diff --git a/.changesets/1789537146-da471faf.yaml b/.changesets/1789537146-da471faf.yaml
new file mode 100644
index 00000000..c2d10444
--- /dev/null
+++ b/.changesets/1789537146-da471faf.yaml
@@ -0,0 +1,10 @@
+id: 1789537146-da471faf
+features:
+    - core
+targets:
+    - terraform
+type: fix
+bump: patch
+description: stop provider Configure mutating the global http.DefaultClient and http.DefaultTransport
+author: byron-lambda
+date: "2026-09-16"
diff --git a/templates/templates/terraform/provider/provider.go.stmpl b/templates/templates/terraform/provider/provider.go.stmpl
index a80c6089..ed1692e3 100644
--- a/templates/templates/terraform/provider/provider.go.stmpl
+++ b/templates/templates/terraform/provider/provider.go.stmpl
@@ -67,16 +67,21 @@ func (p *{{sanitizeClassName .Global.Config.PackageName}}Provider) Configure(ctx
 	{{ templateProviderConfigureGlobals .Global.AST.MainSDK.Globals }}
 	{{ templateProviderConfigureSecurity .Global.AST.MainSDK.Security }}
 
+	// Configure owns its transport: clone the default so provider-specific
+	// settings (headers, TLS skip verification) never mutate process globals.
+	transport := http.DefaultTransport
+	if t, ok := transport.(*http.Transport); ok {
+		transport = t.Clone()
+	}
 	providerHTTPTransportOpts := ProviderHTTPTransportOpts{
 		SetHeaders: make(map[string]string),
-		Transport:  http.DefaultTransport,
+		Transport:  transport,
 	}
 
 	{{ templateProviderHTTPTransportOptsSetHeaders .Local "data" "providerHTTPTransportOpts" }}
 	{{ templateProviderHTTPTransportTlsSkipVerify .Local "data" "providerHTTPTransportOpts" }}
 
-	httpClient := http.DefaultClient
-	httpClient.Transport = NewProviderHTTPTransport(providerHTTPTransportOpts)
+	httpClient := &http.Client{Transport: NewProviderHTTPTransport(providerHTTPTransportOpts)}
 
 	{{ templateProviderConfigureSDKOptions .Global.AST.MainSDK }}
 
diff --git a/zSDKs/terraform-provider-testing/.speakeasy/gen.lock b/zSDKs/terraform-provider-testing/.speakeasy/gen.lock
index b04e25f7..711ad04d 100644
--- a/zSDKs/terraform-provider-testing/.speakeasy/gen.lock
+++ b/zSDKs/terraform-provider-testing/.speakeasy/gen.lock
@@ -1048,7 +1048,7 @@ trackedFiles:
   internal/provider/patch_resource_sdk.go:
     last_write_checksum: sha1:9b583e2ac47191350373ce5a86408c118bd606b1
   internal/provider/provider.go:
-    last_write_checksum: sha1:165aa656ebff0c9e83540c0fececc3cf4ab7eeeb
+    last_write_checksum: sha1:1da048473254e15222459129544e6a54163e660d
   internal/provider/reflect/diags.go:
     last_write_checksum: sha1:ace8bc53054bb1d8ee8689acf3e4323de75a6297
   internal/provider/reflect/doc.go:
diff --git a/zSDKs/terraform-provider-testing/internal/provider/provider.go b/zSDKs/terraform-provider-testing/internal/provider/provider.go
index 484398c5..89e07be5 100644
--- a/zSDKs/terraform-provider-testing/internal/provider/provider.go
+++ b/zSDKs/terraform-provider-testing/internal/provider/provider.go
@@ -632,9 +632,15 @@ func (p *TestingProvider) Configure(ctx context.Context, req provider.ConfigureR
 
 	security.Custom = custom
 
+	// Configure owns its transport: clone the default so provider-specific
+	// settings (headers, TLS skip verification) never mutate process globals.
+	transport := http.DefaultTransport
+	if t, ok := transport.(*http.Transport); ok {
+		transport = t.Clone()
+	}
 	providerHTTPTransportOpts := ProviderHTTPTransportOpts{
 		SetHeaders: make(map[string]string),
-		Transport:  http.DefaultTransport,
+		Transport:  transport,
 	}
 
 	resp.Diagnostics.Append(data.HTTPHeaders.ElementsAs(ctx, &providerHTTPTransportOpts.SetHeaders, false)...)
@@ -648,8 +654,7 @@ func (p *TestingProvider) Configure(ctx context.Context, req provider.ConfigureR
 		transport.TLSClientConfig.InsecureSkipVerify = data.TLSSkipVerify.ValueBool()
 	}
 
-	httpClient := http.DefaultClient
-	httpClient.Transport = NewProviderHTTPTransport(providerHTTPTransportOpts)
+	httpClient := &http.Client{Transport: NewProviderHTTPTransport(providerHTTPTransportOpts)}
 
 	opts := []sdk.SDKOption{
 		sdk.WithTemplatedServerURL(serverUrl, serverUrlParams),