diff --git a/CHANGES b/CHANGES
index e31d8d075b..27b9350eff 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,6 +1,9 @@
                                                          -*- coding: utf-8 -*-
 Changes with Apache 2.5.0
 
+  *) ap_expr: Add req_novary function that allows HTTP header lookups
+     without adding the name to the Vary header. [Stefan Fritsch]
+
   *) mod_ssl: Change default for SSLCompression to off, as compression
      causes security issues in most setups. (The so called "CRIME" attack).
      [Stefan Fritsch]
diff --git a/docs/manual/expr.xml b/docs/manual/expr.xml
index 7b1f6d6626..508d9d4b85 100644
--- a/docs/manual/expr.xml
+++ b/docs/manual/expr.xml
@@ -142,7 +142,9 @@ listfunction ::= listfuncname "<strong>(</strong>" word "<strong>)</strong>"
     <code>req</code> <a href="#functions">function</a>. Using these
     variables may cause the header name to be added to the Vary
     header of the HTTP response, except where otherwise noted for the
-    directive accepting the expression.</p>
+    directive accepting the expression. The <code>req_novary</code>
+    <a href="#functions">function</a> may be used to circumvent this
+    behavior.</p>
 
     <table border="1" style="zebra">
     <columnspec><column width="1"/></columnspec>
@@ -434,6 +436,9 @@ listfunction ::= listfuncname "<strong>(</strong>" word "<strong>)</strong>"
     <tr><td><code>req</code>, <code>http</code></td>
         <td>Get HTTP request header; header names may be added to the Vary
             header, see below</td><td></td></tr>
+    <tr><td><code>req_novary</code></td>
+        <td>Same as <code>req</code>, but header names will not be added to the
+            Vary header</td><td></td></tr>
     <tr><td><code>resp</code></td>
         <td>Get HTTP response header</td><td></td></tr>
     <tr><td><code>reqenv</code></td>
@@ -468,7 +473,8 @@ listfunction ::= listfuncname "<strong>(</strong>" word "<strong>)</strong>"
     <p>When the functions <code>req</code> or <code>http</code> are used,
     the header name will automatically be added to the Vary header of the
     HTTP response, except where otherwise noted for the directive accepting
-    the expression.</p>
+    the expression. The <code>req_novary</code> function can be used to
+    prevent names from being added to the Vary header.</p>
 
     <p>In addition to string-valued functions, there are also list-valued functions which
     take one string as argument and return a wordlist, i.e. a list of strings. The wordlist
diff --git a/server/util_expr_eval.c b/server/util_expr_eval.c
index 699593108c..b350cfc771 100644
--- a/server/util_expr_eval.c
+++ b/server/util_expr_eval.c
@@ -968,6 +968,8 @@ static const char *req_table_func(ap_expr_eval_ctx_t *ctx, const void *data,
         t = ctx->r->notes;
     else if (name[3] == 'e')        /* reqenv */
         t = ctx->r->subprocess_env;
+    else if (name[3] == '_')        /* req_novary */
+        t = ctx->r->headers_in;
     else {                          /* req, http */
         t = ctx->r->headers_in;
         add_vary(ctx, arg);
@@ -1566,6 +1568,7 @@ static const struct expr_provider_single string_func_providers[] = {
     { req_table_func,       "http",           NULL, 0 },
     { req_table_func,       "note",           NULL, 0 },
     { req_table_func,       "reqenv",         NULL, 0 },
+    { req_table_func,       "req_novary",     NULL, 0 },
     { tolower_func,         "tolower",        NULL, 0 },
     { toupper_func,         "toupper",        NULL, 0 },
     { escape_func,          "escape",         NULL, 0 },