diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6743fc3..526c984 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -13,6 +13,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
+- [#906](https://github.com/spegel-org/spegel/pull/906) Replace HTTP header strings with httpx constants.
+
 ### Deprecated
 
 ### Removed
diff --git a/pkg/httpx/httpx.go b/pkg/httpx/httpx.go
index ebf5de4..be2b475 100644
--- a/pkg/httpx/httpx.go
+++ b/pkg/httpx/httpx.go
@@ -1,9 +1,14 @@
 package httpx
 
 const (
-	HeaderContentType   = "Content-Type"
-	HeaderContentLength = "Content-Length"
-	HeaderContentRange  = "Content-Range"
-	HeaderRange         = "Range"
-	HeaderAcceptRanges  = "Accept-Ranges"
+	HeaderContentType     = "Content-Type"
+	HeaderContentLength   = "Content-Length"
+	HeaderContentRange    = "Content-Range"
+	HeaderRange           = "Range"
+	HeaderAcceptRanges    = "Accept-Ranges"
+	HeaderUserAgent       = "User-Agent"
+	HeaderAccept          = "Accept"
+	HeaderAuthorization   = "Authorization"
+	HeaderWWWAuthenticate = "WWW-Authenticate"
+	HeaderXForwardedFor   = "X-Forwarded-For"
 )
diff --git a/pkg/httpx/mux.go b/pkg/httpx/mux.go
index c7d4c0a..ac025e1 100644
--- a/pkg/httpx/mux.go
+++ b/pkg/httpx/mux.go
@@ -79,7 +79,7 @@ func (s *ServeMux) Handle(pattern string, handler HandlerFunc) {
 }
 
 func GetClientIP(req *http.Request) string {
-	forwardedFor := req.Header.Get("X-Forwarded-For")
+	forwardedFor := req.Header.Get(HeaderXForwardedFor)
 	if forwardedFor != "" {
 		comps := strings.Split(forwardedFor, ",")
 		if len(comps) > 1 {
diff --git a/pkg/httpx/mux_test.go b/pkg/httpx/mux_test.go
index a68ab6e..01e7000 100644
--- a/pkg/httpx/mux_test.go
+++ b/pkg/httpx/mux_test.go
@@ -91,7 +91,7 @@ func TestGetClientIP(t *testing.T) {
 			name: "x forwarded for single",
 			request: &http.Request{
 				Header: http.Header{
-					"X-Forwarded-For": []string{"localhost"},
+					HeaderXForwardedFor: []string{"localhost"},
 				},
 			},
 			expected: "localhost",
@@ -100,7 +100,7 @@ func TestGetClientIP(t *testing.T) {
 			name: "x forwarded for multiple",
 			request: &http.Request{
 				Header: http.Header{
-					"X-Forwarded-For": []string{"localhost,127.0.0.1"},
+					HeaderXForwardedFor: []string{"localhost,127.0.0.1"},
 				},
 			},
 			expected: "localhost",
diff --git a/pkg/oci/client.go b/pkg/oci/client.go
index 49bdd37..bc4a60b 100644
--- a/pkg/oci/client.go
+++ b/pkg/oci/client.go
@@ -174,18 +174,18 @@ func (c *Client) fetch(ctx context.Context, method string, dist DistributionPath
 		if err != nil {
 			return nil, ocispec.Descriptor{}, err
 		}
-		req.Header.Set("User-Agent", "spegel")
-		req.Header.Add("Accept", "application/vnd.oci.image.manifest.v1+json")
-		req.Header.Add("Accept", "application/vnd.docker.distribution.manifest.v2+json")
-		req.Header.Add("Accept", "application/vnd.oci.image.index.v1+json")
-		req.Header.Add("Accept", "application/vnd.docker.distribution.manifest.list.v2+json")
+		req.Header.Set(httpx.HeaderUserAgent, "spegel")
+		req.Header.Add(httpx.HeaderAccept, "application/vnd.oci.image.manifest.v1+json")
+		req.Header.Add(httpx.HeaderAccept, "application/vnd.docker.distribution.manifest.v2+json")
+		req.Header.Add(httpx.HeaderAccept, "application/vnd.oci.image.index.v1+json")
+		req.Header.Add(httpx.HeaderAccept, "application/vnd.docker.distribution.manifest.list.v2+json")
 		if len(brr) > 0 {
 			req.Header.Add(httpx.HeaderRange, httpx.FormatMultipartRangeHeader(brr))
 		}
 		token, ok := c.tc.Load(tcKey)
 		if ok {
 			//nolint: errcheck // We know it will be a string.
-			req.Header.Set("Authorization", "Bearer "+token.(string))
+			req.Header.Set(httpx.HeaderAuthorization, "Bearer "+token.(string))
 		}
 		resp, err := c.hc.Do(req)
 		if err != nil {
@@ -193,7 +193,7 @@ func (c *Client) fetch(ctx context.Context, method string, dist DistributionPath
 		}
 		if resp.StatusCode == http.StatusUnauthorized {
 			c.tc.Delete(tcKey)
-			wwwAuth := resp.Header.Get("WWW-Authenticate")
+			wwwAuth := resp.Header.Get(httpx.HeaderWWWAuthenticate)
 			token, err = getBearerToken(ctx, wwwAuth, c.hc)
 			if err != nil {
 				return nil, ocispec.Descriptor{}, err