diff --git a/Cargo.lock b/Cargo.lock
index d2fff119..5bafe7a8 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -78,7 +78,7 @@ version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5ca11d4be1bab0c8bc8734a9aa7bf4ee8316d462a08c6ac5052f888fef5b494b"
 dependencies = [
- "windows-sys",
+ "windows-sys 0.48.0",
 ]
 
 [[package]]
@@ -88,7 +88,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f0699d10d2f4d628a98ee7b57b289abbc98ff3bad977cb3152709d4bf2330628"
 dependencies = [
  "anstyle",
- "windows-sys",
+ "windows-sys 0.48.0",
 ]
 
 [[package]]
@@ -133,13 +133,13 @@ dependencies = [
 
 [[package]]
 name = "async-trait"
-version = "0.1.73"
+version = "0.1.77"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bc00ceb34980c03614e35a3a4e218276a0a824e911d07651cd0d858a51e8c0f0"
+checksum = "c980ee35e870bd1a4d2c8294d4c04d0499e67bca1e4b5cefcc693c2fa00caea9"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.32",
+ "syn 2.0.50",
 ]
 
 [[package]]
@@ -192,6 +192,12 @@ version = "0.21.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "604178f6c5c21f02dc555784810edfb88d34ac2c73b2eae109655649ee73ce3d"
 
+[[package]]
+name = "base64"
+version = "0.22.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
+
 [[package]]
 name = "base64ct"
 version = "1.6.0"
@@ -349,7 +355,7 @@ dependencies = [
  "lazy_static",
  "proc-macro2",
  "quote",
- "syn 2.0.32",
+ "syn 2.0.50",
 ]
 
 [[package]]
@@ -417,7 +423,7 @@ dependencies = [
  "heck",
  "proc-macro2",
  "quote",
- "syn 2.0.32",
+ "syn 2.0.50",
 ]
 
 [[package]]
@@ -450,7 +456,7 @@ checksum = "2674ec482fbc38012cf31e6c42ba0177b431a0cb6f15fe40efa5aab1bda516f6"
 dependencies = [
  "is-terminal",
  "lazy_static",
- "windows-sys",
+ "windows-sys 0.48.0",
 ]
 
 [[package]]
@@ -711,7 +717,7 @@ checksum = "6b30f669a7961ef1631673d2766cc92f52d64f7ef354d4fe0ddfd30ed52f0f4f"
 dependencies = [
  "errno-dragonfly",
  "libc",
- "windows-sys",
+ "windows-sys 0.48.0",
 ]
 
 [[package]]
@@ -821,7 +827,7 @@ checksum = "89ca545a94061b6365f2c7355b4b32bd20df3ff95f02da9329b34ccc3bd6ee72"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.32",
+ "syn 2.0.50",
 ]
 
 [[package]]
@@ -917,7 +923,7 @@ dependencies = [
  "futures-core",
  "futures-sink",
  "futures-util",
- "http",
+ "http 0.2.9",
  "indexmap",
  "slab",
  "tokio",
@@ -979,6 +985,17 @@ dependencies = [
  "itoa",
 ]
 
+[[package]]
+name = "http"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "21b9ddb458710bc376481b842f5da65cdf31522de232c1ca8146abce2a358258"
+dependencies = [
+ "bytes",
+ "fnv",
+ "itoa",
+]
+
 [[package]]
 name = "http-body"
 version = "0.4.5"
@@ -986,7 +1003,30 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d5f38f16d184e36f2408a55281cd658ecbd3ca05cce6d6510a176eca393e26d1"
 dependencies = [
  "bytes",
- "http",
+ "http 0.2.9",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "http-body"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1cac85db508abc24a2e48553ba12a996e87244a0395ce011e62b37158745d643"
+dependencies = [
+ "bytes",
+ "http 1.1.0",
+]
+
+[[package]]
+name = "http-body-util"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0475f8b2ac86659c21b64320d5d653f9efe42acd2a4e560073ec61a155a34f1d"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "http 1.1.0",
+ "http-body 1.0.0",
  "pin-project-lite",
 ]
 
@@ -1019,8 +1059,8 @@ dependencies = [
  "futures-core",
  "futures-util",
  "h2",
- "http",
- "http-body",
+ "http 0.2.9",
+ "http-body 0.4.5",
  "httparse",
  "httpdate",
  "itoa",
@@ -1032,6 +1072,25 @@ dependencies = [
  "want",
 ]
 
+[[package]]
+name = "hyper"
+version = "1.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fe575dd17d0862a9a33781c8c4696a55c320909004a67a00fb286ba8b1bc496d"
+dependencies = [
+ "bytes",
+ "futures-channel",
+ "futures-util",
+ "http 1.1.0",
+ "http-body 1.0.0",
+ "httparse",
+ "itoa",
+ "pin-project-lite",
+ "smallvec",
+ "tokio",
+ "want",
+]
+
 [[package]]
 name = "hyper-rustls"
 version = "0.24.1"
@@ -1039,20 +1098,58 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8d78e1e73ec14cf7375674f74d7dde185c8206fd9dea6fb6295e8a98098aaa97"
 dependencies = [
  "futures-util",
- "http",
- "hyper",
+ "http 0.2.9",
+ "hyper 0.14.27",
  "log",
- "rustls",
+ "rustls 0.21.6",
  "rustls-native-certs",
  "tokio",
- "tokio-rustls",
+ "tokio-rustls 0.24.1",
  "webpki-roots 0.23.1",
 ]
 
+[[package]]
+name = "hyper-rustls"
+version = "0.26.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a0bea761b46ae2b24eb4aef630d8d1c398157b6fc29e6350ecf090a0b70c952c"
+dependencies = [
+ "futures-util",
+ "http 1.1.0",
+ "hyper 1.3.1",
+ "hyper-util",
+ "rustls 0.22.4",
+ "rustls-pki-types",
+ "tokio",
+ "tokio-rustls 0.25.0",
+ "tower-service",
+]
+
+[[package]]
+name = "hyper-util"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b875924a60b96e5d7b9ae7b066540b1dd1cbd90d1828f54c92e02a283351c56"
+dependencies = [
+ "bytes",
+ "futures-channel",
+ "futures-util",
+ "http 1.1.0",
+ "http-body 1.0.0",
+ "hyper 1.3.1",
+ "pin-project-lite",
+ "socket2 0.5.3",
+ "tokio",
+ "tower",
+ "tower-service",
+ "tracing",
+]
+
 [[package]]
 name = "ic-agent"
 version = "0.33.0"
 dependencies = [
+ "async-trait",
  "backoff",
  "cached",
  "candid",
@@ -1060,10 +1157,10 @@ dependencies = [
  "futures-util",
  "getrandom",
  "hex",
- "http",
- "http-body",
- "hyper",
- "hyper-rustls",
+ "http 0.2.9",
+ "http-body 0.4.5",
+ "hyper 0.14.27",
+ "hyper-rustls 0.24.1",
  "ic-certification",
  "ic-transport-types",
  "ic-verify-bls-signature",
@@ -1076,8 +1173,8 @@ dependencies = [
  "pkcs8",
  "rand",
  "rangemap",
- "reqwest",
- "ring",
+ "reqwest 0.11.19",
+ "ring 0.16.20",
  "rustls-webpki 0.101.4",
  "sec1",
  "serde",
@@ -1113,6 +1210,7 @@ dependencies = [
 name = "ic-identity-hsm"
 version = "0.33.0"
 dependencies = [
+ "async-trait",
  "hex",
  "ic-agent",
  "pkcs11",
@@ -1146,7 +1244,7 @@ dependencies = [
  "futures-util",
  "ic-agent",
  "once_cell",
- "ring",
+ "ring 0.16.20",
  "semver",
  "serde",
  "serde_bytes",
@@ -1198,7 +1296,7 @@ dependencies = [
  "humantime",
  "ic-agent",
  "ic-utils",
- "ring",
+ "ring 0.16.20",
  "serde",
  "serde_json",
  "tokio",
@@ -1214,7 +1312,7 @@ dependencies = [
  "hex",
  "ic-certification",
  "leb128",
- "reqwest",
+ "reqwest 0.12.4",
  "serde",
  "serde_bytes",
  "serde_cbor",
@@ -1268,7 +1366,7 @@ checksum = "cb0889898416213fab133e1d33a0e5858a48177452750691bde3666d0fdbaf8b"
 dependencies = [
  "hermit-abi",
  "rustix",
- "windows-sys",
+ "windows-sys 0.48.0",
 ]
 
 [[package]]
@@ -1411,7 +1509,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "regex-syntax 0.6.29",
- "syn 2.0.32",
+ "syn 2.0.50",
 ]
 
 [[package]]
@@ -1452,7 +1550,7 @@ checksum = "927a765cd3fc26206e66b296465fa9d3e5ab003e651c1b3c060e7956d96b19d2"
 dependencies = [
  "libc",
  "wasi",
- "windows-sys",
+ "windows-sys 0.48.0",
 ]
 
 [[package]]
@@ -1464,7 +1562,7 @@ dependencies = [
  "assert-json-diff",
  "colored",
  "futures",
- "hyper",
+ "hyper 0.14.27",
  "lazy_static",
  "log",
  "rand",
@@ -1601,7 +1699,7 @@ dependencies = [
  "libc",
  "redox_syscall 0.3.5",
  "smallvec",
- "windows-targets",
+ "windows-targets 0.48.5",
 ]
 
 [[package]]
@@ -1660,6 +1758,26 @@ version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5be167a7af36ee22fe3115051bc51f6e6c7054c9348e28deb4f49bd6f705a315"
 
+[[package]]
+name = "pin-project"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6bf43b791c5b9e34c3d182969b4abb522f9343702850a2e57f460d00d09b4b3"
+dependencies = [
+ "pin-project-internal",
+]
+
+[[package]]
+name = "pin-project-internal"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f38a4412a78282e09a2cf38d195ea5420d15ba0602cb375210efbc877243965"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.50",
+]
+
 [[package]]
 name = "pin-project-lite"
 version = "0.2.12"
@@ -1726,9 +1844,9 @@ dependencies = [
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.66"
+version = "1.0.78"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "18fb31db3f9bddb2ea821cde30a9f70117e3f119938b5ee630b7403aa6e2ead9"
+checksum = "e2422ad645d89c99f8f3e6b88a9fdeca7fabeac836b1002371c4367c8f984aae"
 dependencies = [
  "unicode-ident",
 ]
@@ -1744,9 +1862,9 @@ dependencies = [
 
 [[package]]
 name = "quote"
-version = "1.0.33"
+version = "1.0.35"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5267fca4496028628a95160fc423a33e8b2e6af8a5302579e322e4b520293cae"
+checksum = "291ec9ab5efd934aaf503a6466c5d5251535d108ee747472c3977cc5acc868ef"
 dependencies = [
  "proc-macro2",
 ]
@@ -1825,7 +1943,7 @@ dependencies = [
  "ic-certification",
  "ic-identity-hsm",
  "ic-utils",
- "ring",
+ "ring 0.16.20",
  "serde",
  "serde_cbor",
  "sha2 0.10.7",
@@ -1879,10 +1997,10 @@ dependencies = [
  "futures-core",
  "futures-util",
  "h2",
- "http",
- "http-body",
- "hyper",
- "hyper-rustls",
+ "http 0.2.9",
+ "http-body 0.4.5",
+ "hyper 0.14.27",
+ "hyper-rustls 0.24.1",
  "ipnet",
  "js-sys",
  "log",
@@ -1890,13 +2008,13 @@ dependencies = [
  "once_cell",
  "percent-encoding",
  "pin-project-lite",
- "rustls",
- "rustls-pemfile",
+ "rustls 0.21.6",
+ "rustls-pemfile 1.0.3",
  "serde",
  "serde_json",
  "serde_urlencoded",
  "tokio",
- "tokio-rustls",
+ "tokio-rustls 0.24.1",
  "tokio-util",
  "tower-service",
  "url",
@@ -1905,7 +2023,49 @@ dependencies = [
  "wasm-streams",
  "web-sys",
  "webpki-roots 0.25.2",
- "winreg",
+ "winreg 0.50.0",
+]
+
+[[package]]
+name = "reqwest"
+version = "0.12.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "566cafdd92868e0939d3fb961bd0dc25fcfaaed179291093b3d43e6b3150ea10"
+dependencies = [
+ "base64 0.22.1",
+ "bytes",
+ "futures-channel",
+ "futures-core",
+ "futures-util",
+ "http 1.1.0",
+ "http-body 1.0.0",
+ "http-body-util",
+ "hyper 1.3.1",
+ "hyper-rustls 0.26.0",
+ "hyper-util",
+ "ipnet",
+ "js-sys",
+ "log",
+ "mime",
+ "once_cell",
+ "percent-encoding",
+ "pin-project-lite",
+ "rustls 0.22.4",
+ "rustls-pemfile 2.1.2",
+ "rustls-pki-types",
+ "serde",
+ "serde_json",
+ "serde_urlencoded",
+ "sync_wrapper",
+ "tokio",
+ "tokio-rustls 0.25.0",
+ "tower-service",
+ "url",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+ "webpki-roots 0.26.2",
+ "winreg 0.52.0",
 ]
 
 [[package]]
@@ -1927,12 +2087,27 @@ dependencies = [
  "cc",
  "libc",
  "once_cell",
- "spin",
- "untrusted",
+ "spin 0.5.2",
+ "untrusted 0.7.1",
  "web-sys",
  "winapi",
 ]
 
+[[package]]
+name = "ring"
+version = "0.17.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c17fa4cb658e3583423e915b9f3acc01cceaee1860e33d59ebae66adc3a2dc0d"
+dependencies = [
+ "cc",
+ "cfg-if",
+ "getrandom",
+ "libc",
+ "spin 0.9.8",
+ "untrusted 0.9.0",
+ "windows-sys 0.52.0",
+]
+
 [[package]]
 name = "rustc-demangle"
 version = "0.1.23"
@@ -1949,7 +2124,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys",
- "windows-sys",
+ "windows-sys 0.48.0",
 ]
 
 [[package]]
@@ -1959,11 +2134,25 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1d1feddffcfcc0b33f5c6ce9a29e341e4cd59c3f78e7ee45f4a40c038b1d6cbb"
 dependencies = [
  "log",
- "ring",
+ "ring 0.16.20",
  "rustls-webpki 0.101.4",
  "sct",
 ]
 
+[[package]]
+name = "rustls"
+version = "0.22.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bf4ef73721ac7bcd79b2b315da7779d8fc09718c6b3d2d1b2d94850eb8c18432"
+dependencies = [
+ "log",
+ "ring 0.17.8",
+ "rustls-pki-types",
+ "rustls-webpki 0.102.4",
+ "subtle",
+ "zeroize",
+]
+
 [[package]]
 name = "rustls-native-certs"
 version = "0.6.3"
@@ -1971,7 +2160,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a9aace74cb666635c918e9c12bc0d348266037aa8eb599b5cba565709a8dff00"
 dependencies = [
  "openssl-probe",
- "rustls-pemfile",
+ "rustls-pemfile 1.0.3",
  "schannel",
  "security-framework",
 ]
@@ -1985,14 +2174,30 @@ dependencies = [
  "base64 0.21.2",
 ]
 
+[[package]]
+name = "rustls-pemfile"
+version = "2.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29993a25686778eb88d4189742cd713c9bce943bc54251a33509dc63cbacf73d"
+dependencies = [
+ "base64 0.22.1",
+ "rustls-pki-types",
+]
+
+[[package]]
+name = "rustls-pki-types"
+version = "1.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "976295e77ce332211c0d24d92c0e83e50f5c5f046d11082cea19f3df13a3562d"
+
 [[package]]
 name = "rustls-webpki"
 version = "0.100.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e98ff011474fa39949b7e5c0428f9b4937eda7da7848bbb947786b7be0b27dab"
 dependencies = [
- "ring",
- "untrusted",
+ "ring 0.16.20",
+ "untrusted 0.7.1",
 ]
 
 [[package]]
@@ -2001,8 +2206,19 @@ version = "0.101.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7d93931baf2d282fff8d3a532bbfd7653f734643161b87e3e01e59a04439bf0d"
 dependencies = [
- "ring",
- "untrusted",
+ "ring 0.16.20",
+ "untrusted 0.7.1",
+]
+
+[[package]]
+name = "rustls-webpki"
+version = "0.102.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff448f7e92e913c4b7d4c6d8e4540a1724b319b4152b8aef6d4cf8339712b33e"
+dependencies = [
+ "ring 0.17.8",
+ "rustls-pki-types",
+ "untrusted 0.9.0",
 ]
 
 [[package]]
@@ -2023,7 +2239,7 @@ version = "0.1.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0c3733bf4cf7ea0880754e19cb5a462007c4a8c1914bff372ccc95b464f1df88"
 dependencies = [
- "windows-sys",
+ "windows-sys 0.48.0",
 ]
 
 [[package]]
@@ -2044,8 +2260,8 @@ version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d53dcdb7c9f8158937a7981b48accfd39a43af418591a5d008c7b22b5e1b7ca4"
 dependencies = [
- "ring",
- "untrusted",
+ "ring 0.16.20",
+ "untrusted 0.7.1",
 ]
 
 [[package]]
@@ -2127,7 +2343,7 @@ checksum = "dc59dfdcbad1437773485e0367fea4b090a2e0a16d9ffc46af47764536a298ec"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.32",
+ "syn 2.0.50",
 ]
 
 [[package]]
@@ -2149,7 +2365,7 @@ checksum = "8725e1dfadb3a50f7e5ce0b1a540466f6ed3fe7a0fca2ac2b8b831d31316bd00"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.32",
+ "syn 2.0.50",
 ]
 
 [[package]]
@@ -2242,9 +2458,9 @@ dependencies = [
 
 [[package]]
 name = "smallvec"
-version = "1.11.0"
+version = "1.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "62bb4feee49fdd9f707ef802e22365a35de4b7b299de4763d44bfea899442ff9"
+checksum = "3c5e1a9a646d36c3599cd173a41282daf47c44583ad367b8e6837255952e5c67"
 
 [[package]]
 name = "socket2"
@@ -2263,7 +2479,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2538b18701741680e0322a2302176d3253a35388e2e62f172f64f4f16605f877"
 dependencies = [
  "libc",
- "windows-sys",
+ "windows-sys 0.48.0",
 ]
 
 [[package]]
@@ -2272,6 +2488,12 @@ version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6e63cff320ae2c57904679ba7cb63280a3dc4613885beafb148ee7bf9aa9042d"
 
+[[package]]
+name = "spin"
+version = "0.9.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6980e8d7511241f8acf4aebddbb1ff938df5eebe98691418c4468d0b72a96a67"
+
 [[package]]
 name = "spki"
 version = "0.7.2"
@@ -2358,15 +2580,21 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "2.0.32"
+version = "2.0.50"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "239814284fd6f1a4ffe4ca893952cdd93c224b6a1571c9a9eadd670295c0c9e2"
+checksum = "74f1bdc9872430ce9b75da68329d1c1746faf50ffac5f19e02b71e37ff881ffb"
 dependencies = [
  "proc-macro2",
  "quote",
  "unicode-ident",
 ]
 
+[[package]]
+name = "sync_wrapper"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2047c6ded9c721764247e62cd3b03c09ffc529b2ba5b10ec482ae507a4a70160"
+
 [[package]]
 name = "term"
 version = "0.7.0"
@@ -2404,7 +2632,7 @@ checksum = "6bb623b56e39ab7dcd4b1b98bb6c8f8d907ed255b18de254088016b27a8ee19b"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.32",
+ "syn 2.0.50",
 ]
 
 [[package]]
@@ -2476,7 +2704,7 @@ dependencies = [
  "signal-hook-registry",
  "socket2 0.5.3",
  "tokio-macros",
- "windows-sys",
+ "windows-sys 0.48.0",
 ]
 
 [[package]]
@@ -2487,7 +2715,7 @@ checksum = "630bdcf245f78637c13ec01ffae6187cca34625e8c63150d424b59e55af2675e"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.32",
+ "syn 2.0.50",
 ]
 
 [[package]]
@@ -2496,7 +2724,18 @@ version = "0.24.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c28327cf380ac148141087fbfb9de9d7bd4e84ab5d2c28fbc911d753de8a7081"
 dependencies = [
- "rustls",
+ "rustls 0.21.6",
+ "tokio",
+]
+
+[[package]]
+name = "tokio-rustls"
+version = "0.25.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "775e0c0f0adb3a2f22a00c4745d728b479985fc15ee7ca6a2608388c5569860f"
+dependencies = [
+ "rustls 0.22.4",
+ "rustls-pki-types",
  "tokio",
 ]
 
@@ -2514,6 +2753,27 @@ dependencies = [
  "tracing",
 ]
 
+[[package]]
+name = "tower"
+version = "0.4.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8fa9be0de6cf49e536ce1851f987bd21a43b771b09473c3549a6c853db37c1c"
+dependencies = [
+ "futures-core",
+ "futures-util",
+ "pin-project",
+ "pin-project-lite",
+ "tokio",
+ "tower-layer",
+ "tower-service",
+]
+
+[[package]]
+name = "tower-layer"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c20c8dbed6283a09604c3e69b4b7eeb54e298b8a600d4d5ecb5ad39de609f1d0"
+
 [[package]]
 name = "tower-service"
 version = "0.3.2"
@@ -2603,6 +2863,12 @@ version = "0.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a156c684c91ea7d62626509bce3cb4e1d9ed5c4d978f7b4352658f96a4c26b4a"
 
+[[package]]
+name = "untrusted"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
+
 [[package]]
 name = "url"
 version = "2.4.0"
@@ -2662,7 +2928,7 @@ dependencies = [
  "once_cell",
  "proc-macro2",
  "quote",
- "syn 2.0.32",
+ "syn 2.0.50",
  "wasm-bindgen-shared",
 ]
 
@@ -2696,7 +2962,7 @@ checksum = "54681b18a46765f095758388f2d0cf16eb8d4169b639ab575a8f5693af210c7b"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.32",
+ "syn 2.0.50",
  "wasm-bindgen-backend",
  "wasm-bindgen-shared",
 ]
@@ -2769,6 +3035,15 @@ version = "0.25.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "14247bb57be4f377dfb94c72830b8ce8fc6beac03cf4bf7b9732eadd414123fc"
 
+[[package]]
+name = "webpki-roots"
+version = "0.26.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c452ad30530b54a4d8e71952716a212b08efd0f3562baa66c29a618b07da7c3"
+dependencies = [
+ "rustls-pki-types",
+]
+
 [[package]]
 name = "winapi"
 version = "0.3.9"
@@ -2806,7 +3081,16 @@ version = "0.48.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "677d2418bec65e3338edb076e806bc1ec15693c5d0104683f2efe857f61056a9"
 dependencies = [
- "windows-targets",
+ "windows-targets 0.48.5",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
+dependencies = [
+ "windows-targets 0.52.5",
 ]
 
 [[package]]
@@ -2815,13 +3099,29 @@ version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9a2fa6e2155d7247be68c096456083145c183cbbbc2764150dda45a87197940c"
 dependencies = [
- "windows_aarch64_gnullvm",
- "windows_aarch64_msvc",
- "windows_i686_gnu",
- "windows_i686_msvc",
- "windows_x86_64_gnu",
- "windows_x86_64_gnullvm",
- "windows_x86_64_msvc",
+ "windows_aarch64_gnullvm 0.48.5",
+ "windows_aarch64_msvc 0.48.5",
+ "windows_i686_gnu 0.48.5",
+ "windows_i686_msvc 0.48.5",
+ "windows_x86_64_gnu 0.48.5",
+ "windows_x86_64_gnullvm 0.48.5",
+ "windows_x86_64_msvc 0.48.5",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.52.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6f0713a46559409d202e70e28227288446bf7841d3211583a4b53e3f6d96e7eb"
+dependencies = [
+ "windows_aarch64_gnullvm 0.52.5",
+ "windows_aarch64_msvc 0.52.5",
+ "windows_i686_gnu 0.52.5",
+ "windows_i686_gnullvm",
+ "windows_i686_msvc 0.52.5",
+ "windows_x86_64_gnu 0.52.5",
+ "windows_x86_64_gnullvm 0.52.5",
+ "windows_x86_64_msvc 0.52.5",
 ]
 
 [[package]]
@@ -2830,42 +3130,90 @@ version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8"
 
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.52.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7088eed71e8b8dda258ecc8bac5fb1153c5cffaf2578fc8ff5d61e23578d3263"
+
 [[package]]
 name = "windows_aarch64_msvc"
 version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc"
 
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.52.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9985fd1504e250c615ca5f281c3f7a6da76213ebd5ccc9561496568a2752afb6"
+
 [[package]]
 name = "windows_i686_gnu"
 version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e"
 
+[[package]]
+name = "windows_i686_gnu"
+version = "0.52.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "88ba073cf16d5372720ec942a8ccbf61626074c6d4dd2e745299726ce8b89670"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.52.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "87f4261229030a858f36b459e748ae97545d6f1ec60e5e0d6a3d32e0dc232ee9"
+
 [[package]]
 name = "windows_i686_msvc"
 version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406"
 
+[[package]]
+name = "windows_i686_msvc"
+version = "0.52.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db3c2bf3d13d5b658be73463284eaf12830ac9a26a90c717b7f771dfe97487bf"
+
 [[package]]
 name = "windows_x86_64_gnu"
 version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e"
 
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.52.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4e4246f76bdeff09eb48875a0fd3e2af6aada79d409d33011886d3e1581517d9"
+
 [[package]]
 name = "windows_x86_64_gnullvm"
 version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc"
 
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.52.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "852298e482cd67c356ddd9570386e2862b5673c85bd5f88df9ab6802b334c596"
+
 [[package]]
 name = "windows_x86_64_msvc"
 version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"
 
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.52.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bec47e5bfd1bff0eeaf6d8b485cc1074891a197ab4225d504cb7a1ab88b02bf0"
+
 [[package]]
 name = "winreg"
 version = "0.50.0"
@@ -2873,7 +3221,17 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "524e57b2c537c0f9b1e69f1965311ec12182b4122e45035b1508cd24d2adadb1"
 dependencies = [
  "cfg-if",
- "windows-sys",
+ "windows-sys 0.48.0",
+]
+
+[[package]]
+name = "winreg"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a277a57398d4bfa075df44f501a17cfdf8542d224f0d36095a2adc7aee4ef0a5"
+dependencies = [
+ "cfg-if",
+ "windows-sys 0.48.0",
 ]
 
 [[package]]
diff --git a/ic-agent/Cargo.toml b/ic-agent/Cargo.toml
index 91f92c1a..512f1484 100644
--- a/ic-agent/Cargo.toml
+++ b/ic-agent/Cargo.toml
@@ -15,57 +15,57 @@ keywords = ["internet-computer", "agent", "icp", "dfinity"]
 include = ["src", "Cargo.toml", "../LICENSE", "README.md"]
 
 [dependencies]
+async-trait.workspace = true
+arc-swap = "1.7"
+async-channel = "1.9"
+async-lock = "3.3"
+async-watch = "0.3"
 backoff = "0.4.0"
-cached = { version = "0.46", features = ["ahash"], default-features = false }
+cached = { version = "0.52", features = ["ahash"], default-features = false }
 candid = { workspace = true }
-ed25519-consensus = { version = "2" }
+der = "0.7"
+ecdsa = "0.16"
+ed25519-consensus = { workspace = true }
+elliptic-curve = "0.13"
 futures-util = { workspace = true }
 hex = { workspace = true }
-http = "0.2.6"
-http-body = "0.4.5"
+http = "1.0.0"
+http-body = "1.0.0"
 ic-certification = { workspace = true }
 ic-transport-types = { workspace = true }
-ic-verify-bls-signature = "0.1"
-k256 = { version = "0.13.1", features = ["pem"] }
-p256 = { version = "0.13.2", features = ["pem"] }
+ic-verify-bls-signature = "0.5"
+k256 = { workspace = true, features = ["pem"] }
+p256 = { workspace = true, features = ["pem"] }
 leb128 = { workspace = true }
 pkcs8 = { version = "0.10.2", features = ["std"] }
 sec1 = { version = "0.7.2", features = ["pem"] }
-rand = "0.8.5"
+rand = { workspace = true }
 rangemap = "1.4"
-ring = { workspace = true, features = ["std"] }
+ring = { version = "0.17", optional = true }
 serde = { workspace = true, features = ["derive"] }
 serde_bytes = { workspace = true }
 serde_cbor = { workspace = true }
 serde_repr = { workspace = true }
 sha2 = { workspace = true }
 simple_asn1 = "0.6.1"
+stop-token = "0.7"
 thiserror = { workspace = true }
 time = { workspace = true }
+tower-service = "0.3"
+tracing = { version = "0.1", optional = true }
 url = "2.1.0"
 
-[dependencies.hyper]
-version = "0.14"
-features = ["client", "http2", "http1"]
-optional = true
-
 [dependencies.reqwest]
-version = "0.11.7"
+workspace = true
 default-features = false
 features = ["blocking", "json", "rustls-tls-webpki-roots", "stream"]
-optional = true
 
 [dependencies.pem]
-version = "2.0.1"
+version = "3"
 optional = true
 
 [target.'cfg(not(target_family = "wasm"))'.dependencies]
-hyper-rustls = { version = "0.24.1", features = [
-    "webpki-roots",
-    "http2",
-], optional = true }
 tokio = { version = "1.24.2", features = ["time"] }
-rustls-webpki = "0.101.4"
 
 [target.'cfg(target_family = "wasm")'.dependencies]
 getrandom = { version = "0.2", features = ["js"], optional = true }
@@ -75,11 +75,12 @@ wasm-bindgen-futures = { version = "0.4", optional = true }
 web-sys = { version = "0.3", features = ["Window"], optional = true }
 
 [dev-dependencies]
-serde_json = "1.0.79"
-candid = { workspace = true, features = ["value"]}
+serde_json.workspace = true
+tracing-subscriber = "0.3"
+tracing = "0.1"
 
 [target.'cfg(not(target_family = "wasm"))'.dev-dependencies]
-tokio = { version = "1.24.2", features = ["full"] }
+tokio = { workspace = true, features = ["full"] }
 mockito = "1.0.2"
 
 [target.'cfg(target_family = "wasm")'.dev-dependencies]
@@ -93,9 +94,9 @@ web-sys = { version = "0.3", features = [
 ] }
 
 [features]
-default = ["pem", "reqwest"]
-reqwest = ["dep:reqwest"]
-hyper = ["dep:hyper", "dep:hyper-rustls"]
+default = ["pem"]
+pem = ["dep:pem"]
+ring = ["dep:ring"]
 ic_ref_tests = [
     "default",
 ] # Used to separate integration tests for ic-ref which need a server running.
@@ -109,8 +110,10 @@ wasm-bindgen = [
     "backoff/wasm-bindgen",
     "cached/wasm",
 ]
+_internal_dynamic-routing = []
+tracing = ["dep:tracing"] # Does very little right now.
 
 [package.metadata.docs.rs]
 targets = ["x86_64-unknown-linux-gnu", "wasm32-unknown-unknown"]
 rustdoc-args = ["--cfg=docsrs"]
-features = ["hyper"]
+features = []
diff --git a/ic-agent/src/agent/agent_config.rs b/ic-agent/src/agent/agent_config.rs
index 626424d5..11ed2f35 100644
--- a/ic-agent/src/agent/agent_config.rs
+++ b/ic-agent/src/agent/agent_config.rs
@@ -1,21 +1,43 @@
+use reqwest::Client;
+use url::Url;
+
 use crate::{
-    agent::{NonceFactory, NonceGenerator, Transport},
+    agent::{NonceFactory, NonceGenerator},
     identity::{anonymous::AnonymousIdentity, Identity},
 };
 use std::{sync::Arc, time::Duration};
 
+use super::{route_provider::RouteProvider, HttpService};
+
 /// A configuration for an agent.
+#[non_exhaustive]
 pub struct AgentConfig {
     /// See [`with_nonce_factory`](super::AgentBuilder::with_nonce_factory).
     pub nonce_factory: Arc<dyn NonceGenerator>,
     /// See [`with_identity`](super::AgentBuilder::with_identity).
     pub identity: Arc<dyn Identity>,
     /// See [`with_ingress_expiry`](super::AgentBuilder::with_ingress_expiry).
-    pub ingress_expiry: Option<Duration>,
-    /// See [`with_transport`](super::AgentBuilder::with_transport).
-    pub transport: Option<Arc<dyn Transport>>,
+    pub ingress_expiry: Duration,
+    /// See [`with_http_client`](super::AgentBuilder::with_http_client).
+    pub client: Option<Client>,
+    /// See [`with_route_provider`](super::AgentBuilder::with_route_provider).
+    pub route_provider: Option<Arc<dyn RouteProvider>>,
     /// See [`verify_query_signatures`](super::AgentBuilder::with_verify_query_signatures).
     pub verify_query_signatures: bool,
+    /// See [`with_max_concurrent_requests`](super::AgentBuilder::with_max_concurrent_requests).
+    pub max_concurrent_requests: usize,
+    /// See [`with_max_response_body_size`](super::AgentBuilder::with_max_response_body_size).
+    pub max_response_body_size: Option<usize>,
+    /// See [`with_max_tcp_error_retries`](super::AgentBuilder::with_max_tcp_error_retries).
+    pub max_tcp_error_retries: usize,
+    /// See [`with_arc_http_middleware`](super::AgentBuilder::with_arc_http_middleware).
+    pub http_service: Option<Arc<dyn HttpService>>,
+    /// See [`with_max_polling_time`](super::AgentBuilder::with_max_polling_time).
+    pub max_polling_time: Duration,
+    /// See [`with_background_dynamic_routing`](super::AgentBuilder::with_background_dynamic_routing).
+    pub background_dynamic_routing: bool,
+    /// See [`with_url`](super::AgentBuilder::with_url).
+    pub url: Option<Url>,
 }
 
 impl Default for AgentConfig {
@@ -23,9 +45,17 @@ impl Default for AgentConfig {
         Self {
             nonce_factory: Arc::new(NonceFactory::random()),
             identity: Arc::new(AnonymousIdentity {}),
-            ingress_expiry: None,
-            transport: None,
+            ingress_expiry: Duration::from_secs(3 * 60),
+            client: None,
+            http_service: None,
             verify_query_signatures: true,
+            max_concurrent_requests: 50,
+            route_provider: None,
+            max_response_body_size: None,
+            max_tcp_error_retries: 0,
+            max_polling_time: Duration::from_secs(60 * 5),
+            background_dynamic_routing: false,
+            url: None,
         }
     }
 }
diff --git a/ic-agent/src/agent/agent_error.rs b/ic-agent/src/agent/agent_error.rs
index 70477f05..dc2b03c4 100644
--- a/ic-agent/src/agent/agent_error.rs
+++ b/ic-agent/src/agent/agent_error.rs
@@ -50,9 +50,13 @@ pub enum AgentError {
     #[error("Cannot parse Principal: {0}")]
     PrincipalError(#[from] crate::export::PrincipalError),
 
-    /// The replica rejected the message.
-    #[error("The replica returned a replica error: reject code {:?}, reject message {}, error code {:?}", .0.reject_code, .0.reject_message, .0.error_code)]
-    ReplicaError(RejectResponse),
+    /// The subnet rejected the message.
+    #[error("The replica returned a rejection error: reject code {:?}, reject message {}, error code {:?}", .0.reject_code, .0.reject_message, .0.error_code)]
+    CertifiedReject(RejectResponse),
+
+    /// The replica rejected the message. This rejection cannot be verified as authentic.
+    #[error("The replica returned a rejection error: reject code {:?}, reject message {}, error code {:?}", .0.reject_code, .0.reject_message, .0.error_code)]
+    UncertifiedReject(RejectResponse),
 
     /// The replica returned an HTTP error.
     #[error("The replica returned an HTTP Error: {0}")]
@@ -94,7 +98,7 @@ pub enum AgentError {
     #[error("The request status ({1}) at path {0:?} is invalid.")]
     InvalidRequestStatus(Vec<Label>, String),
 
-    /// The certificate verification for a read_state call failed.
+    /// The certificate verification for a `read_state` call failed.
     #[error("Certificate verification failed.")]
     CertificateVerificationFailed(),
 
@@ -102,7 +106,7 @@ pub enum AgentError {
     #[error("Query signature verification failed.")]
     QuerySignatureVerificationFailed,
 
-    /// The certificate contained a delegation that does not include the effective_canister_id in the canister_ranges field.
+    /// The certificate contained a delegation that does not include the `effective_canister_id` in the `canister_ranges` field.
     #[error("Certificate is not authorized to respond to queries for this canister. While developing: Did you forget to set effective_canister_id?")]
     CertificateNotAuthorized(),
 
@@ -171,17 +175,13 @@ pub enum AgentError {
     #[error("The wallet canister must be upgraded: {0}")]
     WalletUpgradeRequired(String),
 
-    /// The transport was not specified in the [`AgentBuilder`](super::AgentBuilder).
-    #[error("Missing replica transport in the Agent Builder.")]
-    MissingReplicaTransport(),
-
     /// The response size exceeded the provided limit.
     #[error("Response size exceeded limit.")]
     ResponseSizeExceededLimit(),
 
     /// An unknown error occurred during communication with the replica.
     #[error("An error happened during communication with the replica: {0}")]
-    TransportError(Box<dyn std::error::Error + Send + Sync>),
+    TransportError(#[from] reqwest::Error),
 
     /// There was a mismatch between the expected and actual CBOR data during inspection.
     #[error("There is a mismatch between the CBOR encoded call and the arguments: field {field}, value in argument is {value_arg}, value in CBOR is {value_cbor}")]
@@ -201,13 +201,17 @@ pub enum AgentError {
     /// Route provider failed to generate a url for some reason.
     #[error("Route provider failed to generate url: {0}")]
     RouteProviderError(String),
+
+    /// Invalid HTTP response.
+    #[error("Invalid HTTP response: {0}")]
+    InvalidHttpResponse(String),
 }
 
 impl PartialEq for AgentError {
     fn eq(&self, other: &Self) -> bool {
         // Verify the debug string is the same. Some of the subtypes of this error
         // don't implement Eq or PartialEq, so we cannot rely on derive.
-        format!("{:?}", self) == format!("{:?}", other)
+        format!("{self:?}") == format!("{other:?}")
     }
 }
 
@@ -235,7 +239,7 @@ impl HttpErrorPayload {
         f.write_fmt(format_args!(
             "Http Error: status {}, content type {:?}, content: {}",
             http::StatusCode::from_u16(self.status)
-                .map_or_else(|_| format!("{}", self.status), |code| format!("{}", code)),
+                .map_or_else(|_| format!("{}", self.status), |code| format!("{code}")),
             self.content_type.clone().unwrap_or_default(),
             String::from_utf8(self.content.clone()).unwrap_or_else(|_| format!(
                 "(unable to decode content as UTF-8: {:?})",
diff --git a/ic-agent/src/agent/agent_test.rs b/ic-agent/src/agent/agent_test.rs
index d6939d37..6cf92633 100644
--- a/ic-agent/src/agent/agent_test.rs
+++ b/ic-agent/src/agent/agent_test.rs
@@ -1,25 +1,33 @@
-// Disable these tests without the reqwest feature.
-#![cfg(feature = "reqwest")]
-
-use self::mock::{assert_mock, assert_single_mock, mock, mock_additional};
-use crate::{
-    agent::{http_transport::ReqwestTransport, Status},
-    export::Principal,
-    Agent, AgentError, Certificate,
+use self::mock::{
+    assert_mock, assert_single_mock, assert_single_mock_count, mock, mock_additional,
 };
+use crate::{agent::Status, export::Principal, Agent, AgentError, Certificate};
 use candid::{Encode, Nat};
+use futures_util::FutureExt;
 use ic_certification::{Delegation, Label};
-use ic_transport_types::{NodeSignature, QueryResponse, RejectCode, RejectResponse, ReplyResponse};
-use std::{collections::BTreeMap, time::Duration};
+use ic_transport_types::{
+    NodeSignature, QueryResponse, RejectCode, RejectResponse, ReplyResponse, TransportCallResponse,
+};
+use std::{collections::BTreeMap, str::FromStr, sync::Arc, time::Duration};
 #[cfg(all(target_family = "wasm", feature = "wasm-bindgen"))]
 use wasm_bindgen_test::wasm_bindgen_test;
 
+use crate::agent::route_provider::{RoundRobinRouteProvider, RouteProvider};
 #[cfg(all(target_family = "wasm", feature = "wasm-bindgen"))]
 wasm_bindgen_test::wasm_bindgen_test_configure!(run_in_browser);
 
 fn make_agent(url: &str) -> Agent {
+    let builder = Agent::builder().with_url(url);
+    builder.with_verify_query_signatures(false).build().unwrap()
+}
+
+fn make_agent_with_route_provider(
+    route_provider: Arc<dyn RouteProvider>,
+    tcp_retries: usize,
+) -> Agent {
     Agent::builder()
-        .with_transport(ReqwestTransport::create(url).unwrap())
+        .with_arc_route_provider(route_provider)
+        .with_max_tcp_error_retries(tcp_retries)
         .with_verify_query_signatures(false)
         .build()
         .unwrap()
@@ -27,17 +35,17 @@ fn make_agent(url: &str) -> Agent {
 
 fn make_untimed_agent(url: &str) -> Agent {
     Agent::builder()
-        .with_transport(ReqwestTransport::create(url).unwrap())
+        .with_url(url)
         .with_verify_query_signatures(false)
-        .with_ingress_expiry(Some(Duration::from_secs(u32::MAX as _)))
+        .with_ingress_expiry(Duration::from_secs(u32::MAX.into()))
         .build()
         .unwrap()
 }
 
 fn make_certifying_agent(url: &str) -> Agent {
     Agent::builder()
-        .with_transport(ReqwestTransport::create(url).unwrap())
-        .with_ingress_expiry(Some(Duration::from_secs(u32::MAX as _)))
+        .with_url(url)
+        .with_ingress_expiry(Duration::from_secs(u32::MAX.into()))
         .build()
         .unwrap()
 }
@@ -69,6 +77,7 @@ async fn query() -> Result<(), AgentError> {
             vec![],
             None,
             false,
+            None,
         )
         .await;
 
@@ -94,6 +103,7 @@ async fn query_error() -> Result<(), AgentError> {
             vec![],
             None,
             false,
+            None,
         )
         .await;
 
@@ -135,13 +145,14 @@ async fn query_rejected() -> Result<(), AgentError> {
             vec![],
             None,
             false,
+            None,
         )
         .await;
 
     assert_mock(query_mock).await;
 
     match result {
-        Err(AgentError::ReplicaError(replica_error)) => {
+        Err(AgentError::UncertifiedReject(replica_error)) => {
             assert_eq!(replica_error.reject_code, RejectCode::DestinationInvalid);
             assert_eq!(replica_error.reject_message, "Rejected Message");
             assert_eq!(replica_error.error_code, Some("Error code".to_string()));
@@ -155,7 +166,7 @@ async fn query_rejected() -> Result<(), AgentError> {
 #[cfg_attr(not(target_family = "wasm"), tokio::test)]
 #[cfg_attr(target_family = "wasm", wasm_bindgen_test)]
 async fn call_error() -> Result<(), AgentError> {
-    let (call_mock, url) = mock("POST", "/api/v2/canister/aaaaa-aa/call", 500, vec![], None).await;
+    let (call_mock, url) = mock("POST", "/api/v3/canister/aaaaa-aa/call", 500, vec![], None).await;
 
     let agent = make_agent(&url);
 
@@ -175,17 +186,19 @@ async fn call_error() -> Result<(), AgentError> {
 #[cfg_attr(not(target_family = "wasm"), tokio::test)]
 #[cfg_attr(target_family = "wasm", wasm_bindgen_test)]
 async fn call_rejected() -> Result<(), AgentError> {
-    let reject_body = RejectResponse {
+    let reject_response = RejectResponse {
         reject_code: RejectCode::SysTransient,
         reject_message: "Test reject message".to_string(),
         error_code: Some("Test error code".to_string()),
     };
 
+    let reject_body = TransportCallResponse::NonReplicatedRejection(reject_response.clone());
+
     let body = serde_cbor::to_vec(&reject_body).unwrap();
 
     let (call_mock, url) = mock(
         "POST",
-        "/api/v2/canister/aaaaa-aa/call",
+        "/api/v3/canister/aaaaa-aa/call",
         200,
         body,
         Some("application/cbor"),
@@ -202,7 +215,7 @@ async fn call_rejected() -> Result<(), AgentError> {
 
     assert_mock(call_mock).await;
 
-    let expected_response = Err(AgentError::ReplicaError(reject_body));
+    let expected_response = Err(AgentError::UncertifiedReject(reject_response));
     assert_eq!(expected_response, result);
 
     Ok(())
@@ -211,17 +224,21 @@ async fn call_rejected() -> Result<(), AgentError> {
 #[cfg_attr(not(target_family = "wasm"), tokio::test)]
 #[cfg_attr(target_family = "wasm", wasm_bindgen_test)]
 async fn call_rejected_without_error_code() -> Result<(), AgentError> {
-    let reject_body = RejectResponse {
+    let non_replicated_reject = RejectResponse {
         reject_code: RejectCode::SysTransient,
         reject_message: "Test reject message".to_string(),
         error_code: None,
     };
 
+    let reject_body = TransportCallResponse::NonReplicatedRejection(non_replicated_reject.clone());
+
+    let canister_id_str = "aaaaa-aa";
+
     let body = serde_cbor::to_vec(&reject_body).unwrap();
 
     let (call_mock, url) = mock(
         "POST",
-        "/api/v2/canister/aaaaa-aa/call",
+        format!("/api/v3/canister/{canister_id_str}/call").as_str(),
         200,
         body,
         Some("application/cbor"),
@@ -231,14 +248,14 @@ async fn call_rejected_without_error_code() -> Result<(), AgentError> {
     let agent = make_agent(&url);
 
     let result = agent
-        .update(&Principal::management_canister(), "greet")
+        .update(&Principal::from_str(canister_id_str).unwrap(), "greet")
         .with_arg([])
         .call()
         .await;
 
     assert_mock(call_mock).await;
 
-    let expected_response = Err(AgentError::ReplicaError(reject_body));
+    let expected_response = Err(AgentError::UncertifiedReject(non_replicated_reject));
     assert_eq!(expected_response, result);
 
     Ok(())
@@ -291,6 +308,38 @@ async fn status_okay() -> Result<(), AgentError> {
     Ok(())
 }
 
+#[cfg_attr(not(target_family = "wasm"), tokio::test)]
+async fn reqwest_client_status_okay_when_request_retried() -> Result<(), AgentError> {
+    let map = BTreeMap::new();
+    let response = serde_cbor::Value::Map(map);
+    let (read_mock, url) = mock(
+        "GET",
+        "/api/v2/status",
+        200,
+        serde_cbor::to_vec(&response)?,
+        Some("application/cbor"),
+    )
+    .await;
+    // Without retry request should fail.
+    let non_working_url = "http://127.0.0.1:4444";
+    let tcp_retries = 0;
+    let route_provider = RoundRobinRouteProvider::new(vec![non_working_url, &url]).unwrap();
+    let agent = make_agent_with_route_provider(Arc::new(route_provider), tcp_retries);
+    let result = agent.status().await;
+    assert!(result.is_err());
+
+    // With retry request should succeed.
+    let tcp_retries = 1;
+    let route_provider = RoundRobinRouteProvider::new(vec![non_working_url, &url]).unwrap();
+    let agent = make_agent_with_route_provider(Arc::new(route_provider), tcp_retries);
+    let result = agent.status().await;
+
+    assert_mock(read_mock).await;
+
+    assert!(result.is_ok());
+    Ok(())
+}
+
 #[cfg_attr(not(target_family = "wasm"), tokio::test)]
 #[cfg_attr(target_family = "wasm", wasm_bindgen_test)]
 // test that the agent (re)tries to reach the server.
@@ -426,7 +475,7 @@ async fn wrong_subnet_query_certificate() {
     let response = QueryResponse::Replied {
         reply: ReplyResponse { arg: blob.clone() },
         signatures: vec![NodeSignature {
-            timestamp: 1697831349698624964,
+            timestamp: 1_697_831_349_698_624_964,
             signature: hex::decode("4bb6ba316623395d56d8e2834ece39d2c81d47e76a9fd122e1457963be6a83a5589e2c98c7b4d8b3c6c7b11c74b8ce9dcb345b5d1bd91706a643f33c7b509b0b").unwrap(),
             identity: "oo4np-rrvnz-5vram-kglex-enhkp-uew6q-vdf6z-whj4x-v44jd-tebaw-nqe".parse().unwrap()
         }],
@@ -494,14 +543,14 @@ const RESP_WITH_SUBNET_KEY: &[u8] = include_bytes!("agent_test/with_subnet_key.b
 #[cfg_attr(target_family = "wasm", wasm_bindgen_test)]
 async fn too_many_delegations() {
     // Use the certificate as its own delegation, and repeat the process the specified number of times
-    fn self_delegate_cert(subnet_id: Vec<u8>, cert: &Certificate, depth: u32) -> Certificate {
+    fn self_delegate_cert(subnet_id: &[u8], cert: &Certificate, depth: u32) -> Certificate {
         let mut current = cert.clone();
         for _ in 0..depth {
             current = Certificate {
                 tree: current.tree.clone(),
                 signature: current.signature.clone(),
                 delegation: Some(Delegation {
-                    subnet_id: subnet_id.clone(),
+                    subnet_id: subnet_id.to_vec(),
                     certificate: serde_cbor::to_vec(&current).unwrap(),
                 }),
             }
@@ -519,7 +568,7 @@ async fn too_many_delegations() {
 
     let (_read_mock, url) = mock(
         "POST",
-        format!("/api/v2/canister/{}/read_state", canister_id_str).as_str(),
+        format!("/api/v2/canister/{canister_id_str}/read_state").as_str(),
         200,
         RESP_WITH_SUBNET_KEY.into(),
         Some("application/cbor"),
@@ -531,13 +580,38 @@ async fn too_many_delegations() {
         .read_state_raw(vec![vec![path_label]], canister_id)
         .await
         .expect("read state failed");
-    let new_cert = self_delegate_cert(subnet_id, &cert, 1);
+    let new_cert = self_delegate_cert(&subnet_id, &cert, 1);
     assert!(matches!(
         agent.verify(&new_cert, canister_id).unwrap_err(),
         AgentError::CertificateHasTooManyDelegations
     ));
 }
 
+#[cfg_attr(not(target_family = "wasm"), tokio::test)]
+#[cfg_attr(target_family = "wasm", wasm_bindgen_test)]
+async fn retry_ratelimit() {
+    let (mut mock, url) = mock(
+        "POST",
+        "/api/v2/canister/ryjl3-tyaaa-aaaaa-aaaba-cai/query",
+        429,
+        vec![],
+        Some("text/plain"),
+    )
+    .await;
+    let agent = make_agent(&url);
+    futures_util::select! {
+        _ = agent.query(&"ryjl3-tyaaa-aaaaa-aaaba-cai".parse().unwrap(), "greet").call().fuse() => panic!("did not retry 429"),
+        _ = crate::util::sleep(Duration::from_millis(500)).fuse() => {},
+    };
+    assert_single_mock_count(
+        "POST",
+        "/api/v2/canister/ryjl3-tyaaa-aaaaa-aaaba-cai/query",
+        2,
+        &mut mock,
+    )
+    .await;
+}
+
 #[cfg(not(target_family = "wasm"))]
 mod mock {
 
@@ -601,6 +675,19 @@ mod mock {
     ) {
         mocks[&format!("{method} {path}")].assert_async().await;
     }
+
+    pub async fn assert_single_mock_count(
+        method: &str,
+        path: &str,
+        n: usize,
+        (_, mocks): &mut (ServerGuard, HashMap<String, Mock>),
+    ) {
+        let k = format!("{method} {path}");
+        let mut mock = mocks.remove(&k).unwrap();
+        mock = mock.expect_at_least(n);
+        mock.assert_async().await;
+        mocks.insert(k, mock);
+    }
 }
 
 #[cfg(all(target_family = "wasm", feature = "wasm-bindgen"))]
@@ -694,8 +781,8 @@ mod mock {
             .unwrap();
     }
 
-    pub async fn assert_mock(nonce: String) {
-        let hits: HashMap<String, i64> = Client::new()
+    async fn get_hits(nonce: &str) -> HashMap<String, i64> {
+        Client::new()
             .get(&format!("http://mock_assert/{}", nonce))
             .send()
             .await
@@ -704,21 +791,21 @@ mod mock {
             .unwrap()
             .json()
             .await
-            .unwrap();
+            .unwrap()
+    }
+
+    pub async fn assert_mock(nonce: String) {
+        let hits = get_hits(&nonce).await;
         assert!(hits.values().all(|x| *x > 0));
     }
 
     pub async fn assert_single_mock(method: &str, path: &str, nonce: &String) {
-        let hits: HashMap<String, i64> = Client::new()
-            .get(&format!("http://mock_assert/{}", nonce))
-            .send()
-            .await
-            .unwrap()
-            .error_for_status()
-            .unwrap()
-            .json()
-            .await
-            .unwrap();
+        let hits = get_hits(nonce).await;
         assert!(hits[&format!("{method} {path}")] > 0);
     }
+
+    pub async fn assert_single_mock_count(method: &str, path: &str, n: usize, nonce: &mut String) {
+        let hits = get_hits(&*nonce).await;
+        assert!(hits[&format!("{method} {path}")] >= n as i64);
+    }
 }
diff --git a/ic-agent/src/agent/builder.rs b/ic-agent/src/agent/builder.rs
index 77556a12..388cd0aa 100644
--- a/ic-agent/src/agent/builder.rs
+++ b/ic-agent/src/agent/builder.rs
@@ -1,9 +1,11 @@
 use crate::{
-    agent::{agent_config::AgentConfig, Agent, Transport},
+    agent::{agent_config::AgentConfig, Agent},
     AgentError, Identity, NonceFactory, NonceGenerator,
 };
 use std::sync::Arc;
 
+use super::{route_provider::RouteProvider, HttpService};
+
 /// A builder for an [`Agent`].
 #[derive(Default)]
 pub struct AgentBuilder {
@@ -16,32 +18,35 @@ impl AgentBuilder {
         Agent::new(self.config)
     }
 
-    /// Set the URL of the [Agent].
-    #[cfg(feature = "reqwest")]
-    pub fn with_url<S: Into<String>>(self, url: S) -> Self {
-        use crate::agent::http_transport::ReqwestTransport;
-
-        self.with_transport(ReqwestTransport::create(url).unwrap())
-    }
-
-    /// Set a Replica transport to talk to serve as the replica interface.
-    pub fn with_transport<T: 'static + Transport>(self, transport: T) -> Self {
-        self.with_arc_transport(Arc::new(transport))
+    /// Set the dynamic transport layer for the [`Agent`], performing continuous discovery of the API boundary nodes
+    /// and routing traffic via them based on latency. Cannot be set together with `with_route_provider`.
+    ///
+    /// See [`DynamicRouteProvider`](super::route_provider::DynamicRouteProvider) if more customization is needed such as polling intervals.
+    pub async fn with_background_dynamic_routing(mut self) -> Self {
+        assert!(
+            self.config.route_provider.is_none(),
+            "with_background_dynamic_routing cannot be called with with_route_provider"
+        );
+        self.config.background_dynamic_routing = true;
+        self
     }
 
-    /// Same as [Self::with_transport], but provides a `Arc` boxed implementation instead
-    /// of a direct type.
-    pub fn with_arc_transport(mut self, transport: Arc<dyn Transport>) -> Self {
-        self.config.transport = Some(transport);
+    /// Set the URL of the [`Agent`]. Either this or `with_route_provider` must be called (but not both).
+    pub fn with_url<S: Into<String>>(mut self, url: S) -> Self {
+        assert!(
+            self.config.route_provider.is_none(),
+            "with_url cannot be called with with_route_provider"
+        );
+        self.config.url = Some(url.into().parse().unwrap());
         self
     }
 
-    /// Add a NonceFactory to this Agent. By default, no nonce is produced.
+    /// Add a `NonceFactory` to this Agent. By default, no nonce is produced.
     pub fn with_nonce_factory(self, nonce_factory: NonceFactory) -> AgentBuilder {
         self.with_nonce_generator(nonce_factory)
     }
 
-    /// Same as [Self::with_nonce_factory], but for any `NonceGenerator` type
+    /// Same as [`Self::with_nonce_factory`], but for any `NonceGenerator` type
     pub fn with_nonce_generator<N: 'static + NonceGenerator>(
         self,
         nonce_factory: N,
@@ -49,8 +54,7 @@ impl AgentBuilder {
         self.with_arc_nonce_generator(Arc::new(nonce_factory))
     }
 
-    /// Same as [Self::with_nonce_generator], but provides a `Arc` boxed implementation instead
-    /// of a direct type.
+    /// Same as [`Self::with_nonce_generator`], but reuses an existing `Arc`.
     pub fn with_arc_nonce_generator(
         mut self,
         nonce_factory: Arc<dyn NonceGenerator>,
@@ -67,14 +71,12 @@ impl AgentBuilder {
         self.with_arc_identity(Arc::new(identity))
     }
 
-    /// Same as [Self::with_identity], but provides a boxed implementation instead
-    /// of a direct type.
+    /// Same as [`Self::with_identity`], but reuses an existing box
     pub fn with_boxed_identity(self, identity: Box<dyn Identity>) -> Self {
         self.with_arc_identity(Arc::from(identity))
     }
 
-    /// Same as [Self::with_identity], but provides a `Arc` boxed implementation instead
-    /// of a direct type.
+    /// Same as [`Self::with_identity`], but reuses an existing `Arc`
     pub fn with_arc_identity(mut self, identity: Arc<dyn Identity>) -> Self {
         self.config.identity = identity;
         self
@@ -82,12 +84,12 @@ impl AgentBuilder {
 
     /// Provides a _default_ ingress expiry. This is the delta that will be applied
     /// at the time an update or query is made. The default expiry cannot be a
-    /// fixed system time.
+    /// fixed system time. This is also used when checking certificate timestamps.
     ///
     /// The timestamp corresponding to this duration may be rounded in order to reduce
     /// cache misses. The current implementation rounds to the nearest minute if the
     /// expiry is more than a minute, but this is not guaranteed.
-    pub fn with_ingress_expiry(mut self, ingress_expiry: Option<std::time::Duration>) -> Self {
+    pub fn with_ingress_expiry(mut self, ingress_expiry: std::time::Duration) -> Self {
         self.config.ingress_expiry = ingress_expiry;
         self
     }
@@ -98,4 +100,72 @@ impl AgentBuilder {
         self.config.verify_query_signatures = verify_query_signatures;
         self
     }
+
+    /// Sets the maximum number of requests that the agent will make concurrently. The replica is configured
+    /// to only permit 50 concurrent requests per client. Set this value lower if you have multiple agents,
+    /// to avoid the slowdown of retrying any 429 errors.
+    pub fn with_max_concurrent_requests(mut self, max_concurrent_requests: usize) -> Self {
+        self.config.max_concurrent_requests = max_concurrent_requests;
+        self
+    }
+
+    /// Add a `RouteProvider` to this agent, to provide the URLs of boundary nodes.
+    pub fn with_route_provider(self, provider: impl RouteProvider + 'static) -> Self {
+        self.with_arc_route_provider(Arc::new(provider))
+    }
+
+    /// Same as [`Self::with_route_provider`], but reuses an existing `Arc`.
+    pub fn with_arc_route_provider(mut self, provider: Arc<dyn RouteProvider>) -> Self {
+        assert!(
+            !self.config.background_dynamic_routing,
+            "with_background_dynamic_routing cannot be called with with_route_provider"
+        );
+        assert!(
+            self.config.url.is_none(),
+            "with_url cannot be called with with_route_provider"
+        );
+        self.config.route_provider = Some(provider);
+        self
+    }
+
+    /// Provide a pre-configured HTTP client to use. Use this to set e.g. HTTP timeouts or proxy configuration.
+    pub fn with_http_client(mut self, client: reqwest::Client) -> Self {
+        assert!(
+            self.config.http_service.is_none(),
+            "with_arc_http_middleware cannot be called with with_http_client"
+        );
+        self.config.client = Some(client);
+        self
+    }
+
+    /// Provide a custom `reqwest`-compatible HTTP service, e.g. to add per-request headers for custom boundary nodes.
+    /// Most users will not need this and should use `with_http_client`. Cannot be called with `with_http_client`.
+    ///
+    /// The trait is automatically implemented for any `tower::Service` impl matching the one `reqwest::Client` uses,
+    /// including `reqwest-middleware`. This is a low-level interface, and direct implementations must provide all automatic retry logic.
+    pub fn with_arc_http_middleware(mut self, service: Arc<dyn HttpService>) -> Self {
+        assert!(
+            self.config.client.is_none(),
+            "with_arc_http_middleware cannot be called with with_http_client"
+        );
+        self.config.http_service = Some(service);
+        self
+    }
+
+    /// Retry up to the specified number of times upon encountering underlying TCP errors.
+    pub fn with_max_tcp_error_retries(mut self, retries: usize) -> Self {
+        self.config.max_tcp_error_retries = retries;
+        self
+    }
+
+    /// Don't accept HTTP bodies any larger than `max_size` bytes.
+    pub fn with_max_response_body_size(mut self, max_size: usize) -> Self {
+        self.config.max_response_body_size = Some(max_size);
+        self
+    }
+    /// Set the maximum time to wait for a response from the replica.
+    pub fn with_max_polling_time(mut self, max_polling_time: std::time::Duration) -> Self {
+        self.config.max_polling_time = max_polling_time;
+        self
+    }
 }
diff --git a/ic-agent/src/agent/http_transport/hyper_transport.rs b/ic-agent/src/agent/http_transport/hyper_transport.rs
deleted file mode 100644
index c5b1f5ce..00000000
--- a/ic-agent/src/agent/http_transport/hyper_transport.rs
+++ /dev/null
@@ -1,301 +0,0 @@
-//! A [`Transport`] that connects using a [`hyper`] client.
-pub use hyper;
-
-use std::{any, error::Error, future::Future, marker::PhantomData, sync::atomic::AtomicPtr};
-
-use http_body::{LengthLimitError, Limited};
-use hyper::{
-    body::HttpBody, client::HttpConnector, header::CONTENT_TYPE, service::Service, Client, Method,
-    Request, Response,
-};
-use hyper_rustls::{HttpsConnector, HttpsConnectorBuilder};
-
-use crate::{
-    agent::{
-        agent_error::HttpErrorPayload,
-        http_transport::route_provider::{RoundRobinRouteProvider, RouteProvider},
-        AgentFuture, Transport,
-    },
-    export::Principal,
-    AgentError, RequestId,
-};
-
-/// A [`Transport`] using [`hyper`] to make HTTP calls to the Internet Computer.
-#[derive(Debug)]
-pub struct HyperTransport<B1, S = Client<HttpsConnector<HttpConnector>, B1>> {
-    _marker: PhantomData<AtomicPtr<B1>>,
-    route_provider: Box<dyn RouteProvider>,
-    max_response_body_size: Option<usize>,
-    service: S,
-}
-
-#[doc(hidden)]
-#[deprecated(since = "0.30.0", note = "use HyperTransport")]
-pub use HyperTransport as HyperReplicaV2Transport; // delete after 0.31
-
-/// Trait representing the contraints on [`HttpBody`] that [`HyperTransport`] requires
-pub trait HyperBody:
-    HttpBody<Data = Self::BodyData, Error = Self::BodyError> + Send + From<Vec<u8>> + 'static
-{
-    /// Values yielded by the `Body`.
-    type BodyData: Send;
-    /// The error type this `Body` might generate.
-    type BodyError: Error + Send + Sync + 'static;
-}
-
-impl<B> HyperBody for B
-where
-    B: HttpBody + Send + From<Vec<u8>> + 'static,
-    B::Data: Send,
-    B::Error: Error + Send + Sync + 'static,
-{
-    type BodyData = B::Data;
-    type BodyError = B::Error;
-}
-
-/// Trait representing the contraints on [`Service`] that [`HyperTransport`] requires.
-pub trait HyperService<B1: HyperBody>:
-    Send
-    + Sync
-    + Clone
-    + Service<
-        Request<B1>,
-        Response = Response<Self::ResponseBody>,
-        Error = hyper::Error,
-        Future = Self::ServiceFuture,
-    >
-{
-    /// Values yielded in the `Body` of the `Response`.
-    type ResponseBody: HyperBody;
-    /// The future response value.
-    type ServiceFuture: Send + Future<Output = Result<Self::Response, Self::Error>>;
-}
-
-impl<B1, B2, S> HyperService<B1> for S
-where
-    B1: HyperBody,
-    B2: HyperBody,
-    S: Send + Sync + Clone + Service<Request<B1>, Response = Response<B2>, Error = hyper::Error>,
-    S::Future: Send,
-{
-    type ResponseBody = B2;
-    type ServiceFuture = S::Future;
-}
-
-impl<B1: HyperBody> HyperTransport<B1> {
-    /// Creates a replica transport from a HTTP URL.
-    pub fn create<U: Into<String>>(url: U) -> Result<Self, AgentError> {
-        let connector = HttpsConnectorBuilder::new()
-            .with_webpki_roots()
-            .https_or_http()
-            .enable_http1()
-            .enable_http2()
-            .build();
-        Self::create_with_service(url, Client::builder().build(connector))
-    }
-}
-
-impl<B1, S> HyperTransport<B1, S>
-where
-    B1: HyperBody,
-    S: HyperService<B1>,
-{
-    /// Creates a replica transport from a HTTP URL and a [`HyperService`].
-    pub fn create_with_service<U: Into<String>>(url: U, service: S) -> Result<Self, AgentError> {
-        let route_provider = Box::new(RoundRobinRouteProvider::new(vec![url.into()])?);
-        Self::create_with_service_route(route_provider, service)
-    }
-
-    /// Creates a replica transport from a [`RouteProvider`] and a [`HyperService`].
-    pub fn create_with_service_route(
-        route_provider: Box<dyn RouteProvider>,
-        service: S,
-    ) -> Result<Self, AgentError> {
-        Ok(Self {
-            _marker: PhantomData,
-            route_provider,
-            service,
-            max_response_body_size: None,
-        })
-    }
-
-    /// Sets a max response body size limit
-    pub fn with_max_response_body_size(self, max_response_body_size: usize) -> Self {
-        Self {
-            max_response_body_size: Some(max_response_body_size),
-            ..self
-        }
-    }
-
-    async fn request(
-        &self,
-        method: Method,
-        url: String,
-        body: Option<Vec<u8>>,
-    ) -> Result<Vec<u8>, AgentError> {
-        let http_request = Request::builder()
-            .method(method)
-            .uri(url)
-            .header(CONTENT_TYPE, "application/cbor")
-            .body(body.unwrap_or_default().into())
-            .map_err(|err| AgentError::TransportError(Box::new(err)))?;
-
-        fn map_error<E: Error + Send + Sync + 'static>(err: E) -> AgentError {
-            if any::TypeId::of::<E>() == any::TypeId::of::<AgentError>() {
-                // Store the value in an `Option` so we can `take`
-                // it after casting to `&mut dyn Any`.
-                let mut slot = Some(err);
-
-                // Re-write the `$val` ident with the downcasted value.
-                let val = (&mut slot as &mut dyn any::Any)
-                    .downcast_mut::<Option<AgentError>>()
-                    .unwrap()
-                    .take()
-                    .unwrap();
-
-                // Run the $body in scope of the replaced val.
-                return val;
-            }
-            AgentError::TransportError(Box::new(err))
-        }
-        let response = self
-            .service
-            .clone()
-            .call(http_request)
-            .await
-            .map_err(map_error)?;
-
-        let (parts, body) = response.into_parts();
-        let body = if let Some(limit) = self.max_response_body_size {
-            hyper::body::to_bytes(Limited::new(body, limit))
-                .await
-                .map_err(|err| {
-                    if err.downcast_ref::<LengthLimitError>().is_some() {
-                        AgentError::ResponseSizeExceededLimit()
-                    } else {
-                        AgentError::TransportError(err)
-                    }
-                })?
-        } else {
-            hyper::body::to_bytes(body)
-                .await
-                .map_err(|err| AgentError::TransportError(Box::new(err)))?
-        };
-
-        let (status, headers, body) = (parts.status, parts.headers, body.to_vec());
-        if status.is_client_error() || status.is_server_error() {
-            Err(AgentError::HttpError(HttpErrorPayload {
-                status: status.into(),
-                content_type: headers
-                    .get(CONTENT_TYPE)
-                    .and_then(|value| value.to_str().ok())
-                    .map(|x| x.to_string()),
-                content: body,
-            }))
-        } else {
-            Ok(body)
-        }
-    }
-}
-
-impl<B1, S> Transport for HyperTransport<B1, S>
-where
-    B1: HyperBody,
-    S: HyperService<B1>,
-{
-    fn call(
-        &self,
-        effective_canister_id: Principal,
-        envelope: Vec<u8>,
-        _request_id: RequestId,
-    ) -> AgentFuture<()> {
-        Box::pin(async move {
-            let url = format!(
-                "{}canister/{effective_canister_id}/call",
-                self.route_provider.route()?
-            );
-            self.request(Method::POST, url, Some(envelope)).await?;
-            Ok(())
-        })
-    }
-
-    fn read_state(
-        &self,
-        effective_canister_id: Principal,
-        envelope: Vec<u8>,
-    ) -> AgentFuture<Vec<u8>> {
-        Box::pin(async move {
-            let url = format!(
-                "{}canister/{effective_canister_id}/read_state",
-                self.route_provider.route()?
-            );
-            self.request(Method::POST, url, Some(envelope)).await
-        })
-    }
-
-    fn read_subnet_state(&self, subnet_id: Principal, envelope: Vec<u8>) -> AgentFuture<Vec<u8>> {
-        Box::pin(async move {
-            let url = format!(
-                "{}subnet/{subnet_id}/read_state",
-                self.route_provider.route()?
-            );
-            self.request(Method::POST, url, Some(envelope)).await
-        })
-    }
-
-    fn query(&self, effective_canister_id: Principal, envelope: Vec<u8>) -> AgentFuture<Vec<u8>> {
-        Box::pin(async move {
-            let url = format!(
-                "{}canister/{effective_canister_id}/query",
-                self.route_provider.route()?
-            );
-            self.request(Method::POST, url, Some(envelope)).await
-        })
-    }
-
-    fn status(&self) -> AgentFuture<Vec<u8>> {
-        Box::pin(async move {
-            let url = format!("{}status", self.route_provider.route()?);
-            self.request(Method::GET, url, None).await
-        })
-    }
-}
-
-#[cfg(test)]
-mod test {
-    use super::HyperTransport;
-    use hyper::Client;
-    use url::Url;
-
-    #[test]
-    fn redirect() {
-        fn test(base: &str, result: &str) {
-            let client: Client<_> = Client::builder().build_http();
-            let url: Url = base.parse().unwrap();
-            let t = HyperTransport::create_with_service(url, client).unwrap();
-            assert_eq!(
-                t.route_provider.route().unwrap().as_str(),
-                result,
-                "{}",
-                base
-            );
-        }
-
-        test("https://ic0.app", "https://ic0.app/api/v2/");
-        test("https://IC0.app", "https://ic0.app/api/v2/");
-        test("https://foo.ic0.app", "https://ic0.app/api/v2/");
-        test("https://foo.IC0.app", "https://ic0.app/api/v2/");
-        test("https://foo.Ic0.app", "https://ic0.app/api/v2/");
-        test("https://foo.iC0.app", "https://ic0.app/api/v2/");
-        test("https://foo.bar.ic0.app", "https://ic0.app/api/v2/");
-        test("https://ic0.app/foo/", "https://ic0.app/foo/api/v2/");
-        test("https://foo.ic0.app/foo/", "https://ic0.app/foo/api/v2/");
-
-        test("https://ic1.app", "https://ic1.app/api/v2/");
-        test("https://foo.ic1.app", "https://foo.ic1.app/api/v2/");
-        test("https://ic0.app.ic1.app", "https://ic0.app.ic1.app/api/v2/");
-
-        test("https://fooic0.app", "https://fooic0.app/api/v2/");
-        test("https://fooic0.app.ic0.app", "https://ic0.app/api/v2/");
-    }
-}
diff --git a/ic-agent/src/agent/http_transport/mod.rs b/ic-agent/src/agent/http_transport/mod.rs
index 8f2220d6..bf937667 100644
--- a/ic-agent/src/agent/http_transport/mod.rs
+++ b/ic-agent/src/agent/http_transport/mod.rs
@@ -1,33 +1,8 @@
-//! [`Transport`](super::Transport) implementations.
+//! This module has been deprecated in favor of builder methods on `AgentBuilder`.
 
-#[cfg(feature = "reqwest")]
+#[deprecated(since = "0.38.0", note = "use the AgentBuilder methods")]
+#[doc(hidden)]
 pub mod reqwest_transport;
-
-#[cfg(feature = "reqwest")]
-#[doc(inline)]
+#[doc(hidden)]
+#[allow(deprecated)]
 pub use reqwest_transport::ReqwestTransport;
-
-#[cfg(feature = "hyper")]
-pub mod hyper_transport;
-
-#[cfg(feature = "hyper")]
-#[doc(inline)]
-pub use hyper_transport::HyperTransport;
-
-#[allow(dead_code)]
-const IC0_DOMAIN: &str = "ic0.app";
-#[allow(dead_code)]
-const ICP0_DOMAIN: &str = "icp0.io";
-#[allow(dead_code)]
-const ICP_API_DOMAIN: &str = "icp-api.io";
-#[allow(dead_code)]
-const LOCALHOST_DOMAIN: &str = "localhost";
-#[allow(dead_code)]
-const IC0_SUB_DOMAIN: &str = ".ic0.app";
-#[allow(dead_code)]
-const ICP0_SUB_DOMAIN: &str = ".icp0.io";
-#[allow(dead_code)]
-const ICP_API_SUB_DOMAIN: &str = ".icp-api.io";
-#[allow(dead_code)]
-const LOCALHOST_SUB_DOMAIN: &str = ".localhost";
-pub mod route_provider;
diff --git a/ic-agent/src/agent/http_transport/reqwest_transport.rs b/ic-agent/src/agent/http_transport/reqwest_transport.rs
index 194c9123..5876c281 100644
--- a/ic-agent/src/agent/http_transport/reqwest_transport.rs
+++ b/ic-agent/src/agent/http_transport/reqwest_transport.rs
@@ -1,39 +1,30 @@
-//! A [`Transport`] that connects using a [`reqwest`] client.
-#![cfg(feature = "reqwest")]
-
-use ic_transport_types::RejectResponse;
+//! This module has been deprecated in favor of builder methods on `AgentBuilder`.
+#![allow(deprecated)]
 pub use reqwest;
+use std::sync::Arc;
 
-use futures_util::StreamExt;
-use reqwest::{
-    header::{HeaderMap, CONTENT_TYPE},
-    Body, Client, Method, Request, StatusCode,
-};
+use reqwest::Client;
 
 use crate::{
     agent::{
-        agent_error::HttpErrorPayload,
-        http_transport::route_provider::{RoundRobinRouteProvider, RouteProvider},
-        AgentFuture, Transport,
+        route_provider::{RoundRobinRouteProvider, RouteProvider},
+        AgentBuilder,
     },
-    export::Principal,
-    AgentError, RequestId,
+    AgentError,
 };
 
-/// A [`Transport`] using [`reqwest`] to make HTTP calls to the Internet Computer.
-#[derive(Debug)]
+/// A legacy configuration object. `AgentBuilder::with_transport` will apply these settings to the builder.
+#[derive(Debug, Clone)]
 pub struct ReqwestTransport {
-    route_provider: Box<dyn RouteProvider>,
+    route_provider: Arc<dyn RouteProvider>,
     client: Client,
     max_response_body_size: Option<usize>,
+    max_tcp_error_retries: usize,
 }
 
-#[doc(hidden)]
-#[deprecated(since = "0.30.0", note = "use ReqwestTransport")]
-pub use ReqwestTransport as ReqwestHttpReplicaV2Transport; // delete after 0.31
-
 impl ReqwestTransport {
-    /// Creates a replica transport from a HTTP URL.
+    /// Equivalent to [`AgentBuilder::with_url`].
+    #[deprecated(since = "0.38.0", note = "Use AgentBuilder::with_url")]
     pub fn create<U: Into<String>>(url: U) -> Result<Self, AgentError> {
         #[cfg(not(target_family = "wasm"))]
         {
@@ -41,6 +32,7 @@ impl ReqwestTransport {
                 url,
                 Client::builder()
                     .use_rustls_tls()
+                    .timeout(std::time::Duration::from_secs(360))
                     .build()
                     .expect("Could not create HTTP client."),
             )
@@ -51,25 +43,38 @@ impl ReqwestTransport {
         }
     }
 
-    /// Creates a replica transport from a HTTP URL and a [`reqwest::Client`].
+    /// Equivalent to [`AgentBuilder::with_url`] and [`AgentBuilder::with_http_client`].
+    #[deprecated(
+        since = "0.38.0",
+        note = "Use AgentBuilder::with_url and AgentBuilder::with_http_client"
+    )]
     pub fn create_with_client<U: Into<String>>(url: U, client: Client) -> Result<Self, AgentError> {
-        let route_provider = Box::new(RoundRobinRouteProvider::new(vec![url.into()])?);
+        let route_provider = Arc::new(RoundRobinRouteProvider::new(vec![url.into()])?);
         Self::create_with_client_route(route_provider, client)
     }
 
-    /// Creates a replica transport from a [`RouteProvider`] and a [`reqwest::Client`].
+    /// Equivalent to [`AgentBuilder::with_http_client`] and [`AgentBuilder::with_route_provider`].
+    #[deprecated(
+        since = "0.38.0",
+        note = "Use AgentBuilder::with_http_client and AgentBuilder::with_arc_route_provider"
+    )]
     pub fn create_with_client_route(
-        route_provider: Box<dyn RouteProvider>,
+        route_provider: Arc<dyn RouteProvider>,
         client: Client,
     ) -> Result<Self, AgentError> {
         Ok(Self {
             route_provider,
             client,
             max_response_body_size: None,
+            max_tcp_error_retries: 0,
         })
     }
 
-    /// Sets a max response body size limit
+    /// Equivalent to [`AgentBuilder::with_max_response_body_size`].
+    #[deprecated(
+        since = "0.38.0",
+        note = "Use AgentBuilder::with_max_response_body_size"
+    )]
     pub fn with_max_response_body_size(self, max_response_body_size: usize) -> Self {
         ReqwestTransport {
             max_response_body_size: Some(max_response_body_size),
@@ -77,201 +82,35 @@ impl ReqwestTransport {
         }
     }
 
-    async fn request(
-        &self,
-        http_request: Request,
-    ) -> Result<(StatusCode, HeaderMap, Vec<u8>), AgentError> {
-        let response = self
-            .client
-            .execute(http_request)
-            .await
-            .map_err(|x| AgentError::TransportError(Box::new(x)))?;
-
-        let http_status = response.status();
-        let response_headers = response.headers().clone();
-
-        // Size Check (Content-Length)
-        if matches!(self
-            .max_response_body_size
-            .zip(response.content_length()), Some((size_limit, content_length)) if content_length as usize > size_limit)
-        {
-            return Err(AgentError::ResponseSizeExceededLimit());
-        }
-
-        let mut body: Vec<u8> = response
-            .content_length()
-            .map_or_else(Vec::new, |n| Vec::with_capacity(n as usize));
-
-        let mut stream = response.bytes_stream();
-
-        while let Some(chunk) = stream.next().await {
-            let chunk = chunk.map_err(|x| AgentError::TransportError(Box::new(x)))?;
-
-            // Size Check (Body Size)
-            if matches!(self
-                .max_response_body_size, Some(size_limit) if body.len() + chunk.len() > size_limit)
-            {
-                return Err(AgentError::ResponseSizeExceededLimit());
-            }
-
-            body.extend_from_slice(chunk.as_ref());
-        }
-
-        Ok((http_status, response_headers, body))
-    }
-
-    async fn execute(
-        &self,
-        method: Method,
-        endpoint: &str,
-        body: Option<Vec<u8>>,
-    ) -> Result<Vec<u8>, AgentError> {
-        let url = self.route_provider.route()?.join(endpoint)?;
-        let mut http_request = Request::new(method, url);
-        http_request
-            .headers_mut()
-            .insert(CONTENT_TYPE, "application/cbor".parse().unwrap());
-
-        *http_request.body_mut() = body.map(Body::from);
-
-        let request_result = self.request(http_request.try_clone().unwrap()).await?;
-        let status = request_result.0;
-        let headers = request_result.1;
-        let body = request_result.2;
-
-        // status == OK means we have an error message for call requests
-        // see https://internetcomputer.org/docs/current/references/ic-interface-spec#http-call
-        if status == StatusCode::OK && endpoint.ends_with("call") {
-            let cbor_decoded_body: Result<RejectResponse, serde_cbor::Error> =
-                serde_cbor::from_slice(&body);
-
-            let agent_error = match cbor_decoded_body {
-                Ok(replica_error) => AgentError::ReplicaError(replica_error),
-                Err(cbor_error) => AgentError::InvalidCborData(cbor_error),
-            };
-
-            Err(agent_error)
-        } else if status.is_client_error() || status.is_server_error() {
-            Err(AgentError::HttpError(HttpErrorPayload {
-                status: status.into(),
-                content_type: headers
-                    .get(CONTENT_TYPE)
-                    .and_then(|value| value.to_str().ok())
-                    .map(|x| x.to_string()),
-                content: body,
-            }))
-        } else {
-            Ok(body)
+    /// Equivalent to [`AgentBuilder::with_max_tcp_error_retries`].
+    #[deprecated(
+        since = "0.38.0",
+        note = "Use AgentBuilder::with_max_tcp_error_retries"
+    )]
+    pub fn with_max_tcp_errors_retries(self, retries: usize) -> Self {
+        ReqwestTransport {
+            max_tcp_error_retries: retries,
+            ..self
         }
     }
 }
 
-impl Transport for ReqwestTransport {
-    fn call(
-        &self,
-        effective_canister_id: Principal,
-        envelope: Vec<u8>,
-        _request_id: RequestId,
-    ) -> AgentFuture<()> {
-        Box::pin(async move {
-            let endpoint = format!("canister/{}/call", effective_canister_id.to_text());
-            self.execute(Method::POST, &endpoint, Some(envelope))
-                .await?;
-            Ok(())
-        })
-    }
-
-    fn read_state(
-        &self,
-        effective_canister_id: Principal,
-        envelope: Vec<u8>,
-    ) -> AgentFuture<Vec<u8>> {
-        Box::pin(async move {
-            let endpoint = format!("canister/{effective_canister_id}/read_state");
-            self.execute(Method::POST, &endpoint, Some(envelope)).await
-        })
-    }
-
-    fn read_subnet_state(&self, subnet_id: Principal, envelope: Vec<u8>) -> AgentFuture<Vec<u8>> {
-        Box::pin(async move {
-            let endpoint = format!("subnet/{subnet_id}/read_state");
-            self.execute(Method::POST, &endpoint, Some(envelope)).await
-        })
-    }
-
-    fn query(&self, effective_canister_id: Principal, envelope: Vec<u8>) -> AgentFuture<Vec<u8>> {
-        Box::pin(async move {
-            let endpoint = format!("canister/{effective_canister_id}/query");
-            self.execute(Method::POST, &endpoint, Some(envelope)).await
-        })
-    }
-
-    fn status(&self) -> AgentFuture<Vec<u8>> {
-        Box::pin(async move { self.execute(Method::GET, "status", None).await })
-    }
-}
-
-#[cfg(test)]
-mod test {
-    #[cfg(all(target_family = "wasm", feature = "wasm-bindgen"))]
-    use wasm_bindgen_test::wasm_bindgen_test;
-    #[cfg(all(target_family = "wasm", feature = "wasm-bindgen"))]
-    wasm_bindgen_test::wasm_bindgen_test_configure!(run_in_browser);
-
-    use super::ReqwestTransport;
-
-    #[cfg_attr(not(target_family = "wasm"), test)]
-    #[cfg_attr(target_family = "wasm", wasm_bindgen_test)]
-    fn redirect() {
-        fn test(base: &str, result: &str) {
-            let t = ReqwestTransport::create(base).unwrap();
-            assert_eq!(
-                t.route_provider.route().unwrap().as_str(),
-                result,
-                "{}",
-                base
-            );
+impl AgentBuilder {
+    #[doc(hidden)]
+    #[deprecated(since = "0.38.0", note = "Use the dedicated methods on AgentBuilder")]
+    pub fn with_transport(self, transport: ReqwestTransport) -> Self {
+        let mut builder = self
+            .with_arc_route_provider(transport.route_provider)
+            .with_http_client(transport.client)
+            .with_max_tcp_error_retries(transport.max_tcp_error_retries);
+        if let Some(max_size) = transport.max_response_body_size {
+            builder = builder.with_max_response_body_size(max_size);
         }
-
-        test("https://ic0.app", "https://ic0.app/api/v2/");
-        test("https://IC0.app", "https://ic0.app/api/v2/");
-        test("https://foo.ic0.app", "https://ic0.app/api/v2/");
-        test("https://foo.IC0.app", "https://ic0.app/api/v2/");
-        test("https://foo.Ic0.app", "https://ic0.app/api/v2/");
-        test("https://foo.iC0.app", "https://ic0.app/api/v2/");
-        test("https://foo.bar.ic0.app", "https://ic0.app/api/v2/");
-        test("https://ic0.app/foo/", "https://ic0.app/foo/api/v2/");
-        test("https://foo.ic0.app/foo/", "https://ic0.app/foo/api/v2/");
-        test(
-            "https://ryjl3-tyaaa-aaaaa-aaaba-cai.ic0.app",
-            "https://ic0.app/api/v2/",
-        );
-
-        test("https://ic1.app", "https://ic1.app/api/v2/");
-        test("https://foo.ic1.app", "https://foo.ic1.app/api/v2/");
-        test("https://ic0.app.ic1.app", "https://ic0.app.ic1.app/api/v2/");
-
-        test("https://fooic0.app", "https://fooic0.app/api/v2/");
-        test("https://fooic0.app.ic0.app", "https://ic0.app/api/v2/");
-
-        test("https://icp0.io", "https://icp0.io/api/v2/");
-        test(
-            "https://ryjl3-tyaaa-aaaaa-aaaba-cai.icp0.io",
-            "https://icp0.io/api/v2/",
-        );
-        test("https://ic0.app.icp0.io", "https://icp0.io/api/v2/");
-
-        test("https://icp-api.io", "https://icp-api.io/api/v2/");
-        test(
-            "https://ryjl3-tyaaa-aaaaa-aaaba-cai.icp-api.io",
-            "https://icp-api.io/api/v2/",
-        );
-        test("https://icp0.io.icp-api.io", "https://icp-api.io/api/v2/");
-
-        test("http://localhost:4943", "http://localhost:4943/api/v2/");
-        test(
-            "http://ryjl3-tyaaa-aaaaa-aaaba-cai.localhost:4943",
-            "http://localhost:4943/api/v2/",
-        );
+        builder
+    }
+    #[doc(hidden)]
+    #[deprecated(since = "0.38.0", note = "Use the dedicated methods on AgentBuilder")]
+    pub fn with_arc_transport(self, transport: Arc<ReqwestTransport>) -> Self {
+        self.with_transport((*transport).clone())
     }
 }
diff --git a/ic-agent/src/agent/http_transport/route_provider.rs b/ic-agent/src/agent/http_transport/route_provider.rs
deleted file mode 100644
index 3200e691..00000000
--- a/ic-agent/src/agent/http_transport/route_provider.rs
+++ /dev/null
@@ -1,105 +0,0 @@
-//! A [`RouteProvider`] for dynamic generation of routing urls.
-use std::{
-    str::FromStr,
-    sync::atomic::{AtomicUsize, Ordering},
-};
-use url::Url;
-
-use crate::agent::{
-    http_transport::{
-        IC0_DOMAIN, IC0_SUB_DOMAIN, ICP0_DOMAIN, ICP0_SUB_DOMAIN, ICP_API_DOMAIN,
-        ICP_API_SUB_DOMAIN, LOCALHOST_DOMAIN, LOCALHOST_SUB_DOMAIN,
-    },
-    AgentError,
-};
-
-/// A [`RouteProvider`] for dynamic generation of routing urls.
-pub trait RouteProvider: std::fmt::Debug + Send + Sync {
-    /// Generate next routing url
-    fn route(&self) -> Result<Url, AgentError>;
-}
-
-/// A simple implementation of the [`RouteProvider`] which produces an even distribution of the urls from the input ones.
-#[derive(Debug)]
-pub struct RoundRobinRouteProvider {
-    routes: Vec<Url>,
-    current_idx: AtomicUsize,
-}
-
-impl RouteProvider for RoundRobinRouteProvider {
-    fn route(&self) -> Result<Url, AgentError> {
-        if self.routes.is_empty() {
-            return Err(AgentError::RouteProviderError(
-                "No routing urls provided".to_string(),
-            ));
-        }
-        // This operation wraps around an overflow, i.e. after max is reached the value is reset back to 0.
-        let prev_idx = self.current_idx.fetch_add(1, Ordering::Relaxed);
-        Ok(self.routes[prev_idx % self.routes.len()].clone())
-    }
-}
-
-impl RoundRobinRouteProvider {
-    /// Construct [`RoundRobinRouteProvider`] from a vector of urls.
-    pub fn new<T: AsRef<str>>(routes: Vec<T>) -> Result<Self, AgentError> {
-        let routes: Result<Vec<Url>, _> = routes
-            .into_iter()
-            .map(|url| {
-                Url::from_str(url.as_ref()).and_then(|mut url| {
-                    // rewrite *.ic0.app to ic0.app
-                    if let Some(domain) = url.domain() {
-                        if domain.ends_with(IC0_SUB_DOMAIN) {
-                            url.set_host(Some(IC0_DOMAIN))?
-                        } else if domain.ends_with(ICP0_SUB_DOMAIN) {
-                            url.set_host(Some(ICP0_DOMAIN))?
-                        } else if domain.ends_with(ICP_API_SUB_DOMAIN) {
-                            url.set_host(Some(ICP_API_DOMAIN))?
-                        } else if domain.ends_with(LOCALHOST_SUB_DOMAIN) {
-                            url.set_host(Some(LOCALHOST_DOMAIN))?;
-                        }
-                    }
-                    url.join("api/v2/")
-                })
-            })
-            .collect();
-        Ok(Self {
-            routes: routes?,
-            current_idx: AtomicUsize::new(0),
-        })
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn test_empty_routes() {
-        let provider = RoundRobinRouteProvider::new::<&str>(vec![])
-            .expect("failed to create a route provider");
-        let result = provider.route().unwrap_err();
-        assert_eq!(
-            result,
-            AgentError::RouteProviderError("No routing urls provided".to_string())
-        );
-    }
-
-    #[test]
-    fn test_routes_rotation() {
-        let provider = RoundRobinRouteProvider::new(vec!["https://url1.com", "https://url2.com"])
-            .expect("failed to create a route provider");
-        let url_strings = vec![
-            "https://url1.com/api/v2/",
-            "https://url2.com/api/v2/",
-            "https://url1.com/api/v2/",
-        ];
-        let expected_urls: Vec<Url> = url_strings
-            .iter()
-            .map(|url_str| Url::parse(url_str).expect("Invalid URL"))
-            .collect();
-        let urls: Vec<Url> = (0..3)
-            .map(|_| provider.route().expect("failed to get next url"))
-            .collect();
-        assert_eq!(expected_urls, urls);
-    }
-}
diff --git a/ic-agent/src/agent/mod.rs b/ic-agent/src/agent/mod.rs
index 24b217fb..c36a092f 100644
--- a/ic-agent/src/agent/mod.rs
+++ b/ic-agent/src/agent/mod.rs
@@ -2,24 +2,42 @@
 pub(crate) mod agent_config;
 pub mod agent_error;
 pub(crate) mod builder;
+// delete this module after 0.40
+#[doc(hidden)]
+#[deprecated(since = "0.38.0", note = "use the AgentBuilder methods")]
 pub mod http_transport;
 pub(crate) mod nonce;
 pub(crate) mod response_authentication;
+pub mod route_provider;
 pub mod status;
 
 pub use agent_config::AgentConfig;
 pub use agent_error::AgentError;
+use agent_error::HttpErrorPayload;
+use async_lock::Semaphore;
+use async_trait::async_trait;
 pub use builder::AgentBuilder;
 use cached::{Cached, TimedCache};
 use ed25519_consensus::{Error as Ed25519Error, Signature, VerificationKey};
+use futures_util::StreamExt;
+use http::{header::CONTENT_TYPE, HeaderMap, Method, StatusCode};
 #[doc(inline)]
 pub use ic_transport_types::{
-    signed, Envelope, EnvelopeContent, RejectCode, RejectResponse, ReplyResponse,
+    signed, CallResponse, Envelope, EnvelopeContent, RejectCode, RejectResponse, ReplyResponse,
     RequestStatusResponse,
 };
 pub use nonce::{NonceFactory, NonceGenerator};
 use rangemap::{RangeInclusiveMap, RangeInclusiveSet, StepFns};
+use reqwest::{Body, Client, Request, Response};
+use route_provider::{
+    dynamic_routing::{
+        dynamic_route_provider::DynamicRouteProviderBuilder, node::Node,
+        snapshot::latency_based_routing::LatencyRoutingSnapshot,
+    },
+    RouteProvider, UrlUntilReady,
+};
 use time::OffsetDateTime;
+use tower_service::Service;
 
 #[cfg(test)]
 mod agent_test;
@@ -27,7 +45,7 @@ mod agent_test;
 use crate::{
     agent::response_authentication::{
         extract_der, lookup_canister_info, lookup_canister_metadata, lookup_request_status,
-        lookup_subnet, lookup_subnet_metrics, lookup_value,
+        lookup_subnet, lookup_subnet_metrics, lookup_time, lookup_value,
     },
     export::Principal,
     identity::Identity,
@@ -38,7 +56,7 @@ use backoff::{exponential::ExponentialBackoff, SystemClock};
 use ic_certification::{Certificate, Delegation, Label};
 use ic_transport_types::{
     signed::{SignedQuery, SignedRequestStatus, SignedUpdate},
-    QueryResponse, ReadStateResponse, SubnetMetrics,
+    QueryResponse, ReadStateResponse, SubnetMetrics, TransportCallResponse,
 };
 use serde::Serialize;
 use status::Status;
@@ -46,14 +64,16 @@ use std::{
     borrow::Cow,
     collections::HashMap,
     convert::TryFrom,
-    fmt,
-    future::Future,
+    fmt::{self, Debug},
+    future::{Future, IntoFuture},
     pin::Pin,
     sync::{Arc, Mutex, RwLock},
     task::{Context, Poll},
     time::Duration,
 };
 
+use crate::agent::response_authentication::lookup_api_boundary_nodes;
+
 const IC_STATE_ROOT_DOMAIN_SEPARATOR: &[u8; 14] = b"\x0Dic-state-root";
 
 const IC_ROOT_KEY: &[u8; 133] = b"\x30\x81\x82\x30\x1d\x06\x0d\x2b\x06\x01\x04\x01\x82\xdc\x7c\x05\x03\x01\x02\x01\x06\x0c\x2b\x06\x01\x04\x01\x82\xdc\x7c\x05\x03\x02\x01\x03\x61\x00\x81\x4c\x0e\x6e\xc7\x1f\xab\x58\x3b\x08\xbd\x81\x37\x3c\x25\x5c\x3c\x37\x1b\x2e\x84\x86\x3c\x98\xa4\xf1\xe0\x8b\x74\x23\x5d\x14\xfb\x5d\x9c\x0c\xd5\x46\xd9\x68\x5f\x91\x3a\x0c\x0b\x2c\xc5\x34\x15\x83\xbf\x4b\x43\x92\xe4\x67\xdb\x96\xd6\x5b\x9b\xb4\xcb\x71\x71\x12\xf8\x47\x2e\x0d\x5a\x4d\x14\x50\x5f\xfd\x74\x84\xb0\x12\x91\x09\x1c\x5f\x87\xb9\x88\x83\x46\x3f\x98\x09\x1a\x0b\xaa\xae";
@@ -64,122 +84,6 @@ type AgentFuture<'a, V> = Pin<Box<dyn Future<Output = Result<V, AgentError>> + S
 #[cfg(target_family = "wasm")]
 type AgentFuture<'a, V> = Pin<Box<dyn Future<Output = Result<V, AgentError>> + 'a>>;
 
-/// A facade that connects to a Replica and does requests. These requests can be of any type
-/// (does not have to be HTTP). This trait is to inverse the control from the Agent over its
-/// connection code, and to resolve any direct dependencies to tokio or HTTP code from this
-/// crate.
-///
-/// An implementation of this trait for HTTP transport is implemented using Reqwest, with the
-/// feature flag `reqwest`. This might be deprecated in the future.
-///
-/// Any error returned by these methods will bubble up to the code that called the [Agent].
-pub trait Transport: Send + Sync {
-    /// Sends an asynchronous request to a replica. The Request ID is non-mutable and
-    /// depends on the content of the envelope.
-    ///
-    /// This normally corresponds to the `/api/v2/canister/<effective_canister_id>/call` endpoint.
-    fn call(
-        &self,
-        effective_canister_id: Principal,
-        envelope: Vec<u8>,
-        request_id: RequestId,
-    ) -> AgentFuture<()>;
-
-    /// Sends a synchronous request to a replica. This call includes the body of the request message
-    /// itself (envelope).
-    ///
-    /// This normally corresponds to the `/api/v2/canister/<effective_canister_id>/read_state` endpoint.
-    fn read_state(
-        &self,
-        effective_canister_id: Principal,
-        envelope: Vec<u8>,
-    ) -> AgentFuture<Vec<u8>>;
-
-    /// Sends a synchronous request to a replica. This call includes the body of the request message
-    /// itself (envelope).
-    ///
-    /// This normally corresponds to the `/api/v2/subnet/<subnet_id>/read_state` endpoint.
-    fn read_subnet_state(&self, subnet_id: Principal, envelope: Vec<u8>) -> AgentFuture<Vec<u8>>;
-
-    /// Sends a synchronous request to a replica. This call includes the body of the request message
-    /// itself (envelope).
-    ///
-    /// This normally corresponds to the `/api/v2/canister/<effective_canister_id>/query` endpoint.
-    fn query(&self, effective_canister_id: Principal, envelope: Vec<u8>) -> AgentFuture<Vec<u8>>;
-
-    /// Sends a status request to the replica, returning whatever the replica returns.
-    /// In the current spec v2, this is a CBOR encoded status message, but we are not
-    /// making this API attach semantics to the response.
-    fn status(&self) -> AgentFuture<Vec<u8>>;
-}
-
-impl<I: Transport + ?Sized> Transport for Box<I> {
-    fn call(
-        &self,
-        effective_canister_id: Principal,
-        envelope: Vec<u8>,
-        request_id: RequestId,
-    ) -> AgentFuture<()> {
-        (**self).call(effective_canister_id, envelope, request_id)
-    }
-    fn read_state(
-        &self,
-        effective_canister_id: Principal,
-        envelope: Vec<u8>,
-    ) -> AgentFuture<Vec<u8>> {
-        (**self).read_state(effective_canister_id, envelope)
-    }
-    fn query(&self, effective_canister_id: Principal, envelope: Vec<u8>) -> AgentFuture<Vec<u8>> {
-        (**self).query(effective_canister_id, envelope)
-    }
-    fn status(&self) -> AgentFuture<Vec<u8>> {
-        (**self).status()
-    }
-    fn read_subnet_state(&self, subnet_id: Principal, envelope: Vec<u8>) -> AgentFuture<Vec<u8>> {
-        (**self).read_subnet_state(subnet_id, envelope)
-    }
-}
-impl<I: Transport + ?Sized> Transport for Arc<I> {
-    fn call(
-        &self,
-        effective_canister_id: Principal,
-        envelope: Vec<u8>,
-        request_id: RequestId,
-    ) -> AgentFuture<()> {
-        (**self).call(effective_canister_id, envelope, request_id)
-    }
-    fn read_state(
-        &self,
-        effective_canister_id: Principal,
-        envelope: Vec<u8>,
-    ) -> AgentFuture<Vec<u8>> {
-        (**self).read_state(effective_canister_id, envelope)
-    }
-    fn query(&self, effective_canister_id: Principal, envelope: Vec<u8>) -> AgentFuture<Vec<u8>> {
-        (**self).query(effective_canister_id, envelope)
-    }
-    fn status(&self) -> AgentFuture<Vec<u8>> {
-        (**self).status()
-    }
-    fn read_subnet_state(&self, subnet_id: Principal, envelope: Vec<u8>) -> AgentFuture<Vec<u8>> {
-        (**self).read_subnet_state(subnet_id, envelope)
-    }
-}
-
-/// Classification of the result of a request_status_raw (poll) call.
-#[derive(Debug)]
-pub enum PollResult {
-    /// The request has been submitted, but we do not know yet if it
-    /// has been accepted or not.
-    Submitted,
-
-    /// The request has been received and may be processing.
-    Accepted,
-
-    /// The request completed and returned some data.
-    Completed(Vec<u8>),
-}
-
 /// A low level Agent to make calls to a Replica endpoint.
 ///
 /// ```ignore
@@ -200,21 +104,16 @@ pub enum PollResult {
 /// }
 ///
 /// # fn create_identity() -> impl ic_agent::Identity {
-/// #     let rng = ring::rand::SystemRandom::new();
-/// #     let key_pair = ring::signature::Ed25519KeyPair::generate_pkcs8(&rng)
-/// #         .expect("Could not generate a key pair.");
 /// #
-/// #     ic_agent::identity::BasicIdentity::from_key_pair(
-/// #         ring::signature::Ed25519KeyPair::from_pkcs8(key_pair.as_ref())
-/// #           .expect("Could not read the key pair."),
+/// #     ic_agent::identity::BasicIdentity::from_signing_key(
+/// #         ed25519_consensus::SigningKey::new(rand::thread_rng())
 /// #     )
 /// # }
 /// #
-/// # const URL: &'static str = concat!("http://localhost:", env!("IC_REF_PORT"));
-/// #
 /// async fn create_a_canister() -> Result<Principal, Box<dyn std::error::Error>> {
+/// # let url = format!("http://localhost:{}", option_env!("IC_REF_PORT").unwrap_or("4943"));
 ///   let agent = Agent::builder()
-///     .with_url(URL)
+///     .with_url(url)
 ///     .with_identity(create_identity())
 ///     .build()?;
 ///
@@ -232,7 +131,6 @@ pub enum PollResult {
 ///   let response = agent.update(&management_canister_id, "provisional_create_canister_with_cycles")
 ///     .with_effective_canister_id(effective_canister_id)
 ///     .with_arg(Encode!(&Argument { amount: None })?)
-///     .call_and_wait()
 ///     .await?;
 ///
 ///   let result = Decode!(response.as_slice(), CreateCanisterResult)?;
@@ -248,15 +146,24 @@ pub enum PollResult {
 /// ```
 ///
 /// This agent does not understand Candid, and only acts on byte buffers.
+///
+/// Some methods return certificates. While there is a `verify_certificate` method, any certificate
+/// you receive from a method has already been verified and you do not need to manually verify it.
 #[derive(Clone)]
 pub struct Agent {
     nonce_factory: Arc<dyn NonceGenerator>,
     identity: Arc<dyn Identity>,
     ingress_expiry: Duration,
     root_key: Arc<RwLock<Vec<u8>>>,
-    transport: Arc<dyn Transport>,
+    client: Arc<dyn HttpService>,
+    route_provider: Arc<dyn RouteProvider>,
     subnet_key_cache: Arc<Mutex<SubnetCache>>,
+    concurrent_requests_semaphore: Arc<Semaphore>,
     verify_query_signatures: bool,
+    max_response_body_size: Option<usize>,
+    max_polling_time: Duration,
+    #[allow(dead_code)]
+    max_tcp_error_retries: usize,
 }
 
 impl fmt::Debug for Agent {
@@ -276,28 +183,67 @@ impl Agent {
 
     /// Create an instance of an [`Agent`].
     pub fn new(config: agent_config::AgentConfig) -> Result<Agent, AgentError> {
+        let client = config.http_service.unwrap_or_else(|| {
+            Arc::new(Retry429Logic {
+                client: config.client.unwrap_or_else(|| {
+                    #[cfg(not(target_family = "wasm"))]
+                    {
+                        Client::builder()
+                            .use_rustls_tls()
+                            .timeout(Duration::from_secs(360))
+                            .build()
+                            .expect("Could not create HTTP client.")
+                    }
+                    #[cfg(all(target_family = "wasm", feature = "wasm-bindgen"))]
+                    {
+                        Client::new()
+                    }
+                }),
+            })
+        });
         Ok(Agent {
             nonce_factory: config.nonce_factory,
             identity: config.identity,
-            ingress_expiry: config.ingress_expiry.unwrap_or(DEFAULT_INGRESS_EXPIRY),
+            ingress_expiry: config.ingress_expiry,
             root_key: Arc::new(RwLock::new(IC_ROOT_KEY.to_vec())),
-            transport: config
-                .transport
-                .ok_or_else(AgentError::MissingReplicaTransport)?,
+            client: client.clone(),
+            route_provider: if let Some(route_provider) = config.route_provider {
+                route_provider
+            } else if let Some(url) = config.url {
+                if config.background_dynamic_routing {
+                    assert!(
+                        url.scheme() == "https" && url.path() == "/" && url.port().is_none() && url.domain().is_some(),
+                        "in dynamic routing mode, URL must be in the exact form https://domain with no path, port, IP, or non-HTTPS scheme"
+                    );
+                    let seeds = vec![Node::new(url.domain().unwrap()).unwrap()];
+                    UrlUntilReady::new(url, async move {
+                        DynamicRouteProviderBuilder::new(
+                            LatencyRoutingSnapshot::new(),
+                            seeds,
+                            client,
+                        )
+                        .build()
+                        .await
+                    }) as Arc<dyn RouteProvider>
+                } else {
+                    Arc::new(url)
+                }
+            } else {
+                panic!("either route_provider or url must be specified");
+            },
             subnet_key_cache: Arc::new(Mutex::new(SubnetCache::new())),
             verify_query_signatures: config.verify_query_signatures,
+            concurrent_requests_semaphore: Arc::new(Semaphore::new(config.max_concurrent_requests)),
+            max_response_body_size: config.max_response_body_size,
+            max_tcp_error_retries: config.max_tcp_error_retries,
+            max_polling_time: config.max_polling_time,
         })
     }
 
-    /// Set the transport of the [`Agent`].
-    pub fn set_transport<F: 'static + Transport>(&mut self, transport: F) {
-        self.transport = Arc::new(transport);
-    }
-
     /// Set the identity provider for signing messages.
     ///
     /// NOTE: if you change the identity while having update calls in
-    /// flight, you will not be able to [Agent::poll] the status of these
+    /// flight, you will not be able to [`Agent::request_status_raw`] the status of these
     /// messages.
     pub fn set_identity<I>(&mut self, identity: I)
     where
@@ -308,7 +254,7 @@ impl Agent {
     /// Set the arc identity provider for signing messages.
     ///
     /// NOTE: if you change the identity while having update calls in
-    /// flight, you will not be able to [Agent::poll] the status of these
+    /// flight, you will not be able to [`Agent::request_status_raw`] the status of these
     /// messages.
     pub fn set_arc_identity(&mut self, identity: Arc<dyn Identity>) {
         self.identity = identity;
@@ -328,9 +274,8 @@ impl Agent {
             return Ok(());
         }
         let status = self.status().await?;
-        let root_key = match status.root_key {
-            Some(key) => key,
-            None => return Err(AgentError::NoRootKeyInStatus(status)),
+        let Some(root_key) = status.root_key else {
+            return Err(AgentError::NoRootKeyInStatus(status));
         };
         self.set_root_key(root_key);
         Ok(())
@@ -355,7 +300,7 @@ impl Agent {
         if self.ingress_expiry.as_secs() > 90 {
             rounded = rounded.replace_second(0).unwrap();
         }
-        rounded.unix_timestamp_nanos() as u64
+        rounded.unix_timestamp_nanos().try_into().unwrap()
     }
 
     /// Return the principal of the identity.
@@ -371,10 +316,15 @@ impl Agent {
     where
         A: serde::de::DeserializeOwned,
     {
+        let _permit = self.concurrent_requests_semaphore.acquire().await;
         let bytes = self
-            .transport
-            .query(effective_canister_id, serialized_bytes)
-            .await?;
+            .execute(
+                Method::POST,
+                &format!("api/v2/canister/{}/query", effective_canister_id.to_text()),
+                Some(serialized_bytes),
+            )
+            .await?
+            .1;
         serde_cbor::from_slice(&bytes).map_err(AgentError::InvalidCborData)
     }
 
@@ -386,10 +336,15 @@ impl Agent {
     where
         A: serde::de::DeserializeOwned,
     {
+        let _permit = self.concurrent_requests_semaphore.acquire().await;
+        let endpoint = format!(
+            "api/v2/canister/{}/read_state",
+            effective_canister_id.to_text()
+        );
         let bytes = self
-            .transport
-            .read_state(effective_canister_id, serialized_bytes)
-            .await?;
+            .execute(Method::POST, &endpoint, Some(serialized_bytes))
+            .await?
+            .1;
         serde_cbor::from_slice(&bytes).map_err(AgentError::InvalidCborData)
     }
 
@@ -401,27 +356,36 @@ impl Agent {
     where
         A: serde::de::DeserializeOwned,
     {
+        let _permit = self.concurrent_requests_semaphore.acquire().await;
+        let endpoint = format!("api/v2/subnet/{}/read_state", subnet_id.to_text());
         let bytes = self
-            .transport
-            .read_subnet_state(subnet_id, serialized_bytes)
-            .await?;
+            .execute(Method::POST, &endpoint, Some(serialized_bytes))
+            .await?
+            .1;
         serde_cbor::from_slice(&bytes).map_err(AgentError::InvalidCborData)
     }
 
     async fn call_endpoint(
         &self,
         effective_canister_id: Principal,
-        request_id: RequestId,
         serialized_bytes: Vec<u8>,
-    ) -> Result<RequestId, AgentError> {
-        self.transport
-            .call(effective_canister_id, serialized_bytes, request_id)
+    ) -> Result<TransportCallResponse, AgentError> {
+        let _permit = self.concurrent_requests_semaphore.acquire().await;
+        let endpoint = format!("api/v3/canister/{}/call", effective_canister_id.to_text());
+        let (status_code, response_body) = self
+            .execute(Method::POST, &endpoint, Some(serialized_bytes))
             .await?;
-        Ok(request_id)
+
+        if status_code == StatusCode::ACCEPTED {
+            return Ok(TransportCallResponse::Accepted);
+        }
+
+        serde_cbor::from_slice(&response_body).map_err(AgentError::InvalidCborData)
     }
 
     /// The simplest way to do a query call; sends a byte array and will return a byte vector.
     /// The encoding is left as an exercise to the user.
+    #[allow(clippy::too_many_arguments)]
     async fn query_raw(
         &self,
         canister_id: Principal,
@@ -430,6 +394,7 @@ impl Agent {
         arg: Vec<u8>,
         ingress_expiry_datetime: Option<u64>,
         use_nonce: bool,
+        explicit_verify_query_signatures: Option<bool>,
     ) -> Result<Vec<u8>, AgentError> {
         let content = self.query_content(
             canister_id,
@@ -438,11 +403,12 @@ impl Agent {
             ingress_expiry_datetime,
             use_nonce,
         )?;
-        let serialized_bytes = sign_envelope(&content, self.identity.clone())?;
+        let serialized_bytes = sign_envelope(&content, self.identity.clone()).await?;
         self.query_inner(
             effective_canister_id,
             serialized_bytes,
             content.to_request_id(),
+            explicit_verify_query_signatures,
         )
         .await
     }
@@ -461,11 +427,12 @@ impl Agent {
             effective_canister_id,
             signed_query,
             envelope.content.to_request_id(),
+            None,
         )
         .await
     }
 
-    /// Helper function for performing both the query call and possibly a read_state to check the subnet node keys.
+    /// Helper function for performing both the query call and possibly a `read_state` to check the subnet node keys.
     ///
     /// This should be used instead of `query_endpoint`. No validation is performed on `signed_query`.
     async fn query_inner(
@@ -473,8 +440,9 @@ impl Agent {
         effective_canister_id: Principal,
         signed_query: Vec<u8>,
         request_id: RequestId,
+        explicit_verify_query_signatures: Option<bool>,
     ) -> Result<Vec<u8>, AgentError> {
-        let response = if self.verify_query_signatures {
+        let response = if explicit_verify_query_signatures.unwrap_or(self.verify_query_signatures) {
             let (response, mut subnet) = futures_util::try_join!(
                 self.query_endpoint::<QueryResponse>(effective_canister_id, signed_query),
                 self.get_subnet_by_canister(&effective_canister_id)
@@ -489,7 +457,7 @@ impl Agent {
             }
             for signature in response.signatures() {
                 if OffsetDateTime::now_utc()
-                    - OffsetDateTime::from_unix_timestamp_nanos(signature.timestamp as _).unwrap()
+                    - OffsetDateTime::from_unix_timestamp_nanos(signature.timestamp.into()).unwrap()
                     > self.ingress_expiry
                 {
                     return Err(AgentError::CertificateOutdated(self.ingress_expiry));
@@ -549,7 +517,7 @@ impl Agent {
 
         match response {
             QueryResponse::Replied { reply, .. } => Ok(reply.arg),
-            QueryResponse::Rejected { reject, .. } => Err(AgentError::ReplicaError(reject)),
+            QueryResponse::Rejected { reject, .. } => Err(AgentError::UncertifiedReject(reject)),
         }
     }
 
@@ -571,8 +539,7 @@ impl Agent {
         })
     }
 
-    /// The simplest way to do an update call; sends a byte array and will return a RequestId.
-    /// The RequestId should then be used for request_status (most likely in a loop).
+    /// The simplest way to do an update call; sends a byte array and will return a response, [`CallResponse`], from the replica.
     async fn update_raw(
         &self,
         canister_id: Principal,
@@ -580,7 +547,7 @@ impl Agent {
         method_name: String,
         arg: Vec<u8>,
         ingress_expiry_datetime: Option<u64>,
-    ) -> Result<RequestId, AgentError> {
+    ) -> Result<CallResponse<(Vec<u8>, Certificate)>, AgentError> {
         let nonce = self.nonce_factory.generate();
         let content = self.update_content(
             canister_id,
@@ -590,25 +557,74 @@ impl Agent {
             nonce,
         )?;
         let request_id = to_request_id(&content)?;
-        let serialized_bytes = sign_envelope(&content, self.identity.clone())?;
+        let serialized_bytes = sign_envelope(&content, self.identity.clone()).await?;
 
-        self.call_endpoint(effective_canister_id, request_id, serialized_bytes)
-            .await
+        let response_body = self
+            .call_endpoint(effective_canister_id, serialized_bytes)
+            .await?;
+
+        match response_body {
+            TransportCallResponse::Replied { certificate } => {
+                let certificate =
+                    serde_cbor::from_slice(&certificate).map_err(AgentError::InvalidCborData)?;
+
+                self.verify(&certificate, effective_canister_id)?;
+                let status = lookup_request_status(&certificate, &request_id)?;
+
+                match status {
+                    RequestStatusResponse::Replied(reply) => {
+                        Ok(CallResponse::Response((reply.arg, certificate)))
+                    }
+                    RequestStatusResponse::Rejected(reject_response) => {
+                        Err(AgentError::CertifiedReject(reject_response))?
+                    }
+                    _ => Ok(CallResponse::Poll(request_id)),
+                }
+            }
+            TransportCallResponse::Accepted => Ok(CallResponse::Poll(request_id)),
+            TransportCallResponse::NonReplicatedRejection(reject_response) => {
+                Err(AgentError::UncertifiedReject(reject_response))
+            }
+        }
     }
 
-    /// Send the signed update to the network. Will return a [`RequestId`].
+    /// Send the signed update to the network. Will return a [`CallResponse<Vec<u8>>`].
     /// The bytes will be checked to verify that it is a valid update.
     /// If you want to inspect the fields of the update, use [`signed_update_inspect`] before calling this method.
     pub async fn update_signed(
         &self,
         effective_canister_id: Principal,
         signed_update: Vec<u8>,
-    ) -> Result<RequestId, AgentError> {
+    ) -> Result<CallResponse<Vec<u8>>, AgentError> {
         let envelope: Envelope =
             serde_cbor::from_slice(&signed_update).map_err(AgentError::InvalidCborData)?;
         let request_id = to_request_id(&envelope.content)?;
-        self.call_endpoint(effective_canister_id, request_id, signed_update)
-            .await
+
+        let response_body = self
+            .call_endpoint(effective_canister_id, signed_update)
+            .await?;
+
+        match response_body {
+            TransportCallResponse::Replied { certificate } => {
+                let certificate =
+                    serde_cbor::from_slice(&certificate).map_err(AgentError::InvalidCborData)?;
+
+                self.verify(&certificate, effective_canister_id)?;
+                let status = lookup_request_status(&certificate, &request_id)?;
+
+                match status {
+                    RequestStatusResponse::Replied(reply) => Ok(CallResponse::Response(reply.arg)),
+                    RequestStatusResponse::Rejected(reject_response) => {
+                        Err(AgentError::CertifiedReject(reject_response))?
+                    }
+                    _ => Ok(CallResponse::Poll(request_id)),
+                }
+            }
+            TransportCallResponse::Accepted => Ok(CallResponse::Poll(request_id)),
+            TransportCallResponse::NonReplicatedRejection(reject_response) => {
+                Err(AgentError::UncertifiedReject(reject_response))
+            }
+        }
     }
 
     fn update_content(
@@ -629,62 +645,34 @@ impl Agent {
         })
     }
 
-    /// Call request_status on the RequestId once and classify the result
-    pub async fn poll(
-        &self,
-        request_id: &RequestId,
-        effective_canister_id: Principal,
-    ) -> Result<PollResult, AgentError> {
-        match self
-            .request_status_raw(request_id, effective_canister_id)
-            .await?
-        {
-            RequestStatusResponse::Unknown => Ok(PollResult::Submitted),
-
-            RequestStatusResponse::Received | RequestStatusResponse::Processing => {
-                Ok(PollResult::Accepted)
-            }
-
-            RequestStatusResponse::Replied(ReplyResponse { arg, .. }) => {
-                Ok(PollResult::Completed(arg))
-            }
-
-            RequestStatusResponse::Rejected(response) => Err(AgentError::ReplicaError(response)),
-
-            RequestStatusResponse::Done => Err(AgentError::RequestStatusDoneNoReply(String::from(
-                *request_id,
-            ))),
-        }
-    }
-
-    fn get_retry_policy() -> ExponentialBackoff<SystemClock> {
+    fn get_retry_policy(&self) -> ExponentialBackoff<SystemClock> {
         ExponentialBackoffBuilder::new()
             .with_initial_interval(Duration::from_millis(500))
             .with_max_interval(Duration::from_secs(1))
             .with_multiplier(1.4)
-            .with_max_elapsed_time(Some(Duration::from_secs(60 * 5)))
+            .with_max_elapsed_time(Some(self.max_polling_time))
             .build()
     }
 
-    /// Wait for request_status to return a Replied response and return the arg.
+    /// Wait for `request_status` to return a Replied response and return the arg.
     pub async fn wait_signed(
         &self,
         request_id: &RequestId,
         effective_canister_id: Principal,
         signed_request_status: Vec<u8>,
-    ) -> Result<Vec<u8>, AgentError> {
-        let mut retry_policy = Self::get_retry_policy();
+    ) -> Result<(Vec<u8>, Certificate), AgentError> {
+        let mut retry_policy = self.get_retry_policy();
 
         let mut request_accepted = false;
+        let (resp, cert) = self
+            .request_status_signed(
+                request_id,
+                effective_canister_id,
+                signed_request_status.clone(),
+            )
+            .await?;
         loop {
-            match self
-                .request_status_signed(
-                    request_id,
-                    effective_canister_id,
-                    signed_request_status.clone(),
-                )
-                .await?
-            {
+            match resp {
                 RequestStatusResponse::Unknown => {}
 
                 RequestStatusResponse::Received | RequestStatusResponse::Processing => {
@@ -694,10 +682,12 @@ impl Agent {
                     }
                 }
 
-                RequestStatusResponse::Replied(ReplyResponse { arg, .. }) => return Ok(arg),
+                RequestStatusResponse::Replied(ReplyResponse { arg, .. }) => {
+                    return Ok((arg, cert))
+                }
 
                 RequestStatusResponse::Rejected(response) => {
-                    return Err(AgentError::ReplicaError(response))
+                    return Err(AgentError::CertifiedReject(response))
                 }
 
                 RequestStatusResponse::Done => {
@@ -708,48 +698,33 @@ impl Agent {
             };
 
             match retry_policy.next_backoff() {
-                #[cfg(not(target_family = "wasm"))]
-                Some(duration) => tokio::time::sleep(duration).await,
-
-                #[cfg(all(target_family = "wasm", feature = "wasm-bindgen"))]
-                Some(duration) => {
-                    wasm_bindgen_futures::JsFuture::from(js_sys::Promise::new(&mut |rs, rj| {
-                        if let Err(e) = web_sys::window()
-                            .expect("global window unavailable")
-                            .set_timeout_with_callback_and_timeout_and_arguments_0(
-                                &rs,
-                                duration.as_millis() as _,
-                            )
-                        {
-                            use wasm_bindgen::UnwrapThrowExt;
-                            rj.call1(&rj, &e).unwrap_throw();
-                        }
-                    }))
-                    .await
-                    .expect("unable to setTimeout");
-                }
+                Some(duration) => crate::util::sleep(duration).await,
 
                 None => return Err(AgentError::TimeoutWaitingForResponse()),
             }
         }
     }
 
-    /// Call request_status on the RequestId in a loop and return the response as a byte vector.
+    /// Call `request_status` on the `RequestId` in a loop and return the response as a byte vector.
     pub async fn wait(
         &self,
-        request_id: RequestId,
+        request_id: &RequestId,
         effective_canister_id: Principal,
-    ) -> Result<Vec<u8>, AgentError> {
-        let mut retry_policy = Self::get_retry_policy();
+    ) -> Result<(Vec<u8>, Certificate), AgentError> {
+        let mut retry_policy = self.get_retry_policy();
 
         let mut request_accepted = false;
         loop {
-            match self.poll(&request_id, effective_canister_id).await? {
-                PollResult::Submitted => {}
-                PollResult::Accepted => {
+            let (resp, cert) = self
+                .request_status_raw(request_id, effective_canister_id)
+                .await?;
+            match resp {
+                RequestStatusResponse::Unknown => {}
+
+                RequestStatusResponse::Received | RequestStatusResponse::Processing => {
                     if !request_accepted {
                         // The system will return RequestStatusResponse::Unknown
-                        // (PollResult::Submitted) until the request is accepted
+                        // until the request is accepted
                         // and we generally cannot know how long that will take.
                         // State transitions between Received and Processing may be
                         // instantaneous. Therefore, once we know the request is accepted,
@@ -759,29 +734,25 @@ impl Agent {
                         request_accepted = true;
                     }
                 }
-                PollResult::Completed(result) => return Ok(result),
+
+                RequestStatusResponse::Replied(ReplyResponse { arg, .. }) => {
+                    return Ok((arg, cert))
+                }
+
+                RequestStatusResponse::Rejected(response) => {
+                    return Err(AgentError::CertifiedReject(response))
+                }
+
+                RequestStatusResponse::Done => {
+                    return Err(AgentError::RequestStatusDoneNoReply(String::from(
+                        *request_id,
+                    )))
+                }
             };
 
             match retry_policy.next_backoff() {
-                #[cfg(not(target_family = "wasm"))]
-                Some(duration) => tokio::time::sleep(duration).await,
-                #[cfg(all(target_family = "wasm", feature = "wasm-bindgen"))]
-                Some(duration) => {
-                    wasm_bindgen_futures::JsFuture::from(js_sys::Promise::new(&mut |rs, rj| {
-                        if let Err(e) = web_sys::window()
-                            .expect("global window unavailable")
-                            .set_timeout_with_callback_and_timeout_and_arguments_0(
-                                &rs,
-                                duration.as_millis() as _,
-                            )
-                        {
-                            use wasm_bindgen::UnwrapThrowExt;
-                            rj.call1(&rj, &e).unwrap_throw();
-                        }
-                    }))
-                    .await
-                    .expect("unable to setTimeout");
-                }
+                Some(duration) => crate::util::sleep(duration).await,
+
                 None => return Err(AgentError::TimeoutWaitingForResponse()),
             }
         }
@@ -795,7 +766,7 @@ impl Agent {
         effective_canister_id: Principal,
     ) -> Result<Certificate, AgentError> {
         let content = self.read_state_content(paths)?;
-        let serialized_bytes = sign_envelope(&content, self.identity.clone())?;
+        let serialized_bytes = sign_envelope(&content, self.identity.clone()).await?;
 
         let read_state_response: ReadStateResponse = self
             .read_state_endpoint(effective_canister_id, serialized_bytes)
@@ -814,7 +785,7 @@ impl Agent {
         subnet_id: Principal,
     ) -> Result<Certificate, AgentError> {
         let content = self.read_state_content(paths)?;
-        let serialized_bytes = sign_envelope(&content, self.identity.clone())?;
+        let serialized_bytes = sign_envelope(&content, self.identity.clone()).await?;
 
         let read_state_response: ReadStateResponse = self
             .read_subnet_state_endpoint(subnet_id, serialized_bytes)
@@ -839,6 +810,16 @@ impl Agent {
         &self,
         cert: &Certificate,
         effective_canister_id: Principal,
+    ) -> Result<(), AgentError> {
+        self.verify_cert(cert, effective_canister_id)?;
+        self.verify_cert_timestamp(cert)?;
+        Ok(())
+    }
+
+    fn verify_cert(
+        &self,
+        cert: &Certificate,
+        effective_canister_id: Principal,
     ) -> Result<(), AgentError> {
         let sig = &cert.signature;
 
@@ -852,7 +833,6 @@ impl Agent {
 
         ic_verify_bls_signature::verify_bls_signature(sig, &msg, &key)
             .map_err(|_| AgentError::CertificateVerificationFailed())?;
-
         Ok(())
     }
 
@@ -862,6 +842,16 @@ impl Agent {
         &self,
         cert: &Certificate,
         subnet_id: Principal,
+    ) -> Result<(), AgentError> {
+        self.verify_cert_for_subnet(cert, subnet_id)?;
+        self.verify_cert_timestamp(cert)?;
+        Ok(())
+    }
+
+    fn verify_cert_for_subnet(
+        &self,
+        cert: &Certificate,
+        subnet_id: Principal,
     ) -> Result<(), AgentError> {
         let sig = &cert.signature;
 
@@ -874,7 +864,21 @@ impl Agent {
         let key = extract_der(der_key)?;
 
         ic_verify_bls_signature::verify_bls_signature(sig, &msg, &key)
-            .map_err(|_| AgentError::CertificateVerificationFailed())
+            .map_err(|_| AgentError::CertificateVerificationFailed())?;
+        Ok(())
+    }
+
+    fn verify_cert_timestamp(&self, cert: &Certificate) -> Result<(), AgentError> {
+        let time = lookup_time(cert)?;
+        if (OffsetDateTime::now_utc()
+            - OffsetDateTime::from_unix_timestamp_nanos(time.into()).unwrap())
+        .abs()
+            > self.ingress_expiry
+        {
+            Err(AgentError::CertificateOutdated(self.ingress_expiry))
+        } else {
+            Ok(())
+        }
     }
 
     fn check_delegation(
@@ -890,7 +894,7 @@ impl Agent {
                 if cert.delegation.is_some() {
                     return Err(AgentError::CertificateHasTooManyDelegations);
                 }
-                self.verify(&cert, effective_canister_id)?;
+                self.verify_cert(&cert, effective_canister_id)?;
                 let canister_range_lookup = [
                     "subnet".as_bytes(),
                     delegation.subnet_id.as_ref(),
@@ -909,7 +913,7 @@ impl Agent {
                     delegation.subnet_id.as_ref(),
                     "public_key".as_bytes(),
                 ];
-                lookup_value(&cert.tree, public_key_path).map(|pk| pk.to_vec())
+                lookup_value(&cert.tree, public_key_path).map(<[u8]>::to_vec)
             }
         }
     }
@@ -927,7 +931,7 @@ impl Agent {
                 if cert.delegation.is_some() {
                     return Err(AgentError::CertificateHasTooManyDelegations);
                 }
-                self.verify_for_subnet(&cert, subnet_id)?;
+                self.verify_cert_for_subnet(&cert, subnet_id)?;
                 let public_key_path = [
                     "subnet".as_bytes(),
                     delegation.subnet_id.as_ref(),
@@ -996,24 +1000,24 @@ impl Agent {
         &self,
         request_id: &RequestId,
         effective_canister_id: Principal,
-    ) -> Result<RequestStatusResponse, AgentError> {
+    ) -> Result<(RequestStatusResponse, Certificate), AgentError> {
         let paths: Vec<Vec<Label>> =
             vec![vec!["request_status".into(), request_id.to_vec().into()]];
 
         let cert = self.read_state_raw(paths, effective_canister_id).await?;
 
-        lookup_request_status(cert, request_id)
+        Ok((lookup_request_status(&cert, request_id)?, cert))
     }
 
-    /// Send the signed request_status to the network. Will return [`RequestStatusResponse`].
-    /// The bytes will be checked to verify that it is a valid request_status.
-    /// If you want to inspect the fields of the request_status, use [`signed_request_status_inspect`] before calling this method.
+    /// Send the signed `request_status` to the network. Will return [`RequestStatusResponse`].
+    /// The bytes will be checked to verify that it is a valid `request_status`.
+    /// If you want to inspect the fields of the `request_status`, use [`signed_request_status_inspect`] before calling this method.
     pub async fn request_status_signed(
         &self,
         request_id: &RequestId,
         effective_canister_id: Principal,
         signed_request_status: Vec<u8>,
-    ) -> Result<RequestStatusResponse, AgentError> {
+    ) -> Result<(RequestStatusResponse, Certificate), AgentError> {
         let _envelope: Envelope =
             serde_cbor::from_slice(&signed_request_status).map_err(AgentError::InvalidCborData)?;
         let read_state_response: ReadStateResponse = self
@@ -1023,10 +1027,10 @@ impl Agent {
         let cert: Certificate = serde_cbor::from_slice(&read_state_response.certificate)
             .map_err(AgentError::InvalidCborData)?;
         self.verify(&cert, effective_canister_id)?;
-        lookup_request_status(cert, request_id)
+        Ok((lookup_request_status(&cert, request_id)?, cert))
     }
 
-    /// Returns an UpdateBuilder enabling the construction of an update call without
+    /// Returns an `UpdateBuilder` enabling the construction of an update call without
     /// passing all arguments.
     pub fn update<S: Into<String>>(
         &self,
@@ -1038,7 +1042,8 @@ impl Agent {
 
     /// Calls and returns the information returned by the status endpoint of a replica.
     pub async fn status(&self) -> Result<Status, AgentError> {
-        let bytes = self.transport.status().await?;
+        let endpoint = "api/v2/status";
+        let bytes = self.execute(Method::GET, endpoint, None).await?.1;
 
         let cbor: serde_cbor::Value =
             serde_cbor::from_slice(&bytes).map_err(AgentError::InvalidCborData)?;
@@ -1046,15 +1051,15 @@ impl Agent {
         Status::try_from(&cbor).map_err(|_| AgentError::InvalidReplicaStatus)
     }
 
-    /// Returns a QueryBuilder enabling the construction of a query call without
+    /// Returns a `QueryBuilder` enabling the construction of a query call without
     /// passing all arguments.
     pub fn query<S: Into<String>>(&self, canister_id: &Principal, method_name: S) -> QueryBuilder {
         QueryBuilder::new(self, *canister_id, method_name.into())
     }
 
-    /// Sign a request_status call. This will return a [`signed::SignedRequestStatus`]
-    /// which contains all fields of the request_status and the signed request_status in CBOR encoding
-    pub fn sign_request_status(
+    /// Sign a `request_status` call. This will return a [`signed::SignedRequestStatus`]
+    /// which contains all fields of the `request_status` and the signed `request_status` in CBOR encoding
+    pub async fn sign_request_status(
         &self,
         effective_canister_id: Principal,
         request_id: RequestId,
@@ -1062,7 +1067,8 @@ impl Agent {
         let paths: Vec<Vec<Label>> =
             vec![vec!["request_status".into(), request_id.to_vec().into()]];
         let read_state_content = self.read_state_content(paths)?;
-        let signed_request_status = sign_envelope(&read_state_content, self.identity.clone())?;
+        let signed_request_status =
+            sign_envelope(&read_state_content, self.identity.clone()).await?;
         let ingress_expiry = read_state_content.ingress_expiry();
         let sender = *read_state_content.sender();
         Ok(SignedRequestStatus {
@@ -1090,6 +1096,28 @@ impl Agent {
         }
     }
 
+    /// Retrieve all existing API boundary nodes from the state tree via endpoint `/api/v2/canister/<effective_canister_id>/read_state`
+    pub async fn fetch_api_boundary_nodes_by_canister_id(
+        &self,
+        canister_id: Principal,
+    ) -> Result<Vec<ApiBoundaryNode>, AgentError> {
+        let paths = vec![vec!["api_boundary_nodes".into()]];
+        let certificate = self.read_state_raw(paths, canister_id).await?;
+        let api_boundary_nodes = lookup_api_boundary_nodes(certificate)?;
+        Ok(api_boundary_nodes)
+    }
+
+    /// Retrieve all existing API boundary nodes from the state tree via endpoint `/api/v2/subnet/<subnet_id>/read_state`
+    pub async fn fetch_api_boundary_nodes_by_subnet_id(
+        &self,
+        subnet_id: Principal,
+    ) -> Result<Vec<ApiBoundaryNode>, AgentError> {
+        let paths = vec![vec!["api_boundary_nodes".into()]];
+        let certificate = self.read_subnet_state_raw(paths, subnet_id).await?;
+        let api_boundary_nodes = lookup_api_boundary_nodes(certificate)?;
+        Ok(api_boundary_nodes)
+    }
+
     async fn fetch_subnet_by_canister(
         &self,
         canister: &Principal,
@@ -1097,26 +1125,104 @@ impl Agent {
         let cert = self
             .read_state_raw(vec![vec!["subnet".into()]], *canister)
             .await?;
-        let time = leb128::read::unsigned(&mut lookup_value(&cert.tree, [b"time".as_ref()])?)?;
-        if (OffsetDateTime::now_utc()
-            - OffsetDateTime::from_unix_timestamp_nanos(time as _).unwrap())
-            > self.ingress_expiry
+
+        let (subnet_id, subnet) = lookup_subnet(&cert, &self.root_key.read().unwrap())?;
+        let subnet = Arc::new(subnet);
+        self.subnet_key_cache
+            .lock()
+            .unwrap()
+            .insert_subnet(subnet_id, subnet.clone());
+        Ok(subnet)
+    }
+
+    async fn request(
+        &self,
+        method: Method,
+        endpoint: &str,
+        body: Option<Vec<u8>>,
+    ) -> Result<(StatusCode, HeaderMap, Vec<u8>), AgentError> {
+        let create_request_with_generated_url = || -> Result<Request, AgentError> {
+            let url = self.route_provider.route()?.join(endpoint)?;
+            let mut http_request = Request::new(method.clone(), url);
+            http_request
+                .headers_mut()
+                .insert(CONTENT_TYPE, "application/cbor".parse().unwrap());
+            *http_request.body_mut() = body.clone().map(Body::from);
+            Ok(http_request)
+        };
+
+        let response = self
+            .client
+            .call(
+                &create_request_with_generated_url,
+                self.max_tcp_error_retries,
+            )
+            .await?;
+
+        let http_status = response.status();
+        let response_headers = response.headers().clone();
+
+        // Size Check (Content-Length)
+        if matches!(self
+            .max_response_body_size
+            .zip(response.content_length()), Some((size_limit, content_length)) if content_length > size_limit as u64)
         {
-            Err(AgentError::CertificateOutdated(self.ingress_expiry))
+            return Err(AgentError::ResponseSizeExceededLimit());
+        }
+
+        let mut body: Vec<u8> = response
+            .content_length()
+            .map_or_else(Vec::new, |n| Vec::with_capacity(n as usize));
+
+        let mut stream = response.bytes_stream();
+
+        while let Some(chunk) = stream.next().await {
+            let chunk = chunk?;
+
+            // Size Check (Body Size)
+            if matches!(self
+                .max_response_body_size, Some(size_limit) if body.len() + chunk.len() > size_limit)
+            {
+                return Err(AgentError::ResponseSizeExceededLimit());
+            }
+
+            body.extend_from_slice(chunk.as_ref());
+        }
+
+        Ok((http_status, response_headers, body))
+    }
+
+    async fn execute(
+        &self,
+        method: Method,
+        endpoint: &str,
+        body: Option<Vec<u8>>,
+    ) -> Result<(StatusCode, Vec<u8>), AgentError> {
+        let request_result = self.request(method.clone(), endpoint, body.clone()).await?;
+
+        let status = request_result.0;
+        let headers = request_result.1;
+        let body = request_result.2;
+
+        if status.is_client_error() || status.is_server_error() {
+            Err(AgentError::HttpError(HttpErrorPayload {
+                status: status.into(),
+                content_type: headers
+                    .get(CONTENT_TYPE)
+                    .and_then(|value| value.to_str().ok())
+                    .map(str::to_string),
+                content: body,
+            }))
+        } else if !(status == StatusCode::OK || status == StatusCode::ACCEPTED) {
+            Err(AgentError::InvalidHttpResponse(format!(
+                "Expected `200`, `202`, 4xx`, or `5xx` HTTP status code. Got: {status}",
+            )))
         } else {
-            let (subnet_id, subnet) = lookup_subnet(&cert, &self.root_key.read().unwrap())?;
-            let subnet = Arc::new(subnet);
-            self.subnet_key_cache
-                .lock()
-                .unwrap()
-                .insert_subnet(subnet_id, subnet.clone());
-            Ok(subnet)
+            Ok((status, body))
         }
     }
 }
 
-const DEFAULT_INGRESS_EXPIRY: Duration = Duration::from_secs(240);
-
 // Checks if a principal is contained within a list of principal ranges
 // A range is a tuple: (low: Principal, high: Principal), as described here: https://internetcomputer.org/docs/current/references/ic-interface-spec#state-tree-subnet
 fn principal_is_within_ranges(principal: &Principal, ranges: &[(Principal, Principal)]) -> bool {
@@ -1125,11 +1231,14 @@ fn principal_is_within_ranges(principal: &Principal, ranges: &[(Principal, Princ
         .any(|r| principal >= &r.0 && principal <= &r.1)
 }
 
-fn sign_envelope(
+async fn sign_envelope(
     content: &EnvelopeContent,
     identity: Arc<dyn Identity>,
 ) -> Result<Vec<u8>, AgentError> {
-    let signature = identity.sign(content).map_err(AgentError::SigningError)?;
+    let signature = identity
+        .sign(content)
+        .await
+        .map_err(AgentError::SigningError)?;
 
     let envelope = Envelope {
         content: Cow::Borrowed(content),
@@ -1198,8 +1307,8 @@ pub fn signed_query_inspect(
             if arg != *arg_cbor {
                 return Err(AgentError::CallDataMismatch {
                     field: "arg".to_string(),
-                    value_arg: format!("{:?}", arg),
-                    value_cbor: format!("{:?}", arg_cbor),
+                    value_arg: format!("{arg:?}"),
+                    value_cbor: format!("{arg_cbor:?}"),
                 });
             }
         }
@@ -1273,8 +1382,8 @@ pub fn signed_update_inspect(
             if arg != *arg_cbor {
                 return Err(AgentError::CallDataMismatch {
                     field: "arg".to_string(),
-                    value_arg: format!("{:?}", arg),
-                    value_cbor: format!("{:?}", arg_cbor),
+                    value_arg: format!("{arg:?}"),
+                    value_cbor: format!("{arg_cbor:?}"),
                 });
             }
         }
@@ -1296,8 +1405,8 @@ pub fn signed_update_inspect(
     Ok(())
 }
 
-/// Inspect the bytes to be sent as a request_status
-/// Return Ok only when the bytes can be deserialized as a request_status and all fields match with the arguments
+/// Inspect the bytes to be sent as a `request_status`
+/// Return Ok only when the bytes can be deserialized as a `request_status` and all fields match with the arguments
 pub fn signed_request_status_inspect(
     sender: Principal,
     request_id: &RequestId,
@@ -1331,8 +1440,8 @@ pub fn signed_request_status_inspect(
             if paths != *paths_cbor {
                 return Err(AgentError::CallDataMismatch {
                     field: "paths".to_string(),
-                    value_arg: format!("{:?}", paths),
-                    value_cbor: format!("{:?}", paths_cbor),
+                    value_arg: format!("{paths:?}"),
+                    value_cbor: format!("{paths_cbor:?}"),
                 });
             }
         }
@@ -1422,7 +1531,18 @@ pub(crate) struct Subnet {
     canister_ranges: RangeInclusiveSet<Principal, PrincipalStep>,
 }
 
-/// A Query Request Builder.
+/// API boundary node, which routes /api calls to IC replica nodes.
+#[derive(Debug, Clone)]
+pub struct ApiBoundaryNode {
+    /// Domain name
+    pub domain: String,
+    /// IPv6 address in the hexadecimal notation with colons.
+    pub ipv6_address: String,
+    /// IPv4 address in the dotted-decimal notation.
+    pub ipv4_address: Option<String>,
+}
+
+/// A query request builder.
 ///
 /// This makes it easier to do query calls without actually passing all arguments.
 #[derive(Debug, Clone)]
@@ -1469,13 +1589,13 @@ impl<'agent> QueryBuilder<'agent> {
         self
     }
 
-    /// Sets ingress_expiry_datetime to the provided timestamp, at nanosecond precision.
+    /// Sets `ingress_expiry_datetime` to the provided timestamp, at nanosecond precision.
     pub fn expire_at(mut self, time: impl Into<OffsetDateTime>) -> Self {
         self.ingress_expiry_datetime = Some(time.into().unix_timestamp_nanos() as u64);
         self
     }
 
-    /// Sets ingress_expiry_datetime to `max(now, 4min)`.
+    /// Sets `ingress_expiry_datetime` to `max(now, 4min)`.
     pub fn expire_after(mut self, duration: Duration) -> Self {
         self.ingress_expiry_datetime = Some(
             OffsetDateTime::now_utc()
@@ -1502,21 +1622,54 @@ impl<'agent> QueryBuilder<'agent> {
                 self.arg,
                 self.ingress_expiry_datetime,
                 self.use_nonce,
+                None,
+            )
+            .await
+    }
+
+    /// Make a query call with signature verification. This will return a byte vector.
+    ///
+    /// Compared with [call][Self::call], this method will **always** verify the signature of the query response
+    /// regardless the Agent level configuration from [`AgentBuilder::with_verify_query_signatures`].
+    pub async fn call_with_verification(self) -> Result<Vec<u8>, AgentError> {
+        self.agent
+            .query_raw(
+                self.canister_id,
+                self.effective_canister_id,
+                self.method_name,
+                self.arg,
+                self.ingress_expiry_datetime,
+                self.use_nonce,
+                Some(true),
+            )
+            .await
+    }
+
+    /// Make a query call without signature verification. This will return a byte vector.
+    ///
+    /// Compared with [call][Self::call], this method will **never** verify the signature of the query response
+    /// regardless the Agent level configuration from [`AgentBuilder::with_verify_query_signatures`].
+    pub async fn call_without_verification(self) -> Result<Vec<u8>, AgentError> {
+        self.agent
+            .query_raw(
+                self.canister_id,
+                self.effective_canister_id,
+                self.method_name,
+                self.arg,
+                self.ingress_expiry_datetime,
+                self.use_nonce,
+                Some(false),
             )
             .await
     }
 
     /// Sign a query call. This will return a [`signed::SignedQuery`]
     /// which contains all fields of the query and the signed query in CBOR encoding
-    pub fn sign(self) -> Result<SignedQuery, AgentError> {
-        let content = self.agent.query_content(
-            self.canister_id,
-            self.method_name,
-            self.arg,
-            self.ingress_expiry_datetime,
-            self.use_nonce,
-        )?;
-        let signed_query = sign_envelope(&content, self.agent.identity.clone())?;
+    pub async fn sign(self) -> Result<SignedQuery, AgentError> {
+        let effective_canister_id = self.effective_canister_id;
+        let identity = self.agent.identity.clone();
+        let content = self.into_envelope()?;
+        let signed_query = sign_envelope(&content, identity).await?;
         let EnvelopeContent::Query {
             ingress_expiry,
             sender,
@@ -1534,17 +1687,36 @@ impl<'agent> QueryBuilder<'agent> {
             canister_id,
             method_name,
             arg,
-            effective_canister_id: self.effective_canister_id,
+            effective_canister_id,
             signed_query,
             nonce,
         })
     }
+
+    /// Converts the query builder into [`EnvelopeContent`] for external signing or storage.
+    pub fn into_envelope(self) -> Result<EnvelopeContent, AgentError> {
+        self.agent.query_content(
+            self.canister_id,
+            self.method_name,
+            self.arg,
+            self.ingress_expiry_datetime,
+            self.use_nonce,
+        )
+    }
+}
+
+impl<'agent> IntoFuture for QueryBuilder<'agent> {
+    type IntoFuture = AgentFuture<'agent, Vec<u8>>;
+    type Output = Result<Vec<u8>, AgentError>;
+    fn into_future(self) -> Self::IntoFuture {
+        Box::pin(self.call())
+    }
 }
 
 /// An in-flight canister update call. Useful primarily as a `Future`.
 pub struct UpdateCall<'agent> {
     agent: &'agent Agent,
-    request_id: AgentFuture<'agent, RequestId>,
+    response_future: AgentFuture<'agent, CallResponse<(Vec<u8>, Certificate)>>,
     effective_canister_id: Principal,
 }
 
@@ -1558,20 +1730,28 @@ impl fmt::Debug for UpdateCall<'_> {
 }
 
 impl Future for UpdateCall<'_> {
-    type Output = Result<RequestId, AgentError>;
+    type Output = Result<CallResponse<(Vec<u8>, Certificate)>, AgentError>;
     fn poll(mut self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<Self::Output> {
-        self.request_id.as_mut().poll(cx)
+        self.response_future.as_mut().poll(cx)
     }
 }
+
 impl<'a> UpdateCall<'a> {
-    async fn and_wait(self) -> Result<Vec<u8>, AgentError> {
-        let request_id = self.request_id.await?;
-        self.agent
-            .wait(request_id, self.effective_canister_id)
-            .await
+    /// Waits for the update call to be completed, polling if necessary.
+    pub async fn and_wait(self) -> Result<(Vec<u8>, Certificate), AgentError> {
+        let response = self.response_future.await?;
+
+        match response {
+            CallResponse::Response(response) => Ok(response),
+            CallResponse::Poll(request_id) => {
+                self.agent
+                    .wait(&request_id, self.effective_canister_id)
+                    .await
+            }
+        }
     }
 }
-/// An Update Request Builder.
+/// An update request Builder.
 ///
 /// This makes it easier to do update calls without actually passing all arguments or specifying
 /// if you want to wait or not.
@@ -1615,13 +1795,13 @@ impl<'agent> UpdateBuilder<'agent> {
         self
     }
 
-    /// Sets ingress_expiry_datetime to the provided timestamp, at nanosecond precision.
+    /// Sets `ingress_expiry_datetime` to the provided timestamp, at nanosecond precision.
     pub fn expire_at(mut self, time: impl Into<OffsetDateTime>) -> Self {
         self.ingress_expiry_datetime = Some(time.into().unix_timestamp_nanos() as u64);
         self
     }
 
-    /// Sets ingress_expiry_datetime to `min(now, 4min)`.
+    /// Sets `ingress_expiry_datetime` to `min(now, 4min)`.
     pub fn expire_after(mut self, duration: Duration) -> Self {
         self.ingress_expiry_datetime = Some(
             OffsetDateTime::now_utc()
@@ -1631,16 +1811,16 @@ impl<'agent> UpdateBuilder<'agent> {
         self
     }
 
-    /// Make an update call. This will call request_status on the RequestId in a loop and return
+    /// Make an update call. This will call `request_status` on the `RequestId` in a loop and return
     /// the response as a byte vector.
     pub async fn call_and_wait(self) -> Result<Vec<u8>, AgentError> {
-        self.call().and_wait().await
+        self.call().and_wait().await.map(|x| x.0)
     }
 
-    /// Make an update call. This will return a RequestId.
-    /// The RequestId should then be used for request_status (most likely in a loop).
+    /// Make an update call. This will return a `RequestId`.
+    /// The `RequestId` should then be used for `request_status` (most likely in a loop).
     pub fn call(self) -> UpdateCall<'agent> {
-        let request_id_future = async move {
+        let response_future = async move {
             self.agent
                 .update_raw(
                     self.canister_id,
@@ -1653,23 +1833,18 @@ impl<'agent> UpdateBuilder<'agent> {
         };
         UpdateCall {
             agent: self.agent,
-            request_id: Box::pin(request_id_future),
+            response_future: Box::pin(response_future),
             effective_canister_id: self.effective_canister_id,
         }
     }
 
     /// Sign a update call. This will return a [`signed::SignedUpdate`]
     /// which contains all fields of the update and the signed update in CBOR encoding
-    pub fn sign(self) -> Result<SignedUpdate, AgentError> {
-        let nonce = self.agent.nonce_factory.generate();
-        let content = self.agent.update_content(
-            self.canister_id,
-            self.method_name,
-            self.arg,
-            self.ingress_expiry_datetime,
-            nonce,
-        )?;
-        let signed_update = sign_envelope(&content, self.agent.identity.clone())?;
+    pub async fn sign(self) -> Result<SignedUpdate, AgentError> {
+        let identity = self.agent.identity.clone();
+        let effective_canister_id = self.effective_canister_id;
+        let content = self.into_envelope()?;
+        let signed_update = sign_envelope(&content, identity).await?;
         let request_id = to_request_id(&content)?;
         let EnvelopeContent::Call {
             nonce,
@@ -1689,20 +1864,136 @@ impl<'agent> UpdateBuilder<'agent> {
             canister_id,
             method_name,
             arg,
-            effective_canister_id: self.effective_canister_id,
+            effective_canister_id,
             signed_update,
             request_id,
         })
     }
+
+    /// Converts the update builder into an [`EnvelopeContent`] for external signing or storage.
+    pub fn into_envelope(self) -> Result<EnvelopeContent, AgentError> {
+        let nonce = self.agent.nonce_factory.generate();
+        self.agent.update_content(
+            self.canister_id,
+            self.method_name,
+            self.arg,
+            self.ingress_expiry_datetime,
+            nonce,
+        )
+    }
 }
 
-#[cfg(all(test, feature = "reqwest"))]
+impl<'agent> IntoFuture for UpdateBuilder<'agent> {
+    type IntoFuture = AgentFuture<'agent, Vec<u8>>;
+    type Output = Result<Vec<u8>, AgentError>;
+    fn into_future(self) -> Self::IntoFuture {
+        Box::pin(self.call_and_wait())
+    }
+}
+
+/// HTTP client middleware. Implemented automatically for `reqwest`-compatible by-ref `tower::Service`, such as `reqwest_middleware`.
+#[cfg_attr(target_family = "wasm", async_trait(?Send))]
+#[cfg_attr(not(target_family = "wasm"), async_trait)]
+pub trait HttpService: Send + Sync + Debug {
+    /// Perform a HTTP request. Any retry logic should call `req` again, instead of `Request::try_clone`.
+    async fn call<'a>(
+        &'a self,
+        req: &'a (dyn Fn() -> Result<Request, AgentError> + Send + Sync),
+        max_retries: usize,
+    ) -> Result<Response, AgentError>;
+}
+#[cfg(not(target_family = "wasm"))]
+#[async_trait]
+impl<T> HttpService for T
+where
+    for<'a> &'a T: Service<Request, Response = Response, Error = reqwest::Error>,
+    for<'a> <&'a Self as Service<Request>>::Future: Send,
+    T: Send + Sync + Debug + ?Sized,
+{
+    #[allow(clippy::needless_arbitrary_self_type)]
+    async fn call<'a>(
+        mut self: &'a Self,
+        req: &'a (dyn Fn() -> Result<Request, AgentError> + Send + Sync),
+        max_retries: usize,
+    ) -> Result<Response, AgentError> {
+        let mut retry_count = 0;
+        loop {
+            match Service::call(&mut self, req()?).await {
+                Err(err) => {
+                    // Network-related errors can be retried.
+                    if err.is_connect() {
+                        if retry_count >= max_retries {
+                            return Err(AgentError::TransportError(err));
+                        }
+                        retry_count += 1;
+                    }
+                }
+                Ok(resp) => return Ok(resp),
+            }
+        }
+    }
+}
+
+#[cfg(target_family = "wasm")]
+#[async_trait(?Send)]
+impl<T> HttpService for T
+where
+    for<'a> &'a T: Service<Request, Response = Response, Error = reqwest::Error>,
+    T: Send + Sync + Debug + ?Sized,
+{
+    #[allow(clippy::needless_arbitrary_self_type)]
+    async fn call<'a>(
+        mut self: &'a Self,
+        req: &'a (dyn Fn() -> Result<Request, AgentError> + Send + Sync),
+        _: usize,
+    ) -> Result<Response, AgentError> {
+        Ok(Service::call(&mut self, req()?).await?)
+    }
+}
+
+#[derive(Debug)]
+struct Retry429Logic {
+    client: Client,
+}
+
+#[cfg_attr(target_family = "wasm", async_trait(?Send))]
+#[cfg_attr(not(target_family = "wasm"), async_trait)]
+impl HttpService for Retry429Logic {
+    async fn call<'a>(
+        &'a self,
+        req: &'a (dyn Fn() -> Result<Request, AgentError> + Send + Sync),
+        _max_tcp_retries: usize,
+    ) -> Result<Response, AgentError> {
+        let mut retries = 0;
+        loop {
+            #[cfg(not(target_family = "wasm"))]
+            let resp = self.client.call(req, _max_tcp_retries).await?;
+            // Client inconveniently does not implement Service on wasm
+            #[cfg(target_family = "wasm")]
+            let resp = self.client.execute(req()?).await?;
+            if resp.status() == StatusCode::TOO_MANY_REQUESTS {
+                if retries == 6 {
+                    break Ok(resp);
+                } else {
+                    retries += 1;
+                    crate::util::sleep(Duration::from_millis(250)).await;
+                    continue;
+                }
+            } else {
+                break Ok(resp);
+            }
+        }
+    }
+}
+
+#[cfg(all(test, not(target_family = "wasm")))]
 mod offline_tests {
     use super::*;
+    use tokio::net::TcpListener;
     // Any tests that involve the network should go in agent_test, not here.
 
-    #[test]
-    fn rounded_expiry() {
+    #[tokio::test]
+    async fn rounded_expiry() {
         let agent = Agent::builder()
             .with_url("http://not-a-real-url")
             .build()
@@ -1713,6 +2004,7 @@ mod offline_tests {
             let update = agent
                 .update(&Principal::management_canister(), "not_a_method")
                 .sign()
+                .await
                 .unwrap();
             if prev_expiry < Some(update.ingress_expiry) {
                 prev_expiry = Some(update.ingress_expiry);
@@ -1722,4 +2014,41 @@ mod offline_tests {
         // in six requests, there should be no more than two timestamps
         assert!(num_timestamps <= 2, "num_timestamps:{num_timestamps} > 2");
     }
+
+    #[tokio::test]
+    async fn client_ratelimit() {
+        let mock_server = TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let count = Arc::new(Mutex::new(0));
+        let port = mock_server.local_addr().unwrap().port();
+        tokio::spawn({
+            let count = count.clone();
+            async move {
+                loop {
+                    let (mut conn, _) = mock_server.accept().await.unwrap();
+                    *count.lock().unwrap() += 1;
+                    tokio::spawn(
+                        // read all data, never reply
+                        async move { tokio::io::copy(&mut conn, &mut tokio::io::sink()).await },
+                    );
+                }
+            }
+        });
+        let agent = Agent::builder()
+            .with_http_client(Client::builder().http1_only().build().unwrap())
+            .with_url(format!("http://127.0.0.1:{port}"))
+            .with_max_concurrent_requests(2)
+            .build()
+            .unwrap();
+        for _ in 0..3 {
+            let agent = agent.clone();
+            tokio::spawn(async move {
+                agent
+                    .query(&"ryjl3-tyaaa-aaaaa-aaaba-cai".parse().unwrap(), "greet")
+                    .call()
+                    .await
+            });
+        }
+        crate::util::sleep(Duration::from_millis(250)).await;
+        assert_eq!(*count.lock().unwrap(), 2);
+    }
 }
diff --git a/ic-agent/src/agent/response_authentication.rs b/ic-agent/src/agent/response_authentication.rs
index 563f58d0..4a50a18b 100644
--- a/ic-agent/src/agent/response_authentication.rs
+++ b/ic-agent/src/agent/response_authentication.rs
@@ -1,10 +1,10 @@
-use crate::agent::{RejectCode, RejectResponse, RequestStatusResponse};
+use crate::agent::{ApiBoundaryNode, RejectCode, RejectResponse, RequestStatusResponse};
 use crate::{export::Principal, AgentError, RequestId};
 use ic_certification::hash_tree::{HashTree, SubtreeLookupResult};
 use ic_certification::{certificate::Certificate, hash_tree::Label, LookupResult};
 use ic_transport_types::{ReplyResponse, SubnetMetrics};
 use rangemap::RangeInclusiveSet;
-use std::collections::HashMap;
+use std::collections::{HashMap, HashSet};
 use std::str::from_utf8;
 
 use super::Subnet;
@@ -33,6 +33,13 @@ pub fn extract_der(buf: Vec<u8>) -> Result<Vec<u8>, AgentError> {
     Ok(key.to_vec())
 }
 
+pub(crate) fn lookup_time<Storage: AsRef<[u8]>>(
+    certificate: &Certificate<Storage>,
+) -> Result<u64, AgentError> {
+    let mut time = lookup_value(&certificate.tree, ["time".as_bytes()])?;
+    Ok(leb128::read::unsigned(&mut time)?)
+}
+
 pub(crate) fn lookup_canister_info<Storage: AsRef<[u8]>>(
     certificate: Certificate<Storage>,
     canister_id: Principal,
@@ -71,7 +78,7 @@ pub(crate) fn lookup_subnet_metrics<Storage: AsRef<[u8]>>(
 }
 
 pub(crate) fn lookup_request_status<Storage: AsRef<[u8]>>(
-    certificate: Certificate<Storage>,
+    certificate: &Certificate<Storage>,
     request_id: &RequestId,
 ) -> Result<RequestStatusResponse, AgentError> {
     use AgentError::*;
@@ -87,8 +94,8 @@ pub(crate) fn lookup_request_status<Storage: AsRef<[u8]>>(
             "done" => Ok(RequestStatusResponse::Done),
             "processing" => Ok(RequestStatusResponse::Processing),
             "received" => Ok(RequestStatusResponse::Received),
-            "rejected" => lookup_rejection(&certificate, request_id),
-            "replied" => lookup_reply(&certificate, request_id),
+            "rejected" => lookup_rejection(certificate, request_id),
+            "replied" => lookup_reply(certificate, request_id),
             other => Err(InvalidRequestStatus(path_status.into(), other.to_string())),
         },
         LookupResult::Error => Err(LookupPathError(path_status.into())),
@@ -101,11 +108,12 @@ pub(crate) fn lookup_rejection<Storage: AsRef<[u8]>>(
 ) -> Result<RequestStatusResponse, AgentError> {
     let reject_code = lookup_reject_code(certificate, request_id)?;
     let reject_message = lookup_reject_message(certificate, request_id)?;
+    let error_code = lookup_error_code(certificate, request_id)?;
 
     Ok(RequestStatusResponse::Rejected(RejectResponse {
         reject_code,
         reject_message,
-        error_code: None,
+        error_code,
     }))
 }
 
@@ -137,6 +145,23 @@ pub(crate) fn lookup_reject_message<Storage: AsRef<[u8]>>(
     Ok(from_utf8(msg)?.to_string())
 }
 
+pub(crate) fn lookup_error_code<Storage: AsRef<[u8]>>(
+    certificate: &Certificate<Storage>,
+    request_id: &RequestId,
+) -> Result<Option<String>, AgentError> {
+    let path = [
+        "request_status".as_bytes(),
+        request_id.as_slice(),
+        "error_code".as_bytes(),
+    ];
+    let msg = lookup_value(&certificate.tree, path);
+    match msg {
+        Ok(val) => Ok(Some(from_utf8(val)?.to_string())),
+        Err(AgentError::LookupPathAbsent(_)) => Ok(None),
+        Err(e) => Err(e),
+    }
+}
+
 pub(crate) fn lookup_reply<Storage: AsRef<[u8]>>(
     certificate: &Certificate<Storage>,
     request_id: &RequestId,
@@ -206,6 +231,52 @@ pub(crate) fn lookup_subnet<Storage: AsRef<[u8]> + Clone>(
     Ok((subnet_id, subnet))
 }
 
+pub(crate) fn lookup_api_boundary_nodes<Storage: AsRef<[u8]> + Clone>(
+    certificate: Certificate<Storage>,
+) -> Result<Vec<ApiBoundaryNode>, AgentError> {
+    // API boundary nodes paths in the state tree, as defined in the spec (https://internetcomputer.org/docs/current/references/ic-interface-spec#state-tree-api-bn).
+    let api_bn_path = "api_boundary_nodes".as_bytes();
+    let domain_path = "domain".as_bytes();
+    let ipv4_path = "ipv4_address".as_bytes();
+    let ipv6_path = "ipv6_address".as_bytes();
+
+    let api_bn_tree = lookup_tree(&certificate.tree, [api_bn_path])?;
+
+    let mut api_bns = Vec::<ApiBoundaryNode>::new();
+    let paths = api_bn_tree.list_paths();
+    let node_ids: HashSet<&[u8]> = paths.iter().map(|path| path[0].as_bytes()).collect();
+
+    for node_id in node_ids {
+        let domain =
+            String::from_utf8(lookup_value(&api_bn_tree, [node_id, domain_path])?.to_vec())
+                .map_err(|err| AgentError::Utf8ReadError(err.utf8_error()))?;
+
+        let ipv6_address =
+            String::from_utf8(lookup_value(&api_bn_tree, [node_id, ipv6_path])?.to_vec())
+                .map_err(|err| AgentError::Utf8ReadError(err.utf8_error()))?;
+
+        let ipv4_address = match lookup_value(&api_bn_tree, [node_id, ipv4_path]) {
+            Ok(ipv4) => Some(
+                String::from_utf8(ipv4.to_vec())
+                    .map_err(|err| AgentError::Utf8ReadError(err.utf8_error()))?,
+            ),
+            // By convention an absent path `/api_boundary_nodes/<node_id>/ipv4_address` in the state tree signifies that ipv4 is None.
+            Err(AgentError::LookupPathAbsent(_)) => None,
+            Err(err) => return Err(err),
+        };
+
+        let api_bn = ApiBoundaryNode {
+            domain,
+            ipv6_address,
+            ipv4_address,
+        };
+
+        api_bns.push(api_bn);
+    }
+
+    Ok(api_bns)
+}
+
 /// The path to [`lookup_value`]
 pub trait LookupPath {
     type Item: AsRef<[u8]>;
diff --git a/ic-agent/src/agent/route_provider.rs b/ic-agent/src/agent/route_provider.rs
new file mode 100644
index 00000000..8720c05a
--- /dev/null
+++ b/ic-agent/src/agent/route_provider.rs
@@ -0,0 +1,356 @@
+//! A [`RouteProvider`] for dynamic generation of routing urls.
+use arc_swap::ArcSwapOption;
+use dynamic_routing::{
+    dynamic_route_provider::DynamicRouteProviderBuilder,
+    node::Node,
+    snapshot::{
+        latency_based_routing::LatencyRoutingSnapshot,
+        round_robin_routing::RoundRobinRoutingSnapshot,
+    },
+};
+use std::{
+    future::Future,
+    str::FromStr,
+    sync::{
+        atomic::{AtomicUsize, Ordering},
+        Arc,
+    },
+    time::Duration,
+};
+use url::Url;
+
+use crate::agent::AgentError;
+
+use super::HttpService;
+#[cfg(not(feature = "_internal_dynamic-routing"))]
+pub(crate) mod dynamic_routing;
+#[cfg(feature = "_internal_dynamic-routing")]
+pub mod dynamic_routing;
+
+const IC0_DOMAIN: &str = "ic0.app";
+const ICP0_DOMAIN: &str = "icp0.io";
+const ICP_API_DOMAIN: &str = "icp-api.io";
+const LOCALHOST_DOMAIN: &str = "localhost";
+const IC0_SUB_DOMAIN: &str = ".ic0.app";
+const ICP0_SUB_DOMAIN: &str = ".icp0.io";
+const ICP_API_SUB_DOMAIN: &str = ".icp-api.io";
+const LOCALHOST_SUB_DOMAIN: &str = ".localhost";
+
+/// A [`RouteProvider`] for dynamic generation of routing urls.
+pub trait RouteProvider: std::fmt::Debug + Send + Sync {
+    /// Generates the next routing URL based on the internal routing logic.
+    ///
+    /// This method returns a single `Url` that can be used for routing.
+    /// The logic behind determining the next URL can vary depending on the implementation
+    fn route(&self) -> Result<Url, AgentError>;
+
+    /// Generates up to `n` different routing URLs in order of priority.
+    ///
+    /// This method returns a vector of `Url` instances, each representing a routing
+    /// endpoint. The URLs are ordered by priority, with the most preferred route
+    /// appearing first. The returned vector can contain fewer than `n` URLs if
+    /// fewer are available.
+    fn n_ordered_routes(&self, n: usize) -> Result<Vec<Url>, AgentError>;
+}
+
+/// A simple implementation of the [`RouteProvider`] which produces an even distribution of the urls from the input ones.
+#[derive(Debug)]
+pub struct RoundRobinRouteProvider {
+    routes: Vec<Url>,
+    current_idx: AtomicUsize,
+}
+
+impl RouteProvider for RoundRobinRouteProvider {
+    /// Generates a url for the given endpoint.
+    fn route(&self) -> Result<Url, AgentError> {
+        if self.routes.is_empty() {
+            return Err(AgentError::RouteProviderError(
+                "No routing urls provided".to_string(),
+            ));
+        }
+        // This operation wraps around an overflow, i.e. after max is reached the value is reset back to 0.
+        let prev_idx = self.current_idx.fetch_add(1, Ordering::Relaxed);
+        Ok(self.routes[prev_idx % self.routes.len()].clone())
+    }
+
+    fn n_ordered_routes(&self, n: usize) -> Result<Vec<Url>, AgentError> {
+        if n == 0 {
+            return Ok(Vec::new());
+        }
+
+        if n >= self.routes.len() {
+            return Ok(self.routes.clone());
+        }
+
+        let idx = self.current_idx.fetch_add(n, Ordering::Relaxed) % self.routes.len();
+        let mut urls = Vec::with_capacity(n);
+
+        if self.routes.len() - idx >= n {
+            urls.extend_from_slice(&self.routes[idx..idx + n]);
+        } else {
+            urls.extend_from_slice(&self.routes[idx..]);
+            urls.extend_from_slice(&self.routes[..n - urls.len()]);
+        }
+
+        Ok(urls)
+    }
+}
+
+impl RoundRobinRouteProvider {
+    /// Construct [`RoundRobinRouteProvider`] from a vector of urls.
+    pub fn new<T: AsRef<str>>(routes: Vec<T>) -> Result<Self, AgentError> {
+        let routes: Result<Vec<Url>, _> = routes
+            .into_iter()
+            .map(|url| {
+                Url::from_str(url.as_ref()).and_then(|mut url| {
+                    // rewrite *.ic0.app to ic0.app
+                    if let Some(domain) = url.domain() {
+                        if domain.ends_with(IC0_SUB_DOMAIN) {
+                            url.set_host(Some(IC0_DOMAIN))?;
+                        } else if domain.ends_with(ICP0_SUB_DOMAIN) {
+                            url.set_host(Some(ICP0_DOMAIN))?;
+                        } else if domain.ends_with(ICP_API_SUB_DOMAIN) {
+                            url.set_host(Some(ICP_API_DOMAIN))?;
+                        } else if domain.ends_with(LOCALHOST_SUB_DOMAIN) {
+                            url.set_host(Some(LOCALHOST_DOMAIN))?;
+                        }
+                    }
+                    Ok(url)
+                })
+            })
+            .collect();
+        Ok(Self {
+            routes: routes?,
+            current_idx: AtomicUsize::new(0),
+        })
+    }
+}
+
+impl RouteProvider for Url {
+    fn route(&self) -> Result<Url, AgentError> {
+        Ok(self.clone())
+    }
+    fn n_ordered_routes(&self, _: usize) -> Result<Vec<Url>, AgentError> {
+        Ok(vec![self.route()?])
+    }
+}
+
+/// A [`RouteProvider`] that will attempt to discover new boundary nodes and cycle through them, optionally prioritizing those with low latency.
+#[derive(Debug)]
+pub struct DynamicRouteProvider {
+    inner: Box<dyn RouteProvider>,
+}
+
+impl DynamicRouteProvider {
+    /// Create a new `DynamicRouter` from a list of seed domains and a routing strategy.
+    pub async fn run_in_background(
+        seed_domains: Vec<String>,
+        client: Arc<dyn HttpService>,
+        strategy: DynamicRoutingStrategy,
+    ) -> Result<Self, AgentError> {
+        let seed_nodes: Result<Vec<_>, _> = seed_domains.into_iter().map(Node::new).collect();
+        let boxed = match strategy {
+            DynamicRoutingStrategy::ByLatency => Box::new(
+                DynamicRouteProviderBuilder::new(
+                    LatencyRoutingSnapshot::new(),
+                    seed_nodes?,
+                    client,
+                )
+                .build()
+                .await,
+            ) as Box<dyn RouteProvider>,
+            DynamicRoutingStrategy::RoundRobin => Box::new(
+                DynamicRouteProviderBuilder::new(
+                    RoundRobinRoutingSnapshot::new(),
+                    seed_nodes?,
+                    client,
+                )
+                .build()
+                .await,
+            ),
+        };
+        Ok(Self { inner: boxed })
+    }
+    /// Same as [`run_in_background`](Self::run_in_background), but with custom intervals for refreshing the routing list and health-checking nodes.
+    pub async fn run_in_background_with_intervals(
+        seed_domains: Vec<String>,
+        client: Arc<dyn HttpService>,
+        strategy: DynamicRoutingStrategy,
+        list_update_interval: Duration,
+        health_check_interval: Duration,
+    ) -> Result<Self, AgentError> {
+        let seed_nodes: Result<Vec<_>, _> = seed_domains.into_iter().map(Node::new).collect();
+        let boxed = match strategy {
+            DynamicRoutingStrategy::ByLatency => Box::new(
+                DynamicRouteProviderBuilder::new(
+                    LatencyRoutingSnapshot::new(),
+                    seed_nodes?,
+                    client,
+                )
+                .with_fetch_period(list_update_interval)
+                .with_check_period(health_check_interval)
+                .build()
+                .await,
+            ) as Box<dyn RouteProvider>,
+            DynamicRoutingStrategy::RoundRobin => Box::new(
+                DynamicRouteProviderBuilder::new(
+                    RoundRobinRoutingSnapshot::new(),
+                    seed_nodes?,
+                    client,
+                )
+                .with_fetch_period(list_update_interval)
+                .with_check_period(health_check_interval)
+                .build()
+                .await,
+            ),
+        };
+        Ok(Self { inner: boxed })
+    }
+}
+
+impl RouteProvider for DynamicRouteProvider {
+    fn route(&self) -> Result<Url, AgentError> {
+        self.inner.route()
+    }
+    fn n_ordered_routes(&self, n: usize) -> Result<Vec<Url>, AgentError> {
+        self.inner.n_ordered_routes(n)
+    }
+}
+
+/// Strategy for [`DynamicRouteProvider`]'s routing mechanism.
+#[derive(Debug, Copy, Clone, Eq, PartialEq, Hash)]
+pub enum DynamicRoutingStrategy {
+    /// Prefer nodes with low latency.
+    ByLatency,
+    /// Cycle through discovered nodes with no regard for latency.
+    RoundRobin,
+}
+
+#[derive(Debug)]
+pub(crate) struct UrlUntilReady<R> {
+    url: Url,
+    router: ArcSwapOption<R>,
+}
+
+impl<R: RouteProvider + 'static> UrlUntilReady<R> {
+    pub(crate) fn new<
+        #[cfg(not(target_family = "wasm"))] F: Future<Output = R> + Send + 'static,
+        #[cfg(target_family = "wasm")] F: Future<Output = R> + 'static,
+    >(
+        url: Url,
+        fut: F,
+    ) -> Arc<Self> {
+        let s = Arc::new(Self {
+            url,
+            router: ArcSwapOption::empty(),
+        });
+        let weak = Arc::downgrade(&s);
+        crate::util::spawn(async move {
+            let router = fut.await;
+            if let Some(outer) = weak.upgrade() {
+                outer.router.store(Some(Arc::new(router)))
+            }
+        });
+        s
+    }
+}
+
+impl<R: RouteProvider> RouteProvider for UrlUntilReady<R> {
+    fn n_ordered_routes(&self, n: usize) -> Result<Vec<Url>, AgentError> {
+        if let Some(r) = &*self.router.load() {
+            r.n_ordered_routes(n)
+        } else {
+            self.url.n_ordered_routes(n)
+        }
+    }
+    fn route(&self) -> Result<Url, AgentError> {
+        if let Some(r) = &*self.router.load() {
+            r.route()
+        } else {
+            self.url.route()
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_empty_routes() {
+        let provider = RoundRobinRouteProvider::new::<&str>(vec![])
+            .expect("failed to create a route provider");
+        let result = provider.route().unwrap_err();
+        assert_eq!(
+            result,
+            AgentError::RouteProviderError("No routing urls provided".to_string())
+        );
+    }
+
+    #[test]
+    fn test_routes_rotation() {
+        let provider = RoundRobinRouteProvider::new(vec!["https://url1.com", "https://url2.com"])
+            .expect("failed to create a route provider");
+        let url_strings = ["https://url1.com", "https://url2.com", "https://url1.com"];
+        let expected_urls: Vec<Url> = url_strings
+            .iter()
+            .map(|url_str| Url::parse(url_str).expect("Invalid URL"))
+            .collect();
+        let urls: Vec<Url> = (0..3)
+            .map(|_| provider.route().expect("failed to get next url"))
+            .collect();
+        assert_eq!(expected_urls, urls);
+    }
+
+    #[test]
+    fn test_n_routes() {
+        // Test with an empty list of urls
+        let provider = RoundRobinRouteProvider::new(Vec::<&str>::new())
+            .expect("failed to create a route provider");
+        let urls_iter = provider.n_ordered_routes(1).expect("failed to get urls");
+        assert!(urls_iter.is_empty());
+        // Test with non-empty list of urls
+        let provider = RoundRobinRouteProvider::new(vec![
+            "https://url1.com",
+            "https://url2.com",
+            "https://url3.com",
+            "https://url4.com",
+            "https://url5.com",
+        ])
+        .expect("failed to create a route provider");
+        // First call
+        let urls: Vec<_> = provider.n_ordered_routes(3).expect("failed to get urls");
+        let expected_urls: Vec<Url> = ["https://url1.com", "https://url2.com", "https://url3.com"]
+            .iter()
+            .map(|url_str| Url::parse(url_str).expect("invalid URL"))
+            .collect();
+        assert_eq!(urls, expected_urls);
+        // Second call
+        let urls: Vec<_> = provider.n_ordered_routes(3).expect("failed to get urls");
+        let expected_urls: Vec<Url> = ["https://url4.com", "https://url5.com", "https://url1.com"]
+            .iter()
+            .map(|url_str| Url::parse(url_str).expect("invalid URL"))
+            .collect();
+        assert_eq!(urls, expected_urls);
+        // Third call
+        let urls: Vec<_> = provider.n_ordered_routes(2).expect("failed to get urls");
+        let expected_urls: Vec<Url> = ["https://url2.com", "https://url3.com"]
+            .iter()
+            .map(|url_str| Url::parse(url_str).expect("invalid URL"))
+            .collect();
+        assert_eq!(urls, expected_urls);
+        // Fourth call
+        let urls: Vec<_> = provider.n_ordered_routes(5).expect("failed to get urls");
+        let expected_urls: Vec<Url> = [
+            "https://url1.com",
+            "https://url2.com",
+            "https://url3.com",
+            "https://url4.com",
+            "https://url5.com",
+        ]
+        .iter()
+        .map(|url_str| Url::parse(url_str).expect("invalid URL"))
+        .collect();
+        assert_eq!(urls, expected_urls);
+    }
+}
diff --git a/ic-agent/src/agent/route_provider/dynamic_routing/dynamic_route_provider.rs b/ic-agent/src/agent/route_provider/dynamic_routing/dynamic_route_provider.rs
new file mode 100644
index 00000000..ad9b7b40
--- /dev/null
+++ b/ic-agent/src/agent/route_provider/dynamic_routing/dynamic_route_provider.rs
@@ -0,0 +1,706 @@
+//! An implementation of [`RouteProvider`] for dynamic generation of routing urls.
+
+use std::{
+    sync::Arc,
+    time::{Duration, Instant},
+};
+
+use arc_swap::ArcSwap;
+use candid::Principal;
+use futures_util::FutureExt;
+use stop_token::StopSource;
+use thiserror::Error;
+use url::Url;
+
+use crate::{
+    agent::{
+        route_provider::{
+            dynamic_routing::{
+                health_check::{HealthCheck, HealthChecker, HealthManagerActor},
+                messages::FetchedNodes,
+                node::Node,
+                nodes_fetch::{Fetch, NodesFetchActor, NodesFetcher},
+                snapshot::routing_snapshot::RoutingSnapshot,
+                type_aliases::AtomicSwap,
+            },
+            RouteProvider,
+        },
+        HttpService,
+    },
+    AgentError,
+};
+
+/// The default seed domain for boundary node discovery.
+#[allow(unused)]
+pub const IC0_SEED_DOMAIN: &str = "ic0.app";
+
+const MAINNET_ROOT_SUBNET_ID: &str =
+    "tdb26-jop6k-aogll-7ltgs-eruif-6kk7m-qpktf-gdiqx-mxtrf-vb5e6-eqe";
+
+const FETCH_PERIOD: Duration = Duration::from_secs(5);
+const FETCH_RETRY_INTERVAL: Duration = Duration::from_millis(250);
+const TIMEOUT_AWAIT_HEALTHY_SEED: Duration = Duration::from_millis(1000);
+#[allow(unused)]
+const HEALTH_CHECK_TIMEOUT: Duration = Duration::from_secs(1);
+const HEALTH_CHECK_PERIOD: Duration = Duration::from_secs(1);
+#[allow(unused)]
+const DYNAMIC_ROUTE_PROVIDER: &str = "DynamicRouteProvider";
+
+/// A dynamic route provider.
+/// It spawns the discovery service (`NodesFetchActor`) for fetching the latest nodes topology.
+/// It also spawns the `HealthManagerActor`, which orchestrates the health check tasks for each node and updates routing snapshot.
+#[derive(Debug)]
+pub struct DynamicRouteProvider<S> {
+    /// Fetcher for fetching the latest nodes topology.
+    fetcher: Arc<dyn Fetch>,
+    /// Periodicity of fetching the latest nodes topology.
+    fetch_period: Duration,
+    /// Interval for retrying fetching the nodes in case of error.
+    fetch_retry_interval: Duration,
+    /// Health checker for checking the health of the nodes.
+    checker: Arc<dyn HealthCheck>,
+    /// Periodicity of checking the health of the nodes.
+    check_period: Duration,
+    /// Snapshot of the routing nodes.
+    routing_snapshot: AtomicSwap<S>,
+    /// Initial seed nodes, which are used for the initial fetching of the nodes.
+    seeds: Vec<Node>,
+    /// Cancellation token for stopping the spawned tasks.
+    token: StopSource,
+}
+
+/// An error that occurred when the DynamicRouteProvider service was running.
+#[derive(Error, Debug)]
+pub enum DynamicRouteProviderError {
+    /// An error when fetching topology of the API nodes.
+    #[error("An error when fetching API nodes: {0}")]
+    NodesFetchError(String),
+    /// An error when checking API node's health.
+    #[error("An error when checking API node's health: {0}")]
+    HealthCheckError(String),
+}
+
+/// A builder for the `DynamicRouteProvider`.
+pub struct DynamicRouteProviderBuilder<S> {
+    fetcher: Arc<dyn Fetch>,
+    fetch_period: Duration,
+    fetch_retry_interval: Duration,
+    checker: Arc<dyn HealthCheck>,
+    check_period: Duration,
+    routing_snapshot: AtomicSwap<S>,
+    seeds: Vec<Node>,
+}
+
+impl<S> DynamicRouteProviderBuilder<S> {
+    /// Creates a new instance of the builder.
+    pub fn new(snapshot: S, seeds: Vec<Node>, http_client: Arc<dyn HttpService>) -> Self {
+        let fetcher = Arc::new(NodesFetcher::new(
+            http_client.clone(),
+            Principal::from_text(MAINNET_ROOT_SUBNET_ID).unwrap(),
+            None,
+        ));
+        let checker = Arc::new(HealthChecker::new(
+            http_client,
+            #[cfg(not(target_family = "wasm"))]
+            HEALTH_CHECK_TIMEOUT,
+        ));
+        Self {
+            fetcher,
+            fetch_period: FETCH_PERIOD,
+            fetch_retry_interval: FETCH_RETRY_INTERVAL,
+            checker,
+            check_period: HEALTH_CHECK_PERIOD,
+            seeds,
+            routing_snapshot: Arc::new(ArcSwap::from_pointee(snapshot)),
+        }
+    }
+
+    /// Sets the fetcher of the nodes in the topology.
+    #[allow(unused)]
+    pub fn with_fetcher(mut self, fetcher: Arc<dyn Fetch>) -> Self {
+        self.fetcher = fetcher;
+        self
+    }
+
+    /// Sets the fetching periodicity.
+    pub fn with_fetch_period(mut self, period: Duration) -> Self {
+        self.fetch_period = period;
+        self
+    }
+
+    /// Sets the node health checker.
+    #[allow(unused)]
+    pub fn with_checker(mut self, checker: Arc<dyn HealthCheck>) -> Self {
+        self.checker = checker;
+        self
+    }
+
+    /// Sets the periodicity of node health checking.
+    pub fn with_check_period(mut self, period: Duration) -> Self {
+        self.check_period = period;
+        self
+    }
+
+    /// Builds an instance of the `DynamicRouteProvider`.
+    pub async fn build(self) -> DynamicRouteProvider<S>
+    where
+        S: RoutingSnapshot + 'static,
+    {
+        let route_provider = DynamicRouteProvider {
+            fetcher: self.fetcher,
+            fetch_period: self.fetch_period,
+            fetch_retry_interval: self.fetch_retry_interval,
+            checker: self.checker,
+            check_period: self.check_period,
+            routing_snapshot: self.routing_snapshot,
+            seeds: self.seeds,
+            token: StopSource::new(),
+        };
+
+        route_provider.run().await;
+
+        route_provider
+    }
+}
+
+impl<S> RouteProvider for DynamicRouteProvider<S>
+where
+    S: RoutingSnapshot + 'static,
+{
+    fn route(&self) -> Result<Url, AgentError> {
+        let snapshot = self.routing_snapshot.load();
+        let node = snapshot.next_node().ok_or_else(|| {
+            AgentError::RouteProviderError("No healthy API nodes found.".to_string())
+        })?;
+        Ok(node.to_routing_url())
+    }
+
+    fn n_ordered_routes(&self, n: usize) -> Result<Vec<Url>, AgentError> {
+        let snapshot = self.routing_snapshot.load();
+        let nodes = snapshot.next_n_nodes(n);
+        if nodes.is_empty() {
+            return Err(AgentError::RouteProviderError(
+                "No healthy API nodes found.".to_string(),
+            ));
+        };
+        let urls = nodes.iter().map(|n| n.to_routing_url()).collect();
+        Ok(urls)
+    }
+}
+
+impl<S> DynamicRouteProvider<S>
+where
+    S: RoutingSnapshot + 'static,
+{
+    /// Starts two background tasks:
+    /// - Task1: NodesFetchActor
+    ///   - Periodically fetches existing API nodes (gets latest nodes topology) and sends discovered nodes to HealthManagerActor.
+    /// - Task2: HealthManagerActor:
+    ///   - Listens to the fetched nodes messages from the NodesFetchActor.
+    ///   - Starts/stops health check tasks (HealthCheckActors) based on the newly added/removed nodes.
+    ///   - These spawned health check tasks periodically update the snapshot with the latest node health info.
+    pub async fn run(&self) {
+        log!(info, "{DYNAMIC_ROUTE_PROVIDER}: started ...");
+        // Communication channel between NodesFetchActor and HealthManagerActor.
+        let (fetch_sender, fetch_receiver) = async_watch::channel(None);
+
+        // Communication channel with HealthManagerActor to receive info about healthy seed nodes (used only once).
+        let (init_sender, init_receiver) = async_channel::bounded(1);
+
+        // Start the receiving part first.
+        let health_manager_actor = HealthManagerActor::new(
+            Arc::clone(&self.checker),
+            self.check_period,
+            Arc::clone(&self.routing_snapshot),
+            fetch_receiver,
+            init_sender,
+            self.token.token(),
+        );
+        crate::util::spawn(async move { health_manager_actor.run().await });
+
+        // Dispatch all seed nodes for initial health checks
+        if let Err(_err) = fetch_sender.send(Some(FetchedNodes {
+            nodes: self.seeds.clone(),
+        })) {
+            log!(
+                error,
+                "{DYNAMIC_ROUTE_PROVIDER}: failed to send results to HealthManager: {_err:?}"
+            );
+        }
+
+        // Try await for healthy seeds.
+        let _start = Instant::now();
+        futures_util::select! {
+            _ = crate::util::sleep(TIMEOUT_AWAIT_HEALTHY_SEED).fuse() => {
+                log!(
+                    warn,
+                    "{DYNAMIC_ROUTE_PROVIDER}: no healthy seeds found within {:?}",
+                    _start.elapsed()
+                );
+            }
+            _ = init_receiver.recv().fuse() => {
+                log!(
+                    info,
+                    "{DYNAMIC_ROUTE_PROVIDER}: found healthy seeds within {:?}",
+                    _start.elapsed()
+                );
+            }
+        }
+        // We can close the channel now.
+        init_receiver.close();
+
+        let fetch_actor = NodesFetchActor::new(
+            Arc::clone(&self.fetcher),
+            self.fetch_period,
+            self.fetch_retry_interval,
+            fetch_sender,
+            Arc::clone(&self.routing_snapshot),
+            self.token.token(),
+        );
+        crate::util::spawn(async move { fetch_actor.run().await });
+        log!(
+            info,
+            "{DYNAMIC_ROUTE_PROVIDER}: NodesFetchActor and HealthManagerActor started successfully"
+        );
+    }
+}
+
+#[cfg(all(test, not(target_family = "wasm")))]
+mod tests {
+    use candid::Principal;
+    use reqwest::Client;
+    use std::{
+        sync::{Arc, Once},
+        time::{Duration, Instant},
+    };
+    use tracing::Level;
+    use tracing_subscriber::FmtSubscriber;
+
+    use crate::{
+        agent::route_provider::{
+            dynamic_routing::{
+                dynamic_route_provider::{
+                    DynamicRouteProviderBuilder, IC0_SEED_DOMAIN, MAINNET_ROOT_SUBNET_ID,
+                },
+                node::Node,
+                snapshot::{
+                    latency_based_routing::LatencyRoutingSnapshot,
+                    round_robin_routing::RoundRobinRoutingSnapshot,
+                },
+                test_utils::{
+                    assert_routed_domains, route_n_times, NodeHealthCheckerMock, NodesFetcherMock,
+                },
+            },
+            RouteProvider,
+        },
+        Agent, AgentError,
+    };
+
+    static TRACING_INIT: Once = Once::new();
+
+    pub fn setup_tracing() {
+        TRACING_INIT.call_once(|| {
+            FmtSubscriber::builder()
+                .with_max_level(Level::TRACE)
+                .with_test_writer()
+                .init();
+        });
+    }
+
+    async fn assert_no_routing_via_domains(
+        route_provider: Arc<dyn RouteProvider>,
+        excluded_domains: Vec<&str>,
+        timeout: Duration,
+        route_call_interval: Duration,
+    ) {
+        if excluded_domains.is_empty() {
+            panic!("List of excluded domains can't be empty");
+        }
+
+        let route_calls = 30;
+        let start = Instant::now();
+
+        while start.elapsed() < timeout {
+            let routed_domains = (0..route_calls)
+                .map(|_| {
+                    route_provider.route().map(|url| {
+                        let domain = url.domain().expect("no domain name in url");
+                        domain.to_string()
+                    })
+                })
+                .collect::<Result<Vec<String>, _>>()
+                .unwrap_or_default();
+
+            // Exit when excluded domains are not used for routing any more.
+            if !routed_domains.is_empty()
+                && !routed_domains
+                    .iter()
+                    .any(|d| excluded_domains.contains(&d.as_str()))
+            {
+                return;
+            }
+
+            tokio::time::sleep(route_call_interval).await;
+        }
+        panic!("Expected excluded domains {excluded_domains:?} are still observed in routing over the last {route_calls} calls");
+    }
+
+    #[tokio::test]
+    async fn test_mainnet() {
+        // Setup.
+        setup_tracing();
+        let seed = Node::new(IC0_SEED_DOMAIN).unwrap();
+        let client = Client::builder().build().unwrap();
+        let route_provider = DynamicRouteProviderBuilder::new(
+            LatencyRoutingSnapshot::new(),
+            vec![seed],
+            Arc::new(client.clone()),
+        )
+        .build()
+        .await;
+        let route_provider = Arc::new(route_provider) as Arc<dyn RouteProvider>;
+        let agent = Agent::builder()
+            .with_arc_route_provider(Arc::clone(&route_provider))
+            .with_http_client(client)
+            .build()
+            .expect("failed to create an agent");
+        let subnet_id = Principal::from_text(MAINNET_ROOT_SUBNET_ID).unwrap();
+        // Assert that seed (ic0.app) is not used for routing. Henceforth, only discovered API nodes are used.
+        assert_no_routing_via_domains(
+            Arc::clone(&route_provider),
+            vec![IC0_SEED_DOMAIN],
+            Duration::from_secs(40),
+            Duration::from_secs(2),
+        )
+        .await;
+        // Act: perform /read_state call via dynamically discovered API BNs.
+        let api_bns = agent
+            .fetch_api_boundary_nodes_by_subnet_id(subnet_id)
+            .await
+            .expect("failed to fetch api boundary nodes");
+        assert!(!api_bns.is_empty());
+    }
+
+    #[tokio::test]
+    async fn test_routing_with_topology_and_node_health_updates() {
+        // Setup.
+        setup_tracing();
+        let node_1 = Node::new(IC0_SEED_DOMAIN).unwrap();
+        // Set nodes fetching params: topology, fetching periodicity.
+        let fetcher = Arc::new(NodesFetcherMock::new());
+        fetcher.overwrite_nodes(vec![node_1.clone()]);
+        let fetch_interval = Duration::from_secs(2);
+        // Set health checking params: healthy nodes, checking periodicity.
+        let checker = Arc::new(NodeHealthCheckerMock::new());
+        let check_interval = Duration::from_secs(1);
+        // A single healthy node exists in the topology. This node happens to be the seed node.
+        fetcher.overwrite_nodes(vec![node_1.clone()]);
+        checker.overwrite_healthy_nodes(vec![node_1.clone()]);
+        // Configure RouteProvider
+        let snapshot = RoundRobinRoutingSnapshot::new();
+        let client = Client::builder().build().unwrap();
+        let route_provider =
+            DynamicRouteProviderBuilder::new(snapshot, vec![node_1.clone()], Arc::new(client))
+                .with_fetcher(fetcher.clone())
+                .with_checker(checker.clone())
+                .with_fetch_period(fetch_interval)
+                .with_check_period(check_interval)
+                .build()
+                .await;
+        let route_provider = Arc::new(route_provider);
+
+        // This time span is required for the snapshot to be fully updated with the new nodes and their health info.
+        let snapshot_update_duration = fetch_interval + 2 * check_interval;
+
+        // Test 1: multiple route() calls return a single domain=ic0.app.
+        // Only a single node exists, which is initially healthy.
+        tokio::time::sleep(snapshot_update_duration).await;
+        let routed_domains = route_n_times(6, Arc::clone(&route_provider));
+        assert_routed_domains(routed_domains, vec![node_1.domain()], 6);
+
+        // Test 2: multiple route() calls return 3 different domains with equal fairness (repetition).
+        // Two healthy nodes are added to the topology.
+        let node_2 = Node::new("api1.com").unwrap();
+        let node_3 = Node::new("api2.com").unwrap();
+        checker.overwrite_healthy_nodes(vec![node_1.clone(), node_2.clone(), node_3.clone()]);
+        fetcher.overwrite_nodes(vec![node_1.clone(), node_2.clone(), node_3.clone()]);
+        tokio::time::sleep(snapshot_update_duration).await;
+        let routed_domains = route_n_times(6, Arc::clone(&route_provider));
+        assert_routed_domains(
+            routed_domains,
+            vec![node_1.domain(), node_2.domain(), node_3.domain()],
+            2,
+        );
+
+        // Test 3:  multiple route() calls return 2 different domains with equal fairness (repetition).
+        // One node is set to unhealthy.
+        checker.overwrite_healthy_nodes(vec![node_1.clone(), node_3.clone()]);
+        tokio::time::sleep(snapshot_update_duration).await;
+        let routed_domains = route_n_times(6, Arc::clone(&route_provider));
+        assert_routed_domains(routed_domains, vec![node_1.domain(), node_3.domain()], 3);
+
+        // Test 4: multiple route() calls return 3 different domains with equal fairness (repetition).
+        // Unhealthy node is set back to healthy.
+        checker.overwrite_healthy_nodes(vec![node_1.clone(), node_2.clone(), node_3.clone()]);
+        tokio::time::sleep(snapshot_update_duration).await;
+        let routed_domains = route_n_times(6, Arc::clone(&route_provider));
+        assert_routed_domains(
+            routed_domains,
+            vec![node_1.domain(), node_2.domain(), node_3.domain()],
+            2,
+        );
+
+        // Test 5: multiple route() calls return 3 different domains with equal fairness (repetition).
+        // One healthy node is added, but another one goes unhealthy.
+        let node_4 = Node::new("api3.com").unwrap();
+        checker.overwrite_healthy_nodes(vec![node_2.clone(), node_3.clone(), node_4.clone()]);
+        fetcher.overwrite_nodes(vec![
+            node_1.clone(),
+            node_2.clone(),
+            node_3.clone(),
+            node_4.clone(),
+        ]);
+        tokio::time::sleep(snapshot_update_duration).await;
+        let routed_domains = route_n_times(6, Arc::clone(&route_provider));
+        assert_routed_domains(
+            routed_domains,
+            vec![node_2.domain(), node_3.domain(), node_4.domain()],
+            2,
+        );
+
+        // Test 6: multiple route() calls return a single domain=api1.com.
+        // One node is set to unhealthy and one is removed from the topology.
+        checker.overwrite_healthy_nodes(vec![node_2.clone(), node_3.clone()]);
+        fetcher.overwrite_nodes(vec![node_1.clone(), node_2.clone(), node_4.clone()]);
+        tokio::time::sleep(snapshot_update_duration).await;
+        let routed_domains = route_n_times(3, Arc::clone(&route_provider));
+        assert_routed_domains(routed_domains, vec![node_2.domain()], 3);
+    }
+
+    #[tokio::test]
+    async fn test_route_with_initially_unhealthy_seeds_becoming_healthy() {
+        // Setup.
+        setup_tracing();
+        let node_1 = Node::new(IC0_SEED_DOMAIN).unwrap();
+        let node_2 = Node::new("api1.com").unwrap();
+        // Set nodes fetching params: topology, fetching periodicity.
+        let fetcher = Arc::new(NodesFetcherMock::new());
+        let fetch_interval = Duration::from_secs(2);
+        // Set health checking params: healthy nodes, checking periodicity.
+        let checker = Arc::new(NodeHealthCheckerMock::new());
+        let check_interval = Duration::from_secs(1);
+        // Two nodes exist, which are initially unhealthy.
+        fetcher.overwrite_nodes(vec![node_1.clone(), node_2.clone()]);
+        checker.overwrite_healthy_nodes(vec![]);
+        // Configure RouteProvider
+        let snapshot = RoundRobinRoutingSnapshot::new();
+        let client = Client::builder().build().unwrap();
+        let route_provider = DynamicRouteProviderBuilder::new(
+            snapshot,
+            vec![node_1.clone(), node_2.clone()],
+            Arc::new(client),
+        )
+        .with_fetcher(fetcher)
+        .with_checker(checker.clone())
+        .with_fetch_period(fetch_interval)
+        .with_check_period(check_interval)
+        .build()
+        .await;
+        let route_provider = Arc::new(route_provider);
+
+        // Test 1: calls to route() return an error, as no healthy seeds exist.
+        for _ in 0..4 {
+            tokio::time::sleep(check_interval).await;
+            let result = route_provider.route();
+            assert_eq!(
+                result.unwrap_err(),
+                AgentError::RouteProviderError("No healthy API nodes found.".to_string())
+            );
+        }
+
+        // Test 2: calls to route() return both seeds, as they become healthy.
+        checker.overwrite_healthy_nodes(vec![node_1.clone(), node_2.clone()]);
+        tokio::time::sleep(3 * check_interval).await;
+        let routed_domains = route_n_times(6, Arc::clone(&route_provider));
+        assert_routed_domains(routed_domains, vec![node_1.domain(), node_2.domain()], 3);
+    }
+
+    #[tokio::test]
+    async fn test_routing_with_no_healthy_nodes_returns_an_error() {
+        // Setup.
+        setup_tracing();
+        let node_1 = Node::new(IC0_SEED_DOMAIN).unwrap();
+        // Set nodes fetching params: topology, fetching periodicity.
+        let fetcher = Arc::new(NodesFetcherMock::new());
+        let fetch_interval = Duration::from_secs(2);
+        // Set health checking params: healthy nodes, checking periodicity.
+        let checker = Arc::new(NodeHealthCheckerMock::new());
+        let check_interval = Duration::from_secs(1);
+        // A single seed node which is initially healthy.
+        fetcher.overwrite_nodes(vec![node_1.clone()]);
+        checker.overwrite_healthy_nodes(vec![node_1.clone()]);
+        // Configure RouteProvider
+        let snapshot = RoundRobinRoutingSnapshot::new();
+        let client = Client::builder().build().unwrap();
+        let route_provider =
+            DynamicRouteProviderBuilder::new(snapshot, vec![node_1.clone()], Arc::new(client))
+                .with_fetcher(fetcher)
+                .with_checker(checker.clone())
+                .with_fetch_period(fetch_interval)
+                .with_check_period(check_interval)
+                .build()
+                .await;
+        let route_provider = Arc::new(route_provider);
+
+        // Test 1: multiple route() calls return a single domain=ic0.app, as the seed is healthy.
+        tokio::time::sleep(2 * check_interval).await;
+        let routed_domains = route_n_times(3, Arc::clone(&route_provider));
+        assert_routed_domains(routed_domains, vec![node_1.domain()], 3);
+
+        // Test 2: calls to route() return an error, as no healthy nodes exist.
+        checker.overwrite_healthy_nodes(vec![]);
+        tokio::time::sleep(2 * check_interval).await;
+        for _ in 0..4 {
+            let result = route_provider.route();
+            assert_eq!(
+                result.unwrap_err(),
+                AgentError::RouteProviderError("No healthy API nodes found.".to_string())
+            );
+        }
+    }
+
+    #[tokio::test]
+    async fn test_route_with_no_healthy_seeds_errors() {
+        // Setup.
+        setup_tracing();
+        let node_1 = Node::new(IC0_SEED_DOMAIN).unwrap();
+        // Set nodes fetching params: topology, fetching periodicity.
+        let fetcher = Arc::new(NodesFetcherMock::new());
+        let fetch_interval = Duration::from_secs(2);
+        // Set health checking params: healthy nodes, checking periodicity.
+        let checker = Arc::new(NodeHealthCheckerMock::new());
+        let check_interval = Duration::from_secs(1);
+        // No healthy seed nodes present, this should lead to errors.
+        fetcher.overwrite_nodes(vec![]);
+        checker.overwrite_healthy_nodes(vec![]);
+        // Configure RouteProvider
+        let snapshot = RoundRobinRoutingSnapshot::new();
+        let client = Client::builder().build().unwrap();
+        let route_provider =
+            DynamicRouteProviderBuilder::new(snapshot, vec![node_1.clone()], Arc::new(client))
+                .with_fetcher(fetcher)
+                .with_checker(checker)
+                .with_fetch_period(fetch_interval)
+                .with_check_period(check_interval)
+                .build()
+                .await;
+
+        // Test: calls to route() return an error, as no healthy seeds exist.
+        for _ in 0..4 {
+            tokio::time::sleep(check_interval).await;
+            let result = route_provider.route();
+            assert_eq!(
+                result.unwrap_err(),
+                AgentError::RouteProviderError("No healthy API nodes found.".to_string())
+            );
+        }
+    }
+
+    #[tokio::test]
+    async fn test_route_with_one_healthy_and_one_unhealthy_seed() {
+        // Setup.
+        setup_tracing();
+        let node_1 = Node::new(IC0_SEED_DOMAIN).unwrap();
+        let node_2 = Node::new("api1.com").unwrap();
+        // Set nodes fetching params: topology, fetching periodicity.
+        let fetcher = Arc::new(NodesFetcherMock::new());
+        let fetch_interval = Duration::from_secs(2);
+        // Set health checking params: healthy nodes, checking periodicity.
+        let checker = Arc::new(NodeHealthCheckerMock::new());
+        let check_interval = Duration::from_secs(1);
+        // One healthy seed is present, it should be discovered during the initialization time.
+        fetcher.overwrite_nodes(vec![node_1.clone(), node_2.clone()]);
+        checker.overwrite_healthy_nodes(vec![node_1.clone()]);
+        // Configure RouteProvider
+        let snapshot = RoundRobinRoutingSnapshot::new();
+        let client = Client::builder().build().unwrap();
+        let route_provider = DynamicRouteProviderBuilder::new(
+            snapshot,
+            vec![node_1.clone(), node_2.clone()],
+            Arc::new(client),
+        )
+        .with_fetcher(fetcher)
+        .with_checker(checker.clone())
+        .with_fetch_period(fetch_interval)
+        .with_check_period(check_interval)
+        .build()
+        .await;
+        let route_provider = Arc::new(route_provider);
+
+        // Test 1: calls to route() return only a healthy seed ic0.app.
+        let routed_domains = route_n_times(3, Arc::clone(&route_provider));
+        assert_routed_domains(routed_domains, vec![node_1.domain()], 3);
+
+        // Test 2: calls to route() return two healthy seeds, as the unhealthy seed becomes healthy.
+        checker.overwrite_healthy_nodes(vec![node_1.clone(), node_2.clone()]);
+        tokio::time::sleep(2 * check_interval).await;
+        let routed_domains = route_n_times(6, Arc::clone(&route_provider));
+        assert_routed_domains(routed_domains, vec![node_1.domain(), node_2.domain()], 3);
+    }
+
+    #[tokio::test]
+    async fn test_routing_with_an_empty_fetched_list_of_api_nodes() {
+        // Check resiliency to an empty list of fetched API nodes (this should never happen in normal IC operation).
+        // Setup.
+        setup_tracing();
+        let node_1 = Node::new(IC0_SEED_DOMAIN).unwrap();
+        // Set nodes fetching params: topology, fetching periodicity.
+        let fetcher = Arc::new(NodesFetcherMock::new());
+        let fetch_interval = Duration::from_secs(2);
+        // Set health checking params: healthy nodes, checking periodicity.
+        let checker = Arc::new(NodeHealthCheckerMock::new());
+        let check_interval = Duration::from_secs(1);
+        // One healthy seed is initially present, but the topology has no node.
+        fetcher.overwrite_nodes(vec![]);
+        checker.overwrite_healthy_nodes(vec![node_1.clone()]);
+        // Configure RouteProvider
+        let snapshot = RoundRobinRoutingSnapshot::new();
+        let client = Client::builder().build().unwrap();
+        let route_provider =
+            DynamicRouteProviderBuilder::new(snapshot, vec![node_1.clone()], Arc::new(client))
+                .with_fetcher(fetcher.clone())
+                .with_checker(checker.clone())
+                .with_fetch_period(fetch_interval)
+                .with_check_period(check_interval)
+                .build()
+                .await;
+        let route_provider = Arc::new(route_provider);
+
+        // This time span is required for the snapshot to be fully updated with the new nodes topology and health info.
+        let snapshot_update_duration = fetch_interval + 2 * check_interval;
+
+        // Test 1: multiple route() calls return a single domain=ic0.app.
+        // HealthManagerActor shouldn't update the snapshot, if the list of fetched nodes is empty, thus we observe the healthy seed.
+        tokio::time::sleep(snapshot_update_duration).await;
+        let routed_domains = route_n_times(3, Arc::clone(&route_provider));
+        assert_routed_domains(routed_domains, vec![node_1.domain()], 3);
+
+        // Test 2: multiple route() calls should now return 3 different domains with equal fairness (repetition).
+        // Three nodes are added to the topology, i.e. now the fetched nodes list is non-empty.
+        let node_2 = Node::new("api1.com").unwrap();
+        let node_3 = Node::new("api2.com").unwrap();
+        fetcher.overwrite_nodes(vec![node_1.clone(), node_2.clone(), node_3.clone()]);
+        checker.overwrite_healthy_nodes(vec![node_1.clone(), node_2.clone(), node_3.clone()]);
+        tokio::time::sleep(snapshot_update_duration).await;
+        let routed_domains = route_n_times(6, Arc::clone(&route_provider));
+        assert_routed_domains(
+            routed_domains,
+            vec![node_1.domain(), node_2.domain(), node_3.domain()],
+            2,
+        );
+    }
+}
+
+// - none of the seeds [] are healthy
+// - none of the API node [] is healthy
+// - return a vector of errors: HealthCheckErrors, FetchErrors, etc.
diff --git a/ic-agent/src/agent/route_provider/dynamic_routing/health_check.rs b/ic-agent/src/agent/route_provider/dynamic_routing/health_check.rs
new file mode 100644
index 00000000..da15c3d4
--- /dev/null
+++ b/ic-agent/src/agent/route_provider/dynamic_routing/health_check.rs
@@ -0,0 +1,336 @@
+use async_trait::async_trait;
+use futures_util::FutureExt;
+use http::{Method, StatusCode};
+use reqwest::Request;
+use std::{
+    fmt::Debug,
+    sync::Arc,
+    time::{Duration, Instant},
+};
+use stop_token::{StopSource, StopToken};
+use url::Url;
+
+use crate::agent::{
+    route_provider::dynamic_routing::{
+        dynamic_route_provider::DynamicRouteProviderError,
+        messages::{FetchedNodes, NodeHealthState},
+        node::Node,
+        snapshot::routing_snapshot::RoutingSnapshot,
+        type_aliases::{AtomicSwap, ReceiverMpsc, ReceiverWatch, SenderMpsc},
+    },
+    HttpService,
+};
+
+const CHANNEL_BUFFER: usize = 128;
+
+/// A trait representing a health check of the node.
+#[cfg_attr(target_family = "wasm", async_trait(?Send))]
+#[cfg_attr(not(target_family = "wasm"), async_trait)]
+pub trait HealthCheck: Send + Sync + Debug {
+    /// Checks the health of the node.
+    async fn check(&self, node: &Node) -> Result<HealthCheckStatus, DynamicRouteProviderError>;
+}
+
+/// A struct representing the health check status of the node.
+#[derive(Clone, PartialEq, Debug, Default)]
+pub struct HealthCheckStatus {
+    latency: Option<Duration>,
+}
+
+impl HealthCheckStatus {
+    /// Creates a new `HealthCheckStatus` instance.
+    pub fn new(latency: Option<Duration>) -> Self {
+        Self { latency }
+    }
+
+    /// Checks if the node is healthy.
+    pub fn is_healthy(&self) -> bool {
+        self.latency.is_some()
+    }
+
+    /// Get the latency of the health check.
+    pub fn latency(&self) -> Option<Duration> {
+        self.latency
+    }
+}
+
+/// A struct implementing the `HealthCheck` for the nodes.
+#[derive(Debug)]
+pub struct HealthChecker {
+    http_client: Arc<dyn HttpService>,
+    #[cfg(not(target_family = "wasm"))]
+    timeout: Duration,
+}
+
+impl HealthChecker {
+    /// Creates a new `HealthChecker` instance.
+    pub fn new(
+        http_client: Arc<dyn HttpService>,
+        #[cfg(not(target_family = "wasm"))] timeout: Duration,
+    ) -> Self {
+        Self {
+            http_client,
+            #[cfg(not(target_family = "wasm"))]
+            timeout,
+        }
+    }
+}
+
+const HEALTH_CHECKER: &str = "HealthChecker";
+
+#[cfg_attr(target_family = "wasm", async_trait(?Send))]
+#[cfg_attr(not(target_family = "wasm"), async_trait)]
+impl HealthCheck for HealthChecker {
+    #[allow(unused_mut)]
+    async fn check(&self, node: &Node) -> Result<HealthCheckStatus, DynamicRouteProviderError> {
+        // API boundary node exposes /health endpoint and should respond with 204 (No Content) if it's healthy.
+        let url = Url::parse(&format!("https://{}/health", node.domain())).unwrap();
+
+        let mut request = Request::new(Method::GET, url.clone());
+        #[cfg(not(target_family = "wasm"))]
+        {
+            *request.timeout_mut() = Some(self.timeout);
+        }
+
+        let start = Instant::now();
+        let response = self
+            .http_client
+            .call(&|| Ok(request.try_clone().unwrap()), 1)
+            .await
+            .map_err(|err| {
+                DynamicRouteProviderError::HealthCheckError(format!(
+                    "Failed to execute GET request to {url}: {err}"
+                ))
+            })?;
+        let latency = start.elapsed();
+
+        if response.status() != StatusCode::NO_CONTENT {
+            let err_msg = format!(
+                "{HEALTH_CHECKER}: Unexpected http status code {} for url={url} received",
+                response.status()
+            );
+            log!(error, err_msg);
+            return Err(DynamicRouteProviderError::HealthCheckError(err_msg));
+        }
+
+        Ok(HealthCheckStatus::new(Some(latency)))
+    }
+}
+
+#[allow(unused)]
+const HEALTH_CHECK_ACTOR: &str = "HealthCheckActor";
+
+/// A struct performing the health check of the node and sending the health status to the listener.
+struct HealthCheckActor {
+    /// The health checker.
+    checker: Arc<dyn HealthCheck>,
+    /// The period of the health check.
+    period: Duration,
+    /// The node to check.
+    node: Node,
+    /// The sender channel (listener) to send the health status.
+    sender_channel: SenderMpsc<NodeHealthState>,
+    /// The cancellation token of the actor.
+    token: StopToken,
+}
+
+impl HealthCheckActor {
+    fn new(
+        checker: Arc<dyn HealthCheck>,
+        period: Duration,
+        node: Node,
+        sender_channel: SenderMpsc<NodeHealthState>,
+        token: StopToken,
+    ) -> Self {
+        Self {
+            checker,
+            period,
+            node,
+            sender_channel,
+            token,
+        }
+    }
+
+    /// Runs the actor.
+    async fn run(self) {
+        loop {
+            let health = self.checker.check(&self.node).await.unwrap_or_default();
+            let message = NodeHealthState {
+                node: self.node.clone(),
+                health,
+            };
+            // Inform the listener about node's health. It can only fail if the listener was closed/dropped.
+            self.sender_channel
+                .send(message)
+                .await
+                .expect("Failed to send node's health state");
+            futures_util::select! {
+                _ = crate::util::sleep(self.period).fuse() => {
+                    continue;
+                }
+                _ = self.token.clone().fuse() => {
+                    log!(info, "{HEALTH_CHECK_ACTOR}: was gracefully cancelled for node {:?}", self.node);
+                    break;
+                }
+            }
+        }
+    }
+}
+
+/// The name of the health manager actor.
+#[allow(unused)]
+pub(super) const HEALTH_MANAGER_ACTOR: &str = "HealthManagerActor";
+
+/// A struct managing the health checks of the nodes.
+/// It receives the fetched nodes from the `NodesFetchActor` and starts the health checks for them.
+/// It also receives the health status of the nodes from the `HealthCheckActor/s` and updates the routing snapshot.
+pub(super) struct HealthManagerActor<S> {
+    /// The health checker.
+    checker: Arc<dyn HealthCheck>,
+    /// The period of the health check.
+    period: Duration,
+    /// The routing snapshot, storing the nodes.   
+    routing_snapshot: AtomicSwap<S>,
+    /// The receiver channel to listen to the fetched nodes messages.
+    fetch_receiver: ReceiverWatch<FetchedNodes>,
+    /// The sender channel to send the health status of the nodes back to HealthManagerActor.
+    check_sender: SenderMpsc<NodeHealthState>,
+    /// The receiver channel to receive the health status of the nodes from the `HealthCheckActor/s`.
+    check_receiver: ReceiverMpsc<NodeHealthState>,
+    /// The sender channel to send the initialization status to DynamicRouteProvider (used only once in the init phase).
+    init_sender: SenderMpsc<bool>,
+    /// The cancellation token of the actor.
+    token: StopToken,
+    /// The cancellation token for all the health checks.
+    nodes_token: StopSource,
+    /// The flag indicating if this actor is initialized with healthy nodes.
+    is_initialized: bool,
+}
+
+impl<S> HealthManagerActor<S>
+where
+    S: RoutingSnapshot,
+{
+    /// Creates a new `HealthManagerActor` instance.
+    pub fn new(
+        checker: Arc<dyn HealthCheck>,
+        period: Duration,
+        routing_snapshot: AtomicSwap<S>,
+        fetch_receiver: ReceiverWatch<FetchedNodes>,
+        init_sender: SenderMpsc<bool>,
+        token: StopToken,
+    ) -> Self {
+        let (check_sender, check_receiver) = async_channel::bounded(CHANNEL_BUFFER);
+
+        Self {
+            checker,
+            period,
+            routing_snapshot,
+            fetch_receiver,
+            check_sender,
+            check_receiver,
+            init_sender,
+            token,
+            nodes_token: StopSource::new(),
+            is_initialized: false,
+        }
+    }
+
+    /// Runs the actor.
+    pub async fn run(mut self) {
+        loop {
+            futures_util::select! {
+                // Process a new array of fetched nodes from NodesFetchActor, if it appeared in the channel.
+                result = self.fetch_receiver.recv().fuse() => {
+                    let value = match result {
+                        Ok(value) => value,
+                        Err(_err) => {
+                            log!(error, "{HEALTH_MANAGER_ACTOR}: nodes fetch sender has been dropped: {_err:?}");
+                            continue;
+                        }
+                    };
+                    // Get the latest value from the channel and mark it as seen.
+                    let Some(FetchedNodes { nodes }) = value else { continue };
+                    self.handle_fetch_update(nodes).await;
+                }
+                // Receive health check messages from all running HealthCheckActor/s.
+                msg_opt = self.check_receiver.recv().fuse() => {
+                    if let Ok(msg) = msg_opt {
+                        self.handle_health_update(msg).await;
+                    }
+                }
+                _ = self.token.clone().fuse() => {
+                    self.stop_all_checks().await;
+                    self.check_receiver.close();
+                    log!(warn, "{HEALTH_MANAGER_ACTOR}: was gracefully cancelled, all nodes health checks stopped");
+                    break;
+                }
+            }
+        }
+    }
+
+    async fn handle_health_update(&mut self, msg: NodeHealthState) {
+        let current_snapshot = self.routing_snapshot.load_full();
+        let mut new_snapshot = (*current_snapshot).clone();
+        new_snapshot.update_node(&msg.node, msg.health.clone());
+        self.routing_snapshot.store(Arc::new(new_snapshot));
+        if !self.is_initialized && msg.health.is_healthy() {
+            self.is_initialized = true;
+            // If TIMEOUT_AWAIT_HEALTHY_SEED has been exceeded, the receiver was dropped and send would thus fail. We ignore the failure.
+            let _ = self.init_sender.send(true).await;
+        }
+    }
+
+    async fn handle_fetch_update(&mut self, nodes: Vec<Node>) {
+        if nodes.is_empty() {
+            // This is a bug in the IC registry. There should be at least one API Boundary Node in the registry.
+            // Updating nodes snapshot with an empty array, would lead to an irrecoverable error, as new nodes couldn't be fetched.
+            // We avoid such updates and just wait for a non-empty list.
+            log!(
+                error,
+                "{HEALTH_MANAGER_ACTOR}: list of fetched nodes is empty"
+            );
+            return;
+        }
+        log!(
+            debug,
+            "{HEALTH_MANAGER_ACTOR}: fetched nodes received {:?}",
+            nodes
+        );
+        let current_snapshot = self.routing_snapshot.load_full();
+        let mut new_snapshot = (*current_snapshot).clone();
+        // If the snapshot has changed, store it and restart all node's health checks.
+        if new_snapshot.sync_nodes(&nodes) {
+            self.routing_snapshot.store(Arc::new(new_snapshot));
+            self.stop_all_checks().await;
+            self.start_checks(nodes.to_vec());
+        }
+    }
+
+    fn start_checks(&mut self, nodes: Vec<Node>) {
+        // Create a single cancellation token for all started health checks.
+        self.nodes_token = StopSource::new();
+        for node in nodes {
+            log!(
+                debug,
+                "{HEALTH_MANAGER_ACTOR}: starting health check for node {node:?}"
+            );
+            let actor = HealthCheckActor::new(
+                Arc::clone(&self.checker),
+                self.period,
+                node,
+                self.check_sender.clone(),
+                self.nodes_token.token(),
+            );
+            crate::util::spawn(async move { actor.run().await });
+        }
+    }
+
+    async fn stop_all_checks(&mut self) {
+        log!(
+            warn,
+            "{HEALTH_MANAGER_ACTOR}: stopping all running health checks"
+        );
+        self.nodes_token = StopSource::new();
+    }
+}
diff --git a/ic-agent/src/agent/route_provider/dynamic_routing/messages.rs b/ic-agent/src/agent/route_provider/dynamic_routing/messages.rs
new file mode 100644
index 00000000..61876389
--- /dev/null
+++ b/ic-agent/src/agent/route_provider/dynamic_routing/messages.rs
@@ -0,0 +1,16 @@
+use crate::agent::route_provider::dynamic_routing::{health_check::HealthCheckStatus, node::Node};
+
+/// Represents a message with fetched nodes.
+#[derive(Debug, Clone)]
+pub struct FetchedNodes {
+    /// The fetched nodes.
+    pub nodes: Vec<Node>,
+}
+
+/// Represents a message with the health state of a node.
+pub struct NodeHealthState {
+    /// The node.
+    pub node: Node,
+    /// The health state of the node.
+    pub health: HealthCheckStatus,
+}
diff --git a/ic-agent/src/agent/route_provider/dynamic_routing/mod.rs b/ic-agent/src/agent/route_provider/dynamic_routing/mod.rs
new file mode 100644
index 00000000..5bfc2af1
--- /dev/null
+++ b/ic-agent/src/agent/route_provider/dynamic_routing/mod.rs
@@ -0,0 +1,20 @@
+//! Dynamic routing implementation.
+//!
+//! This is an internal unstable feature. The guts of this system are not subject to semver and are likely to change.
+
+pub mod dynamic_route_provider;
+/// Health check implementation.
+pub mod health_check;
+/// Messages used in dynamic routing.
+pub(super) mod messages;
+/// Node implementation.
+pub mod node;
+/// Nodes fetch implementation.
+pub mod nodes_fetch;
+/// Routing snapshot implementation.
+pub mod snapshot;
+#[cfg(test)]
+#[cfg_attr(target_family = "wasm", allow(unused))]
+pub(super) mod test_utils;
+/// Type aliases used in dynamic routing.
+pub(super) mod type_aliases;
diff --git a/ic-agent/src/agent/route_provider/dynamic_routing/node.rs b/ic-agent/src/agent/route_provider/dynamic_routing/node.rs
new file mode 100644
index 00000000..cd02ddce
--- /dev/null
+++ b/ic-agent/src/agent/route_provider/dynamic_routing/node.rs
@@ -0,0 +1,53 @@
+use url::Url;
+
+use crate::agent::ApiBoundaryNode;
+
+/// Represents a node in the dynamic routing.
+#[derive(Debug, Clone, PartialEq, Eq, Hash)]
+pub struct Node {
+    domain: String,
+}
+
+impl Node {
+    /// Creates a new `Node` instance from the domain name.
+    pub fn new(domain: impl Into<String>) -> Result<Self, url::ParseError> {
+        let domain = domain.into();
+        check_valid_domain(&domain)?;
+        Ok(Self { domain })
+    }
+
+    /// Returns the domain name of the node.
+    pub fn domain(&self) -> &str {
+        &self.domain
+    }
+}
+
+impl Node {
+    /// Converts the node to a routing URL.
+    pub fn to_routing_url(&self) -> Url {
+        Url::parse(&format!("https://{}", self.domain)).expect("failed to parse URL")
+    }
+}
+
+impl From<&Node> for Url {
+    fn from(node: &Node) -> Self {
+        // Parsing can't fail, as the domain was checked at node instantiation.
+        Url::parse(&format!("https://{}", node.domain)).expect("failed to parse URL")
+    }
+}
+
+impl TryFrom<ApiBoundaryNode> for Node {
+    type Error = url::ParseError;
+
+    fn try_from(value: ApiBoundaryNode) -> Result<Self, Self::Error> {
+        Node::new(value.domain)
+    }
+}
+
+/// Checks if the given domain is a valid URL.
+fn check_valid_domain<S: AsRef<str>>(domain: S) -> Result<(), url::ParseError> {
+    // Prepend scheme to make it a valid URL
+    let url_string = format!("http://{}", domain.as_ref());
+    Url::parse(&url_string)?;
+    Ok(())
+}
diff --git a/ic-agent/src/agent/route_provider/dynamic_routing/nodes_fetch.rs b/ic-agent/src/agent/route_provider/dynamic_routing/nodes_fetch.rs
new file mode 100644
index 00000000..3318f03d
--- /dev/null
+++ b/ic-agent/src/agent/route_provider/dynamic_routing/nodes_fetch.rs
@@ -0,0 +1,181 @@
+use async_trait::async_trait;
+use candid::Principal;
+use futures_util::FutureExt;
+use std::{fmt::Debug, sync::Arc, time::Duration};
+use stop_token::StopToken;
+use url::Url;
+
+#[allow(unused)]
+use crate::agent::route_provider::dynamic_routing::health_check::HEALTH_MANAGER_ACTOR;
+use crate::agent::{
+    route_provider::dynamic_routing::{
+        dynamic_route_provider::DynamicRouteProviderError,
+        messages::FetchedNodes,
+        node::Node,
+        snapshot::routing_snapshot::RoutingSnapshot,
+        type_aliases::{AtomicSwap, SenderWatch},
+    },
+    Agent, HttpService,
+};
+#[allow(unused)]
+const NODES_FETCH_ACTOR: &str = "NodesFetchActor";
+
+/// Fetcher of nodes in the topology.
+#[cfg_attr(target_family = "wasm", async_trait(?Send))]
+#[cfg_attr(not(target_family = "wasm"), async_trait)]
+pub trait Fetch: Sync + Send + Debug {
+    /// Fetches the nodes from the topology.
+    async fn fetch(&self, url: Url) -> Result<Vec<Node>, DynamicRouteProviderError>;
+}
+
+/// A struct representing the fetcher of the nodes from the topology.
+#[derive(Debug)]
+pub struct NodesFetcher {
+    http_client: Arc<dyn HttpService>,
+    subnet_id: Principal,
+    // By default, the nodes fetcher is configured to talk to the mainnet of Internet Computer, and verifies responses using a hard-coded public key.
+    // However, for testnets one can set up a custom public key.
+    root_key: Option<Vec<u8>>,
+}
+
+impl NodesFetcher {
+    /// Creates a new `NodesFetcher` instance.
+    pub fn new(
+        http_client: Arc<dyn HttpService>,
+        subnet_id: Principal,
+        root_key: Option<Vec<u8>>,
+    ) -> Self {
+        Self {
+            http_client,
+            subnet_id,
+            root_key,
+        }
+    }
+}
+
+#[cfg_attr(target_family = "wasm", async_trait(?Send))]
+#[cfg_attr(not(target_family = "wasm"), async_trait)]
+impl Fetch for NodesFetcher {
+    async fn fetch(&self, url: Url) -> Result<Vec<Node>, DynamicRouteProviderError> {
+        let agent = Agent::builder()
+            .with_url(url)
+            .with_arc_http_middleware(self.http_client.clone())
+            .build()
+            .map_err(|err| {
+                DynamicRouteProviderError::NodesFetchError(format!(
+                    "Failed to build the agent: {err}"
+                ))
+            })?;
+        if let Some(key) = self.root_key.clone() {
+            agent.set_root_key(key);
+        }
+        let api_bns = agent
+            .fetch_api_boundary_nodes_by_subnet_id(self.subnet_id)
+            .await
+            .map_err(|err| {
+                DynamicRouteProviderError::NodesFetchError(format!(
+                    "Failed to fetch API nodes: {err}"
+                ))
+            })?;
+        // If some API BNs have invalid domain names, they are discarded.
+        let nodes = api_bns
+            .into_iter()
+            .filter_map(|api_node| api_node.try_into().ok())
+            .collect();
+        return Ok(nodes);
+    }
+}
+
+/// A struct representing the actor responsible for fetching existing nodes and communicating it with the listener.
+pub(super) struct NodesFetchActor<S> {
+    /// The fetcher object responsible for fetching the nodes.
+    fetcher: Arc<dyn Fetch>,
+    /// Time period between fetches.
+    period: Duration,
+    /// The interval to wait before retrying to fetch the nodes in case of failures.
+    fetch_retry_interval: Duration,
+    /// Communication channel with the listener.
+    fetch_sender: SenderWatch<FetchedNodes>,
+    /// The snapshot of the routing table.
+    routing_snapshot: AtomicSwap<S>,
+    /// The token to cancel/stop the actor.
+    token: StopToken,
+}
+
+impl<S> NodesFetchActor<S>
+where
+    S: RoutingSnapshot,
+{
+    /// Creates a new `NodesFetchActor` instance.
+    pub fn new(
+        fetcher: Arc<dyn Fetch>,
+        period: Duration,
+        retry_interval: Duration,
+        fetch_sender: SenderWatch<FetchedNodes>,
+        snapshot: AtomicSwap<S>,
+        token: StopToken,
+    ) -> Self {
+        Self {
+            fetcher,
+            period,
+            fetch_retry_interval: retry_interval,
+            fetch_sender,
+            routing_snapshot: snapshot,
+            token,
+        }
+    }
+
+    /// Runs the actor.
+    pub async fn run(self) {
+        loop {
+            // Retry until success:
+            // - try to get a healthy node from the routing snapshot
+            //   - if snapshot is empty, break the cycle and wait for the next fetch cycle
+            // - using the healthy node, try to fetch nodes from topology
+            //   - if failure, sleep and retry
+            // - try send fetched nodes to the listener
+            //   - failure should never happen, but we trace it if it does
+            loop {
+                let snapshot = self.routing_snapshot.load();
+                if let Some(node) = snapshot.next_node() {
+                    match self.fetcher.fetch((&node).into()).await {
+                        Ok(nodes) => {
+                            let msg = Some(FetchedNodes { nodes });
+                            match self.fetch_sender.send(msg) {
+                                Ok(()) => break, // message sent successfully, exist the loop
+                                Err(_err) => {
+                                    log!(error, "{NODES_FETCH_ACTOR}: failed to send results to {HEALTH_MANAGER_ACTOR}: {_err:?}");
+                                }
+                            }
+                        }
+                        Err(_err) => {
+                            log!(
+                                error,
+                                "{NODES_FETCH_ACTOR}: failed to fetch nodes: {_err:?}"
+                            );
+                        }
+                    };
+                } else {
+                    // No healthy nodes in the snapshot, break the cycle and wait for the next fetch cycle
+                    log!(error, "{NODES_FETCH_ACTOR}: no nodes in the snapshot");
+                    break;
+                };
+                log!(
+                    warn,
+                    "Retrying to fetch the nodes in {:?}",
+                    self.fetch_retry_interval
+                );
+                crate::util::sleep(self.fetch_retry_interval).await;
+            }
+            futures_util::select! {
+                _ = crate::util::sleep(self.period).fuse() => {
+                    continue;
+                }
+                _ = self.token.clone().fuse() => {
+                    log!(warn, "{NODES_FETCH_ACTOR}: was gracefully cancelled");
+                    break;
+                }
+            }
+        }
+    }
+}
diff --git a/ic-agent/src/agent/route_provider/dynamic_routing/snapshot/latency_based_routing.rs b/ic-agent/src/agent/route_provider/dynamic_routing/snapshot/latency_based_routing.rs
new file mode 100644
index 00000000..028bbb2c
--- /dev/null
+++ b/ic-agent/src/agent/route_provider/dynamic_routing/snapshot/latency_based_routing.rs
@@ -0,0 +1,644 @@
+use std::{
+    collections::{HashSet, VecDeque},
+    time::Duration,
+};
+
+use rand::Rng;
+
+use crate::agent::route_provider::dynamic_routing::{
+    health_check::HealthCheckStatus, node::Node, snapshot::routing_snapshot::RoutingSnapshot,
+};
+
+// Determines the size of the sliding window used for storing latencies and availabilities of nodes.
+const WINDOW_SIZE: usize = 15;
+// Determines the decay rate of the exponential decay function, which is used for generating weights over the sliding window.
+const LAMBDA_DECAY: f64 = 0.3;
+
+/// Generates exponentially decaying weights for the sliding window.
+fn generate_exp_decaying_weights(n: usize, lambda: f64) -> Vec<f64> {
+    let mut weights: Vec<f64> = Vec::with_capacity(n);
+    for i in 0..n {
+        let weight = (-lambda * i as f64).exp();
+        weights.push(weight);
+    }
+    weights
+}
+
+// Node with meta information and metrics (latencies, availabilities).
+// Routing URLs a generated based on the score field.
+#[derive(Clone, Debug)]
+struct NodeWithMetrics {
+    // Node information.
+    node: Node,
+    // Size of the sliding window used for store latencies and availabilities of the node.
+    window_size: usize,
+    /// Reflects the status of the most recent health check. It should be the same as the last element in `availabilities`.
+    is_healthy: bool,
+    /// Sliding window with latency measurements.
+    latencies: VecDeque<f64>,
+    /// Sliding window with availability measurements.
+    availabilities: VecDeque<bool>,
+    /// Overall score of the node. Calculated based on latencies and availabilities arrays. This score is used in `next_n_nodes()` and `next_node()` methods.
+    score: f64,
+}
+
+impl NodeWithMetrics {
+    pub fn new(node: Node, window_size: usize) -> Self {
+        Self {
+            node,
+            window_size,
+            is_healthy: false,
+            latencies: VecDeque::with_capacity(window_size + 1),
+            availabilities: VecDeque::with_capacity(window_size + 1),
+            score: 0.0,
+        }
+    }
+
+    pub fn add_latency_measurement(&mut self, latency: Option<Duration>) {
+        self.is_healthy = latency.is_some();
+        if let Some(duration) = latency {
+            self.latencies.push_back(duration.as_secs_f64());
+            while self.latencies.len() > self.window_size {
+                self.latencies.pop_front();
+            }
+            self.availabilities.push_back(true);
+        } else {
+            self.availabilities.push_back(false);
+        }
+        while self.availabilities.len() > self.window_size {
+            self.availabilities.pop_front();
+        }
+    }
+}
+
+/// Computes the score of the node based on the latencies, availabilities and window weights.
+/// `window_weights_sum`` is passed for efficiency reasons, as it is pre-calculated.
+fn compute_score(
+    window_weights: &[f64],
+    window_weights_sum: f64,
+    availabilities: &VecDeque<bool>,
+    latencies: &VecDeque<f64>,
+    use_availability_penalty: bool,
+) -> f64 {
+    let weights_size = window_weights.len();
+    let availabilities_size = availabilities.len();
+    let latencies_size = latencies.len();
+
+    if weights_size < availabilities_size {
+        panic!(
+            "Weights array of size {weights_size} is smaller than array of availabilities of size {availabilities_size}",
+        );
+    } else if weights_size < latencies_size {
+        panic!(
+            "Weights array of size {weights_size} is smaller than array of latencies of size {latencies_size}",
+        );
+    }
+
+    // Compute normalized availability score [0.0, 1.0].
+    let score_a = if !use_availability_penalty {
+        1.0
+    } else if availabilities.is_empty() {
+        0.0
+    } else {
+        let mut score = 0.0;
+
+        // Compute weighted score. Weights are applied in reverse order.
+        for (idx, availability) in availabilities.iter().rev().enumerate() {
+            score += window_weights[idx] * (*availability as u8 as f64);
+        }
+
+        // Normalize the score.
+        let weights_sum = if availabilities_size < weights_size {
+            // Use partial sum of weights, if the window is not full.
+            let partial_weights_sum: f64 = window_weights.iter().take(availabilities_size).sum();
+            partial_weights_sum
+        } else {
+            // Use pre-calculated sum, if the window is full.
+            window_weights_sum
+        };
+
+        score /= weights_sum;
+
+        score
+    };
+
+    // Compute latency score (not normalized).
+    let score_l = if latencies.is_empty() {
+        0.0
+    } else {
+        let mut score = 0.0;
+
+        // Compute weighted score. Weights are applied in reverse order. Latency is inverted, so that smaller latencies have higher score.
+        for (idx, latency) in latencies.iter().rev().enumerate() {
+            score += window_weights[idx] / latency;
+        }
+
+        let weights_sum = if latencies_size < weights_size {
+            let partial_weights_sum: f64 = window_weights.iter().take(latencies.len()).sum();
+            partial_weights_sum
+        } else {
+            // Use pre-calculated sum.
+            window_weights_sum
+        };
+
+        score /= weights_sum;
+
+        score
+    };
+
+    // Combine availability and latency scores via product to emphasize the importance of both metrics.
+    score_l * score_a
+}
+
+/// Routing snapshot for latency-based routing.
+/// In this routing strategy, nodes are randomly selected based on their averaged latency of the last WINDOW_SIZE health checks.
+/// Nodes with smaller average latencies are preferred for routing.
+#[derive(Default, Debug, Clone)]
+pub struct LatencyRoutingSnapshot {
+    nodes_with_metrics: Vec<NodeWithMetrics>,
+    existing_nodes: HashSet<Node>,
+    window_weights: Vec<f64>,
+    window_weights_sum: f64,
+    use_availability_penalty: bool,
+}
+
+/// Implementation of the LatencyRoutingSnapshot.
+impl LatencyRoutingSnapshot {
+    /// Creates a new LatencyRoutingSnapshot.
+    pub fn new() -> Self {
+        // Weights are ordered from left to right, where the leftmost weight is for the most recent health check.
+        let window_weights = generate_exp_decaying_weights(WINDOW_SIZE, LAMBDA_DECAY);
+        // Pre-calculate the sum of weights for efficiency reasons.
+        let window_weights_sum: f64 = window_weights.iter().sum();
+
+        Self {
+            nodes_with_metrics: vec![],
+            existing_nodes: HashSet::new(),
+            use_availability_penalty: true,
+            window_weights,
+            window_weights_sum,
+        }
+    }
+
+    /// Sets whether to use availability penalty in the score computation.
+    #[allow(unused)]
+    pub fn set_availability_penalty(mut self, use_penalty: bool) -> Self {
+        self.use_availability_penalty = use_penalty;
+        self
+    }
+
+    /// Sets the weights for the sliding window.
+    /// The weights are ordered from left to right, where the leftmost weight is for the most recent health check.
+    #[allow(unused)]
+    pub fn set_window_weights(mut self, weights: &[f64]) -> Self {
+        self.window_weights_sum = weights.iter().sum();
+        self.window_weights = weights.to_vec();
+        self
+    }
+}
+
+/// Helper function to sample nodes based on their weights.
+/// Here weight index is selected based on the input number in range [0, 1]
+#[inline(always)]
+fn weighted_sample(weighted_nodes: &[(f64, &Node)], number: f64) -> Option<usize> {
+    if !(0.0..=1.0).contains(&number) {
+        return None;
+    }
+    let sum: f64 = weighted_nodes.iter().map(|n| n.0).sum();
+    let mut weighted_number = number * sum;
+    for (idx, &(weight, _)) in weighted_nodes.iter().enumerate() {
+        weighted_number -= weight;
+        if weighted_number <= 0.0 {
+            return Some(idx);
+        }
+    }
+    None
+}
+
+impl RoutingSnapshot for LatencyRoutingSnapshot {
+    fn has_nodes(&self) -> bool {
+        self.nodes_with_metrics.iter().any(|n| n.is_healthy)
+    }
+
+    fn next_node(&self) -> Option<Node> {
+        self.next_n_nodes(1).into_iter().next()
+    }
+
+    // Uses weighted random sampling algorithm n times. Node can be selected at most once (sampling without replacement).
+    fn next_n_nodes(&self, n: usize) -> Vec<Node> {
+        if n == 0 {
+            return Vec::new();
+        }
+
+        // Preallocate array for a better efficiency.
+        let mut healthy_nodes = Vec::with_capacity(self.nodes_with_metrics.len());
+        for n in &self.nodes_with_metrics {
+            if n.is_healthy {
+                healthy_nodes.push((n.score, &n.node));
+            }
+        }
+
+        // Limit the number of returned nodes to the number of healthy nodes.
+        let n = std::cmp::min(n, healthy_nodes.len());
+
+        let mut nodes = Vec::with_capacity(n);
+
+        let mut rng = rand::thread_rng();
+
+        for _ in 0..n {
+            // Generate a random float in the range [0, 1)
+            let rand_num = rng.gen::<f64>();
+            if let Some(idx) = weighted_sample(healthy_nodes.as_slice(), rand_num) {
+                let node = healthy_nodes[idx].1;
+                nodes.push(node.clone());
+                // Remove the item, so that it can't be selected anymore.
+                healthy_nodes.swap_remove(idx);
+            }
+        }
+
+        nodes
+    }
+
+    fn sync_nodes(&mut self, nodes: &[Node]) -> bool {
+        let new_nodes = HashSet::from_iter(nodes.iter().cloned());
+        // Find nodes removed from topology.
+        let nodes_removed: Vec<_> = self
+            .existing_nodes
+            .difference(&new_nodes)
+            .cloned()
+            .collect();
+        let has_removed_nodes = !nodes_removed.is_empty();
+        // Find nodes added to topology.
+        let nodes_added: Vec<_> = new_nodes
+            .difference(&self.existing_nodes)
+            .cloned()
+            .collect();
+        let has_added_nodes = !nodes_added.is_empty();
+        self.existing_nodes.extend(nodes_added);
+        // NOTE: newly added nodes will appear in the weighted_nodes later.
+        // This happens after the first node health check round and a consequent update_node() invocation.
+        for node in nodes_removed.into_iter() {
+            self.existing_nodes.remove(&node);
+            let idx = self.nodes_with_metrics.iter().position(|x| x.node == node);
+            idx.map(|idx| self.nodes_with_metrics.swap_remove(idx));
+        }
+
+        has_added_nodes || has_removed_nodes
+    }
+
+    fn update_node(&mut self, node: &Node, health: HealthCheckStatus) -> bool {
+        // Skip the update if the node is not in the existing nodes.
+        if !self.existing_nodes.contains(node) {
+            return false;
+        }
+
+        let idx = self
+            .nodes_with_metrics
+            .iter()
+            .position(|x| &x.node == node)
+            .unwrap_or_else(|| {
+                let node = NodeWithMetrics::new(node.clone(), self.window_weights.len());
+                self.nodes_with_metrics.push(node);
+                self.nodes_with_metrics.len() - 1
+            });
+
+        self.nodes_with_metrics[idx].add_latency_measurement(health.latency());
+
+        self.nodes_with_metrics[idx].score = compute_score(
+            self.window_weights.as_slice(),
+            self.window_weights_sum,
+            &self.nodes_with_metrics[idx].availabilities,
+            &self.nodes_with_metrics[idx].latencies,
+            self.use_availability_penalty,
+        );
+
+        true
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::{
+        collections::{HashMap, HashSet, VecDeque},
+        time::Duration,
+    };
+
+    use crate::agent::route_provider::dynamic_routing::{
+        health_check::HealthCheckStatus,
+        node::Node,
+        snapshot::{
+            latency_based_routing::{
+                compute_score, weighted_sample, LatencyRoutingSnapshot, NodeWithMetrics,
+            },
+            routing_snapshot::RoutingSnapshot,
+        },
+    };
+
+    #[test]
+    fn test_snapshot_init() {
+        // Arrange
+        let snapshot = LatencyRoutingSnapshot::new();
+        // Assert
+        assert!(snapshot.nodes_with_metrics.is_empty());
+        assert!(snapshot.existing_nodes.is_empty());
+        assert!(!snapshot.has_nodes());
+        assert!(snapshot.next_node().is_none());
+        assert!(snapshot.next_n_nodes(1).is_empty());
+    }
+
+    #[test]
+    fn test_update_for_non_existing_node_fails() {
+        // Arrange
+        let mut snapshot = LatencyRoutingSnapshot::new();
+        let node = Node::new("api1.com").unwrap();
+        let health = HealthCheckStatus::new(Some(Duration::from_secs(1)));
+        // Act
+        let is_updated = snapshot.update_node(&node, health);
+        // Assert
+        assert!(!is_updated);
+        assert!(snapshot.nodes_with_metrics.is_empty());
+        assert!(!snapshot.has_nodes());
+        assert!(snapshot.next_node().is_none());
+    }
+
+    #[test]
+    fn test_update_for_existing_node_succeeds() {
+        // Arrange
+        let mut snapshot = LatencyRoutingSnapshot::new()
+            .set_window_weights(&[2.0, 1.0])
+            .set_availability_penalty(false);
+        let node = Node::new("api1.com").unwrap();
+        let health = HealthCheckStatus::new(Some(Duration::from_secs(1)));
+        snapshot.existing_nodes.insert(node.clone());
+        // Check first update
+        let is_updated = snapshot.update_node(&node, health);
+        assert!(is_updated);
+        assert!(snapshot.has_nodes());
+        let node_with_metrics = snapshot.nodes_with_metrics.first().unwrap();
+        assert_eq!(node_with_metrics.score, (2.0 / 1.0) / 2.0);
+        assert_eq!(snapshot.next_node().unwrap(), node);
+        // Check second update
+        let health = HealthCheckStatus::new(Some(Duration::from_secs(2)));
+        let is_updated = snapshot.update_node(&node, health);
+        assert!(is_updated);
+        let node_with_metrics = snapshot.nodes_with_metrics.first().unwrap();
+        assert_eq!(node_with_metrics.score, (2.0 / 2.0 + 1.0 / 1.0) / 3.0);
+        // Check third update
+        let health = HealthCheckStatus::new(Some(Duration::from_secs(3)));
+        let is_updated = snapshot.update_node(&node, health);
+        assert!(is_updated);
+        let node_with_metrics = snapshot.nodes_with_metrics.first().unwrap();
+        assert_eq!(node_with_metrics.score, (2.0 / 3.0 + 1.0 / 2.0) / 3.0);
+        // Check forth update with none
+        let health = HealthCheckStatus::new(None);
+        let is_updated = snapshot.update_node(&node, health);
+        assert!(is_updated);
+        let node_with_metrics = snapshot.nodes_with_metrics.first().unwrap();
+        assert_eq!(node_with_metrics.score, (2.0 / 3.0 + 1.0 / 2.0) / 3.0);
+        assert!(!snapshot.has_nodes());
+        assert_eq!(snapshot.nodes_with_metrics.len(), 1);
+        assert_eq!(snapshot.existing_nodes.len(), 1);
+        assert!(snapshot.next_node().is_none());
+    }
+
+    #[test]
+    fn test_sync_node_scenarios() {
+        // Arrange
+        let window_size = 1;
+        let mut snapshot = LatencyRoutingSnapshot::new();
+        let node_1 = Node::new("api1.com").unwrap();
+        // Sync with node_1
+        let nodes_changed = snapshot.sync_nodes(&[node_1.clone()]);
+        assert!(nodes_changed);
+        assert!(snapshot.nodes_with_metrics.is_empty());
+        assert_eq!(
+            snapshot.existing_nodes,
+            HashSet::from_iter(vec![node_1.clone()])
+        );
+        // Add node_1 to weighted_nodes manually
+        snapshot
+            .nodes_with_metrics
+            .push(NodeWithMetrics::new(node_1.clone(), window_size));
+        // Sync with node_1 again
+        let nodes_changed = snapshot.sync_nodes(&[node_1.clone()]);
+        assert!(!nodes_changed);
+        assert_eq!(
+            snapshot.existing_nodes,
+            HashSet::from_iter(vec![node_1.clone()])
+        );
+        assert_eq!(snapshot.nodes_with_metrics[0].node, node_1);
+        // Sync with node_2
+        let node_2 = Node::new("api2.com").unwrap();
+        let nodes_changed = snapshot.sync_nodes(&[node_2.clone()]);
+        assert!(nodes_changed);
+        assert_eq!(
+            snapshot.existing_nodes,
+            HashSet::from_iter(vec![node_2.clone()])
+        );
+        // Make sure node_1 was removed from weighted_nodes too
+        assert!(snapshot.nodes_with_metrics.is_empty());
+        // Add node_2 to weighted_nodes manually
+        snapshot
+            .nodes_with_metrics
+            .push(NodeWithMetrics::new(node_2.clone(), window_size));
+        // Sync with [node_2, node_3]
+        let node_3 = Node::new("api3.com").unwrap();
+        let nodes_changed = snapshot.sync_nodes(&[node_3.clone(), node_2.clone()]);
+        assert!(nodes_changed);
+        assert_eq!(
+            snapshot.existing_nodes,
+            HashSet::from_iter(vec![node_3.clone(), node_2.clone()])
+        );
+        assert_eq!(snapshot.nodes_with_metrics[0].node, node_2);
+        // Add node_3 to weighted_nodes manually
+        snapshot
+            .nodes_with_metrics
+            .push(NodeWithMetrics::new(node_3, window_size));
+        // Sync with []
+        let nodes_changed = snapshot.sync_nodes(&[]);
+        assert!(nodes_changed);
+        assert!(snapshot.existing_nodes.is_empty());
+        // Make sure all nodes were removed from the healthy_nodes
+        assert!(snapshot.nodes_with_metrics.is_empty());
+        // Sync with [] again
+        let nodes_changed = snapshot.sync_nodes(&[]);
+        assert!(!nodes_changed);
+        assert!(snapshot.existing_nodes.is_empty());
+        assert!(!snapshot.has_nodes());
+    }
+
+    #[test]
+    fn test_weighted_sample() {
+        let node = &Node::new("api1.com").unwrap();
+        // Case 1: empty array
+        let arr = &[];
+        let idx = weighted_sample(arr, 0.5);
+        assert_eq!(idx, None);
+        // Case 2: single element in array
+        let arr = &[(1.0, node)];
+        let idx = weighted_sample(arr, 0.0);
+        assert_eq!(idx, Some(0));
+        let idx = weighted_sample(arr, 1.0);
+        assert_eq!(idx, Some(0));
+        // check bounds
+        let idx = weighted_sample(arr, -1.0);
+        assert_eq!(idx, None);
+        let idx = weighted_sample(arr, 1.1);
+        assert_eq!(idx, None);
+        // Case 3: two elements in array (second element has twice the weight of the first)
+        let arr = &[(1.0, node), (2.0, node)]; // // prefixed_sum = [1.0, 3.0]
+        let idx = weighted_sample(arr, 0.0); // 0.0 * 3.0 < 1.0
+        assert_eq!(idx, Some(0));
+        let idx = weighted_sample(arr, 0.33); // 0.33 * 3.0 < 1.0
+        assert_eq!(idx, Some(0)); // selection probability ~0.33
+        let idx = weighted_sample(arr, 0.35); // 0.35 * 3.0 > 1.0
+        assert_eq!(idx, Some(1)); // selection probability ~0.66
+        let idx = weighted_sample(arr, 1.0); // 1.0 * 3.0 > 1.0
+        assert_eq!(idx, Some(1));
+        // check bounds
+        let idx = weighted_sample(arr, -1.0);
+        assert_eq!(idx, None);
+        let idx = weighted_sample(arr, 1.1);
+        assert_eq!(idx, None);
+        // Case 4: four elements in array
+        let arr = &[(1.0, node), (2.0, node), (1.5, node), (2.5, node)]; // prefixed_sum = [1.0, 3.0, 4.5, 7.0]
+        let idx = weighted_sample(arr, 0.14); // 0.14 * 7 < 1.0
+        assert_eq!(idx, Some(0)); // probability ~0.14
+        let idx = weighted_sample(arr, 0.15); // 0.15 * 7 > 1.0
+        assert_eq!(idx, Some(1));
+        let idx = weighted_sample(arr, 0.42); // 0.42 * 7 < 3.0
+        assert_eq!(idx, Some(1)); // probability ~0.28
+        let idx = weighted_sample(arr, 0.43); // 0.43 * 7 > 3.0
+        assert_eq!(idx, Some(2));
+        let idx = weighted_sample(arr, 0.64); // 0.64 * 7 < 4.5
+        assert_eq!(idx, Some(2)); // probability ~0.22
+        let idx = weighted_sample(arr, 0.65); // 0.65 * 7 > 4.5
+        assert_eq!(idx, Some(3));
+        let idx = weighted_sample(arr, 0.99);
+        assert_eq!(idx, Some(3)); // probability ~0.35
+                                  // check bounds
+        let idx = weighted_sample(arr, -1.0);
+        assert_eq!(idx, None);
+        let idx = weighted_sample(arr, 1.1);
+        assert_eq!(idx, None);
+    }
+
+    #[test]
+    fn test_compute_score_with_penalty() {
+        let use_penalty = true;
+
+        // Test empty arrays
+        let weights: &[f64] = &[];
+        let weights_sum: f64 = weights.iter().sum();
+        let availabilities = VecDeque::new();
+        let latencies = VecDeque::new();
+
+        let score = compute_score(
+            weights,
+            weights_sum,
+            &availabilities,
+            &latencies,
+            use_penalty,
+        );
+        assert_eq!(score, 0.0);
+
+        // Test arrays with one element.
+        let weights: &[f64] = &[2.0, 1.0];
+        let weights_sum: f64 = weights.iter().sum();
+        let availabilities = vec![true].into();
+        let latencies = vec![2.0].into();
+        let score = compute_score(
+            weights,
+            weights_sum,
+            &availabilities,
+            &latencies,
+            use_penalty,
+        );
+        let score_l = (2.0 / 2.0) / 2.0;
+        let score_a = 1.0;
+        assert_eq!(score, score_l * score_a);
+
+        // Test arrays with two element.
+        let weights: &[f64] = &[2.0, 1.0];
+        let weights_sum: f64 = weights.iter().sum();
+        let availabilities = vec![true, false].into();
+        let latencies = vec![1.0, 2.0].into();
+        let score = compute_score(
+            weights,
+            weights_sum,
+            &availabilities,
+            &latencies,
+            use_penalty,
+        );
+        let score_l = (2.0 / 2.0 + 1.0 / 1.0) / weights_sum;
+        let score_a = (2.0 * 0.0 + 1.0 * 1.0) / weights_sum;
+        assert_eq!(score, score_l * score_a);
+
+        // Test arrays of different sizes.
+        let weights: &[f64] = &[3.0, 2.0, 1.0];
+        let weights_sum: f64 = weights.iter().sum();
+        let availabilities = vec![true, false, true].into();
+        let latencies = vec![1.0, 2.0].into();
+        let score = compute_score(
+            weights,
+            weights_sum,
+            &availabilities,
+            &latencies,
+            use_penalty,
+        );
+        let score_l = (3.0 / 2.0 + 2.0 / 1.0) / 5.0;
+        let score_a = (3.0 * 1.0 + 2.0 * 0.0 + 1.0 * 1.0) / weights_sum;
+        assert_eq!(score, score_l * score_a);
+    }
+
+    #[test]
+    #[ignore]
+    // This test is for manual runs to see the statistics for nodes selection probability.
+    fn test_stats_for_next_n_nodes() {
+        // Arrange
+        let mut snapshot = LatencyRoutingSnapshot::new();
+
+        let window_size = 1;
+
+        let node_1 = Node::new("api1.com").unwrap();
+        let node_2 = Node::new("api2.com").unwrap();
+        let node_3 = Node::new("api3.com").unwrap();
+        let node_4 = Node::new("api4.com").unwrap();
+
+        let mut node_1 = NodeWithMetrics::new(node_1, window_size);
+        let mut node_2 = NodeWithMetrics::new(node_2, window_size);
+        let mut node_3 = NodeWithMetrics::new(node_3, window_size);
+        let mut node_4 = NodeWithMetrics::new(node_4, window_size);
+
+        node_1.is_healthy = true;
+        node_2.is_healthy = true;
+        node_3.is_healthy = true;
+        node_4.is_healthy = false;
+
+        node_1.score = 16.0;
+        node_2.score = 8.0;
+        node_3.score = 4.0;
+        // even though the score is high, this node should never be selected as it is unhealthy
+        node_4.score = 30.0;
+
+        snapshot.nodes_with_metrics = vec![node_1, node_2, node_3, node_4];
+
+        let mut stats = HashMap::new();
+        let experiments = 30;
+        let select_nodes_count = 1;
+        for i in 0..experiments {
+            let nodes = snapshot.next_n_nodes(select_nodes_count);
+            println!("Experiment {i}: selected nodes {nodes:?}");
+            for item in nodes.into_iter() {
+                *stats.entry(item).or_insert(1) += 1;
+            }
+        }
+        for (node, count) in stats {
+            println!(
+                "Node {:?} is selected with probability {}",
+                node.domain(),
+                count as f64 / experiments as f64
+            );
+        }
+    }
+}
diff --git a/ic-agent/src/agent/route_provider/dynamic_routing/snapshot/mod.rs b/ic-agent/src/agent/route_provider/dynamic_routing/snapshot/mod.rs
new file mode 100644
index 00000000..73df1537
--- /dev/null
+++ b/ic-agent/src/agent/route_provider/dynamic_routing/snapshot/mod.rs
@@ -0,0 +1,6 @@
+/// Snapshot of the routing table.
+pub mod latency_based_routing;
+/// Node implementation.
+pub mod round_robin_routing;
+/// Routing snapshot implementation.
+pub mod routing_snapshot;
diff --git a/ic-agent/src/agent/route_provider/dynamic_routing/snapshot/round_robin_routing.rs b/ic-agent/src/agent/route_provider/dynamic_routing/snapshot/round_robin_routing.rs
new file mode 100644
index 00000000..67ce51e0
--- /dev/null
+++ b/ic-agent/src/agent/route_provider/dynamic_routing/snapshot/round_robin_routing.rs
@@ -0,0 +1,326 @@
+use std::{
+    collections::HashSet,
+    sync::{
+        atomic::{AtomicUsize, Ordering},
+        Arc,
+    },
+};
+
+use crate::agent::route_provider::dynamic_routing::{
+    health_check::HealthCheckStatus, node::Node, snapshot::routing_snapshot::RoutingSnapshot,
+};
+
+/// Routing snapshot, which samples nodes in a round-robin fashion.
+#[derive(Default, Debug, Clone)]
+pub struct RoundRobinRoutingSnapshot {
+    current_idx: Arc<AtomicUsize>,
+    healthy_nodes: HashSet<Node>,
+    existing_nodes: HashSet<Node>,
+}
+
+impl RoundRobinRoutingSnapshot {
+    /// Creates a new instance of `RoundRobinRoutingSnapshot`.
+    pub fn new() -> Self {
+        Self {
+            current_idx: Arc::new(AtomicUsize::new(0)),
+            healthy_nodes: HashSet::new(),
+            existing_nodes: HashSet::new(),
+        }
+    }
+}
+
+impl RoutingSnapshot for RoundRobinRoutingSnapshot {
+    fn has_nodes(&self) -> bool {
+        !self.healthy_nodes.is_empty()
+    }
+
+    fn next_node(&self) -> Option<Node> {
+        if self.healthy_nodes.is_empty() {
+            return None;
+        }
+        let prev_idx = self.current_idx.fetch_add(1, Ordering::Relaxed);
+        self.healthy_nodes
+            .iter()
+            .nth(prev_idx % self.healthy_nodes.len())
+            .cloned()
+    }
+
+    fn next_n_nodes(&self, n: usize) -> Vec<Node> {
+        if n == 0 {
+            return Vec::new();
+        }
+
+        let healthy_nodes = Vec::from_iter(self.healthy_nodes.clone());
+        let healthy_count = healthy_nodes.len();
+
+        if n >= healthy_count {
+            return healthy_nodes.clone();
+        }
+
+        let idx = self.current_idx.fetch_add(n, Ordering::Relaxed) % healthy_count;
+        let mut nodes = Vec::with_capacity(n);
+
+        if healthy_count - idx >= n {
+            nodes.extend_from_slice(&healthy_nodes[idx..idx + n]);
+        } else {
+            nodes.extend_from_slice(&healthy_nodes[idx..]);
+            nodes.extend_from_slice(&healthy_nodes[..n - nodes.len()]);
+        }
+
+        nodes
+    }
+
+    fn sync_nodes(&mut self, nodes: &[Node]) -> bool {
+        let new_nodes = HashSet::from_iter(nodes.iter().cloned());
+        // Find nodes removed from topology.
+        let nodes_removed: Vec<_> = self
+            .existing_nodes
+            .difference(&new_nodes)
+            .cloned()
+            .collect();
+        let has_removed_nodes = !nodes_removed.is_empty();
+        // Find nodes added to topology.
+        let nodes_added: Vec<_> = new_nodes
+            .difference(&self.existing_nodes)
+            .cloned()
+            .collect();
+        let has_added_nodes = !nodes_added.is_empty();
+        // NOTE: newly added nodes will appear in the healthy_nodes later.
+        // This happens after the first node health check round and a consequent update_node() invocation.
+        self.existing_nodes.extend(nodes_added);
+        nodes_removed.iter().for_each(|node| {
+            self.existing_nodes.remove(node);
+            self.healthy_nodes.remove(node);
+        });
+
+        has_added_nodes || has_removed_nodes
+    }
+
+    fn update_node(&mut self, node: &Node, health: HealthCheckStatus) -> bool {
+        if !self.existing_nodes.contains(node) {
+            return false;
+        }
+        if health.is_healthy() {
+            self.healthy_nodes.insert(node.clone())
+        } else {
+            self.healthy_nodes.remove(node)
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::collections::HashMap;
+    use std::time::Duration;
+    use std::{collections::HashSet, sync::atomic::Ordering};
+
+    use crate::agent::route_provider::dynamic_routing::{
+        health_check::HealthCheckStatus,
+        node::Node,
+        snapshot::{
+            round_robin_routing::RoundRobinRoutingSnapshot, routing_snapshot::RoutingSnapshot,
+        },
+    };
+
+    #[test]
+    fn test_snapshot_init() {
+        // Arrange
+        let snapshot = RoundRobinRoutingSnapshot::new();
+        // Assert
+        assert!(snapshot.healthy_nodes.is_empty());
+        assert!(snapshot.existing_nodes.is_empty());
+        assert!(!snapshot.has_nodes());
+        assert_eq!(snapshot.current_idx.load(Ordering::SeqCst), 0);
+        assert!(snapshot.next_node().is_none());
+    }
+
+    #[test]
+    fn test_update_of_non_existing_node_always_returns_false() {
+        // Arrange
+        let mut snapshot = RoundRobinRoutingSnapshot::new();
+        // This node is not present in existing_nodes
+        let node = Node::new("api1.com").unwrap();
+        let healthy = HealthCheckStatus::new(Some(Duration::from_secs(1)));
+        let unhealthy = HealthCheckStatus::new(None);
+        // Act 1
+        let is_updated = snapshot.update_node(&node, healthy);
+        // Assert
+        assert!(!is_updated);
+        assert!(snapshot.existing_nodes.is_empty());
+        assert!(snapshot.next_node().is_none());
+        // Act 2
+        let is_updated = snapshot.update_node(&node, unhealthy);
+        // Assert
+        assert!(!is_updated);
+        assert!(snapshot.existing_nodes.is_empty());
+        assert!(snapshot.next_node().is_none());
+    }
+
+    #[test]
+    fn test_update_of_existing_unhealthy_node_with_healthy_node_returns_true() {
+        // Arrange
+        let mut snapshot = RoundRobinRoutingSnapshot::new();
+        let node = Node::new("api1.com").unwrap();
+        // node is present in existing_nodes, but not in healthy_nodes
+        snapshot.existing_nodes.insert(node.clone());
+        let health = HealthCheckStatus::new(Some(Duration::from_secs(1)));
+        // Act
+        let is_updated = snapshot.update_node(&node, health);
+        assert!(is_updated);
+        assert!(snapshot.has_nodes());
+        assert_eq!(snapshot.next_node().unwrap(), node);
+        assert_eq!(snapshot.current_idx.load(Ordering::SeqCst), 1);
+    }
+
+    #[test]
+    fn test_update_of_existing_healthy_node_with_unhealthy_node_returns_true() {
+        // Arrange
+        let mut snapshot = RoundRobinRoutingSnapshot::new();
+        let node = Node::new("api1.com").unwrap();
+        snapshot.existing_nodes.insert(node.clone());
+        snapshot.healthy_nodes.insert(node.clone());
+        let unhealthy = HealthCheckStatus::new(None);
+        // Act
+        let is_updated = snapshot.update_node(&node, unhealthy);
+        assert!(is_updated);
+        assert!(!snapshot.has_nodes());
+        assert!(snapshot.next_node().is_none());
+    }
+
+    #[test]
+    fn test_sync_node_scenarios() {
+        // Arrange
+        let mut snapshot = RoundRobinRoutingSnapshot::new();
+        let node_1 = Node::new("api1.com").unwrap();
+        // Sync with node_1
+        let nodes_changed = snapshot.sync_nodes(&[node_1.clone()]);
+        assert!(nodes_changed);
+        assert!(snapshot.healthy_nodes.is_empty());
+        assert_eq!(
+            snapshot.existing_nodes,
+            HashSet::from_iter(vec![node_1.clone()])
+        );
+        // Add node_1 to healthy_nodes manually
+        snapshot.healthy_nodes.insert(node_1.clone());
+        // Sync with node_1 again
+        let nodes_changed = snapshot.sync_nodes(&[node_1.clone()]);
+        assert!(!nodes_changed);
+        assert_eq!(
+            snapshot.existing_nodes,
+            HashSet::from_iter(vec![node_1.clone()])
+        );
+        assert_eq!(snapshot.healthy_nodes, HashSet::from_iter(vec![node_1]));
+        // Sync with node_2
+        let node_2 = Node::new("api2.com").unwrap();
+        let nodes_changed = snapshot.sync_nodes(&[node_2.clone()]);
+        assert!(nodes_changed);
+        assert_eq!(
+            snapshot.existing_nodes,
+            HashSet::from_iter(vec![node_2.clone()])
+        );
+        // Make sure node_1 was removed from healthy nodes
+        assert!(snapshot.healthy_nodes.is_empty());
+        // Add node_2 to healthy_nodes manually
+        snapshot.healthy_nodes.insert(node_2.clone());
+        // Sync with [node_2, node_3]
+        let node_3 = Node::new("api3.com").unwrap();
+        let nodes_changed = snapshot.sync_nodes(&[node_3.clone(), node_2.clone()]);
+        assert!(nodes_changed);
+        assert_eq!(
+            snapshot.existing_nodes,
+            HashSet::from_iter(vec![node_3.clone(), node_2.clone()])
+        );
+        assert_eq!(snapshot.healthy_nodes, HashSet::from_iter(vec![node_2]));
+        snapshot.healthy_nodes.insert(node_3);
+        // Sync with []
+        let nodes_changed = snapshot.sync_nodes(&[]);
+        assert!(nodes_changed);
+        assert!(snapshot.existing_nodes.is_empty());
+        // Make sure all nodes were removed from the healthy_nodes
+        assert!(snapshot.healthy_nodes.is_empty());
+        // Sync with [] again
+        let nodes_changed = snapshot.sync_nodes(&[]);
+        assert!(!nodes_changed);
+        assert!(snapshot.existing_nodes.is_empty());
+    }
+
+    #[test]
+    fn test_next_node() {
+        // Arrange
+        let mut snapshot = RoundRobinRoutingSnapshot::new();
+        let node_1 = Node::new("api1.com").unwrap();
+        let node_2 = Node::new("api2.com").unwrap();
+        let node_3 = Node::new("api3.com").unwrap();
+        let nodes = vec![node_1, node_2, node_3];
+        snapshot.existing_nodes.extend(nodes.clone());
+        snapshot.healthy_nodes.extend(nodes.clone());
+        // Act
+        let n = 6;
+        let mut count_map = HashMap::new();
+        for _ in 0..n {
+            let node = snapshot.next_node().unwrap();
+            count_map.entry(node).and_modify(|v| *v += 1).or_insert(1);
+        }
+        // Assert each node was returned 2 times
+        let k = 2;
+        assert_eq!(
+            count_map.len(),
+            nodes.len(),
+            "The number of unique elements is not {}",
+            nodes.len()
+        );
+        for (item, &count) in &count_map {
+            assert_eq!(
+                count, k,
+                "Element {:?} does not appear exactly {} times",
+                item, k
+            );
+        }
+    }
+
+    #[test]
+    fn test_n_nodes() {
+        // Arrange
+        let mut snapshot = RoundRobinRoutingSnapshot::new();
+        let node_1 = Node::new("api1.com").unwrap();
+        let node_2 = Node::new("api2.com").unwrap();
+        let node_3 = Node::new("api3.com").unwrap();
+        let node_4 = Node::new("api4.com").unwrap();
+        let node_5 = Node::new("api5.com").unwrap();
+        let nodes = vec![
+            node_1.clone(),
+            node_2.clone(),
+            node_3.clone(),
+            node_4.clone(),
+            node_5.clone(),
+        ];
+        snapshot.healthy_nodes.extend(nodes.clone());
+        // First call
+        let mut n_nodes: Vec<_> = snapshot.next_n_nodes(3);
+        // Second call
+        n_nodes.extend(snapshot.next_n_nodes(3));
+        // Third call
+        n_nodes.extend(snapshot.next_n_nodes(4));
+        // Fourth call
+        n_nodes.extend(snapshot.next_n_nodes(5));
+        // Assert each node was returned 3 times
+        let k = 3;
+        let mut count_map = HashMap::new();
+        for item in n_nodes.iter() {
+            count_map.entry(item).and_modify(|v| *v += 1).or_insert(1);
+        }
+        assert_eq!(
+            count_map.len(),
+            nodes.len(),
+            "The number of unique elements is not {}",
+            nodes.len()
+        );
+        for (item, &count) in &count_map {
+            assert_eq!(
+                count, k,
+                "Element {:?} does not appear exactly {} times",
+                item, k
+            );
+        }
+    }
+}
diff --git a/ic-agent/src/agent/route_provider/dynamic_routing/snapshot/routing_snapshot.rs b/ic-agent/src/agent/route_provider/dynamic_routing/snapshot/routing_snapshot.rs
new file mode 100644
index 00000000..ef1e10af
--- /dev/null
+++ b/ic-agent/src/agent/route_provider/dynamic_routing/snapshot/routing_snapshot.rs
@@ -0,0 +1,18 @@
+use std::fmt::Debug;
+
+use crate::agent::route_provider::dynamic_routing::{health_check::HealthCheckStatus, node::Node};
+
+/// A trait for interacting with the snapshot of nodes (routing table).
+pub trait RoutingSnapshot: Send + Sync + Clone + Debug {
+    /// Returns `true` if the snapshot has nodes.
+    #[allow(unused)]
+    fn has_nodes(&self) -> bool;
+    /// Get next node from the snapshot.
+    fn next_node(&self) -> Option<Node>;
+    /// Get up to n different nodes from the snapshot.
+    fn next_n_nodes(&self, n: usize) -> Vec<Node>;
+    /// Syncs the nodes in the snapshot with the provided list of nodes, returning `true` if the snapshot was updated.
+    fn sync_nodes(&mut self, nodes: &[Node]) -> bool;
+    /// Updates the health status of a specific node, returning `true` if the node was found and updated.
+    fn update_node(&mut self, node: &Node, health: HealthCheckStatus) -> bool;
+}
diff --git a/ic-agent/src/agent/route_provider/dynamic_routing/test_utils.rs b/ic-agent/src/agent/route_provider/dynamic_routing/test_utils.rs
new file mode 100644
index 00000000..1ae39c09
--- /dev/null
+++ b/ic-agent/src/agent/route_provider/dynamic_routing/test_utils.rs
@@ -0,0 +1,127 @@
+use std::collections::{HashMap, HashSet};
+use std::time::Duration;
+use std::{fmt::Debug, hash::Hash, sync::Arc};
+
+use arc_swap::ArcSwap;
+use async_trait::async_trait;
+use url::Url;
+
+use crate::agent::route_provider::{
+    dynamic_routing::{
+        dynamic_route_provider::DynamicRouteProviderError,
+        health_check::{HealthCheck, HealthCheckStatus},
+        node::Node,
+        nodes_fetch::Fetch,
+        type_aliases::AtomicSwap,
+    },
+    RouteProvider,
+};
+
+pub(super) fn route_n_times(n: usize, f: Arc<impl RouteProvider + ?Sized>) -> Vec<String> {
+    (0..n)
+        .map(|_| f.route().unwrap().domain().unwrap().to_string())
+        .collect()
+}
+
+pub(super) fn assert_routed_domains<T>(
+    actual: Vec<T>,
+    expected: Vec<&str>,
+    expected_repetitions: usize,
+) where
+    T: AsRef<str> + Eq + Hash + Debug + Ord,
+{
+    fn build_count_map<T>(items: &[T]) -> HashMap<&str, usize>
+    where
+        T: AsRef<str>,
+    {
+        items.iter().fold(HashMap::new(), |mut map, item| {
+            *map.entry(item.as_ref()).or_insert(0) += 1;
+            map
+        })
+    }
+    let count_actual = build_count_map(&actual);
+    let count_expected = build_count_map(&expected);
+
+    let mut keys_actual = count_actual.keys().collect::<Vec<_>>();
+    keys_actual.sort();
+    let mut keys_expected = count_expected.keys().collect::<Vec<_>>();
+    keys_expected.sort();
+    // Assert all routed domains are present.
+    assert_eq!(keys_actual, keys_expected);
+
+    // Assert the expected repetition count of each routed domain.
+    let actual_repetitions = count_actual.values().collect::<Vec<_>>();
+    assert!(actual_repetitions
+        .iter()
+        .all(|&x| x == &expected_repetitions));
+}
+
+#[derive(Debug)]
+pub(super) struct NodesFetcherMock {
+    // A set of nodes, existing in the topology.
+    pub nodes: AtomicSwap<Vec<Node>>,
+}
+
+#[cfg_attr(target_family = "wasm", async_trait(?Send))]
+#[cfg_attr(not(target_family = "wasm"), async_trait)]
+impl Fetch for NodesFetcherMock {
+    async fn fetch(&self, _url: Url) -> Result<Vec<Node>, DynamicRouteProviderError> {
+        let nodes = (*self.nodes.load_full()).clone();
+        Ok(nodes)
+    }
+}
+
+impl Default for NodesFetcherMock {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl NodesFetcherMock {
+    pub fn new() -> Self {
+        Self {
+            nodes: Arc::new(ArcSwap::from_pointee(vec![])),
+        }
+    }
+
+    pub fn overwrite_nodes(&self, nodes: Vec<Node>) {
+        self.nodes.store(Arc::new(nodes));
+    }
+}
+
+#[derive(Debug)]
+pub(super) struct NodeHealthCheckerMock {
+    healthy_nodes: Arc<ArcSwap<HashSet<Node>>>,
+}
+
+impl Default for NodeHealthCheckerMock {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+#[cfg_attr(target_family = "wasm", async_trait(?Send))]
+#[cfg_attr(not(target_family = "wasm"), async_trait)]
+impl HealthCheck for NodeHealthCheckerMock {
+    async fn check(&self, node: &Node) -> Result<HealthCheckStatus, DynamicRouteProviderError> {
+        let nodes = self.healthy_nodes.load_full();
+        let latency = match nodes.contains(node) {
+            true => Some(Duration::from_secs(1)),
+            false => None,
+        };
+        Ok(HealthCheckStatus::new(latency))
+    }
+}
+
+impl NodeHealthCheckerMock {
+    pub fn new() -> Self {
+        Self {
+            healthy_nodes: Arc::new(ArcSwap::from_pointee(HashSet::new())),
+        }
+    }
+
+    pub fn overwrite_healthy_nodes(&self, healthy_nodes: Vec<Node>) {
+        self.healthy_nodes
+            .store(Arc::new(HashSet::from_iter(healthy_nodes)));
+    }
+}
diff --git a/ic-agent/src/agent/route_provider/dynamic_routing/type_aliases.rs b/ic-agent/src/agent/route_provider/dynamic_routing/type_aliases.rs
new file mode 100644
index 00000000..f4d76fa3
--- /dev/null
+++ b/ic-agent/src/agent/route_provider/dynamic_routing/type_aliases.rs
@@ -0,0 +1,17 @@
+use arc_swap::ArcSwap;
+use std::sync::Arc;
+
+/// A type alias for the sender end of a watch channel.
+pub(super) type SenderWatch<T> = async_watch::Sender<Option<T>>;
+
+/// A type alias for the receiver end of a watch channel.
+pub(super) type ReceiverWatch<T> = async_watch::Receiver<Option<T>>;
+
+/// A type alias for the sender end of a multi-producer, single-consumer channel.
+pub(super) type SenderMpsc<T> = async_channel::Sender<T>;
+
+/// A type alias for the receiver end of a multi-producer, single-consumer channel.
+pub(super) type ReceiverMpsc<T> = async_channel::Receiver<T>;
+
+/// A type alias for an atomic swap operation on a shared value.
+pub(super) type AtomicSwap<T> = Arc<ArcSwap<T>>;
diff --git a/ic-agent/src/agent/status.rs b/ic-agent/src/agent/status.rs
index e54ea251..bd601abf 100644
--- a/ic-agent/src/agent/status.rs
+++ b/ic-agent/src/agent/status.rs
@@ -1,15 +1,11 @@
 //! Types for interacting with the status endpoint of a replica. See [`Status`] for details.
 
-use candid::{CandidType, Deserialize};
-use serde::Serialize;
 use std::{collections::BTreeMap, fmt::Debug};
 
 /// Value returned by the status endpoint of a replica. This is a loose mapping to CBOR values.
 /// Because the agent should not return [`serde_cbor::Value`] directly across API boundaries,
 /// we reimplement it as [`Value`] here.
-#[derive(
-    Debug, Ord, PartialOrd, Eq, PartialEq, Clone, Hash, CandidType, Serialize, Deserialize,
-)]
+#[derive(Debug, Ord, PartialOrd, Eq, PartialEq, Clone, Hash)]
 pub enum Value {
     /// See [`Null`](serde_cbor::Value::Null).
     Null,
@@ -44,7 +40,7 @@ impl std::fmt::Display for Value {
 
 /// The structure returned by [`super::Agent::status`], containing the information returned
 /// by the status endpoint of a replica.
-#[derive(Debug, Ord, PartialOrd, PartialEq, Eq, CandidType, Deserialize, Serialize)]
+#[derive(Debug, Ord, PartialOrd, PartialEq, Eq)]
 pub struct Status {
     /// Optional. The precise git revision of the Internet Computer Protocol implementation.
     pub impl_version: Option<String>,
@@ -59,51 +55,16 @@ pub struct Status {
     pub values: BTreeMap<String, Box<Value>>,
 }
 
-#[test]
-fn can_serilaize_status_as_json() {
-    let status = Status {
-        impl_version: None,
-        replica_health_status: None,
-        root_key: None,
-        values: BTreeMap::new(),
-    };
-    let expected_json =
-        r#"{"impl_version":null,"replica_health_status":null,"root_key":null,"values":{}}"#;
-    let actual_json = serde_json::to_string(&status).expect("Failed to serialize as JSON");
-    assert_eq!(expected_json, actual_json);
-}
-#[test]
-fn can_serialize_status_as_idl() {
-    use candid::types::value::IDLValue;
-    use candid::{Encode, IDLArgs, Result as CandidResult, TypeEnv};
-    let status = Status {
-        impl_version: Some("Foo".to_string()),
-        replica_health_status: None,
-        root_key: None,
-        values: BTreeMap::new(),
-    };
-    // Expresses data as IDLValue.  Then use .to_string() to convert to text-form candid.
-    // TODO: This function has been added to the Candid library and will be available in the next
-    // release.  Then, this definition here can be deleted.
-    pub fn try_from_candid_type<T>(data: &T) -> CandidResult<IDLValue>
-    where
-        T: CandidType,
-    {
-        let blob = Encode!(data)?;
-        let args = IDLArgs::from_bytes_with_types(&blob, &TypeEnv::default(), &[T::ty()])?;
-        Ok(args.args[0].clone())
-    }
-    let expected_idl = "record {\n  values = vec {};\n  replica_health_status = null;\n  impl_version = opt \"Foo\";\n  root_key = null;\n}";
-    let actual_idl = try_from_candid_type(&status)
-        .expect("Failed to convert to idl")
-        .to_string();
-    assert_eq!(expected_idl, actual_idl);
-}
-
 impl std::fmt::Display for Status {
     fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
         f.write_str("{\n")?;
+        let mut first = true;
         for (key, value) in &self.values {
+            if first {
+                first = false;
+            } else {
+                f.write_str(",\n")?;
+            }
             f.write_fmt(format_args!(r#"  "{}": "#, key.escape_debug()))?;
             std::fmt::Display::fmt(&value, f)?;
         }
@@ -126,7 +87,7 @@ fn cbor_value_to_value(value: &serde_cbor::Value) -> Result<Value, ()> {
         )),
         serde_cbor::Value::Map(m) => {
             let mut map = BTreeMap::new();
-            for (key, value) in m.iter() {
+            for (key, value) in m {
                 let k = match key {
                     serde_cbor::Value::Text(t) => t.to_owned(),
                     serde_cbor::Value::Integer(i) => i.to_string(),
diff --git a/ic-agent/src/export.rs b/ic-agent/src/export.rs
index fd285e29..dbdedcf2 100644
--- a/ic-agent/src/export.rs
+++ b/ic-agent/src/export.rs
@@ -1,3 +1,4 @@
 //! A module to re-export types that are visible through the ic-agent API.
 #[doc(inline)]
 pub use candid::types::principal::{Principal, PrincipalError};
+pub use reqwest;
diff --git a/ic-agent/src/identity/anonymous.rs b/ic-agent/src/identity/anonymous.rs
index 4df17394..a345fb70 100644
--- a/ic-agent/src/identity/anonymous.rs
+++ b/ic-agent/src/identity/anonymous.rs
@@ -1,3 +1,5 @@
+use async_trait::async_trait;
+
 use crate::{agent::EnvelopeContent, export::Principal, identity::Identity, Signature};
 
 /// The anonymous identity.
@@ -5,7 +7,7 @@ use crate::{agent::EnvelopeContent, export::Principal, identity::Identity, Signa
 /// The caller will be represented as [`Principal::anonymous`], or `2vxsx-fae`.
 #[derive(Debug, Copy, Clone)]
 pub struct AnonymousIdentity;
-
+#[async_trait]
 impl Identity for AnonymousIdentity {
     fn sender(&self) -> Result<Principal, String> {
         Ok(Principal::anonymous())
@@ -15,7 +17,7 @@ impl Identity for AnonymousIdentity {
         None
     }
 
-    fn sign(&self, _: &EnvelopeContent) -> Result<Signature, String> {
+    async   fn sign(&self, _: &EnvelopeContent) -> Result<Signature, String> {
         Ok(Signature {
             signature: None,
             public_key: None,
@@ -23,7 +25,7 @@ impl Identity for AnonymousIdentity {
         })
     }
 
-    fn sign_arbitrary(&self, _: &[u8]) -> Result<Signature, String> {
+      fn sign_arbitrary(&self, _: &[u8]) -> Result<Signature, String> {
         Ok(Signature {
             public_key: None,
             signature: None,
diff --git a/ic-agent/src/identity/basic.rs b/ic-agent/src/identity/basic.rs
index d88b9165..175c2ad5 100644
--- a/ic-agent/src/identity/basic.rs
+++ b/ic-agent/src/identity/basic.rs
@@ -3,7 +3,8 @@ use crate::{agent::EnvelopeContent, export::Principal, Identity, Signature};
 #[cfg(feature = "pem")]
 use crate::identity::error::PemError;
 
-use ring::signature::{Ed25519KeyPair, KeyPair};
+use async_trait::async_trait;
+use ed25519_consensus::SigningKey;
 use simple_asn1::{
     oid, to_der,
     ASN1Block::{BitString, ObjectIdentifier, Sequence},
@@ -13,9 +14,11 @@ use std::fmt;
 
 use super::Delegation;
 
-/// A Basic Identity which sign using an ED25519 key pair.
+/// A cryptographic identity which signs using an Ed25519 key pair.
+///
+/// The caller will be represented via [`Principal::self_authenticating`], which contains the SHA-224 hash of the public key.
 pub struct BasicIdentity {
-    key_pair: Ed25519KeyPair,
+    private_key: KeyCompat,
     der_encoded_public_key: Vec<u8>,
 }
 
@@ -28,37 +31,94 @@ impl fmt::Debug for BasicIdentity {
 }
 
 impl BasicIdentity {
-    /// Create a BasicIdentity from reading a PEM file at the path.
+    /// Create a `BasicIdentity` from reading a PEM file at the path.
     #[cfg(feature = "pem")]
     pub fn from_pem_file<P: AsRef<std::path::Path>>(file_path: P) -> Result<Self, PemError> {
         Self::from_pem(std::fs::File::open(file_path)?)
     }
 
-    /// Create a BasicIdentity from reading a PEM File from a Reader.
+    /// Create a `BasicIdentity` from reading a PEM File from a Reader.
     #[cfg(feature = "pem")]
     pub fn from_pem<R: std::io::Read>(pem_reader: R) -> Result<Self, PemError> {
-        let bytes: Vec<u8> = pem_reader
-            .bytes()
-            .collect::<Result<Vec<u8>, std::io::Error>>()?;
+        use der::{asn1::OctetString, Decode, ErrorKind, SliceReader, Tag, TagNumber};
+        use pkcs8::PrivateKeyInfo;
+
+        let bytes: Vec<u8> = pem_reader.bytes().collect::<Result<_, _>>()?;
+        let pem = pem::parse(bytes)?;
+        let pki_res = PrivateKeyInfo::decode(&mut SliceReader::new(pem.contents())?);
+        let mut truncated;
+        let pki = match pki_res {
+            Ok(pki) => pki,
+            Err(e) => {
+                if e.kind()
+                    == (ErrorKind::Noncanonical {
+                        tag: Tag::ContextSpecific {
+                            constructed: true,
+                            number: TagNumber::new(1),
+                        },
+                    })
+                {
+                    // Very old versions of dfx generated nonconforming containers. They can only be imported if the extra data is removed.
+                    truncated = pem.into_contents();
+                    if truncated[48..52] != *b"\xA1\x23\x03\x21" {
+                        return Err(e.into());
+                    }
+                    // hatchet surgery
+                    truncated.truncate(48);
+                    truncated[1] = 46;
+                    truncated[4] = 0;
+                    PrivateKeyInfo::decode(&mut SliceReader::new(&truncated)?).map_err(|_| e)?
+                } else {
+                    return Err(e.into());
+                }
+            }
+        };
+        let decoded_key = OctetString::from_der(pki.private_key)?; // ed25519 uses an octet string within another octet string
+        let private_key = SigningKey::try_from(decoded_key.as_bytes())?;
+        Ok(BasicIdentity::from_signing_key(private_key))
+    }
+
+    /// Create a `BasicIdentity` from a `SigningKey` from `ed25519-consensus`.
+    pub fn from_signing_key(key: SigningKey) -> Self {
+        let public_key = key.verification_key();
+        let der_encoded_public_key = der_encode_public_key(public_key.as_bytes().to_vec());
 
-        Ok(BasicIdentity::from_key_pair(Ed25519KeyPair::from_pkcs8(
-            pem::parse(bytes)?.contents(),
-        )?))
+        Self {
+            private_key: KeyCompat::Standard(key),
+            der_encoded_public_key,
+        }
     }
 
-    /// Create a BasicIdentity from a KeyPair from the ring crate.
-    pub fn from_key_pair(key_pair: Ed25519KeyPair) -> Self {
+    /// Create a `BasicIdentity` from an `Ed25519KeyPair` from `ring`.
+    #[cfg(feature = "ring")]
+    pub fn from_key_pair(key_pair: ring::signature::Ed25519KeyPair) -> Self {
+        use ring::signature::KeyPair;
         let der_encoded_public_key = der_encode_public_key(key_pair.public_key().as_ref().to_vec());
-
         Self {
-            key_pair,
+            private_key: KeyCompat::Ring(key_pair),
             der_encoded_public_key,
         }
     }
 }
 
+enum KeyCompat {
+    Standard(SigningKey),
+    #[cfg(feature = "ring")]
+    Ring(ring::signature::Ed25519KeyPair),
+}
+
+impl KeyCompat {
+    fn sign(&self, payload: &[u8]) -> Vec<u8> {
+        match self {
+            Self::Standard(k) => k.sign(payload).to_bytes().to_vec(),
+            #[cfg(feature = "ring")]
+            Self::Ring(k) => k.sign(payload).as_ref().to_vec(),
+        }
+    }
+}
+#[async_trait]
 impl Identity for BasicIdentity {
-    fn sender(&self) -> Result<Principal, String> {
+     fn sender(&self) -> Result<Principal, String> {
         Ok(Principal::self_authenticating(&self.der_encoded_public_key))
     }
 
@@ -66,18 +126,17 @@ impl Identity for BasicIdentity {
         Some(self.der_encoded_public_key.clone())
     }
 
-    fn sign(&self, content: &EnvelopeContent) -> Result<Signature, String> {
+    async fn sign(&self, content: &EnvelopeContent) -> Result<Signature, String> {
         self.sign_arbitrary(&content.to_request_id().signable())
     }
 
-    fn sign_delegation(&self, content: &Delegation) -> Result<Signature, String> {
+      fn sign_delegation(&self, content: &Delegation) -> Result<Signature, String> {
         self.sign_arbitrary(&content.signable())
     }
-
-    fn sign_arbitrary(&self, content: &[u8]) -> Result<Signature, String> {
-        let signature = self.key_pair.sign(content);
+ fn sign_arbitrary(&self, content: &[u8]) -> Result<Signature, String> {
+        let signature = self.private_key.sign(content);
         Ok(Signature {
-            signature: Some(signature.as_ref().to_vec()),
+            signature: Some(signature),
             public_key: self.public_key(),
             delegations: None,
         })
diff --git a/ic-agent/src/identity/delegated.rs b/ic-agent/src/identity/delegated.rs
index 623b03c8..8a71425e 100644
--- a/ic-agent/src/identity/delegated.rs
+++ b/ic-agent/src/identity/delegated.rs
@@ -1,8 +1,15 @@
+use async_trait::async_trait;
 use candid::Principal;
+use der::{Decode, SliceReader};
+use ecdsa::signature::Verifier;
+use k256::Secp256k1;
+use p256::NistP256;
+use pkcs8::{spki::SubjectPublicKeyInfoRef, AssociatedOid, ObjectIdentifier};
+use sec1::{EcParameters, EncodedPoint};
 
 use crate::{agent::EnvelopeContent, Signature};
 
-use super::{Delegation, Identity, SignedDelegation};
+use super::{error::DelegationError, Delegation, Identity, SignedDelegation};
 
 /// An identity that has been delegated the authority to authenticate as a different principal.
 pub struct DelegatedIdentity {
@@ -14,12 +21,97 @@ pub struct DelegatedIdentity {
 impl DelegatedIdentity {
     /// Creates a delegated identity that signs using `to`, for the principal corresponding to the public key `from_key`.
     ///
-    /// `chain` must be a list of delegations connecting `from_key` to `to.public_key()`, and in that order.
-    pub fn new(from_key: Vec<u8>, to: Box<dyn Identity>, chain: Vec<SignedDelegation>) -> Self {
+    /// `chain` must be a list of delegations connecting `from_key` to `to.public_key()`, and in that order;
+    /// otherwise, this function will return an error.
+    pub fn new(
+        from_key: Vec<u8>,
+        to: Box<dyn Identity>,
+        chain: Vec<SignedDelegation>,
+    ) -> Result<Self, DelegationError> {
+        let mut last_verified = &from_key;
+        for delegation in &chain {
+            let spki = SubjectPublicKeyInfoRef::decode(
+                &mut SliceReader::new(&last_verified[..]).map_err(|_| DelegationError::Parse)?,
+            )
+            .map_err(|_| DelegationError::Parse)?;
+            if spki.algorithm.oid == elliptic_curve::ALGORITHM_OID {
+                let Some(params) = spki.algorithm.parameters else {
+                    return Err(DelegationError::UnknownAlgorithm);
+                };
+                let params = params
+                    .decode_as::<EcParameters>()
+                    .map_err(|_| DelegationError::Parse)?;
+                let curve = params
+                    .named_curve()
+                    .ok_or(DelegationError::UnknownAlgorithm)?;
+                if curve == Secp256k1::OID {
+                    let pt = EncodedPoint::from_bytes(spki.subject_public_key.raw_bytes())
+                        .map_err(|_| DelegationError::Parse)?;
+                    let vk = k256::ecdsa::VerifyingKey::from_encoded_point(&pt)
+                        .map_err(|_| DelegationError::Parse)?;
+                    let sig = k256::ecdsa::Signature::try_from(&delegation.signature[..])
+                        .map_err(|_| DelegationError::Parse)?;
+                    vk.verify(&delegation.delegation.signable(), &sig)
+                        .map_err(|_| DelegationError::BrokenChain {
+                            from: last_verified.clone(),
+                            to: Some(delegation.delegation.clone()),
+                        })?;
+                } else if curve == NistP256::OID {
+                    let pt = EncodedPoint::from_bytes(spki.subject_public_key.raw_bytes())
+                        .map_err(|_| DelegationError::Parse)?;
+                    let vk = p256::ecdsa::VerifyingKey::from_encoded_point(&pt)
+                        .map_err(|_| DelegationError::Parse)?;
+                    let sig = p256::ecdsa::Signature::try_from(&delegation.signature[..])
+                        .map_err(|_| DelegationError::Parse)?;
+                    vk.verify(&delegation.delegation.signable(), &sig)
+                        .map_err(|_| DelegationError::BrokenChain {
+                            from: last_verified.clone(),
+                            to: Some(delegation.delegation.clone()),
+                        })?;
+                } else {
+                    return Err(DelegationError::UnknownAlgorithm);
+                }
+            } else if spki.algorithm.oid == ObjectIdentifier::new_unwrap("1.3.101.112") {
+                let vk = ed25519_consensus::VerificationKey::try_from(
+                    spki.subject_public_key.raw_bytes(),
+                )
+                .map_err(|_| DelegationError::Parse)?;
+                let sig = ed25519_consensus::Signature::try_from(&delegation.signature[..])
+                    .map_err(|_| DelegationError::Parse)?;
+                vk.verify(&sig, &delegation.delegation.signable())
+                    .map_err(|_| DelegationError::BrokenChain {
+                        from: last_verified.clone(),
+                        to: Some(delegation.delegation.clone()),
+                    })?;
+            } else {
+                return Err(DelegationError::UnknownAlgorithm);
+            }
+            last_verified = &delegation.delegation.pubkey;
+        }
+        let delegated_principal = Principal::self_authenticating(last_verified);
+        if delegated_principal != to.sender().map_err(DelegationError::IdentityError)? {
+            return Err(DelegationError::BrokenChain {
+                from: last_verified.clone(),
+                to: None,
+            });
+        }
+
+        Ok(Self::new_unchecked(from_key, to, chain))
+    }
+
+    /// Creates a delegated identity that signs using `to`, for the principal corresponding to the public key `from_key`.
+    ///
+    /// `chain` must be a list of delegations connecting `from_key` to `to.public_key()`, and in that order;
+    /// otherwise, the replica will reject this delegation when used as an identity.
+    pub fn new_unchecked(
+        from_key: Vec<u8>,
+        to: Box<dyn Identity>,
+        chain: Vec<SignedDelegation>,
+    ) -> Self {
         Self {
             to,
-            from_key,
             chain,
+            from_key,
         }
     }
 
@@ -32,6 +124,7 @@ impl DelegatedIdentity {
     }
 }
 
+#[async_trait]
 impl Identity for DelegatedIdentity {
     fn sender(&self) -> Result<Principal, String> {
         Ok(Principal::self_authenticating(&self.from_key))
@@ -39,8 +132,8 @@ impl Identity for DelegatedIdentity {
     fn public_key(&self) -> Option<Vec<u8>> {
         Some(self.from_key.clone())
     }
-    fn sign(&self, content: &EnvelopeContent) -> Result<Signature, String> {
-        self.to.sign(content).map(|sig| self.chain_signature(sig))
+    async fn sign(&self, content: &EnvelopeContent) -> Result<Signature, String> {
+        self.to.sign(content).await.map(|sig| self.chain_signature(sig))
     }
     fn sign_delegation(&self, content: &Delegation) -> Result<Signature, String> {
         self.to
diff --git a/ic-agent/src/identity/error.rs b/ic-agent/src/identity/error.rs
index 592d1e5c..0b540412 100644
--- a/ic-agent/src/identity/error.rs
+++ b/ic-agent/src/identity/error.rs
@@ -1,6 +1,8 @@
+use ic_transport_types::Delegation;
 use thiserror::Error;
 
 /// An error happened while reading a PEM file.
+#[cfg(feature = "pem")]
 #[derive(Error, Debug)]
 pub enum PemError {
     /// An error occurred with disk I/O.
@@ -16,11 +18,38 @@ pub enum PemError {
     #[error("An error occurred while reading the file: {0}")]
     PemError(#[from] pem::PemError),
 
-    /// The key was rejected by Ring.
-    #[error("A key was rejected by Ring: {0}")]
-    KeyRejected(#[from] ring::error::KeyRejected),
+    /// An error occurred while reading the file in DER format.
+    #[cfg(feature = "pem")]
+    #[error("An error occurred while reading the file: {0}")]
+    DerError(#[from] der::Error),
+
+    /// The key was rejected by ed25519-consensus.
+    #[error("A key was rejected by ed25519-consensus: {0}")]
+    KeyRejected(#[from] ed25519_consensus::Error),
 
     /// The key was rejected by k256.
     #[error("A key was rejected by k256: {0}")]
     ErrorStack(#[from] k256::pkcs8::Error),
 }
+
+/// An error occurred constructing a [`DelegatedIdentity`](super::delegated::DelegatedIdentity).
+#[derive(Error, Debug)]
+pub enum DelegationError {
+    /// Parsing error in delegation bytes.
+    #[error("A delegation could not be parsed")]
+    Parse,
+    /// A key in the chain did not match the signature of the next chain link.
+    #[error("A link was missing in the delegation chain")]
+    BrokenChain {
+        /// The key that should have matched the next delegation
+        from: Vec<u8>,
+        /// The delegation that didn't match, or `None` if the `Identity` didn't match
+        to: Option<Delegation>,
+    },
+    /// A key with an unknown algorithm was used. The IC supports Ed25519, secp256k1, and prime256v1, and in ECDSA the curve must be specified.
+    #[error("The delegation chain contained a key with an unknown algorithm")]
+    UnknownAlgorithm,
+    /// One of `Identity`'s functions returned an error.
+    #[error("A delegated-to identity encountered an error: {0}")]
+    IdentityError(String),
+}
diff --git a/ic-agent/src/identity/mod.rs b/ic-agent/src/identity/mod.rs
index ed2dd4e3..7738674c 100644
--- a/ic-agent/src/identity/mod.rs
+++ b/ic-agent/src/identity/mod.rs
@@ -6,19 +6,20 @@ use crate::{agent::EnvelopeContent, export::Principal};
 pub(crate) mod anonymous;
 pub(crate) mod basic;
 pub(crate) mod delegated;
+pub(crate) mod error;
 pub(crate) mod prime256v1;
 pub(crate) mod secp256k1;
 
-#[cfg(feature = "pem")]
-pub(crate) mod error;
-
 #[doc(inline)]
 pub use anonymous::AnonymousIdentity;
+use async_trait::async_trait;
 #[doc(inline)]
 pub use basic::BasicIdentity;
 #[doc(inline)]
 pub use delegated::DelegatedIdentity;
 #[doc(inline)]
+pub use error::DelegationError;
+#[doc(inline)]
 pub use ic_transport_types::{Delegation, SignedDelegation};
 #[doc(inline)]
 pub use prime256v1::Prime256v1Identity;
@@ -26,6 +27,7 @@ pub use prime256v1::Prime256v1Identity;
 pub use secp256k1::Secp256k1Identity;
 
 #[cfg(feature = "pem")]
+#[doc(inline)]
 pub use error::PemError;
 
 /// A cryptographic signature, signed by an [Identity].
@@ -44,11 +46,12 @@ pub struct Signature {
 ///
 /// [`Agents`](crate::Agent) are assigned a single `Identity` object, but there can be multiple
 /// identities used.
+#[async_trait]
 pub trait Identity: Send + Sync {
     /// Returns a sender, ie. the Principal ID that is used to sign a request.
     ///
     /// Only one sender can be used per request.
-    fn sender(&self) -> Result<Principal, String>;
+     fn sender(&self) -> Result<Principal, String>;
 
     /// Produce the public key commonly returned in [`Signature`].
     ///
@@ -58,14 +61,14 @@ pub trait Identity: Send + Sync {
     /// Sign a request ID derived from a content map.
     ///
     /// Implementors should call `content.to_request_id().signable()` for the actual bytes that need to be signed.
-    fn sign(&self, content: &EnvelopeContent) -> Result<Signature, String>;
+async    fn sign(&self, content: &EnvelopeContent) -> Result<Signature, String>;
 
     /// Sign a delegation to let another key be used to authenticate [`sender`](Identity::sender).
     ///
     /// Not all `Identity` implementations support this operation, though all `ic-agent` implementations other than `AnonymousIdentity` do.
     ///
     /// Implementors should call `content.signable()` for the actual bytes that need to be signed.
-    fn sign_delegation(&self, content: &Delegation) -> Result<Signature, String> {
+       fn sign_delegation(&self, content: &Delegation) -> Result<Signature, String> {
         let _ = content; // silence unused warning
         Err(String::from("unsupported"))
     }
@@ -73,21 +76,22 @@ pub trait Identity: Send + Sync {
     /// Sign arbitrary bytes.
     ///
     /// Not all `Identity` implementations support this operation, though all `ic-agent` implementations do.
-    fn sign_arbitrary(&self, content: &[u8]) -> Result<Signature, String> {
+      fn sign_arbitrary(&self, content: &[u8]) -> Result<Signature, String> {
         let _ = content; // silence unused warning
         Err(String::from("unsupported"))
     }
 
     /// A list of signed delegations connecting [`sender`](Identity::sender)
     /// to [`public_key`](Identity::public_key), and in that order.
-    fn delegation_chain(&self) -> Vec<SignedDelegation> {
+     fn delegation_chain(&self) -> Vec<SignedDelegation> {
         vec![]
     }
 }
 
+
 macro_rules! delegating_impl {
     ($implementor:ty, $name:ident => $self_expr:expr) => {
-        impl Identity for $implementor {
+        impl Identity for $implementor{
             fn sender(&$name) -> Result<Principal, String> {
                 $self_expr.sender()
             }
@@ -96,7 +100,10 @@ macro_rules! delegating_impl {
                 $self_expr.public_key()
             }
 
-            fn sign(&$name, content: &EnvelopeContent) -> Result<Signature, String> {
+            fn sign<'a, 'b, 'async_trait>(&'a $name, content: &'b EnvelopeContent) -> std::pin::Pin<Box<dyn std::future::Future<Output = Result<Signature, String>> + Send + 'async_trait>>
+            where 'a: 'async_trait,
+                  'b: 'async_trait,
+                  Self: 'async_trait {
                 $self_expr.sign(content)
             }
 
@@ -117,4 +124,4 @@ macro_rules! delegating_impl {
 
 delegating_impl!(Box<dyn Identity>, self => **self);
 delegating_impl!(Arc<dyn Identity>, self => **self);
-delegating_impl!(&dyn Identity, self => *self);
+delegating_impl!(&dyn Identity, self => *self);
\ No newline at end of file
diff --git a/ic-agent/src/identity/prime256v1.rs b/ic-agent/src/identity/prime256v1.rs
index 4cec9a0b..ab4e6c3c 100644
--- a/ic-agent/src/identity/prime256v1.rs
+++ b/ic-agent/src/identity/prime256v1.rs
@@ -3,6 +3,7 @@ use crate::{agent::EnvelopeContent, export::Principal, Identity, Signature};
 #[cfg(feature = "pem")]
 use crate::identity::error::PemError;
 
+use async_trait::async_trait;
 use p256::{
     ecdsa::{self, signature::Signer, SigningKey, VerifyingKey},
     pkcs8::{Document, EncodePublicKey},
@@ -71,7 +72,7 @@ impl Prime256v1Identity {
         }
     }
 }
-
+#[async_trait]
 impl Identity for Prime256v1Identity {
     fn sender(&self) -> Result<Principal, String> {
         Ok(Principal::self_authenticating(
@@ -83,7 +84,7 @@ impl Identity for Prime256v1Identity {
         Some(self.der_encoded_public_key.as_ref().to_vec())
     }
 
-    fn sign(&self, content: &EnvelopeContent) -> Result<Signature, String> {
+  async  fn sign(&self, content: &EnvelopeContent) -> Result<Signature, String> {
         self.sign_arbitrary(&content.to_request_id().signable())
     }
 
@@ -95,7 +96,7 @@ impl Identity for Prime256v1Identity {
         let ecdsa_sig: ecdsa::Signature = self
             .private_key
             .try_sign(content)
-            .map_err(|err| format!("Cannot create prime256v1 signature: {}", err))?;
+            .map_err(|err| format!("Cannot create prime256v1 signature: {err}"))?;
         let r = ecdsa_sig.r().as_ref().to_bytes();
         let s = ecdsa_sig.s().as_ref().to_bytes();
         let mut bytes = [0u8; 64];
@@ -188,8 +189,8 @@ Sks4xGbA/ZbazsrMl4v446U5UIVxCGGaKw==
         assert!(DER_ENCODED_PUBLIC_KEY == hex::encode(identity.der_encoded_public_key));
     }
 
-    #[test]
-    fn test_prime256v1_signature() {
+    #[tokio::test]
+   async fn test_prime256v1_signature() {
         // Create a prime256v1 identity from a PEM file.
         let identity = Prime256v1Identity::from_pem(IDENTITY_FILE.as_bytes())
             .expect("Cannot create prime256v1 identity from PEM file.");
@@ -204,7 +205,7 @@ Sks4xGbA/ZbazsrMl4v446U5UIVxCGGaKw==
             arg: Encode!(&"world").unwrap(),
         };
         let signature = identity
-            .sign(&message)
+            .sign(&message).await
             .expect("Cannot create prime256v1 signature.")
             .signature
             .expect("Cannot find prime256v1 signature bytes.");
diff --git a/ic-agent/src/identity/secp256k1.rs b/ic-agent/src/identity/secp256k1.rs
index 73670987..4bb2e741 100644
--- a/ic-agent/src/identity/secp256k1.rs
+++ b/ic-agent/src/identity/secp256k1.rs
@@ -3,6 +3,7 @@ use crate::{agent::EnvelopeContent, export::Principal, Identity, Signature};
 #[cfg(feature = "pem")]
 use crate::identity::error::PemError;
 
+use async_trait::async_trait;
 use k256::{
     ecdsa::{self, signature::Signer, SigningKey, VerifyingKey},
     pkcs8::{Document, EncodePublicKey},
@@ -71,7 +72,7 @@ impl Secp256k1Identity {
         }
     }
 }
-
+#[async_trait]
 impl Identity for Secp256k1Identity {
     fn sender(&self) -> Result<Principal, String> {
         Ok(Principal::self_authenticating(
@@ -83,7 +84,7 @@ impl Identity for Secp256k1Identity {
         Some(self.der_encoded_public_key.as_ref().to_vec())
     }
 
-    fn sign(&self, content: &EnvelopeContent) -> Result<Signature, String> {
+   async fn sign(&self, content: &EnvelopeContent) -> Result<Signature, String> {
         self.sign_arbitrary(&content.to_request_id().signable())
     }
 
@@ -95,7 +96,7 @@ impl Identity for Secp256k1Identity {
         let ecdsa_sig: ecdsa::Signature = self
             .private_key
             .try_sign(content)
-            .map_err(|err| format!("Cannot create secp256k1 signature: {}", err))?;
+            .map_err(|err| format!("Cannot create secp256k1 signature: {err}"))?;
         let r = ecdsa_sig.r().as_ref().to_bytes();
         let s = ecdsa_sig.s().as_ref().to_bytes();
         let mut bytes = [0u8; 64];
@@ -188,8 +189,8 @@ N3d26cRxD99TPtm8uo2OuzKhSiq6EQ==
         assert!(DER_ENCODED_PUBLIC_KEY == hex::encode(identity.der_encoded_public_key));
     }
 
-    #[test]
-    fn test_secp256k1_signature() {
+    #[tokio::test]
+    async fn test_secp256k1_signature() {
         // Create a secp256k1 identity from a PEM file.
         let identity = Secp256k1Identity::from_pem(IDENTITY_FILE.as_bytes())
             .expect("Cannot create secp256k1 identity from PEM file.");
@@ -204,7 +205,7 @@ N3d26cRxD99TPtm8uo2OuzKhSiq6EQ==
             arg: Encode!(&"world").unwrap(),
         };
         let signature = identity
-            .sign(&message)
+            .sign(&message).await
             .expect("Cannot create secp256k1 signature.")
             .signature
             .expect("Cannot find secp256k1 signature bytes.");
diff --git a/ic-agent/src/lib.rs b/ic-agent/src/lib.rs
index 03a5d641..40254364 100644
--- a/ic-agent/src/lib.rs
+++ b/ic-agent/src/lib.rs
@@ -43,21 +43,15 @@
 //! }
 //!
 //! # fn create_identity() -> impl ic_agent::Identity {
-//! #     let rng = ring::rand::SystemRandom::new();
-//! #     let key_pair = ring::signature::Ed25519KeyPair::generate_pkcs8(&rng)
-//! #         .expect("Could not generate a key pair.");
-//! #
-//! #     ic_agent::identity::BasicIdentity::from_key_pair(
-//! #         ring::signature::Ed25519KeyPair::from_pkcs8(key_pair.as_ref())
-//! #           .expect("Could not read the key pair."),
+//! #     ic_agent::identity::BasicIdentity::from_signing_key(
+//! #         ed25519_consensus::SigningKey::new(rand::thread_rng()),
 //! #     )
 //! # }
 //! #
-//! # const URL: &'static str = concat!("http://localhost:", env!("IC_REF_PORT"));
-//! #
 //! async fn create_a_canister() -> Result<Principal, Box<dyn std::error::Error>> {
+//! # let url = format!("http://localhost:{}", option_env!("IC_REF_PORT").unwrap_or("4943"));
 //!   let agent = Agent::builder()
-//!     .with_url(URL)
+//!     .with_url(url)
 //!     .with_identity(create_identity())
 //!     .build()?;
 //!   // Only do the following call when not contacting the IC main net (e.g. a local emulator).
@@ -74,7 +68,6 @@
 //!   let response = agent.update(&management_canister_id, "provisional_create_canister_with_cycles")
 //!     .with_effective_canister_id(effective_canister_id)
 //!     .with_arg(Encode!(&Argument { amount: None})?)
-//!     .call_and_wait()
 //!     .await?;
 //!
 //!   let result = Decode!(response.as_slice(), CreateCanisterResult)?;
@@ -111,8 +104,8 @@
 #![cfg_attr(not(target_family = "wasm"), warn(clippy::future_not_send))]
 #![cfg_attr(docsrs, feature(doc_cfg, doc_auto_cfg))]
 
-#[cfg(all(feature = "hyper", target_family = "wasm"))]
-compile_error!("Feature `hyper` cannot be used from WASM.");
+#[macro_use]
+mod util;
 
 pub mod agent;
 pub mod export;
@@ -122,7 +115,7 @@ use agent::response_authentication::LookupPath;
 #[doc(inline)]
 pub use agent::{agent_error, agent_error::AgentError, Agent, NonceFactory, NonceGenerator};
 #[doc(inline)]
-pub use ic_transport_types::{to_request_id, RequestId, RequestIdError};
+pub use ic_transport_types::{to_request_id, RequestId, RequestIdError, TransportCallResponse};
 #[doc(inline)]
 pub use identity::{Identity, Signature};
 
diff --git a/ic-agent/src/util.rs b/ic-agent/src/util.rs
new file mode 100644
index 00000000..232b2eca
--- /dev/null
+++ b/ic-agent/src/util.rs
@@ -0,0 +1,38 @@
+#![allow(dead_code)]
+
+use std::future::Future;
+use std::time::Duration;
+
+pub async fn sleep(d: Duration) {
+    #[cfg(not(all(target_family = "wasm", feature = "wasm-bindgen")))]
+    tokio::time::sleep(d).await;
+    #[cfg(all(target_family = "wasm", feature = "wasm-bindgen"))]
+    wasm_bindgen_futures::JsFuture::from(js_sys::Promise::new(&mut |rs, rj| {
+        if let Err(e) = web_sys::window()
+            .expect("global window unavailable")
+            .set_timeout_with_callback_and_timeout_and_arguments_0(&rs, d.as_millis() as _)
+        {
+            use wasm_bindgen::UnwrapThrowExt;
+            rj.call1(&rj, &e).unwrap_throw();
+        }
+    }))
+    .await
+    .expect("unable to setTimeout");
+    #[cfg(all(target_family = "wasm", not(feature = "wasm-bindgen")))]
+    const _: () =
+        { panic!("Using ic-agent from WASM requires enabling the `wasm-bindgen` feature") };
+}
+
+#[cfg(all(target_family = "wasm", feature = "wasm-bindgen"))]
+pub fn spawn(f: impl Future<Output = ()> + 'static) {
+    wasm_bindgen_futures::spawn_local(f);
+}
+
+#[cfg(not(all(target_family = "wasm", feature = "wasm-bindgen")))]
+pub fn spawn(f: impl Future<Output = ()> + Send + 'static) {
+    tokio::spawn(f);
+}
+
+macro_rules! log {
+    ($name:ident, $($t:tt)*) => { #[cfg(feature = "tracing")] { tracing::$name!($($t)*) } };
+}
diff --git a/ic-identity-hsm/Cargo.toml b/ic-identity-hsm/Cargo.toml
index 8cfebccb..e368f06d 100644
--- a/ic-identity-hsm/Cargo.toml
+++ b/ic-identity-hsm/Cargo.toml
@@ -15,6 +15,7 @@ keywords = ["internet-computer", "agent", "utility", "icp", "dfinity"]
 include = ["src", "Cargo.toml", "../LICENSE", "README.md"]
 
 [dependencies]
+async-trait = "0.1.77"
 hex = { workspace = true }
 ic-agent = { workspace = true, default-features = false }
 pkcs11 = "0.5.0"
diff --git a/ic-identity-hsm/src/hsm.rs b/ic-identity-hsm/src/hsm.rs
index ab7dfeb4..2bcca362 100644
--- a/ic-identity-hsm/src/hsm.rs
+++ b/ic-identity-hsm/src/hsm.rs
@@ -1,3 +1,4 @@
+use async_trait::async_trait;
 use ic_agent::{
     agent::EnvelopeContent, export::Principal, identity::Delegation, Identity, Signature,
 };
@@ -134,6 +135,7 @@ impl HardwareIdentity {
     }
 }
 
+#[async_trait]
 impl Identity for HardwareIdentity {
     fn sender(&self) -> Result<Principal, String> {
         Ok(Principal::self_authenticating(&self.public_key))
@@ -143,7 +145,7 @@ impl Identity for HardwareIdentity {
         Some(self.public_key.clone())
     }
 
-    fn sign(&self, content: &EnvelopeContent) -> Result<Signature, String> {
+    async fn sign(&self, content: &EnvelopeContent) -> Result<Signature, String> {
         self.sign_arbitrary(&content.to_request_id().signable())
     }
 
diff --git a/icx-cert/Cargo.toml b/icx-cert/Cargo.toml
index db62abab..f61ea055 100644
--- a/icx-cert/Cargo.toml
+++ b/icx-cert/Cargo.toml
@@ -23,7 +23,7 @@ clap = { workspace = true, features = ["derive", "cargo", "color"] }
 hex = { workspace = true }
 ic-certification = { workspace = true }
 leb128 = "0.2.4"
-reqwest = { version = "0.11", default-features = false, features = [
+reqwest = { version = "0.12", default-features = false, features = [
     "blocking",
     "rustls-tls",
 ] }
diff --git a/icx/src/main.rs b/icx/src/main.rs
index 8bb6d69f..7eb37adc 100644
--- a/icx/src/main.rs
+++ b/icx/src/main.rs
@@ -487,12 +487,14 @@ async fn main() -> Result<()> {
                             .with_arg(arg)
                             .with_effective_canister_id(effective_canister_id)
                             .sign()
+                            .await
                             .context("Failed to sign the update call")?;
                         let serialized = serde_json::to_string(&signed_update).unwrap();
                         println!("{}", serialized);
 
                         let signed_request_status = agent
                             .sign_request_status(effective_canister_id, signed_update.request_id)
+                            .await
                             .context(
                                 "Failed to sign the request_status call accompany with the update",
                             )?;
@@ -509,6 +511,7 @@ async fn main() -> Result<()> {
                             .with_arg(arg)
                             .with_effective_canister_id(effective_canister_id)
                             .sign()
+                            .await
                             .context("Failed to sign the query call")?;
                         let serialized = serde_json::to_string(&signed_query).unwrap();
                         println!("{}", serialized);
diff --git a/ref-tests/tests/integration.rs b/ref-tests/tests/integration.rs
index a4fa7982..7f5a27db 100644
--- a/ref-tests/tests/integration.rs
+++ b/ref-tests/tests/integration.rs
@@ -101,7 +101,7 @@ fn wait_signed() {
         };
 
         let call_request_id = call_envelope_content.to_request_id();
-        let call_signature = agent_identity.sign(&call_envelope_content).unwrap();
+        let call_signature = agent_identity.sign(&call_envelope_content).await.unwrap();
 
         let call_envelope = Envelope {
             content: Cow::Borrowed(&call_envelope_content),
@@ -127,7 +127,7 @@ fn wait_signed() {
             ingress_expiry,
         };
 
-        let read_signature = agent_identity.sign(&read_state_envelope_content).unwrap();
+        let read_signature = agent_identity.sign(&read_state_envelope_content).await.unwrap();
 
         let read_state_envelope = Envelope {
             content: Cow::Borrowed(&read_state_envelope_content),
@@ -560,7 +560,7 @@ mod sign_send {
     fn query() {
         with_universal_canister(|agent, canister_id| async move {
             let arg = payload().reply_data(b"hello").build();
-            let signed_query = agent.query(&canister_id, "query").with_arg(arg).sign()?;
+            let signed_query = agent.query(&canister_id, "query").with_arg(arg).sign().await?;
 
             assert!(signed_query_inspect(
                 signed_query.sender,
@@ -589,7 +589,7 @@ mod sign_send {
     fn update_then_request_status() {
         with_universal_canister(|agent, canister_id| async move {
             let arg = payload().reply_data(b"hello").build();
-            let signed_update = agent.update(&canister_id, "update").with_arg(arg).sign()?;
+            let signed_update = agent.update(&canister_id, "update").with_arg(arg).sign().await?;
 
             assert!(signed_update_inspect(
                 signed_update.sender,
@@ -604,7 +604,7 @@ mod sign_send {
             let signed_request_status = agent.sign_request_status(
                 signed_update.effective_canister_id,
                 signed_update.request_id,
-            )?;
+            ).await?;
 
             assert!(signed_request_status_inspect(
                 signed_request_status.sender,
@@ -644,7 +644,7 @@ mod sign_send {
     fn forged_query() {
         with_universal_canister(|agent, canister_id| async move {
             let arg = payload().reply_data(b"hello").build();
-            let mut signed_query = agent.query(&canister_id, "query").with_arg(arg).sign()?;
+            let mut signed_query = agent.query(&canister_id, "query").with_arg(arg).sign().await?;
 
             signed_query.method_name = "non_query".to_string();