diff --git a/.changeset/fix-quota-header-discovery.md b/.changeset/fix-quota-header-discovery.md
new file mode 100644
index 0000000..e482287
--- /dev/null
+++ b/.changeset/fix-quota-header-discovery.md
@@ -0,0 +1,5 @@
+---
+"@googleworkspace/cli": patch
+---
+
+Move x-goog-user-project header from default client headers to API request builder, fixing Discovery Document fetches failing with 403 when the quota project lacks certain APIs enabled
diff --git a/src/auth.rs b/src/auth.rs
index 97a1839..48d28f6 100644
--- a/src/auth.rs
+++ b/src/auth.rs
@@ -738,6 +738,7 @@ mod tests {
         .unwrap();
 
         let _home_guard = EnvVarGuard::set("HOME", tmp.path());
+        let _adc_guard = EnvVarGuard::remove("GOOGLE_APPLICATION_CREDENTIALS");
         assert_eq!(get_quota_project(), Some("my-project-123".to_string()));
     }
 }
diff --git a/src/client.rs b/src/client.rs
index 421ffbb..eb83885 100644
--- a/src/client.rs
+++ b/src/client.rs
@@ -11,13 +11,6 @@ pub fn build_client() -> Result<reqwest::Client, crate::error::GwsError> {
         headers.insert("x-goog-api-client", header_value);
     }
 
-    // Set quota project from ADC for billing/quota attribution
-    if let Some(quota_project) = crate::auth::get_quota_project() {
-        if let Ok(header_value) = HeaderValue::from_str(&quota_project) {
-            headers.insert("x-goog-user-project", header_value);
-        }
-    }
-
     reqwest::Client::builder()
         .default_headers(headers)
         .build()
diff --git a/src/executor.rs b/src/executor.rs
index 1957e1e..49101ec 100644
--- a/src/executor.rs
+++ b/src/executor.rs
@@ -165,6 +165,11 @@ async fn build_http_request(
         }
     }
 
+    // Set quota project from ADC for billing/quota attribution
+    if let Some(quota_project) = crate::auth::get_quota_project() {
+        request = request.header("x-goog-user-project", quota_project);
+    }
+
     for (key, value) in &input.query_params {
         request = request.query(&[(key, value)]);
     }