diff --git a/src/Network/Minio/Sign/V4.hs b/src/Network/Minio/Sign/V4.hs
index d5836e2..95c29f1 100644
--- a/src/Network/Minio/Sign/V4.hs
+++ b/src/Network/Minio/Sign/V4.hs
@@ -117,13 +117,15 @@ signV4 !sp !req =
     accessKey = toS $ spAccessKey sp
     secretKey = toS $ spSecretKey sp
     expiry = spExpirySecs sp
+    sha256Hdr = ("x-amz-content-sha256",
+                 fromMaybe "UNSIGNED-PAYLOAD" $ spPayloadHash sp)
 
     -- headers to be added to the request
     datePair = ("X-Amz-Date", awsTimeFormatBS ts)
     computedHeaders = NC.requestHeaders req ++
                       if isJust $ expiry
                       then []
-                      else [(\(x, y) -> (mk x, y)) datePair]
+                      else map (\(x, y) -> (mk x, y)) [datePair, sha256Hdr]
     headersToSign = getHeadersToSign computedHeaders
     signedHeaderKeys = B.intercalate ";" $ sort $ map fst headersToSign
 
@@ -158,8 +160,6 @@ signV4 !sp !req =
     authHeader = mkAuthHeader (spAccessKey sp) scope signedHeaderKeys signature
 
     -- finally compute output pairs
-    sha256Hdr = ("x-amz-content-sha256",
-                 fromMaybe "UNSIGNED-PAYLOAD" $ spPayloadHash sp)
     output = if isJust expiry
              then ("X-Amz-Signature", signature) : authQP
              else [(\(x, y) -> (CI.foldedCase x, y)) authHeader,