diff --git a/ci_cd/security_scans.sh b/ci_cd/security_scans.sh
index 797476f8bb8..b75318e8b30 100755
--- a/ci_cd/security_scans.sh
+++ b/ci_cd/security_scans.sh
@@ -162,6 +162,7 @@ run_grype_scans() {
         "GHSA-83g3-92jg-28cx" # tar arbitrary file read/write via hardlink - from nodejs_wheel bundled npm, not used in application runtime code
         "CVE-2026-25639" # axios - full fix requires 1.x major version bump; pinned to >=0.30.2 to clear other axios CVEs, upgrade to 1.x in follow-up
         "GHSA-qffp-2rhf-9h96" # tar hardlink path traversal via drive-relative linkpath - transitive dep, not directly exploitable in this context
+        "CVE-2026-2297" # Python 3.13 SourcelessFileLoader import hook issue - no fix available yet
     )
 
     # Build JSON array of allowlisted CVE IDs for jq
diff --git a/litellm/a2a_protocol/main.py b/litellm/a2a_protocol/main.py
index 45e3bbd30df..b9ae870cdb3 100644
--- a/litellm/a2a_protocol/main.py
+++ b/litellm/a2a_protocol/main.py
@@ -664,15 +664,21 @@ async def create_a2a_client(
 
     verbose_logger.info(f"Creating A2A client for {base_url}")
 
-    # Always create a fresh httpx client per A2A call so that per-agent auth
-    # headers (extra_headers) are never shared across agents or requests.
-    # Mutating a cached shared client would cause headers from one agent to
-    # bleed into requests made to a different agent.
-    httpx_client = httpx.AsyncClient(
-        timeout=httpx.Timeout(timeout),
-        headers=extra_headers or {},
-    )
+    # Use LiteLLM's cached httpx client to avoid creating a new client per
+    # request (+500ms latency).  When extra_headers are provided they are
+    # included in the cache-key params so that per-agent auth headers are
+    # never shared across agents.
+    _params: Dict[str, Any] = {"timeout": timeout}
     if extra_headers:
+        # Sort keys for deterministic cache key generation
+        _params["extra_headers"] = str(sorted(extra_headers.items()))
+    http_handler = get_async_httpx_client(
+        llm_provider=httpxSpecialProvider.A2A,
+        params=_params,
+    )
+    httpx_client = http_handler.client
+    if extra_headers:
+        httpx_client.headers.update(extra_headers)
         verbose_proxy_logger.debug(
             f"A2A client created with extra_headers={list(extra_headers.keys())}"
         )