api-proxy-cf/src/index.js b/api-proxy-cf/src/index.js
index 95d654ab..1feb6816 100644
--- a/api-proxy-cf/src/index.js
+++ b/api-proxy-cf/src/index.js
@@ -346,8 +346,8 @@ function clearSessionCookieHeader(c) {
   return `${SESSION_COOKIE}=; Domain=${sessionCookieDomain(c)}; Path=/; Max-Age=0; HttpOnly; Secure; SameSite=Lax`
 }
 
-async function sessionUserFromCookie(c) {
-  const token = getCookieValue(c, SESSION_COOKIE)
+async function sessionUserFromCookieName(c, cookieName) {
+  const token = getCookieValue(c, cookieName)
   if (!token) return null
   const payload = await parseToken(token, c.env.TOKEN_SECRET)
   if (!payload?.uid) return null
@@ -357,6 +357,10 @@ async function sessionUserFromCookie(c) {
   return user
 }
 
+async function sessionUserFromCookie(c) {
+  return sessionUserFromCookieName(c, SESSION_COOKIE)
+}
+
 function domainMigrationDestination(raw) {
   try {
     const candidate = new URL(raw || '/keys', WEB_ORIGIN)
@@ -384,7 +388,11 @@ function noStoreRedirect(location) {
 // a URL or page script.
 app.get('/auth/domain-migrate', async (c) => {
   const destination = domainMigrationDestination(c.req.query('return'))
-  const user = await sessionUserFromCookie(c)
+  // This endpoint only ever runs on the old domain during the cutover, where
+  // a signed-in visitor still carries the pre-rename cookie name, not the
+  // current SESSION_COOKIE — reading the renamed cookie here would mean this
+  // endpoint can never find a signed-in old-domain user.
+  const user = await sessionUserFromCookieName(c, 'axion_session')
   if (!user) return noStoreRedirect(destination)
 
   const now = Date.now()
diff --git a/api-proxy-cf/test/sandbox-route.test.mjs b/api-proxy-cf/test/sandbox-route.test.mjs
index 9dee2374..ef7dd029 100644
--- a/api-proxy-cf/test/sandbox-route.test.mjs
+++ b/api-proxy-cf/test/sandbox-route.test.mjs
@@ -128,10 +128,10 @@ test('a banned session-token account is rejected (requireAuth already filters ba
 test('a banned account using an API key (not pre-filtered by requireAuth) hits the route\'s own banned check and gets 403', async () => {
   const db = new D1TestDatabase()
   addUser(db, 'banned-keyholder', { banned: 1 })
-  db.prepare('INSERT INTO api_keys (id, user_id, key_value) VALUES (?,?,?)').bind('k1', 'banned-keyholder', 'axion-sk-banned').run()
+  db.prepare('INSERT INTO api_keys (id, user_id, key_value) VALUES (?,?,?)').bind('k1', 'banned-keyholder', 'sennoric-sk-banned').run()
   const response = await app.request('/v1/sandbox/execute', {
     method: 'POST',
-    headers: { Authorization: 'Bearer axion-sk-banned', 'Content-Type': 'application/json' },
+    headers: { Authorization: 'Bearer sennoric-sk-banned', 'Content-Type': 'application/json' },
     body: JSON.stringify({ code: 'print(1)' }),
   }, { DB: db })
   assert.equal(response.status, 403)
@@ -229,10 +229,10 @@ test('hitting the weekly cap returns 200 with cap_exceeded:true instead of a har
   assert.equal(fetchCalled, false)
 })
 
-test('a valid axion-sk- API key can also use the sandbox (not just session tokens)', async () => {
+test('a valid sennoric-sk- API key can also use the sandbox (not just session tokens)', async () => {
   const db = new D1TestDatabase()
   addUser(db, 'keyholder')
-  db.prepare('INSERT INTO api_keys (id, user_id, key_value) VALUES (?,?,?)').bind('k1', 'keyholder', 'axion-sk-test123').run()
+  db.prepare('INSERT INTO api_keys (id, user_id, key_value) VALUES (?,?,?)').bind('k1', 'keyholder', 'sennoric-sk-test123').run()
   const env = { DB: db, DAYTONA_API_KEY: 'dtn-test' }
 
   const realFetch = globalThis.fetch
@@ -240,7 +240,7 @@ test('a valid axion-sk- API key can also use the sandbox (not just session token
   try {
     const response = await app.request('/v1/sandbox/execute', {
       method: 'POST',
-      headers: { Authorization: 'Bearer axion-sk-test123', 'Content-Type': 'application/json' },
+      headers: { Authorization: 'Bearer sennoric-sk-test123', 'Content-Type': 'application/json' },
       body: JSON.stringify({ code: 'print(1)' }),
     }, env)
     assert.equal(response.status, 200)