set-cookie returned in response headers, cors origin is not wildcarded, but cookie is not stored in browser

This question has been asked a million times, but I've tried it all and nothing seems to work.

My situation:

I've deployed a node/express backend as a Google Cloud Run service. I am running my frontend locally, trying to login to my backend in the cloud. Frontend is served on http, backend on https. I have enabled cors on the backend. My config is:

app.use(cors({
    origin: 'http://localhost:3000',
    credentials: true,
}));

I am using axios, and I have set withCredentials: true:

axios.defaults.baseURL = ApiURL;
const { data } = await axios({
    method: 'post',
    url: `/api/login`,
    data: {
        username: this.state.username,
        password: this.state.password,
        keepLoggedIn: this.state.keepLoggedIn,
    },
    withCredentials: true,
});

This setup works perfectly when I run my backend locally, but of course there is no cors then. When I try to log in when the frontend is pointed at the Cloud Run service, I get a response from the backend with a set-cookie header as expected, but no cookie ever appears in the Storage > Cookies section of the Chrome dev console as it does with my local backend. There is then of course nothing sent with the rest of my axios requests, which need the cookie.

I've been at this for a full day and its driving me nuts. I'm sure there is something simple I'm missing. Any ideas?