@@ -55,7 +55,7 @@ refusing to provision unless the Deployment Manager has declared
 ``host_network_policy="deny-all"``, which means a bare ``SandboxSpec()`` is refused
 under the default ``host_network_policy="unknown"`` rather than silently getting
 an open sandbox. On OpenSandbox the default and ``allow_egress_to`` become a policy
-for the server's egress sidecar, and the backend refuses to provision unless that
+for the server's egress sidecar, and the backend destroys the sandbox and fails the task unless that
 sidecar runs in ``dns+nft`` mode, the one that drops connections to unlisted
 addresses rather than only name resolution (see
 :ref:`the OpenSandbox backend <sandbox-backend-opensandbox>`). ``allow_egress_to``
 
@@ -328,10 +328,13 @@ def _get_egress_enforcement_mode(sandbox: SandboxSync) -> str | None:
         # its enforcementMode, so read that response with the SDK's generated egress client.
         config = sandbox.connection_config
         endpoint = sandbox.get_endpoint(DEFAULT_EGRESS_PORT)
+        # OpenSandbox 1.1.0 has no new_owned_transport(); give this client its own SDK transport.
+        transport = config.model_copy(update={"transport": None}).with_transport_if_missing().transport
         with Client(
             base_url=f"{config.protocol}://{endpoint.endpoint}",
             headers=endpoint.build_request_headers(config),
             timeout=httpx.Timeout(config.request_timeout.total_seconds()),
+            httpx_args={"transport": transport},
         ) as client:
             response = get_policy.sync_detailed(client=client)
         handle_api_error(response, "Get egress policy")
@@ -353,15 +356,20 @@ def _verify_network_policy(sandbox: SandboxSync, requested: NetworkPolicy) -> No
                 mode = OpenSandboxBackend._get_egress_enforcement_mode(sandbox)
                 if mode == _ADDRESS_LAYER_EGRESS_MODE:
                     return
-                problem = (
-                    f"its egress sidecar enforces it in {mode!r} mode"
-                    if mode is not None
-                    else "its egress sidecar does not report an enforcement mode"
-                ) + (
-                    f', and only "{_ADDRESS_LAYER_EGRESS_MODE}" stops connections to numeric addresses '
-                    "rather than name resolution alone. Set "
-                    f'[egress] mode = "{_ADDRESS_LAYER_EGRESS_MODE}" in the server configuration, or pass '
-                    "SandboxSpec(block_network=False) for a sandbox that may reach the network."
+                if mode is None:
+                    problem = (
+                        "its egress sidecar does not report an enforcement mode. Upgrade the egress "
+                        "sidecar to v1.0.1 or later and configure it to run in dns+nft mode."
+                    )
+                else:
+                    problem = (
+                        f"its egress sidecar enforces it in {mode!r} mode, and only "
+                        f'"{_ADDRESS_LAYER_EGRESS_MODE}" stops connections to numeric addresses '
+                        "rather than name resolution alone. Set "
+                        f'[egress] mode = "{_ADDRESS_LAYER_EGRESS_MODE}" in the server configuration.'
+                    )
+                problem += (
+                    " Or pass SandboxSpec(block_network=False) for a sandbox that may reach the network."
                 )
         except Exception as e:
             code = _get_status_code(e)
 
@@ -221,20 +221,24 @@ class TestCreate:
     @pytest.fixture(autouse=True)
     def egress_sidecar(self):
         """Answer the egress sidecar's ``GET /policy``, reporting ``enforcement_mode`` (dns+nft unless a test sets it)."""
-        sidecar = SimpleNamespace(enforcement_mode="dns+nft", status_code=200, requests=[])
+        sidecar = SimpleNamespace(
+            enforcement_mode="dns+nft", status_code=200, transient_status=None, requests=[]
+        )
 
-        def send(_client, request, **_kwargs):
+        def send(_transport, request):
             sidecar.requests.append(request)
             if isinstance(sidecar.enforcement_mode, Exception):
                 raise sidecar.enforcement_mode
+            if sidecar.transient_status is not None and len(sidecar.requests) == 1:
+                return httpx.Response(sidecar.transient_status, text="retry", request=request)
             if sidecar.status_code != 200:
                 return httpx.Response(sidecar.status_code, text="upstream failed", request=request)
             body = {"status": "ok", "mode": "deny_all", "policy": {"defaultAction": "deny"}}
             if sidecar.enforcement_mode is not None:
                 body["enforcementMode"] = sidecar.enforcement_mode
             return httpx.Response(200, json=body, request=request)
 
-        with mock.patch.object(httpx.Client, "send", autospec=True, side_effect=send):
+        with mock.patch.object(httpx.HTTPTransport, "handle_request", autospec=True, side_effect=send):
             yield sidecar
 
     @mock.patch("opensandbox.SandboxSync.create", autospec=True)
@@ -345,11 +349,43 @@ def test_enforced_deny_policy_is_read_back_before_the_sandbox_is_handed_out(self
         assert request.extensions["timeout"]["read"] == 12
         create.return_value.destroy.assert_not_called()
 
+    @pytest.mark.parametrize("transient_status", [None, 502, 503])
+    @mock.patch("opensandbox.SandboxSync.create", autospec=True)
+    def test_policy_readback_uses_owned_transport_with_proxy_environment(
+        self, create, transient_status, egress_sidecar, monkeypatch
+    ):
+        monkeypatch.setenv("HTTP_PROXY", "http://proxy.invalid:3128")
+        monkeypatch.setenv("HTTPS_PROXY", "http://proxy.invalid:3128")
+        monkeypatch.setenv("NO_PROXY", "")
+        egress_sidecar.transient_status = transient_status
+        sandbox = _created(_deny_policy())
+        sandbox.connection_config = sandbox.connection_config.with_transport_if_missing()
+        shared_transport = sandbox.connection_config.transport
+        create.return_value = sandbox
+        backend = OpenSandboxBackend()
+        backend._connection_config = mock.sentinel.connection_config
+        transport_init = httpx.HTTPTransport.__init__
+        with (
+            mock.patch.object(
+                httpx.HTTPTransport, "__init__", autospec=True, side_effect=transport_init
+            ) as init,
+            mock.patch.object(
+                type(shared_transport), "close", autospec=True, side_effect=type(shared_transport).close
+            ) as close,
+        ):
+            assert backend.create(spec=SandboxSpec()) == "created"
+        assert len(egress_sidecar.requests) == (1 if transient_status is None else 2)
+        assert all(call.kwargs.get("proxy") is None for call in init.call_args_list)
+        close.assert_called_once()
+        assert close.call_args.args[0] is not shared_transport
+        shared_transport.close()
+        sandbox.destroy.assert_not_called()
+
     @pytest.mark.parametrize(
         ("sidecar", "reason"),
         [
             ({"enforcement_mode": "dns"}, r"enforces it in 'dns' mode.*\[egress\] mode = \"dns\+nft\""),
-            ({"enforcement_mode": None}, "does not report an enforcement mode"),
+            ({"enforcement_mode": None}, "does not report an enforcement mode.*Upgrade.*v1.0.1 or later"),
             ({"enforcement_mode": httpx.ConnectError("refused")}, r"could not be read back \(ConnectError\)"),
             ({"status_code": 500}, r"could not be read back \(SandboxApiException, HTTP 500\)"),
         ],