diff --git a/site/src/modules/resources/AppLink/AppLink.tsx b/site/src/modules/resources/AppLink/AppLink.tsx
index 5c4209a8f72c7..0e94335ba0c43 100644
--- a/site/src/modules/resources/AppLink/AppLink.tsx
+++ b/site/src/modules/resources/AppLink/AppLink.tsx
@@ -106,7 +106,11 @@ export const AppLink: FC<AppLinkProps> = ({ app, workspace, agent }) => {
 
 					event.preventDefault();
 
-					if (app.external) {
+					// HTTP links should never need the session token, since Cookies
+					// handle sharing it when you access the Coder Dashboard. We should
+					// never be forwarding the bare session token to other domains!
+					const isHttp = app.url?.startsWith("http");
+					if (app.external && !isHttp) {
 						// This is a magic undocumented string that is replaced
 						// with a brand-new session token from the backend.
 						// This only exists for external URLs, and should only