diff --git a/apps/guacamole/manifests/deployment-complete.yaml b/apps/guacamole/manifests/deployment-complete.yaml
index 666df43..ec2f8b0 100644
--- a/apps/guacamole/manifests/deployment-complete.yaml
+++ b/apps/guacamole/manifests/deployment-complete.yaml
@@ -227,10 +227,6 @@ metadata:
     component: client
 spec:
   type: ClusterIP
-  sessionAffinity: ClientIP
-  sessionAffinityConfig:
-    clientIP:
-      timeoutSeconds: 3600
   ports:
     - port: 8080
       targetPort: http
diff --git a/apps/guacamole/manifests/envoy-gateway.yaml b/apps/guacamole/manifests/envoy-gateway.yaml
index a382bdf..ad686a7 100644
--- a/apps/guacamole/manifests/envoy-gateway.yaml
+++ b/apps/guacamole/manifests/envoy-gateway.yaml
@@ -74,3 +74,25 @@ spec:
           name: guacamole
           port: 8080
           weight: 1
+
+---
+# Cookie-based session persistence so OIDC nonce validation works across 2 replicas.
+# Without this, the OIDC callback can hit a different pod than the one that generated
+# the nonce, causing "Rejected OpenID token with invalid/old nonce" errors.
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: BackendTrafficPolicy
+metadata:
+  name: guacamole-session-persistence
+  namespace: guacamole
+spec:
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: guacamole
+  loadBalancer:
+    type: ConsistentHash
+    consistentHash:
+      type: Cookie
+      cookie:
+        name: GUAC_ROUTE
+        ttl: 3600s