diff --git a/Directory.Build.props b/Directory.Build.props
index 656152a59..65046e121 100644
--- a/Directory.Build.props
+++ b/Directory.Build.props
@@ -82,7 +82,7 @@
     <MicrosoftIdentityModelVersion Condition="'$(MicrosoftIdentityModelVersion)' == ''">8.19.1</MicrosoftIdentityModelVersion>
     <MicrosoftIdentityClientVersion Condition="'$(MicrosoftIdentityClientVersion)' == ''">4.86.0</MicrosoftIdentityClientVersion>
     <MicrosoftIdentityClientKeyAttestationVersion Condition="'$(MicrosoftIdentityClientKeyAttestationVersion)' == ''">4.86.0</MicrosoftIdentityClientKeyAttestationVersion>
-    <MicrosoftIdentityAbstractionsVersion Condition="'$(MicrosoftIdentityAbstractionsVersion)' == ''">12.4.0</MicrosoftIdentityAbstractionsVersion>
+    <MicrosoftIdentityAbstractionsVersion Condition="'$(MicrosoftIdentityAbstractionsVersion)' == ''">12.5.0</MicrosoftIdentityAbstractionsVersion>
     <FxCopAnalyzersVersion>3.3.0</FxCopAnalyzersVersion>
     <SystemTextEncodingsWebVersion>4.7.2</SystemTextEncodingsWebVersion>
     <AzureSecurityKeyVaultSecretsVersion>4.6.0</AzureSecurityKeyVaultSecretsVersion>
diff --git a/changelog.md b/changelog.md
index 151f27025..3b2a60f56 100644
--- a/changelog.md
+++ b/changelog.md
@@ -1,3 +1,8 @@
+## 4.13.2
+
+### Dependencies updates
+- Bump `Microsoft.Identity.Abstractions` from 12.4.0 to 12.5.0 (adds the `OnBeforeAuthHeaderCreation` / `OnAfterAuthHeaderCreation` request hooks). See [#3947](https://github.com/AzureAD/microsoft-identity-web/pull/3947).
+
 ## 4.13.1
 
 ### Bug fixes
diff --git a/tests/E2E Tests/Sidecar.Tests/DownstreamApiOptionsMergeTests.cs b/tests/E2E Tests/Sidecar.Tests/DownstreamApiOptionsMergeTests.cs
index f17cd3cab..45e0382c1 100644
--- a/tests/E2E Tests/Sidecar.Tests/DownstreamApiOptionsMergeTests.cs	
+++ b/tests/E2E Tests/Sidecar.Tests/DownstreamApiOptionsMergeTests.cs	
@@ -688,6 +688,8 @@ public void MergeDownstreamApiOptionsOverrides_AllPropertiesAreCopied()
             // Properties intentionally not merged (they use CustomizeHttpRequestMessage pattern or are clone-only)
             "Clone",
             "CustomizeHttpRequestMessage",
+            "OnBeforeAuthHeaderCreation",
+            "OnAfterAuthHeaderCreation",
             "Serializer",
             "Deserializer",
             "ProtocolScheme",