diff --git a/internal/dev-entrypoint/cloud-web-proxy.mjs b/internal/dev-entrypoint/cloud-web-proxy.mjs
index aa27a688..7fc4755a 100644
--- a/internal/dev-entrypoint/cloud-web-proxy.mjs
+++ b/internal/dev-entrypoint/cloud-web-proxy.mjs
@@ -12,7 +12,8 @@ const FORWARDED_REQUEST_HEADERS = Object.freeze([
   "x-trace-id",
   "x-request-id",
   "x-actor-id",
-  "x-source-service-id"
+  "x-source-service-id",
+  "x-hwlab-session-token"
 ]);
 
 export function isCloudWebSseRoute(pathname) {
diff --git a/internal/dev-entrypoint/http.test.mjs b/internal/dev-entrypoint/http.test.mjs
index 626d9ae9..3caf3034 100644
--- a/internal/dev-entrypoint/http.test.mjs
+++ b/internal/dev-entrypoint/http.test.mjs
@@ -2,6 +2,7 @@ import assert from "node:assert/strict";
 import { createServer } from "node:http";
 import test from "node:test";
 
+import { upstreamRequestHeaders } from "./cloud-web-proxy.mjs";
 import { cloudWebProxyRoutePolicy } from "./cloud-web-routes.mjs";
 import { proxyHttpRequest } from "./http.mjs";
 
@@ -83,6 +84,23 @@ test("cloud web route policy delegates auth authority to cloud-api", () => {
   });
 });
 
+test("cloud web proxy forwards device-pod session tokens without forwarding bearer credentials", () => {
+  const headers = upstreamRequestHeaders({
+    headers: {
+      accept: "application/json",
+      authorization: "Bearer should-not-forward",
+      cookie: "hwlab_session=session-a",
+      "x-hwlab-session-token": "device-pod-session-a",
+      "x-trace-id": "trc_device_pod_session_proxy"
+    }
+  });
+
+  assert.equal(headers["x-hwlab-session-token"], "device-pod-session-a");
+  assert.equal(headers.cookie, "hwlab_session=session-a");
+  assert.equal(headers["x-trace-id"], "trc_device_pod_session_proxy");
+  assert.equal(headers.authorization, undefined);
+});
+
 test("dev entrypoint proxy allows slow first response beyond legacy 4500ms", async () => {
   const upstream = createServer((request, response) => {
     request.resume();