diff --git a/cmd/cloudflared/access/carrier.go b/cmd/cloudflared/access/carrier.go
index f328ba84..3a8d072b 100644
--- a/cmd/cloudflared/access/carrier.go
+++ b/cmd/cloudflared/access/carrier.go
@@ -148,9 +148,9 @@ func ssh(c *cli.Context) error {
 func buildRequestHeaders(values []string) http.Header {
 	headers := make(http.Header)
 	for _, valuePair := range values {
-		split := strings.Split(valuePair, ":")
-		if len(split) > 1 {
-			headers.Add(strings.TrimSpace(split[0]), strings.TrimSpace(split[1]))
+		header, value, found := strings.Cut(valuePair, ":")
+		if found {
+			headers.Add(strings.TrimSpace(header), strings.TrimSpace(value))
 		}
 	}
 	return headers
diff --git a/cmd/cloudflared/access/carrier_test.go b/cmd/cloudflared/access/carrier_test.go
index 2bca1fba..23dc9b24 100644
--- a/cmd/cloudflared/access/carrier_test.go
+++ b/cmd/cloudflared/access/carrier_test.go
@@ -12,7 +12,8 @@ func TestBuildRequestHeaders(t *testing.T) {
 	headers.Add("client", "value")
 	headers.Add("secret", "safe-value")
 
-	values := buildRequestHeaders([]string{"client: value", "secret: safe-value", "trash"})
+	values := buildRequestHeaders([]string{"client: value", "secret: safe-value", "trash", "cf-trace-id: 000:000:0:1:asd"})
 	assert.Equal(t, headers.Get("client"), values.Get("client"))
 	assert.Equal(t, headers.Get("secret"), values.Get("secret"))
+	assert.Equal(t, headers.Get("cf-trace-id"), values.Get("000:000:0:1:asd"))
 }