diff --git a/plugins/inputs/prometheus/README.md b/plugins/inputs/prometheus/README.md
index 04ed95121..987cc48ad 100644
--- a/plugins/inputs/prometheus/README.md
+++ b/plugins/inputs/prometheus/README.md
@@ -19,25 +19,25 @@ See the [CONFIGURATION.md][CONFIGURATION.md] for more details.
 [[inputs.prometheus]]
   ## An array of urls to scrape metrics from.
   urls = ["http://localhost:9100/metrics"]
-  
+
   ## Metric version controls the mapping from Prometheus metrics into Telegraf metrics.
   ## See "Metric Format Configuration" in plugins/inputs/prometheus/README.md for details.
   ## Valid options: 1, 2
   # metric_version = 1
-  
+
   ## Url tag name (tag containing scrapped url. optional, default is "url")
   # url_tag = "url"
-  
+
   ## Whether the timestamp of the scraped metrics will be ignored.
   ## If set to true, the gather time will be used.
   # ignore_timestamp = false
-  
+
   ## An array of Kubernetes services to scrape metrics from.
   # kubernetes_services = ["http://my-service-dns.my-namespace:9100/metrics"]
-  
+
   ## Kubernetes config file to create client from.
   # kube_config = "/path/to/kubernetes.config"
-  
+
   ## Scrape Kubernetes pods for the following prometheus annotations:
   ## - prometheus.io/scrape: Enable scraping for this pod
   ## - prometheus.io/scheme: If the metrics endpoint is secured then you will need to
@@ -45,20 +45,20 @@ See the [CONFIGURATION.md][CONFIGURATION.md] for more details.
   ## - prometheus.io/path: If the metrics path is not /metrics, define it with this annotation.
   ## - prometheus.io/port: If port is not 9102 use this annotation
   # monitor_kubernetes_pods = true
-  
+
   ## Get the list of pods to scrape with either the scope of
   ## - cluster: the kubernetes watch api (default, no need to specify)
   ## - node: the local cadvisor api; for scalability. Note that the config node_ip or the environment variable NODE_IP must be set to the host IP.
   # pod_scrape_scope = "cluster"
-  
+
   ## Only for node scrape scope: node IP of the node that telegraf is running on.
   ## Either this config or the environment variable NODE_IP must be set.
   # node_ip = "10.180.1.1"
- 
+
   ## Only for node scrape scope: interval in seconds for how often to get updated pod list for scraping.
   ## Default is 60 seconds.
   # pod_scrape_interval = 60
-  
+
   ## Restricts Kubernetes monitoring to a single namespace
   ##   ex: monitor_kubernetes_pods_namespace = "default"
   # monitor_kubernetes_pods_namespace = ""
@@ -71,7 +71,7 @@ See the [CONFIGURATION.md][CONFIGURATION.md] for more details.
   # eg. To scrape pods on a specific node
   # kubernetes_field_selector = "spec.nodeName=$HOSTNAME"
 
-  # cache refresh interval to set the interval for re-sync of pods list. 
+  # cache refresh interval to set the interval for re-sync of pods list.
   # Default is 60 minutes.
   # cache_refresh_interval = 60
 
@@ -87,29 +87,32 @@ See the [CONFIGURATION.md][CONFIGURATION.md] for more details.
   #     url = 'http://{{if ne .ServiceAddress ""}}{{.ServiceAddress}}{{else}}{{.Address}}{{end}}:{{.ServicePort}}/{{with .ServiceMeta.metrics_path}}{{.}}{{else}}metrics{{end}}'
   #     [inputs.prometheus.consul.query.tags]
   #       host = "{{.Node}}"
-  
+
   ## Use bearer token for authorization. ('bearer_token' takes priority)
   # bearer_token = "/path/to/bearer/token"
   ## OR
   # bearer_token_string = "abc_123"
-  
+
   ## HTTP Basic Authentication username and password. ('bearer_token' and
   ## 'bearer_token_string' take priority)
   # username = ""
   # password = ""
-  
+
+  ## Optional custom HTTP headers
+  # headers = {"X-Special-Header" = "Special-Value"}
+
   ## Specify timeout duration for slower prometheus clients (default is 3s)
   # response_timeout = "3s"
 
   ## HTTP Proxy support
   # use_system_proxy = false
   # http_proxy_url = ""
-  
+
   ## Optional TLS Config
   # tls_ca = /path/to/cafile
   # tls_cert = /path/to/certfile
   # tls_key = /path/to/keyfile
-  
+
   ## Use TLS but skip chain & host verification
   # insecure_skip_verify = false
 ```
diff --git a/plugins/inputs/prometheus/prometheus.go b/plugins/inputs/prometheus/prometheus.go
index 9ab281ef3..741e16fec 100644
--- a/plugins/inputs/prometheus/prometheus.go
+++ b/plugins/inputs/prometheus/prometheus.go
@@ -58,6 +58,8 @@ type Prometheus struct {
 	Username string `toml:"username"`
 	Password string `toml:"password"`
 
+	HTTPHeaders map[string]string `toml:"http_headers"`
+
 	ResponseTimeout config.Duration `toml:"response_timeout"`
 
 	MetricVersion int `toml:"metric_version"`
@@ -298,6 +300,12 @@ func (p *Prometheus) gatherURL(u URLAndAddress, acc telegraf.Accumulator) error
 		req.SetBasicAuth(p.Username, p.Password)
 	}
 
+	if p.HTTPHeaders != nil {
+		for key, value := range p.HTTPHeaders {
+			req.Header.Add(key, value)
+		}
+	}
+
 	var resp *http.Response
 	if u.URL.Scheme != "unix" {
 		//nolint:bodyclose // False positive (because of if-else) - body will be closed in `defer`
diff --git a/plugins/inputs/prometheus/sample.conf b/plugins/inputs/prometheus/sample.conf
index d2b675871..7ce1488ed 100644
--- a/plugins/inputs/prometheus/sample.conf
+++ b/plugins/inputs/prometheus/sample.conf
@@ -2,25 +2,25 @@
 [[inputs.prometheus]]
   ## An array of urls to scrape metrics from.
   urls = ["http://localhost:9100/metrics"]
-  
+
   ## Metric version controls the mapping from Prometheus metrics into Telegraf metrics.
   ## See "Metric Format Configuration" in plugins/inputs/prometheus/README.md for details.
   ## Valid options: 1, 2
   # metric_version = 1
-  
+
   ## Url tag name (tag containing scrapped url. optional, default is "url")
   # url_tag = "url"
-  
+
   ## Whether the timestamp of the scraped metrics will be ignored.
   ## If set to true, the gather time will be used.
   # ignore_timestamp = false
-  
+
   ## An array of Kubernetes services to scrape metrics from.
   # kubernetes_services = ["http://my-service-dns.my-namespace:9100/metrics"]
-  
+
   ## Kubernetes config file to create client from.
   # kube_config = "/path/to/kubernetes.config"
-  
+
   ## Scrape Kubernetes pods for the following prometheus annotations:
   ## - prometheus.io/scrape: Enable scraping for this pod
   ## - prometheus.io/scheme: If the metrics endpoint is secured then you will need to
@@ -28,20 +28,20 @@
   ## - prometheus.io/path: If the metrics path is not /metrics, define it with this annotation.
   ## - prometheus.io/port: If port is not 9102 use this annotation
   # monitor_kubernetes_pods = true
-  
+
   ## Get the list of pods to scrape with either the scope of
   ## - cluster: the kubernetes watch api (default, no need to specify)
   ## - node: the local cadvisor api; for scalability. Note that the config node_ip or the environment variable NODE_IP must be set to the host IP.
   # pod_scrape_scope = "cluster"
-  
+
   ## Only for node scrape scope: node IP of the node that telegraf is running on.
   ## Either this config or the environment variable NODE_IP must be set.
   # node_ip = "10.180.1.1"
- 
+
   ## Only for node scrape scope: interval in seconds for how often to get updated pod list for scraping.
   ## Default is 60 seconds.
   # pod_scrape_interval = 60
-  
+
   ## Restricts Kubernetes monitoring to a single namespace
   ##   ex: monitor_kubernetes_pods_namespace = "default"
   # monitor_kubernetes_pods_namespace = ""
@@ -54,7 +54,7 @@
   # eg. To scrape pods on a specific node
   # kubernetes_field_selector = "spec.nodeName=$HOSTNAME"
 
-  # cache refresh interval to set the interval for re-sync of pods list. 
+  # cache refresh interval to set the interval for re-sync of pods list.
   # Default is 60 minutes.
   # cache_refresh_interval = 60
 
@@ -70,28 +70,31 @@
   #     url = 'http://{{if ne .ServiceAddress ""}}{{.ServiceAddress}}{{else}}{{.Address}}{{end}}:{{.ServicePort}}/{{with .ServiceMeta.metrics_path}}{{.}}{{else}}metrics{{end}}'
   #     [inputs.prometheus.consul.query.tags]
   #       host = "{{.Node}}"
-  
+
   ## Use bearer token for authorization. ('bearer_token' takes priority)
   # bearer_token = "/path/to/bearer/token"
   ## OR
   # bearer_token_string = "abc_123"
-  
+
   ## HTTP Basic Authentication username and password. ('bearer_token' and
   ## 'bearer_token_string' take priority)
   # username = ""
   # password = ""
-  
+
+  ## Optional custom HTTP headers
+  # headers = {"X-Special-Header" = "Special-Value"}
+
   ## Specify timeout duration for slower prometheus clients (default is 3s)
   # response_timeout = "3s"
 
   ## HTTP Proxy support
   # use_system_proxy = false
   # http_proxy_url = ""
-  
+
   ## Optional TLS Config
   # tls_ca = /path/to/cafile
   # tls_cert = /path/to/certfile
   # tls_key = /path/to/keyfile
-  
+
   ## Use TLS but skip chain & host verification
   # insecure_skip_verify = false