Using ExecuteURL as 404 handler in web.config will bypass URL Rewrite (ie.. outboundRules) while using other responseModes won't

I have the following rule in web.config designed to identify and rewrite outbound session cookies with both the secure and httpOnly flags:

<rewrite>
    <outboundRules>
        <preConditions>
            <preCondition name="MatchSessionCookies">
                <add input="{RESPONSE_SET_COOKIE}" pattern="." />
            </preCondition>
        </preConditions>

        <rule preCondition="MatchSessionCookies" name="SecureSessionCookies" enabled="true">
            <match serverVariable="RESPONSE_SET_COOKIE" pattern="^(.*sess.*)=(.+)$" />
            <action type="Rewrite" value="{R:1}={R:2}; httpOnly; secure" />
        </rule>
    </outboundRules>
</rewrite>

This works as intended, up until httpErrors comes into play:

<httpErrors>
    <remove statusCode="404" subStatusCode="-1" />
    <error statusCode="404" prefixLanguageFilePath="" path="/path/to/404.aspx" responseMode="ExecuteURL" />
</httpErrors>

So when accessing /a-page-that-exists.aspx, the outbound ASPSESSIONID cookies that get written out are successfully rewritten with both secure and httpOnly flags.

Request URL: /a-page-that-exists.aspx
Status Code: 200 OK

Set-Cookie: ASPSESSIONIDABCDEFG=...; path=/; httpOnly; secure

The problem is accessing /a-page-that-does-NOT-exist.aspx. It appears that the [404] request is internally "routed" to the ExecuteURL path and my URL rewrite rules I have in place are bypassed altogether.

Request URL: /a-page-that-does-NOT-exist.aspx
Status Code: 200 OK

Set-Cookie: ASPSESSIONIDABCDEFG=...; path=/

Any ideas on how to modify my outbound rewrite rules so that they can be applied to [404] requests before being handed of to my 404 handler?