diff --git a/lib/s3_cors_rulesets.rb b/lib/s3_cors_rulesets.rb
index 91216de082c..dfd3db3d386 100644
--- a/lib/s3_cors_rulesets.rb
+++ b/lib/s3_cors_rulesets.rb
@@ -19,7 +19,13 @@ class S3CorsRulesets
   }.freeze
 
   DIRECT_UPLOAD = {
-    allowed_headers: %w[Authorization Content-Disposition Content-Type],
+    allowed_headers: %w[
+      Authorization
+      Content-Disposition
+      Content-Type
+      X-Amz-Acl
+      X-Amz-Meta-Sha1-Checksum
+    ],
     expose_headers: ["ETag"],
     allowed_methods: %w[GET HEAD PUT],
     allowed_origins: ["*"],