diff --git a/examples/outgoing-request/app.py b/examples/outgoing-request/app.py
index ce26087..6855695 100644
--- a/examples/outgoing-request/app.py
+++ b/examples/outgoing-request/app.py
@@ -1,4 +1,4 @@
-from spin_sdk import http   
+from spin_sdk import http
 from spin_sdk.http import Request, Response, send
 
 class WasiHttpHandler030Rc20260315(http.Handler):
@@ -12,4 +12,6 @@ async def handle_request(self, request: Request) -> Response:
                 bytes("Please specify `url` header", "utf-8")
             )
 
-        return await send(Request("GET", url, {}, None))
+        resp = await send(Request("GET", url, {}, None))
+        resp.headers = http.strip_forbidden_headers(resp.headers)
+        return resp
diff --git a/src/spin_sdk/http/__init__.py b/src/spin_sdk/http/__init__.py
index 88629de..b47b402 100644
--- a/src/spin_sdk/http/__init__.py
+++ b/src/spin_sdk/http/__init__.py
@@ -206,6 +206,28 @@ async def send(request: Request) -> Response:
         bytes(body)
     )
 
+def strip_forbidden_headers(headers:MutableMapping[str, str]) -> MutableMapping[str, str]:
+    """
+    Strips forbidden headers for requests and responses originating from guest apps, per wasmtime/Spin
+    """
+    # See https://github.com/bytecodealliance/wasmtime/blob/e9e1665c5ef150d618bd8c21fb355c063596d6f7/crates/wasi-http/src/lib.rs#L42-L52
+    for header in [
+        "connection",
+        "keep-alive",
+        "proxy-authenticate",
+        "proxy-authorization",
+        "proxy-connection",
+        "transfer-encoding",
+        "upgrade",
+        "host",
+        "http2-settings"
+    ]:
+        try:
+            del headers[header]
+        except KeyError:
+            pass
+    return headers
+
 async def copy(bytes:bytes, tx:ByteStreamWriter):
     with tx:
         if bytes is not None: