diff --git a/integration-tests/idtoken/idtoken_test.go b/integration-tests/idtoken/idtoken_test.go
index 2ff8876..e2cc4e9 100644
--- a/integration-tests/idtoken/idtoken_test.go
+++ b/integration-tests/idtoken/idtoken_test.go
@@ -13,6 +13,7 @@
 	"strings"
 	"testing"
 
+	"golang.org/x/oauth2"
 	"google.golang.org/api/idtoken"
 	"google.golang.org/api/option"
 )
@@ -45,3 +46,22 @@
 		t.Fatalf("got %q, want %q", validTok.Audience, aud)
 	}
 }
+
+func TestNewClient(t *testing.T) {
+	aud := os.Getenv(envTokenAudience)
+	client, err := idtoken.NewClient(context.Background(), aud, option.WithCredentialsFile(os.Getenv(envCredentialFile)))
+	if err != nil {
+		t.Fatalf("unable to create Client: %v", err)
+	}
+	tok, err := client.Transport.(*oauth2.Transport).Source.Token()
+	if err != nil {
+		t.Fatalf("unable to retrieve Token: %v", err)
+	}
+	validTok, err := idtoken.Validate(context.Background(), tok.AccessToken, aud)
+	if err != nil {
+		t.Fatalf("token validation failed: %v", err)
+	}
+	if validTok.Audience != aud {
+		t.Fatalf("got %q, want %q", validTok.Audience, aud)
+	}
+}
diff --git a/transport/http/dial.go b/transport/http/dial.go
index 4848698..075ef87 100644
--- a/transport/http/dial.go
+++ b/transport/http/dial.go
@@ -89,9 +89,14 @@
 		if paramTransport.quotaProject == "" {
 			paramTransport.quotaProject = internal.QuotaProjectFromCreds(creds)
 		}
+
+		ts := creds.TokenSource
+		if settings.TokenSource != nil {
+			ts = settings.TokenSource
+		}
 		trans = &oauth2.Transport{
 			Base:   trans,
-			Source: creds.TokenSource,
+			Source: ts,
 		}
 	}
 	return trans, nil