diff --git a/main_test.go b/main_test.go
index dce11fcc..cbe79683 100644
--- a/main_test.go
+++ b/main_test.go
@@ -169,8 +169,9 @@ redirect_url="http://localhost:4180/oauth2/callback"
 				SkipClaimsFromProfileURL: ptr.To(false),
 				GoogleConfig: options.GoogleOptions{
 					AdminEmail:                       "admin@example.com",
-					UseApplicationDefaultCredentials: ptr.To(false),
 					TargetPrincipal:                  "principal",
+					UseOrganizationID:                ptr.To(false),
+					UseApplicationDefaultCredentials: ptr.To(false),
 				},
 				AzureConfig: options.AzureOptions{
 					Tenant: "common",
diff --git a/pkg/apis/options/header.go b/pkg/apis/options/header.go
index 52552397..d9509de0 100644
--- a/pkg/apis/options/header.go
+++ b/pkg/apis/options/header.go
@@ -5,6 +5,8 @@ import "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/util/ptr"
 const (
 	// DefaultHeaderPreserveRequestValue is the default value for Header.PreserveRequestValue
 	DefaultHeaderPreserveRequestValue bool = false
+	// DefaultInsecureSkipHeaderNormalization is the default value for Header.InsecureSkipHeaderNormalization
+	DefaultInsecureSkipHeaderNormalization bool = false
 )
 
 // Header represents an individual header that will be added to a request or
@@ -28,7 +30,7 @@ type Header struct {
 	// treated as the same header. Additionally underscores (_) in header names
 	// will be converted to dashes (-) when normalizing.
 	// Defaults to false (header names will be normalized).
-	InsecureSkipHeaderNormalization bool `json:"InsecureSkipHeaderNormalization,omitempty"`
+	InsecureSkipHeaderNormalization *bool `yaml:"InsecureSkipHeaderNormalization,omitempty"`
 
 	// Values contains the desired values for this header
 	Values []HeaderValue `yaml:"values,omitempty"`
diff --git a/pkg/apis/options/legacy_options.go b/pkg/apis/options/legacy_options.go
index 0f9f0829..6ce730fd 100644
--- a/pkg/apis/options/legacy_options.go
+++ b/pkg/apis/options/legacy_options.go
@@ -789,7 +789,7 @@ func (l *LegacyProvider) convert() (Providers, error) {
 			ServiceAccountJSON:               l.GoogleServiceAccountJSON,
 			UseApplicationDefaultCredentials: &l.GoogleUseApplicationDefaultCredentials,
 			TargetPrincipal:                  l.GoogleTargetPrincipal,
-			UseOrganizationID:                l.GoogleUseOrganizationID,
+			UseOrganizationID:                &l.GoogleUseOrganizationID,
 			AdminAPIUserScope:                l.GoogleAdminAPIUserScope,
 		}
 	case "entra-id":
diff --git a/pkg/apis/options/legacy_options_test.go b/pkg/apis/options/legacy_options_test.go
index 3fe9c1e5..ceba53af 100644
--- a/pkg/apis/options/legacy_options_test.go
+++ b/pkg/apis/options/legacy_options_test.go
@@ -955,6 +955,7 @@ var _ = Describe("Legacy Options", func() {
 		}
 
 		defaultGoogleOptions := GoogleOptions{
+			UseOrganizationID:                ptr.To(false),
 			UseApplicationDefaultCredentials: ptr.To(false),
 		}
 
@@ -1020,6 +1021,7 @@ var _ = Describe("Legacy Options", func() {
 				AdminEmail:                       "email@email.com",
 				ServiceAccountJSON:               "test.json",
 				Groups:                           []string{"1", "2"},
+				UseOrganizationID:                ptr.To(false),
 				UseApplicationDefaultCredentials: ptr.To(false),
 			},
 			LoginURLParameters:       defaultURLParams,
diff --git a/pkg/apis/options/providers.go b/pkg/apis/options/providers.go
index 2d89eb2c..4dd206e2 100644
--- a/pkg/apis/options/providers.go
+++ b/pkg/apis/options/providers.go
@@ -37,6 +37,10 @@ const (
 	// for MicrosoftEntraIDOptions.FederatedTokenAuth
 	DefaultMicrosoftEntraIDUseFederatedToken bool = false
 
+	// DefaultGoogleUseOrganizationID is the default value
+	// for GoogleOptions.UseOrganizationID
+	DefaultGoogleUseOrganizationID bool = false
+
 	// DefaultGoogleUseApplicationDefaultCredentials is the default values
 	// for GoogleOptions.UseApplicationDefaultCredentials
 	DefaultUseApplicationDefaultCredentials bool = false
@@ -269,7 +273,7 @@ type GoogleOptions struct {
 	// TargetPrincipal is the Google Service Account used for Application Default Credentials
 	TargetPrincipal string `yaml:"targetPrincipal,omitempty"`
 	// UseOrganizationId indicates whether to use the organization ID as the UserName claim
-	UseOrganizationID bool `yaml:"useOrganizationID,omitempty"`
+	UseOrganizationID *bool `yaml:"useOrganizationID,omitempty"`
 	// admin scope needed for fetching user organization information from admin api, can be one of cloud, user or defaults to readonly
 	AdminAPIUserScope string `yaml:"adminAPIUserScope,omitempty"`
 }
@@ -412,6 +416,8 @@ func (a *ADFSOptions) EnsureDefaults() {
 
 // EnsureDefaults sets any default values for GoogleOptions fields.
 func (g *GoogleOptions) EnsureDefaults() {
+	g.UseOrganizationID = ptr.To(DefaultGoogleUseOrganizationID)
+
 	if g.UseApplicationDefaultCredentials == nil {
 		g.UseApplicationDefaultCredentials = ptr.To(DefaultUseApplicationDefaultCredentials)
 	}
diff --git a/pkg/middleware/headers.go b/pkg/middleware/headers.go
index b567f4f5..39f8367a 100644
--- a/pkg/middleware/headers.go
+++ b/pkg/middleware/headers.go
@@ -54,7 +54,7 @@ func flattenHeaders(headers http.Header) {
 func stripHeaders(headers []options.Header, next http.Handler) http.Handler {
 	return http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
 		for _, header := range headers {
-			if header.InsecureSkipHeaderNormalization {
+			if ptr.Deref(header.InsecureSkipHeaderNormalization, options.DefaultInsecureSkipHeaderNormalization) {
 				req.Header.Del(header.Name)
 				continue
 			}
diff --git a/pkg/middleware/headers_test.go b/pkg/middleware/headers_test.go
index 393ade9c..c3c402f0 100644
--- a/pkg/middleware/headers_test.go
+++ b/pkg/middleware/headers_test.go
@@ -231,7 +231,7 @@ var _ = Describe("Headers Suite", func() {
 			headers: []options.Header{
 				{
 					Name:                            "X-Auth-Request-User",
-					InsecureSkipHeaderNormalization: true,
+					InsecureSkipHeaderNormalization: ptr.To(true),
 					Values: []options.HeaderValue{
 						{
 							ClaimSource: &options.ClaimSource{Claim: "user"},
diff --git a/providers/google.go b/providers/google.go
index 92d78224..d8e4dec8 100644
--- a/providers/google.go
+++ b/providers/google.go
@@ -109,11 +109,11 @@ func NewGoogleProvider(p *ProviderData, opts options.GoogleOptions) (*GoogleProv
 		},
 	}
 
-	if opts.UseOrganizationID || opts.ServiceAccountJSON != "" || ptr.Deref(opts.UseApplicationDefaultCredentials, options.DefaultUseApplicationDefaultCredentials) {
+	if ptr.Deref(opts.UseOrganizationID, options.DefaultGoogleUseOrganizationID) || opts.ServiceAccountJSON != "" || ptr.Deref(opts.UseApplicationDefaultCredentials, options.DefaultUseApplicationDefaultCredentials) {
 		// reuse admin service to avoid multiple calls for token
 		var adminService *admin.Service
 
-		if opts.UseOrganizationID {
+		if ptr.Deref(opts.UseOrganizationID, options.DefaultGoogleUseOrganizationID) {
 			// add user scopes to admin api
 			userScope := getAdminAPIUserScope(opts.AdminAPIUserScope)
 			for index, scope := range possibleScopesList {