diff --git a/terraform/provider/CHANGELOG.md b/terraform/provider/CHANGELOG.md
index af03cfb4ce9..4dc728e2045 100644
--- a/terraform/provider/CHANGELOG.md
+++ b/terraform/provider/CHANGELOG.md
@@ -9,7 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
-- **provider**: Optional `custom_headers` map to send extra HTTP headers on every LiteLLM API request (e.g. proxy or gateway headers). Applied by both request helpers. `x-api-key` from `api_key` always takes precedence. Cross-origin redirects drop custom headers and `x-api-key`
+- **provider**: Optional `custom_headers` map to send extra HTTP headers on every LiteLLM API request (e.g. proxy or gateway headers). Applied by both request helpers. `x-api-key` from `api_key` always takes precedence
 
 ## [0.4.0] - 2026-08-06
 
diff --git a/terraform/provider/litellm/client.go b/terraform/provider/litellm/client.go
index e8bcbfafc1a..37ce532894d 100644
--- a/terraform/provider/litellm/client.go
+++ b/terraform/provider/litellm/client.go
@@ -26,33 +26,17 @@ func NewClient(cfg ProviderConfig) *Client {
 		headers[k] = v
 	}
 
-	c := &Client{
+	return &Client{
 		APIBase:            cfg.APIBase,
 		APIKey:             cfg.APIKey,
 		InsecureSkipVerify: cfg.InsecureSkipVerify,
 		CustomHeaders:      headers,
-	}
-	c.httpClient = &http.Client{
-		Transport: &http.Transport{
-			TLSClientConfig: &tls.Config{InsecureSkipVerify: cfg.InsecureSkipVerify},
+		httpClient: &http.Client{
+			Transport: &http.Transport{
+				TLSClientConfig: &tls.Config{InsecureSkipVerify: cfg.InsecureSkipVerify},
+			},
 		},
-		CheckRedirect: c.checkRedirect,
 	}
-	return c
-}
-
-func (c *Client) checkRedirect(req *http.Request, via []*http.Request) error {
-	if len(via) >= 10 {
-		return fmt.Errorf("stopped after 10 redirects")
-	}
-	orig := via[0].URL
-	if req.URL.Scheme != orig.Scheme || req.URL.Host != orig.Host {
-		for k := range c.CustomHeaders {
-			req.Header.Del(k)
-		}
-		req.Header.Del("x-api-key")
-	}
-	return nil
 }
 
 func (c *Client) applyRequestHeaders(req *http.Request) {
diff --git a/terraform/provider/litellm/client_test.go b/terraform/provider/litellm/client_test.go
index a9525a8e284..c66e56718db 100644
--- a/terraform/provider/litellm/client_test.go
+++ b/terraform/provider/litellm/client_test.go
@@ -2,7 +2,6 @@ package litellm
 
 import (
 	"encoding/json"
-	"io"
 	"net/http"
 	"net/http/httptest"
 	"strings"
@@ -73,43 +72,6 @@ func TestMakeRequestCustomHeaders(t *testing.T) {
 	}
 }
 
-func TestCrossOriginRedirectStripsSensitiveHeaders(t *testing.T) {
-	var finalAuth, finalAPIKey string
-	target := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		finalAuth = r.Header.Get("X-Proxy-Auth")
-		finalAPIKey = r.Header.Get("x-api-key")
-		w.Header().Set("Content-Type", "application/json")
-		_ = json.NewEncoder(w).Encode(map[string]interface{}{"ok": true})
-	}))
-	defer target.Close()
-
-	origin := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if got := r.Header.Get("X-Proxy-Auth"); got != "proxy-token" {
-			t.Errorf("origin X-Proxy-Auth = %q, want proxy-token", got)
-		}
-		http.Redirect(w, r, target.URL+"/final", http.StatusFound)
-	}))
-	defer origin.Close()
-
-	client := testClient(origin.URL, "sk-real-key", false, map[string]string{
-		"X-Proxy-Auth": "proxy-token",
-	})
-
-	resp, err := MakeRequest(client, "GET", "/start", nil)
-	if err != nil {
-		t.Fatalf("MakeRequest: %v", err)
-	}
-	defer resp.Body.Close()
-	_, _ = io.Copy(io.Discard, resp.Body)
-
-	if finalAuth != "" {
-		t.Errorf("cross-origin redirect kept X-Proxy-Auth = %q", finalAuth)
-	}
-	if finalAPIKey != "" {
-		t.Errorf("cross-origin redirect kept x-api-key = %q", finalAPIKey)
-	}
-}
-
 func TestRedactSensitiveDataNestedCredentialValues(t *testing.T) {
 	c := testClient("http://localhost:4000", "sk-test", false, nil)