diff --git a/codex-rs/codex-mcp/src/server.rs b/codex-rs/codex-mcp/src/server.rs
index f0e739a904..002e1d5e99 100644
--- a/codex-rs/codex-mcp/src/server.rs
+++ b/codex-rs/codex-mcp/src/server.rs
@@ -329,15 +329,13 @@ fn referenced_environment_variables(config: &McpServerConfig) -> Vec<(String, Op
             .filter(|env_var| !env_var.is_remote_source())
             .map(|env_var| env_var.name().to_string())
             .collect::<Vec<_>>(),
-        McpServerTransportConfig::StreamableHttp { .. } if !config.is_local_environment() => {
-            Vec::new()
-        }
         McpServerTransportConfig::StreamableHttp {
             bearer_token_env_var,
             env_http_headers,
             ..
         } => bearer_token_env_var
             .iter()
+            .filter(|_| config.is_local_environment())
             .chain(env_http_headers.iter().flat_map(|headers| headers.values()))
             .cloned()
             .collect(),
@@ -421,3 +419,7 @@ impl From<&EffectiveMcpServer> for McpServerMetadata {
         }
     }
 }
+
+#[cfg(test)]
+#[path = "server_tests.rs"]
+mod tests;
diff --git a/codex-rs/codex-mcp/src/server_tests.rs b/codex-rs/codex-mcp/src/server_tests.rs
new file mode 100644
index 0000000000..87992a8800
--- /dev/null
+++ b/codex-rs/codex-mcp/src/server_tests.rs
@@ -0,0 +1,32 @@
+use super::referenced_environment_variables;
+use codex_config::DEFAULT_MCP_SERVER_ENVIRONMENT_ID;
+use codex_config::McpServerConfig;
+use pretty_assertions::assert_eq;
+
+#[test]
+fn remote_http_connections_track_host_headers_but_not_executor_bearer_tokens() {
+    let mut config: McpServerConfig = serde_json::from_value(serde_json::json!({
+        "url": "https://example.com/mcp",
+        "environment_id": "executor-1",
+        "bearer_token_env_var": "NODE_REPL_AUTH_TOKEN",
+        "env_http_headers": {"X-Api-Key": "PATH"},
+    }))
+    .expect("remote MCP configuration should deserialize");
+
+    assert_eq!(
+        referenced_environment_variables(&config),
+        vec![("PATH".to_string(), std::env::var_os("PATH"))],
+    );
+
+    config.environment_id = DEFAULT_MCP_SERVER_ENVIRONMENT_ID.to_string();
+    assert_eq!(
+        referenced_environment_variables(&config),
+        vec![
+            (
+                "NODE_REPL_AUTH_TOKEN".to_string(),
+                std::env::var_os("NODE_REPL_AUTH_TOKEN"),
+            ),
+            ("PATH".to_string(), std::env::var_os("PATH")),
+        ],
+    );
+}