diff --git a/http_client_pool.go b/http_client_pool.go
index 6eaf622..8dc2932 100644
--- a/http_client_pool.go
+++ b/http_client_pool.go
@@ -121,11 +121,11 @@ func (p *SharedTransportPool) GetOrCreateTransport(config HTTPClientConfig) *htt
 		ForceAttemptHTTP2:     config.ForceHTTP2,
 		TLSHandshakeTimeout:   config.TLSHandshakeTimeout,
 		ExpectContinueTimeout: config.ExpectContinueTimeout,
-		MaxIdleConns:          10,               // SECURITY FIX: Further reduced
-		MaxIdleConnsPerHost:   2,                // SECURITY FIX: Limited connections
-		IdleConnTimeout:       30 * time.Second, // Reduced from 5 minutes
+		MaxIdleConns:          config.MaxIdleConns,
+		MaxIdleConnsPerHost:   config.MaxIdleConnsPerHost,
+		IdleConnTimeout:       config.IdleConnTimeout,
 		DisableKeepAlives:     config.DisableKeepAlives,
-		MaxConnsPerHost:       5, // SECURITY FIX: Strict limit
+		MaxConnsPerHost:       config.MaxConnsPerHost,
 		ResponseHeaderTimeout: config.ResponseHeaderTimeout,
 		DisableCompression:    config.DisableCompression,
 		WriteBufferSize:       config.WriteBufferSize,
diff --git a/http_client_pool_test.go b/http_client_pool_test.go
index 9bf96cd..f5ec70e 100644
--- a/http_client_pool_test.go
+++ b/http_client_pool_test.go
@@ -689,3 +689,38 @@ func TestSharedTransportPoolEdgeCases(t *testing.T) {
 		assert.Equal(t, int32(0), finalCount, "client count should decrement on cleanup")
 	})
 }
+
+// TestSharedTransportPoolAppliesConfigLimits is a regression test: the pooled
+// transport must apply the configured connection limits (MaxConnsPerHost,
+// MaxIdleConnsPerHost, MaxIdleConns, IdleConnTimeout) rather than hardcoded
+// constants. Previously GetOrCreateTransport built the transport with fixed
+// values (5/2/10/30s) while configKey still incorporated these config fields,
+// so the config was valid, keyed, and validated but silently ignored
+// (dead config) — e.g. OIDCProviderHTTPClientConfig's tuning had no effect.
+func TestSharedTransportPoolAppliesConfigLimits(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	pool := &SharedTransportPool{
+		transports:  make(map[string]*sharedTransport),
+		maxConns:    20,
+		clientCount: 0,
+		maxClients:  5,
+		ctx:         ctx,
+		cancel:      cancel,
+	}
+
+	config := DefaultHTTPClientConfig()
+	config.MaxConnsPerHost = 37
+	config.MaxIdleConnsPerHost = 13
+	config.MaxIdleConns = 41
+	config.IdleConnTimeout = 7 * time.Second
+
+	transport := pool.GetOrCreateTransport(config)
+	require.NotNil(t, transport)
+
+	assert.Equal(t, 37, transport.MaxConnsPerHost, "MaxConnsPerHost must come from config")
+	assert.Equal(t, 13, transport.MaxIdleConnsPerHost, "MaxIdleConnsPerHost must come from config")
+	assert.Equal(t, 41, transport.MaxIdleConns, "MaxIdleConns must come from config")
+	assert.Equal(t, 7*time.Second, transport.IdleConnTimeout, "IdleConnTimeout must come from config")
+}