diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b05b726..859e348 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -26,9 +26,9 @@ jobs:
       github.repository == 'stainless-sdks/courier-ruby' &&
       (github.event_name == 'push' || github.event.pull_request.head.repo.fork) && (github.event_name != 'push' || github.event.head_commit.message != 'codegen metadata')
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Set up Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@c4e5b1316158f92e3d49443a9d58b31d25ac0f8f # v1.306.0
         with:
           bundler-cache: false
       - run: |-
@@ -39,7 +39,7 @@ jobs:
           github.repository == 'stainless-sdks/courier-ruby' &&
           !startsWith(github.ref, 'refs/heads/stl/')
         id: github-oidc
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           script: core.setOutput('github_token', await core.getIDToken());
 
@@ -60,9 +60,9 @@ jobs:
     if: github.event_name == 'push' || github.event.pull_request.head.repo.fork
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Set up Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@c4e5b1316158f92e3d49443a9d58b31d25ac0f8f # v1.306.0
         with:
           bundler-cache: false
       - run: |-
@@ -76,9 +76,9 @@ jobs:
     runs-on: ${{ github.repository == 'stainless-sdks/courier-ruby' && 'depot-ubuntu-24.04' || 'ubuntu-latest' }}
     if: github.event_name == 'push' || github.event.pull_request.head.repo.fork
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Set up Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@c4e5b1316158f92e3d49443a9d58b31d25ac0f8f # v1.306.0
         with:
           bundler-cache: false
       - run: |-
diff --git a/.github/workflows/publish-gem.yml b/.github/workflows/publish-gem.yml
index b7cc511..21ef312 100644
--- a/.github/workflows/publish-gem.yml
+++ b/.github/workflows/publish-gem.yml
@@ -14,9 +14,9 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Set up Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@c4e5b1316158f92e3d49443a9d58b31d25ac0f8f # v1.306.0
         with:
           bundler-cache: false
       - run: |-
diff --git a/.github/workflows/release-doctor.yml b/.github/workflows/release-doctor.yml
index 404425f..f8cb15d 100644
--- a/.github/workflows/release-doctor.yml
+++ b/.github/workflows/release-doctor.yml
@@ -12,7 +12,7 @@ jobs:
     if: github.repository == 'trycourier/courier-ruby' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || startsWith(github.head_ref, 'release-please') || github.head_ref == 'next')
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Check release environment
         run: |
diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index e11f827..a43b15a 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "4.10.2"
+  ".": "4.11.0"
 }
\ No newline at end of file
diff --git a/.stats.yml b/.stats.yml
index effa635..a59050a 100644
--- a/.stats.yml
+++ b/.stats.yml
@@ -1,4 +1,4 @@
 configured_endpoints: 103
-openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/courier%2Fcourier-3f78581b4e078a1f620d9f587f18d77bcde6d20f56b0e4ae798648f4236494fb.yml
+openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/courier/courier-2fca943954773292b6ca82dcb420c6500d118d2fbbe1cd4718afcb804f6c818c.yml
 openapi_spec_hash: 6bd33e0396d85e11bb46f0d549af93a3
 config_hash: afcc4f6f8c33ca3f338589e32e086f56
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 75590b1..7fa002a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,18 @@
 # Changelog
 
+## 4.11.0 (2026-05-13)
+
+Full Changelog: [v4.10.2...v4.11.0](https://github.com/trycourier/courier-ruby/compare/v4.10.2...v4.11.0)
+
+### Features
+
+* support setting headers via env ([6f99d29](https://github.com/trycourier/courier-ruby/commit/6f99d290cad4006de8f84b22cbac6694d314a3aa))
+
+
+### Chores
+
+* **internal:** more robust bootstrap script ([91e8fd1](https://github.com/trycourier/courier-ruby/commit/91e8fd1ecdd6d10def9215f53a73248b754b5386))
+
 ## 4.10.2 (2026-04-14)
 
 Full Changelog: [v4.10.1...v4.10.2](https://github.com/trycourier/courier-ruby/compare/v4.10.1...v4.10.2)
diff --git a/Gemfile.lock b/Gemfile.lock
index f35a67e..a4018fe 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -11,7 +11,7 @@ GIT
 PATH
   remote: .
   specs:
-    trycourier (4.10.2)
+    trycourier (4.11.0)
       cgi
       connection_pool
 
diff --git a/lib/courier/client.rb b/lib/courier/client.rb
index 82a7e16..97fc0ae 100644
--- a/lib/courier/client.rb
+++ b/lib/courier/client.rb
@@ -112,6 +112,19 @@ def initialize(
         raise ArgumentError.new("api_key is required, and can be set via environ: \"COURIER_API_KEY\"")
       end
 
+      headers = {}
+      custom_headers_env = ENV["COURIER_CUSTOM_HEADERS"]
+      unless custom_headers_env.nil?
+        parsed = {}
+        custom_headers_env.split("\n").each do |line|
+          colon = line.index(":")
+          unless colon.nil?
+            parsed[line[0...colon].strip] = line[(colon + 1)..].strip
+          end
+        end
+        headers = parsed.merge(headers)
+      end
+
       @api_key = api_key.to_s
 
       super(
@@ -119,7 +132,8 @@ def initialize(
         timeout: timeout,
         max_retries: max_retries,
         initial_retry_delay: initial_retry_delay,
-        max_retry_delay: max_retry_delay
+        max_retry_delay: max_retry_delay,
+        headers: headers
       )
 
       @send_ = Courier::Resources::Send.new(client: self)
diff --git a/lib/courier/version.rb b/lib/courier/version.rb
index cb7875b..bf96ded 100644
--- a/lib/courier/version.rb
+++ b/lib/courier/version.rb
@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Courier
-  VERSION = "4.10.2"
+  VERSION = "4.11.0"
 end
diff --git a/scripts/bootstrap b/scripts/bootstrap
index 3487864..a5e1b80 100755
--- a/scripts/bootstrap
+++ b/scripts/bootstrap
@@ -4,7 +4,7 @@ set -e
 
 cd -- "$(dirname -- "$0")/.."
 
-if [ -f "Brewfile" ] && [ "$(uname -s)" = "Darwin" ] && [ "$SKIP_BREW" != "1" ] && [ -t 0 ]; then
+if [ -f "Brewfile" ] && [ "$(uname -s)" = "Darwin" ] && [ "${SKIP_BREW:-}" != "1" ] && [ -t 0 ]; then
   brew bundle check >/dev/null 2>&1 || {
     echo -n "==> Install Homebrew dependencies? (y/N): "
     read -r response