diff --git a/README.md b/README.md
index aecef9f..2c5cf41 100644
--- a/README.md
+++ b/README.md
@@ -27,7 +27,8 @@ The script parameters are
 - `DD_SET_TRACER_VERSION_DOTNET`: (optional) Version of the .NET tracer to install. If not provided, the latest version is installed.
 - `DD_SET_TRACER_VERSION_JAVA`: (optional) Version of the Java tracer to install (without the `v` prefix, e.g. `1.37.1`). If not provided, the latest version is installed.
 - `DD_SET_TRACER_REPOSITORY_URL_JAVA`: (optional) Base URL of a Maven repository (or proxy/mirror) used to download the Java tracer JAR and its `.sha256`. The path under the base must follow the standard Maven layout for `com.datadoghq:dd-java-agent` (i.e. `<base>/<version>/dd-java-agent-<version>.jar`, plus `<base>/maven-metadata.xml` when `DD_SET_TRACER_VERSION_JAVA` is not pinned). Trailing slashes are tolerated. Defaults to `https://repo1.maven.org/maven2/com/datadoghq/dd-java-agent`.
-- `DD_SET_AUTH_HEADER_JAVA`: (optional) HTTP header used to authenticate against `DD_SET_TRACER_REPOSITORY_URL_JAVA`, provided as a complete `Name: Value` string (e.g. `Authorization: Bearer <token>`). Passed verbatim to `curl -H` / `wget --header` on every Java tracer download. Requires `DD_SET_TRACER_REPOSITORY_URL_JAVA` to be set to a custom repository URL. Redirects are not followed when this option is set, to avoid forwarding credentials to another location; configure `DD_SET_TRACER_REPOSITORY_URL_JAVA` as the final repository URL.
+- `DD_SET_AUTH_HEADER_JAVA`: (optional) HTTP header used to authenticate against `DD_SET_TRACER_REPOSITORY_URL_JAVA`, provided as a complete `Name: Value` string (e.g. `Authorization: Bearer <token>`). Passed verbatim to `curl -H` / `wget --header` on every Java tracer download. Requires `DD_SET_TRACER_REPOSITORY_URL_JAVA` to be set to a custom repository URL. Redirects are followed by default; be aware that the header will be re-sent on each redirect hop with the following caveats: `curl` strips `Authorization` and `Cookie` headers on cross-origin redirects (different host, port, or scheme), but `wget` does not strip any header. Custom header names (e.g. `X-API-Key`, `X-JFrog-Art-Api`) are never stripped by either tool — prefer the `Authorization: …` form when possible. Set `DD_SET_AUTH_HEADER_JAVA_DISABLE_REDIRECTS` to opt out of redirect following entirely.
+- `DD_SET_AUTH_HEADER_JAVA_DISABLE_REDIRECTS`: (optional) When set to any non-empty value, disables HTTP redirect following for Java tracer downloads that send `DD_SET_AUTH_HEADER_JAVA`. Use this if your repository never redirects and you want to guarantee the auth header is only ever sent to the configured `DD_SET_TRACER_REPOSITORY_URL_JAVA` host.
 - `DD_SET_TRACER_VERSION_JS`: (optional) Version of the JS tracer to install. If not provided, the latest version is installed.
 - `DD_SET_TRACER_VERSION_PYTHON`: (optional) Version of the Python tracer to install. If not provided, the latest version is installed.
 - `DD_SET_COVERAGE_VERSION_PYTHON`: (optional) Version of the Python `coverage` package to install. Defaults to `7.13.5`.
diff --git a/install_test_visibility.sh b/install_test_visibility.sh
index 8ffdaf2..f1958ff 100755
--- a/install_test_visibility.sh
+++ b/install_test_visibility.sh
@@ -156,17 +156,24 @@ download_file() {
   local url=$1
   local filepath=$2
   local auth_header="${3:-}"
+  local disable_redirects="${DD_SET_AUTH_HEADER_JAVA_DISABLE_REDIRECTS:-}"
   if command -v curl >/dev/null 2>&1; then
     if [ -n "$auth_header" ]; then
-      # Do not follow redirects while sending a caller-provided secret header.
-      curl -fLo "$filepath" --max-redirs 0 -H "$auth_header" "$url"
+      if [ -n "$disable_redirects" ]; then
+        curl -fLo "$filepath" --max-redirs 0 -H "$auth_header" "$url"
+      else
+        curl -fLo "$filepath" -H "$auth_header" "$url"
+      fi
     else
       curl -fLo "$filepath" "$url"
     fi
   elif command -v wget >/dev/null 2>&1; then
     if [ -n "$auth_header" ]; then
-      # Do not follow redirects while sending a caller-provided secret header.
-      wget --max-redirect=0 -O "$filepath" --header="$auth_header" "$url"
+      if [ -n "$disable_redirects" ]; then
+        wget --max-redirect=0 -O "$filepath" --header="$auth_header" "$url"
+      else
+        wget -O "$filepath" --header="$auth_header" "$url"
+      fi
     else
       wget -O "$filepath" "$url"
     fi