diff --git a/agent/pkg/agent/stream/header.go b/agent/pkg/agent/stream/header.go
index f1679c6a..2acdfeaf 100644
--- a/agent/pkg/agent/stream/header.go
+++ b/agent/pkg/agent/stream/header.go
@@ -72,8 +72,9 @@ func NewStreamHealthCheckHeader() *StreamRequestHeader {
 	return header
 }
 
-func ToHeader(buf [headerSize]byte) *StreamRequestHeader {
-	return (*StreamRequestHeader)(unsafe.Pointer(&buf[0]))
+// ToHeader converts header byte array to a copy of itself as a StreamRequestHeader.
+func ToHeader(buf *[headerSize]byte) StreamRequestHeader {
+	return *(*StreamRequestHeader)(unsafe.Pointer(buf))
 }
 
 func (h *StreamRequestHeader) GetHostPort() (string, string) {
diff --git a/agent/pkg/agent/stream/payload_test.go b/agent/pkg/agent/stream/payload_test.go
index 6083a371..1c5d7c32 100644
--- a/agent/pkg/agent/stream/payload_test.go
+++ b/agent/pkg/agent/stream/payload_test.go
@@ -15,7 +15,7 @@ func TestStreamRequestHeader_RoundTripAndChecksum(t *testing.T) {
 
 	var buf [headerSize]byte
 	copy(buf[:], h.Bytes())
-	h2 := ToHeader(buf)
+	h2 := ToHeader(&buf)
 	if !h2.Validate() {
 		t.Fatalf("expected round-tripped header to validate")
 	}
diff --git a/agent/pkg/agent/stream/tcp_server.go b/agent/pkg/agent/stream/tcp_server.go
index 36aed306..9432746c 100644
--- a/agent/pkg/agent/stream/tcp_server.go
+++ b/agent/pkg/agent/stream/tcp_server.go
@@ -151,7 +151,7 @@ func (s *TCPServer) redirect(conn net.Conn) (net.Conn, error) {
 		return nil, err
 	}
 
-	header := ToHeader(headerBuf)
+	header := ToHeader(&headerBuf)
 	if !header.Validate() {
 		return nil, ErrInvalidHeader
 	}
diff --git a/agent/pkg/agent/stream/udp_server.go b/agent/pkg/agent/stream/udp_server.go
index 29e523d9..0ceb7124 100644
--- a/agent/pkg/agent/stream/udp_server.go
+++ b/agent/pkg/agent/stream/udp_server.go
@@ -106,7 +106,7 @@ func (s *UDPServer) handleDTLSConnection(clientConn net.Conn) {
 		s.logger(clientConn).Err(err).Msg("failed to read stream header")
 		return
 	}
-	header := ToHeader(headerBuf)
+	header := ToHeader(&headerBuf)
 	if !header.Validate() {
 		s.logger(clientConn).Error().Bytes("header", headerBuf[:]).Msg("invalid stream header received")
 		return