diff --git a/src/aioweb/session.py b/src/aioweb/session.py
index a0dc4b3..91ea3b8 100644
--- a/src/aioweb/session.py
+++ b/src/aioweb/session.py
@@ -95,9 +95,15 @@ class ExtendedSession:
         proxy/retry/preview logic in this class never touches the session object
         directly (only _raw_request, the cookie methods, and close do), so those
         features work unchanged on any backend.
+
+        `headers` is the session-default header set; the default aiohttp backend
+        does NOT bake it into the ClientSession (which would copy it into an
+        immutable per-session map that update_headers/clear_headers can't touch).
+        instead `_default_headers` is our own mutable layer that request() and
+        preview() merge per call, so the mutable session-header API actually works.
+        a backend that needs the defaults baked at construction may use `headers`.
         """
         return aiohttp.ClientSession(
-            headers=headers,
             timeout=aiohttp.ClientTimeout(
                 total=timeout,
                 connect=timeout / 2,
@@ -233,10 +239,8 @@ class ExtendedSession:
     def preview(self, method, url, **kwargs):
         """build a RequestPreview for a request without sending it"""
         proxy = self._get_proxy(url, kwargs.pop("proxies", None))
-        if kwargs.get("headers"):
-            headers = self._apply_overwrites(kwargs.pop("headers"))
-        else:
-            headers = dict(self.get_headers())
+        merged = {**self._default_headers, **(kwargs.pop("headers", None) or {})}
+        headers = self._apply_overwrites(merged)
 
         timeout = kwargs.get("timeout")
         timeout_total = timeout if isinstance(timeout, (int, float)) else None