diff --git a/azblob/zc_policy_request_log.go b/azblob/zc_policy_request_log.go
index ddc83cc..915fd21 100644
--- a/azblob/zc_policy_request_log.go
+++ b/azblob/zc_policy_request_log.go
@@ -170,7 +170,7 @@ func stack() []byte {
 func prepareRequestForServiceLogging(request pipeline.Request) *http.Request {
 	req := request
 	if exist, key := doesHeaderExistCaseInsensitive(req.Header, xMsCopySourceHeader); exist {
-		req = request.Copy()
+		req = req.Copy()
 		url, err := url.Parse(req.Header.Get(key))
 		if err == nil {
 			if sigFound, rawQuery := RedactSigQueryParam(url.RawQuery); sigFound {
@@ -179,10 +179,21 @@ func prepareRequestForServiceLogging(request pipeline.Request) *http.Request {
 			}
 		}
 	}
+	// Redact headers that have to do with CPK keys.
+	if exist, key := doesHeaderExistCaseInsensitive(req.Header, xMsEncryptionKey); exist {
+		req = req.Copy()
+		req.Header.Set(key, "REDACTED")
+	}
+	if exist, key := doesHeaderExistCaseInsensitive(req.Header, xMsEncryptionKeySha256); exist {
+		req = req.Copy()
+		req.Header.Set(key, "REDACTED")
+	}
 	return req.Request
 }
 
 const xMsCopySourceHeader = "x-ms-copy-source"
+const xMsEncryptionKey = "x-ms-encryption-key"
+const xMsEncryptionKeySha256 = "x-ms-encryption-key-sha256"
 
 func doesHeaderExistCaseInsensitive(header http.Header, key string) (bool, string) {
 	for keyInHeader := range header {