googleapis
diff --git a/Collapse file
‎packages/google-auth/google/auth/impersonated_credentials.py‎
Copy file name to clipboardExpand all lines: packages/google-auth/google/auth/impersonated_credentials.py
+2Lines changed: 2 additions & 0 deletions b/Collapse file
‎packages/google-auth/google/auth/impersonated_credentials.py‎
Copy file name to clipboardExpand all lines: packages/google-auth/google/auth/impersonated_credentials.py
+2Lines changed: 2 additions & 0 deletions
diff --git a/Collapse file
‎packages/google-auth/tests/test_impersonated_credentials.py‎
Copy file name to clipboardExpand all lines: packages/google-auth/tests/test_impersonated_credentials.py
+43Lines changed: 43 additions & 0 deletions b/Collapse file
‎packages/google-auth/tests/test_impersonated_credentials.py‎
Copy file name to clipboardExpand all lines: packages/google-auth/tests/test_impersonated_credentials.py
+43Lines changed: 43 additions & 0 deletions
@@ -388,6 +388,7 @@ def sign_bytes(self, message):
         headers = {"Content-Type": "application/json"}
 
         authed_session = AuthorizedSession(self._source_credentials)
+        authed_session.configure_mtls_channel()
 
         try:
             retries = _exponential_backoff.ExponentialBackoff()
@@ -627,6 +628,7 @@ def refresh(self, request):
         authed_session = AuthorizedSession(
             self._target_credentials._source_credentials, auth_request=request
         )
+        authed_session.configure_mtls_channel()
 
         try:
             response = authed_session.post(
 
@@ -639,6 +639,26 @@ def _sign_bytes_helper(
 
         assert signature == b"signature"
 
+    @mock.patch(
+        "google.auth.transport.requests.AuthorizedSession.configure_mtls_channel",
+        autospec=True,
+    )
+    def test_sign_bytes_configures_mtls(
+        self, mock_configure_mtls, mock_donor_credentials, mock_authorizedsession_sign
+    ):
+        credentials = self.make_credentials(lifetime=None)
+        # Refresh is needed to make credentials valid before signing
+        request = self.make_request(
+            data=json.dumps(
+                {"accessToken": "token", "expireTime": "2026-06-09T00:00:00Z"}
+            ),
+            status=http_client.OK,
+        )
+        credentials.refresh(request)
+
+        credentials.sign_bytes(b"signed bytes")
+        mock_configure_mtls.assert_called_once()
+
     def test_sign_bytes_failure(self):
         credentials = self.make_credentials(lifetime=None)
 
@@ -751,6 +771,29 @@ def test_with_scopes_provide_default_scopes(self):
         )
         assert credentials._target_scopes == ["fake_scope1"]
 
+    @mock.patch(
+        "google.auth.transport.requests.AuthorizedSession.configure_mtls_channel",
+        autospec=True,
+    )
+    def test_id_token_refresh_configures_mtls(
+        self, mock_configure_mtls, mock_donor_credentials
+    ):
+        credentials = self.make_credentials(lifetime=None)
+        credentials.token = "token"
+        id_creds = impersonated_credentials.IDTokenCredentials(
+            credentials, target_audience="https://foo.bar"
+        )
+
+        with mock.patch(
+            "google.auth.transport.requests.AuthorizedSession.post", autospec=True
+        ) as mock_post:
+            mock_post.return_value = MockResponse(
+                {"token": ID_TOKEN_DATA}, http_client.OK
+            )
+            id_creds.refresh(None)
+
+            mock_configure_mtls.assert_called_once()
+
     def test_id_token_success(
         self, mock_donor_credentials, mock_authorizedsession_idtoken
     ):