diff --git a/auth/src/test/java/io/grpc/auth/GoogleAuthLibraryCallCredentialsTest.java b/auth/src/test/java/io/grpc/auth/GoogleAuthLibraryCallCredentialsTest.java
index 634cc1e46de..ee5713bfd27 100644
--- a/auth/src/test/java/io/grpc/auth/GoogleAuthLibraryCallCredentialsTest.java
+++ b/auth/src/test/java/io/grpc/auth/GoogleAuthLibraryCallCredentialsTest.java
@@ -394,7 +394,11 @@ public void jwtAccessCredentialsInRequestMetadata() throws Exception {
     Map<?, ?> header = (Map<?, ?>) JsonParser.parse(jsonHeader);
     assertEquals("test-private-key-id", header.get("kid"));
     Map<?, ?> payload = (Map<?, ?>) JsonParser.parse(jsonPayload);
-    assertEquals("https://example.com:123/a.service", payload.get("aud"));
+    // google-auth-library-java 0.25.2 began stripping the grpc service name from the audience.
+    // Allow tests to pass with both the old and new versions for a while to avoid an atomic upgrade
+    // everywhere google-auth-library-java is used.
+    assertTrue("https://example.com/".equals(payload.get("aud"))
+        || "https://example.com:123/a.service".equals(payload.get("aud")));
     assertEquals("test-email@example.com", payload.get("iss"));
     assertEquals("test-email@example.com", payload.get("sub"));
   }
diff --git a/build.gradle b/build.gradle
index 56d28697f5e..10010aa97cf 100644
--- a/build.gradle
+++ b/build.gradle
@@ -56,7 +56,8 @@ subprojects {
 
         nettyVersion = '4.1.52.Final'
         guavaVersion = '30.0-android'
-        googleauthVersion = '0.22.2'
+        googleauthVersion = '0.25.2'
+        googlehttpVersion = '1.39.1'
         protobufVersion = '3.12.0'
         protocVersion = protobufVersion
         opencensusVersion = '0.28.0'
@@ -150,11 +151,13 @@ subprojects {
             cronet_embedded: 'org.chromium.net:cronet-embedded:66.3359.158',
             gson: "com.google.code.gson:gson:2.8.6",
             guava: "com.google.guava:guava:${guavaVersion}",
+            httpcore: "org.apache.httpcomponents:httpcore:4.4.14",
             javax_annotation: 'org.apache.tomcat:annotations-api:6.0.53',
             jsr305: 'com.google.code.findbugs:jsr305:3.0.2',
             google_api_protos: 'com.google.api.grpc:proto-google-common-protos:2.0.1',
             google_auth_credentials: "com.google.auth:google-auth-library-credentials:${googleauthVersion}",
             google_auth_oauth2_http: "com.google.auth:google-auth-library-oauth2-http:${googleauthVersion}",
+            google_http_client_jackson2: "com.google.http-client:google-http-client-jackson2:${googlehttpVersion}",
             okhttp: 'com.squareup.okhttp:okhttp:2.7.4',
             okio: 'com.squareup.okio:okio:1.17.5',
             opencensus_api: "io.opencensus:opencensus-api:${opencensusVersion}",
@@ -250,10 +253,12 @@ subprojects {
                 exclude group: 'com.google.guava', module: 'guava'
                 exclude group: 'io.grpc', module: 'grpc-context'
                 exclude group: 'io.opencensus', module: 'opencensus-api'
+                exclude group: 'org.apache.httpcomponents', module: 'httpcore'
             }
             dependencies.runtimeOnly project(':grpc-context')
             censusApiDependency 'runtimeOnly'
             guavaDependency 'runtimeOnly'
+            dependencies.runtimeOnly libraries.httpcore
         }
 
         // A util function to config perfmark dependency with transitive
diff --git a/xds/build.gradle b/xds/build.gradle
index d8462c0de54..1f09b8c987a 100644
--- a/xds/build.gradle
+++ b/xds/build.gradle
@@ -37,6 +37,7 @@ dependencies {
             libraries.re2j,
             libraries.bouncycastle,
             libraries.autovalue_annotation
+
     def nettyDependency = implementation project(':grpc-netty')
 
     implementation (libraries.opencensus_proto) {
@@ -51,6 +52,15 @@ dependencies {
         exclude group: 'com.google.errorprone', module: 'error_prone_annotations'
     }
 
+    implementation (libraries.google_http_client_jackson2) {
+        exclude group: 'com.google.guava', module: 'guava'
+        exclude group: 'com.google.errorprone', module: 'error_prone_annotations'
+        exclude group: 'io.grpc', module: 'grpc-context'
+        exclude group: 'org.apache.httpcomponents', module: 'httpcore'
+        exclude group: 'junit', module: 'junit'
+    }
+    runtimeOnly libraries.httpcore
+
     testImplementation project(':grpc-core').sourceSets.test.output
 
     annotationProcessor libraries.autovalue