diff --git a/sigstore-java/build.gradle.kts b/sigstore-java/build.gradle.kts
index 3b3d3145e..8c5a3eea4 100644
--- a/sigstore-java/build.gradle.kts
+++ b/sigstore-java/build.gradle.kts
@@ -16,7 +16,7 @@ dependencies {
     annotationProcessor("org.immutables:value:2.12.2")
 
     implementation(platform("com.google.http-client:google-http-client-bom:2.1.1"))
-    implementation("com.google.http-client:google-http-client-apache-v2")
+    implementation("com.google.http-client:google-http-client-apache-v5")
     implementation("com.google.http-client:google-http-client-gson")
 
     implementation("io.github.erdtman:java-json-canonicalization:1.1")
@@ -34,7 +34,6 @@ dependencies {
     runtimeOnly("io.grpc:grpc-netty-shaded")
     compileOnly("org.apache.tomcat:annotations-api:6.0.53") // java 9+ only
 
-    implementation("commons-codec:commons-codec:1.18.0")
     implementation("com.google.code.gson:gson:2.14.0")
     implementation("org.bouncycastle:bcutil-jdk18on:1.84")
     implementation("org.bouncycastle:bcpkix-jdk18on:1.84")
diff --git a/sigstore-java/src/main/java/dev/sigstore/http/HttpClients.java b/sigstore-java/src/main/java/dev/sigstore/http/HttpClients.java
index d9fd5f20c..1c62d7213 100644
--- a/sigstore-java/src/main/java/dev/sigstore/http/HttpClients.java
+++ b/sigstore-java/src/main/java/dev/sigstore/http/HttpClients.java
@@ -18,14 +18,17 @@
 import com.google.api.client.http.HttpBackOffIOExceptionHandler;
 import com.google.api.client.http.HttpRequestFactory;
 import com.google.api.client.http.HttpTransport;
-import com.google.api.client.http.apache.v2.ApacheHttpTransport;
+import com.google.api.client.http.apache.v5.Apache5HttpTransport;
 import com.google.api.client.util.ExponentialBackOff;
 import com.google.api.client.util.ObjectParser;
 import dev.sigstore.forbidden.SuppressForbidden;
 import javax.annotation.Nullable;
-import org.apache.http.HttpHeaders;
-import org.apache.http.conn.ssl.NoopHostnameVerifier;
-import org.apache.http.impl.client.HttpClientBuilder;
+import org.apache.hc.client5.http.config.ConnectionConfig;
+import org.apache.hc.client5.http.impl.io.PoolingHttpClientConnectionManagerBuilder;
+import org.apache.hc.client5.http.ssl.NoopHostnameVerifier;
+import org.apache.hc.client5.http.ssl.SSLConnectionSocketFactoryBuilder;
+import org.apache.hc.core5.http.HttpHeaders;
+import org.apache.hc.core5.util.TimeValue;
 
 /** HttpClients generates Google Http Client objects from configuration. */
 public class HttpClients {
@@ -36,11 +39,24 @@ public class HttpClients {
    * you need to also configure the response parser}.
    */
   public static HttpTransport newHttpTransport(HttpParams httpParams) {
-    HttpClientBuilder hcb = ApacheHttpTransport.newDefaultHttpClientBuilder();
     if (httpParams.getAllowInsecureConnections()) {
-      hcb.setSSLHostnameVerifier(NoopHostnameVerifier.INSTANCE);
+      var connManager =
+          PoolingHttpClientConnectionManagerBuilder.create()
+              .setSSLSocketFactory(
+                  SSLConnectionSocketFactoryBuilder.create()
+                      .setHostnameVerifier(NoopHostnameVerifier.INSTANCE)
+                      .build())
+              .setMaxConnTotal(200)
+              .setMaxConnPerRoute(20)
+              .setDefaultConnectionConfig(
+                  ConnectionConfig.custom().setTimeToLive(TimeValue.NEG_ONE_MILLISECOND).build())
+              .build();
+      return new Apache5HttpTransport(
+          Apache5HttpTransport.newDefaultHttpClientBuilder()
+              .setConnectionManager(connManager)
+              .build());
     }
-    return new ApacheHttpTransport(hcb.build());
+    return new Apache5HttpTransport(Apache5HttpTransport.newDefaultHttpClientBuilder().build());
   }
 
   /** Create a new get requests with the httpParams applied and retries. */