diff --git a/testdata/npm/npmnpmrcproject/.npmrc b/testdata/npm/npmnpmrcproject/.npmrc
index b38227afb..e6f4636fd 100755
--- a/testdata/npm/npmnpmrcproject/.npmrc
+++ b/testdata/npm/npmnpmrcproject/.npmrc
@@ -1,7 +1,7 @@
 @jfrog:registry=http://NO-NO-REPO/
 registry=http://NO-NO-REPO/
-_auth=YWRtaW46QVBFG1ZkZFMzN3NCakJiaRFVBThVb0JlZzFl
 always-auth=true
-email=ddd@dd.dd
+//NO-NO-REPO/:_auth=YWRtaW46QVBFG1ZkZFMzN3NCakJiaRFVBThVb0JlZzFl
+//NO-NO-REPO/:email=ddd@dd.dd
 # jfrog-ignore - not a real token
 //NO-NO-REPO/:_authToken=eyJ2ZXIiOzfsdhiOiIyR3A5cDlUYW44NmpaTkxDNlBpa0lmWTU1Uk9Kc1pfNGlFUnRQLVsdfhZmFjdG9yeUBsdhjZDc2MGJmOC0wNjI0LTQwYTYtOGEyMS0zOTViMzg1OWQzNzVcL3VzZXJzXC9hZG1pbiIsInNjcCI6Im1lbWJlci1vZi1ncm91cHM6KiBhcGk6KiIsImF1ZCI6ImpmLWFydGlmYWN0b3J5QGNkNzYwYmY4LTA2MjQtNDBhNisdhmpmLWFydGlmYWN0b3J5QGNkNzYwYmY4LTA2MjQtNDBhNi04YTIxLTM5NWIzODU5ZDM3NSIsImlhdCI6MTUxMzI0MjcxMywianRpIjoiNWZiYmY1ZDAtYjUzNC00ZWMxLWE3NDItZTRiMjNmZDA4YTI5In0.pwNys1ek1v7BtjESjlEMgiVLAdD60vwh1EWvuoGSaxAvu1ppW1fwCJmNjJ69HJbA58tq-AfkusKhr7juoIw2TaIsikyrnrDHv1ELaFupAxDMkDfx4w1GQO3dMzWYDAYoVfeaImpdXQ3_pKemR5eLiRiqJrtEfj52OfIFyVPOuBTvtoqDe8-DvFNFz0TyUAfbLvya8S9I6KGr2mxR4v8eir4me8zp0lPBm7oIKL_tfgr5uP9naTrUg5Ydfkc-vhwU0jK-45R3RQPbpW-NE78yy17TVJuxgE0s2OtMWmLpvr3FJaPCJ5VGPtRexJFbN_7BhR2tl02Wys41lk6pqSpRlA
\ No newline at end of file
diff --git a/utils/tests/proxy/server/server.go b/utils/tests/proxy/server/server.go
index 40a3a5fe6..81757892a 100644
--- a/utils/tests/proxy/server/server.go
+++ b/utils/tests/proxy/server/server.go
@@ -47,16 +47,21 @@ func getReverseProxyHandler(targetUrl string) (*httputil.ReverseProxy, error) {
 		return nil, err
 	}
 	origHost := target.Host
-	d := func(req *http.Request) {
-		req.URL.Host = origHost
-		req.Host = origHost
-		req.URL.Scheme = target.Scheme
+	// Rewrite replaces the deprecated Director (Go 1.26, staticcheck SA1019).
+	// pr.Out is a clone of pr.In that ReverseProxy sends upstream; unlike a
+	// nil Rewrite's defaults, defining this func means no other header
+	// rewriting happens automatically (X-Forwarded-For, etc.) -- matching
+	// Director's behavior exactly, since Director never set defaults either.
+	rewrite := func(pr *httputil.ProxyRequest) {
+		pr.Out.URL.Host = origHost
+		pr.Out.Host = origHost
+		pr.Out.URL.Scheme = target.Scheme
 	}
 	tr := &http.Transport{
 		TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
 	}
 	proxyErrLogger := log.New(os.Stdout, "PROXY-LOGGER", log.Ldate|log.Ltime|log.Lshortfile)
-	p := &httputil.ReverseProxy{Director: d, Transport: tr, ErrorLog: proxyErrLogger}
+	p := &httputil.ReverseProxy{Rewrite: rewrite, Transport: tr, ErrorLog: proxyErrLogger}
 	return p, nil
 }