diff --git a/flame_hub/_auth_flows.py b/flame_hub/_auth_flows.py
index 7aa591d..8248eb1 100644
--- a/flame_hub/_auth_flows.py
+++ b/flame_hub/_auth_flows.py
@@ -1,7 +1,7 @@
 import time
 import typing as t
 
-import httpx
+import httpx2 as httpx
 from pydantic import BaseModel
 
 from flame_hub._defaults import DEFAULT_AUTH_BASE_URL
diff --git a/flame_hub/_base_client.py b/flame_hub/_base_client.py
index f009148..8d171be 100644
--- a/flame_hub/_base_client.py
+++ b/flame_hub/_base_client.py
@@ -4,7 +4,7 @@
 from collections.abc import Iterable
 from enum import Enum
 
-import httpx
+import httpx2 as httpx
 import typing_extensions as te
 from pydantic import BaseModel, ValidatorFunctionWrapHandler, ValidationError, ConfigDict
 
diff --git a/flame_hub/_core_client.py b/flame_hub/_core_client.py
index 26243dd..f3efeb1 100644
--- a/flame_hub/_core_client.py
+++ b/flame_hub/_core_client.py
@@ -3,7 +3,7 @@
 import uuid
 from datetime import datetime
 
-import httpx
+import httpx2 as httpx
 import typing_extensions as te
 from pydantic import BaseModel, WrapValidator, Field, BeforeValidator
 
diff --git a/flame_hub/_exceptions.py b/flame_hub/_exceptions.py
index b8d6db0..08e4045 100644
--- a/flame_hub/_exceptions.py
+++ b/flame_hub/_exceptions.py
@@ -1,6 +1,6 @@
 from json import JSONDecodeError
 
-import httpx
+import httpx2 as httpx
 from pydantic import ValidationError, BaseModel, ConfigDict
 
 
diff --git a/flame_hub/_storage_client.py b/flame_hub/_storage_client.py
index 9bbce94..6c26f72 100644
--- a/flame_hub/_storage_client.py
+++ b/flame_hub/_storage_client.py
@@ -2,7 +2,7 @@
 import uuid
 from datetime import datetime
 
-import httpx
+import httpx2 as httpx
 import typing_extensions as te
 from pydantic import BaseModel
 
diff --git a/poetry.lock b/poetry.lock
index b23a89e..2fcb8b2 100644
--- a/poetry.lock
+++ b/poetry.lock
@@ -135,7 +135,7 @@ version = "2026.5.20"
 description = "Python package for providing Mozilla's CA Bundle."
 optional = false
 python-versions = ">=3.7"
-groups = ["main", "dev", "docs"]
+groups = ["dev", "docs"]
 files = [
     {file = "certifi-2026.5.20-py3-none-any.whl", hash = "sha256:3c52e209ba0a4ad7aebe60436a4ab349c39e1e602e8c134221e546902ad25897"},
     {file = "certifi-2026.5.20.tar.gz", hash = "sha256:69dea482ab64caa7b9f6aba1c6bf48bb6a5448d1c0f1b17ab42ad8c763a5344d"},
@@ -826,51 +826,53 @@ files = [
 ]
 
 [[package]]
-name = "httpcore"
-version = "1.0.9"
+name = "httpcore2"
+version = "2.7.0"
 description = "A minimal low-level HTTP client."
 optional = false
-python-versions = ">=3.8"
+python-versions = ">=3.10"
 groups = ["main"]
 files = [
-    {file = "httpcore-1.0.9-py3-none-any.whl", hash = "sha256:2d400746a40668fc9dec9810239072b40b4484b640a8c38fd654a024c7a1bf55"},
-    {file = "httpcore-1.0.9.tar.gz", hash = "sha256:6e34463af53fd2ab5d807f399a9b45ea31c3dfa2276f15a2c3f00afff6e176e8"},
+    {file = "httpcore2-2.7.0-py3-none-any.whl", hash = "sha256:1452f589fe23f55b44546cd884294c41a29330af902bc0b71a761fd52d18f92b"},
+    {file = "httpcore2-2.7.0.tar.gz", hash = "sha256:6dc0fedf329a52a990930a5579edfebaea81118ea700ea0dd7de2b5e5be49efc"},
 ]
 
 [package.dependencies]
-certifi = "*"
 h11 = ">=0.16"
+truststore = ">=0.10"
 
 [package.extras]
-asyncio = ["anyio (>=4.0,<5.0)"]
+asyncio = ["anyio (>=4.5.0,<5.0)"]
 http2 = ["h2 (>=3,<5)"]
 socks = ["socksio (==1.*)"]
 trio = ["trio (>=0.22.0,<1.0)"]
 
 [[package]]
-name = "httpx"
-version = "0.28.1"
+name = "httpx2"
+version = "2.7.0"
 description = "The next generation HTTP client."
 optional = false
-python-versions = ">=3.8"
+python-versions = ">=3.10"
 groups = ["main"]
 files = [
-    {file = "httpx-0.28.1-py3-none-any.whl", hash = "sha256:d909fcccc110f8c7faf814ca82a9a4d816bc5a6dbfea25d6591d6985b8ba59ad"},
-    {file = "httpx-0.28.1.tar.gz", hash = "sha256:75e98c5f16b0f35b567856f597f06ff2270a374470a5c2392242528e3e3e42fc"},
+    {file = "httpx2-2.7.0-py3-none-any.whl", hash = "sha256:ed2a2719c696789e09493bd8e2bec3d8bd925cc6e26b68389ec25ade132f7bf4"},
+    {file = "httpx2-2.7.0.tar.gz", hash = "sha256:8b30709aed5c8465b0dd3b95c09ce301c8f79e7e7a2d00ab0af551e0d0375b07"},
 ]
 
 [package.dependencies]
-anyio = "*"
-certifi = "*"
-httpcore = "==1.*"
-idna = "*"
+anyio = ">=4.10"
+httpcore2 = "2.7.0"
+idna = ">=3.18"
+truststore = ">=0.10"
+typing-extensions = {version = ">=4.5.0", markers = "python_version < \"3.13\""}
 
 [package.extras]
 brotli = ["brotli ; platform_python_implementation == \"CPython\"", "brotlicffi ; platform_python_implementation != \"CPython\""]
-cli = ["click (==8.*)", "pygments (==2.*)", "rich (>=10,<14)"]
+cli = ["click (>=8.4)", "pygments (==2.*)", "rich (>=10,<16)"]
 http2 = ["h2 (>=3,<5)"]
 socks = ["socksio (==1.*)"]
-zstd = ["zstandard (>=0.18.0)"]
+ws = ["wsproto (>=1.2)"]
+zstd = ["zstandard (>=0.18.0) ; python_version <= \"3.13\""]
 
 [[package]]
 name = "identify"
@@ -2257,6 +2259,18 @@ files = [
 ]
 markers = {dev = "python_full_version <= \"3.11.0a6\"", docs = "python_version == \"3.10\""}
 
+[[package]]
+name = "truststore"
+version = "0.10.4"
+description = "Verify certificates using native system trust stores"
+optional = false
+python-versions = ">=3.10"
+groups = ["main"]
+files = [
+    {file = "truststore-0.10.4-py3-none-any.whl", hash = "sha256:adaeaecf1cbb5f4de3b1959b42d41f6fab57b2b1666adb59e89cb0b53361d981"},
+    {file = "truststore-0.10.4.tar.gz", hash = "sha256:9d91bd436463ad5e4ee4aba766628dd6cd7010cf3e2461756b3303710eebc301"},
+]
+
 [[package]]
 name = "typing-extensions"
 version = "4.15.0"
@@ -2639,4 +2653,4 @@ dev = ["pytest", "setuptools"]
 [metadata]
 lock-version = "2.1"
 python-versions = ">=3.10,<4"
-content-hash = "3bb9c41a501710fd2e874849b620d4ff7173aed8c62f192ba67f1b4885622e42"
+content-hash = "0dccd29f948252142807640098e1cf5c5d2fe8ec5acc2edcd5edd26674f82931"
diff --git a/pyproject.toml b/pyproject.toml
index 2f123c6..11cca6e 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -10,8 +10,7 @@ readme = "README.md"
 requires-python = ">=3.10,<4"
 dependencies = [
     "pydantic[email] (>=2.12.5,<3.0.0)",
-    "httpx (>=0.28.0,<0.29.0)",
-    "httpcore (>=1.0.9,<2.0.0)",  # dep of httpx, contains vulnerable h11 dep so needs to be patched here
+    "httpx2 (>=2.7.0,<3.0.0)",
 ]
 license = "Apache-2.0"
 classifiers = [
diff --git a/tests/conftest.py b/tests/conftest.py
index 6ae5f0d..28d4135 100644
--- a/tests/conftest.py
+++ b/tests/conftest.py
@@ -1,7 +1,7 @@
 import os
 import random
 
-import httpx
+import httpx2 as httpx
 import pytest
 from testcontainers.core.container import DockerContainer
 from testcontainers.core.network import Network
diff --git a/tests/test_flow.py b/tests/test_flow.py
index 4bfd326..b3a93ca 100644
--- a/tests/test_flow.py
+++ b/tests/test_flow.py
@@ -1,4 +1,4 @@
-import httpx
+import httpx2 as httpx
 import pytest
 
 from flame_hub import HubAPIError