diff --git a/src/ngx_base_fetch.h b/src/ngx_base_fetch.h
index 6a3fa9cbb..b56b93f97 100644
--- a/src/ngx_base_fetch.h
+++ b/src/ngx_base_fetch.h
@@ -116,6 +116,7 @@ class NgxBaseFetch : public AsyncFetch {
   bool detached() { return detached_; }
 
   ngx_http_request_t* request() { return request_; }
+  NgxBaseFetchType base_fetch_type() { return base_fetch_type_; }
 
  private:
   virtual bool HandleWrite(const StringPiece& sp, MessageHandler* handler);
diff --git a/src/ngx_pagespeed.cc b/src/ngx_pagespeed.cc
index 9cb106626..eb6877c09 100644
--- a/src/ngx_pagespeed.cc
+++ b/src/ngx_pagespeed.cc
@@ -266,6 +266,19 @@ ngx_int_t ps_base_fetch_handler(ngx_http_request_t* r) {
                  "ps fetch handler: %V", &r->uri);
 
   if (!r->header_sent) {
+    int status_code = ctx->base_fetch->response_headers()->status_code();
+    bool status_ok = (status_code != 0) && (status_code < 400);
+
+    // Pass on error handling for non-success status codes to nginx for
+    // responses where PSOL acts as a content generator (pagespeed resource,
+    // ipro hit, admin pages).
+    // This generates nginx's default error responses, but also allows header
+    // modules running after us to manipulate those responses.
+    if (!status_ok && (ctx->base_fetch->base_fetch_type() != kHtmlTransform
+                       && ctx->base_fetch->base_fetch_type() != kIproLookup)) {
+      return status_code;
+    }
+
     if (ctx->preserve_caching_headers != kDontPreserveHeaders) {
       ngx_table_elt_t* header;
       NgxListIterator it(&(r->headers_out.headers.part));
diff --git a/test/nginx_system_test.sh b/test/nginx_system_test.sh
index 9a8967e46..2a6f7a835 100644
--- a/test/nginx_system_test.sh
+++ b/test/nginx_system_test.sh
@@ -1143,6 +1143,16 @@ OUT=$(http_proxy=$SECONDARY_HOSTNAME $WGET_DUMP -O /dev/null -S $URL 2>&1)
 MATCHES=$(echo "$OUT" | grep -c "Server: override") || true
 check [ $MATCHES -eq 1 ]
 
+start_test Conditional cache-control header override in resource flow.
+URL=http://headers.example.com/mod_pagespeed_test/
+URL+=A.doesnotexist.css.pagespeed.cf.0.css
+# The 404 response makes wget exit with an error code, which we ignore.
+OUT=$(http_proxy=$SECONDARY_HOSTNAME $WGET_DUMP -O /dev/null -S $URL 2>&1) || true
+# We ignored the exit code, check if we got a 404 response.
+check_from "$OUT" fgrep -qi '404'
+MATCHES=$(echo "$OUT" | grep -c "Cache-Control: override") || true
+check [ $MATCHES -eq 1 ]
+
 if $USE_VALGRIND; then
     # It is possible that there are still ProxyFetches outstanding
     # at this point in time. Give them a few extra seconds to allow
diff --git a/test/pagespeed_test.conf.template b/test/pagespeed_test.conf.template
index ac8d9e498..335cad100 100644
--- a/test/pagespeed_test.conf.template
+++ b/test/pagespeed_test.conf.template
@@ -1192,7 +1192,8 @@ http {
     pagespeed LoadFromFile "http://headers.example.com/"
               "@@SERVER_ROOT@@/";
     location /mod_pagespeed_test/ {
-      more_set_headers "Server: overriden";
+      more_set_headers "Server: override";
+      more_set_headers -s '404' 'Cache-Control: override';
     }
   }