diff --git a/src/main/java/com/google/devtools/build/lib/bazel/repository/starlark/StarlarkBaseExternalContext.java b/src/main/java/com/google/devtools/build/lib/bazel/repository/starlark/StarlarkBaseExternalContext.java
index 2d9f73b4fe25a3..e23e2978bdd025 100644
--- a/src/main/java/com/google/devtools/build/lib/bazel/repository/starlark/StarlarkBaseExternalContext.java
+++ b/src/main/java/com/google/devtools/build/lib/bazel/repository/starlark/StarlarkBaseExternalContext.java
@@ -223,6 +223,46 @@ private static ImmutableMap<URI, Map<String, List<String>>> getAuthHeaders(
     return res;
   }
 
+  private static ImmutableMap<URI, Map<String, List<String>>> getHeaders(
+    Map<String, Map<String, List<String>>> auth) throws RepositoryFunctionException, EvalException {
+    ImmutableMap.Builder<URI, Map<String, List<String>>> headers = new ImmutableMap.Builder<>();
+    for (Map.Entry<String, Map<String, List<String>>> entry : auth.entrySet()) {
+      try {
+        URL url = new URL(entry.getKey());
+        Map<String, List<String>> headerMap = entry.getValue();
+        headers.put(url.toURI(), headerMap);
+      } catch (MalformedURLException e) {
+        throw new RepositoryFunctionException(e, Transience.PERSISTENT);
+      } catch (URISyntaxException e) {
+        throw new EvalException(e);
+      }
+    }
+    return headers.buildOrThrow();
+  }
+
+  private static ImmutableMap<String, Map<String, List<String>>> getHeaderContents(Dict<?, ?> x, String what)
+  throws EvalException {
+    // Dict.cast returns Dict<String, raw Dict>.
+    @SuppressWarnings({"unchecked", "rawtypes"})
+    Map<String, Dict<?, ?>> urlHeaderMapUnchecked = (Map) Dict.cast(x, String.class, Dict.class, what);
+
+    ImmutableMap.Builder<String, Map<String, List<String>>> urlHeadersMap = new ImmutableMap.Builder<>();
+
+    for (Map.Entry<String, Dict<?, ?>> urlHeaderEntry : urlHeaderMapUnchecked.entrySet()) {
+    
+      ImmutableMap.Builder<String, List<String>> headers = new ImmutableMap.Builder<>();
+      Dict<String, List> headersUnchecked = Dict.cast(urlHeaderEntry.getValue(), String.class, List.class, "header entry");
+
+      for (Map.Entry<String, List> headerEntry : headersUnchecked.entrySet()) {
+        List<String> headerValue = headerEntry.getValue().stream().map(r -> r.toString()).toList();
+        headers.put(headerEntry.getKey(), headerValue);
+      }
+
+      urlHeadersMap.put(urlHeaderEntry.getKey(), headers.buildOrThrow());
+    }
+    return urlHeadersMap.buildOrThrow();
+}
+
   private static ImmutableList<String> checkAllUrls(Iterable<?> urlList) throws EvalException {
     ImmutableList.Builder<String> result = ImmutableList.builder();
 
@@ -424,6 +464,11 @@ private StructImpl calculateDownloadResult(Optional<Checksum> checksum, Path dow
             defaultValue = "{}",
             named = true,
             doc = "An optional dict specifying authentication information for some of the URLs."),
+        @Param(
+              name = "headers",
+              defaultValue = "{}",
+              named = true,
+              doc = "An optional dict specifying http headers for some of the URLs."),
         @Param(
             name = "integrity",
             defaultValue = "''",
@@ -444,12 +489,20 @@ public StructImpl download(
       Boolean allowFail,
       String canonicalId,
       Dict<?, ?> authUnchecked, // <String, Dict> expected
+      Dict<?, ?> headersUnchecked, // <String, Dict> expected
       String integrity,
       StarlarkThread thread)
       throws RepositoryFunctionException, EvalException, InterruptedException {
     ImmutableMap<URI, Map<String, List<String>>> authHeaders =
         getAuthHeaders(getAuthContents(authUnchecked, "auth"));
 
+    ImmutableMap<URI, Map<String, List<String>>> headers = getHeaders(getHeaderContents(headersUnchecked, "headers"));
+
+    ImmutableMap<URI, Map<String, List<String>>> allHeaders = new ImmutableMap.Builder<URI, Map<String, List<String>>>()
+        .putAll(authHeaders)
+        .putAll(headers)
+        .buildOrThrow();
+
     ImmutableList<URL> urls =
         getUrls(
             url,
@@ -483,7 +536,7 @@ public StructImpl download(
       downloadedPath =
           downloadManager.download(
               urls,
-              authHeaders,
+              allHeaders,
               checksum,
               canonicalId,
               Optional.<String>absent(),
@@ -598,6 +651,11 @@ public StructImpl download(
             defaultValue = "{}",
             named = true,
             doc = "An optional dict specifying authentication information for some of the URLs."),
+        @Param(
+              name = "headers",
+              defaultValue = "{}",
+              named = true,
+              doc = "An optional dict specifying http headers for some of the URLs."),
         @Param(
             name = "integrity",
             defaultValue = "''",
@@ -629,13 +687,21 @@ public StructImpl downloadAndExtract(
       String stripPrefix,
       Boolean allowFail,
       String canonicalId,
-      Dict<?, ?> auth, // <String, Dict> expected
+      Dict<?, ?> authUnchecked, // <String, Dict> expected
+      Dict<?, ?> headersUnchecked, // <String, Dict> expected
       String integrity,
       Dict<?, ?> renameFiles, // <String, String> expected
       StarlarkThread thread)
       throws RepositoryFunctionException, InterruptedException, EvalException {
     ImmutableMap<URI, Map<String, List<String>>> authHeaders =
-        getAuthHeaders(getAuthContents(auth, "auth"));
+        getAuthHeaders(getAuthContents(authUnchecked, "auth"));
+
+    ImmutableMap<URI, Map<String, List<String>>> headers = getHeaders(getHeaderContents(headersUnchecked, "headers"));
+
+    ImmutableMap<URI, Map<String, List<String>>> allHeaders = new ImmutableMap.Builder<URI, Map<String, List<String>>>()
+        .putAll(authHeaders)
+        .putAll(headers)
+        .buildOrThrow();
 
     ImmutableList<URL> urls =
         getUrls(
@@ -684,7 +750,7 @@ public StructImpl downloadAndExtract(
       downloadedPath =
           downloadManager.download(
               urls,
-              authHeaders,
+              allHeaders,
               checksum,
               canonicalId,
               Optional.of(type),