diff --git a/internal/config/config_stdin.go b/internal/config/config_stdin.go
index 23469bc40..adad12cb4 100644
--- a/internal/config/config_stdin.go
+++ b/internal/config/config_stdin.go
@@ -76,10 +76,6 @@ type StdinOpenTelemetryConfig struct {
 	// Endpoint is the OTLP/HTTP collector URL. MUST be HTTPS. Supports ${VAR} expansion.
 	Endpoint string `json:"endpoint"`
 
-	// Headers is a comma-separated list of key=value HTTP headers for export requests
-	// (e.g. "Authorization=Bearer ${OTEL_TOKEN},X-Custom=value"). Supports ${VAR} expansion.
-	Headers string `json:"headers,omitempty"`
-
 	// TraceID is the parent trace ID (32-char lowercase hex, W3C format). Supports ${VAR}.
 	TraceID string `json:"traceId,omitempty"`
 
diff --git a/internal/config/config_tracing.go b/internal/config/config_tracing.go
index 601f9afa5..d70840782 100644
--- a/internal/config/config_tracing.go
+++ b/internal/config/config_tracing.go
@@ -99,7 +99,6 @@ func init() {
 		}
 		cfg.Gateway.Tracing = &TracingConfig{
 			Endpoint:    otel.Endpoint,
-			Headers:     otel.Headers,
 			TraceID:     otel.TraceID,
 			SpanID:      otel.SpanID,
 			ServiceName: otel.ServiceName,
diff --git a/internal/config/config_tracing_test.go b/internal/config/config_tracing_test.go
index da65198b8..8e764cf48 100644
--- a/internal/config/config_tracing_test.go
+++ b/internal/config/config_tracing_test.go
@@ -365,7 +365,6 @@ func TestStdinConverter_OTelConfig(t *testing.T) {
 		Gateway: &StdinGatewayConfig{
 			OpenTelemetry: &StdinOpenTelemetryConfig{
 				Endpoint:    "https://otel.example.com",
-				Headers:     "Authorization=Bearer tok",
 				TraceID:     "4bf92f3577b34da6a3ce929d0e0e4736",
 				SpanID:      "00f067aa0ba902b7",
 				ServiceName: "my-service",
@@ -376,7 +375,6 @@ func TestStdinConverter_OTelConfig(t *testing.T) {
 
 	require.NotNil(t, cfg.Gateway.Tracing, "TracingConfig must be populated by the stdin converter")
 	assert.Equal(t, "https://otel.example.com", cfg.Gateway.Tracing.Endpoint)
-	assert.Equal(t, "Authorization=Bearer tok", cfg.Gateway.Tracing.Headers)
 	assert.Equal(t, "4bf92f3577b34da6a3ce929d0e0e4736", cfg.Gateway.Tracing.TraceID)
 	assert.Equal(t, "00f067aa0ba902b7", cfg.Gateway.Tracing.SpanID)
 	assert.Equal(t, "my-service", cfg.Gateway.Tracing.ServiceName)
diff --git a/internal/config/load_from_stdin_coverage_test.go b/internal/config/load_from_stdin_coverage_test.go
index bf215a7cc..a7acacb82 100644
--- a/internal/config/load_from_stdin_coverage_test.go
+++ b/internal/config/load_from_stdin_coverage_test.go
@@ -182,7 +182,8 @@ func TestLoadFromStdin_ValidateGatewayConfigError_AllZeroTraceId(t *testing.T) {
 }
 
 // TestLoadFromStdin_OpenTelemetryHeaders verifies that gateway.opentelemetry.headers
-// passes schema validation and is converted into the runtime tracing config.
+// is rejected by schema validation (spec §4.1.3.7 v1.14.0 Breaking Change).
+// Authentication headers must be provided via OTEL_EXPORTER_OTLP_HEADERS env var.
 func TestLoadFromStdin_OpenTelemetryHeaders(t *testing.T) {
 	jsonConfig := `{
 		"mcpServers": {
@@ -201,19 +202,13 @@ func TestLoadFromStdin_OpenTelemetryHeaders(t *testing.T) {
 		}
 	}`
 
-	var (
-		cfg     *Config
-		loadErr error
-	)
+	var loadErr error
 	stdinFromString(t, jsonConfig, func() {
-		cfg, loadErr = LoadFromStdin()
+		_, loadErr = LoadFromStdin()
 	})
 
-	require.NoError(t, loadErr)
-	require.NotNil(t, cfg)
-	require.NotNil(t, cfg.Gateway)
-	require.NotNil(t, cfg.Gateway.Tracing)
-	assert.Equal(t, "X-Test=value", cfg.Gateway.Tracing.Headers)
+	require.Error(t, loadErr, "headers field in opentelemetry config must be rejected")
+	assert.ErrorContains(t, loadErr, "headers")
 }
 
 // TestNormalizeLocalType_NonObjectServerValue covers the continue branch (line 616-617)
diff --git a/internal/config/schema/mcp-gateway-config.schema.json b/internal/config/schema/mcp-gateway-config.schema.json
index e24e6b002..101d5ed0c 100644
--- a/internal/config/schema/mcp-gateway-config.schema.json
+++ b/internal/config/schema/mcp-gateway-config.schema.json
@@ -456,11 +456,6 @@
           "description": "Logical service name reported in the 'service.name' resource attribute of all emitted spans. Identifies the gateway in the tracing backend. Defaults to 'mcp-gateway' when not specified.",
           "minLength": 1,
           "default": "mcp-gateway"
-        },
-        "headers": {
-          "type": "string",
-          "description": "Comma-separated key=value HTTP headers for OTLP export requests. Supports ${VAR} expansion.",
-          "minLength": 1
         }
       },
       "required": [
diff --git a/internal/config/validation.go b/internal/config/validation.go
index 12e27a062..7cdd4988a 100644
--- a/internal/config/validation.go
+++ b/internal/config/validation.go
@@ -441,7 +441,6 @@ func validateGatewayConfig(gateway *StdinGatewayConfig) error {
 	if gateway.OpenTelemetry != nil {
 		tracingCfg := &TracingConfig{
 			Endpoint:    gateway.OpenTelemetry.Endpoint,
-			Headers:     gateway.OpenTelemetry.Headers,
 			TraceID:     gateway.OpenTelemetry.TraceID,
 			SpanID:      gateway.OpenTelemetry.SpanID,
 			ServiceName: gateway.OpenTelemetry.ServiceName,