diff --git a/staging/src/k8s.io/controller-manager/pkg/clientbuilder/client_builder_dynamic.go b/staging/src/k8s.io/controller-manager/pkg/clientbuilder/client_builder_dynamic.go
index 81946198374..c8ceaefecea 100644
--- a/staging/src/k8s.io/controller-manager/pkg/clientbuilder/client_builder_dynamic.go
+++ b/staging/src/k8s.io/controller-manager/pkg/clientbuilder/client_builder_dynamic.go
@@ -235,7 +235,11 @@ func (ts *tokenSourceImpl) Token() (*oauth2.Token, error) {
 
 func constructClient(saNamespace, saName string, config *restclient.Config) restclient.Config {
 	username := apiserverserviceaccount.MakeUsername(saNamespace, saName)
-	ret := *restclient.AnonymousClientConfig(config)
+	// make a shallow copy
+	// the caller already castrated the config during creation
+	// this allows for potential extensions in the future
+	// for example it preserve HTTP wrappers for custom behavior per request
+	ret := *config
 	restclient.AddUserAgent(&ret, username)
 	return ret
 }