diff --git a/pkg/proxy/backup_test.go b/pkg/proxy/backup_test.go
index 28bc8d9d0..e76b9c140 100644
--- a/pkg/proxy/backup_test.go
+++ b/pkg/proxy/backup_test.go
@@ -78,6 +78,7 @@ func TestSetEnv_AcceptsAllowlistedCredentials(t *testing.T) {
 		"AWS_ENDPOINTS",
 		"AWS_CERT",
 		"VIRTUAL_HOSTED_STYLE",
+		"AWS_SIGN_ACCEPT_ENCODING",
 		"CIFS_USERNAME",
 		"CIFS_PASSWORD",
 		"AZBLOB_ACCOUNT_NAME",
diff --git a/pkg/proxy/env_allowlist.go b/pkg/proxy/env_allowlist.go
index 12181f7ab..ae0e8406a 100644
--- a/pkg/proxy/env_allowlist.go
+++ b/pkg/proxy/env_allowlist.go
@@ -28,6 +28,10 @@ var backupEnvAllowlist = map[string]struct{}{
 	btypes.AWSCert:            {},
 	btypes.VirtualHostedStyle: {},
 
+	// Selects whether Accept-Encoding is part of the SigV4 signature. It is a
+	// signing option, not a credential, and carries no secret.
+	btypes.AWSSignAcceptEncoding: {},
+
 	// CIFS
 	btypes.CIFSUsername: {},
 	btypes.CIFSPassword: {},