diff --git a/internal/tenant/rest_helper.go b/internal/tenant/rest_helper.go
new file mode 100644
index 000000000..ad4076d07
--- /dev/null
+++ b/internal/tenant/rest_helper.go
@@ -0,0 +1,27 @@
+package tenant
+
+import (
+	"context"
+	"fmt"
+	"log"
+	"net/http"
+
+	"github.com/sourcegraph/zoekt/internal/tenant/internal/tenanttype"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+)
+
+func InjectTenantFromHeader(ctx context.Context, header http.Header) (context.Context, error) {
+	log.Printf("header: %v", header)
+	tenantID := header.Get("X-TENANT-ID") // TODO: we don't use headerKeyTenantID here so we don't need to change it and potentially break future grpc changes
+	log.Printf("tenantID: %s", tenantID)
+	if tenantID != "" {
+		tenant, err := tenanttype.Unmarshal(tenantID)
+		if err != nil {
+			return ctx, status.New(codes.InvalidArgument, fmt.Errorf("bad tenant value in header: %w", err).Error()).Err()
+		}
+
+		return tenanttype.WithTenant(ctx, tenant), nil
+	}
+	return ctx, nil
+}
diff --git a/json/json.go b/json/json.go
index 80b47348d..7936ddee4 100644
--- a/json/json.go
+++ b/json/json.go
@@ -7,6 +7,7 @@ import (
 	"time"
 
 	"github.com/sourcegraph/zoekt"
+	"github.com/sourcegraph/zoekt/internal/tenant"
 	"github.com/sourcegraph/zoekt/query"
 )
 
@@ -85,6 +86,12 @@ func (s *jsonSearcher) jsonSearch(w http.ResponseWriter, req *http.Request) {
 		defer cancel()
 	}
 
+	ctx, err = tenant.InjectTenantFromHeader(ctx, req.Header)
+	if err != nil {
+		jsonError(w, http.StatusBadRequest, err.Error())
+		return
+	}
+
 	if err := CalculateDefaultSearchLimits(ctx, q, s.Searcher, searchArgs.Opts); err != nil {
 		jsonError(w, http.StatusInternalServerError, err.Error())
 		return