diff --git a/ChangeLog b/ChangeLog
index 3d81825c..3a6e0807 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,7 @@
+08/26/2024
+- fix parsing OIDCXForwardedHeaders; closes #1250; thanks @maltesmann
+- release 2.4.16.1
+
 08/23/2024
 - release 2.4.16
 
diff --git a/configure.ac b/configure.ac
index 042e33ae..ebd93bce 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1,4 +1,4 @@
-AC_INIT([mod_auth_openidc],[2.4.16],[hans.zandbelt@openidc.com])
+AC_INIT([mod_auth_openidc],[2.4.16.1],[hans.zandbelt@openidc.com])
 
 AC_SUBST(NAMEVER, AC_PACKAGE_TARNAME()-AC_PACKAGE_VERSION())
 
diff --git a/src/cfg/cfg.c b/src/cfg/cfg.c
index b562876c..497f4683 100644
--- a/src/cfg/cfg.c
+++ b/src/cfg/cfg.c
@@ -423,8 +423,12 @@ const char *oidc_cmd_x_forwarded_headers_set(cmd_parms *cmd, void *m, const char
 						    {OIDC_HDR_FORWARDED, OIDC_HTTP_HDR_FORWARDED}};
 	int v = OIDC_CONFIG_POS_INT_UNSET;
 	const char *rv = oidc_cfg_parse_option(cmd->pool, options, OIDC_CFG_OPTIONS_SIZE(options), arg, &v);
-	if ((rv == NULL) && (v != OIDC_CONFIG_POS_INT_UNSET))
+	if ((rv == NULL) && (v != OIDC_CONFIG_POS_INT_UNSET)) {
+		// NB: cannot use |= with UNSET/-1 !
+		if (cfg->x_forwarded_headers == OIDC_CONFIG_POS_INT_UNSET)
+			cfg->x_forwarded_headers = OIDC_HDR_NONE;
 		cfg->x_forwarded_headers |= v;
+	}
 	return OIDC_CONFIG_DIR_RV(cmd, rv);
 }