diff --git a/packages/dotagents/src/targets/definitions/helpers.test.ts b/packages/dotagents/src/targets/definitions/helpers.test.ts
index fef2aef7..60ff3212 100644
--- a/packages/dotagents/src/targets/definitions/helpers.test.ts
+++ b/packages/dotagents/src/targets/definitions/helpers.test.ts
@@ -55,7 +55,7 @@ describe("extractCodexHeaders", () => {
       "X-Api-Key": "${GOOGLE_API_KEY}",
     });
     expect(httpHeaders).toBeUndefined();
-    expect(envHttpHeaders).toEqual({ GOOGLE_API_KEY: "X-Api-Key" });
+    expect(envHttpHeaders).toEqual({ "X-Api-Key": "GOOGLE_API_KEY" });
   });
 
   it("keeps static values in httpHeaders", () => {
@@ -80,7 +80,7 @@ describe("extractCodexHeaders", () => {
       Authorization: "Bearer tok",
       "X-Mixed": "prefix ${VAR} suffix",
     });
-    expect(envHttpHeaders).toEqual({ API_KEY: "X-Api-Key" });
+    expect(envHttpHeaders).toEqual({ "X-Api-Key": "API_KEY" });
     expect(httpHeaders).toEqual({
       Authorization: "Bearer tok",
       "X-Mixed": "prefix ${VAR} suffix",
diff --git a/packages/dotagents/src/targets/definitions/helpers.ts b/packages/dotagents/src/targets/definitions/helpers.ts
index d94c1100..ad1f0f94 100644
--- a/packages/dotagents/src/targets/definitions/helpers.ts
+++ b/packages/dotagents/src/targets/definitions/helpers.ts
@@ -46,7 +46,7 @@ export function interpolateHeaders(
 
 /**
  * Split headers for Codex's model: pure `${VAR}` refs go to `envHttpHeaders`
- * (mapping env var name to header name), everything else stays in `httpHeaders`.
+ * (mapping header name to env var name), everything else stays in `httpHeaders`.
  * Mixed values like `"Bearer ${TOKEN}"` can't be represented in Codex's
  * env_http_headers format and fall through as literal strings in httpHeaders.
  */
@@ -60,7 +60,7 @@ export function extractCodexHeaders(
   for (const [key, value] of Object.entries(headers)) {
     const match = pureRefRe.exec(value);
     if (match) {
-      (envHttpHeaders ??= {})[match[1]!] = key;
+      (envHttpHeaders ??= {})[key] = match[1]!;
     } else {
       (httpHeaders ??= {})[key] = value;
     }
diff --git a/packages/dotagents/src/targets/mcp-writer.test.ts b/packages/dotagents/src/targets/mcp-writer.test.ts
index ec0ca74e..4d34e697 100644
--- a/packages/dotagents/src/targets/mcp-writer.test.ts
+++ b/packages/dotagents/src/targets/mcp-writer.test.ts
@@ -501,8 +501,8 @@ describe("writeMcpConfigs", () => {
     const content = parseTomlObject(raw);
     expect(childObject(content, "mcp_servers")["authed-api"]).toEqual({
       url: "https://${API_HOST}/mcp",
-      // Pure ref: X-Api-Key = "${API_KEY}" → env_http_headers.API_KEY = "X-Api-Key"
-      env_http_headers: { API_KEY: "X-Api-Key" },
+      // Pure ref: X-Api-Key = "${API_KEY}" → env_http_headers.X-Api-Key = "API_KEY"
+      env_http_headers: { "X-Api-Key": "API_KEY" },
       // Mixed ref stays as literal in http_headers
       http_headers: { Authorization: "Bearer ${TOKEN}" },
     });