diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2f931ad4408..2546374221e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,7 @@
 * GraphQL: Manage `pagination_use_output_walkers` and `pagination_fetch_join_collection` for operations (#3311)
 * Swagger UI: Remove Google fonts (#4112)
 * Doctrine: Revert #3774 support for binary UUID in search filter (#4134) 
+* Do not override Vary headers already set in the Response 
 
 ## 2.6.3
 
diff --git a/src/HttpCache/EventListener/AddHeadersListener.php b/src/HttpCache/EventListener/AddHeadersListener.php
index 304fcc14222..ff528baa466 100644
--- a/src/HttpCache/EventListener/AddHeadersListener.php
+++ b/src/HttpCache/EventListener/AddHeadersListener.php
@@ -74,10 +74,9 @@ public function onKernelResponse(ResponseEvent $event): void
             $response->setMaxAge($maxAge);
         }
 
-        if (isset($resourceCacheHeaders['vary'])) {
-            $response->setVary($resourceCacheHeaders['vary']);
-        } elseif (null !== $this->vary) {
-            $response->setVary(array_diff($this->vary, $response->getVary()), false);
+        $vary = $resourceCacheHeaders['vary'] ?? $this->vary;
+        if (null !== $vary) {
+            $response->setVary(array_diff($vary, $response->getVary()), false);
         }
 
         // if the public-property is defined and not yet set; apply it to the response
diff --git a/tests/HttpCache/EventListener/AddHeadersListenerTest.php b/tests/HttpCache/EventListener/AddHeadersListenerTest.php
index c44d708827b..7f05ea60496 100644
--- a/tests/HttpCache/EventListener/AddHeadersListenerTest.php
+++ b/tests/HttpCache/EventListener/AddHeadersListenerTest.php
@@ -162,7 +162,7 @@ public function testSetHeadersFromResourceMetadata()
         $listener->onKernelResponse($event);
 
         $this->assertSame('max-age=123, public, s-maxage=456, stale-if-error=70, stale-while-revalidate=928', $response->headers->get('Cache-Control'));
-        $this->assertSame(['Vary-1', 'Vary-2'], $response->getVary());
+        $this->assertSame(['Accept', 'Cookie', 'Vary-1', 'Vary-2'], $response->getVary());
     }
 
     public function testSetHeadersFromResourceMetadataMarkedAsPrivate()