diff --git a/clients/cmd/fluentd/lib/fluent/plugin/out_loki.rb b/clients/cmd/fluentd/lib/fluent/plugin/out_loki.rb
index f2bb30538a400..b3d789ea684b9 100644
--- a/clients/cmd/fluentd/lib/fluent/plugin/out_loki.rb
+++ b/clients/cmd/fluentd/lib/fluent/plugin/out_loki.rb
@@ -61,6 +61,9 @@ class LogPostError < StandardError; end
       desc 'TLS: disable server certificate verification'
       config_param :insecure_tls, :bool, default: false
 
+      desc 'Custom HTTP headers'
+      config_param :custom_headers, :hash, default: {}
+
       desc 'Loki tenant id'
       config_param :tenant, :string, default: nil
 
@@ -232,6 +235,9 @@ def loki_http_request(body, tenant)
         req = Net::HTTP::Post.new(
           @uri.request_uri
         )
+        @custom_headers.each do |key, value|
+          req.add_field(key, value)
+        end
         req.add_field('Content-Type', 'application/json')
         req.add_field('Authorization', "Bearer #{@auth_token_bearer}") unless @auth_token_bearer.nil?
         req.add_field('X-Scope-OrgID', tenant) if tenant