diff --git a/net/tshttpproxy/tshttpproxy.go b/net/tshttpproxy/tshttpproxy.go
index 03d604568..b00ecded0 100644
--- a/net/tshttpproxy/tshttpproxy.go
+++ b/net/tshttpproxy/tshttpproxy.go
@@ -9,6 +9,7 @@ package tshttpproxy
 import (
 	"net/http"
 	"net/url"
+	"os"
 )
 
 // sysProxyFromEnv, if non-nil, specifies a platform-specific ProxyFromEnvironment
@@ -36,6 +37,9 @@ var sysAuthHeader func(*url.URL) (string, error)
 
 // GetAuthHeader returns the Authorization header value to send to proxy u.
 func GetAuthHeader(u *url.URL) (string, error) {
+	if fake := os.Getenv("TS_DEBUG_FAKE_PROXY_AUTH"); fake != "" {
+		return fake, nil
+	}
 	if sysAuthHeader != nil {
 		return sysAuthHeader(u)
 	}
diff --git a/net/tshttpproxy/tshttpproxy_future.go b/net/tshttpproxy/tshttpproxy_future.go
index c50d4e5d9..f905d2fbb 100644
--- a/net/tshttpproxy/tshttpproxy_future.go
+++ b/net/tshttpproxy/tshttpproxy_future.go
@@ -14,7 +14,6 @@ import (
 	"log"
 	"net/http"
 	"net/url"
-	"os"
 )
 
 func init() {
@@ -25,9 +24,6 @@ func init() {
 				log.Printf("failed to get proxy Auth header for %v; ignoring: %v", proxyURL, err)
 				return nil, nil
 			}
-			if fake := os.Getenv("TS_DEBUG_FAKE_PROXY_AUTH"); fake != "" {
-				v = fake
-			}
 			if v == "" {
 				return nil, nil
 			}