diff --git a/client/src/main/java/org/asynchttpclient/util/AuthenticatorUtils.java b/client/src/main/java/org/asynchttpclient/util/AuthenticatorUtils.java
index bd9ee8bb2..46a776296 100644
--- a/client/src/main/java/org/asynchttpclient/util/AuthenticatorUtils.java
+++ b/client/src/main/java/org/asynchttpclient/util/AuthenticatorUtils.java
@@ -596,14 +596,11 @@ private static void appendQuotedStringContent(StringBuilder builder, @Nullable S
                     break;
                 case KERBEROS:
                 case SPNEGO:
-                    String host;
-                    if (proxyServer != null) {
-                        host = proxyServer.getHost();
-                    } else if (request.getVirtualHost() != null) {
-                        host = request.getVirtualHost();
-                    } else {
-                        host = request.getUri().getHost();
-                    }
+                    // The origin realm's Negotiate token must target the origin service even when a proxy
+                    // is configured. Minting it against the proxy host produced a service ticket for the
+                    // proxy's SPN: a confused deputy where the origin credential is delivered to, and only
+                    // usable by, the proxy, while origin authentication fails.
+                    String host = request.getVirtualHost() != null ? request.getVirtualHost() : request.getUri().getHost();
 
                     try {
                         authorizationHeader = NEGOTIATE + ' ' + SpnegoEngine.instance(