diff --git a/changes/23758-use-fleethttp-client-for-apns-push-notifications b/changes/23758-use-fleethttp-client-for-apns-push-notifications
new file mode 100644
index 0000000000..08a6eebba6
--- /dev/null
+++ b/changes/23758-use-fleethttp-client-for-apns-push-notifications
@@ -0,0 +1 @@
+* Fixed a bug where the HTTP client used for MDM APNs push notifications did not support using a configured proxy.
diff --git a/cmd/fleet/serve.go b/cmd/fleet/serve.go
index f1e0d4d674..a523a91bac 100644
--- a/cmd/fleet/serve.go
+++ b/cmd/fleet/serve.go
@@ -22,6 +22,7 @@ import (
 	"github.com/e-dard/netbug"
 	"github.com/fleetdm/fleet/v4/ee/server/licensing"
 	eeservice "github.com/fleetdm/fleet/v4/ee/server/service"
+	"github.com/fleetdm/fleet/v4/pkg/fleethttp"
 	"github.com/fleetdm/fleet/v4/pkg/scripts"
 	"github.com/fleetdm/fleet/v4/server"
 	configpkg "github.com/fleetdm/fleet/v4/server/config"
@@ -498,7 +499,11 @@ the way that the Fleet server works.
 
 			var mdmPushService push.Pusher
 			nanoMDMLogger := service.NewNanoMDMLogger(kitlog.With(logger, "component", "apple-mdm-push"))
-			pushProviderFactory := buford.NewPushProviderFactory()
+			pushProviderFactory := buford.NewPushProviderFactory(buford.WithNewClient(func(cert *tls.Certificate) (*http.Client, error) {
+				return fleethttp.NewClient(fleethttp.WithTLSClientConfig(&tls.Config{
+					Certificates: []tls.Certificate{*cert},
+				})), nil
+			}))
 			if os.Getenv("FLEET_DEV_MDM_APPLE_DISABLE_PUSH") == "1" {
 				mdmPushService = nopPusher{}
 			} else {
diff --git a/pkg/fleethttp/fleethttp.go b/pkg/fleethttp/fleethttp.go
index f3fa0cd248..167f3e297a 100644
--- a/pkg/fleethttp/fleethttp.go
+++ b/pkg/fleethttp/fleethttp.go
@@ -97,7 +97,8 @@ func WithTLSConfig(conf *tls.Config) TransportOpt {
 // NewTransport creates an http transport (a type that implements
 // http.RoundTripper) with the provided optional options. The transport is
 // derived from Go's http.DefaultTransport and only overrides the specific
-// parts it needs to, so that it keeps its sane defaults for the rest.
+// parts it needs to, so that it keeps its sane defaults for the rest (such as
+// timeouts and proxy support).
 func NewTransport(opts ...TransportOpt) *http.Transport {
 	var to transportOpts
 	for _, opt := range opts {