diff --git a/atproto/auth.go b/atproto/auth.go
index 56d6a4e..4ce7759 100644
--- a/atproto/auth.go
+++ b/atproto/auth.go
@@ -181,6 +181,7 @@ func NewAuthManagerWithClient(httpClient *http.Client) *AuthManager {
 	store := NewKeyringStore()
 	app := oauth.NewClientApp(&config, store)
 	app.Client = httpClient
+	app.Resolver.Client = httpClient
 	// Best-effort: if the credentials directory cannot be created (e.g. no home
 	// directory), --insecure login will surface a clear error instead.
 	insecureStore, _ := newInsecureFileStore()
diff --git a/atproto/auth_test.go b/atproto/auth_test.go
index acdedbb..13f56f2 100644
--- a/atproto/auth_test.go
+++ b/atproto/auth_test.go
@@ -152,6 +152,15 @@ func TestRequestContextUsesClientTimeout(t *testing.T) {
 	}
 }
 
+func TestNewAuthManagerUsesConfiguredClientForOAuthDiscovery(t *testing.T) {
+	httpClient := &http.Client{}
+	manager := NewAuthManagerWithClient(httpClient)
+
+	if manager.app.Resolver.Client != httpClient {
+		t.Error("OAuth resolver does not use the configured HTTP client")
+	}
+}
+
 func TestAPIClientNotAuthenticated(t *testing.T) {
 	manager := newAuthManagerForTest("http://127.0.0.1:8095/callback", testKeyringStore(newFakeKeyring()))
 	_, _, err := manager.APIClient(context.Background())