How to update 'Allow' headers in DRF to match an OPTIONS request's permissions?

[why-not-try-calmer]

I am using Django Rest Framework 3.14 with ModelViewsets and a settings-wide DjangoModelOrAnonReadOnly permission class. I am trying to add custom HTTP headers to my responses to OPTIONS request, so as reflect the authentication/permission of the requesting party, like so:

def options(self, request, *args, **kwargs) -> response.Response:
    allowed_actions = self.metadata_class().determine_actions(request, self)
    allowed_actions = ", ".join(allowed_actions.keys())
    data = self.metadata_class().determine_metadata(request, self)
    return response.Response(data, headers={"Allow": allowed_actions})

Alas, the Allow header appears unmodifed. Am I missing something? Also, Is there any (better) way of doing what I am trying?

[why-not-try-calmer]

https://stackoverflow.com/a/76808421/4500155