diff --git a/builtin/credential/okta/backend.go b/builtin/credential/okta/backend.go
index 6046e282c..463f3277d 100644
--- a/builtin/credential/okta/backend.go
+++ b/builtin/credential/okta/backend.go
@@ -3,6 +3,7 @@ package okta
 import (
 	"context"
 	"fmt"
+	"net/textproto"
 	"time"
 
 	"github.com/hashicorp/vault/helper/mfa"
@@ -216,6 +217,9 @@ func (b *backend) Login(ctx context.Context, req *logical.Request, username, pas
 		if err != nil {
 			return nil, nil, nil, err
 		}
+		if len(req.Headers["X-Forwarded-For"]) > 0 {
+			verifyReq.Header.Set("X-Forwarded-For", req.Headers[textproto.CanonicalMIMEHeaderKey("X-Forwarded-For")][0])
+		}
 
 		rsp, err := shim.Do(verifyReq, &result)
 		if err != nil {
diff --git a/changelog/12320.txt b/changelog/12320.txt
new file mode 100644
index 000000000..f6091e103
--- /dev/null
+++ b/changelog/12320.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+auth/okta: Send x-forwarded-for in Okta Push Factor request
+```