diff --git a/src/exec_auth.ts b/src/exec_auth.ts
index c0d9896563..054818ce47 100644
--- a/src/exec_auth.ts
+++ b/src/exec_auth.ts
@@ -49,6 +49,9 @@ export class ExecAuth implements Authenticator {
         }
         const token = this.getToken(credential);
         if (token) {
+            if (!opts.headers) {
+                opts.headers = [];
+            }
             opts.headers!.Authorization = `Bearer ${token}`;
         }
     }
diff --git a/src/exec_auth_test.ts b/src/exec_auth_test.ts
index 357b2ac387..ad0d43fbd1 100644
--- a/src/exec_auth_test.ts
+++ b/src/exec_auth_test.ts
@@ -6,9 +6,11 @@ import * as shell from 'shelljs';
 
 import execa = require('execa');
 import request = require('request');
+import https = require('https');
 
 import { ExecAuth } from './exec_auth';
 import { User } from './config_types';
+import { fail } from 'assert';
 
 describe('ExecAuth', () => {
     it('should claim correctly', () => {
@@ -246,4 +248,37 @@ describe('ExecAuth', () => {
         expect(optsOut.env.PATH).to.equal(process.env.PATH);
         expect(optsOut.env.BLABBLE).to.equal(process.env.BLABBLE);
     });
+
+    it('should handle empty headers array correctly', async () => {
+        const auth = new ExecAuth();
+        (auth as any).execFn = (
+            command: string,
+            args: string[],
+            opts: execa.SyncOptions,
+        ): execa.ExecaSyncReturnValue => {
+            return {
+                code: 0,
+                stdout: JSON.stringify({ status: { token: 'foo' } }),
+            } as execa.ExecaSyncReturnValue;
+        };
+        const opts = {} as https.RequestOptions;
+        auth.applyAuthentication(
+            {
+                name: 'user',
+                authProvider: {
+                    config: {
+                        exec: {
+                            command: 'echo',
+                        },
+                    },
+                },
+            },
+            opts,
+        );
+        if (!opts.headers) {
+            fail('unexpected null headers!');
+        } else {
+            expect(opts.headers.Authorization).to.equal('Bearer foo');
+        }
+    });
 });