diff --git a/ChangeLog.md b/ChangeLog.md
--- a/ChangeLog.md
+++ b/ChangeLog.md
@@ -1,3 +1,7 @@
+## 0.4.16
+
+* Proxy auth for HTTPS [#132](https://github.com/snoyberg/http-client/issues/132)
+
 ## 0.4.15
 
 * Support proxy authentication in environment variables [#129](https://github.com/snoyberg/http-client/issues/129)
diff --git a/Network/HTTP/Client/Core.hs b/Network/HTTP/Client/Core.hs
--- a/Network/HTTP/Client/Core.hs
+++ b/Network/HTTP/Client/Core.hs
@@ -89,7 +89,7 @@
     -- connections after accepting the request headers, so we need to check for
     -- exceptions in both.
     ex <- try $ do
-        cont <- requestBuilder req ci
+        cont <- requestBuilder (dropProxyAuthSecure req) ci
 
         getResponse connRelease timeout' req ci cont
 
diff --git a/Network/HTTP/Client/Manager.hs b/Network/HTTP/Client/Manager.hs
--- a/Network/HTTP/Client/Manager.hs
+++ b/Network/HTTP/Client/Manager.hs
@@ -19,6 +19,7 @@
     , proxyEnvironment
     , proxyEnvironmentNamed
     , defaultProxy
+    , dropProxyAuthSecure
     ) where
 
 #if !MIN_VERSION_base(4,6,0)
@@ -385,6 +386,18 @@
         Just p -> (True, S8.unpack (proxyHost p), proxyPort p)
         Nothing -> (False, S8.unpack $ host req, port req)
 
+-- | Drop the Proxy-Authorization header from the request if we're using a
+-- secure proxy.
+dropProxyAuthSecure :: Request -> Request
+dropProxyAuthSecure req
+    | secure req && useProxy = req
+        { requestHeaders = filter (\(k, _) -> k /= "Proxy-Authorization")
+                                  (requestHeaders req)
+        }
+    | otherwise = req
+  where
+    (useProxy, _, _) = getConnDest req
+
 getConn :: Request
         -> Manager
         -> IO (ConnRelease, Connection, ManagedConn)
@@ -413,12 +426,15 @@
             (True, True) ->
                 let ultHost = host req
                     ultPort = port req
+                    proxyAuthorizationHeader = maybe "" (\h -> S8.concat ["Proxy-Authorization: ", h, "\r\n"]) . lookup "Proxy-Authorization" $ requestHeaders req
                     connstr = S8.concat
                         [ "CONNECT "
                         , ultHost
                         , ":"
                         , S8.pack $ show ultPort
-                        , " HTTP/1.1\r\n\r\n"
+                        , " HTTP/1.1\r\n"
+                        , proxyAuthorizationHeader
+                        , "\r\n"
                         ]
                     parse conn = do
                         sh@(StatusHeaders status _ _) <- parseStatusHeaders conn Nothing Nothing
diff --git a/http-client.cabal b/http-client.cabal
--- a/http-client.cabal
+++ b/http-client.cabal
@@ -1,5 +1,5 @@
 name:                http-client
-version:             0.4.15
+version:             0.4.16
 synopsis:            An HTTP client engine, intended as a base layer for more user-friendly packages.
 description:         Hackage documentation generation is not reliable. For up to date documentation, please see: <http://www.stackage.org/package/http-client>.
 homepage:            https://github.com/snoyberg/http-client