diff --git a/box.json b/box.json
index fd9d7cb..03bf178 100644
--- a/box.json
+++ b/box.json
@@ -1,6 +1,6 @@
 {
     "name":"ColdBox Security",
-    "version":"3.7.2",
+    "version":"3.8.0",
     "location":"https://downloads.ortussolutions.com/ortussolutions/coldbox-modules/cbsecurity/@build.version@/cbsecurity-@build.version@.zip",
     "author":"Ortus Solutions.com <info@ortussolutions.com>",
     "slug":"cbsecurity",
@@ -24,7 +24,7 @@
     ],
     "dependencies":{
         "jwt-cfml":"^1.0.0",
-        "cbauth":"^6.0.0",
+        "cbauth":"^7.0.0",
         "cbcsrf":"^3.0.0"
     },
     "devDependencies":{
diff --git a/changelog.md b/changelog.md
index 8afda08..561c8e9 100644
--- a/changelog.md
+++ b/changelog.md
@@ -9,6 +9,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Changed
+
+- Upgraded `cbauth` to `^7.0.0` to support thread-safe authentication startup.
+
+### Fixed
+
+- Corrected the `Strict-Transport-Security` header formatting by removing the extra `": "` in the rendered header value.
+
 ## [3.7.2] - 2026-08-26
 
 ### 🐛 Fixed
diff --git a/interceptors/SecurityHeaders.cfc b/interceptors/SecurityHeaders.cfc
index 978031a..0ffecf2 100644
--- a/interceptors/SecurityHeaders.cfc
+++ b/interceptors/SecurityHeaders.cfc
@@ -250,12 +250,12 @@ component extends="coldbox.system.Interceptor" {
 		}
 
 		if ( variables.settings.securityHeaders.hsts.enabled ) {
-			var headerValue = "max-age: #variables.settings.securityHeaders.hsts[ "max-age" ]#;";
+			var headerValue = "max-age=#variables.settings.securityHeaders.hsts[ "max-age" ]#";
 			if ( variables.settings.securityHeaders.hsts.includeSubDomains ) {
-				headerValue &= " includeSubDomains";
+				headerValue &= "; includeSubDomains";
 			}
 			if ( variables.settings.securityHeaders.hsts.preload ) {
-				headerValue &= " preload";
+				headerValue &= "; preload";
 			}
 			event.setHTTPHeader( name: "Strict-Transport-Security", value: headerValue );
 		}
diff --git a/test-harness/tests/specs/integration/CBSecuritySpec.cfc b/test-harness/tests/specs/integration/CBSecuritySpec.cfc
index 19372e7..39387c6 100644
--- a/test-harness/tests/specs/integration/CBSecuritySpec.cfc
+++ b/test-harness/tests/specs/integration/CBSecuritySpec.cfc
@@ -41,6 +41,30 @@ component extends="coldbox.system.testing.BaseTestCase" appMapping="/root" {
 				cbauth.logout();
 			} );
 
+			it( "registers the authentication singleton with thread-safe publication", function(){
+				expect(
+					getWireBox()
+						.getBinder()
+						.getMapping( "authenticationService@cbauth" )
+						.getThreadSafe()
+				).toBeTrue();
+			} );
+
+			it( "can log in and out through the cbauth provider", function(){
+				var security = getInstance( "CBSecurity@cbsecurity" );
+				var user     = getInstance( "User" ).setId( "cbauth-compatibility" );
+				try {
+					expect( security.isLoggedIn() ).toBeFalse();
+					cbauth.login( user );
+					expect( security.isLoggedIn() ).toBeTrue();
+					expect( security.getUser().getId() ).toBe( user.getId() );
+					cbauth.logout();
+					expect( security.isLoggedIn() ).toBeFalse();
+				} finally {
+					cbauth.logout();
+				}
+			} );
+
 			it( "can retrieve user,auth and mixin services", function(){
 				var e = get( "/main/cbsecuremixin" );
 				expect( e.getRenderedContent() ).toBeJSON();