diff --git a/private/buf/bufcurl/verbose_transport.go b/private/buf/bufcurl/verbose_transport.go
index 8415308815..6818f3f316 100644
--- a/private/buf/bufcurl/verbose_transport.go
+++ b/private/buf/bufcurl/verbose_transport.go
@@ -53,7 +53,7 @@ func DefaultUserAgent(protocol string, bufVersion string) string {
 	if strings.Contains(protocol, "grpc") {
 		libUserAgent = "grpc-go-connect"
 	}
-	return fmt.Sprintf("buf/%s %s/%s (%s)", bufVersion, libUserAgent, connect.Version, runtime.Version())
+	return fmt.Sprintf("%s/%s (%s) buf/%s", libUserAgent, connect.Version, runtime.Version(), bufVersion)
 }
 
 // NewVerboseHTTPClient creates a new HTTP client with the given transport and
diff --git a/private/buf/cmd/buf/command/curl/curl.go b/private/buf/cmd/buf/command/curl/curl.go
index 776526a2dc..0c3c4addc6 100644
--- a/private/buf/cmd/buf/command/curl/curl.go
+++ b/private/buf/cmd/buf/command/curl/curl.go
@@ -814,11 +814,11 @@ func run(ctx context.Context, container appflag.Container, f *flags) (err error)
 	if err != nil {
 		return err
 	}
+	userAgent := f.UserAgent
+	if userAgent == "" {
+		userAgent = bufcurl.DefaultUserAgent(f.Protocol, bufcli.Version)
+	}
 	if len(requestHeaders.Values("user-agent")) == 0 {
-		userAgent := f.UserAgent
-		if userAgent == "" {
-			userAgent = bufcurl.DefaultUserAgent(f.Protocol, bufcli.Version)
-		}
 		requestHeaders.Set("user-agent", userAgent)
 	}
 	var basicCreds *string
@@ -885,6 +885,9 @@ func run(ctx context.Context, container appflag.Container, f *flags) (err error)
 				reflectHeaders.Set("authorization", creds)
 			}
 		}
+		if len(reflectHeaders.Values("user-agent")) == 0 {
+			reflectHeaders.Set("user-agent", userAgent)
+		}
 		reflectProtocol, err := bufcurl.ParseReflectProtocol(f.ReflectProtocol)
 		if err != nil {
 			return err