amtk3 · amtk3 · Jun 9, 2026 · Jun 9, 2026 · Jun 9, 2026
diff --git a/packages/google-auth/google/auth/impersonated_credentials.py b/packages/google-auth/google/auth/impersonated_credentials.py
@@ -388,6 +388,7 @@ def sign_bytes(self, message):
        headers = {"Content-Type": "application/json"}

        authed_session = AuthorizedSession(self._source_credentials)
+        authed_session.configure_mtls_channel()

        try:
            retries = _exponential_backoff.ExponentialBackoff()
@@ -627,6 +628,7 @@ def refresh(self, request):
        authed_session = AuthorizedSession(
            self._target_credentials._source_credentials, auth_request=request
        )
+        authed_session.configure_mtls_channel()

        try:
            response = authed_session.post(

diff --git a/packages/google-auth/tests/test_impersonated_credentials.py b/packages/google-auth/tests/test_impersonated_credentials.py
@@ -639,6 +639,19 @@ def _sign_bytes_helper(

        assert signature == b"signature"

+    @mock.patch("google.auth.transport.requests.AuthorizedSession.configure_mtls_channel", autospec=True)
+    def test_sign_bytes_configures_mtls(self, mock_configure_mtls, mock_donor_credentials, mock_authorizedsession_sign):
+        credentials = self.make_credentials(lifetime=None)
+        # Refresh is needed to make credentials valid before signing
+        request = self.make_request(
+            data=json.dumps({"accessToken": "token", "expireTime": "2026-06-09T00:00:00Z"}),
+            status=http_client.OK,
+        )
+        credentials.refresh(request)
+
+        credentials.sign_bytes(b"signed bytes")
+        mock_configure_mtls.assert_called_once()
+
    def test_sign_bytes_failure(self):
        credentials = self.make_credentials(lifetime=None)

@@ -751,6 +764,22 @@ def test_with_scopes_provide_default_scopes(self):
        )
        assert credentials._target_scopes == ["fake_scope1"]

+    @mock.patch("google.auth.transport.requests.AuthorizedSession.configure_mtls_channel", autospec=True)
+    def test_id_token_refresh_configures_mtls(self, mock_configure_mtls, mock_donor_credentials):
+        credentials = self.make_credentials(lifetime=None)
+        credentials.token = "token"
+        id_creds = impersonated_credentials.IDTokenCredentials(
+            credentials, target_audience="https://foo.bar"
+        )
+
+        with mock.patch(
+            "google.auth.transport.requests.AuthorizedSession.post", autospec=True
+        ) as mock_post:
+            mock_post.return_value = MockResponse({"token": ID_TOKEN_DATA}, http_client.OK)
+            id_creds.refresh(None)
+
+            mock_configure_mtls.assert_called_once()
+
    def test_id_token_success(
        self, mock_donor_credentials, mock_authorizedsession_idtoken
    ):