diff --git a/package.yaml b/package.yaml
--- a/package.yaml
+++ b/package.yaml
@@ -1,5 +1,5 @@
 name:                servant-auth-server
-version:             0.2.8.0
+version:             0.3.0.0
 synopsis:            servant-server/servant-auth compatibility
 description:         |
     This package provides the required instances for using the @Auth@ combinator
diff --git a/servant-auth-server.cabal b/servant-auth-server.cabal
--- a/servant-auth-server.cabal
+++ b/servant-auth-server.cabal
@@ -3,7 +3,7 @@
 -- see: https://github.com/sol/hpack
 
 name:           servant-auth-server
-version:        0.2.8.0
+version:        0.3.0.0
 synopsis:       servant-server/servant-auth compatibility
 description:    This package provides the required instances for using the @Auth@ combinator
                 in your 'servant' server.
diff --git a/src/Servant/Auth/Server/Internal/ConfigTypes.hs b/src/Servant/Auth/Server/Internal/ConfigTypes.hs
--- a/src/Servant/Auth/Server/Internal/ConfigTypes.hs
+++ b/src/Servant/Auth/Server/Internal/ConfigTypes.hs
@@ -50,16 +50,20 @@
   -- | 'Secure' means browsers will only send cookies over HTTPS. Default:
   -- @Secure@.
     cookieIsSecure    :: IsSecure
-  -- | How long from now until the cookie expires. Default: @Nothing@
+  -- | How long from now until the cookie expires. Default: @Nothing@.
   , cookieMaxAge      :: Maybe DiffTime
-  -- | At what time the cookie expires. Default: @Nothing@
+  -- | At what time the cookie expires. Default: @Nothing@.
   , cookieExpires     :: Maybe UTCTime
+  -- | The URL path and sub-paths for which this cookie is used. Default @Just "/"@.
+  , cookiePath        :: Maybe BS.ByteString
   -- | 'SameSite' settings. Default: @SameSiteLax@.
   , cookieSameSite    :: SameSite
   -- | What name to use for the cookie used for the session.
   , sessionCookieName :: BS.ByteString
   -- | What name to use for the cookie used for CSRF protection.
   , xsrfCookieName    :: BS.ByteString
+  -- | What path to use for the cookie used for CSRF protection. Default @Just "/"@.
+  , xsrfCookiePath    :: Maybe BS.ByteString
   -- | What name to use for the header used for CSRF protection.
   , xsrfHeaderName    :: BS.ByteString
   } deriving (Eq, Show, Generic)
@@ -72,9 +76,11 @@
     { cookieIsSecure    = Secure
     , cookieMaxAge      = Nothing
     , cookieExpires     = Nothing
+    , cookiePath        = Just "/"
     , cookieSameSite    = SameSiteLax
     , sessionCookieName = "JWT-Cookie"
     , xsrfCookieName    = "XSRF-TOKEN"
+    , xsrfCookiePath    = Just "/"
     , xsrfHeaderName    = "X-XSRF-TOKEN"
     }
 
diff --git a/src/Servant/Auth/Server/Internal/Cookie.hs b/src/Servant/Auth/Server/Internal/Cookie.hs
--- a/src/Servant/Auth/Server/Internal/Cookie.hs
+++ b/src/Servant/Auth/Server/Internal/Cookie.hs
@@ -53,6 +53,7 @@
     , setCookieValue = csrfValue
     , setCookieMaxAge = cookieMaxAge cookieSettings
     , setCookieExpires = cookieExpires cookieSettings
+    , setCookiePath = xsrfCookiePath cookieSettings
     , setCookieSecure = case cookieIsSecure cookieSettings of
         Secure -> True
         NotSecure -> False
@@ -70,6 +71,7 @@
       , setCookieHttpOnly = True
       , setCookieMaxAge = cookieMaxAge cookieSettings
       , setCookieExpires = cookieExpires cookieSettings
+      , setCookiePath = cookiePath cookieSettings
       , setCookieSecure = case cookieIsSecure cookieSettings of
           Secure -> True
           NotSecure -> False