diff --git a/src/shrpx_downstream.cc b/src/shrpx_downstream.cc
index 34669cf2..14c01498 100644
--- a/src/shrpx_downstream.cc
+++ b/src/shrpx_downstream.cc
@@ -619,7 +619,7 @@ void Downstream::rewrite_location_response_header(
     return;
   }
   std::string new_uri;
-  if (get_config()->no_host_rewrite) {
+  if (get_config()->no_host_rewrite || request_method_ == "CONNECT") {
     if (!request_http2_authority_.empty()) {
       new_uri = http2::rewrite_location_uri(
           (*hd).value, u, request_http2_authority_, request_http2_authority_,
diff --git a/src/shrpx_http2_downstream_connection.cc b/src/shrpx_http2_downstream_connection.cc
index dd65c7bd..57cc9eaf 100644
--- a/src/shrpx_http2_downstream_connection.cc
+++ b/src/shrpx_http2_downstream_connection.cc
@@ -253,9 +253,13 @@ int Http2DownstreamConnection::push_request_headers() {
 
   downstream_->set_request_pending(false);
 
+  auto no_host_rewrite = get_config()->no_host_rewrite ||
+                         get_config()->http2_proxy ||
+                         get_config()->client_proxy ||
+                         downstream_->get_request_method() == "CONNECT";
+
   const char *authority = nullptr, *host = nullptr;
-  if (!get_config()->no_host_rewrite && !get_config()->http2_proxy &&
-      !get_config()->client_proxy) {
+  if (!no_host_rewrite) {
     // HTTP/2 backend does not support multiple address, so we always
     // use index = 0.
     if (!downstream_->get_request_http2_authority().empty()) {
@@ -369,8 +373,7 @@ int Http2DownstreamConnection::push_request_headers() {
       nva.push_back(http2::make_nv_ls(":path", path));
     }
 
-    if (!get_config()->no_host_rewrite && !get_config()->http2_proxy &&
-        !get_config()->client_proxy) {
+    if (!no_host_rewrite) {
       if (authority) {
         nva.push_back(http2::make_nv_lc(":authority", authority));
       }
diff --git a/src/shrpx_http_downstream_connection.cc b/src/shrpx_http_downstream_connection.cc
index be8981cd..4b5c06f8 100644
--- a/src/shrpx_http_downstream_connection.cc
+++ b/src/shrpx_http_downstream_connection.cc
@@ -212,7 +212,8 @@ int HttpDownstreamConnection::attach_downstream(Downstream *downstream) {
 int HttpDownstreamConnection::push_request_headers() {
   const char *authority = nullptr, *host = nullptr;
   if (!get_config()->no_host_rewrite && !get_config()->http2_proxy &&
-      !get_config()->client_proxy) {
+      !get_config()->client_proxy &&
+      downstream_->get_request_method() != "CONNECT") {
     if (!downstream_->get_request_http2_authority().empty()) {
       authority = get_config()->downstream_addrs[addr_idx_].hostport.get();
     }