diff --git a/hub/package-lock.json b/hub/package-lock.json
index 7f2ae60..f569594 100644
--- a/hub/package-lock.json
+++ b/hub/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@paradigm/hub",
-  "version": "0.0.19",
+  "version": "0.0.18",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@paradigm/hub",
-      "version": "0.0.19",
+      "version": "0.0.18",
       "dependencies": {
         "@anthropic-ai/claude-agent-sdk": "^0.3.202",
         "@fastify/cookie": "^11.0.2",
diff --git a/hub/package.json b/hub/package.json
index ce580e1..6126130 100644
--- a/hub/package.json
+++ b/hub/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@paradigm/hub",
-  "version": "0.0.19",
+  "version": "0.0.18",
   "private": true,
   "type": "module",
   "engines": {
diff --git a/hub/src/agent/security.ts b/hub/src/agent/security.ts
index 89d0118..7601c3e 100644
--- a/hub/src/agent/security.ts
+++ b/hub/src/agent/security.ts
@@ -8,7 +8,6 @@ const PROVIDER_ENV_KEYS = new Set([
   "ANTHROPIC_BASE_URL",
   "ANTHROPIC_AUTH_TOKEN",
   "ANTHROPIC_API_KEY",
-  "ANTHROPIC_CUSTOM_HEADERS",
 ]);
 
 const SAFE_HOST_ENV_KEYS = [
diff --git a/hub/src/connections/providerProxy.ts b/hub/src/connections/providerProxy.ts
index abc70e6..ab89e8f 100644
--- a/hub/src/connections/providerProxy.ts
+++ b/hub/src/connections/providerProxy.ts
@@ -20,7 +20,6 @@ const REPLACED_REQUEST_HEADERS = new Set([
   "content-length",
   "host",
   "x-api-key",
-  "x-cph-run-capability",
 ]);
 
 export interface ProviderUpstreamCredential {
@@ -45,7 +44,6 @@ export interface ProviderProxyDiagnostic {
   readonly authShape?: {
     readonly bearerLength: number;
     readonly apiKeyLength: number;
-    readonly customCapabilityLength: number;
     readonly expectedLength: number;
   };
 }
@@ -89,7 +87,6 @@ export async function openProviderProxyLease(
       ANTHROPIC_BASE_URL: `http://127.0.0.1:${address.port}`,
       ANTHROPIC_AUTH_TOKEN: capability,
       ANTHROPIC_API_KEY: capability,
-      ANTHROPIC_CUSTOM_HEADERS: `X-CPH-Run-Capability: ${capability}`,
     },
     sensitiveValues: [capability],
     async close(): Promise<void> {
@@ -110,12 +107,7 @@ async function forwardProviderRequest(
   upstream: ProviderUpstreamCredential,
   options: ProviderProxyOptions,
 ): Promise<void> {
-  if (!authorized(
-    request.headers.authorization,
-    header(request.headers["x-api-key"]),
-    header(request.headers["x-cph-run-capability"]),
-    capability,
-  )) {
+  if (!authorized(request.headers.authorization, header(request.headers["x-api-key"]), capability)) {
     options.onDiagnostic?.({
       code: "provider_proxy_unauthorized",
       category: "authorization",
@@ -124,7 +116,6 @@ async function forwardProviderRequest(
           ? request.headers.authorization.length - "Bearer ".length
           : 0,
         apiKeyLength: header(request.headers["x-api-key"])?.length ?? 0,
-        customCapabilityLength: header(request.headers["x-cph-run-capability"])?.length ?? 0,
         expectedLength: capability.length,
       },
     });
@@ -192,16 +183,11 @@ async function forwardProviderRequest(
 function authorized(
   authorization: string | undefined,
   apiKey: string | undefined,
-  customCapability: string | undefined,
   capability: string,
 ): boolean {
-  const bearer = authorization?.startsWith("Bearer ")
+  const value = authorization?.startsWith("Bearer ")
     ? authorization.slice("Bearer ".length)
-    : undefined;
-  return [bearer, apiKey, customCapability].some((value) => matchesCapability(value, capability));
-}
-
-function matchesCapability(value: string | undefined, capability: string): boolean {
+    : apiKey;
   if (value === undefined) return false;
   const supplied = Buffer.from(value);
   const expected = Buffer.from(capability);
diff --git a/hub/test/unit/provider-proxy.test.ts b/hub/test/unit/provider-proxy.test.ts
index 91a10b0..bf4e6b7 100644
--- a/hub/test/unit/provider-proxy.test.ts
+++ b/hub/test/unit/provider-proxy.test.ts
@@ -54,7 +54,6 @@ describe("run-scoped provider proxy", () => {
       ANTHROPIC_BASE_URL: expect.stringMatching(/^http:\/\/127\.0\.0\.1:\d+$/),
       ANTHROPIC_AUTH_TOKEN: expect.any(String),
       ANTHROPIC_API_KEY: expect.any(String),
-      ANTHROPIC_CUSTOM_HEADERS: expect.stringMatching(/^X-CPH-Run-Capability: /),
     });
     expect(lease.sdkEnv.ANTHROPIC_AUTH_TOKEN).toBe(lease.sdkEnv.ANTHROPIC_API_KEY);
 
@@ -109,7 +108,7 @@ describe("run-scoped provider proxy", () => {
     expect(diagnostics).toEqual([{
       code: "provider_proxy_unauthorized",
       category: "authorization",
-      authShape: { bearerLength: 0, apiKeyLength: 0, customCapabilityLength: 0, expectedLength: 43 },
+      authShape: { bearerLength: 0, apiKeyLength: 0, expectedLength: 43 },
     }]);
   });