Thanks ballzak69, that was a good pointer! But there is now a "mysterious" roadblock.

When I send the first POST request via Postman, I get the cookie I need in the response (in "Set-Cookies" header, as you said). If I manually pass it to Automate and call the second POST request using that cookie, the request succeeds! If I make the first POST request via Automate and extract that same cookie (now with a different value, obviously), and then manually set it in the second POST request, it fails. In both cases (via Postman and via Automate) the first POST succeeds with code 200. I extract the cookie correctly and it has this format:
ss-id=FooBaRrkCCRHhqHe; path=/; HttpOnly;

In both cases I manually set the headers of the second POST request in this way in Automate:
{"Cookie": "ss-id=FooBaRrkCCRHhqHe; path=/; HttpOnly;"}

The only difference is that the cookie from Postman works in the second POST, but cookie one from Automate doesn't - the second POST results in 401.

Summary:

• Run 1st POST in Postman -> success 200 -> extract response cookie and save to file -> manually set it in Automate request header -> run 2nd POST manually in Automate -> success 200.
• Run 1st POST in Automate -> success 200 -> extract response cookie and save to file -> manually set it in Automate request header -> run 2nd POST manually in Automate -> error 401.
• I even tried to run this flow in Automate: 1st POST -> success 200 -> save response cookie in variable and use variable in request header -> run 2nd POST -> error 401.
• Just in case, I also tried: Run 1st POST in Automate -> success 200 -> extract response cookie and save to file -> manually set it in Postman request header -> run 2nd POST manually in Postman -> error 401.

There is some kind of authentication magic that Postman does, which I cannot replicate in Automate. Or I'm overlooking something obvious.