diff --git a/CHANGELOG.md b/CHANGELOG.md
index d1ae9cedd..29a7b132c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,9 @@ in each release's notes.
 
 Changes to be including in future/planned release notes will be added here.
 
+## Unreleased
+- `salesforce`: forward `Sforce-Limit-Info` and `Sforce-Query-Options` request headers to Salesforce on Task/Event/composite/query endpoints. Lets connections set a smaller `batchSize` via `Sforce-Query-Options` to mitigate `SocketTimeoutException`s on large query responses; previously these headers were silently dropped.
+
 ## [0.7.0](https://github.com/Worklytics/psoxy/releases/tag/v0.7.0)
 - Release cut/QA/publish orchestration (`prep.sh`, `rc-to-main.sh`, local `publish.sh`, example-repo PR helpers) moved to the internal `Worklytics/proxy-dev` repo. GitHub Actions in this repo still publish Maven packages and deployment bundles.
 - **Breaking (`gdrive`):** required OAuth scope changes from `drive.metadata.readonly` to `drive.readonly`. Google's Drive API `revisions.list` returns incomplete (often empty) revision histories for Docs/Sheets/Slides under metadata-only scopes; Google has confirmed this is intended, permanent behavior and recommends `drive.readonly` for complete histories. Existing deployments must update both the proxy `OAUTH_SCOPES` (Terraform apply from this release does this) **and** the Domain-wide Delegation grant in the Google Workspace Admin console. See [gdrive README](docs/sources/google-workspace/gdrive/README.md).
diff --git a/docs/sources/salesforce/salesforce.yaml b/docs/sources/salesforce/salesforce.yaml
index 7687f3eca..b2bf08de9 100644
--- a/docs/sources/salesforce/salesforce.yaml
+++ b/docs/sources/salesforce/salesforce.yaml
@@ -4,6 +4,9 @@ endpoints:
     allowedMethods:
       - "POST"
     allowedQueryParams: []
+    allowedRequestHeaders:
+      - "Sforce-Limit-Info"
+      - "Sforce-Query-Options"
     transforms:
       - !<pseudonymize>
         jsonPaths:
@@ -52,6 +55,9 @@ endpoints:
         $ref: "#/definitions/Account"
   - pathRegex: "^/services/data/v(\\d*.\\d{1})/query/[^?]+$"
     allowedQueryParams: []
+    allowedRequestHeaders:
+      - "Sforce-Limit-Info"
+      - "Sforce-Query-Options"
     transforms:
       - !<pseudonymize>
         jsonPaths:
@@ -99,6 +105,9 @@ endpoints:
     +)*.*$"
     allowedQueryParams:
       - "q"
+    allowedRequestHeaders:
+      - "Sforce-Limit-Info"
+      - "Sforce-Query-Options"
     transforms:
       - !<pseudonymize>
         jsonPaths:
@@ -133,6 +142,9 @@ endpoints:
     +)*.*$"
     allowedQueryParams:
       - "q"
+    allowedRequestHeaders:
+      - "Sforce-Limit-Info"
+      - "Sforce-Query-Options"
     transforms:
       - !<pseudonymize>
         jsonPaths:
@@ -187,6 +199,9 @@ endpoints:
     +|\\b).*"
     allowedQueryParams:
       - "q"
+    allowedRequestHeaders:
+      - "Sforce-Limit-Info"
+      - "Sforce-Query-Options"
     transforms:
       - !<pseudonymize>
         jsonPaths:
@@ -211,6 +226,9 @@ endpoints:
     +|\\b).*"
     allowedQueryParams:
       - "q"
+    allowedRequestHeaders:
+      - "Sforce-Limit-Info"
+      - "Sforce-Query-Options"
     transforms:
       - !<pseudonymize>
         jsonPaths: