diff --git a/packages/angular_devkit/build_angular/src/builders/ssr-dev-server/index.ts b/packages/angular_devkit/build_angular/src/builders/ssr-dev-server/index.ts
index 003eb693bb56..e3a58234892c 100644
--- a/packages/angular_devkit/build_angular/src/builders/ssr-dev-server/index.ts
+++ b/packages/angular_devkit/build_angular/src/builders/ssr-dev-server/index.ts
@@ -268,6 +268,7 @@ async function initBrowserSync(
       target: `localhost:${nodeServerPort}`,
       proxyOptions: {
         xfwd: true,
+        changeOrigin: false,
       },
       proxyRes: [
         (proxyRes) => {
@@ -277,7 +278,7 @@ async function initBrowserSync(
         },
       ],
       // proxyOptions is not in the typings
-    } as ProxyOptions & { proxyOptions: { xfwd: boolean } },
+    } as ProxyOptions & { proxyOptions: { xfwd: boolean; changeOrigin: boolean } },
     host,
     port: bsPort,
     ui: false,
diff --git a/packages/angular_devkit/build_angular/src/builders/ssr-dev-server/specs/works_spec.ts b/packages/angular_devkit/build_angular/src/builders/ssr-dev-server/specs/works_spec.ts
index 92324fa34526..4b2e6d980527 100644
--- a/packages/angular_devkit/build_angular/src/builders/ssr-dev-server/specs/works_spec.ts
+++ b/packages/angular_devkit/build_angular/src/builders/ssr-dev-server/specs/works_spec.ts
@@ -9,6 +9,7 @@
 import { Architect } from '@angular-devkit/architect';
 // eslint-disable-next-line import/no-extraneous-dependencies
 import * as browserSync from 'browser-sync';
+import { get } from 'node:http';
 import { createArchitect, host } from '../../../testing/test-utils';
 
 describe('Serve SSR Builder - Works', () => {
@@ -95,4 +96,32 @@ describe('Serve SSR Builder - Works', () => {
     expect(output.success).toBe(true);
     expect(output.baseUrl).not.toContain('4200');
   });
+
+  it('rejects requests with a disallowed Host header', async () => {
+    const run = await architect.scheduleTarget(target, { port: 0 });
+    try {
+      const output = await run.result;
+      expect(output.success).toBeTrue();
+
+      const statusCode = await new Promise<number | undefined>((resolve, reject) => {
+        const req = get(
+          {
+            hostname: 'localhost',
+            port: output.port,
+            path: '/',
+            headers: { host: 'example.com' },
+          },
+          (res) => {
+            res.resume();
+            resolve(res.statusCode);
+          },
+        );
+        req.on('error', reject);
+      });
+
+      expect(statusCode).toBe(500);
+    } finally {
+      await run.stop();
+    }
+  });
 });