diff --git a/gateway/core/corehttp/commands.go b/gateway/core/corehttp/commands.go
index aa2f51065..3b2a971b9 100644
--- a/gateway/core/corehttp/commands.go
+++ b/gateway/core/corehttp/commands.go
@@ -72,6 +72,7 @@ func addHeadersFromConfig(c *cmdsHttp.ServerConfig, nc *config.Config) {
 	// Copy these because the config is shared and this function is called
 	// in multiple places concurrently. Updating these in-place *is* racy.
 	for h, v := range nc.API.HTTPHeaders {
+		h = http.CanonicalHeaderKey(h)
 		switch h {
 		case cmdsHttp.ACAOrigin, cmdsHttp.ACAMethods, cmdsHttp.ACACredentials:
 			// these are handled by the CORs library.
diff --git a/gateway/core/corehttp/gateway.go b/gateway/core/corehttp/gateway.go
index ae3e035d8..044144a76 100644
--- a/gateway/core/corehttp/gateway.go
+++ b/gateway/core/corehttp/gateway.go
@@ -53,7 +53,7 @@ func GatewayOption(writable bool, paths ...string) ServeOption {
 
 		headers := make(map[string][]string, len(cfg.Gateway.HTTPHeaders))
 		for h, v := range cfg.Gateway.HTTPHeaders {
-			headers[h] = v
+			headers[http.CanonicalHeaderKey(h)] = v
 		}
 
 		// Hard-coded headers.