diff --git a/deploy/nifi.env b/deploy/nifi.env
index 44bd88a1..eb2daad5 100644
--- a/deploy/nifi.env
+++ b/deploy/nifi.env
@@ -44,12 +44,14 @@ NIFI_WEB_PROXY_CONTEXT_PATH="/nifi"
 # if you wish to run NiFi on another port, this goes for NIFI_WEB_PROXY_HOST,
 # NIFI_WEB_PROXY_PORT, NIFI_INTERNAL_PORT, and NIFI_EXTERNAL_PORT_NGINX.
 
+# If browsers have trouble with localhost-scoped auth cookies, using 127.0.0.1
+# avoids the special-case cookie handling around localhost.
 NIFI_WEB_HTTPS_HOST="0.0.0.0"
 
 # NiFi validates reverse proxy headers against this public host:port list.
 # For remote deployments, include the exact hostname or IP users open in a browser,
 # for example: "localhost:8443,nifi.example.org:8443".
-NIFI_WEB_PROXY_HOST="localhost:8443"
+NIFI_WEB_PROXY_HOST="localhost:8443,127.0.0.1:8443"
 NIFI_WEB_PROXY_PORT=8443
 
 NIFI_INTERNAL_PORT=8443
diff --git a/nifi/Dockerfile b/nifi/Dockerfile
index 8e3e78b4..c3b7584d 100644
--- a/nifi/Dockerfile
+++ b/nifi/Dockerfile
@@ -149,8 +149,8 @@ RUN $GROOVY_BIN/grape -V install org.apache.avro avro 1.12.0
 # INSTALL NAR extensions 
 WORKDIR /opt/nifi/nifi-current/lib/
 
-# --- Hotfix: NiFi 2.7.2 + Azure + Netty QUIC missing class (netty 4.2.9.Final) ---
-ARG NETTY_VERSION=4.2.9.Final
+# --- Hotfix: NiFi 2.7.2 + Azure + Netty QUIC missing class (netty 4.2.12.Final) ---
+ARG NETTY_VERSION=4.2.12.Final
 RUN set -eux; \
     cd /opt/nifi/nifi-current/lib; \
     curl -fL --retry 5 --retry-delay 2 \
diff --git a/services/cogstack-jupyter-hub b/services/cogstack-jupyter-hub
index 0362e4bc..ea5a6851 160000
--- a/services/cogstack-jupyter-hub
+++ b/services/cogstack-jupyter-hub
@@ -1 +1 @@
-Subproject commit 0362e4bce262fa72a0b270d4d1a85e76e9109ab0
+Subproject commit ea5a68511702553d7f1ccac41939919fa38b6d86
diff --git a/services/cogstack-nlp b/services/cogstack-nlp
index 14cb02e2..7b193624 160000
--- a/services/cogstack-nlp
+++ b/services/cogstack-nlp
@@ -1 +1 @@
-Subproject commit 14cb02e2c8b8b188cd12f727a20991a3097a6537
+Subproject commit 7b193624e10aa550fec44890b76a4c84cdc65897
diff --git a/services/nginx/config/nginx.conf.template b/services/nginx/config/nginx.conf.template
index e59ce3a0..305e717a 100644
--- a/services/nginx/config/nginx.conf.template
+++ b/services/nginx/config/nginx.conf.template
@@ -83,6 +83,13 @@ http {
 
         proxy_ssl_server_name on;
 
+        # Firefox has trouble with the localhost-scoped NiFi auth cookie.
+        # Redirect localhost to 127.0.0.1 so the browser gets a stable IP-scoped
+        # cookie domain instead.
+        if ($host = localhost) {
+            return 308 https://127.0.0.1:8443$request_uri;
+        }
+
         ssl_certificate           /certificates/nifi/nifi.pem;
         ssl_certificate_key       /certificates/nifi/nifi.key;
         ssl_client_certificate    /certificates/root/root-ca.pem;