diff --git a/src/zope/publisher/http.py b/src/zope/publisher/http.py
index 51ef486..f571f05 100644
--- a/src/zope/publisher/http.py
+++ b/src/zope/publisher/http.py
@@ -721,7 +721,7 @@ class HTTPResponse(BaseResponse):
         result.append(
             ("X-Powered-By", "Zope (www.zope.org), Python (www.python.org)"))
 
-        for key, values in headers.items():
+        for key, values in sorted(headers.items(), key=lambda x: x[0].lower()):
             if key.lower() == key:
                 # only change non-literal header names
                 key = '-'.join([k.capitalize() for k in key.split('-')])

Response headers are in random order
`HTTPResponse.getHeaders()` returns a list of headers in dictionary-internal order.  This causes problems like https://github.com/zopefoundation/zope.app.publication/issues/3.
diff --git a/src/zope/publisher/tests/test_browserrequest.py b/src/zope/publisher/tests/test_browserrequest.py
index 36c1233..250f93c 100644
--- a/src/zope/publisher/tests/test_browserrequest.py
+++ b/src/zope/publisher/tests/test_browserrequest.py
@@ -152,10 +152,10 @@ class BrowserTests(HTTPTests):
         self.assertEqual(
             res,
             "Status: 200 Ok\r\n"
+            "X-Powered-By: Zope (www.zope.org), Python (www.python.org)\r\n"
             "Content-Length: 6\r\n"
             "Content-Type: text/plain;charset=utf-8\r\n"
             "X-Content-Type-Warning: guessed from content\r\n"
-            "X-Powered-By: Zope (www.zope.org), Python (www.python.org)\r\n"
             "\r\n"
             "'5', 6")
 
diff --git a/src/zope/publisher/tests/test_http.py b/src/zope/publisher/tests/test_http.py
index 0772204..9859d6f 100644
--- a/src/zope/publisher/tests/test_http.py
+++ b/src/zope/publisher/tests/test_http.py
@@ -236,7 +236,6 @@ class HTTPTests(unittest.TestCase):
         response = request.response
         publish(request, handle_errors=False)
         headers = response.getHeaders()
-        headers.sort()
         return (
             "Status: %s\r\n" % response.getStatusString()
             +
@@ -273,8 +272,8 @@ class HTTPTests(unittest.TestCase):
         self.assertEqual(
             res,
             "Status: 200 Ok\r\n"
-            "Content-Length: 6\r\n"
             "X-Powered-By: Zope (www.zope.org), Python (www.python.org)\r\n"
+            "Content-Length: 6\r\n"
             "\r\n"
             "'5', 6")
 

pip install -e .[test]
parse_log_pytest
requirements.txt
pytest pytest-cov pytest-xdist pytest-mock pytest-asyncio
apt-get update apt-get install -y gcc
3.9
requirements/base.txt
pytest --no-header -rA --tb=line --color=no -p no:cacheprovider -W ignore::DeprecationWarning
coverage==7.8.0
exceptiongroup==1.2.2
execnet==2.1.1
iniconfig==2.1.0
packaging==24.2
pluggy==1.5.0
pytest==8.3.5
pytest-asyncio==0.26.0
pytest-cov==6.0.0
pytest-mock==3.14.0
pytest-xdist==3.6.1
python-gettext==5.0
pytz==2025.2
six==1.17.0
tomli==2.2.1
typing_extensions==4.13.0
zope.browser==3.1
zope.component==6.0
zope.configuration==6.0
zope.contenttype==5.2
zope.deprecation==5.1
zope.event==5.0
zope.exceptions==5.2
zope.hookable==7.0
zope.i18n==5.2
zope.i18nmessageid==7.0
zope.interface==7.2
zope.location==5.1
zope.proxy==6.1
-e git+https://github.com/zopefoundation/zope.publisher.git@57a3cee97207ab4a4f05924a07857d007109e17c#egg=zope.publisher
zope.schema==7.0.1
zope.security==7.3
zope.testing==5.1

name: zope.publisher
channels:
  - defaults
  - https://repo.anaconda.com/pkgs/main
  - https://repo.anaconda.com/pkgs/r
  - conda-forge
dependencies:
  - _libgcc_mutex=0.1=main
  - _openmp_mutex=5.1=1_gnu
  - ca-certificates=2025.2.25=h06a4308_0
  - ld_impl_linux-64=2.40=h12ee557_0
  - libffi=3.4.4=h6a678d5_1
  - libgcc-ng=11.2.0=h1234567_1
  - libgomp=11.2.0=h1234567_1
  - libstdcxx-ng=11.2.0=h1234567_1
  - ncurses=6.4=h6a678d5_0
  - openssl=3.0.16=h5eee18b_0
  - pip=25.0=py39h06a4308_0
  - python=3.9.21=he870216_1
  - readline=8.2=h5eee18b_0
  - setuptools=75.8.0=py39h06a4308_0
  - sqlite=3.45.3=h5eee18b_0
  - tk=8.6.14=h39e8969_0
  - tzdata=2025a=h04d1e81_0
  - wheel=0.45.1=py39h06a4308_0
  - xz=5.6.4=h5eee18b_1
  - zlib=1.2.13=h5eee18b_1
  - pip:
      - coverage==7.8.0
      - exceptiongroup==1.2.2
      - execnet==2.1.1
      - iniconfig==2.1.0
      - packaging==24.2
      - pluggy==1.5.0
      - pytest==8.3.5
      - pytest-asyncio==0.26.0
      - pytest-cov==6.0.0
      - pytest-mock==3.14.0
      - pytest-xdist==3.6.1
      - python-gettext==5.0
      - pytz==2025.2
      - six==1.17.0
      - tomli==2.2.1
      - typing-extensions==4.13.0
      - zope-browser==3.1
      - zope-component==6.0
      - zope-configuration==6.0
      - zope-contenttype==5.2
      - zope-deprecation==5.1
      - zope-event==5.0
      - zope-exceptions==5.2
      - zope-hookable==7.0
      - zope-i18n==5.2
      - zope-i18nmessageid==7.0
      - zope-interface==7.2
      - zope-location==5.1
      - zope-proxy==6.1
      - zope-schema==7.0.1
      - zope-security==7.3
      - zope-testing==5.1
prefix: /opt/conda/envs/zope.publisher

src/zope/publisher/tests/test_browserrequest.py::BrowserTests::testTraversalToItem
src/zope/publisher/tests/test_browserrequest.py::HTTPTests::testCookieErrorToLog src/zope/publisher/tests/test_browserrequest.py::BrowserTests::testCookieErrorToLog src/zope/publisher/tests/test_http.py::HTTPTests::testCookieErrorToLog src/zope/publisher/tests/test_http.py::ConcreteHTTPTests::testCookieErrorToLog src/zope/publisher/tests/test_http.py::TestHTTPResponse::testSetCookie
src/zope/publisher/tests/test_browserrequest.py::HTTPTests::testBasicAuth src/zope/publisher/tests/test_browserrequest.py::HTTPTests::testCookies src/zope/publisher/tests/test_browserrequest.py::HTTPTests::testCookiesUnicode src/zope/publisher/tests/test_browserrequest.py::HTTPTests::testDeduceServerURL src/zope/publisher/tests/test_browserrequest.py::HTTPTests::testHeaders src/zope/publisher/tests/test_browserrequest.py::HTTPTests::testInterface src/zope/publisher/tests/test_browserrequest.py::HTTPTests::testRedirect src/zope/publisher/tests/test_browserrequest.py::HTTPTests::testRequestEnvironment src/zope/publisher/tests/test_browserrequest.py::HTTPTests::testRequestLocale src/zope/publisher/tests/test_browserrequest.py::HTTPTests::testResponseWriteFaile src/zope/publisher/tests/test_browserrequest.py::HTTPTests::testSetPrincipal src/zope/publisher/tests/test_browserrequest.py::HTTPTests::testTraversalToItem src/zope/publisher/tests/test_browserrequest.py::HTTPTests::testUnicodeURLs src/zope/publisher/tests/test_browserrequest.py::HTTPTests::testUnregisteredStatus src/zope/publisher/tests/test_browserrequest.py::HTTPTests::testUntrustedRedirect src/zope/publisher/tests/test_browserrequest.py::HTTPTests::test_PathTrailingWhitespace src/zope/publisher/tests/test_browserrequest.py::HTTPTests::test_double_dots src/zope/publisher/tests/test_browserrequest.py::HTTPTests::test_getVirtualHostRoot src/zope/publisher/tests/test_browserrequest.py::HTTPTests::test_method src/zope/publisher/tests/test_browserrequest.py::HTTPTests::test_repr src/zope/publisher/tests/test_browserrequest.py::HTTPTests::test_setApplicationNames src/zope/publisher/tests/test_browserrequest.py::HTTPTests::test_setApplicationServer src/zope/publisher/tests/test_browserrequest.py::HTTPTests::test_setVirtualHostRoot src/zope/publisher/tests/test_browserrequest.py::HTTPTests::test_traverse src/zope/publisher/tests/test_browserrequest.py::HTTPTests::test_traverseDuplicateHooks src/zope/publisher/tests/test_browserrequest.py::HTTPTests::test_unacceptable_charset src/zope/publisher/tests/test_browserrequest.py::BrowserTests::testBadPath src/zope/publisher/tests/test_browserrequest.py::BrowserTests::testBadPath2 src/zope/publisher/tests/test_browserrequest.py::BrowserTests::testBasicAuth src/zope/publisher/tests/test_browserrequest.py::BrowserTests::testCookies src/zope/publisher/tests/test_browserrequest.py::BrowserTests::testCookiesUnicode src/zope/publisher/tests/test_browserrequest.py::BrowserTests::testDeduceServerURL src/zope/publisher/tests/test_browserrequest.py::BrowserTests::testDefault src/zope/publisher/tests/test_browserrequest.py::BrowserTests::testDefault2 src/zope/publisher/tests/test_browserrequest.py::BrowserTests::testDefault3 src/zope/publisher/tests/test_browserrequest.py::BrowserTests::testDefault4 src/zope/publisher/tests/test_browserrequest.py::BrowserTests::testDefault6 src/zope/publisher/tests/test_browserrequest.py::BrowserTests::testDefaultPOST src/zope/publisher/tests/test_browserrequest.py::BrowserTests::testFileUploadPost src/zope/publisher/tests/test_browserrequest.py::BrowserTests::testForm src/zope/publisher/tests/test_browserrequest.py::BrowserTests::testFormAcceptsStarButNotUTF8 src/zope/publisher/tests/test_browserrequest.py::BrowserTests::testFormBooleanTypes src/zope/publisher/tests/test_browserrequest.py::BrowserTests::testFormDefaults src/zope/publisher/tests/test_browserrequest.py::BrowserTests::testFormDefaults2 src/zope/publisher/tests/test_browserrequest.py::BrowserTests::testFormFieldName src/zope/publisher/tests/test_browserrequest.py::BrowserTests::testFormFieldValue src/zope/publisher/tests/test_browserrequest.py::BrowserTests::testFormFloatTypes src/zope/publisher/tests/test_browserrequest.py::BrowserTests::testFormIntTypes src/zope/publisher/tests/test_browserrequest.py::BrowserTests::testFormLinesTypes src/zope/publisher/tests/test_browserrequest.py::BrowserTests::testFormListRecordTypes src/zope/publisher/tests/test_browserrequest.py::BrowserTests::testFormListTypes src/zope/publisher/tests/test_browserrequest.py::BrowserTests::testFormListTypes2 src/zope/publisher/tests/test_browserrequest.py::BrowserTests::testFormLongTypes src/zope/publisher/tests/test_browserrequest.py::BrowserTests::testFormMultipleRecordsTypes src/zope/publisher/tests/test_browserrequest.py::BrowserTests::testFormNoEncodingUsesUTF8 src/zope/publisher/tests/test_browserrequest.py::BrowserTests::testFormRecordsTypes src/zope/publisher/tests/test_browserrequest.py::BrowserTests::testFormRequiredTypes src/zope/publisher/tests/test_browserrequest.py::BrowserTests::testFormStringTypes src/zope/publisher/tests/test_browserrequest.py::BrowserTests::testFormTextTypes src/zope/publisher/tests/test_browserrequest.py::BrowserTests::testFormTokensTypes src/zope/publisher/tests/test_browserrequest.py::BrowserTests::testFormTupleRecordTypes src/zope/publisher/tests/test_browserrequest.py::BrowserTests::testFormTupleTypes src/zope/publisher/tests/test_browserrequest.py::BrowserTests::testHeaders src/zope/publisher/tests/test_browserrequest.py::BrowserTests::testInterface src/zope/publisher/tests/test_browserrequest.py::BrowserTests::testIssue394 src/zope/publisher/tests/test_browserrequest.py::BrowserTests::testIssue559 src/zope/publisher/tests/test_browserrequest.py::BrowserTests::testNoDefault src/zope/publisher/tests/test_browserrequest.py::BrowserTests::testNoneFieldNamePost src/zope/publisher/tests/test_browserrequest.py::BrowserTests::testQueryStringIgnoredForPOST src/zope/publisher/tests/test_browserrequest.py::BrowserTests::testRedirect src/zope/publisher/tests/test_browserrequest.py::BrowserTests::testRequestEnvironment src/zope/publisher/tests/test_browserrequest.py::BrowserTests::testRequestLocale src/zope/publisher/tests/test_browserrequest.py::BrowserTests::testResponseWriteFaile src/zope/publisher/tests/test_browserrequest.py::BrowserTests::testSetPrincipal src/zope/publisher/tests/test_browserrequest.py::BrowserTests::testUnicodeURLs src/zope/publisher/tests/test_browserrequest.py::BrowserTests::testUnregisteredStatus src/zope/publisher/tests/test_browserrequest.py::BrowserTests::testUntrustedRedirect src/zope/publisher/tests/test_browserrequest.py::BrowserTests::test_PathTrailingWhitespace src/zope/publisher/tests/test_browserrequest.py::BrowserTests::test_double_dots src/zope/publisher/tests/test_browserrequest.py::BrowserTests::test_getVirtualHostRoot src/zope/publisher/tests/test_browserrequest.py::BrowserTests::test_method src/zope/publisher/tests/test_browserrequest.py::BrowserTests::test_post_body_not_consumed_unnecessarily src/zope/publisher/tests/test_browserrequest.py::BrowserTests::test_post_body_not_necessarily src/zope/publisher/tests/test_browserrequest.py::BrowserTests::test_repr src/zope/publisher/tests/test_browserrequest.py::BrowserTests::test_setApplicationNames src/zope/publisher/tests/test_browserrequest.py::BrowserTests::test_setApplicationServer src/zope/publisher/tests/test_browserrequest.py::BrowserTests::test_setVirtualHostRoot src/zope/publisher/tests/test_browserrequest.py::BrowserTests::test_traverse src/zope/publisher/tests/test_browserrequest.py::BrowserTests::test_traverseDuplicateHooks src/zope/publisher/tests/test_browserrequest.py::BrowserTests::test_unacceptable_charset src/zope/publisher/tests/test_browserrequest.py::APITests::testEnvironment src/zope/publisher/tests/test_browserrequest.py::APITests::testGetAndDefaultInMapping src/zope/publisher/tests/test_browserrequest.py::APITests::testHaveCustomTestsForIApplicationRequest src/zope/publisher/tests/test_browserrequest.py::APITests::testHaveCustomTestsForIPublicationRequest src/zope/publisher/tests/test_browserrequest.py::APITests::testHaveCustomTestsForIPublisherRequest src/zope/publisher/tests/test_browserrequest.py::APITests::testHoldCloseAndGetResponse src/zope/publisher/tests/test_browserrequest.py::APITests::testIReadMapping src/zope/publisher/tests/test_browserrequest.py::APITests::testPublicationManagement src/zope/publisher/tests/test_browserrequest.py::APITests::testSkinManagement src/zope/publisher/tests/test_browserrequest.py::APITests::testTraversalStack src/zope/publisher/tests/test_browserrequest.py::APITests::testVerifyIApplicationRequest src/zope/publisher/tests/test_browserrequest.py::APITests::testVerifyIPublicationRequest src/zope/publisher/tests/test_browserrequest.py::APITests::testVerifyIPublisherRequest src/zope/publisher/tests/test_browserrequest.py::APITests::testVerifyISkinnable src/zope/publisher/tests/test_browserrequest.py::APITests::test_IApplicationRequest_bodyStream src/zope/publisher/tests/test_browserrequest.py::APITests::test_IBrowserRequest src/zope/publisher/tests/test_browserrequest.py::APITests::test_IPublicationRequest_getPositionalArguments src/zope/publisher/tests/test_browserrequest.py::APITests::test_IPublisherRequest_processInputs src/zope/publisher/tests/test_browserrequest.py::APITests::test_IPublisherRequest_retry src/zope/publisher/tests/test_browserrequest.py::APITests::test_IPublisherRequest_traverse src/zope/publisher/tests/test_browserrequest.py::APITests::test_ISkinnable src/zope/publisher/tests/test_browserrequest.py::APITests::test___len__ src/zope/publisher/tests/test_browserrequest.py::APITests::test_items src/zope/publisher/tests/test_browserrequest.py::APITests::test_keys src/zope/publisher/tests/test_browserrequest.py::APITests::test_values src/zope/publisher/tests/test_browserrequest.py::test_suite src/zope/publisher/tests/test_http.py::HTTPInputStreamTests::testCachingWithContentLength src/zope/publisher/tests/test_http.py::HTTPInputStreamTests::testGetCacheStream src/zope/publisher/tests/test_http.py::HTTPInputStreamTests::testRead src/zope/publisher/tests/test_http.py::HTTPInputStreamTests::testReadLine src/zope/publisher/tests/test_http.py::HTTPInputStreamTests::testReadLines src/zope/publisher/tests/test_http.py::HTTPInputStreamTests::testWorkingWithNonClosingStreams src/zope/publisher/tests/test_http.py::HTTPTests::testBasicAuth src/zope/publisher/tests/test_http.py::HTTPTests::testCookies src/zope/publisher/tests/test_http.py::HTTPTests::testCookiesUnicode src/zope/publisher/tests/test_http.py::HTTPTests::testDeduceServerURL src/zope/publisher/tests/test_http.py::HTTPTests::testHeaders src/zope/publisher/tests/test_http.py::HTTPTests::testInterface src/zope/publisher/tests/test_http.py::HTTPTests::testRedirect src/zope/publisher/tests/test_http.py::HTTPTests::testRequestEnvironment src/zope/publisher/tests/test_http.py::HTTPTests::testRequestLocale src/zope/publisher/tests/test_http.py::HTTPTests::testResponseWriteFaile src/zope/publisher/tests/test_http.py::HTTPTests::testSetPrincipal src/zope/publisher/tests/test_http.py::HTTPTests::testTraversalToItem src/zope/publisher/tests/test_http.py::HTTPTests::testUnicodeURLs src/zope/publisher/tests/test_http.py::HTTPTests::testUnregisteredStatus src/zope/publisher/tests/test_http.py::HTTPTests::testUntrustedRedirect src/zope/publisher/tests/test_http.py::HTTPTests::test_PathTrailingWhitespace src/zope/publisher/tests/test_http.py::HTTPTests::test_double_dots src/zope/publisher/tests/test_http.py::HTTPTests::test_getVirtualHostRoot src/zope/publisher/tests/test_http.py::HTTPTests::test_method src/zope/publisher/tests/test_http.py::HTTPTests::test_repr src/zope/publisher/tests/test_http.py::HTTPTests::test_setApplicationNames src/zope/publisher/tests/test_http.py::HTTPTests::test_setApplicationServer src/zope/publisher/tests/test_http.py::HTTPTests::test_setVirtualHostRoot src/zope/publisher/tests/test_http.py::HTTPTests::test_traverse src/zope/publisher/tests/test_http.py::HTTPTests::test_traverseDuplicateHooks src/zope/publisher/tests/test_http.py::HTTPTests::test_unacceptable_charset src/zope/publisher/tests/test_http.py::ConcreteHTTPTests::testBasicAuth src/zope/publisher/tests/test_http.py::ConcreteHTTPTests::testCookies src/zope/publisher/tests/test_http.py::ConcreteHTTPTests::testCookiesUnicode src/zope/publisher/tests/test_http.py::ConcreteHTTPTests::testDeduceServerURL src/zope/publisher/tests/test_http.py::ConcreteHTTPTests::testHeaders src/zope/publisher/tests/test_http.py::ConcreteHTTPTests::testInterface src/zope/publisher/tests/test_http.py::ConcreteHTTPTests::testRedirect src/zope/publisher/tests/test_http.py::ConcreteHTTPTests::testRequestEnvironment src/zope/publisher/tests/test_http.py::ConcreteHTTPTests::testRequestLocale src/zope/publisher/tests/test_http.py::ConcreteHTTPTests::testResponseWriteFaile src/zope/publisher/tests/test_http.py::ConcreteHTTPTests::testSetPrincipal src/zope/publisher/tests/test_http.py::ConcreteHTTPTests::testTraversalToItem src/zope/publisher/tests/test_http.py::ConcreteHTTPTests::testUnicodeURLs src/zope/publisher/tests/test_http.py::ConcreteHTTPTests::testUnregisteredStatus src/zope/publisher/tests/test_http.py::ConcreteHTTPTests::testUntrustedRedirect src/zope/publisher/tests/test_http.py::ConcreteHTTPTests::test_PathTrailingWhitespace src/zope/publisher/tests/test_http.py::ConcreteHTTPTests::test_double_dots src/zope/publisher/tests/test_http.py::ConcreteHTTPTests::test_getVirtualHostRoot src/zope/publisher/tests/test_http.py::ConcreteHTTPTests::test_method src/zope/publisher/tests/test_http.py::ConcreteHTTPTests::test_non_existing_charset src/zope/publisher/tests/test_http.py::ConcreteHTTPTests::test_repr src/zope/publisher/tests/test_http.py::ConcreteHTTPTests::test_setApplicationNames src/zope/publisher/tests/test_http.py::ConcreteHTTPTests::test_setApplicationServer src/zope/publisher/tests/test_http.py::ConcreteHTTPTests::test_setVirtualHostRoot src/zope/publisher/tests/test_http.py::ConcreteHTTPTests::test_shiftNameToApplication src/zope/publisher/tests/test_http.py::ConcreteHTTPTests::test_traverse src/zope/publisher/tests/test_http.py::ConcreteHTTPTests::test_traverseDuplicateHooks src/zope/publisher/tests/test_http.py::ConcreteHTTPTests::test_unacceptable_charset src/zope/publisher/tests/test_http.py::TestHTTPResponse::testContentLength src/zope/publisher/tests/test_http.py::TestHTTPResponse::testContentType src/zope/publisher/tests/test_http.py::TestHTTPResponse::testInterface src/zope/publisher/tests/test_http.py::TestHTTPResponse::testWrite_noContentLength src/zope/publisher/tests/test_http.py::TestHTTPResponse::test_handleException src/zope/publisher/tests/test_http.py::APITests::testEnvironment src/zope/publisher/tests/test_http.py::APITests::testGetAndDefaultInMapping src/zope/publisher/tests/test_http.py::APITests::testHaveCustomTestsForIApplicationRequest src/zope/publisher/tests/test_http.py::APITests::testHaveCustomTestsForIPublicationRequest src/zope/publisher/tests/test_http.py::APITests::testHaveCustomTestsForIPublisherRequest src/zope/publisher/tests/test_http.py::APITests::testHoldCloseAndGetResponse src/zope/publisher/tests/test_http.py::APITests::testIReadMapping src/zope/publisher/tests/test_http.py::APITests::testPublicationManagement src/zope/publisher/tests/test_http.py::APITests::testSkinManagement src/zope/publisher/tests/test_http.py::APITests::testTraversalStack src/zope/publisher/tests/test_http.py::APITests::testVerifyIApplicationRequest src/zope/publisher/tests/test_http.py::APITests::testVerifyIPublicationRequest src/zope/publisher/tests/test_http.py::APITests::testVerifyIPublisherRequest src/zope/publisher/tests/test_http.py::APITests::test_IApplicationRequest_bodyStream src/zope/publisher/tests/test_http.py::APITests::test_IPublicationRequest_getPositionalArguments src/zope/publisher/tests/test_http.py::APITests::test_IPublisherRequest_processInputs src/zope/publisher/tests/test_http.py::APITests::test_IPublisherRequest_retry src/zope/publisher/tests/test_http.py::APITests::test_IPublisherRequest_traverse src/zope/publisher/tests/test_http.py::APITests::test___len__ src/zope/publisher/tests/test_http.py::APITests::test_items src/zope/publisher/tests/test_http.py::APITests::test_keys src/zope/publisher/tests/test_http.py::APITests::test_values src/zope/publisher/tests/test_http.py::test_suite
src/zope/publisher/http.py
src/zope/publisher/http.py