diff --git a/packages/protocol/src/messages.ts b/packages/protocol/src/messages.ts
index 37f0af5730..dc8bb97134 100644
--- a/packages/protocol/src/messages.ts
+++ b/packages/protocol/src/messages.ts
@@ -1948,7 +1948,7 @@ const PaseoAgentSetProviderOptionsSchema = z
     apiKey: z.string().min(1).optional(),
     baseUrl: z.string().url().optional(),
     api: z.string().min(1).optional(),
-    headers: z.record(z.string()).optional(),
+    headers: z.record(z.string(), z.string()).optional(),
     authHeader: z.boolean().optional(),
     models: z.array(PaseoAgentProviderModelConfigSchema).min(1),
   })
diff --git a/packages/server/src/server/agent/providers/paseo-agent/config.ts b/packages/server/src/server/agent/providers/paseo-agent/config.ts
index d6b7f69320..9a2cdf414b 100644
--- a/packages/server/src/server/agent/providers/paseo-agent/config.ts
+++ b/packages/server/src/server/agent/providers/paseo-agent/config.ts
@@ -120,7 +120,7 @@ const PaseoAgentProviderOptionsSchema = z
     baseUrl: z.string().url().optional(),
     // Override the wire api. Required for `custom`; optional elsewhere.
     api: z.string().min(1).optional(),
-    headers: z.record(z.string()).optional(),
+    headers: z.record(z.string(), z.string()).optional(),
     // Advanced: send `Authorization: Bearer <apiKey>` as a header. Only needed for
     // endpoints whose wire api doesn't already attach the key.
     authHeader: z.boolean().optional(),
@@ -169,7 +169,7 @@ export const PaseoAgentConfigSchema = z
     defaultProfile: z.string().min(1).optional(),
     // Inference providers keyed by instance name. Multiple entries may share a
     // type while pointing at different APIs/base URLs/models.
-    providers: z.record(PaseoAgentInferenceProviderSchema).optional(),
+    providers: z.record(z.string(), PaseoAgentInferenceProviderSchema).optional(),
   })
   .strict();