diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index c3f484be..a8fbb42e 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -10,7 +10,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ macos-12, ubuntu-latest ]
+        os: [ macos-13-large, ubuntu-latest ]
         dfx: [ '0.8.4', '0.9.2', '0.10.1', '0.11.1' ]
 
     steps:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a69e33e7..6a76944c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -19,7 +19,7 @@ jobs:
             target: x86_64-unknown-linux-musl
             binary_path: target/x86_64-unknown-linux-musl/release
             binary_files: icx
-          - os: macos-12
+          - os: macos-13-large
             name: macos
             target: x86_64-apple-darwin
             binary_path: target/x86_64-apple-darwin/release
diff --git a/.github/workflows/shellcheck.yml b/.github/workflows/shellcheck.yml
index a59b286f..eaa8729e 100644
--- a/.github/workflows/shellcheck.yml
+++ b/.github/workflows/shellcheck.yml
@@ -15,7 +15,7 @@ on:
 jobs:
   check_macos:
     # ubuntu-latest has shellcheck 0.4.6, while macos-12 has 0.7.1
-    runs-on: macos-12
+    runs-on: macos-13-large
     steps:
       - uses: actions/checkout@v4
       - name: Install shellcheck
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index c2ebcd3c..b4ab2d94 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -11,7 +11,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
-        os: [ubuntu-latest, macos-12, windows-latest]
+        os: [ubuntu-latest, macos-13-large, windows-latest]
 
     steps:
       - uses: actions/checkout@v4
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3e0af72f..e6e00f96 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,21 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## Unreleased
 
+## [0.39.0]
+
+* The lower-level update call functions now return the certificate in addition to the parsed response data.
+* Make ingress_expiry required and set the default value to 3 min.
+* Changed `BasicIdentity`'s implementation from `ring` to `ed25519-consensus`.
+* Added `AgentBuilder::with_max_polling_time` to config the maximum time to wait for a response from the replica.
+* `DelegatedIdentity::new` now checks the delegation chain. The old behavior is available under `new_unchecked`.
+
+## [0.38.2] - 2024-09-30
+
+* Limited the number of HTTP 429 retries. Users receiving this error should configure `with_max_concurrent_requests`.
+* Added `Envelope::encode_bytes` and `Query/UpdateBuilder::into_envelope` for external signing workflows.
+* Added `AgentBuilder::with_arc_http_middleware` for `Transport`-like functionality at the level of HTTP requests.
+* Add support for dynamic routing based on boundary node discovery. This is an internal feature for now, with a feature flag `_internal_dynamic-routing`.
+
 ## [0.38.1] - 2024-09-23
 
 * Fix `ic-agent` manifest so that documentation can be built for docs.rs.
diff --git a/Cargo.lock b/Cargo.lock
index 37ec4a69..5950ec0d 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -46,9 +46,9 @@ checksum = "5c6cb57a04249c6480766f7f7cef5467412af1490f8d1e243141daddada3264f"
 
 [[package]]
 name = "anstream"
-version = "0.6.14"
+version = "0.6.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "418c75fa768af9c03be99d17643f93f79bbba589895012a80e3452a19ddda15b"
+checksum = "64e15c1ab1f89faffbf04a634d5e1962e9074f2741eef6d97f3c4e322426d526"
 dependencies = [
  "anstyle",
  "anstyle-parse",
@@ -61,33 +61,33 @@ dependencies = [
 
 [[package]]
 name = "anstyle"
-version = "1.0.7"
+version = "1.0.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "038dfcf04a5feb68e9c60b21c9625a54c2c0616e79b72b0fd87075a056ae1d1b"
+checksum = "1bec1de6f59aedf83baf9ff929c98f2ad654b97c9510f4e70cf6f661d49fd5b1"
 
 [[package]]
 name = "anstyle-parse"
-version = "0.2.4"
+version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c03a11a9034d92058ceb6ee011ce58af4a9bf61491aa7e1e59ecd24bd40d22d4"
+checksum = "eb47de1e80c2b463c735db5b217a0ddc39d612e7ac9e2e96a5aed1f57616c1cb"
 dependencies = [
  "utf8parse",
 ]
 
 [[package]]
 name = "anstyle-query"
-version = "1.1.0"
+version = "1.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ad186efb764318d35165f1758e7dcef3b10628e26d41a44bc5550652e6804391"
+checksum = "6d36fc52c7f6c869915e99412912f22093507da8d9e942ceaf66fe4b7c14422a"
 dependencies = [
  "windows-sys 0.52.0",
 ]
 
 [[package]]
 name = "anstyle-wincon"
-version = "3.0.3"
+version = "3.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61a38449feb7068f52bb06c12759005cf459ee52bb4adc1d5a7c4322d716fb19"
+checksum = "5bf74e1b6e971609db8ca7a9ce79fd5768ab6ae46441c572e46cf596f59e57f8"
 dependencies = [
  "anstyle",
  "windows-sys 0.52.0",
@@ -108,6 +108,12 @@ version = "1.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7d5a26814d8dcb93b0e5a0ff3c6d80a8843bafb21b39e8e18a6f05471870e110"
 
+[[package]]
+name = "arc-swap"
+version = "1.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69f7f8c3906b62b754cd5326047894316021dcfe5a194c8ea52bdd94934a3457"
+
 [[package]]
 name = "arrayvec"
 version = "0.5.2"
@@ -133,13 +139,24 @@ dependencies = [
  "serde_json",
 ]
 
+[[package]]
+name = "async-channel"
+version = "1.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "81953c529336010edd6d8e358f886d9581267795c61b19475b71314bffa46d35"
+dependencies = [
+ "concurrent-queue",
+ "event-listener 2.5.3",
+ "futures-core",
+]
+
 [[package]]
 name = "async-lock"
 version = "3.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ff6e472cdea888a4bd64f342f09b3f50e1886d32afe8df3d663c01140b811b18"
 dependencies = [
- "event-listener",
+ "event-listener 5.3.1",
  "event-listener-strategy",
  "pin-project-lite",
 ]
@@ -152,9 +169,24 @@ checksum = "6e0c28dcc82d7c8ead5cb13beb15405b57b8546e93215673ff8ca0349a028107"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.71",
+ "syn 2.0.76",
 ]
 
+[[package]]
+name = "async-watch"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a078faf4e27c0c6cc0efb20e5da59dcccc04968ebf2801d8e0b2195124cdcdb2"
+dependencies = [
+ "event-listener 2.5.3",
+]
+
+[[package]]
+name = "atomic-waker"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
+
 [[package]]
 name = "autocfg"
 version = "1.3.0"
@@ -287,9 +319,9 @@ checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
 
 [[package]]
 name = "bytes"
-version = "1.6.1"
+version = "1.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a12916984aab3fa6e39d655a33e09c0071eb36d6ab3aea5c2d78551f1df6d952"
+checksum = "8318a53db07bb3f8dca91a600466bdb3f2eaadeedfdbcf02e1accbad9271ba50"
 
 [[package]]
 name = "cached"
@@ -306,9 +338,9 @@ dependencies = [
 
 [[package]]
 name = "candid"
-version = "0.10.9"
+version = "0.10.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7df77a80c72fcd356cf37ff59c812f37ff06dc9a81232b3aff0a308cb5996904"
+checksum = "6c30ee7f886f296b6422c0ff017e89dd4f831521dfdcc76f3f71aae1ce817222"
 dependencies = [
  "anyhow",
  "binread",
@@ -336,7 +368,7 @@ dependencies = [
  "lazy_static",
  "proc-macro2",
  "quote",
- "syn 2.0.71",
+ "syn 2.0.76",
 ]
 
 [[package]]
@@ -360,9 +392,12 @@ dependencies = [
 
 [[package]]
 name = "cc"
-version = "1.1.5"
+version = "1.1.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "324c74f2155653c90b04f25b2a47a8a631360cb908f92a772695f430c7e31052"
+checksum = "50d2eb3cd3d1bf4529e31c215ee6f93ec5a3d536d9f578f93d9d33ee19562932"
+dependencies = [
+ "shlex",
+]
 
 [[package]]
 name = "cfg-if"
@@ -372,9 +407,9 @@ checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
 
 [[package]]
 name = "clap"
-version = "4.5.9"
+version = "4.5.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "64acc1846d54c1fe936a78dc189c34e28d3f5afc348403f28ecf53660b9b8462"
+checksum = "ed6719fffa43d0d87e5fd8caeab59be1554fb028cd30edc88fc4369b17971019"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -382,9 +417,9 @@ dependencies = [
 
 [[package]]
 name = "clap_builder"
-version = "4.5.9"
+version = "4.5.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6fb8393d67ba2e7bfaf28a23458e4e2b543cc73a99595511eb207fdb8aede942"
+checksum = "216aec2b177652e3846684cbfe25c9964d18ec45234f0f5da5157b207ed1aab6"
 dependencies = [
  "anstream",
  "anstyle",
@@ -394,21 +429,21 @@ dependencies = [
 
 [[package]]
 name = "clap_derive"
-version = "4.5.8"
+version = "4.5.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2bac35c6dafb060fd4d275d9a4ffae97917c13a6327903a8be2153cd964f7085"
+checksum = "501d359d5f3dcaf6ecdeee48833ae73ec6e42723a1e52419c79abf9507eec0a0"
 dependencies = [
  "heck",
  "proc-macro2",
  "quote",
- "syn 2.0.71",
+ "syn 2.0.76",
 ]
 
 [[package]]
 name = "clap_lex"
-version = "0.7.1"
+version = "0.7.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4b82cf0babdbd58558212896d1a4272303a57bdb245c2bf1147185fb45640e70"
+checksum = "1462739cb27611015575c0c11df5df7601141071f07518d56fcc1be504cbec97"
 
 [[package]]
 name = "codespan-reporting"
@@ -422,9 +457,9 @@ dependencies = [
 
 [[package]]
 name = "colorchoice"
-version = "1.0.1"
+version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b6a852b24ab71dffc585bcb46eaf7959d175cb865a7152e35b348d1b2960422"
+checksum = "d3fd119d74b830634cea2a0f58bbd0d54540518a14397557951e79340abc28c0"
 
 [[package]]
 name = "colored"
@@ -472,9 +507,9 @@ dependencies = [
 
 [[package]]
 name = "cpufeatures"
-version = "0.2.12"
+version = "0.2.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "53fe5e26ff1b7aef8bca9c6080520cfb8d9333c7568e1829cef191a9723e5504"
+checksum = "51e852e6dc9a5bed1fae92dd2375037bf2b768725bf3be87811edee3249d09ad"
 dependencies = [
  "libc",
 ]
@@ -673,6 +708,12 @@ version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5443807d6dff69373d433ab9ef5378ad8df50ca6298caf15de6e52e24aaf54d5"
 
+[[package]]
+name = "event-listener"
+version = "2.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0206175f82b8d6bf6652ff7d71a1e27fd2e4efde587fd368662814d6ec1d9ce0"
+
 [[package]]
 name = "event-listener"
 version = "5.3.1"
@@ -690,7 +731,7 @@ version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0f214dc438f977e6d4e3500aaa277f5ad94ca83fbbd9b1a15713ce2344ccc5a1"
 dependencies = [
- "event-listener",
+ "event-listener 5.3.1",
  "pin-project-lite",
 ]
 
@@ -755,7 +796,7 @@ checksum = "87750cf4b7a4c0625b1529e4c543c2182106e4dedc60a2a6455e00d212c489ac"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.71",
+ "syn 2.0.76",
 ]
 
 [[package]]
@@ -830,16 +871,16 @@ dependencies = [
 
 [[package]]
 name = "h2"
-version = "0.3.26"
+version = "0.4.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "81fe527a889e1532da5c525686d96d4c2e74cdd345badf8dfef9f6b39dd5f5e8"
+checksum = "524e8ac6999421f49a846c2d4411f337e53497d8ec55d67753beffa43c5d9205"
 dependencies = [
+ "atomic-waker",
  "bytes",
  "fnv",
  "futures-core",
  "futures-sink",
- "futures-util",
- "http 0.2.12",
+ "http",
  "indexmap",
  "slab",
  "tokio",
@@ -890,17 +931,6 @@ dependencies = [
  "digest 0.10.7",
 ]
 
-[[package]]
-name = "http"
-version = "0.2.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "601cbb57e577e2f5ef5be8e7b83f0f63994f25aa94d673e54a92d5c516d101f1"
-dependencies = [
- "bytes",
- "fnv",
- "itoa",
-]
-
 [[package]]
 name = "http"
 version = "1.1.0"
@@ -912,17 +942,6 @@ dependencies = [
  "itoa",
 ]
 
-[[package]]
-name = "http-body"
-version = "0.4.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ceab25649e9960c0311ea418d17bee82c0dcec1bd053b5f9a66e265a693bed2"
-dependencies = [
- "bytes",
- "http 0.2.12",
- "pin-project-lite",
-]
-
 [[package]]
 name = "http-body"
 version = "1.0.1"
@@ -930,7 +949,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1efedce1fb8e6913f23e0c92de8e62cd5b772a67e7b3946df930a62566c93184"
 dependencies = [
  "bytes",
- "http 1.1.0",
+ "http",
 ]
 
 [[package]]
@@ -941,8 +960,8 @@ checksum = "793429d76616a256bcb62c2a2ec2bed781c8307e797e2598c50010f2bee2544f"
 dependencies = [
  "bytes",
  "futures-util",
- "http 1.1.0",
- "http-body 1.0.1",
+ "http",
+ "http-body",
  "pin-project-lite",
 ]
 
@@ -964,29 +983,6 @@ version = "2.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9a3a5bfb195931eeb336b2a7b4d761daec841b97f947d34394601737a7bba5e4"
 
-[[package]]
-name = "hyper"
-version = "0.14.30"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a152ddd61dfaec7273fe8419ab357f33aee0d914c5f4efbf0d96fa749eea5ec9"
-dependencies = [
- "bytes",
- "futures-channel",
- "futures-core",
- "futures-util",
- "h2",
- "http 0.2.12",
- "http-body 0.4.6",
- "httparse",
- "httpdate",
- "itoa",
- "pin-project-lite",
- "tokio",
- "tower-service",
- "tracing",
- "want",
-]
-
 [[package]]
 name = "hyper"
 version = "1.4.1"
@@ -996,9 +992,11 @@ dependencies = [
  "bytes",
  "futures-channel",
  "futures-util",
- "http 1.1.0",
- "http-body 1.0.1",
+ "h2",
+ "http",
+ "http-body",
  "httparse",
+ "httpdate",
  "itoa",
  "pin-project-lite",
  "smallvec",
@@ -1008,13 +1006,13 @@ dependencies = [
 
 [[package]]
 name = "hyper-rustls"
-version = "0.27.2"
+version = "0.27.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ee4be2c948921a1a5320b629c4193916ed787a7f7f293fd3f7f5a6c9de74155"
+checksum = "08afdbb5c31130e3034af566421053ab03787c640246a446327f550d11bcb333"
 dependencies = [
  "futures-util",
- "http 1.1.0",
- "hyper 1.4.1",
+ "http",
+ "hyper",
  "hyper-util",
  "rustls",
  "rustls-pki-types",
@@ -1026,16 +1024,16 @@ dependencies = [
 
 [[package]]
 name = "hyper-util"
-version = "0.1.6"
+version = "0.1.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3ab92f4f49ee4fb4f997c784b7a2e0fa70050211e0b6a287f898c3c9785ca956"
+checksum = "cde7055719c54e36e95e8719f95883f22072a48ede39db7fc17a4e1d5281e9b9"
 dependencies = [
  "bytes",
  "futures-channel",
  "futures-util",
- "http 1.1.0",
- "http-body 1.0.1",
- "hyper 1.4.1",
+ "http",
+ "http-body",
+ "hyper",
  "pin-project-lite",
  "socket2",
  "tokio",
@@ -1046,21 +1044,29 @@ dependencies = [
 
 [[package]]
 name = "ic-agent"
-version = "0.38.1"
+version = "0.39.1"
 dependencies = [
+ "arc-swap",
+ "async-channel",
  "async-lock",
+ "async-trait",
+ "async-watch",
  "backoff",
  "cached",
  "candid",
+ "der",
+ "ecdsa",
  "ed25519-consensus",
+ "elliptic-curve",
  "futures-util",
  "getrandom",
  "hex",
- "http 1.1.0",
- "http-body 1.0.1",
+ "http",
+ "http-body",
  "ic-certification",
  "ic-transport-types",
  "ic-verify-bls-signature",
+ "indexmap",
  "js-sys",
  "k256",
  "leb128",
@@ -1072,7 +1078,6 @@ dependencies = [
  "rangemap",
  "reqwest",
  "ring",
- "rustls-webpki",
  "sec1",
  "serde",
  "serde_bytes",
@@ -1081,9 +1086,13 @@ dependencies = [
  "serde_repr",
  "sha2 0.10.8",
  "simple_asn1",
+ "stop-token",
  "thiserror",
  "time",
  "tokio",
+ "tower-service",
+ "tracing",
+ "tracing-subscriber",
  "url",
  "wasm-bindgen",
  "wasm-bindgen-futures",
@@ -1093,9 +1102,9 @@ dependencies = [
 
 [[package]]
 name = "ic-certification"
-version = "2.5.0"
+version = "2.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "20052ce9255fbe2de7041a4f6996fddd095ba1f31ae83b6c0ccdee5be6e7bbcf"
+checksum = "e64ee3d8b6e81b51f245716d3e0badb63c283c00f3c9fb5d5219afc30b5bf821"
 dependencies = [
  "hex",
  "serde",
@@ -1105,7 +1114,7 @@ dependencies = [
 
 [[package]]
 name = "ic-identity-hsm"
-version = "0.38.1"
+version = "0.39.1"
 dependencies = [
  "hex",
  "ic-agent",
@@ -1117,7 +1126,7 @@ dependencies = [
 
 [[package]]
 name = "ic-transport-types"
-version = "0.38.1"
+version = "0.39.1"
 dependencies = [
  "candid",
  "hex",
@@ -1125,6 +1134,7 @@ dependencies = [
  "leb128",
  "serde",
  "serde_bytes",
+ "serde_cbor",
  "serde_json",
  "serde_repr",
  "sha2 0.10.8",
@@ -1133,14 +1143,15 @@ dependencies = [
 
 [[package]]
 name = "ic-utils"
-version = "0.38.1"
+version = "0.39.1"
 dependencies = [
  "async-trait",
  "candid",
+ "ed25519-consensus",
  "futures-util",
  "ic-agent",
  "once_cell",
- "ring",
+ "rand",
  "semver",
  "serde",
  "serde_bytes",
@@ -1196,17 +1207,18 @@ dependencies = [
 
 [[package]]
 name = "icx"
-version = "0.38.1"
+version = "0.39.1"
 dependencies = [
  "anyhow",
  "candid",
  "candid_parser",
  "clap",
+ "ed25519-consensus",
  "hex",
  "humantime",
  "ic-agent",
  "ic-utils",
- "ring",
+ "rand",
  "serde",
  "serde_json",
  "tokio",
@@ -1214,7 +1226,7 @@ dependencies = [
 
 [[package]]
 name = "icx-cert"
-version = "0.38.1"
+version = "0.39.1"
 dependencies = [
  "anyhow",
  "base64",
@@ -1242,9 +1254,9 @@ dependencies = [
 
 [[package]]
 name = "indexmap"
-version = "2.2.6"
+version = "2.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "168fb715dda47215e360912c096649d23d58bf392ac62f73919e831745e40f26"
+checksum = "93ead53efc7ea8ed3cfb0c79fc8023fbb782a5432b52830b6518941cebe6505c"
 dependencies = [
  "equivalent",
  "hashbrown",
@@ -1270,9 +1282,9 @@ checksum = "8f518f335dce6725a761382244631d86cf0ccb2863413590b31338feb467f9c3"
 
 [[package]]
 name = "is_terminal_polyfill"
-version = "1.70.0"
+version = "1.70.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8478577c03552c21db0e2724ffb8986a5ce7af88107e6be5d2ee6e158c12800"
+checksum = "7943c866cc5cd64cbc25b2e01621d07fa8eb2a1a23160ee81ce38704e97b8ecf"
 
 [[package]]
 name = "itertools"
@@ -1291,18 +1303,18 @@ checksum = "49f1f14873335454500d59611f1cf4a4b0f786f9ac11f4312a78e4cf2566695b"
 
 [[package]]
 name = "js-sys"
-version = "0.3.69"
+version = "0.3.70"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "29c15563dc2726973df627357ce0c9ddddbea194836909d655df6a75d2cf296d"
+checksum = "1868808506b929d7b0cfa8f75951347aa71bb21144b7791bae35d9bccfcfe37a"
 dependencies = [
  "wasm-bindgen",
 ]
 
 [[package]]
 name = "k256"
-version = "0.13.3"
+version = "0.13.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "956ff9b67e26e1a6a866cb758f12c6f8746208489e3e4a4b5580802f2f0a587b"
+checksum = "f6e3919bbaa2945715f0bb6d3934a173d1e9a59ac23767fbaaef277265a7411b"
 dependencies = [
  "cfg-if",
  "ecdsa",
@@ -1357,9 +1369,9 @@ checksum = "884e2677b40cc8c339eaefcb701c32ef1fd2493d71118dc0ca4b6a736c93bd67"
 
 [[package]]
 name = "libc"
-version = "0.2.155"
+version = "0.2.158"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97b3888a4aecf77e811145cadf6eef5901f4782c53886191b2f693f24761847c"
+checksum = "d8adc4bb1803a324070e64a98ae98f38934d91957a99cfb3a43dcbc01bc56439"
 
 [[package]]
 name = "libloading"
@@ -1417,7 +1429,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "regex-syntax 0.6.29",
- "syn 2.0.71",
+ "syn 2.0.76",
 ]
 
 [[package]]
@@ -1441,6 +1453,16 @@ version = "0.3.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
 
+[[package]]
+name = "minicov"
+version = "0.3.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c71e683cd655513b99affab7d317deb690528255a0d5f717f1024093c12b169"
+dependencies = [
+ "cc",
+ "walkdir",
+]
+
 [[package]]
 name = "miniz_oxide"
 version = "0.7.4"
@@ -1452,25 +1474,31 @@ dependencies = [
 
 [[package]]
 name = "mio"
-version = "0.8.11"
+version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a4a650543ca06a924e8b371db273b2756685faae30f8487da1b56505a8f78b0c"
+checksum = "80e04d1dcff3aae0704555fe5fee3bcfaf3d1fdf8a7e521d5b9d2b42acb52cec"
 dependencies = [
+ "hermit-abi",
  "libc",
  "wasi",
- "windows-sys 0.48.0",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
 name = "mockito"
-version = "1.4.0"
+version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d2f6e023aa5bdf392aa06c78e4a4e6d498baab5138d0c993503350ebbc37bf1e"
+checksum = "09b34bd91b9e5c5b06338d392463e1318d683cf82ec3d3af4014609be6e2108d"
 dependencies = [
  "assert-json-diff",
+ "bytes",
  "colored",
- "futures-core",
- "hyper 0.14.30",
+ "futures-util",
+ "http",
+ "http-body",
+ "http-body-util",
+ "hyper",
+ "hyper-util",
  "log",
  "rand",
  "regex",
@@ -1486,6 +1514,16 @@ version = "1.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "650eef8c711430f1a879fdd01d4745a7deea475becfb90269c06775983bbf086"
 
+[[package]]
+name = "nu-ansi-term"
+version = "0.46.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77a8165726e8236064dbb45459242600304b42a5ea24ee2948e18e023bf7ba84"
+dependencies = [
+ "overload",
+ "winapi",
+]
+
 [[package]]
 name = "num-bigint"
 version = "0.2.6"
@@ -1532,21 +1570,11 @@ dependencies = [
  "autocfg",
 ]
 
-[[package]]
-name = "num_cpus"
-version = "1.16.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4161fcb6d602d4d2081af7c3a45852d875a03dd337a6bfdd6e06407b61342a43"
-dependencies = [
- "hermit-abi",
- "libc",
-]
-
 [[package]]
 name = "object"
-version = "0.36.1"
+version = "0.36.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "081b846d1d56ddfc18fdf1a922e4f6e07a11768ea1b92dec44e42b72712ccfce"
+checksum = "27b64972346851a39438c60b341ebc01bba47464ae329e55cf343eb93964efd9"
 dependencies = [
  "memchr",
 ]
@@ -1563,6 +1591,12 @@ version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381"
 
+[[package]]
+name = "overload"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b15813163c1d831bf4a13c3610c05c0d03b39feb07f7e09fa234dac9b15aaf39"
+
 [[package]]
 name = "p256"
 version = "0.13.2"
@@ -1686,7 +1720,7 @@ checksum = "2f38a4412a78282e09a2cf38d195ea5420d15ba0602cb375210efbc877243965"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.71",
+ "syn 2.0.76",
 ]
 
 [[package]]
@@ -1729,9 +1763,12 @@ checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
 
 [[package]]
 name = "ppv-lite86"
-version = "0.2.17"
+version = "0.2.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b40af805b3121feab8a3c29f04d8ad262fa8e0561883e7653e024ae4479e6de"
+checksum = "77957b295656769bb8ad2b6a6b09d897d94f05c41b069aede1fcdaa675eaea04"
+dependencies = [
+ "zerocopy",
+]
 
 [[package]]
 name = "precomputed-hash"
@@ -1779,16 +1816,17 @@ dependencies = [
 
 [[package]]
 name = "quinn"
-version = "0.11.2"
+version = "0.11.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e4ceeeeabace7857413798eb1ffa1e9c905a9946a57d81fb69b4b71c4d8eb3ad"
+checksum = "b22d8e7369034b9a7132bc2008cac12f2013c8132b45e0554e6e20e2617f2156"
 dependencies = [
  "bytes",
  "pin-project-lite",
  "quinn-proto",
  "quinn-udp",
- "rustc-hash 1.1.0",
+ "rustc-hash",
  "rustls",
+ "socket2",
  "thiserror",
  "tokio",
  "tracing",
@@ -1803,7 +1841,7 @@ dependencies = [
  "bytes",
  "rand",
  "ring",
- "rustc-hash 2.0.0",
+ "rustc-hash",
  "rustls",
  "slab",
  "thiserror",
@@ -1813,9 +1851,9 @@ dependencies = [
 
 [[package]]
 name = "quinn-udp"
-version = "0.5.2"
+version = "0.5.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9096629c45860fc7fb143e125eb826b5e721e10be3263160c7d60ca832cf8c46"
+checksum = "8bffec3605b73c6f1754535084a85229fa8a30f86014e6c81aeec4abb68b0285"
 dependencies = [
  "libc",
  "once_cell",
@@ -1826,9 +1864,9 @@ dependencies = [
 
 [[package]]
 name = "quote"
-version = "1.0.36"
+version = "1.0.37"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0fa76aaf39101c457836aec0ce2316dbdc3ab723cdda1c6bd4e6ad4208acaca7"
+checksum = "b5b9d34b8991d19d98081b46eacdd8eb58c6f2b201139f7c5f643cc155a633af"
 dependencies = [
  "proc-macro2",
 ]
@@ -1880,9 +1918,9 @@ dependencies = [
 
 [[package]]
 name = "redox_users"
-version = "0.4.5"
+version = "0.4.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bd283d9651eeda4b2a83a43c1c91b266c40fd76ecd39a50a8c630ae69dc72891"
+checksum = "ba009ff324d1fc1b900bd1fdb31564febe58a8ccc8a6fdbb93b543d33b13ca43"
 dependencies = [
  "getrandom",
  "libredox",
@@ -1894,11 +1932,14 @@ name = "ref-tests"
 version = "0.0.0"
 dependencies = [
  "candid",
+ "ed25519-consensus",
  "ic-agent",
  "ic-certification",
  "ic-identity-hsm",
  "ic-utils",
- "ring",
+ "k256",
+ "p256",
+ "rand",
  "serde",
  "serde_cbor",
  "sha2 0.10.8",
@@ -1907,9 +1948,9 @@ dependencies = [
 
 [[package]]
 name = "regex"
-version = "1.10.5"
+version = "1.10.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b91213439dad192326a0d7c6ee3955910425f441d7038e0d6933b0aec5c4517f"
+checksum = "4219d74c6b67a3654a9fbebc4b419e22126d13d2f3c4a07ee0cb61ff79a79619"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -1942,19 +1983,19 @@ checksum = "7a66a03ae7c801facd77a29370b4faec201768915ac14a721ba36f20bc9c209b"
 
 [[package]]
 name = "reqwest"
-version = "0.12.5"
+version = "0.12.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c7d6d2a27d57148378eb5e111173f4276ad26340ecc5c49a4a2152167a2d6a37"
+checksum = "f8f4955649ef5c38cc7f9e8aa41761d48fb9677197daea9984dc54f56aad5e63"
 dependencies = [
  "base64",
  "bytes",
  "futures-channel",
  "futures-core",
  "futures-util",
- "http 1.1.0",
- "http-body 1.0.1",
+ "http",
+ "http-body",
  "http-body-util",
- "hyper 1.4.1",
+ "hyper",
  "hyper-rustls",
  "hyper-util",
  "ipnet",
@@ -1982,7 +2023,7 @@ dependencies = [
  "wasm-streams",
  "web-sys",
  "webpki-roots",
- "winreg",
+ "windows-registry",
 ]
 
 [[package]]
@@ -2016,12 +2057,6 @@ version = "0.1.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "719b953e2095829ee67db738b3bfa9fa368c94900df327b3f07fe6e794d2fe1f"
 
-[[package]]
-name = "rustc-hash"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
-
 [[package]]
 name = "rustc-hash"
 version = "2.0.0"
@@ -2030,9 +2065,9 @@ checksum = "583034fd73374156e66797ed8e5b0d5690409c9226b22d87cb7f19821c05d152"
 
 [[package]]
 name = "rustls"
-version = "0.23.11"
+version = "0.23.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4828ea528154ae444e5a642dbb7d5623354030dc9822b83fd9bb79683c7399d0"
+checksum = "c58f8c84392efc0a126acce10fa59ff7b3d2ac06ab451a33f2741989b806b044"
 dependencies = [
  "once_cell",
  "ring",
@@ -2044,9 +2079,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-pemfile"
-version = "2.1.2"
+version = "2.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "29993a25686778eb88d4189742cd713c9bce943bc54251a33509dc63cbacf73d"
+checksum = "196fe16b00e106300d3e45ecfcb764fa292a535d7326a29a5875c579c7417425"
 dependencies = [
  "base64",
  "rustls-pki-types",
@@ -2054,15 +2089,15 @@ dependencies = [
 
 [[package]]
 name = "rustls-pki-types"
-version = "1.7.0"
+version = "1.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "976295e77ce332211c0d24d92c0e83e50f5c5f046d11082cea19f3df13a3562d"
+checksum = "0e696e35370c65c9c541198af4543ccd580cf17fc25d8e05c5a242b202488c55"
 
 [[package]]
 name = "rustls-webpki"
-version = "0.102.5"
+version = "0.102.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f9a6fccd794a42c2c105b513a2f62bc3fd8f3ba57a4593677ceb0bd035164d78"
+checksum = "64ca1bc8749bd4cf37b5ce386cc146580777b4e8572c7b97baf22c83f444bee9"
 dependencies = [
  "ring",
  "rustls-pki-types",
@@ -2124,9 +2159,9 @@ checksum = "61697e0a1c7e512e84a621326239844a24d8207b4669b41bc18b32ea5cbf988b"
 
 [[package]]
 name = "serde"
-version = "1.0.204"
+version = "1.0.209"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bc76f558e0cbb2a839d37354c575f1dc3fdc6546b5be373ba43d95f231bf7c12"
+checksum = "99fce0ffe7310761ca6bf9faf5115afbc19688edd00171d81b1bb1b116c63e09"
 dependencies = [
  "serde_derive",
 ]
@@ -2152,22 +2187,23 @@ dependencies = [
 
 [[package]]
 name = "serde_derive"
-version = "1.0.204"
+version = "1.0.209"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e0cd7e117be63d3c3678776753929474f3b04a43a080c744d6b0ae2a8c28e222"
+checksum = "a5831b979fd7b5439637af1752d535ff49f4860c0f341d1baeb6faf0f4242170"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.71",
+ "syn 2.0.76",
 ]
 
 [[package]]
 name = "serde_json"
-version = "1.0.120"
+version = "1.0.127"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4e0d21c9a8cae1235ad58a00c11cb40d4b1e5c784f1ef2c537876ed6ffd8b7c5"
+checksum = "8043c06d9f82bd7271361ed64f415fe5e12a77fdb52e573e7f06a516dea329ad"
 dependencies = [
  "itoa",
+ "memchr",
  "ryu",
  "serde",
 ]
@@ -2180,7 +2216,7 @@ checksum = "6c64451ba24fc7a6a2d60fc75dd9c83c90903b19028d4eff35e88fc1e86564e9"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.71",
+ "syn 2.0.76",
 ]
 
 [[package]]
@@ -2219,6 +2255,21 @@ dependencies = [
  "digest 0.10.7",
 ]
 
+[[package]]
+name = "sharded-slab"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f40ca3c46823713e0d4209592e8d6e826aa57e928f09752619fc696c499637f6"
+dependencies = [
+ "lazy_static",
+]
+
+[[package]]
+name = "shlex"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
+
 [[package]]
 name = "signal-hook-registry"
 version = "1.4.2"
@@ -2240,9 +2291,9 @@ dependencies = [
 
 [[package]]
 name = "similar"
-version = "2.5.0"
+version = "2.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fa42c91313f1d05da9b26f267f931cf178d4aba455b4c4622dd7355eb80c6640"
+checksum = "1de1d4f81173b03af4c0cbed3c898f6bff5b870e4a7f5d6f4057d62a7a4b686e"
 
 [[package]]
 name = "simple_asn1"
@@ -2305,15 +2356,27 @@ dependencies = [
 
 [[package]]
 name = "stacker"
-version = "0.1.15"
+version = "0.1.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c886bd4480155fd3ef527d45e9ac8dd7118a898a46530b7b94c3e21866259fce"
+checksum = "95a5daa25ea337c85ed954c0496e3bdd2c7308cc3b24cf7b50d04876654c579f"
 dependencies = [
  "cc",
  "cfg-if",
  "libc",
  "psm",
- "winapi",
+ "windows-sys 0.36.1",
+]
+
+[[package]]
+name = "stop-token"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "af91f480ee899ab2d9f8435bfdfc14d08a5754bd9d3fef1f1a1c23336aad6c8b"
+dependencies = [
+ "async-channel",
+ "cfg-if",
+ "futures-core",
+ "pin-project-lite",
 ]
 
 [[package]]
@@ -2351,7 +2414,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "rustversion",
- "syn 2.0.71",
+ "syn 2.0.76",
 ]
 
 [[package]]
@@ -2379,9 +2442,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "2.0.71"
+version = "2.0.76"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b146dcf730474b4bcd16c311627b31ede9ab149045db4d6088b3becaea046462"
+checksum = "578e081a14e0cefc3279b0472138c513f37b41a08d5a3cca9b6e4e8ceb6cd525"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2393,6 +2456,9 @@ name = "sync_wrapper"
 version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a7065abeca94b6a8a577f9bd45aa0867a2238b74e8eb67cf10d492bc39351394"
+dependencies = [
+ "futures-core",
+]
 
 [[package]]
 name = "term"
@@ -2431,7 +2497,17 @@ checksum = "a4558b58466b9ad7ca0f102865eccc95938dca1a74a856f2b57b6629050da261"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.71",
+ "syn 2.0.76",
+]
+
+[[package]]
+name = "thread_local"
+version = "1.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b9ef9bad013ada3808854ceac7b46812a6465ba368859a37e2100283d2d719c"
+dependencies = [
+ "cfg-if",
+ "once_cell",
 ]
 
 [[package]]
@@ -2492,32 +2568,31 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 
 [[package]]
 name = "tokio"
-version = "1.38.1"
+version = "1.39.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eb2caba9f80616f438e09748d5acda951967e1ea58508ef53d9c6402485a46df"
+checksum = "9babc99b9923bfa4804bd74722ff02c0381021eafa4db9949217e3be8e84fff5"
 dependencies = [
  "backtrace",
  "bytes",
  "libc",
  "mio",
- "num_cpus",
  "parking_lot",
  "pin-project-lite",
  "signal-hook-registry",
  "socket2",
  "tokio-macros",
- "windows-sys 0.48.0",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
 name = "tokio-macros"
-version = "2.3.0"
+version = "2.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f5ae998a069d4b5aba8ee9dad856af7d520c3699e6159b185c2acd48155d39a"
+checksum = "693d596312e88961bc67d7f1f97af8a70227d9f90c31bba5806eec004978d752"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.71",
+ "syn 2.0.76",
 ]
 
 [[package]]
@@ -2561,15 +2636,15 @@ dependencies = [
 
 [[package]]
 name = "tower-layer"
-version = "0.3.2"
+version = "0.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c20c8dbed6283a09604c3e69b4b7eeb54e298b8a600d4d5ecb5ad39de609f1d0"
+checksum = "121c2a6cda46980bb0fcd1647ffaf6cd3fc79a013de288782836f6df9c48780e"
 
 [[package]]
 name = "tower-service"
-version = "0.3.2"
+version = "0.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6bc1c9ce2b5135ac7f93c72918fc37feb872bdc6a5533a8b85eb4b86bfdae52"
+checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3"
 
 [[package]]
 name = "tracing"
@@ -2590,7 +2665,7 @@ checksum = "34704c8d6ebcbc939824180af020566b01a7c01f80641264eba0999f6c2b6be7"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.71",
+ "syn 2.0.76",
 ]
 
 [[package]]
@@ -2600,6 +2675,32 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c06d3da6113f116aaee68e4d601191614c9053067f9ab7f6edbcb161237daa54"
 dependencies = [
  "once_cell",
+ "valuable",
+]
+
+[[package]]
+name = "tracing-log"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee855f1f400bd0e5c02d150ae5de3840039a3f54b025156404e34c23c03f47c3"
+dependencies = [
+ "log",
+ "once_cell",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-subscriber"
+version = "0.3.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ad0f048c97dbd9faa9b7df56362b8ebcaa52adb06b498c050d2f4e32f90a7a8b"
+dependencies = [
+ "nu-ansi-term",
+ "sharded-slab",
+ "smallvec",
+ "thread_local",
+ "tracing-core",
+ "tracing-log",
 ]
 
 [[package]]
@@ -2655,9 +2756,9 @@ checksum = "0336d538f7abc86d282a4189614dfaa90810dfc2c6f6427eaf88e16311dd225d"
 
 [[package]]
 name = "unicode-xid"
-version = "0.2.4"
+version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f962df74c8c05a667b5ee8bcf162993134c104e96440b663c8daa176dc772d8c"
+checksum = "229730647fbc343e3a80e463c1db7f78f3855d3f3739bee0dda773c9a037c90a"
 
 [[package]]
 name = "untrusted"
@@ -2682,11 +2783,17 @@ version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
 
+[[package]]
+name = "valuable"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "830b7e5d4d90034032940e4ace0d9a9a057e7a45cd94e6c007832e39edb82f6d"
+
 [[package]]
 name = "version_check"
-version = "0.9.4"
+version = "0.9.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "49874b5167b65d7193b8aba1567f5c7d93d001cafc34600cee003eda787e483f"
+checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
 
 [[package]]
 name = "walkdir"
@@ -2715,34 +2822,35 @@ checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
 
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.92"
+version = "0.2.93"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4be2531df63900aeb2bca0daaaddec08491ee64ceecbee5076636a3b026795a8"
+checksum = "a82edfc16a6c469f5f44dc7b571814045d60404b55a0ee849f9bcfa2e63dd9b5"
 dependencies = [
  "cfg-if",
+ "once_cell",
  "wasm-bindgen-macro",
 ]
 
 [[package]]
 name = "wasm-bindgen-backend"
-version = "0.2.92"
+version = "0.2.93"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "614d787b966d3989fa7bb98a654e369c762374fd3213d212cfc0251257e747da"
+checksum = "9de396da306523044d3302746f1208fa71d7532227f15e347e2d93e4145dd77b"
 dependencies = [
  "bumpalo",
  "log",
  "once_cell",
  "proc-macro2",
  "quote",
- "syn 2.0.71",
+ "syn 2.0.76",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-futures"
-version = "0.4.42"
+version = "0.4.43"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "76bc14366121efc8dbb487ab05bcc9d346b3b5ec0eaa76e46594cabbe51762c0"
+checksum = "61e9300f63a621e96ed275155c108eb6f843b6a26d053f122ab69724559dc8ed"
 dependencies = [
  "cfg-if",
  "js-sys",
@@ -2752,9 +2860,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.92"
+version = "0.2.93"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1f8823de937b71b9460c0c34e25f3da88250760bec0ebac694b49997550d726"
+checksum = "585c4c91a46b072c92e908d99cb1dcdf95c5218eeb6f3bf1efa991ee7a68cccf"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -2762,31 +2870,32 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.92"
+version = "0.2.93"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e94f17b526d0a461a191c78ea52bbce64071ed5c04c9ffe424dcb38f74171bb7"
+checksum = "afc340c74d9005395cf9dd098506f7f44e38f2b4a21c6aaacf9a105ea5e1e836"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.71",
+ "syn 2.0.76",
  "wasm-bindgen-backend",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.92"
+version = "0.2.93"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "af190c94f2773fdb3729c55b007a722abb5384da03bc0986df4c289bf5567e96"
+checksum = "c62a0a307cb4a311d3a07867860911ca130c3494e8c2719593806c08bc5d0484"
 
 [[package]]
 name = "wasm-bindgen-test"
-version = "0.3.42"
+version = "0.3.43"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d9bf62a58e0780af3e852044583deee40983e5886da43a271dd772379987667b"
+checksum = "68497a05fb21143a08a7d24fc81763384a3072ee43c44e86aad1744d6adef9d9"
 dependencies = [
  "console_error_panic_hook",
  "js-sys",
+ "minicov",
  "scoped-tls",
  "wasm-bindgen",
  "wasm-bindgen-futures",
@@ -2795,13 +2904,13 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-test-macro"
-version = "0.3.42"
+version = "0.3.43"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b7f89739351a2e03cb94beb799d47fb2cac01759b40ec441f7de39b00cbf7ef0"
+checksum = "4b8220be1fa9e4c889b30fd207d4906657e7e90b12e0e6b0c8b8d8709f5de021"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.71",
+ "syn 2.0.76",
 ]
 
 [[package]]
@@ -2819,9 +2928,9 @@ dependencies = [
 
 [[package]]
 name = "web-sys"
-version = "0.3.69"
+version = "0.3.70"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77afa9a11836342370f4817622a2f0f418b134426d91a82dfb48f532d2ec13ef"
+checksum = "26fdeaafd9bd129f65e7c031593c24d62186301e0c72c8978fa1678be7d532c0"
 dependencies = [
  "js-sys",
  "wasm-bindgen",
@@ -2854,11 +2963,11 @@ checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
 
 [[package]]
 name = "winapi-util"
-version = "0.1.8"
+version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4d4cc384e1e73b93bafa6fb4f1df8c41695c8a91cf9c4c64358067d15a7b6c6b"
+checksum = "cf221c93e13a30d793f7645a0e7762c55d169dbb0a49671918a2319d289b10bb"
 dependencies = [
- "windows-sys 0.52.0",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -2867,6 +2976,49 @@ version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
+[[package]]
+name = "windows-registry"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e400001bb720a623c1c69032f8e3e4cf09984deec740f007dd2b03ec864804b0"
+dependencies = [
+ "windows-result",
+ "windows-strings",
+ "windows-targets 0.52.6",
+]
+
+[[package]]
+name = "windows-result"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d1043d8214f791817bab27572aaa8af63732e11bf84aa21a45a78d6c317ae0e"
+dependencies = [
+ "windows-targets 0.52.6",
+]
+
+[[package]]
+name = "windows-strings"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4cd9b125c486025df0eabcb585e62173c6c9eddcec5d117d3b6e8c30e2ee4d10"
+dependencies = [
+ "windows-result",
+ "windows-targets 0.52.6",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.36.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ea04155a16a59f9eab786fe12a4a450e75cdb175f9e0d80da1e17db09f55b8d2"
+dependencies = [
+ "windows_aarch64_msvc 0.36.1",
+ "windows_i686_gnu 0.36.1",
+ "windows_i686_msvc 0.36.1",
+ "windows_x86_64_gnu 0.36.1",
+ "windows_x86_64_msvc 0.36.1",
+]
+
 [[package]]
 name = "windows-sys"
 version = "0.48.0"
@@ -2885,6 +3037,15 @@ dependencies = [
  "windows-targets 0.52.6",
 ]
 
+[[package]]
+name = "windows-sys"
+version = "0.59.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b"
+dependencies = [
+ "windows-targets 0.52.6",
+]
+
 [[package]]
 name = "windows-targets"
 version = "0.48.5"
@@ -2928,6 +3089,12 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
 
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.36.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9bb8c3fd39ade2d67e9874ac4f3db21f0d710bee00fe7cab16949ec184eeaa47"
+
 [[package]]
 name = "windows_aarch64_msvc"
 version = "0.48.5"
@@ -2940,6 +3107,12 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
 
+[[package]]
+name = "windows_i686_gnu"
+version = "0.36.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "180e6ccf01daf4c426b846dfc66db1fc518f074baa793aa7d9b9aaeffad6a3b6"
+
 [[package]]
 name = "windows_i686_gnu"
 version = "0.48.5"
@@ -2958,6 +3131,12 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
 
+[[package]]
+name = "windows_i686_msvc"
+version = "0.36.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2e7917148b2812d1eeafaeb22a97e4813dfa60a3f8f78ebe204bcc88f12f024"
+
 [[package]]
 name = "windows_i686_msvc"
 version = "0.48.5"
@@ -2970,6 +3149,12 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
 
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.36.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4dcd171b8776c41b97521e5da127a2d86ad280114807d0b2ab1e462bc764d9e1"
+
 [[package]]
 name = "windows_x86_64_gnu"
 version = "0.48.5"
@@ -2994,6 +3179,12 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
 
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.36.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c811ca4a8c853ef420abd8592ba53ddbbac90410fab6903b3e79972a631f7680"
+
 [[package]]
 name = "windows_x86_64_msvc"
 version = "0.48.5"
@@ -3006,22 +3197,13 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
 
-[[package]]
-name = "winreg"
-version = "0.52.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a277a57398d4bfa075df44f501a17cfdf8542d224f0d36095a2adc7aee4ef0a5"
-dependencies = [
- "cfg-if",
- "windows-sys 0.48.0",
-]
-
 [[package]]
 name = "zerocopy"
 version = "0.7.35"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1b9b4fd18abc82b8136838da5d50bae7bdea537c574d8dc1a34ed098d6c166f0"
 dependencies = [
+ "byteorder",
  "zerocopy-derive",
 ]
 
@@ -3033,7 +3215,7 @@ checksum = "fa4f8080344d4671fb4e831a13ad1e68092748387dfc4f55e356242fae12ce3e"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.71",
+ "syn 2.0.76",
 ]
 
 [[package]]
diff --git a/Cargo.toml b/Cargo.toml
index 17240f3a..0de99756 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -11,7 +11,7 @@ members = [
 ]
 
 [workspace.package]
-version = "0.38.1"
+version = "0.39.1"
 authors = ["DFINITY Stiftung <sdk@dfinity.org>"]
 edition = "2021"
 repository = "https://github.com/dfinity/agent-rs"
@@ -22,19 +22,22 @@ rust-version = "1.75.0"
 license = "Apache-2.0"
 
 [workspace.dependencies]
-ic-agent = { path = "ic-agent", version = "0.38.1", default-features = false }
-ic-utils = { path = "ic-utils", version = "0.38.1" }
-ic-transport-types = { path = "ic-transport-types", version = "0.38.1" }
+ic-agent = { path = "ic-agent", version = "0.39.1", default-features = false }
+ic-utils = { path = "ic-utils", version = "0.39.1" }
+ic-transport-types = { path = "ic-transport-types", version = "0.39.1" }
 
 ic-certification = "2.2"
 candid = "0.10.1"
 candid_parser = "0.1.1"
 clap = "4.4.3"
+ed25519-consensus = "2.1.0"
 futures-util = "0.3.21"
 hex = "0.4.3"
+k256 = "0.13.4"
 leb128 = "0.2.5"
+p256 = "0.13.2"
+rand = "0.8.5"
 reqwest = { version = "0.12", default-features = false }
-ring = "0.17.7"
 serde = "1.0.162"
 serde_bytes = "0.11.13"
 serde_cbor = "0.11.2"
diff --git a/LICENSE b/LICENSE
index b27ba1fe..b752c47a 100644
--- a/LICENSE
+++ b/LICENSE
@@ -186,7 +186,7 @@
       same "printed page" as the copyright notice for easier
       identification within third-party archives.
 
-   Copyright 2020 DFINITY LLC.
+   Copyright 2020 DFINITY Stiftung.
 
    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.
diff --git a/ic-agent/Cargo.toml b/ic-agent/Cargo.toml
index 9f47aa5e..d2ec96f2 100644
--- a/ic-agent/Cargo.toml
+++ b/ic-agent/Cargo.toml
@@ -15,11 +15,18 @@ keywords = ["internet-computer", "agent", "icp", "dfinity"]
 include = ["src", "Cargo.toml", "../LICENSE", "README.md"]
 
 [dependencies]
+arc-swap = "1.7"
+async-channel = "1.9"
 async-lock = "3.3"
+async-watch = "0.3"
+async-trait = "0.1"
 backoff = "0.4.0"
 cached = { version = "0.52", features = ["ahash"], default-features = false }
 candid = { workspace = true }
-ed25519-consensus = { version = "2" }
+der = "0.7"
+ecdsa = "0.16"
+ed25519-consensus = { workspace = true }
+elliptic-curve = "0.13"
 futures-util = { workspace = true }
 hex = { workspace = true }
 http = "1.0.0"
@@ -27,22 +34,26 @@ http-body = "1.0.0"
 ic-certification = { workspace = true }
 ic-transport-types = { workspace = true }
 ic-verify-bls-signature = "0.5"
-k256 = { version = "0.13.1", features = ["pem"] }
-p256 = { version = "0.13.2", features = ["pem"] }
+indexmap = "2.4"
+k256 = { workspace = true, features = ["pem"] }
+p256 = { workspace = true, features = ["pem"] }
 leb128 = { workspace = true }
 pkcs8 = { version = "0.10.2", features = ["std"] }
 sec1 = { version = "0.7.2", features = ["pem"] }
-rand = "0.8.5"
+rand = { workspace = true }
 rangemap = "1.4"
-ring = { workspace = true, features = ["std"] }
+ring = { version = "0.17", optional = true }
 serde = { workspace = true, features = ["derive"] }
 serde_bytes = { workspace = true }
 serde_cbor = { workspace = true }
 serde_repr = { workspace = true }
 sha2 = { workspace = true }
 simple_asn1 = "0.6.1"
+stop-token = "0.7"
 thiserror = { workspace = true }
 time = { workspace = true }
+tower-service = "0.3"
+tracing = "0.1"
 url = "2.1.0"
 
 [dependencies.reqwest]
@@ -56,7 +67,6 @@ optional = true
 
 [target.'cfg(not(target_family = "wasm"))'.dependencies]
 tokio = { version = "1.24.2", features = ["time"] }
-rustls-webpki = "0.102"
 
 [target.'cfg(target_family = "wasm")'.dependencies]
 getrandom = { version = "0.2", features = ["js"], optional = true }
@@ -67,6 +77,7 @@ web-sys = { version = "0.3", features = ["Window"], optional = true }
 
 [dev-dependencies]
 serde_json.workspace = true
+tracing-subscriber = "0.3"
 
 [target.'cfg(not(target_family = "wasm"))'.dev-dependencies]
 tokio = { workspace = true, features = ["full"] }
@@ -85,6 +96,7 @@ web-sys = { version = "0.3", features = [
 [features]
 default = ["pem"]
 pem = ["dep:pem"]
+ring = ["dep:ring"]
 ic_ref_tests = [
     "default",
 ] # Used to separate integration tests for ic-ref which need a server running.
diff --git a/ic-agent/src/agent/agent_config.rs b/ic-agent/src/agent/agent_config.rs
index 6899e05f..e3858905 100644
--- a/ic-agent/src/agent/agent_config.rs
+++ b/ic-agent/src/agent/agent_config.rs
@@ -1,13 +1,15 @@
+use reqwest::Client;
+
 use crate::{
     agent::{NonceFactory, NonceGenerator},
     identity::{anonymous::AnonymousIdentity, Identity},
 };
-use reqwest::Client;
 use std::{sync::Arc, time::Duration};
 
-use super::route_provider::RouteProvider;
+use super::{route_provider::RouteProvider, HttpService};
 
 /// A configuration for an agent.
+#[derive(Clone)]
 #[non_exhaustive]
 pub struct AgentConfig {
     /// See [`with_nonce_factory`](super::AgentBuilder::with_nonce_factory).
@@ -15,7 +17,7 @@ pub struct AgentConfig {
     /// See [`with_identity`](super::AgentBuilder::with_identity).
     pub identity: Arc<dyn Identity>,
     /// See [`with_ingress_expiry`](super::AgentBuilder::with_ingress_expiry).
-    pub ingress_expiry: Option<Duration>,
+    pub ingress_expiry: Duration,
     /// See [`with_http_client`](super::AgentBuilder::with_http_client).
     pub client: Option<Client>,
     /// See [`with_route_provider`](super::AgentBuilder::with_route_provider).
@@ -28,6 +30,12 @@ pub struct AgentConfig {
     pub max_response_body_size: Option<usize>,
     /// See [`with_max_tcp_error_retries`](super::AgentBuilder::with_max_tcp_error_retries).
     pub max_tcp_error_retries: usize,
+    /// See [`with_preset_root_key`](super::AgentBuilder::with_preset_root_key).
+    pub root_key: Option<Vec<u8>>,
+    /// See [`with_arc_http_middleware`](super::AgentBuilder::with_arc_http_middleware).
+    pub http_service: Option<Arc<dyn HttpService>>,
+    /// See [`with_max_polling_time`](super::AgentBuilder::with_max_polling_time).
+    pub max_polling_time: Duration,
 }
 
 impl Default for AgentConfig {
@@ -35,13 +43,16 @@ impl Default for AgentConfig {
         Self {
             nonce_factory: Arc::new(NonceFactory::random()),
             identity: Arc::new(AnonymousIdentity {}),
-            ingress_expiry: None,
+            ingress_expiry: Duration::from_secs(3 * 60),
             client: None,
+            http_service: None,
             verify_query_signatures: true,
             max_concurrent_requests: 50,
             route_provider: None,
             max_response_body_size: None,
             max_tcp_error_retries: 0,
+            root_key: None,
+            max_polling_time: Duration::from_secs(60 * 5),
         }
     }
 }
diff --git a/ic-agent/src/agent/agent_error.rs b/ic-agent/src/agent/agent_error.rs
index b346c537..dc2b03c4 100644
--- a/ic-agent/src/agent/agent_error.rs
+++ b/ic-agent/src/agent/agent_error.rs
@@ -98,7 +98,7 @@ pub enum AgentError {
     #[error("The request status ({1}) at path {0:?} is invalid.")]
     InvalidRequestStatus(Vec<Label>, String),
 
-    /// The certificate verification for a read_state call failed.
+    /// The certificate verification for a `read_state` call failed.
     #[error("Certificate verification failed.")]
     CertificateVerificationFailed(),
 
@@ -106,7 +106,7 @@ pub enum AgentError {
     #[error("Query signature verification failed.")]
     QuerySignatureVerificationFailed,
 
-    /// The certificate contained a delegation that does not include the effective_canister_id in the canister_ranges field.
+    /// The certificate contained a delegation that does not include the `effective_canister_id` in the `canister_ranges` field.
     #[error("Certificate is not authorized to respond to queries for this canister. While developing: Did you forget to set effective_canister_id?")]
     CertificateNotAuthorized(),
 
@@ -211,7 +211,7 @@ impl PartialEq for AgentError {
     fn eq(&self, other: &Self) -> bool {
         // Verify the debug string is the same. Some of the subtypes of this error
         // don't implement Eq or PartialEq, so we cannot rely on derive.
-        format!("{:?}", self) == format!("{:?}", other)
+        format!("{self:?}") == format!("{other:?}")
     }
 }
 
@@ -239,7 +239,7 @@ impl HttpErrorPayload {
         f.write_fmt(format_args!(
             "Http Error: status {}, content type {:?}, content: {}",
             http::StatusCode::from_u16(self.status)
-                .map_or_else(|_| format!("{}", self.status), |code| format!("{}", code)),
+                .map_or_else(|_| format!("{}", self.status), |code| format!("{code}")),
             self.content_type.clone().unwrap_or_default(),
             String::from_utf8(self.content.clone()).unwrap_or_else(|_| format!(
                 "(unable to decode content as UTF-8: {:?})",
diff --git a/ic-agent/src/agent/agent_test.rs b/ic-agent/src/agent/agent_test.rs
index 07416536..6cf92633 100644
--- a/ic-agent/src/agent/agent_test.rs
+++ b/ic-agent/src/agent/agent_test.rs
@@ -37,7 +37,7 @@ fn make_untimed_agent(url: &str) -> Agent {
     Agent::builder()
         .with_url(url)
         .with_verify_query_signatures(false)
-        .with_ingress_expiry(Some(Duration::from_secs(u32::MAX as _)))
+        .with_ingress_expiry(Duration::from_secs(u32::MAX.into()))
         .build()
         .unwrap()
 }
@@ -45,7 +45,7 @@ fn make_untimed_agent(url: &str) -> Agent {
 fn make_certifying_agent(url: &str) -> Agent {
     Agent::builder()
         .with_url(url)
-        .with_ingress_expiry(Some(Duration::from_secs(u32::MAX as _)))
+        .with_ingress_expiry(Duration::from_secs(u32::MAX.into()))
         .build()
         .unwrap()
 }
@@ -238,7 +238,7 @@ async fn call_rejected_without_error_code() -> Result<(), AgentError> {
 
     let (call_mock, url) = mock(
         "POST",
-        format!("/api/v3/canister/{}/call", canister_id_str).as_str(),
+        format!("/api/v3/canister/{canister_id_str}/call").as_str(),
         200,
         body,
         Some("application/cbor"),
@@ -475,7 +475,7 @@ async fn wrong_subnet_query_certificate() {
     let response = QueryResponse::Replied {
         reply: ReplyResponse { arg: blob.clone() },
         signatures: vec![NodeSignature {
-            timestamp: 1697831349698624964,
+            timestamp: 1_697_831_349_698_624_964,
             signature: hex::decode("4bb6ba316623395d56d8e2834ece39d2c81d47e76a9fd122e1457963be6a83a5589e2c98c7b4d8b3c6c7b11c74b8ce9dcb345b5d1bd91706a643f33c7b509b0b").unwrap(),
             identity: "oo4np-rrvnz-5vram-kglex-enhkp-uew6q-vdf6z-whj4x-v44jd-tebaw-nqe".parse().unwrap()
         }],
@@ -543,14 +543,14 @@ const RESP_WITH_SUBNET_KEY: &[u8] = include_bytes!("agent_test/with_subnet_key.b
 #[cfg_attr(target_family = "wasm", wasm_bindgen_test)]
 async fn too_many_delegations() {
     // Use the certificate as its own delegation, and repeat the process the specified number of times
-    fn self_delegate_cert(subnet_id: Vec<u8>, cert: &Certificate, depth: u32) -> Certificate {
+    fn self_delegate_cert(subnet_id: &[u8], cert: &Certificate, depth: u32) -> Certificate {
         let mut current = cert.clone();
         for _ in 0..depth {
             current = Certificate {
                 tree: current.tree.clone(),
                 signature: current.signature.clone(),
                 delegation: Some(Delegation {
-                    subnet_id: subnet_id.clone(),
+                    subnet_id: subnet_id.to_vec(),
                     certificate: serde_cbor::to_vec(&current).unwrap(),
                 }),
             }
@@ -568,7 +568,7 @@ async fn too_many_delegations() {
 
     let (_read_mock, url) = mock(
         "POST",
-        format!("/api/v2/canister/{}/read_state", canister_id_str).as_str(),
+        format!("/api/v2/canister/{canister_id_str}/read_state").as_str(),
         200,
         RESP_WITH_SUBNET_KEY.into(),
         Some("application/cbor"),
@@ -580,7 +580,7 @@ async fn too_many_delegations() {
         .read_state_raw(vec![vec![path_label]], canister_id)
         .await
         .expect("read state failed");
-    let new_cert = self_delegate_cert(subnet_id, &cert, 1);
+    let new_cert = self_delegate_cert(&subnet_id, &cert, 1);
     assert!(matches!(
         agent.verify(&new_cert, canister_id).unwrap_err(),
         AgentError::CertificateHasTooManyDelegations
diff --git a/ic-agent/src/agent/builder.rs b/ic-agent/src/agent/builder.rs
index 6c4e491c..fdeff6a8 100644
--- a/ic-agent/src/agent/builder.rs
+++ b/ic-agent/src/agent/builder.rs
@@ -1,12 +1,22 @@
 use url::Url;
 
 use crate::{
-    agent::{agent_config::AgentConfig, Agent},
+    agent::{
+        agent_config::AgentConfig,
+        route_provider::{
+            dynamic_routing::{
+                dynamic_route_provider::{DynamicRouteProviderBuilder, IC0_SEED_DOMAIN},
+                snapshot::latency_based_routing::LatencyRoutingSnapshot,
+            },
+            RouteProvider,
+        },
+        Agent, HttpService,
+    },
     AgentError, Identity, NonceFactory, NonceGenerator,
 };
 use std::sync::Arc;
 
-use super::route_provider::RouteProvider;
+use super::ApiBoundaryNode;
 
 /// A builder for an [`Agent`].
 #[derive(Default)]
@@ -20,12 +30,35 @@ impl AgentBuilder {
         Agent::new(self.config)
     }
 
+    /// Set the dynamic transport layer for the [`Agent`], performing continuos discovery of the API boundary nodes and routing traffic via them based on the latencies.
+    pub async fn with_discovery_transport(self, client: reqwest::Client) -> Self {
+        // TODO: This is a temporary solution to get the seed node.
+        let seed = ApiBoundaryNode {
+            domain: IC0_SEED_DOMAIN.to_string(),
+            ipv4_address: None,
+            ipv6_address: None,
+        };
+
+        let route_provider = DynamicRouteProviderBuilder::new(
+            LatencyRoutingSnapshot::new(),
+            vec![seed],
+            client.clone(),
+        )
+        .build()
+        .await;
+
+        let route_provider = Arc::new(route_provider) as Arc<dyn RouteProvider>;
+
+        self.with_http_client(client)
+            .with_arc_route_provider(route_provider)
+    }
+
     /// Set the URL of the [Agent].
     pub fn with_url<S: Into<String>>(self, url: S) -> Self {
         self.with_route_provider(url.into().parse::<Url>().unwrap())
     }
 
-    /// Add a NonceFactory to this Agent. By default, no nonce is produced.
+    /// Add a `NonceFactory` to this Agent. By default, no nonce is produced.
     pub fn with_nonce_factory(self, nonce_factory: NonceFactory) -> AgentBuilder {
         self.with_nonce_generator(nonce_factory)
     }
@@ -73,7 +106,7 @@ impl AgentBuilder {
     /// The timestamp corresponding to this duration may be rounded in order to reduce
     /// cache misses. The current implementation rounds to the nearest minute if the
     /// expiry is more than a minute, but this is not guaranteed.
-    pub fn with_ingress_expiry(mut self, ingress_expiry: Option<std::time::Duration>) -> Self {
+    pub fn with_ingress_expiry(mut self, ingress_expiry: std::time::Duration) -> Self {
         self.config.ingress_expiry = ingress_expiry;
         self
     }
@@ -106,10 +139,28 @@ impl AgentBuilder {
 
     /// Provide a pre-configured HTTP client to use. Use this to set e.g. HTTP timeouts or proxy configuration.
     pub fn with_http_client(mut self, client: reqwest::Client) -> Self {
+        assert!(
+            self.config.http_service.is_none(),
+            "with_arc_http_middleware cannot be called with with_http_client"
+        );
         self.config.client = Some(client);
         self
     }
 
+    /// Provide a custom `reqwest`-compatible HTTP service, e.g. to add per-request headers for custom boundary nodes.
+    /// Most users will not need this and should use `with_http_client`. Cannot be called with `with_http_client`.
+    ///
+    /// The trait is automatically implemented for any `tower::Service` impl matching the one `reqwest::Client` uses,
+    /// including `reqwest-middleware`. This is a low-level interface, and direct implementations must provide all automatic retry logic.
+    pub fn with_arc_http_middleware(mut self, service: Arc<dyn HttpService>) -> Self {
+        assert!(
+            self.config.client.is_none(),
+            "with_arc_http_middleware cannot be called with with_http_client"
+        );
+        self.config.http_service = Some(service);
+        self
+    }
+
     /// Retry up to the specified number of times upon encountering underlying TCP errors.
     pub fn with_max_tcp_error_retries(mut self, retries: usize) -> Self {
         self.config.max_tcp_error_retries = retries;
@@ -121,4 +172,14 @@ impl AgentBuilder {
         self.config.max_response_body_size = Some(max_size);
         self
     }
+    /// Set the maximum time to wait for a response from the replica.
+    pub fn with_max_polling_time(mut self, max_polling_time: std::time::Duration) -> Self {
+        self.config.max_polling_time = max_polling_time;
+        self
+    }
+    /// Sets a custom root key for a local replica.
+    pub fn with_preset_root_key(mut self, root_key: Vec<u8>) -> Self {
+        self.config.root_key = Some(root_key);
+        self
+    }
 }
diff --git a/ic-agent/src/agent/mod.rs b/ic-agent/src/agent/mod.rs
index ec44e482..33caa4ce 100644
--- a/ic-agent/src/agent/mod.rs
+++ b/ic-agent/src/agent/mod.rs
@@ -15,6 +15,7 @@ pub use agent_config::AgentConfig;
 pub use agent_error::AgentError;
 use agent_error::HttpErrorPayload;
 use async_lock::Semaphore;
+use async_trait::async_trait;
 pub use builder::AgentBuilder;
 use cached::{Cached, TimedCache};
 use ed25519_consensus::{Error as Ed25519Error, Signature, VerificationKey};
@@ -27,9 +28,11 @@ pub use ic_transport_types::{
 };
 pub use nonce::{NonceFactory, NonceGenerator};
 use rangemap::{RangeInclusiveMap, RangeInclusiveSet, StepFns};
-use reqwest::{Body, Client, Request};
+use reqwest::{Body, Client, Request, Response};
 use route_provider::RouteProvider;
 use time::OffsetDateTime;
+use tower_service::Service;
+use url::Url;
 
 #[cfg(test)]
 mod agent_test;
@@ -96,13 +99,9 @@ type AgentFuture<'a, V> = Pin<Box<dyn Future<Output = Result<V, AgentError>> + '
 /// }
 ///
 /// # fn create_identity() -> impl ic_agent::Identity {
-/// #     let rng = ring::rand::SystemRandom::new();
-/// #     let key_pair = ring::signature::Ed25519KeyPair::generate_pkcs8(&rng)
-/// #         .expect("Could not generate a key pair.");
 /// #
-/// #     ic_agent::identity::BasicIdentity::from_key_pair(
-/// #         ring::signature::Ed25519KeyPair::from_pkcs8(key_pair.as_ref())
-/// #           .expect("Could not read the key pair."),
+/// #     ic_agent::identity::BasicIdentity::from_signing_key(
+/// #         ed25519_consensus::SigningKey::new(rand::thread_rng())
 /// #     )
 /// # }
 /// #
@@ -142,18 +141,23 @@ type AgentFuture<'a, V> = Pin<Box<dyn Future<Output = Result<V, AgentError>> + '
 /// ```
 ///
 /// This agent does not understand Candid, and only acts on byte buffers.
+///
+/// Some methods return certificates. While there is a `verify_certificate` method, any certificate
+/// you receive from a method has already been verified and you do not need to manually verify it.
 #[derive(Clone)]
 pub struct Agent {
+    // If adding any BN-specific fields, exclude them from clone_with_url.
     nonce_factory: Arc<dyn NonceGenerator>,
     identity: Arc<dyn Identity>,
     ingress_expiry: Duration,
     root_key: Arc<RwLock<Vec<u8>>>,
-    client: Client,
+    client: Arc<dyn HttpService>,
     route_provider: Arc<dyn RouteProvider>,
     subnet_key_cache: Arc<Mutex<SubnetCache>>,
     concurrent_requests_semaphore: Arc<Semaphore>,
     verify_query_signatures: bool,
     max_response_body_size: Option<usize>,
+    max_polling_time: Duration,
     #[allow(dead_code)]
     max_tcp_error_retries: usize,
 }
@@ -175,24 +179,30 @@ impl Agent {
 
     /// Create an instance of an [`Agent`].
     pub fn new(config: agent_config::AgentConfig) -> Result<Agent, AgentError> {
-        Ok(Agent {
+        let agent = Agent {
             nonce_factory: config.nonce_factory,
             identity: config.identity,
-            ingress_expiry: config.ingress_expiry.unwrap_or(DEFAULT_INGRESS_EXPIRY),
-            root_key: Arc::new(RwLock::new(IC_ROOT_KEY.to_vec())),
-            client: config.client.unwrap_or_else(|| {
-                #[cfg(not(target_family = "wasm"))]
-                {
-                    Client::builder()
-                        .use_rustls_tls()
-                        .timeout(Duration::from_secs(360))
-                        .build()
-                        .expect("Could not create HTTP client.")
-                }
-                #[cfg(all(target_family = "wasm", feature = "wasm-bindgen"))]
-                {
-                    Client::new()
-                }
+            ingress_expiry: config.ingress_expiry,
+            root_key: Arc::new(RwLock::new(
+                config.root_key.unwrap_or_else(|| IC_ROOT_KEY.to_vec()),
+            )),
+            client: config.http_service.unwrap_or_else(|| {
+                Arc::new(Retry429Logic {
+                    client: config.client.unwrap_or_else(|| {
+                        #[cfg(not(target_family = "wasm"))]
+                        {
+                            Client::builder()
+                                .use_rustls_tls()
+                                .timeout(Duration::from_secs(360))
+                                .build()
+                                .expect("Could not create HTTP client.")
+                        }
+                        #[cfg(all(target_family = "wasm", feature = "wasm-bindgen"))]
+                        {
+                            Client::new()
+                        }
+                    }),
+                })
             }),
             route_provider: config
                 .route_provider
@@ -202,7 +212,10 @@ impl Agent {
             concurrent_requests_semaphore: Arc::new(Semaphore::new(config.max_concurrent_requests)),
             max_response_body_size: config.max_response_body_size,
             max_tcp_error_retries: config.max_tcp_error_retries,
-        })
+            max_polling_time: config.max_polling_time,
+        };
+        agent.route_provider.notify_start(agent.clone());
+        Ok(agent)
     }
 
     /// Set the identity provider for signing messages.
@@ -239,9 +252,8 @@ impl Agent {
             return Ok(());
         }
         let status = self.status().await?;
-        let root_key = match status.root_key {
-            Some(key) => key,
-            None => return Err(AgentError::NoRootKeyInStatus(status)),
+        let Some(root_key) = status.root_key else {
+            return Err(AgentError::NoRootKeyInStatus(status));
         };
         self.set_root_key(root_key);
         Ok(())
@@ -266,7 +278,7 @@ impl Agent {
         if self.ingress_expiry.as_secs() > 90 {
             rounded = rounded.replace_second(0).unwrap();
         }
-        rounded.unix_timestamp_nanos() as u64
+        rounded.unix_timestamp_nanos().try_into().unwrap()
     }
 
     /// Return the principal of the identity.
@@ -398,7 +410,7 @@ impl Agent {
         .await
     }
 
-    /// Helper function for performing both the query call and possibly a read_state to check the subnet node keys.
+    /// Helper function for performing both the query call and possibly a `read_state` to check the subnet node keys.
     ///
     /// This should be used instead of `query_endpoint`. No validation is performed on `signed_query`.
     async fn query_inner(
@@ -423,7 +435,7 @@ impl Agent {
             }
             for signature in response.signatures() {
                 if OffsetDateTime::now_utc()
-                    - OffsetDateTime::from_unix_timestamp_nanos(signature.timestamp as _).unwrap()
+                    - OffsetDateTime::from_unix_timestamp_nanos(signature.timestamp.into()).unwrap()
                     > self.ingress_expiry
                 {
                     return Err(AgentError::CertificateOutdated(self.ingress_expiry));
@@ -513,7 +525,7 @@ impl Agent {
         method_name: String,
         arg: Vec<u8>,
         ingress_expiry_datetime: Option<u64>,
-    ) -> Result<CallResponse<Vec<u8>>, AgentError> {
+    ) -> Result<CallResponse<(Vec<u8>, Certificate)>, AgentError> {
         let nonce = self.nonce_factory.generate();
         let content = self.update_content(
             canister_id,
@@ -535,10 +547,12 @@ impl Agent {
                     serde_cbor::from_slice(&certificate).map_err(AgentError::InvalidCborData)?;
 
                 self.verify(&certificate, effective_canister_id)?;
-                let status = lookup_request_status(certificate, &request_id)?;
+                let status = lookup_request_status(&certificate, &request_id)?;
 
                 match status {
-                    RequestStatusResponse::Replied(reply) => Ok(CallResponse::Response(reply.arg)),
+                    RequestStatusResponse::Replied(reply) => {
+                        Ok(CallResponse::Response((reply.arg, certificate)))
+                    }
                     RequestStatusResponse::Rejected(reject_response) => {
                         Err(AgentError::CertifiedReject(reject_response))?
                     }
@@ -574,7 +588,7 @@ impl Agent {
                     serde_cbor::from_slice(&certificate).map_err(AgentError::InvalidCborData)?;
 
                 self.verify(&certificate, effective_canister_id)?;
-                let status = lookup_request_status(certificate, &request_id)?;
+                let status = lookup_request_status(&certificate, &request_id)?;
 
                 match status {
                     RequestStatusResponse::Replied(reply) => Ok(CallResponse::Response(reply.arg)),
@@ -609,34 +623,34 @@ impl Agent {
         })
     }
 
-    fn get_retry_policy() -> ExponentialBackoff<SystemClock> {
+    fn get_retry_policy(&self) -> ExponentialBackoff<SystemClock> {
         ExponentialBackoffBuilder::new()
             .with_initial_interval(Duration::from_millis(500))
             .with_max_interval(Duration::from_secs(1))
             .with_multiplier(1.4)
-            .with_max_elapsed_time(Some(Duration::from_secs(60 * 5)))
+            .with_max_elapsed_time(Some(self.max_polling_time))
             .build()
     }
 
-    /// Wait for request_status to return a Replied response and return the arg.
+    /// Wait for `request_status` to return a Replied response and return the arg.
     pub async fn wait_signed(
         &self,
         request_id: &RequestId,
         effective_canister_id: Principal,
         signed_request_status: Vec<u8>,
-    ) -> Result<Vec<u8>, AgentError> {
-        let mut retry_policy = Self::get_retry_policy();
+    ) -> Result<(Vec<u8>, Certificate), AgentError> {
+        let mut retry_policy = self.get_retry_policy();
 
         let mut request_accepted = false;
+        let (resp, cert) = self
+            .request_status_signed(
+                request_id,
+                effective_canister_id,
+                signed_request_status.clone(),
+            )
+            .await?;
         loop {
-            match self
-                .request_status_signed(
-                    request_id,
-                    effective_canister_id,
-                    signed_request_status.clone(),
-                )
-                .await?
-            {
+            match resp {
                 RequestStatusResponse::Unknown => {}
 
                 RequestStatusResponse::Received | RequestStatusResponse::Processing => {
@@ -646,7 +660,9 @@ impl Agent {
                     }
                 }
 
-                RequestStatusResponse::Replied(ReplyResponse { arg, .. }) => return Ok(arg),
+                RequestStatusResponse::Replied(ReplyResponse { arg, .. }) => {
+                    return Ok((arg, cert))
+                }
 
                 RequestStatusResponse::Rejected(response) => {
                     return Err(AgentError::CertifiedReject(response))
@@ -667,20 +683,20 @@ impl Agent {
         }
     }
 
-    /// Call request_status on the RequestId in a loop and return the response as a byte vector.
+    /// Call `request_status` on the `RequestId` in a loop and return the response as a byte vector.
     pub async fn wait(
         &self,
         request_id: &RequestId,
         effective_canister_id: Principal,
-    ) -> Result<Vec<u8>, AgentError> {
-        let mut retry_policy = Self::get_retry_policy();
+    ) -> Result<(Vec<u8>, Certificate), AgentError> {
+        let mut retry_policy = self.get_retry_policy();
 
         let mut request_accepted = false;
         loop {
-            match self
+            let (resp, cert) = self
                 .request_status_raw(request_id, effective_canister_id)
-                .await?
-            {
+                .await?;
+            match resp {
                 RequestStatusResponse::Unknown => {}
 
                 RequestStatusResponse::Received | RequestStatusResponse::Processing => {
@@ -697,7 +713,9 @@ impl Agent {
                     }
                 }
 
-                RequestStatusResponse::Replied(ReplyResponse { arg, .. }) => return Ok(arg),
+                RequestStatusResponse::Replied(ReplyResponse { arg, .. }) => {
+                    return Ok((arg, cert))
+                }
 
                 RequestStatusResponse::Rejected(response) => {
                     return Err(AgentError::CertifiedReject(response))
@@ -873,7 +891,7 @@ impl Agent {
                     delegation.subnet_id.as_ref(),
                     "public_key".as_bytes(),
                 ];
-                lookup_value(&cert.tree, public_key_path).map(|pk| pk.to_vec())
+                lookup_value(&cert.tree, public_key_path).map(<[u8]>::to_vec)
             }
         }
     }
@@ -960,24 +978,24 @@ impl Agent {
         &self,
         request_id: &RequestId,
         effective_canister_id: Principal,
-    ) -> Result<RequestStatusResponse, AgentError> {
+    ) -> Result<(RequestStatusResponse, Certificate), AgentError> {
         let paths: Vec<Vec<Label>> =
             vec![vec!["request_status".into(), request_id.to_vec().into()]];
 
         let cert = self.read_state_raw(paths, effective_canister_id).await?;
 
-        lookup_request_status(cert, request_id)
+        Ok((lookup_request_status(&cert, request_id)?, cert))
     }
 
-    /// Send the signed request_status to the network. Will return [`RequestStatusResponse`].
-    /// The bytes will be checked to verify that it is a valid request_status.
-    /// If you want to inspect the fields of the request_status, use [`signed_request_status_inspect`] before calling this method.
+    /// Send the signed `request_status` to the network. Will return [`RequestStatusResponse`].
+    /// The bytes will be checked to verify that it is a valid `request_status`.
+    /// If you want to inspect the fields of the `request_status`, use [`signed_request_status_inspect`] before calling this method.
     pub async fn request_status_signed(
         &self,
         request_id: &RequestId,
         effective_canister_id: Principal,
         signed_request_status: Vec<u8>,
-    ) -> Result<RequestStatusResponse, AgentError> {
+    ) -> Result<(RequestStatusResponse, Certificate), AgentError> {
         let _envelope: Envelope =
             serde_cbor::from_slice(&signed_request_status).map_err(AgentError::InvalidCborData)?;
         let read_state_response: ReadStateResponse = self
@@ -987,10 +1005,10 @@ impl Agent {
         let cert: Certificate = serde_cbor::from_slice(&read_state_response.certificate)
             .map_err(AgentError::InvalidCborData)?;
         self.verify(&cert, effective_canister_id)?;
-        lookup_request_status(cert, request_id)
+        Ok((lookup_request_status(&cert, request_id)?, cert))
     }
 
-    /// Returns an UpdateBuilder enabling the construction of an update call without
+    /// Returns an `UpdateBuilder` enabling the construction of an update call without
     /// passing all arguments.
     pub fn update<S: Into<String>>(
         &self,
@@ -1011,14 +1029,14 @@ impl Agent {
         Status::try_from(&cbor).map_err(|_| AgentError::InvalidReplicaStatus)
     }
 
-    /// Returns a QueryBuilder enabling the construction of a query call without
+    /// Returns a `QueryBuilder` enabling the construction of a query call without
     /// passing all arguments.
     pub fn query<S: Into<String>>(&self, canister_id: &Principal, method_name: S) -> QueryBuilder {
         QueryBuilder::new(self, *canister_id, method_name.into())
     }
 
-    /// Sign a request_status call. This will return a [`signed::SignedRequestStatus`]
-    /// which contains all fields of the request_status and the signed request_status in CBOR encoding
+    /// Sign a `request_status` call. This will return a [`signed::SignedRequestStatus`]
+    /// which contains all fields of the `request_status` and the signed `request_status` in CBOR encoding
     pub fn sign_request_status(
         &self,
         effective_canister_id: Principal,
@@ -1055,7 +1073,7 @@ impl Agent {
         }
     }
 
-    /// Retrieve all existing API boundary nodes from the state tree via endpoint /api/v2/canister/<effective_canister_id>/read_state
+    /// Retrieve all existing API boundary nodes from the state tree via endpoint `/api/v2/canister/<effective_canister_id>/read_state`
     pub async fn fetch_api_boundary_nodes_by_canister_id(
         &self,
         canister_id: Principal,
@@ -1066,7 +1084,7 @@ impl Agent {
         Ok(api_boundary_nodes)
     }
 
-    /// Retrieve all existing API boundary nodes from the state tree via endpoint /api/v2/subnet/<subnet_id>/read_state
+    /// Retrieve all existing API boundary nodes from the state tree via endpoint `/api/v2/subnet/<subnet_id>/read_state`
     pub async fn fetch_api_boundary_nodes_by_subnet_id(
         &self,
         subnet_id: Principal,
@@ -1106,44 +1124,17 @@ impl Agent {
             http_request
                 .headers_mut()
                 .insert(CONTENT_TYPE, "application/cbor".parse().unwrap());
-            *http_request.body_mut() = body.as_ref().cloned().map(Body::from);
+            *http_request.body_mut() = body.clone().map(Body::from);
             Ok(http_request)
         };
 
-        // Dispatch request with a retry logic only for non-wasm builds.
-        let response = {
-            #[cfg(target_family = "wasm")]
-            {
-                let http_request = create_request_with_generated_url()?;
-                self.client.execute(http_request).await?
-            }
-            #[cfg(not(target_family = "wasm"))]
-            {
-                // RouteProvider generates urls dynamically. Some of these urls can be potentially unhealthy.
-                // TCP related errors (host unreachable, connection refused, connection timed out, connection reset) can be safely retried with a newly generated url.
-
-                let mut retry_count = 0;
-
-                loop {
-                    let http_request = create_request_with_generated_url()?;
-
-                    match self.client.execute(http_request).await {
-                        Ok(response) => break response,
-                        Err(err) => {
-                            // Network-related errors can be retried.
-                            if err.is_connect() {
-                                if retry_count >= self.max_tcp_error_retries {
-                                    return Err(AgentError::TransportError(err));
-                                }
-                                retry_count += 1;
-                                continue;
-                            }
-                            return Err(AgentError::TransportError(err));
-                        }
-                    }
-                }
-            }
-        };
+        let response = self
+            .client
+            .call(
+                &create_request_with_generated_url,
+                self.max_tcp_error_retries,
+            )
+            .await?;
 
         let http_status = response.status();
         let response_headers = response.headers().clone();
@@ -1151,7 +1142,7 @@ impl Agent {
         // Size Check (Content-Length)
         if matches!(self
             .max_response_body_size
-            .zip(response.content_length()), Some((size_limit, content_length)) if content_length as usize > size_limit)
+            .zip(response.content_length()), Some((size_limit, content_length)) if content_length > size_limit as u64)
         {
             return Err(AgentError::ResponseSizeExceededLimit());
         }
@@ -1184,15 +1175,8 @@ impl Agent {
         endpoint: &str,
         body: Option<Vec<u8>>,
     ) -> Result<(StatusCode, Vec<u8>), AgentError> {
-        let request_result = loop {
-            let result = self
-                .request(method.clone(), endpoint, body.as_ref().cloned())
-                .await?;
-            if result.0 != StatusCode::TOO_MANY_REQUESTS {
-                break result;
-            }
-            crate::util::sleep(Duration::from_millis(250)).await;
-        };
+        let request_result = self.request(method.clone(), endpoint, body.clone()).await?;
+
         let status = request_result.0;
         let headers = request_result.1;
         let body = request_result.2;
@@ -1203,21 +1187,24 @@ impl Agent {
                 content_type: headers
                     .get(CONTENT_TYPE)
                     .and_then(|value| value.to_str().ok())
-                    .map(|x| x.to_string()),
+                    .map(str::to_string),
                 content: body,
             }))
         } else if !(status == StatusCode::OK || status == StatusCode::ACCEPTED) {
             Err(AgentError::InvalidHttpResponse(format!(
-                "Expected `200`, `202`, 4xx`, or `5xx` HTTP status code. Got: {}",
-                status
+                "Expected `200`, `202`, 4xx`, or `5xx` HTTP status code. Got: {status}",
             )))
         } else {
             Ok((status, body))
         }
     }
-}
 
-const DEFAULT_INGRESS_EXPIRY: Duration = Duration::from_secs(240);
+    fn clone_with_url(&self, url: Url) -> Self {
+        let mut clone = self.clone();
+        clone.route_provider = Arc::new(url);
+        clone
+    }
+}
 
 // Checks if a principal is contained within a list of principal ranges
 // A range is a tuple: (low: Principal, high: Principal), as described here: https://internetcomputer.org/docs/current/references/ic-interface-spec#state-tree-subnet
@@ -1300,8 +1287,8 @@ pub fn signed_query_inspect(
             if arg != *arg_cbor {
                 return Err(AgentError::CallDataMismatch {
                     field: "arg".to_string(),
-                    value_arg: format!("{:?}", arg),
-                    value_cbor: format!("{:?}", arg_cbor),
+                    value_arg: format!("{arg:?}"),
+                    value_cbor: format!("{arg_cbor:?}"),
                 });
             }
         }
@@ -1375,8 +1362,8 @@ pub fn signed_update_inspect(
             if arg != *arg_cbor {
                 return Err(AgentError::CallDataMismatch {
                     field: "arg".to_string(),
-                    value_arg: format!("{:?}", arg),
-                    value_cbor: format!("{:?}", arg_cbor),
+                    value_arg: format!("{arg:?}"),
+                    value_cbor: format!("{arg_cbor:?}"),
                 });
             }
         }
@@ -1398,8 +1385,8 @@ pub fn signed_update_inspect(
     Ok(())
 }
 
-/// Inspect the bytes to be sent as a request_status
-/// Return Ok only when the bytes can be deserialized as a request_status and all fields match with the arguments
+/// Inspect the bytes to be sent as a `request_status`
+/// Return Ok only when the bytes can be deserialized as a `request_status` and all fields match with the arguments
 pub fn signed_request_status_inspect(
     sender: Principal,
     request_id: &RequestId,
@@ -1433,8 +1420,8 @@ pub fn signed_request_status_inspect(
             if paths != *paths_cbor {
                 return Err(AgentError::CallDataMismatch {
                     field: "paths".to_string(),
-                    value_arg: format!("{:?}", paths),
-                    value_cbor: format!("{:?}", paths_cbor),
+                    value_arg: format!("{paths:?}"),
+                    value_cbor: format!("{paths_cbor:?}"),
                 });
             }
         }
@@ -1525,17 +1512,27 @@ pub(crate) struct Subnet {
 }
 
 /// API boundary node, which routes /api calls to IC replica nodes.
-#[derive(Debug, Clone)]
+#[derive(Debug, Clone, PartialEq, Eq, Hash)]
 pub struct ApiBoundaryNode {
     /// Domain name
     pub domain: String,
     /// IPv6 address in the hexadecimal notation with colons.
-    pub ipv6_address: String,
+    pub ipv6_address: Option<String>,
     /// IPv4 address in the dotted-decimal notation.
     pub ipv4_address: Option<String>,
 }
 
-/// A Query Request Builder.
+impl ApiBoundaryNode {
+    fn to_routing_url(&self) -> Url {
+        if cfg!(test) {
+            Url::parse(&format!("http://{}:7357", self.domain)).expect("failed to parse URL")
+        } else {
+            Url::parse(&format!("https://{}", self.domain)).expect("failed to parse URL")
+        }
+    }
+}
+
+/// A query request builder.
 ///
 /// This makes it easier to do query calls without actually passing all arguments.
 #[derive(Debug, Clone)]
@@ -1582,13 +1579,13 @@ impl<'agent> QueryBuilder<'agent> {
         self
     }
 
-    /// Sets ingress_expiry_datetime to the provided timestamp, at nanosecond precision.
+    /// Sets `ingress_expiry_datetime` to the provided timestamp, at nanosecond precision.
     pub fn expire_at(mut self, time: impl Into<OffsetDateTime>) -> Self {
         self.ingress_expiry_datetime = Some(time.into().unix_timestamp_nanos() as u64);
         self
     }
 
-    /// Sets ingress_expiry_datetime to `max(now, 4min)`.
+    /// Sets `ingress_expiry_datetime` to `max(now, 4min)`.
     pub fn expire_after(mut self, duration: Duration) -> Self {
         self.ingress_expiry_datetime = Some(
             OffsetDateTime::now_utc()
@@ -1623,7 +1620,7 @@ impl<'agent> QueryBuilder<'agent> {
     /// Make a query call with signature verification. This will return a byte vector.
     ///
     /// Compared with [call][Self::call], this method will **always** verify the signature of the query response
-    /// regardless the Agent level configuration from [AgentBuilder::with_verify_query_signatures].
+    /// regardless the Agent level configuration from [`AgentBuilder::with_verify_query_signatures`].
     pub async fn call_with_verification(self) -> Result<Vec<u8>, AgentError> {
         self.agent
             .query_raw(
@@ -1641,7 +1638,7 @@ impl<'agent> QueryBuilder<'agent> {
     /// Make a query call without signature verification. This will return a byte vector.
     ///
     /// Compared with [call][Self::call], this method will **never** verify the signature of the query response
-    /// regardless the Agent level configuration from [AgentBuilder::with_verify_query_signatures].
+    /// regardless the Agent level configuration from [`AgentBuilder::with_verify_query_signatures`].
     pub async fn call_without_verification(self) -> Result<Vec<u8>, AgentError> {
         self.agent
             .query_raw(
@@ -1659,14 +1656,10 @@ impl<'agent> QueryBuilder<'agent> {
     /// Sign a query call. This will return a [`signed::SignedQuery`]
     /// which contains all fields of the query and the signed query in CBOR encoding
     pub fn sign(self) -> Result<SignedQuery, AgentError> {
-        let content = self.agent.query_content(
-            self.canister_id,
-            self.method_name,
-            self.arg,
-            self.ingress_expiry_datetime,
-            self.use_nonce,
-        )?;
-        let signed_query = sign_envelope(&content, self.agent.identity.clone())?;
+        let effective_canister_id = self.effective_canister_id;
+        let identity = self.agent.identity.clone();
+        let content = self.into_envelope()?;
+        let signed_query = sign_envelope(&content, identity)?;
         let EnvelopeContent::Query {
             ingress_expiry,
             sender,
@@ -1684,11 +1677,22 @@ impl<'agent> QueryBuilder<'agent> {
             canister_id,
             method_name,
             arg,
-            effective_canister_id: self.effective_canister_id,
+            effective_canister_id,
             signed_query,
             nonce,
         })
     }
+
+    /// Converts the query builder into [`EnvelopeContent`] for external signing or storage.
+    pub fn into_envelope(self) -> Result<EnvelopeContent, AgentError> {
+        self.agent.query_content(
+            self.canister_id,
+            self.method_name,
+            self.arg,
+            self.ingress_expiry_datetime,
+            self.use_nonce,
+        )
+    }
 }
 
 impl<'agent> IntoFuture for QueryBuilder<'agent> {
@@ -1702,7 +1706,7 @@ impl<'agent> IntoFuture for QueryBuilder<'agent> {
 /// An in-flight canister update call. Useful primarily as a `Future`.
 pub struct UpdateCall<'agent> {
     agent: &'agent Agent,
-    response_future: AgentFuture<'agent, CallResponse<Vec<u8>>>,
+    response_future: AgentFuture<'agent, CallResponse<(Vec<u8>, Certificate)>>,
     effective_canister_id: Principal,
 }
 
@@ -1716,13 +1720,15 @@ impl fmt::Debug for UpdateCall<'_> {
 }
 
 impl Future for UpdateCall<'_> {
-    type Output = Result<CallResponse<Vec<u8>>, AgentError>;
+    type Output = Result<CallResponse<(Vec<u8>, Certificate)>, AgentError>;
     fn poll(mut self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<Self::Output> {
         self.response_future.as_mut().poll(cx)
     }
 }
+
 impl<'a> UpdateCall<'a> {
-    async fn and_wait(self) -> Result<Vec<u8>, AgentError> {
+    /// Waits for the update call to be completed, polling if necessary.
+    pub async fn and_wait(self) -> Result<(Vec<u8>, Certificate), AgentError> {
         let response = self.response_future.await?;
 
         match response {
@@ -1735,7 +1741,7 @@ impl<'a> UpdateCall<'a> {
         }
     }
 }
-/// An Update Request Builder.
+/// An update request Builder.
 ///
 /// This makes it easier to do update calls without actually passing all arguments or specifying
 /// if you want to wait or not.
@@ -1779,13 +1785,13 @@ impl<'agent> UpdateBuilder<'agent> {
         self
     }
 
-    /// Sets ingress_expiry_datetime to the provided timestamp, at nanosecond precision.
+    /// Sets `ingress_expiry_datetime` to the provided timestamp, at nanosecond precision.
     pub fn expire_at(mut self, time: impl Into<OffsetDateTime>) -> Self {
         self.ingress_expiry_datetime = Some(time.into().unix_timestamp_nanos() as u64);
         self
     }
 
-    /// Sets ingress_expiry_datetime to `min(now, 4min)`.
+    /// Sets `ingress_expiry_datetime` to `min(now, 4min)`.
     pub fn expire_after(mut self, duration: Duration) -> Self {
         self.ingress_expiry_datetime = Some(
             OffsetDateTime::now_utc()
@@ -1795,14 +1801,14 @@ impl<'agent> UpdateBuilder<'agent> {
         self
     }
 
-    /// Make an update call. This will call request_status on the RequestId in a loop and return
+    /// Make an update call. This will call `request_status` on the `RequestId` in a loop and return
     /// the response as a byte vector.
     pub async fn call_and_wait(self) -> Result<Vec<u8>, AgentError> {
-        self.call().and_wait().await
+        self.call().and_wait().await.map(|x| x.0)
     }
 
-    /// Make an update call. This will return a RequestId.
-    /// The RequestId should then be used for request_status (most likely in a loop).
+    /// Make an update call. This will return a `RequestId`.
+    /// The `RequestId` should then be used for `request_status` (most likely in a loop).
     pub fn call(self) -> UpdateCall<'agent> {
         let response_future = async move {
             self.agent
@@ -1825,15 +1831,10 @@ impl<'agent> UpdateBuilder<'agent> {
     /// Sign a update call. This will return a [`signed::SignedUpdate`]
     /// which contains all fields of the update and the signed update in CBOR encoding
     pub fn sign(self) -> Result<SignedUpdate, AgentError> {
-        let nonce = self.agent.nonce_factory.generate();
-        let content = self.agent.update_content(
-            self.canister_id,
-            self.method_name,
-            self.arg,
-            self.ingress_expiry_datetime,
-            nonce,
-        )?;
-        let signed_update = sign_envelope(&content, self.agent.identity.clone())?;
+        let identity = self.agent.identity.clone();
+        let effective_canister_id = self.effective_canister_id;
+        let content = self.into_envelope()?;
+        let signed_update = sign_envelope(&content, identity)?;
         let request_id = to_request_id(&content)?;
         let EnvelopeContent::Call {
             nonce,
@@ -1853,11 +1854,23 @@ impl<'agent> UpdateBuilder<'agent> {
             canister_id,
             method_name,
             arg,
-            effective_canister_id: self.effective_canister_id,
+            effective_canister_id,
             signed_update,
             request_id,
         })
     }
+
+    /// Converts the update builder into an [`EnvelopeContent`] for external signing or storage.
+    pub fn into_envelope(self) -> Result<EnvelopeContent, AgentError> {
+        let nonce = self.agent.nonce_factory.generate();
+        self.agent.update_content(
+            self.canister_id,
+            self.method_name,
+            self.arg,
+            self.ingress_expiry_datetime,
+            nonce,
+        )
+    }
 }
 
 impl<'agent> IntoFuture for UpdateBuilder<'agent> {
@@ -1868,6 +1881,100 @@ impl<'agent> IntoFuture for UpdateBuilder<'agent> {
     }
 }
 
+/// HTTP client middleware. Implemented automatically for `reqwest`-compatible by-ref `tower::Service`, such as `reqwest_middleware`.
+#[cfg_attr(target_family = "wasm", async_trait(?Send))]
+#[cfg_attr(not(target_family = "wasm"), async_trait)]
+pub trait HttpService: Send + Sync {
+    /// Perform a HTTP request. Any retry logic should call `req` again, instead of `Request::try_clone`.
+    async fn call<'a>(
+        &'a self,
+        req: &'a (dyn Fn() -> Result<Request, AgentError> + Send + Sync),
+        max_retries: usize,
+    ) -> Result<Response, AgentError>;
+}
+#[cfg(not(target_family = "wasm"))]
+#[async_trait]
+impl<T> HttpService for T
+where
+    for<'a> &'a T: Service<Request, Response = Response, Error = reqwest::Error>,
+    for<'a> <&'a Self as Service<Request>>::Future: Send,
+    T: Send + Sync + ?Sized,
+{
+    #[allow(clippy::needless_arbitrary_self_type)]
+    async fn call<'a>(
+        mut self: &'a Self,
+        req: &'a (dyn Fn() -> Result<Request, AgentError> + Send + Sync),
+        max_retries: usize,
+    ) -> Result<Response, AgentError> {
+        let mut retry_count = 0;
+        loop {
+            match Service::call(&mut self, req()?).await {
+                Err(err) => {
+                    // Network-related errors can be retried.
+                    if err.is_connect() {
+                        if retry_count >= max_retries {
+                            return Err(AgentError::TransportError(err));
+                        }
+                        retry_count += 1;
+                    }
+                }
+                Ok(resp) => return Ok(resp),
+            }
+        }
+    }
+}
+
+#[cfg(target_family = "wasm")]
+#[async_trait(?Send)]
+impl<T> HttpService for T
+where
+    for<'a> &'a T: Service<Request, Response = Response, Error = reqwest::Error>,
+    T: Send + Sync + ?Sized,
+{
+    #[allow(clippy::needless_arbitrary_self_type)]
+    async fn call<'a>(
+        mut self: &'a Self,
+        req: &'a (dyn Fn() -> Result<Request, AgentError> + Send + Sync),
+        _: usize,
+    ) -> Result<Response, AgentError> {
+        Ok(Service::call(&mut self, req()?).await?)
+    }
+}
+
+struct Retry429Logic {
+    client: Client,
+}
+
+#[cfg_attr(target_family = "wasm", async_trait(?Send))]
+#[cfg_attr(not(target_family = "wasm"), async_trait)]
+impl HttpService for Retry429Logic {
+    async fn call<'a>(
+        &'a self,
+        req: &'a (dyn Fn() -> Result<Request, AgentError> + Send + Sync),
+        _max_tcp_retries: usize,
+    ) -> Result<Response, AgentError> {
+        let mut retries = 0;
+        loop {
+            #[cfg(not(target_family = "wasm"))]
+            let resp = self.client.call(req, _max_tcp_retries).await?;
+            // Client inconveniently does not implement Service on wasm
+            #[cfg(target_family = "wasm")]
+            let resp = self.client.execute(req()?).await?;
+            if resp.status() == StatusCode::TOO_MANY_REQUESTS {
+                if retries == 6 {
+                    break Ok(resp);
+                } else {
+                    retries += 1;
+                    crate::util::sleep(Duration::from_millis(250)).await;
+                    continue;
+                }
+            } else {
+                break Ok(resp);
+            }
+        }
+    }
+}
+
 #[cfg(all(test, not(target_family = "wasm")))]
 mod offline_tests {
     use super::*;
diff --git a/ic-agent/src/agent/response_authentication.rs b/ic-agent/src/agent/response_authentication.rs
index 26e06058..fab572ca 100644
--- a/ic-agent/src/agent/response_authentication.rs
+++ b/ic-agent/src/agent/response_authentication.rs
@@ -78,7 +78,7 @@ pub(crate) fn lookup_subnet_metrics<Storage: AsRef<[u8]>>(
 }
 
 pub(crate) fn lookup_request_status<Storage: AsRef<[u8]>>(
-    certificate: Certificate<Storage>,
+    certificate: &Certificate<Storage>,
     request_id: &RequestId,
 ) -> Result<RequestStatusResponse, AgentError> {
     use AgentError::*;
@@ -94,8 +94,8 @@ pub(crate) fn lookup_request_status<Storage: AsRef<[u8]>>(
             "done" => Ok(RequestStatusResponse::Done),
             "processing" => Ok(RequestStatusResponse::Processing),
             "received" => Ok(RequestStatusResponse::Received),
-            "rejected" => lookup_rejection(&certificate, request_id),
-            "replied" => lookup_reply(&certificate, request_id),
+            "rejected" => lookup_rejection(certificate, request_id),
+            "replied" => lookup_reply(certificate, request_id),
             other => Err(InvalidRequestStatus(path_status.into(), other.to_string())),
         },
         LookupResult::Error => Err(LookupPathError(path_status.into())),
@@ -233,9 +233,10 @@ pub(crate) fn lookup_api_boundary_nodes<Storage: AsRef<[u8]> + Clone>(
             String::from_utf8(lookup_value(&api_bn_tree, [node_id, domain_path])?.to_vec())
                 .map_err(|err| AgentError::Utf8ReadError(err.utf8_error()))?;
 
-        let ipv6_address =
+        let ipv6_address = Some(
             String::from_utf8(lookup_value(&api_bn_tree, [node_id, ipv6_path])?.to_vec())
-                .map_err(|err| AgentError::Utf8ReadError(err.utf8_error()))?;
+                .map_err(|err| AgentError::Utf8ReadError(err.utf8_error()))?,
+        );
 
         let ipv4_address = match lookup_value(&api_bn_tree, [node_id, ipv4_path]) {
             Ok(ipv4) => Some(
diff --git a/ic-agent/src/agent/route_provider.rs b/ic-agent/src/agent/route_provider.rs
index c7b5171c..293d2712 100644
--- a/ic-agent/src/agent/route_provider.rs
+++ b/ic-agent/src/agent/route_provider.rs
@@ -5,7 +5,9 @@ use std::{
 };
 use url::Url;
 
-use crate::agent::AgentError;
+use crate::{agent::AgentError, Agent};
+
+pub mod dynamic_routing;
 
 const IC0_DOMAIN: &str = "ic0.app";
 const ICP0_DOMAIN: &str = "icp0.io";
@@ -18,8 +20,21 @@ const LOCALHOST_SUB_DOMAIN: &str = ".localhost";
 
 /// A [`RouteProvider`] for dynamic generation of routing urls.
 pub trait RouteProvider: std::fmt::Debug + Send + Sync {
-    /// Generate next routing url
+    /// Generates the next routing URL based on the internal routing logic.
+    ///
+    /// This method returns a single `Url` that can be used for routing.
+    /// The logic behind determining the next URL can vary depending on the implementation
     fn route(&self) -> Result<Url, AgentError>;
+
+    /// Generates up to `n` different routing URLs in order of priority.
+    ///
+    /// This method returns a vector of `Url` instances, each representing a routing
+    /// endpoint. The URLs are ordered by priority, with the most preferred route
+    /// appearing first. The returned vector can contain fewer than `n` URLs if
+    /// fewer are available.
+    fn n_ordered_routes(&self, n: usize) -> Result<Vec<Url>, AgentError>;
+
+    fn notify_start(&self, agent: Agent) {}
 }
 
 /// A simple implementation of the [`RouteProvider`] which produces an even distribution of the urls from the input ones.
@@ -41,6 +56,28 @@ impl RouteProvider for RoundRobinRouteProvider {
         let prev_idx = self.current_idx.fetch_add(1, Ordering::Relaxed);
         Ok(self.routes[prev_idx % self.routes.len()].clone())
     }
+
+    fn n_ordered_routes(&self, n: usize) -> Result<Vec<Url>, AgentError> {
+        if n == 0 {
+            return Ok(Vec::new());
+        }
+
+        if n >= self.routes.len() {
+            return Ok(self.routes.clone());
+        }
+
+        let idx = self.current_idx.fetch_add(n, Ordering::Relaxed) % self.routes.len();
+        let mut urls = Vec::with_capacity(n);
+
+        if self.routes.len() - idx >= n {
+            urls.extend_from_slice(&self.routes[idx..idx + n]);
+        } else {
+            urls.extend_from_slice(&self.routes[idx..]);
+            urls.extend_from_slice(&self.routes[..n - urls.len()]);
+        }
+
+        Ok(urls)
+    }
 }
 
 impl RoundRobinRouteProvider {
@@ -53,11 +90,11 @@ impl RoundRobinRouteProvider {
                     // rewrite *.ic0.app to ic0.app
                     if let Some(domain) = url.domain() {
                         if domain.ends_with(IC0_SUB_DOMAIN) {
-                            url.set_host(Some(IC0_DOMAIN))?
+                            url.set_host(Some(IC0_DOMAIN))?;
                         } else if domain.ends_with(ICP0_SUB_DOMAIN) {
-                            url.set_host(Some(ICP0_DOMAIN))?
+                            url.set_host(Some(ICP0_DOMAIN))?;
                         } else if domain.ends_with(ICP_API_SUB_DOMAIN) {
-                            url.set_host(Some(ICP_API_DOMAIN))?
+                            url.set_host(Some(ICP_API_DOMAIN))?;
                         } else if domain.ends_with(LOCALHOST_SUB_DOMAIN) {
                             url.set_host(Some(LOCALHOST_DOMAIN))?;
                         }
@@ -77,6 +114,9 @@ impl RouteProvider for Url {
     fn route(&self) -> Result<Url, AgentError> {
         Ok(self.clone())
     }
+    fn n_ordered_routes(&self, _: usize) -> Result<Vec<Url>, AgentError> {
+        Ok(vec![self.route()?])
+    }
 }
 
 #[cfg(test)]
@@ -108,4 +148,56 @@ mod tests {
             .collect();
         assert_eq!(expected_urls, urls);
     }
+
+    #[test]
+    fn test_n_routes() {
+        // Test with an empty list of urls
+        let provider = RoundRobinRouteProvider::new(Vec::<&str>::new())
+            .expect("failed to create a route provider");
+        let urls_iter = provider.n_ordered_routes(1).expect("failed to get urls");
+        assert!(urls_iter.is_empty());
+        // Test with non-empty list of urls
+        let provider = RoundRobinRouteProvider::new(vec![
+            "https://url1.com",
+            "https://url2.com",
+            "https://url3.com",
+            "https://url4.com",
+            "https://url5.com",
+        ])
+        .expect("failed to create a route provider");
+        // First call
+        let urls: Vec<_> = provider.n_ordered_routes(3).expect("failed to get urls");
+        let expected_urls: Vec<Url> = ["https://url1.com", "https://url2.com", "https://url3.com"]
+            .iter()
+            .map(|url_str| Url::parse(url_str).expect("invalid URL"))
+            .collect();
+        assert_eq!(urls, expected_urls);
+        // Second call
+        let urls: Vec<_> = provider.n_ordered_routes(3).expect("failed to get urls");
+        let expected_urls: Vec<Url> = ["https://url4.com", "https://url5.com", "https://url1.com"]
+            .iter()
+            .map(|url_str| Url::parse(url_str).expect("invalid URL"))
+            .collect();
+        assert_eq!(urls, expected_urls);
+        // Third call
+        let urls: Vec<_> = provider.n_ordered_routes(2).expect("failed to get urls");
+        let expected_urls: Vec<Url> = ["https://url2.com", "https://url3.com"]
+            .iter()
+            .map(|url_str| Url::parse(url_str).expect("invalid URL"))
+            .collect();
+        assert_eq!(urls, expected_urls);
+        // Fourth call
+        let urls: Vec<_> = provider.n_ordered_routes(5).expect("failed to get urls");
+        let expected_urls: Vec<Url> = [
+            "https://url1.com",
+            "https://url2.com",
+            "https://url3.com",
+            "https://url4.com",
+            "https://url5.com",
+        ]
+        .iter()
+        .map(|url_str| Url::parse(url_str).expect("invalid URL"))
+        .collect();
+        assert_eq!(urls, expected_urls);
+    }
 }
diff --git a/ic-agent/src/agent/route_provider/dynamic_routing/dynamic_route_provider.rs b/ic-agent/src/agent/route_provider/dynamic_routing/dynamic_route_provider.rs
new file mode 100644
index 00000000..d130a5b7
--- /dev/null
+++ b/ic-agent/src/agent/route_provider/dynamic_routing/dynamic_route_provider.rs
@@ -0,0 +1,676 @@
+//! An implementation of the [`RouteProvider`](crate::agent::http_transport::route_provider::RouteProvider) for dynamic generation of routing urls.
+
+use std::{
+    sync::Arc,
+    time::{Duration, Instant},
+};
+
+use arc_swap::ArcSwap;
+use candid::Principal;
+use futures_util::{select, FutureExt};
+use reqwest::Client;
+use stop_token::StopSource;
+use thiserror::Error;
+use tracing::{error, info, warn};
+use url::Url;
+
+use crate::{
+    agent::{
+        route_provider::{
+            dynamic_routing::{
+                health_check::health_check_manager_actor, messages::FetchedNodes,
+                nodes_fetch::nodes_fetch_actor, snapshot::routing_snapshot::RoutingSnapshot,
+                type_aliases::AtomicSwap,
+            },
+            RouteProvider,
+        },
+        ApiBoundaryNode,
+    },
+    Agent, AgentError,
+};
+
+pub(crate) const IC0_SEED_DOMAIN: &str = "ic0.app";
+
+pub(crate) const MAINNET_ROOT_SUBNET_ID: &str =
+    "tdb26-jop6k-aogll-7ltgs-eruif-6kk7m-qpktf-gdiqx-mxtrf-vb5e6-eqe";
+
+const FETCH_PERIOD: Duration = Duration::from_secs(5);
+const FETCH_RETRY_INTERVAL: Duration = Duration::from_millis(250);
+const TIMEOUT_AWAIT_HEALTHY_SEED: Duration = Duration::from_millis(1000);
+const HEALTH_CHECK_TIMEOUT: Duration = Duration::from_secs(1);
+const HEALTH_CHECK_PERIOD: Duration = Duration::from_secs(1);
+
+const DYNAMIC_ROUTE_PROVIDER: &str = "DynamicRouteProvider";
+
+/// A dynamic route provider.
+/// It spawns the discovery service (`NodesFetchActor`) for fetching the latest nodes topology.
+/// It also spawns the `HealthManagerActor`, which orchestrates the health check tasks for each node and updates routing snapshot.
+#[derive(Debug)]
+pub struct DynamicRouteProvider<S> {
+    /// Periodicity of fetching the latest nodes topology.
+    fetch_period: Duration,
+    /// Interval for retrying fetching the nodes in case of error.
+    fetch_retry_interval: Duration,
+    /// Periodicity of checking the health of the nodes.
+    check_period: Duration,
+    /// Timeout for checking the health of the nodes.
+    check_timeout: Duration,
+    /// Snapshot of the routing nodes.
+    routing_snapshot: AtomicSwap<S>,
+    /// Initial seed nodes, which are used for the initial fetching of the nodes.
+    seeds: Vec<ApiBoundaryNode>,
+    /// Cancellation source for stopping the spawned tasks.
+    stop: StopSource,
+}
+
+/// An error that occurred when the DynamicRouteProvider service was running.
+#[derive(Error, Debug)]
+pub enum DynamicRouteProviderError {
+    /// An error when fetching topology of the API nodes.
+    #[error("An error when fetching API nodes: {0}")]
+    NodesFetchError(String),
+    /// An error when checking API node's health.
+    #[error("An error when checking API node's health: {0}")]
+    HealthCheckError(String),
+    /// An invalid domain name provided.
+    #[error("Provided domain name is invalid: {0}")]
+    InvalidDomainName(String),
+}
+
+/// A builder for the `DynamicRouteProvider`.
+pub struct DynamicRouteProviderBuilder<S> {
+    fetch_period: Duration,
+    fetch_retry_interval: Duration,
+    check_period: Duration,
+    check_timeout: Duration,
+    routing_snapshot: AtomicSwap<S>,
+    seeds: Vec<ApiBoundaryNode>,
+}
+
+impl<S> DynamicRouteProviderBuilder<S> {
+    /// Creates a new instance of the builder.
+    pub fn new(snapshot: S, seeds: Vec<ApiBoundaryNode>, http_client: Client) -> Self {
+        Self {
+            fetch_period: FETCH_PERIOD,
+            fetch_retry_interval: FETCH_RETRY_INTERVAL,
+            check_period: HEALTH_CHECK_PERIOD,
+            check_timeout: HEALTH_CHECK_TIMEOUT,
+            seeds,
+            routing_snapshot: Arc::new(ArcSwap::from_pointee(snapshot)),
+        }
+    }
+
+    /// Sets the fetching periodicity.
+    pub fn with_fetch_period(mut self, period: Duration) -> Self {
+        self.fetch_period = period;
+        self
+    }
+
+    /// Sets the timeout for node health checking.
+    pub fn with_check_timeout(mut self, timeout: Duration) -> Self {
+        self.check_timeout = timeout;
+        self
+    }
+
+    /// Sets the periodicity of node health checking.
+    pub fn with_check_period(mut self, period: Duration) -> Self {
+        self.check_period = period;
+        self
+    }
+
+    /// Builds an instance of the `DynamicRouteProvider`.
+    pub async fn build(self) -> DynamicRouteProvider<S>
+    where
+        S: RoutingSnapshot + 'static,
+    {
+        DynamicRouteProvider {
+            fetch_period: self.fetch_period,
+            fetch_retry_interval: self.fetch_retry_interval,
+            check_period: self.check_period,
+            check_timeout: self.check_timeout,
+            routing_snapshot: self.routing_snapshot,
+            seeds: self.seeds,
+            stop: StopSource::new(),
+        }
+    }
+}
+
+impl<S> RouteProvider for DynamicRouteProvider<S>
+where
+    S: RoutingSnapshot + 'static,
+{
+    fn route(&self) -> Result<Url, AgentError> {
+        let snapshot = self.routing_snapshot.load();
+        let node = snapshot.next_node().ok_or_else(|| {
+            AgentError::RouteProviderError("No healthy API nodes found.".to_string())
+        })?;
+        Ok(node.to_routing_url())
+    }
+
+    fn n_ordered_routes(&self, n: usize) -> Result<Vec<Url>, AgentError> {
+        let snapshot = self.routing_snapshot.load();
+        let nodes = snapshot.next_n_nodes(n);
+        if nodes.is_empty() {
+            return Err(AgentError::RouteProviderError(
+                "No healthy API nodes found.".to_string(),
+            ));
+        };
+        let urls = nodes.iter().map(|n| n.to_routing_url()).collect();
+        Ok(urls)
+    }
+
+    /// Starts two background tasks:
+    /// - Task1: NodesFetchActor
+    ///   - Periodically fetches existing API nodes (gets latest nodes topology) and sends discovered nodes to HealthManagerActor.
+    /// - Task2: HealthManagerActor:
+    ///   - Listens to the fetched nodes messages from the NodesFetchActor.
+    ///   - Starts/stops health check tasks (HealthCheckActors) based on the newly added/removed nodes.
+    ///   - These spawned health check tasks periodically update the snapshot with the latest node health info.
+    fn notify_start(&self, agent: Agent) {
+        info!("{DYNAMIC_ROUTE_PROVIDER}: started ...");
+        // Communication channel between NodesFetchActor and HealthManagerActor.
+        let (fetch_sender, fetch_receiver) = async_watch::channel(None);
+
+        // Communication channel with HealthManagerActor to receive info about healthy seed nodes (used only once).
+        let (init_sender, init_receiver) = async_channel::bounded(1);
+
+        // Start the receiving part first.
+        crate::util::spawn(health_check_manager_actor(
+            agent.client.clone(),
+            self.check_period,
+            self.check_timeout,
+            Arc::clone(&self.routing_snapshot),
+            fetch_receiver,
+            init_sender,
+            self.stop.token(),
+        ));
+        let seeds = self.seeds.clone();
+        let routing_snapshot = self.routing_snapshot.clone();
+        let fetch_period = self.fetch_period;
+        let fetch_retry_interval = self.fetch_retry_interval;
+        let stop_token = self.stop.token();
+
+        crate::util::spawn(async move {
+            // Dispatch all seed nodes for initial health checks
+            if let Err(err) = fetch_sender.send(Some(FetchedNodes { nodes: seeds })) {
+                error!(
+                    "{DYNAMIC_ROUTE_PROVIDER}: failed to send results to HealthManager: {err:?}"
+                );
+            }
+
+            // Try await for healthy seeds.
+            let start = Instant::now();
+            select! {
+                _ = crate::util::sleep(TIMEOUT_AWAIT_HEALTHY_SEED).fuse() => warn!(
+                    "{DYNAMIC_ROUTE_PROVIDER}: no healthy seeds found within {:?}",
+                    start.elapsed()
+                ),
+                _ = init_receiver.recv().fuse() => info!(
+                    "{DYNAMIC_ROUTE_PROVIDER}: found healthy seeds within {:?}",
+                    start.elapsed()
+                )
+            }
+            // We can close the channel now.
+            init_receiver.close();
+            nodes_fetch_actor(
+                agent,
+                Principal::from_text(MAINNET_ROOT_SUBNET_ID).unwrap(),
+                fetch_period,
+                fetch_retry_interval,
+                fetch_sender,
+                routing_snapshot,
+                stop_token,
+            )
+            .await;
+        });
+        info!(
+            "{DYNAMIC_ROUTE_PROVIDER}: NodesFetchActor and HealthManagerActor started successfully"
+        );
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use candid::Principal;
+    use reqwest::Client;
+    use std::{
+        collections::HashMap,
+        sync::{Arc, Mutex, Once, OnceLock},
+        time::{Duration, Instant},
+    };
+    use tracing::Level;
+    use tracing_subscriber::FmtSubscriber;
+
+    use crate::{
+        agent::{
+            route_provider::{
+                dynamic_routing::{
+                    dynamic_route_provider::{
+                        DynamicRouteProviderBuilder, IC0_SEED_DOMAIN, MAINNET_ROOT_SUBNET_ID,
+                    },
+                    snapshot::{
+                        latency_based_routing::LatencyRoutingSnapshot,
+                        round_robin_routing::RoundRobinRoutingSnapshot,
+                    },
+                    test_utils::{assert_routed_domains, mock_node, mock_topology, route_n_times},
+                },
+                RouteProvider,
+            },
+            Agent, AgentError, ApiBoundaryNode,
+        },
+        identity::Secp256k1Identity,
+        Identity,
+    };
+
+    static TRACING_INIT: Once = Once::new();
+
+    pub fn setup_tracing() {
+        TRACING_INIT.call_once(|| {
+            FmtSubscriber::builder().with_max_level(Level::TRACE).init();
+        });
+    }
+
+    async fn assert_no_routing_via_domains(
+        route_provider: Arc<dyn RouteProvider>,
+        excluded_domains: Vec<&str>,
+        timeout: Duration,
+        route_call_interval: Duration,
+    ) {
+        if excluded_domains.is_empty() {
+            panic!("List of excluded domains can't be empty");
+        }
+
+        let route_calls = 30;
+        let start = Instant::now();
+
+        while start.elapsed() < timeout {
+            let routed_domains = (0..route_calls)
+                .map(|_| {
+                    route_provider.route().map(|url| {
+                        let domain = url.domain().expect("no domain name in url");
+                        domain.to_string()
+                    })
+                })
+                .collect::<Result<Vec<String>, _>>()
+                .unwrap_or_default();
+
+            // Exit when excluded domains are not used for routing any more.
+            if !routed_domains.is_empty()
+                && !routed_domains
+                    .iter()
+                    .any(|d| excluded_domains.contains(&d.as_str()))
+            {
+                return;
+            }
+
+            tokio::time::sleep(route_call_interval).await;
+        }
+        panic!("Expected excluded domains {excluded_domains:?} are still observed in routing over the last {route_calls} calls");
+    }
+
+    #[tokio::test]
+    async fn test_mainnet() {
+        //TODO need a way of testing mainnet
+        // Setup.
+        setup_tracing();
+        let client = Client::builder().build().unwrap();
+        let route_provider = DynamicRouteProviderBuilder::new(
+            LatencyRoutingSnapshot::new(),
+            vec![ApiBoundaryNode {
+                domain: IC0_SEED_DOMAIN.to_string(),
+                ipv4_address: None,
+                ipv6_address: None,
+            }],
+            client.clone(),
+        )
+        .build()
+        .await;
+        let route_provider = Arc::new(route_provider) as Arc<dyn RouteProvider>;
+        let agent = Agent::builder()
+            .with_arc_route_provider(route_provider.clone())
+            .build()
+            .expect("failed to create an agent");
+        let subnet_id = Principal::from_text(MAINNET_ROOT_SUBNET_ID).unwrap();
+        // Assert that seed (ic0.app) is not used for routing. Henceforth, only discovered API nodes are used.
+        assert_no_routing_via_domains(
+            route_provider.clone(),
+            vec![IC0_SEED_DOMAIN],
+            Duration::from_secs(40),
+            Duration::from_secs(2),
+        )
+        .await;
+        // Act: perform /read_state call via dynamically discovered API BNs.
+        let api_bns = agent
+            .fetch_api_boundary_nodes_by_subnet_id(subnet_id)
+            .await
+            .expect("failed to fetch api boundary nodes");
+        assert!(!api_bns.is_empty());
+    }
+
+    #[tokio::test]
+    async fn test_routing_with_topology_and_node_health_updates() {
+        // Setup.
+        setup_tracing();
+        let node_1 = mock_node("n1.routing_with_topology");
+        // Set nodes fetching params: topology, fetching periodicity.
+        // A single healthy node exists in the topology. This node happens to be the seed node.
+        let mut mocks = mock_topology(vec![(node_1.clone(), true)], "routing_with_topology_1");
+        let fetch_interval = Duration::from_secs(2);
+        // Set health checking params: healthy nodes, checking periodicity.
+        let check_interval = Duration::from_secs(1);
+        // Configure RouteProvider
+        let snapshot = RoundRobinRoutingSnapshot::new();
+        let client = Client::builder().build().unwrap();
+        let route_provider =
+            DynamicRouteProviderBuilder::new(snapshot, vec![node_1.clone()], client)
+                .with_fetch_period(fetch_interval)
+                .with_check_period(check_interval)
+                .build()
+                .await;
+        let route_provider = Arc::new(route_provider);
+
+        // This time span is required for the snapshot to be fully updated with the new nodes and their health info.
+        let snapshot_update_duration = fetch_interval + 2 * check_interval;
+
+        // Test 1: multiple route() calls return a single domain=ic0.app.
+        // Only a single node exists, which is initially healthy.
+        tokio::time::sleep(snapshot_update_duration).await;
+        let routed_domains = route_n_times(6, Arc::clone(&route_provider));
+        assert_routed_domains(routed_domains, vec![node_1.domain.clone()], 6);
+
+        // Test 2: multiple route() calls return 3 different domains with equal fairness (repetition).
+        // Two healthy nodes are added to the topology.
+        let node_2 = mock_node("api1");
+        let node_3 = mock_node("api2");
+        mocks.add_nodes([(node_2.clone(), true), (node_3.clone(), true)]);
+        tokio::time::sleep(snapshot_update_duration).await;
+        let routed_domains = route_n_times(6, Arc::clone(&route_provider));
+        assert_routed_domains(
+            routed_domains,
+            vec![
+                node_1.domain.clone(),
+                node_2.domain.clone(),
+                node_3.domain.clone(),
+            ],
+            2,
+        );
+
+        // Test 3:  multiple route() calls return 2 different domains with equal fairness (repetition).
+        // One node is set to unhealthy.
+        mocks.set_node_health(&node_2, false);
+        tokio::time::sleep(snapshot_update_duration).await;
+        let routed_domains = route_n_times(6, Arc::clone(&route_provider));
+        assert_routed_domains(
+            routed_domains,
+            vec![node_1.domain.clone(), node_3.domain.clone()],
+            3,
+        );
+
+        // Test 4: multiple route() calls return 3 different domains with equal fairness (repetition).
+        // Unhealthy node is set back to healthy.
+        mocks.set_node_health(&node_2, true);
+        tokio::time::sleep(snapshot_update_duration).await;
+        let routed_domains = route_n_times(6, Arc::clone(&route_provider));
+        assert_routed_domains(
+            routed_domains,
+            vec![
+                node_1.domain.clone(),
+                node_2.domain.clone(),
+                node_3.domain.clone(),
+            ],
+            2,
+        );
+
+        // Test 5: multiple route() calls return 3 different domains with equal fairness (repetition).
+        // One healthy node is added, but another one goes unhealthy.
+        let node_4 = mock_node("api3");
+        mocks.add_nodes([(node_4.clone(), true)]);
+        mocks.set_node_health(&node_1, false);
+        tokio::time::sleep(snapshot_update_duration).await;
+        let routed_domains = route_n_times(6, Arc::clone(&route_provider));
+        assert_routed_domains(
+            routed_domains,
+            vec![
+                node_2.domain.clone(),
+                node_3.domain.clone(),
+                node_4.domain.clone(),
+            ],
+            2,
+        );
+
+        // Test 6: multiple route() calls return a single domain=api1.com.
+        // One node is set to unhealthy and one is removed from the topology.
+        mocks.set_node_health(&node_4, false);
+        mocks.remove_nodes([&node_3]);
+        tokio::time::sleep(snapshot_update_duration).await;
+        let routed_domains = route_n_times(3, Arc::clone(&route_provider));
+        assert_routed_domains(routed_domains, vec![node_2.domain.clone()], 3);
+    }
+
+    // #[tokio::test]
+    // async fn test_route_with_initially_unhealthy_seeds_becoming_healthy() {
+    //     // Setup.
+    //     setup_tracing();
+    //     let node_1 = mock_node(IC0_SEED_DOMAIN);
+    //     let node_2 = mock_node("api1");
+    //     // Set nodes fetching params: topology, fetching periodicity.
+    //     let fetcher = Arc::new(NodesFetcherMock::new());
+    //     let fetch_interval = Duration::from_secs(2);
+    //     // Set health checking params: healthy nodes, checking periodicity.
+    //     let checker = Arc::new(NodeHealthCheckerMock::new());
+    //     let check_interval = Duration::from_secs(1);
+    //     // Two nodes exist, which are initially unhealthy.
+    //     fetcher.overwrite_nodes(vec![node_1.clone(), node_2.clone()]);
+    //     checker.overwrite_healthy_nodes(vec![]);
+    //     // Configure RouteProvider
+    //     let snapshot = RoundRobinRoutingSnapshot::new();
+    //     let client = Client::builder().build().unwrap();
+    //     let route_provider = DynamicRouteProviderBuilder::new(
+    //         snapshot,
+    //         vec![node_1.clone(), node_2.clone()],
+    //         client,
+    //     )
+    //     .with_fetcher(fetcher)
+    //     .with_checker(checker.clone())
+    //     .with_fetch_period(fetch_interval)
+    //     .with_check_period(check_interval)
+    //     .build()
+    //     .await;
+    //     let route_provider = Arc::new(route_provider);
+
+    //     // Test 1: calls to route() return an error, as no healthy seeds exist.
+    //     for _ in 0..4 {
+    //         tokio::time::sleep(check_interval).await;
+    //         let result = route_provider.route();
+    //         assert_eq!(
+    //             result.unwrap_err(),
+    //             AgentError::RouteProviderError("No healthy API nodes found.".to_string())
+    //         );
+    //     }
+
+    //     // Test 2: calls to route() return both seeds, as they become healthy.
+    //     checker.overwrite_healthy_nodes(vec![node_1.clone(), node_2.clone()]);
+    //     tokio::time::sleep(3 * check_interval).await;
+    //     let routed_domains = route_n_times(6, Arc::clone(&route_provider));
+    //     assert_routed_domains(routed_domains, vec![node_1.domain(), node_2.domain()], 3);
+    // }
+
+    // #[tokio::test]
+    // async fn test_routing_with_no_healthy_nodes_returns_an_error() {
+    //     // Setup.
+    //     setup_tracing();
+    //     let node_1 = Node::new(IC0_SEED_DOMAIN).unwrap();
+    //     // Set nodes fetching params: topology, fetching periodicity.
+    //     let fetcher = Arc::new(NodesFetcherMock::new());
+    //     let fetch_interval = Duration::from_secs(2);
+    //     // Set health checking params: healthy nodes, checking periodicity.
+    //     let checker = Arc::new(NodeHealthCheckerMock::new());
+    //     let check_interval = Duration::from_secs(1);
+    //     // A single seed node which is initially healthy.
+    //     fetcher.overwrite_nodes(vec![node_1.clone()]);
+    //     checker.overwrite_healthy_nodes(vec![node_1.clone()]);
+    //     // Configure RouteProvider
+    //     let snapshot = RoundRobinRoutingSnapshot::new();
+    //     let client = Client::builder().build().unwrap();
+    //     let route_provider =
+    //         DynamicRouteProviderBuilder::new(snapshot, vec![node_1.clone()], client)
+    //             .with_fetcher(fetcher)
+    //             .with_checker(checker.clone())
+    //             .with_fetch_period(fetch_interval)
+    //             .with_check_period(check_interval)
+    //             .build()
+    //             .await;
+    //     let route_provider = Arc::new(route_provider);
+
+    //     // Test 1: multiple route() calls return a single domain=ic0.app, as the seed is healthy.
+    //     tokio::time::sleep(2 * check_interval).await;
+    //     let routed_domains = route_n_times(3, Arc::clone(&route_provider));
+    //     assert_routed_domains(routed_domains, vec![node_1.domain()], 3);
+
+    //     // Test 2: calls to route() return an error, as no healthy nodes exist.
+    //     checker.overwrite_healthy_nodes(vec![]);
+    //     tokio::time::sleep(2 * check_interval).await;
+    //     for _ in 0..4 {
+    //         let result = route_provider.route();
+    //         assert_eq!(
+    //             result.unwrap_err(),
+    //             AgentError::RouteProviderError("No healthy API nodes found.".to_string())
+    //         );
+    //     }
+    // }
+
+    // #[tokio::test]
+    // async fn test_route_with_no_healthy_seeds_errors() {
+    //     // Setup.
+    //     setup_tracing();
+    //     let node_1 = Node::new(IC0_SEED_DOMAIN).unwrap();
+    //     // Set nodes fetching params: topology, fetching periodicity.
+    //     let fetcher = Arc::new(NodesFetcherMock::new());
+    //     let fetch_interval = Duration::from_secs(2);
+    //     // Set health checking params: healthy nodes, checking periodicity.
+    //     let checker = Arc::new(NodeHealthCheckerMock::new());
+    //     let check_interval = Duration::from_secs(1);
+    //     // No healthy seed nodes present, this should lead to errors.
+    //     fetcher.overwrite_nodes(vec![]);
+    //     checker.overwrite_healthy_nodes(vec![]);
+    //     // Configure RouteProvider
+    //     let snapshot = RoundRobinRoutingSnapshot::new();
+    //     let client = Client::builder().build().unwrap();
+    //     let route_provider =
+    //         DynamicRouteProviderBuilder::new(snapshot, vec![node_1.clone()], client)
+    //             .with_fetcher(fetcher)
+    //             .with_checker(checker)
+    //             .with_fetch_period(fetch_interval)
+    //             .with_check_period(check_interval)
+    //             .build()
+    //             .await;
+
+    //     // Test: calls to route() return an error, as no healthy seeds exist.
+    //     for _ in 0..4 {
+    //         tokio::time::sleep(check_interval).await;
+    //         let result = route_provider.route();
+    //         assert_eq!(
+    //             result.unwrap_err(),
+    //             AgentError::RouteProviderError("No healthy API nodes found.".to_string())
+    //         );
+    //     }
+    // }
+
+    // #[tokio::test]
+    // async fn test_route_with_one_healthy_and_one_unhealthy_seed() {
+    //     // Setup.
+    //     setup_tracing();
+    //     let node_1 = Node::new(IC0_SEED_DOMAIN).unwrap();
+    //     let node_2 = Node::new("api1.com").unwrap();
+    //     // Set nodes fetching params: topology, fetching periodicity.
+    //     let fetcher = Arc::new(NodesFetcherMock::new());
+    //     let fetch_interval = Duration::from_secs(2);
+    //     // Set health checking params: healthy nodes, checking periodicity.
+    //     let checker = Arc::new(NodeHealthCheckerMock::new());
+    //     let check_interval = Duration::from_secs(1);
+    //     // One healthy seed is present, it should be discovered during the initialization time.
+    //     fetcher.overwrite_nodes(vec![node_1.clone(), node_2.clone()]);
+    //     checker.overwrite_healthy_nodes(vec![node_1.clone()]);
+    //     // Configure RouteProvider
+    //     let snapshot = RoundRobinRoutingSnapshot::new();
+    //     let client = Client::builder().build().unwrap();
+    //     let route_provider = DynamicRouteProviderBuilder::new(
+    //         snapshot,
+    //         vec![node_1.clone(), node_2.clone()],
+    //         client,
+    //     )
+    //     .with_fetcher(fetcher)
+    //     .with_checker(checker.clone())
+    //     .with_fetch_period(fetch_interval)
+    //     .with_check_period(check_interval)
+    //     .build()
+    //     .await;
+    //     let route_provider = Arc::new(route_provider);
+
+    //     // Test 1: calls to route() return only a healthy seed ic0.app.
+    //     let routed_domains = route_n_times(3, Arc::clone(&route_provider));
+    //     assert_routed_domains(routed_domains, vec![node_1.domain()], 3);
+
+    //     // Test 2: calls to route() return two healthy seeds, as the unhealthy seed becomes healthy.
+    //     checker.overwrite_healthy_nodes(vec![node_1.clone(), node_2.clone()]);
+    //     tokio::time::sleep(2 * check_interval).await;
+    //     let routed_domains = route_n_times(6, Arc::clone(&route_provider));
+    //     assert_routed_domains(routed_domains, vec![node_1.domain(), node_2.domain()], 3);
+    // }
+
+    // #[tokio::test]
+    // async fn test_routing_with_an_empty_fetched_list_of_api_nodes() {
+    //     // Check resiliency to an empty list of fetched API nodes (this should never happen in normal IC operation).
+    //     // Setup.
+    //     setup_tracing();
+    //     let node_1 = Node::new(IC0_SEED_DOMAIN).unwrap();
+    //     // Set nodes fetching params: topology, fetching periodicity.
+    //     let fetcher = Arc::new(NodesFetcherMock::new());
+    //     let fetch_interval = Duration::from_secs(2);
+    //     // Set health checking params: healthy nodes, checking periodicity.
+    //     let checker = Arc::new(NodeHealthCheckerMock::new());
+    //     let check_interval = Duration::from_secs(1);
+    //     // One healthy seed is initially present, but the topology has no node.
+    //     fetcher.overwrite_nodes(vec![]);
+    //     checker.overwrite_healthy_nodes(vec![node_1.clone()]);
+    //     // Configure RouteProvider
+    //     let snapshot = RoundRobinRoutingSnapshot::new();
+    //     let client = Client::builder().build().unwrap();
+    //     let route_provider =
+    //         DynamicRouteProviderBuilder::new(snapshot, vec![node_1.clone()], client)
+    //             .with_fetcher(fetcher.clone())
+    //             .with_checker(checker.clone())
+    //             .with_fetch_period(fetch_interval)
+    //             .with_check_period(check_interval)
+    //             .build()
+    //             .await;
+    //     let route_provider = Arc::new(route_provider);
+
+    //     // This time span is required for the snapshot to be fully updated with the new nodes topology and health info.
+    //     let snapshot_update_duration = fetch_interval + 2 * check_interval;
+
+    //     // Test 1: multiple route() calls return a single domain=ic0.app.
+    //     // HealthManagerActor shouldn't update the snapshot, if the list of fetched nodes is empty, thus we observe the healthy seed.
+    //     tokio::time::sleep(snapshot_update_duration).await;
+    //     let routed_domains = route_n_times(3, Arc::clone(&route_provider));
+    //     assert_routed_domains(routed_domains, vec![node_1.domain()], 3);
+
+    //     // Test 2: multiple route() calls should now return 3 different domains with equal fairness (repetition).
+    //     // Three nodes are added to the topology, i.e. now the fetched nodes list is non-empty.
+    //     let node_2 = Node::new("api1.com").unwrap();
+    //     let node_3 = Node::new("api2.com").unwrap();
+    //     fetcher.overwrite_nodes(vec![node_1.clone(), node_2.clone(), node_3.clone()]);
+    //     checker.overwrite_healthy_nodes(vec![node_1.clone(), node_2.clone(), node_3.clone()]);
+    //     tokio::time::sleep(snapshot_update_duration).await;
+    //     let routed_domains = route_n_times(6, Arc::clone(&route_provider));
+    //     assert_routed_domains(
+    //         routed_domains,
+    //         vec![node_1.domain(), node_2.domain(), node_3.domain()],
+    //         2,
+    //     );
+    // }
+}
+
+// - none of the seeds [] are healthy
+// - none of the API node [] is healthy
+// - return a vector of errors: HealthCheckErrors, FetchErrors, etc.
diff --git a/ic-agent/src/agent/route_provider/dynamic_routing/health_check.rs b/ic-agent/src/agent/route_provider/dynamic_routing/health_check.rs
new file mode 100644
index 00000000..f1474e6a
--- /dev/null
+++ b/ic-agent/src/agent/route_provider/dynamic_routing/health_check.rs
@@ -0,0 +1,194 @@
+use futures_util::FutureExt;
+use http::{Method, StatusCode};
+use reqwest::Request;
+use std::{
+    fmt::Debug,
+    sync::Arc,
+    time::{Duration, Instant},
+};
+use stop_token::{StopSource, StopToken};
+use tracing::{debug, error, info, trace, warn};
+use url::Url;
+
+use crate::agent::{
+    route_provider::dynamic_routing::{
+        dynamic_route_provider::DynamicRouteProviderError,
+        messages::{FetchedNodes, NodeHealthState},
+        snapshot::routing_snapshot::RoutingSnapshot,
+        type_aliases::{AtomicSwap, ReceiverWatch, SenderMpsc},
+    },
+    ApiBoundaryNode, HttpService,
+};
+
+const CHANNEL_BUFFER: usize = 128;
+
+/// A struct representing the health check status of the node.
+#[derive(Clone, PartialEq, Debug, Default)]
+pub struct HealthCheckStatus {
+    latency: Option<Duration>,
+}
+
+impl HealthCheckStatus {
+    /// Creates a new `HealthCheckStatus` instance.
+    pub fn new(latency: Option<Duration>) -> Self {
+        Self { latency }
+    }
+
+    /// Checks if the node is healthy.
+    pub fn is_healthy(&self) -> bool {
+        self.latency.is_some()
+    }
+
+    /// Get the latency of the health check.
+    pub fn latency(&self) -> Option<Duration> {
+        self.latency
+    }
+}
+
+const HEALTH_CHECKER: &str = "HealthChecker";
+
+pub(crate) async fn health_check(
+    client: Arc<dyn HttpService>,
+    check_timeout: Duration,
+    node: &ApiBoundaryNode,
+) -> Result<HealthCheckStatus, DynamicRouteProviderError> {
+    // API boundary node exposes /health endpoint and should respond with 204 (No Content) if it's healthy.
+    let url = node.to_routing_url().join("/health").unwrap();
+
+    let start = Instant::now();
+    let response = client
+        .call(
+            &|| {
+                let mut request = Request::new(Method::GET, url.clone());
+                *request.timeout_mut() = Some(check_timeout);
+                Ok(request)
+            },
+            0,
+        )
+        .await
+        .map_err(|err| {
+            DynamicRouteProviderError::HealthCheckError(format!(
+                "Failed to execute GET request to {url}: {err}"
+            ))
+        })?;
+    let latency = start.elapsed();
+
+    if response.status() != StatusCode::NO_CONTENT {
+        let err_msg = format!(
+            "{HEALTH_CHECKER}: Unexpected http status code {} for url={url} received",
+            response.status()
+        );
+        error!(err_msg);
+        return Err(DynamicRouteProviderError::HealthCheckError(err_msg));
+    }
+
+    Ok(HealthCheckStatus::new(Some(latency)))
+}
+
+const HEALTH_CHECK_ACTOR: &str = "HealthCheckActor";
+
+/// The name of the health manager actor.
+pub(super) const HEALTH_MANAGER_ACTOR: &str = "HealthManagerActor";
+
+pub(crate) async fn health_check_actor(
+    client: Arc<dyn HttpService>,
+    period: Duration,
+    timeout: Duration,
+    node: ApiBoundaryNode,
+    sender_channel: SenderMpsc<NodeHealthState>,
+    token: StopToken,
+) {
+    loop {
+        futures_util::select! {
+            _ = crate::util::sleep(period).fuse() => {
+                let health = health_check(client.clone(), timeout, &node).await.unwrap_or_default();
+                let message = NodeHealthState {
+                    node: node.clone(),
+                    health,
+                };
+                // Inform the listener about node's health. It can only fail if the listener was closed/dropped.
+                sender_channel.send(message).await.expect("Failed to send node's health state");
+            }
+            _ = token.clone().fuse() => {
+                info!("{HEALTH_CHECK_ACTOR}: was gracefully cancelled for node {node:?}");
+                break;
+            }
+        }
+    }
+}
+
+pub(crate) async fn health_check_manager_actor<S: RoutingSnapshot>(
+    client: Arc<dyn HttpService>,
+    period: Duration,
+    timeout: Duration,
+    routing_snapshot: AtomicSwap<S>,
+    mut fetch_receiver: ReceiverWatch<FetchedNodes>,
+    init_sender: SenderMpsc<bool>,
+    token: StopToken,
+) {
+    let (check_sender, check_receiver) = async_channel::bounded(CHANNEL_BUFFER);
+    let mut is_initialized = false;
+    let mut nodes_stop: StopSource;
+    loop {
+        futures_util::select_biased! {
+            _ = token.clone().fuse() => {
+                check_receiver.close();
+                trace!("{HEALTH_MANAGER_ACTOR}: was gracefully cancelled, all nodes health checks stopped");
+                break;
+            }
+            // Process a new array of fetched nodes from NodesFetchActor, if it appeared in the channel.
+            result = fetch_receiver.recv().fuse() => {
+                match result {
+                    Err(err) => {
+                        error!("{HEALTH_MANAGER_ACTOR}: nodes fetch sender has been dropped: {err:?}");
+                        continue; // will hit the stoptoken next
+                    }
+                    Ok(Some(FetchedNodes { nodes })) => {
+                        if nodes.is_empty() {
+                            // This is a bug in the IC registry. There should be at least one API Boundary Node in the registry.
+                            // Updating nodes snapshot with an empty array, would lead to an irrecoverable error, as new nodes couldn't be fetched.
+                            // We avoid such updates and just wait for a non-empty list.
+                            error!("{HEALTH_MANAGER_ACTOR}: list of fetched nodes is empty");
+                            return;
+                        }
+                        debug!("{HEALTH_MANAGER_ACTOR}: fetched nodes received {:?}", nodes);
+                        let current_snapshot = routing_snapshot.load_full();
+                        let mut new_snapshot = (*current_snapshot).clone();
+                        // If the snapshot has changed, store it and restart all node's health checks.
+                        if new_snapshot.sync_nodes(&nodes) {
+                            routing_snapshot.store(Arc::new(new_snapshot));
+                            warn!("{HEALTH_MANAGER_ACTOR}: stopping all running health checks");
+                            nodes_stop = StopSource::new();
+                            for node in &nodes {
+                                debug!("{HEALTH_MANAGER_ACTOR}: starting health check for node {node:?}");
+                                crate::util::spawn(health_check_actor(
+                                    client.clone(),
+                                    period,
+                                    timeout,
+                                    node.clone(),
+                                    check_sender.clone(),
+                                    nodes_stop.token(),
+                                ));
+                            }
+                        }
+                    }
+                    Ok(None) => continue,
+                }
+            }
+            // Receive health check messages from all running HealthCheckActor/s.
+            msg = check_receiver.recv().fuse() => {
+                if let Ok(msg) = msg {
+                    let current_snapshot = routing_snapshot.load_full();
+                    let mut new_snapshot = (*current_snapshot).clone();
+                    new_snapshot.update_node(&msg.node, msg.health.clone());
+                    routing_snapshot.store(Arc::new(new_snapshot));
+                    if !is_initialized && msg.health.is_healthy() {
+                        is_initialized = true;
+                        // If TIMEOUT_AWAIT_HEALTHY_SEED has been exceeded, the receiver was dropped and send would thus fail. We ignore the failure.
+                        let _ = init_sender.send(true).await;
+                    }
+                }
+            }
+        }
+    }
+}
diff --git a/ic-agent/src/agent/route_provider/dynamic_routing/messages.rs b/ic-agent/src/agent/route_provider/dynamic_routing/messages.rs
new file mode 100644
index 00000000..77934f05
--- /dev/null
+++ b/ic-agent/src/agent/route_provider/dynamic_routing/messages.rs
@@ -0,0 +1,18 @@
+use crate::agent::{
+    route_provider::dynamic_routing::health_check::HealthCheckStatus, ApiBoundaryNode,
+};
+
+/// Represents a message with fetched nodes.
+#[derive(Debug, Clone)]
+pub struct FetchedNodes {
+    /// The fetched nodes.
+    pub nodes: Vec<ApiBoundaryNode>,
+}
+
+/// Represents a message with the health state of a node.
+pub struct NodeHealthState {
+    /// The node.
+    pub node: ApiBoundaryNode,
+    /// The health state of the node.
+    pub health: HealthCheckStatus,
+}
diff --git a/ic-agent/src/agent/route_provider/dynamic_routing/mod.rs b/ic-agent/src/agent/route_provider/dynamic_routing/mod.rs
new file mode 100644
index 00000000..c983ae73
--- /dev/null
+++ b/ic-agent/src/agent/route_provider/dynamic_routing/mod.rs
@@ -0,0 +1,14 @@
+//! Dynamic routing implementation.
+pub mod dynamic_route_provider;
+/// Health check implementation.
+pub mod health_check;
+/// Messages used in dynamic routing.
+pub(super) mod messages;
+/// Nodes fetch implementation.
+pub mod nodes_fetch;
+/// Routing snapshot implementation.
+pub mod snapshot;
+#[cfg(test)]
+pub(super) mod test_utils;
+/// Type aliases used in dynamic routing.
+pub(super) mod type_aliases;
diff --git a/ic-agent/src/agent/route_provider/dynamic_routing/nodes_fetch.rs b/ic-agent/src/agent/route_provider/dynamic_routing/nodes_fetch.rs
new file mode 100644
index 00000000..51770c60
--- /dev/null
+++ b/ic-agent/src/agent/route_provider/dynamic_routing/nodes_fetch.rs
@@ -0,0 +1,98 @@
+use candid::Principal;
+use futures_util::FutureExt;
+use std::time::Duration;
+use stop_token::StopToken;
+use tracing::{error, warn};
+use url::Url;
+
+use crate::{
+    agent::{
+        route_provider::dynamic_routing::{
+            health_check::HEALTH_MANAGER_ACTOR,
+            messages::FetchedNodes,
+            snapshot::routing_snapshot::RoutingSnapshot,
+            type_aliases::{AtomicSwap, SenderWatch},
+        },
+        Agent, ApiBoundaryNode,
+    },
+    AgentError,
+};
+
+const NODES_FETCH_ACTOR: &str = "NodesFetchActor";
+
+async fn fetch_subnet_nodes(
+    agent: &Agent,
+    subnet_id: Principal,
+    node: &ApiBoundaryNode,
+) -> Result<Vec<ApiBoundaryNode>, AgentError> {
+    let agent = agent.clone_with_url(node.to_routing_url());
+    let api_bns = agent
+        .fetch_api_boundary_nodes_by_subnet_id(subnet_id)
+        .await?;
+    // If some API BNs have invalid domain names, they are discarded.
+    let nodes = api_bns
+        .into_iter()
+        .filter(|api_node| is_valid_domain(&api_node.domain))
+        .collect();
+    Ok(nodes)
+}
+
+pub(crate) async fn nodes_fetch_actor<S: RoutingSnapshot>(
+    agent: Agent,
+    subnet_id: Principal,
+    period: Duration,
+    retry_interval: Duration,
+    fetch_sender: SenderWatch<FetchedNodes>,
+    snapshot: AtomicSwap<S>,
+    token: StopToken,
+) {
+    loop {
+        futures_util::select! {
+            _ = crate::util::sleep(period).fuse() => {
+                    // Retry until success:
+                    // - try to get a healthy node from the routing snapshot
+                    //   - if snapshot is empty, break the cycle and wait for the next fetch cycle
+                    // - using the healthy node, try to fetch nodes from topology
+                    //   - if failure, sleep and retry
+                    // - try send fetched nodes to the listener
+                    //   - failure should never happen, but we trace it if it does
+                    loop {
+                        let snapshot = snapshot.load();
+                        if let Some(node) = snapshot.next_node() {
+                            match fetch_subnet_nodes(&agent, subnet_id, &node).await {
+                                Ok(nodes) => {
+                                    let msg = Some(FetchedNodes {nodes});
+                                    match fetch_sender.send(msg) {
+                                        Ok(()) => break, // message sent successfully, exist the loop
+                                        Err(err) => {
+                                            error!("{NODES_FETCH_ACTOR}: failed to send results to {HEALTH_MANAGER_ACTOR}: {err:?}");
+                                        }
+                                    }
+                                },
+                                Err(err) => {
+                                    error!("{NODES_FETCH_ACTOR}: failed to fetch nodes: {err:?}");
+                                }
+                            };
+                        } else {
+                            // No healthy nodes in the snapshot, break the cycle and wait for the next fetch cycle
+                            error!("{NODES_FETCH_ACTOR}: no nodes in the snapshot");
+                            break;
+                        };
+                        warn!("Retrying to fetch the nodes in {:?}", retry_interval);
+                        crate::util::sleep(retry_interval).await;
+                    }
+            }
+            _ = token.clone().fuse() => {
+                warn!("{NODES_FETCH_ACTOR}: was gracefully cancelled");
+                break;
+            }
+        }
+    }
+}
+
+/// Checks if the given domain is a valid URL.
+fn is_valid_domain<S: AsRef<str>>(domain: S) -> bool {
+    // Prepend scheme to make it a valid URL
+    let url_string = format!("http://{}", domain.as_ref());
+    Url::parse(&url_string).is_ok()
+}
diff --git a/ic-agent/src/agent/route_provider/dynamic_routing/snapshot/latency_based_routing.rs b/ic-agent/src/agent/route_provider/dynamic_routing/snapshot/latency_based_routing.rs
new file mode 100644
index 00000000..203a5a18
--- /dev/null
+++ b/ic-agent/src/agent/route_provider/dynamic_routing/snapshot/latency_based_routing.rs
@@ -0,0 +1,645 @@
+use std::{
+    collections::{HashSet, VecDeque},
+    time::Duration,
+};
+
+use rand::Rng;
+
+use crate::agent::{
+    route_provider::dynamic_routing::{
+        health_check::HealthCheckStatus, snapshot::routing_snapshot::RoutingSnapshot,
+    },
+    ApiBoundaryNode,
+};
+
+// Determines the size of the sliding window used for storing latencies and availabilities of nodes.
+const WINDOW_SIZE: usize = 15;
+// Determines the decay rate of the exponential decay function, which is used for generating weights over the sliding window.
+const LAMBDA_DECAY: f64 = 0.3;
+
+/// Generates exponentially decaying weights for the sliding window.
+fn generate_exp_decaying_weights(n: usize, lambda: f64) -> Vec<f64> {
+    let mut weights: Vec<f64> = Vec::with_capacity(n);
+    for i in 0..n {
+        let weight = (-lambda * i as f64).exp();
+        weights.push(weight);
+    }
+    weights
+}
+
+// ApiBoundaryNode with meta information and metrics (latencies, availabilities).
+// Routing URLs a generated based on the score field.
+#[derive(Clone, Debug)]
+struct ApiBoundaryNodeWithMetrics {
+    // ApiBoundaryNode information.
+    node: ApiBoundaryNode,
+    // Size of the sliding window used for store latencies and availabilities of the node.
+    window_size: usize,
+    /// Reflects the status of the most recent health check. It should be the same as the last element in `availabilities`.
+    is_healthy: bool,
+    /// Sliding window with latency measurements.
+    latencies: VecDeque<f64>,
+    /// Sliding window with availability measurements.
+    availabilities: VecDeque<bool>,
+    /// Overall score of the node. Calculated based on latencies and availabilities arrays. This score is used in `next_n_nodes()` and `next_node()` methods.
+    score: f64,
+}
+
+impl ApiBoundaryNodeWithMetrics {
+    pub fn new(node: ApiBoundaryNode, window_size: usize) -> Self {
+        Self {
+            node,
+            window_size,
+            is_healthy: false,
+            latencies: VecDeque::with_capacity(window_size + 1),
+            availabilities: VecDeque::with_capacity(window_size + 1),
+            score: 0.0,
+        }
+    }
+
+    pub fn add_latency_measurement(&mut self, latency: Option<Duration>) {
+        self.is_healthy = latency.is_some();
+        if let Some(duration) = latency {
+            self.latencies.push_back(duration.as_secs_f64());
+            while self.latencies.len() > self.window_size {
+                self.latencies.pop_front();
+            }
+            self.availabilities.push_back(true);
+        } else {
+            self.availabilities.push_back(false);
+        }
+        while self.availabilities.len() > self.window_size {
+            self.availabilities.pop_front();
+        }
+    }
+}
+
+/// Computes the score of the node based on the latencies, availabilities and window weights.
+/// `window_weights_sum`` is passed for efficiency reasons, as it is pre-calculated.
+fn compute_score(
+    window_weights: &[f64],
+    window_weights_sum: f64,
+    availabilities: &VecDeque<bool>,
+    latencies: &VecDeque<f64>,
+    use_availability_penalty: bool,
+) -> f64 {
+    let weights_size = window_weights.len();
+    let availabilities_size = availabilities.len();
+    let latencies_size = latencies.len();
+
+    if weights_size < availabilities_size {
+        panic!(
+            "Weights array of size {weights_size} is smaller than array of availabilities of size {availabilities_size}",
+        );
+    } else if weights_size < latencies_size {
+        panic!(
+            "Weights array of size {weights_size} is smaller than array of latencies of size {latencies_size}",
+        );
+    }
+
+    // Compute normalized availability score [0.0, 1.0].
+    let score_a = if !use_availability_penalty {
+        1.0
+    } else if availabilities.is_empty() {
+        0.0
+    } else {
+        let mut score = 0.0;
+
+        // Compute weighted score. Weights are applied in reverse order.
+        for (idx, availability) in availabilities.iter().rev().enumerate() {
+            score += window_weights[idx] * (*availability as u8 as f64);
+        }
+
+        // Normalize the score.
+        let weights_sum = if availabilities_size < weights_size {
+            // Use partial sum of weights, if the window is not full.
+            let partial_weights_sum: f64 = window_weights.iter().take(availabilities_size).sum();
+            partial_weights_sum
+        } else {
+            // Use pre-calculated sum, if the window is full.
+            window_weights_sum
+        };
+
+        score /= weights_sum;
+
+        score
+    };
+
+    // Compute latency score (not normalized).
+    let score_l = if latencies.is_empty() {
+        0.0
+    } else {
+        let mut score = 0.0;
+
+        // Compute weighted score. Weights are applied in reverse order. Latency is inverted, so that smaller latencies have higher score.
+        for (idx, latency) in latencies.iter().rev().enumerate() {
+            score += window_weights[idx] / latency;
+        }
+
+        let weights_sum = if latencies_size < weights_size {
+            let partial_weights_sum: f64 = window_weights.iter().take(latencies.len()).sum();
+            partial_weights_sum
+        } else {
+            // Use pre-calculated sum.
+            window_weights_sum
+        };
+
+        score /= weights_sum;
+
+        score
+    };
+
+    // Combine availability and latency scores via product to emphasize the importance of both metrics.
+    score_l * score_a
+}
+
+/// Routing snapshot for latency-based routing.
+/// In this routing strategy, nodes are randomly selected based on their averaged latency of the last WINDOW_SIZE health checks.
+/// ApiBoundaryNodes with smaller average latencies are preferred for routing.
+#[derive(Default, Debug, Clone)]
+pub struct LatencyRoutingSnapshot {
+    nodes_with_metrics: Vec<ApiBoundaryNodeWithMetrics>,
+    existing_nodes: HashSet<ApiBoundaryNode>,
+    window_weights: Vec<f64>,
+    window_weights_sum: f64,
+    use_availability_penalty: bool,
+}
+
+/// Implementation of the LatencyRoutingSnapshot.
+impl LatencyRoutingSnapshot {
+    /// Creates a new LatencyRoutingSnapshot.
+    pub fn new() -> Self {
+        // Weights are ordered from left to right, where the leftmost weight is for the most recent health check.
+        let window_weights = generate_exp_decaying_weights(WINDOW_SIZE, LAMBDA_DECAY);
+        // Pre-calculate the sum of weights for efficiency reasons.
+        let window_weights_sum: f64 = window_weights.iter().sum();
+
+        Self {
+            nodes_with_metrics: vec![],
+            existing_nodes: HashSet::new(),
+            use_availability_penalty: true,
+            window_weights,
+            window_weights_sum,
+        }
+    }
+
+    /// Sets whether to use availability penalty in the score computation.
+    pub fn set_availability_penalty(mut self, use_penalty: bool) -> Self {
+        self.use_availability_penalty = use_penalty;
+        self
+    }
+
+    /// Sets the weights for the sliding window.
+    /// The weights are ordered from left to right, where the leftmost weight is for the most recent health check.
+    pub fn set_window_weights(mut self, weights: &[f64]) -> Self {
+        self.window_weights_sum = weights.iter().sum();
+        self.window_weights = weights.to_vec();
+        self
+    }
+}
+
+/// Helper function to sample nodes based on their weights.
+/// Here weight index is selected based on the input number in range [0, 1]
+#[inline(always)]
+fn weighted_sample(weighted_nodes: &[(f64, &ApiBoundaryNode)], number: f64) -> Option<usize> {
+    if !(0.0..=1.0).contains(&number) {
+        return None;
+    }
+    let sum: f64 = weighted_nodes.iter().map(|n| n.0).sum();
+    let mut weighted_number = number * sum;
+    for (idx, &(weight, _)) in weighted_nodes.iter().enumerate() {
+        weighted_number -= weight;
+        if weighted_number <= 0.0 {
+            return Some(idx);
+        }
+    }
+    None
+}
+
+impl RoutingSnapshot for LatencyRoutingSnapshot {
+    fn has_nodes(&self) -> bool {
+        self.nodes_with_metrics.iter().any(|n| n.is_healthy)
+    }
+
+    fn next_node(&self) -> Option<ApiBoundaryNode> {
+        self.next_n_nodes(1).into_iter().next()
+    }
+
+    // Uses weighted random sampling algorithm n times. ApiBoundaryNode can be selected at most once (sampling without replacement).
+    fn next_n_nodes(&self, n: usize) -> Vec<ApiBoundaryNode> {
+        if n == 0 {
+            return Vec::new();
+        }
+
+        // Preallocate array for a better efficiency.
+        let mut healthy_nodes = Vec::with_capacity(self.nodes_with_metrics.len());
+        for n in &self.nodes_with_metrics {
+            if n.is_healthy {
+                healthy_nodes.push((n.score, &n.node));
+            }
+        }
+
+        // Limit the number of returned nodes to the number of healthy nodes.
+        let n = std::cmp::min(n, healthy_nodes.len());
+
+        let mut nodes = Vec::with_capacity(n);
+
+        let mut rng = rand::thread_rng();
+
+        for _ in 0..n {
+            // Generate a random float in the range [0, 1)
+            let rand_num = rng.gen::<f64>();
+            if let Some(idx) = weighted_sample(healthy_nodes.as_slice(), rand_num) {
+                let node = healthy_nodes[idx].1;
+                nodes.push(node.clone());
+                // Remove the item, so that it can't be selected anymore.
+                healthy_nodes.swap_remove(idx);
+            }
+        }
+
+        nodes
+    }
+
+    fn sync_nodes(&mut self, nodes: &[ApiBoundaryNode]) -> bool {
+        let new_nodes = HashSet::from_iter(nodes.iter().cloned());
+        // Find nodes removed from topology.
+        let nodes_removed: Vec<_> = self
+            .existing_nodes
+            .difference(&new_nodes)
+            .cloned()
+            .collect();
+        let has_removed_nodes = !nodes_removed.is_empty();
+        // Find nodes added to topology.
+        let nodes_added: Vec<_> = new_nodes
+            .difference(&self.existing_nodes)
+            .cloned()
+            .collect();
+        let has_added_nodes = !nodes_added.is_empty();
+        self.existing_nodes.extend(nodes_added);
+        // NOTE: newly added nodes will appear in the weighted_nodes later.
+        // This happens after the first node health check round and a consequent update_node() invocation.
+        for node in nodes_removed.into_iter() {
+            self.existing_nodes.remove(&node);
+            let idx = self.nodes_with_metrics.iter().position(|x| x.node == node);
+            idx.map(|idx| self.nodes_with_metrics.swap_remove(idx));
+        }
+
+        has_added_nodes || has_removed_nodes
+    }
+
+    fn update_node(&mut self, node: &ApiBoundaryNode, health: HealthCheckStatus) -> bool {
+        // Skip the update if the node is not in the existing nodes.
+        if !self.existing_nodes.contains(node) {
+            return false;
+        }
+
+        let idx = self
+            .nodes_with_metrics
+            .iter()
+            .position(|x| &x.node == node)
+            .unwrap_or_else(|| {
+                let node = ApiBoundaryNodeWithMetrics::new(node.clone(), self.window_weights.len());
+                self.nodes_with_metrics.push(node);
+                self.nodes_with_metrics.len() - 1
+            });
+
+        self.nodes_with_metrics[idx].add_latency_measurement(health.latency());
+
+        self.nodes_with_metrics[idx].score = compute_score(
+            self.window_weights.as_slice(),
+            self.window_weights_sum,
+            &self.nodes_with_metrics[idx].availabilities,
+            &self.nodes_with_metrics[idx].latencies,
+            self.use_availability_penalty,
+        );
+
+        true
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::{
+        collections::{HashMap, HashSet, VecDeque},
+        time::Duration,
+    };
+
+    use crate::agent::route_provider::dynamic_routing::{
+        health_check::HealthCheckStatus,
+        snapshot::{
+            latency_based_routing::{
+                compute_score, weighted_sample, ApiBoundaryNodeWithMetrics, LatencyRoutingSnapshot,
+            },
+            routing_snapshot::RoutingSnapshot,
+        },
+        test_utils::mock_node,
+    };
+
+    #[test]
+    fn test_snapshot_init() {
+        // Arrange
+        let snapshot = LatencyRoutingSnapshot::new();
+        // Assert
+        assert!(snapshot.nodes_with_metrics.is_empty());
+        assert!(snapshot.existing_nodes.is_empty());
+        assert!(!snapshot.has_nodes());
+        assert!(snapshot.next_node().is_none());
+        assert!(snapshot.next_n_nodes(1).is_empty());
+    }
+
+    #[test]
+    fn test_update_for_non_existing_node_fails() {
+        // Arrange
+        let mut snapshot = LatencyRoutingSnapshot::new();
+        let node = mock_node("api1");
+        let health = HealthCheckStatus::new(Some(Duration::from_secs(1)));
+        // Act
+        let is_updated = snapshot.update_node(&node, health);
+        // Assert
+        assert!(!is_updated);
+        assert!(snapshot.nodes_with_metrics.is_empty());
+        assert!(!snapshot.has_nodes());
+        assert!(snapshot.next_node().is_none());
+    }
+
+    #[test]
+    fn test_update_for_existing_node_succeeds() {
+        // Arrange
+        let mut snapshot = LatencyRoutingSnapshot::new()
+            .set_window_weights(&[2.0, 1.0])
+            .set_availability_penalty(false);
+        let node = mock_node("api1");
+        let health = HealthCheckStatus::new(Some(Duration::from_secs(1)));
+        snapshot.existing_nodes.insert(node.clone());
+        // Check first update
+        let is_updated = snapshot.update_node(&node, health);
+        assert!(is_updated);
+        assert!(snapshot.has_nodes());
+        let node_with_metrics = snapshot.nodes_with_metrics.first().unwrap();
+        assert_eq!(node_with_metrics.score, (2.0 / 1.0) / 2.0);
+        assert_eq!(snapshot.next_node().unwrap(), node);
+        // Check second update
+        let health = HealthCheckStatus::new(Some(Duration::from_secs(2)));
+        let is_updated = snapshot.update_node(&node, health);
+        assert!(is_updated);
+        let node_with_metrics = snapshot.nodes_with_metrics.first().unwrap();
+        assert_eq!(node_with_metrics.score, (2.0 / 2.0 + 1.0 / 1.0) / 3.0);
+        // Check third update
+        let health = HealthCheckStatus::new(Some(Duration::from_secs(3)));
+        let is_updated = snapshot.update_node(&node, health);
+        assert!(is_updated);
+        let node_with_metrics = snapshot.nodes_with_metrics.first().unwrap();
+        assert_eq!(node_with_metrics.score, (2.0 / 3.0 + 1.0 / 2.0) / 3.0);
+        // Check forth update with none
+        let health = HealthCheckStatus::new(None);
+        let is_updated = snapshot.update_node(&node, health);
+        assert!(is_updated);
+        let node_with_metrics = snapshot.nodes_with_metrics.first().unwrap();
+        assert_eq!(node_with_metrics.score, (2.0 / 3.0 + 1.0 / 2.0) / 3.0);
+        assert!(!snapshot.has_nodes());
+        assert_eq!(snapshot.nodes_with_metrics.len(), 1);
+        assert_eq!(snapshot.existing_nodes.len(), 1);
+        assert!(snapshot.next_node().is_none());
+    }
+
+    #[test]
+    fn test_sync_node_scenarios() {
+        // Arrange
+        let window_size = 1;
+        let mut snapshot = LatencyRoutingSnapshot::new();
+        let node_1 = mock_node("api1.com");
+        // Sync with node_1
+        let nodes_changed = snapshot.sync_nodes(&[node_1.clone()]);
+        assert!(nodes_changed);
+        assert!(snapshot.nodes_with_metrics.is_empty());
+        assert_eq!(
+            snapshot.existing_nodes,
+            HashSet::from_iter(vec![node_1.clone()])
+        );
+        // Add node_1 to weighted_nodes manually
+        snapshot
+            .nodes_with_metrics
+            .push(ApiBoundaryNodeWithMetrics::new(node_1.clone(), window_size));
+        // Sync with node_1 again
+        let nodes_changed = snapshot.sync_nodes(&[node_1.clone()]);
+        assert!(!nodes_changed);
+        assert_eq!(
+            snapshot.existing_nodes,
+            HashSet::from_iter(vec![node_1.clone()])
+        );
+        assert_eq!(snapshot.nodes_with_metrics[0].node, node_1);
+        // Sync with node_2
+        let node_2 = mock_node("api2");
+        let nodes_changed = snapshot.sync_nodes(&[node_2.clone()]);
+        assert!(nodes_changed);
+        assert_eq!(
+            snapshot.existing_nodes,
+            HashSet::from_iter(vec![node_2.clone()])
+        );
+        // Make sure node_1 was removed from weighted_nodes too
+        assert!(snapshot.nodes_with_metrics.is_empty());
+        // Add node_2 to weighted_nodes manually
+        snapshot
+            .nodes_with_metrics
+            .push(ApiBoundaryNodeWithMetrics::new(node_2.clone(), window_size));
+        // Sync with [node_2, node_3]
+        let node_3 = mock_node("api3");
+        let nodes_changed = snapshot.sync_nodes(&[node_3.clone(), node_2.clone()]);
+        assert!(nodes_changed);
+        assert_eq!(
+            snapshot.existing_nodes,
+            HashSet::from_iter(vec![node_3.clone(), node_2.clone()])
+        );
+        assert_eq!(snapshot.nodes_with_metrics[0].node, node_2);
+        // Add node_3 to weighted_nodes manually
+        snapshot
+            .nodes_with_metrics
+            .push(ApiBoundaryNodeWithMetrics::new(node_3, window_size));
+        // Sync with []
+        let nodes_changed = snapshot.sync_nodes(&[]);
+        assert!(nodes_changed);
+        assert!(snapshot.existing_nodes.is_empty());
+        // Make sure all nodes were removed from the healthy_nodes
+        assert!(snapshot.nodes_with_metrics.is_empty());
+        // Sync with [] again
+        let nodes_changed = snapshot.sync_nodes(&[]);
+        assert!(!nodes_changed);
+        assert!(snapshot.existing_nodes.is_empty());
+        assert!(!snapshot.has_nodes());
+    }
+
+    #[test]
+    fn test_weighted_sample() {
+        let node = mock_node("api1");
+        // Case 1: empty array
+        let arr = &[];
+        let idx = weighted_sample(arr, 0.5);
+        assert_eq!(idx, None);
+        // Case 2: single element in array
+        let arr = &[(1.0, &node)];
+        let idx = weighted_sample(arr, 0.0);
+        assert_eq!(idx, Some(0));
+        let idx = weighted_sample(arr, 1.0);
+        assert_eq!(idx, Some(0));
+        // check bounds
+        let idx = weighted_sample(arr, -1.0);
+        assert_eq!(idx, None);
+        let idx = weighted_sample(arr, 1.1);
+        assert_eq!(idx, None);
+        // Case 3: two elements in array (second element has twice the weight of the first)
+        let arr = &[(1.0, &node), (2.0, &node)]; // // prefixed_sum = [1.0, 3.0]
+        let idx = weighted_sample(arr, 0.0); // 0.0 * 3.0 < 1.0
+        assert_eq!(idx, Some(0));
+        let idx = weighted_sample(arr, 0.33); // 0.33 * 3.0 < 1.0
+        assert_eq!(idx, Some(0)); // selection probability ~0.33
+        let idx = weighted_sample(arr, 0.35); // 0.35 * 3.0 > 1.0
+        assert_eq!(idx, Some(1)); // selection probability ~0.66
+        let idx = weighted_sample(arr, 1.0); // 1.0 * 3.0 > 1.0
+        assert_eq!(idx, Some(1));
+        // check bounds
+        let idx = weighted_sample(arr, -1.0);
+        assert_eq!(idx, None);
+        let idx = weighted_sample(arr, 1.1);
+        assert_eq!(idx, None);
+        // Case 4: four elements in array
+        let arr = &[(1.0, &node), (2.0, &node), (1.5, &node), (2.5, &node)]; // prefixed_sum = [1.0, 3.0, 4.5, 7.0]
+        let idx = weighted_sample(arr, 0.14); // 0.14 * 7 < 1.0
+        assert_eq!(idx, Some(0)); // probability ~0.14
+        let idx = weighted_sample(arr, 0.15); // 0.15 * 7 > 1.0
+        assert_eq!(idx, Some(1));
+        let idx = weighted_sample(arr, 0.42); // 0.42 * 7 < 3.0
+        assert_eq!(idx, Some(1)); // probability ~0.28
+        let idx = weighted_sample(arr, 0.43); // 0.43 * 7 > 3.0
+        assert_eq!(idx, Some(2));
+        let idx = weighted_sample(arr, 0.64); // 0.64 * 7 < 4.5
+        assert_eq!(idx, Some(2)); // probability ~0.22
+        let idx = weighted_sample(arr, 0.65); // 0.65 * 7 > 4.5
+        assert_eq!(idx, Some(3));
+        let idx = weighted_sample(arr, 0.99);
+        assert_eq!(idx, Some(3)); // probability ~0.35
+                                  // check bounds
+        let idx = weighted_sample(arr, -1.0);
+        assert_eq!(idx, None);
+        let idx = weighted_sample(arr, 1.1);
+        assert_eq!(idx, None);
+    }
+
+    #[test]
+    fn test_compute_score_with_penalty() {
+        let use_penalty = true;
+
+        // Test empty arrays
+        let weights: &[f64] = &[];
+        let weights_sum: f64 = weights.iter().sum();
+        let availabilities = VecDeque::new();
+        let latencies = VecDeque::new();
+
+        let score = compute_score(
+            weights,
+            weights_sum,
+            &availabilities,
+            &latencies,
+            use_penalty,
+        );
+        assert_eq!(score, 0.0);
+
+        // Test arrays with one element.
+        let weights: &[f64] = &[2.0, 1.0];
+        let weights_sum: f64 = weights.iter().sum();
+        let availabilities = vec![true].into();
+        let latencies = vec![2.0].into();
+        let score = compute_score(
+            weights,
+            weights_sum,
+            &availabilities,
+            &latencies,
+            use_penalty,
+        );
+        let score_l = (2.0 / 2.0) / 2.0;
+        let score_a = 1.0;
+        assert_eq!(score, score_l * score_a);
+
+        // Test arrays with two element.
+        let weights: &[f64] = &[2.0, 1.0];
+        let weights_sum: f64 = weights.iter().sum();
+        let availabilities = vec![true, false].into();
+        let latencies = vec![1.0, 2.0].into();
+        let score = compute_score(
+            weights,
+            weights_sum,
+            &availabilities,
+            &latencies,
+            use_penalty,
+        );
+        let score_l = (2.0 / 2.0 + 1.0 / 1.0) / weights_sum;
+        let score_a = (2.0 * 0.0 + 1.0 * 1.0) / weights_sum;
+        assert_eq!(score, score_l * score_a);
+
+        // Test arrays of different sizes.
+        let weights: &[f64] = &[3.0, 2.0, 1.0];
+        let weights_sum: f64 = weights.iter().sum();
+        let availabilities = vec![true, false, true].into();
+        let latencies = vec![1.0, 2.0].into();
+        let score = compute_score(
+            weights,
+            weights_sum,
+            &availabilities,
+            &latencies,
+            use_penalty,
+        );
+        let score_l = (3.0 / 2.0 + 2.0 / 1.0) / 5.0;
+        let score_a = (3.0 * 1.0 + 2.0 * 0.0 + 1.0 * 1.0) / weights_sum;
+        assert_eq!(score, score_l * score_a);
+    }
+
+    #[test]
+    #[ignore]
+    // This test is for manual runs to see the statistics for nodes selection probability.
+    fn test_stats_for_next_n_nodes() {
+        // Arrange
+        let mut snapshot = LatencyRoutingSnapshot::new();
+
+        let window_size = 1;
+
+        let node_1 = mock_node("api1");
+        let node_2 = mock_node("api2");
+        let node_3 = mock_node("api3");
+        let node_4 = mock_node("api4");
+
+        let mut node_1 = ApiBoundaryNodeWithMetrics::new(node_1, window_size);
+        let mut node_2 = ApiBoundaryNodeWithMetrics::new(node_2, window_size);
+        let mut node_3 = ApiBoundaryNodeWithMetrics::new(node_3, window_size);
+        let mut node_4 = ApiBoundaryNodeWithMetrics::new(node_4, window_size);
+
+        node_1.is_healthy = true;
+        node_2.is_healthy = true;
+        node_3.is_healthy = true;
+        node_4.is_healthy = false;
+
+        node_1.score = 16.0;
+        node_2.score = 8.0;
+        node_3.score = 4.0;
+        // even though the score is high, this node should never be selected as it is unhealthy
+        node_4.score = 30.0;
+
+        snapshot.nodes_with_metrics = vec![node_1, node_2, node_3, node_4];
+
+        let mut stats = HashMap::new();
+        let experiments = 30;
+        let select_nodes_count = 1;
+        for i in 0..experiments {
+            let nodes = snapshot.next_n_nodes(select_nodes_count);
+            println!("Experiment {i}: selected nodes {nodes:?}");
+            for item in nodes.into_iter() {
+                *stats.entry(item).or_insert(1) += 1;
+            }
+        }
+        for (node, count) in stats {
+            println!(
+                "ApiBoundaryNode {:?} is selected with probability {}",
+                node.domain,
+                count as f64 / experiments as f64
+            );
+        }
+    }
+}
diff --git a/ic-agent/src/agent/route_provider/dynamic_routing/snapshot/mod.rs b/ic-agent/src/agent/route_provider/dynamic_routing/snapshot/mod.rs
new file mode 100644
index 00000000..73df1537
--- /dev/null
+++ b/ic-agent/src/agent/route_provider/dynamic_routing/snapshot/mod.rs
@@ -0,0 +1,6 @@
+/// Snapshot of the routing table.
+pub mod latency_based_routing;
+/// Node implementation.
+pub mod round_robin_routing;
+/// Routing snapshot implementation.
+pub mod routing_snapshot;
diff --git a/ic-agent/src/agent/route_provider/dynamic_routing/snapshot/round_robin_routing.rs b/ic-agent/src/agent/route_provider/dynamic_routing/snapshot/round_robin_routing.rs
new file mode 100644
index 00000000..573c40c2
--- /dev/null
+++ b/ic-agent/src/agent/route_provider/dynamic_routing/snapshot/round_robin_routing.rs
@@ -0,0 +1,329 @@
+use std::{
+    collections::HashSet,
+    sync::{
+        atomic::{AtomicUsize, Ordering},
+        Arc,
+    },
+};
+
+use crate::agent::{
+    route_provider::dynamic_routing::{
+        health_check::HealthCheckStatus, snapshot::routing_snapshot::RoutingSnapshot,
+    },
+    ApiBoundaryNode,
+};
+
+/// Routing snapshot, which samples nodes in a round-robin fashion.
+#[derive(Default, Debug, Clone)]
+pub struct RoundRobinRoutingSnapshot {
+    current_idx: Arc<AtomicUsize>,
+    healthy_nodes: HashSet<ApiBoundaryNode>,
+    existing_nodes: HashSet<ApiBoundaryNode>,
+}
+
+impl RoundRobinRoutingSnapshot {
+    /// Creates a new instance of `RoundRobinRoutingSnapshot`.
+    pub fn new() -> Self {
+        Self {
+            current_idx: Arc::new(AtomicUsize::new(0)),
+            healthy_nodes: HashSet::new(),
+            existing_nodes: HashSet::new(),
+        }
+    }
+}
+
+impl RoutingSnapshot for RoundRobinRoutingSnapshot {
+    fn has_nodes(&self) -> bool {
+        !self.healthy_nodes.is_empty()
+    }
+
+    fn next_node(&self) -> Option<ApiBoundaryNode> {
+        if self.healthy_nodes.is_empty() {
+            return None;
+        }
+        let prev_idx = self.current_idx.fetch_add(1, Ordering::Relaxed);
+        self.healthy_nodes
+            .iter()
+            .nth(prev_idx % self.healthy_nodes.len())
+            .cloned()
+    }
+
+    fn next_n_nodes(&self, n: usize) -> Vec<ApiBoundaryNode> {
+        if n == 0 {
+            return Vec::new();
+        }
+
+        let healthy_nodes = Vec::from_iter(self.healthy_nodes.clone());
+        let healthy_count = healthy_nodes.len();
+
+        if n >= healthy_count {
+            return healthy_nodes.clone();
+        }
+
+        let idx = self.current_idx.fetch_add(n, Ordering::Relaxed) % healthy_count;
+        let mut nodes = Vec::with_capacity(n);
+
+        if healthy_count - idx >= n {
+            nodes.extend_from_slice(&healthy_nodes[idx..idx + n]);
+        } else {
+            nodes.extend_from_slice(&healthy_nodes[idx..]);
+            nodes.extend_from_slice(&healthy_nodes[..n - nodes.len()]);
+        }
+
+        nodes
+    }
+
+    fn sync_nodes(&mut self, nodes: &[ApiBoundaryNode]) -> bool {
+        let new_nodes = HashSet::from_iter(nodes.iter().cloned());
+        // Find nodes removed from topology.
+        let nodes_removed: Vec<_> = self
+            .existing_nodes
+            .difference(&new_nodes)
+            .cloned()
+            .collect();
+        let has_removed_nodes = !nodes_removed.is_empty();
+        // Find nodes added to topology.
+        let nodes_added: Vec<_> = new_nodes
+            .difference(&self.existing_nodes)
+            .cloned()
+            .collect();
+        let has_added_nodes = !nodes_added.is_empty();
+        // NOTE: newly added nodes will appear in the healthy_nodes later.
+        // This happens after the first node health check round and a consequent update_node() invocation.
+        self.existing_nodes.extend(nodes_added);
+        nodes_removed.iter().for_each(|node| {
+            self.existing_nodes.remove(node);
+            self.healthy_nodes.remove(node);
+        });
+
+        has_added_nodes || has_removed_nodes
+    }
+
+    fn update_node(&mut self, node: &ApiBoundaryNode, health: HealthCheckStatus) -> bool {
+        if !self.existing_nodes.contains(node) {
+            return false;
+        }
+        if health.is_healthy() {
+            self.healthy_nodes.insert(node.clone())
+        } else {
+            self.healthy_nodes.remove(node)
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::collections::HashMap;
+    use std::time::Duration;
+    use std::{collections::HashSet, sync::atomic::Ordering};
+
+    use crate::agent::route_provider::dynamic_routing::test_utils::mock_node;
+    use crate::agent::route_provider::dynamic_routing::{
+        health_check::HealthCheckStatus,
+        snapshot::{
+            round_robin_routing::RoundRobinRoutingSnapshot, routing_snapshot::RoutingSnapshot,
+        },
+    };
+
+    #[test]
+    fn test_snapshot_init() {
+        // Arrange
+        let snapshot = RoundRobinRoutingSnapshot::new();
+        // Assert
+        assert!(snapshot.healthy_nodes.is_empty());
+        assert!(snapshot.existing_nodes.is_empty());
+        assert!(!snapshot.has_nodes());
+        assert_eq!(snapshot.current_idx.load(Ordering::SeqCst), 0);
+        assert!(snapshot.next_node().is_none());
+    }
+
+    #[test]
+    fn test_update_of_non_existing_node_always_returns_false() {
+        // Arrange
+        let mut snapshot = RoundRobinRoutingSnapshot::new();
+        // This node is not present in existing_nodes
+        let node = mock_node("api1");
+        let healthy = HealthCheckStatus::new(Some(Duration::from_secs(1)));
+        let unhealthy = HealthCheckStatus::new(None);
+        // Act 1
+        let is_updated = snapshot.update_node(&node, healthy);
+        // Assert
+        assert!(!is_updated);
+        assert!(snapshot.existing_nodes.is_empty());
+        assert!(snapshot.next_node().is_none());
+        // Act 2
+        let is_updated = snapshot.update_node(&node, unhealthy);
+        // Assert
+        assert!(!is_updated);
+        assert!(snapshot.existing_nodes.is_empty());
+        assert!(snapshot.next_node().is_none());
+    }
+
+    #[test]
+    fn test_update_of_existing_unhealthy_node_with_healthy_node_returns_true() {
+        // Arrange
+        let mut snapshot = RoundRobinRoutingSnapshot::new();
+        let node = mock_node("api1");
+        // node is present in existing_nodes, but not in healthy_nodes
+        snapshot.existing_nodes.insert(node.clone());
+        let health = HealthCheckStatus::new(Some(Duration::from_secs(1)));
+        // Act
+        let is_updated = snapshot.update_node(&node, health);
+        assert!(is_updated);
+        assert!(snapshot.has_nodes());
+        assert_eq!(snapshot.next_node().unwrap(), node);
+        assert_eq!(snapshot.current_idx.load(Ordering::SeqCst), 1);
+    }
+
+    #[test]
+    fn test_update_of_existing_healthy_node_with_unhealthy_node_returns_true() {
+        // Arrange
+        let mut snapshot = RoundRobinRoutingSnapshot::new();
+        let node = mock_node("api1");
+        snapshot.existing_nodes.insert(node.clone());
+        snapshot.healthy_nodes.insert(node.clone());
+        let unhealthy = HealthCheckStatus::new(None);
+        // Act
+        let is_updated = snapshot.update_node(&node, unhealthy);
+        assert!(is_updated);
+        assert!(!snapshot.has_nodes());
+        assert!(snapshot.next_node().is_none());
+    }
+
+    #[test]
+    fn test_sync_node_scenarios() {
+        // Arrange
+        let mut snapshot = RoundRobinRoutingSnapshot::new();
+        let node_1 = mock_node("api1");
+        // Sync with node_1
+        let nodes_changed = snapshot.sync_nodes(&[node_1.clone()]);
+        assert!(nodes_changed);
+        assert!(snapshot.healthy_nodes.is_empty());
+        assert_eq!(
+            snapshot.existing_nodes,
+            HashSet::from_iter(vec![node_1.clone()])
+        );
+        // Add node_1 to healthy_nodes manually
+        snapshot.healthy_nodes.insert(node_1.clone());
+        // Sync with node_1 again
+        let nodes_changed = snapshot.sync_nodes(&[node_1.clone()]);
+        assert!(!nodes_changed);
+        assert_eq!(
+            snapshot.existing_nodes,
+            HashSet::from_iter(vec![node_1.clone()])
+        );
+        assert_eq!(snapshot.healthy_nodes, HashSet::from_iter(vec![node_1]));
+        // Sync with node_2
+        let node_2 = mock_node("api2");
+        let nodes_changed = snapshot.sync_nodes(&[node_2.clone()]);
+        assert!(nodes_changed);
+        assert_eq!(
+            snapshot.existing_nodes,
+            HashSet::from_iter(vec![node_2.clone()])
+        );
+        // Make sure node_1 was removed from healthy nodes
+        assert!(snapshot.healthy_nodes.is_empty());
+        // Add node_2 to healthy_nodes manually
+        snapshot.healthy_nodes.insert(node_2.clone());
+        // Sync with [node_2, node_3]
+        let node_3 = mock_node("api3");
+        let nodes_changed = snapshot.sync_nodes(&[node_3.clone(), node_2.clone()]);
+        assert!(nodes_changed);
+        assert_eq!(
+            snapshot.existing_nodes,
+            HashSet::from_iter(vec![node_3.clone(), node_2.clone()])
+        );
+        assert_eq!(snapshot.healthy_nodes, HashSet::from_iter(vec![node_2]));
+        snapshot.healthy_nodes.insert(node_3);
+        // Sync with []
+        let nodes_changed = snapshot.sync_nodes(&[]);
+        assert!(nodes_changed);
+        assert!(snapshot.existing_nodes.is_empty());
+        // Make sure all nodes were removed from the healthy_nodes
+        assert!(snapshot.healthy_nodes.is_empty());
+        // Sync with [] again
+        let nodes_changed = snapshot.sync_nodes(&[]);
+        assert!(!nodes_changed);
+        assert!(snapshot.existing_nodes.is_empty());
+    }
+
+    #[test]
+    fn test_next_node() {
+        // Arrange
+        let mut snapshot = RoundRobinRoutingSnapshot::new();
+        let node_1 = mock_node("api1");
+        let node_2 = mock_node("api2");
+        let node_3 = mock_node("api3");
+        let nodes = vec![node_1, node_2, node_3];
+        snapshot.existing_nodes.extend(nodes.clone());
+        snapshot.healthy_nodes.extend(nodes.clone());
+        // Act
+        let n = 6;
+        let mut count_map = HashMap::new();
+        for _ in 0..n {
+            let node = snapshot.next_node().unwrap();
+            count_map.entry(node).and_modify(|v| *v += 1).or_insert(1);
+        }
+        // Assert each node was returned 2 times
+        let k = 2;
+        assert_eq!(
+            count_map.len(),
+            nodes.len(),
+            "The number of unique elements is not {}",
+            nodes.len()
+        );
+        for (item, &count) in &count_map {
+            assert_eq!(
+                count, k,
+                "Element {:?} does not appear exactly {} times",
+                item, k
+            );
+        }
+    }
+
+    #[test]
+    fn test_n_nodes() {
+        // Arrange
+        let mut snapshot = RoundRobinRoutingSnapshot::new();
+        let node_1 = mock_node("api1");
+        let node_2 = mock_node("api2");
+        let node_3 = mock_node("api3");
+        let node_4 = mock_node("api4");
+        let node_5 = mock_node("api5");
+        let nodes = vec![
+            node_1.clone(),
+            node_2.clone(),
+            node_3.clone(),
+            node_4.clone(),
+            node_5.clone(),
+        ];
+        snapshot.healthy_nodes.extend(nodes.clone());
+        // First call
+        let mut n_nodes: Vec<_> = snapshot.next_n_nodes(3);
+        // Second call
+        n_nodes.extend(snapshot.next_n_nodes(3));
+        // Third call
+        n_nodes.extend(snapshot.next_n_nodes(4));
+        // Fourth call
+        n_nodes.extend(snapshot.next_n_nodes(5));
+        // Assert each node was returned 3 times
+        let k = 3;
+        let mut count_map = HashMap::new();
+        for item in n_nodes.iter() {
+            count_map.entry(item).and_modify(|v| *v += 1).or_insert(1);
+        }
+        assert_eq!(
+            count_map.len(),
+            nodes.len(),
+            "The number of unique elements is not {}",
+            nodes.len()
+        );
+        for (item, &count) in &count_map {
+            assert_eq!(
+                count, k,
+                "Element {:?} does not appear exactly {} times",
+                item, k
+            );
+        }
+    }
+}
diff --git a/ic-agent/src/agent/route_provider/dynamic_routing/snapshot/routing_snapshot.rs b/ic-agent/src/agent/route_provider/dynamic_routing/snapshot/routing_snapshot.rs
new file mode 100644
index 00000000..6bd9994b
--- /dev/null
+++ b/ic-agent/src/agent/route_provider/dynamic_routing/snapshot/routing_snapshot.rs
@@ -0,0 +1,19 @@
+use std::fmt::Debug;
+
+use crate::agent::{
+    route_provider::dynamic_routing::health_check::HealthCheckStatus, ApiBoundaryNode,
+};
+
+/// A trait for interacting with the snapshot of nodes (routing table).
+pub trait RoutingSnapshot: Send + Sync + Clone + Debug {
+    /// Returns `true` if the snapshot has nodes.
+    fn has_nodes(&self) -> bool;
+    /// Get next node from the snapshot.
+    fn next_node(&self) -> Option<ApiBoundaryNode>;
+    /// Get up to n different nodes from the snapshot.
+    fn next_n_nodes(&self, n: usize) -> Vec<ApiBoundaryNode>;
+    /// Syncs the nodes in the snapshot with the provided list of nodes, returning `true` if the snapshot was updated.
+    fn sync_nodes(&mut self, nodes: &[ApiBoundaryNode]) -> bool;
+    /// Updates the health status of a specific node, returning `true` if the node was found and updated.
+    fn update_node(&mut self, node: &ApiBoundaryNode, health: HealthCheckStatus) -> bool;
+}
diff --git a/ic-agent/src/agent/route_provider/dynamic_routing/test_utils.rs b/ic-agent/src/agent/route_provider/dynamic_routing/test_utils.rs
new file mode 100644
index 00000000..6dd45aa0
--- /dev/null
+++ b/ic-agent/src/agent/route_provider/dynamic_routing/test_utils.rs
@@ -0,0 +1,241 @@
+use std::collections::HashMap;
+use std::mem;
+use std::sync::{Mutex, OnceLock};
+use std::{fmt::Debug, hash::Hash, sync::Arc};
+
+use ecdsa::signature::Signer;
+use ic_certification::{empty, fork, label, leaf, Certificate, HashTree};
+use indexmap::IndexMap;
+use k256::ecdsa::{Signature, SigningKey};
+use mockito::{Mock, Server, ServerOpts};
+use rand::thread_rng;
+
+use crate::agent::route_provider::RouteProvider;
+use crate::agent::ApiBoundaryNode;
+use crate::identity::Secp256k1Identity;
+use crate::{Agent, Identity};
+
+use super::dynamic_route_provider::MAINNET_ROOT_SUBNET_ID;
+
+pub(super) fn route_n_times(n: usize, f: Arc<impl RouteProvider + ?Sized>) -> Vec<String> {
+    (0..n)
+        .map(|_| f.route().unwrap().domain().unwrap().to_string())
+        .collect()
+}
+
+pub(super) fn assert_routed_domains<T>(
+    actual: Vec<T>,
+    expected: Vec<T>,
+    expected_repetitions: usize,
+) where
+    T: AsRef<str> + Eq + Hash + Debug + Ord,
+{
+    fn build_count_map<T>(items: &[T]) -> HashMap<&T, usize>
+    where
+        T: Eq + Hash,
+    {
+        items.iter().fold(HashMap::new(), |mut map, item| {
+            *map.entry(item).or_insert(0) += 1;
+            map
+        })
+    }
+    let count_actual = build_count_map(&actual);
+    let count_expected = build_count_map(&expected);
+
+    let mut keys_actual = count_actual.keys().collect::<Vec<_>>();
+    keys_actual.sort();
+    let mut keys_expected = count_expected.keys().collect::<Vec<_>>();
+    keys_expected.sort();
+    // Assert all routed domains are present.
+    assert_eq!(keys_actual, keys_expected);
+
+    // Assert the expected repetition count of each routed domain.
+    let actual_repetitions = count_actual.values().collect::<Vec<_>>();
+    assert!(actual_repetitions
+        .iter()
+        .all(|&x| x == &expected_repetitions));
+}
+
+pub fn mock_node(name: &str) -> ApiBoundaryNode {
+    ApiBoundaryNode {
+        domain: format!("{name}.localhost"),
+        ipv4_address: Some("127.0.0.1".to_string()),
+        ipv6_address: Some("::1".to_string()),
+    }
+}
+
+static MOCK_SERVER: OnceLock<Mutex<Server>> = OnceLock::new();
+
+fn get_server() -> &'static Mutex<Server> {
+    MOCK_SERVER.get_or_init(|| {
+        Mutex::new(Server::new_with_opts(ServerOpts {
+            port: 7357,
+            host: "::1",
+            ..<_>::default()
+        }))
+    })
+}
+
+pub fn mock_topology(nodes: Vec<(ApiBoundaryNode, bool)>, root_domain: &str) -> MockTopology {
+    let mut mocks = IndexMap::new();
+    let root_key = SigningKey::random(&mut thread_rng());
+    for (node, healthy) in nodes {
+        let mock = node_mock(&node, healthy);
+        mocks.insert(node, mock);
+    }
+    let root_node = mock_node(root_domain);
+    let root_mock = root_node_mock(&mocks, root_domain, root_key.clone());
+    let root_health_mock = get_server()
+        .lock()
+        .unwrap()
+        .mock("GET", "/health")
+        .match_header("host", root_domain)
+        .with_status(204)
+        .create();
+    MockTopology {
+        nodes: mocks,
+        root_node,
+        root_health_mock,
+        root_mock,
+    }
+}
+
+// pub fn default_test_key() -> SigningKey {
+//     SigningKey::from_bytes(hex::decode("04 20 6B 9C A0 8A 33 7A 61 F1 E0 0B B2 6D F7 00 A2 01 4A 6D D1 0E FA D9 BB B0 24 7E D4 0D AD BE 58 EC").unwrap()[..].into()).unwrap()
+// }
+
+pub struct MockTopology {
+    nodes: IndexMap<ApiBoundaryNode, NodeMock>,
+    root_node: ApiBoundaryNode,
+    root_mock: NodeMock,
+    root_health_mock: Mock,
+}
+
+struct NodeMock {
+    healthy: bool,
+    mock: Mock,
+    key: SigningKey,
+}
+
+impl MockTopology {
+    pub fn agent(&self) -> Agent {
+        Agent::builder()
+            .with_url(self.root_node.to_routing_url())
+            .with_preset_root_key(
+                self.root_mock
+                    .key
+                    .verifying_key()
+                    .to_sec1_bytes()
+                    .into_vec(),
+            )
+            .build()
+            .unwrap()
+    }
+    pub fn add_nodes(&mut self, nodes: impl IntoIterator<Item = (ApiBoundaryNode, bool)>) {
+        for (node, healthy) in nodes {
+            let node_mock = node_mock(&node, healthy);
+            let old_mock = self.nodes.insert(node, node_mock);
+            if let Some(old_mock) = old_mock {
+                old_mock.mock.remove();
+            }
+        }
+        self.update_root_mock();
+    }
+    pub fn remove_nodes<'a>(&mut self, nodes: impl IntoIterator<Item = &'a ApiBoundaryNode>) {
+        for node in nodes {
+            if let Some(mock) = self.nodes.swap_remove(node) {
+                mock.mock.remove();
+            }
+        }
+        self.update_root_mock();
+    }
+    pub fn set_node_health(&mut self, node: &ApiBoundaryNode, healthy: bool) {
+        if let Some(mock) = self.nodes.get_mut(node) {
+            mock.healthy = healthy;
+            let old_mock = mem::replace(
+                &mut mock.mock,
+                get_server()
+                    .lock()
+                    .unwrap()
+                    .mock("GET", "/health")
+                    .match_header("host", &*node.domain)
+                    .with_status(if healthy { 204 } else { 418 })
+                    .create(),
+            );
+            old_mock.remove();
+        }
+    }
+    pub fn update_root_mock(&mut self) {
+        let root_key = self.root_mock.key.clone();
+        let old_mock = mem::replace(
+            &mut self.root_mock,
+            root_node_mock(&self.nodes, &self.root_node.domain, root_key),
+        );
+        old_mock.mock.remove();
+    }
+}
+
+fn node_mock(node: &ApiBoundaryNode, healthy: bool) -> NodeMock {
+    let nk = SigningKey::random(&mut thread_rng());
+    NodeMock {
+        healthy,
+        key: nk,
+        mock: get_server()
+            .lock()
+            .unwrap()
+            .mock("GET", "/health")
+            .match_header("host", &*node.domain)
+            .with_status(if healthy { 204 } else { 418 })
+            .create(),
+    }
+}
+
+fn root_node_mock<'a>(
+    nodes: impl IntoIterator<Item = (&'a ApiBoundaryNode, &'a NodeMock)>,
+    root_domain: &str,
+    root_key: SigningKey,
+) -> NodeMock {
+    let mut tree = empty();
+    for (node, mock) in nodes {
+        let id = Secp256k1Identity::from_private_key(mock.key.clone().into());
+        tree = fork(
+            tree,
+            label(
+                id.sender().unwrap().to_text(),
+                fork(
+                    fork(
+                        label("domain", leaf(&node.domain[..])),
+                        node.ipv4_address
+                            .as_deref()
+                            .map_or_else(empty, |a| label("ipv4_address", leaf(&a[..]))),
+                    ),
+                    node.ipv6_address
+                        .as_deref()
+                        .map_or_else(empty, |a| label("ipv6_address", leaf(&a[..]))),
+                ),
+            ),
+        );
+    }
+    let final_tree = label("api_boundary_nodes", tree);
+    let signature: Signature = root_key.sign(&final_tree.digest());
+    let certificate = Certificate {
+        delegation: None,
+        tree: final_tree,
+        signature: signature.to_bytes().to_vec(),
+    };
+    let mock = get_server()
+        .lock()
+        .unwrap()
+        .mock(
+            "POST",
+            &*format!("/api/v2/subnet/{}/read_state", MAINNET_ROOT_SUBNET_ID),
+        )
+        .match_header("host", &*format!("{root_domain}.localhost"))
+        .with_body(serde_cbor::to_vec(&certificate).unwrap())
+        .create();
+    NodeMock {
+        healthy: true,
+        mock,
+        key: root_key,
+    }
+}
diff --git a/ic-agent/src/agent/route_provider/dynamic_routing/type_aliases.rs b/ic-agent/src/agent/route_provider/dynamic_routing/type_aliases.rs
new file mode 100644
index 00000000..f4d76fa3
--- /dev/null
+++ b/ic-agent/src/agent/route_provider/dynamic_routing/type_aliases.rs
@@ -0,0 +1,17 @@
+use arc_swap::ArcSwap;
+use std::sync::Arc;
+
+/// A type alias for the sender end of a watch channel.
+pub(super) type SenderWatch<T> = async_watch::Sender<Option<T>>;
+
+/// A type alias for the receiver end of a watch channel.
+pub(super) type ReceiverWatch<T> = async_watch::Receiver<Option<T>>;
+
+/// A type alias for the sender end of a multi-producer, single-consumer channel.
+pub(super) type SenderMpsc<T> = async_channel::Sender<T>;
+
+/// A type alias for the receiver end of a multi-producer, single-consumer channel.
+pub(super) type ReceiverMpsc<T> = async_channel::Receiver<T>;
+
+/// A type alias for an atomic swap operation on a shared value.
+pub(super) type AtomicSwap<T> = Arc<ArcSwap<T>>;
diff --git a/ic-agent/src/agent/status.rs b/ic-agent/src/agent/status.rs
index 60f78203..bd601abf 100644
--- a/ic-agent/src/agent/status.rs
+++ b/ic-agent/src/agent/status.rs
@@ -87,7 +87,7 @@ fn cbor_value_to_value(value: &serde_cbor::Value) -> Result<Value, ()> {
         )),
         serde_cbor::Value::Map(m) => {
             let mut map = BTreeMap::new();
-            for (key, value) in m.iter() {
+            for (key, value) in m {
                 let k = match key {
                     serde_cbor::Value::Text(t) => t.to_owned(),
                     serde_cbor::Value::Integer(i) => i.to_string(),
diff --git a/ic-agent/src/identity/basic.rs b/ic-agent/src/identity/basic.rs
index d88b9165..8cf2d6bd 100644
--- a/ic-agent/src/identity/basic.rs
+++ b/ic-agent/src/identity/basic.rs
@@ -3,7 +3,7 @@ use crate::{agent::EnvelopeContent, export::Principal, Identity, Signature};
 #[cfg(feature = "pem")]
 use crate::identity::error::PemError;
 
-use ring::signature::{Ed25519KeyPair, KeyPair};
+use ed25519_consensus::SigningKey;
 use simple_asn1::{
     oid, to_der,
     ASN1Block::{BitString, ObjectIdentifier, Sequence},
@@ -13,9 +13,11 @@ use std::fmt;
 
 use super::Delegation;
 
-/// A Basic Identity which sign using an ED25519 key pair.
+/// A cryptographic identity which signs using an Ed25519 key pair.
+///
+/// The caller will be represented via [`Principal::self_authenticating`], which contains the SHA-224 hash of the public key.
 pub struct BasicIdentity {
-    key_pair: Ed25519KeyPair,
+    private_key: KeyCompat,
     der_encoded_public_key: Vec<u8>,
 }
 
@@ -28,35 +30,92 @@ impl fmt::Debug for BasicIdentity {
 }
 
 impl BasicIdentity {
-    /// Create a BasicIdentity from reading a PEM file at the path.
+    /// Create a `BasicIdentity` from reading a PEM file at the path.
     #[cfg(feature = "pem")]
     pub fn from_pem_file<P: AsRef<std::path::Path>>(file_path: P) -> Result<Self, PemError> {
         Self::from_pem(std::fs::File::open(file_path)?)
     }
 
-    /// Create a BasicIdentity from reading a PEM File from a Reader.
+    /// Create a `BasicIdentity` from reading a PEM File from a Reader.
     #[cfg(feature = "pem")]
     pub fn from_pem<R: std::io::Read>(pem_reader: R) -> Result<Self, PemError> {
-        let bytes: Vec<u8> = pem_reader
-            .bytes()
-            .collect::<Result<Vec<u8>, std::io::Error>>()?;
+        use der::{asn1::OctetString, Decode, ErrorKind, SliceReader, Tag, TagNumber};
+        use pkcs8::PrivateKeyInfo;
+
+        let bytes: Vec<u8> = pem_reader.bytes().collect::<Result<_, _>>()?;
+        let pem = pem::parse(bytes)?;
+        let pki_res = PrivateKeyInfo::decode(&mut SliceReader::new(pem.contents())?);
+        let mut truncated;
+        let pki = match pki_res {
+            Ok(pki) => pki,
+            Err(e) => {
+                if e.kind()
+                    == (ErrorKind::Noncanonical {
+                        tag: Tag::ContextSpecific {
+                            constructed: true,
+                            number: TagNumber::new(1),
+                        },
+                    })
+                {
+                    // Very old versions of dfx generated nonconforming containers. They can only be imported if the extra data is removed.
+                    truncated = pem.into_contents();
+                    if truncated[48..52] != *b"\xA1\x23\x03\x21" {
+                        return Err(e.into());
+                    }
+                    // hatchet surgery
+                    truncated.truncate(48);
+                    truncated[1] = 46;
+                    truncated[4] = 0;
+                    PrivateKeyInfo::decode(&mut SliceReader::new(&truncated)?).map_err(|_| e)?
+                } else {
+                    return Err(e.into());
+                }
+            }
+        };
+        let decoded_key = OctetString::from_der(pki.private_key)?; // ed25519 uses an octet string within another octet string
+        let private_key = SigningKey::try_from(decoded_key.as_bytes())?;
+        Ok(BasicIdentity::from_signing_key(private_key))
+    }
+
+    /// Create a `BasicIdentity` from a `SigningKey` from `ed25519-consensus`.
+    pub fn from_signing_key(key: SigningKey) -> Self {
+        let public_key = key.verification_key();
+        let der_encoded_public_key = der_encode_public_key(public_key.as_bytes().to_vec());
 
-        Ok(BasicIdentity::from_key_pair(Ed25519KeyPair::from_pkcs8(
-            pem::parse(bytes)?.contents(),
-        )?))
+        Self {
+            private_key: KeyCompat::Standard(key),
+            der_encoded_public_key,
+        }
     }
 
-    /// Create a BasicIdentity from a KeyPair from the ring crate.
-    pub fn from_key_pair(key_pair: Ed25519KeyPair) -> Self {
+    /// Create a `BasicIdentity` from an `Ed25519KeyPair` from `ring`.
+    #[cfg(feature = "ring")]
+    pub fn from_key_pair(key_pair: ring::signature::Ed25519KeyPair) -> Self {
+        use ring::signature::KeyPair;
         let der_encoded_public_key = der_encode_public_key(key_pair.public_key().as_ref().to_vec());
-
         Self {
-            key_pair,
+            private_key: KeyCompat::Ring(key_pair),
             der_encoded_public_key,
         }
     }
 }
 
+enum KeyCompat {
+    Standard(SigningKey),
+    #[cfg(feature = "ring")]
+    Ring(ring::signature::Ed25519KeyPair),
+}
+
+impl KeyCompat {
+    fn sign(&self, payload: &[u8]) -> Vec<u8> {
+        match self {
+            Self::Standard(k) => k.sign(payload).to_bytes().to_vec(),
+            #[cfg(feature = "ring")]
+            Self::Ring(k) => k.sign(payload).as_ref().to_vec(),
+        }
+    }
+}
+
 impl Identity for BasicIdentity {
     fn sender(&self) -> Result<Principal, String> {
         Ok(Principal::self_authenticating(&self.der_encoded_public_key))
@@ -75,9 +134,9 @@ impl Identity for BasicIdentity {
     }
 
     fn sign_arbitrary(&self, content: &[u8]) -> Result<Signature, String> {
-        let signature = self.key_pair.sign(content);
+        let signature = self.private_key.sign(content);
         Ok(Signature {
-            signature: Some(signature.as_ref().to_vec()),
+            signature: Some(signature),
             public_key: self.public_key(),
             delegations: None,
         })
diff --git a/ic-agent/src/identity/delegated.rs b/ic-agent/src/identity/delegated.rs
index 623b03c8..08b362ec 100644
--- a/ic-agent/src/identity/delegated.rs
+++ b/ic-agent/src/identity/delegated.rs
@@ -1,8 +1,14 @@
 use candid::Principal;
+use der::{Decode, SliceReader};
+use ecdsa::signature::Verifier;
+use k256::Secp256k1;
+use p256::NistP256;
+use pkcs8::{spki::SubjectPublicKeyInfoRef, AssociatedOid, ObjectIdentifier};
+use sec1::{EcParameters, EncodedPoint};
 
 use crate::{agent::EnvelopeContent, Signature};
 
-use super::{Delegation, Identity, SignedDelegation};
+use super::{error::DelegationError, Delegation, Identity, SignedDelegation};
 
 /// An identity that has been delegated the authority to authenticate as a different principal.
 pub struct DelegatedIdentity {
@@ -14,12 +20,97 @@ pub struct DelegatedIdentity {
 impl DelegatedIdentity {
     /// Creates a delegated identity that signs using `to`, for the principal corresponding to the public key `from_key`.
     ///
-    /// `chain` must be a list of delegations connecting `from_key` to `to.public_key()`, and in that order.
-    pub fn new(from_key: Vec<u8>, to: Box<dyn Identity>, chain: Vec<SignedDelegation>) -> Self {
+    /// `chain` must be a list of delegations connecting `from_key` to `to.public_key()`, and in that order;
+    /// otherwise, this function will return an error.
+    pub fn new(
+        from_key: Vec<u8>,
+        to: Box<dyn Identity>,
+        chain: Vec<SignedDelegation>,
+    ) -> Result<Self, DelegationError> {
+        let mut last_verified = &from_key;
+        for delegation in &chain {
+            let spki = SubjectPublicKeyInfoRef::decode(
+                &mut SliceReader::new(&last_verified[..]).map_err(|_| DelegationError::Parse)?,
+            )
+            .map_err(|_| DelegationError::Parse)?;
+            if spki.algorithm.oid == elliptic_curve::ALGORITHM_OID {
+                let Some(params) = spki.algorithm.parameters else {
+                    return Err(DelegationError::UnknownAlgorithm);
+                };
+                let params = params
+                    .decode_as::<EcParameters>()
+                    .map_err(|_| DelegationError::Parse)?;
+                let curve = params
+                    .named_curve()
+                    .ok_or(DelegationError::UnknownAlgorithm)?;
+                if curve == Secp256k1::OID {
+                    let pt = EncodedPoint::from_bytes(spki.subject_public_key.raw_bytes())
+                        .map_err(|_| DelegationError::Parse)?;
+                    let vk = k256::ecdsa::VerifyingKey::from_encoded_point(&pt)
+                        .map_err(|_| DelegationError::Parse)?;
+                    let sig = k256::ecdsa::Signature::try_from(&delegation.signature[..])
+                        .map_err(|_| DelegationError::Parse)?;
+                    vk.verify(&delegation.delegation.signable(), &sig)
+                        .map_err(|_| DelegationError::BrokenChain {
+                            from: last_verified.clone(),
+                            to: Some(delegation.delegation.clone()),
+                        })?;
+                } else if curve == NistP256::OID {
+                    let pt = EncodedPoint::from_bytes(spki.subject_public_key.raw_bytes())
+                        .map_err(|_| DelegationError::Parse)?;
+                    let vk = p256::ecdsa::VerifyingKey::from_encoded_point(&pt)
+                        .map_err(|_| DelegationError::Parse)?;
+                    let sig = p256::ecdsa::Signature::try_from(&delegation.signature[..])
+                        .map_err(|_| DelegationError::Parse)?;
+                    vk.verify(&delegation.delegation.signable(), &sig)
+                        .map_err(|_| DelegationError::BrokenChain {
+                            from: last_verified.clone(),
+                            to: Some(delegation.delegation.clone()),
+                        })?;
+                } else {
+                    return Err(DelegationError::UnknownAlgorithm);
+                }
+            } else if spki.algorithm.oid == ObjectIdentifier::new_unwrap("1.3.101.112") {
+                let vk = ed25519_consensus::VerificationKey::try_from(
+                    spki.subject_public_key.raw_bytes(),
+                )
+                .map_err(|_| DelegationError::Parse)?;
+                let sig = ed25519_consensus::Signature::try_from(&delegation.signature[..])
+                    .map_err(|_| DelegationError::Parse)?;
+                vk.verify(&sig, &delegation.delegation.signable())
+                    .map_err(|_| DelegationError::BrokenChain {
+                        from: last_verified.clone(),
+                        to: Some(delegation.delegation.clone()),
+                    })?;
+            } else {
+                return Err(DelegationError::UnknownAlgorithm);
+            }
+            last_verified = &delegation.delegation.pubkey;
+        }
+        let delegated_principal = Principal::self_authenticating(last_verified);
+        if delegated_principal != to.sender().map_err(DelegationError::IdentityError)? {
+            return Err(DelegationError::BrokenChain {
+                from: last_verified.clone(),
+                to: None,
+            });
+        }
+
+        Ok(Self::new_unchecked(from_key, to, chain))
+    }
+
+    /// Creates a delegated identity that signs using `to`, for the principal corresponding to the public key `from_key`.
+    ///
+    /// `chain` must be a list of delegations connecting `from_key` to `to.public_key()`, and in that order;
+    /// otherwise, the replica will reject this delegation when used as an identity.
+    pub fn new_unchecked(
+        from_key: Vec<u8>,
+        to: Box<dyn Identity>,
+        chain: Vec<SignedDelegation>,
+    ) -> Self {
         Self {
             to,
-            from_key,
             chain,
+            from_key,
         }
     }
 
diff --git a/ic-agent/src/identity/error.rs b/ic-agent/src/identity/error.rs
index 592d1e5c..0b540412 100644
--- a/ic-agent/src/identity/error.rs
+++ b/ic-agent/src/identity/error.rs
@@ -1,6 +1,8 @@
+use ic_transport_types::Delegation;
 use thiserror::Error;
 
 /// An error happened while reading a PEM file.
+#[cfg(feature = "pem")]
 #[derive(Error, Debug)]
 pub enum PemError {
     /// An error occurred with disk I/O.
@@ -16,11 +18,38 @@ pub enum PemError {
     #[error("An error occurred while reading the file: {0}")]
     PemError(#[from] pem::PemError),
 
-    /// The key was rejected by Ring.
-    #[error("A key was rejected by Ring: {0}")]
-    KeyRejected(#[from] ring::error::KeyRejected),
+    /// An error occurred while reading the file in DER format.
+    #[cfg(feature = "pem")]
+    #[error("An error occurred while reading the file: {0}")]
+    DerError(#[from] der::Error),
+
+    /// The key was rejected by ed25519-consensus.
+    #[error("A key was rejected by ed25519-consensus: {0}")]
+    KeyRejected(#[from] ed25519_consensus::Error),
 
     /// The key was rejected by k256.
     #[error("A key was rejected by k256: {0}")]
     ErrorStack(#[from] k256::pkcs8::Error),
 }
+
+/// An error occurred constructing a [`DelegatedIdentity`](super::delegated::DelegatedIdentity).
+#[derive(Error, Debug)]
+pub enum DelegationError {
+    /// Parsing error in delegation bytes.
+    #[error("A delegation could not be parsed")]
+    Parse,
+    /// A key in the chain did not match the signature of the next chain link.
+    #[error("A link was missing in the delegation chain")]
+    BrokenChain {
+        /// The key that should have matched the next delegation
+        from: Vec<u8>,
+        /// The delegation that didn't match, or `None` if the `Identity` didn't match
+        to: Option<Delegation>,
+    },
+    /// A key with an unknown algorithm was used. The IC supports Ed25519, secp256k1, and prime256v1, and in ECDSA the curve must be specified.
+    #[error("The delegation chain contained a key with an unknown algorithm")]
+    UnknownAlgorithm,
+    /// One of `Identity`'s functions returned an error.
+    #[error("A delegated-to identity encountered an error: {0}")]
+    IdentityError(String),
+}
diff --git a/ic-agent/src/identity/mod.rs b/ic-agent/src/identity/mod.rs
index ed2dd4e3..45c9a301 100644
--- a/ic-agent/src/identity/mod.rs
+++ b/ic-agent/src/identity/mod.rs
@@ -6,12 +6,10 @@ use crate::{agent::EnvelopeContent, export::Principal};
 pub(crate) mod anonymous;
 pub(crate) mod basic;
 pub(crate) mod delegated;
+pub(crate) mod error;
 pub(crate) mod prime256v1;
 pub(crate) mod secp256k1;
 
-#[cfg(feature = "pem")]
-pub(crate) mod error;
-
 #[doc(inline)]
 pub use anonymous::AnonymousIdentity;
 #[doc(inline)]
@@ -19,6 +17,8 @@ pub use basic::BasicIdentity;
 #[doc(inline)]
 pub use delegated::DelegatedIdentity;
 #[doc(inline)]
+pub use error::DelegationError;
+#[doc(inline)]
 pub use ic_transport_types::{Delegation, SignedDelegation};
 #[doc(inline)]
 pub use prime256v1::Prime256v1Identity;
@@ -26,6 +26,7 @@ pub use prime256v1::Prime256v1Identity;
 pub use secp256k1::Secp256k1Identity;
 
 #[cfg(feature = "pem")]
+#[doc(inline)]
 pub use error::PemError;
 
 /// A cryptographic signature, signed by an [Identity].
diff --git a/ic-agent/src/identity/prime256v1.rs b/ic-agent/src/identity/prime256v1.rs
index 4cec9a0b..7555fa7c 100644
--- a/ic-agent/src/identity/prime256v1.rs
+++ b/ic-agent/src/identity/prime256v1.rs
@@ -95,7 +95,7 @@ impl Identity for Prime256v1Identity {
         let ecdsa_sig: ecdsa::Signature = self
             .private_key
             .try_sign(content)
-            .map_err(|err| format!("Cannot create prime256v1 signature: {}", err))?;
+            .map_err(|err| format!("Cannot create prime256v1 signature: {err}"))?;
         let r = ecdsa_sig.r().as_ref().to_bytes();
         let s = ecdsa_sig.s().as_ref().to_bytes();
         let mut bytes = [0u8; 64];
diff --git a/ic-agent/src/identity/secp256k1.rs b/ic-agent/src/identity/secp256k1.rs
index 73670987..d1cd082c 100644
--- a/ic-agent/src/identity/secp256k1.rs
+++ b/ic-agent/src/identity/secp256k1.rs
@@ -95,7 +95,7 @@ impl Identity for Secp256k1Identity {
         let ecdsa_sig: ecdsa::Signature = self
             .private_key
             .try_sign(content)
-            .map_err(|err| format!("Cannot create secp256k1 signature: {}", err))?;
+            .map_err(|err| format!("Cannot create secp256k1 signature: {err}"))?;
         let r = ecdsa_sig.r().as_ref().to_bytes();
         let s = ecdsa_sig.s().as_ref().to_bytes();
         let mut bytes = [0u8; 64];
diff --git a/ic-agent/src/lib.rs b/ic-agent/src/lib.rs
index a333016b..882f5e70 100644
--- a/ic-agent/src/lib.rs
+++ b/ic-agent/src/lib.rs
@@ -43,13 +43,8 @@
 //! }
 //!
 //! # fn create_identity() -> impl ic_agent::Identity {
-//! #     let rng = ring::rand::SystemRandom::new();
-//! #     let key_pair = ring::signature::Ed25519KeyPair::generate_pkcs8(&rng)
-//! #         .expect("Could not generate a key pair.");
-//! #
-//! #     ic_agent::identity::BasicIdentity::from_key_pair(
-//! #         ring::signature::Ed25519KeyPair::from_pkcs8(key_pair.as_ref())
-//! #           .expect("Could not read the key pair."),
+//! #     ic_agent::identity::BasicIdentity::from_signing_key(
+//! #         ed25519_consensus::SigningKey::new(rand::thread_rng()),
 //! #     )
 //! # }
 //! #
diff --git a/ic-agent/src/util.rs b/ic-agent/src/util.rs
index c33a3485..353d20f0 100644
--- a/ic-agent/src/util.rs
+++ b/ic-agent/src/util.rs
@@ -1,3 +1,4 @@
+use std::future::Future;
 use std::time::Duration;
 
 pub async fn sleep(d: Duration) {
@@ -19,3 +20,13 @@ pub async fn sleep(d: Duration) {
     const _: () =
         { panic!("Using ic-agent from WASM requires enabling the `wasm-bindgen` feature") };
 }
+
+#[cfg(all(target_family = "wasm", feature = "wasm-bindgen"))]
+pub fn spawn(f: impl Future<Output = ()> + 'static) {
+    wasm_bindgen_futures::spawn_local(f);
+}
+
+#[cfg(not(all(target_family = "wasm", feature = "wasm-bindgen")))]
+pub fn spawn(f: impl Future<Output = ()> + Send + 'static) {
+    tokio::spawn(f);
+}
diff --git a/ic-identity-hsm/src/hsm.rs b/ic-identity-hsm/src/hsm.rs
index 706de909..36795b6b 100644
--- a/ic-identity-hsm/src/hsm.rs
+++ b/ic-identity-hsm/src/hsm.rs
@@ -33,7 +33,7 @@ type Sha256Hash = GenericArray<u8, <Sha256 as OutputSizeUser>::OutputSize>;
 // We expect the parameters to be curve secp256r1.  This is the base127 encoded form:
 const EXPECTED_EC_PARAMS: &[u8; 10] = b"\x06\x08\x2a\x86\x48\xce\x3d\x03\x01\x07";
 
-/// An error happened related to a HardwareIdentity.
+/// An error happened related to a `HardwareIdentity`.
 #[derive(Error, Debug)]
 pub enum HardwareIdentityError {
     /// A PKCS11 error occurred.
@@ -61,11 +61,11 @@ pub enum HardwareIdentityError {
     #[error("Unexpected key type {0}")]
     UnexpectedKeyType(CK_KEY_TYPE),
 
-    /// An EcPoint block was expected to be an OctetString, but was not.
+    /// An `EcPoint` block was expected to be an `OctetString`, but was not.
     #[error("Expected EcPoint to be an OctetString")]
     ExpectedEcPointOctetString,
 
-    /// An EcPoint block was unexpectedly empty.
+    /// An `EcPoint` block was unexpectedly empty.
     #[error("EcPoint is empty")]
     EcPointEmpty,
 
@@ -73,12 +73,12 @@ pub enum HardwareIdentityError {
     #[error("Attribute with type={0} not found")]
     AttributeNotFound(CK_ATTRIBUTE_TYPE),
 
-    /// The EcParams given were not the ones the crate expected.
+    /// The `EcParams` given were not the ones the crate expected.
     #[error("Invalid EcParams.  Expected prime256v1 {:02x?}, actual is {:02x?}", .expected, .actual)]
     InvalidEcParams {
-        /// The expected value of the EcParams.
+        /// The expected value of the `EcParams`.
         expected: Vec<u8>,
-        /// The actual value of the EcParams.
+        /// The actual value of the `EcParams`.
         actual: Vec<u8>,
     },
 
@@ -104,9 +104,11 @@ pub struct HardwareIdentity {
 impl HardwareIdentity {
     /// Create an identity using a specific key on an HSM.
     /// The filename will be something like /usr/local/lib/opensc-pkcs11.s
-    /// The key_id must refer to a ECDSA key with parameters prime256v1 (secp256r1)
+    /// The `key_id` must refer to a ECDSA key with parameters prime256v1 (secp256r1)
     /// The key must already have been created.  You can create one with pkcs11-tool:
-    /// $ pkcs11-tool -k --slot $SLOT -d $KEY_ID --key-type EC:prime256v1 --pin $PIN
+    /// ```sh
+    /// pkcs11-tool -k --slot $SLOT -d $KEY_ID --key-type EC:prime256v1 --pin $PIN
+    /// ```
     pub fn new<P, PinFn>(
         pkcs11_lib_path: P,
         slot_index: usize,
@@ -167,7 +169,7 @@ fn get_slot_id(ctx: &Ctx, slot_index: usize) -> Result<CK_SLOT_ID, HardwareIdent
     ctx.get_slot_list(true)?
         .get(slot_index)
         .ok_or(HardwareIdentityError::NoSuchSlotIndex(slot_index))
-        .map(|x| *x)
+        .copied()
 }
 
 // We open a session for the duration of the lifetime of the HardwareIdentity.
@@ -245,10 +247,10 @@ fn validate_key_type(
 
     let mut attribute_types = vec![CK_ATTRIBUTE::new(CKA_KEY_TYPE).with_ck_ulong(&kt)];
     ctx.get_attribute_value(session_handle, object_handle, &mut attribute_types)?;
-    if kt != CKK_ECDSA {
-        Err(HardwareIdentityError::UnexpectedKeyType(kt))
-    } else {
+    if kt == CKK_ECDSA {
         Ok(())
+    } else {
+        Err(HardwareIdentityError::UnexpectedKeyType(kt))
     }
 }
 
@@ -260,13 +262,13 @@ fn validate_ec_params(
     object_handle: CK_OBJECT_HANDLE,
 ) -> Result<(), HardwareIdentityError> {
     let ec_params = get_ec_params(ctx, session_handle, object_handle)?;
-    if ec_params != EXPECTED_EC_PARAMS {
+    if ec_params == EXPECTED_EC_PARAMS {
+        Ok(())
+    } else {
         Err(HardwareIdentityError::InvalidEcParams {
             expected: EXPECTED_EC_PARAMS.to_vec(),
             actual: ec_params,
         })
-    } else {
-        Ok(())
     }
 }
 
@@ -376,7 +378,7 @@ impl HardwareIdentity {
     fn sign_hash(&self, hash: &Sha256Hash) -> Result<Vec<u8>, String> {
         let private_key_handle =
             get_private_key_handle(&self.ctx, self.session_handle, &self.key_id)
-                .map_err(|e| format!("Failed to get private key handle: {}", e))?;
+                .map_err(|e| format!("Failed to get private key handle: {e}"))?;
 
         let mechanism = CK_MECHANISM {
             mechanism: CKM_ECDSA,
@@ -385,10 +387,10 @@ impl HardwareIdentity {
         };
         self.ctx
             .sign_init(self.session_handle, &mechanism, private_key_handle)
-            .map_err(|e| format!("Failed to initialize signature: {}", e))?;
+            .map_err(|e| format!("Failed to initialize signature: {e}"))?;
         self.ctx
             .sign(self.session_handle, hash)
-            .map_err(|e| format!("Failed to generate signature: {}", e))
+            .map_err(|e| format!("Failed to generate signature: {e}"))
     }
 }
 
diff --git a/ic-transport-types/Cargo.toml b/ic-transport-types/Cargo.toml
index 3fc529cb..8c706913 100644
--- a/ic-transport-types/Cargo.toml
+++ b/ic-transport-types/Cargo.toml
@@ -18,6 +18,7 @@ leb128.workspace = true
 thiserror.workspace = true
 serde.workspace = true
 serde_bytes.workspace = true
+serde_cbor.workspace = true
 serde_repr.workspace = true
 sha2.workspace = true
 
diff --git a/ic-transport-types/src/lib.rs b/ic-transport-types/src/lib.rs
index d5d3875f..125cab10 100644
--- a/ic-transport-types/src/lib.rs
+++ b/ic-transport-types/src/lib.rs
@@ -16,7 +16,8 @@ use thiserror::Error;
 mod request_id;
 pub mod signed;
 
-/// The authentication envelope, containing the contents and their signature.
+/// The authentication envelope, containing the contents and their signature. This struct can be passed to `Agent`'s
+/// `*_signed` methods via [`encode_bytes`](Envelope::encode_bytes).
 #[derive(Debug, Clone, Deserialize, Serialize)]
 #[serde(rename_all = "snake_case")]
 pub struct Envelope<'a> {
@@ -34,6 +35,17 @@ pub struct Envelope<'a> {
     pub sender_delegation: Option<Vec<SignedDelegation>>,
 }
 
+impl Envelope<'_> {
+    /// Convert the authentication envelope to the format expected by the IC HTTP interface. The result can be passed to `Agent`'s `*_signed` methods.
+    pub fn encode_bytes(&self) -> Vec<u8> {
+        let mut serializer = serde_cbor::Serializer::new(Vec::new());
+        serializer.self_describe().unwrap();
+        self.serialize(&mut serializer)
+            .expect("infallible Envelope::serialize");
+        serializer.into_inner()
+    }
+}
+
 /// The content of an IC ingress message, not including any signature information.
 #[derive(Debug, Clone, Serialize, Deserialize)]
 #[serde(tag = "request_type", rename_all = "snake_case")]
@@ -181,7 +193,7 @@ impl<T> CallResponse<Option<T>> {
 }
 
 impl<T> CallResponse<(T,)> {
-    /// Extracts the inner value of a 1-tuple, if this is `Response`.`
+    /// Extracts the inner value of a 1-tuple, if this is `Response`.
     #[inline]
     pub fn detuple(self) -> CallResponse<T> {
         match self {
@@ -260,10 +272,8 @@ impl QueryResponse {
 
     /// Helper function to get the signatures field present in both variants.
     pub fn signatures(&self) -> &[NodeSignature] {
-        match self {
-            Self::Rejected { signatures, .. } => signatures,
-            Self::Replied { signatures, .. } => signatures,
-        }
+        let (Self::Rejected { signatures, .. } | Self::Replied { signatures, .. }) = self;
+        signatures
     }
 }
 
diff --git a/ic-transport-types/src/request_id.rs b/ic-transport-types/src/request_id.rs
index 4e1f54d2..446f5d41 100644
--- a/ic-transport-types/src/request_id.rs
+++ b/ic-transport-types/src/request_id.rs
@@ -14,7 +14,12 @@ use serde::{
     Deserialize, Deserializer, Serialize, Serializer,
 };
 use sha2::{Digest, Sha256};
-use std::{io::Write, ops::Deref, str::FromStr};
+use std::{
+    fmt::{self, Display, Formatter},
+    io::Write,
+    ops::Deref,
+    str::FromStr,
+};
 
 mod error;
 #[doc(inline)]
@@ -99,6 +104,12 @@ impl From<RequestId> for String {
     }
 }
 
+impl Display for RequestId {
+    fn fmt(&self, f: &mut Formatter<'_>) -> fmt::Result {
+        hex::encode(self.0).fmt(f)
+    }
+}
+
 // Request ID hashing in all contexts is implemented as a serde Serializer to eliminate any special-casing.
 struct RequestIdSerializer;
 
@@ -187,20 +198,14 @@ impl Serializer for RequestIdSerializer {
 
     // Newtypes, including Option::Some, are transparent.
 
-    fn serialize_some<T: ?Sized>(self, value: &T) -> Result<Self::Ok, Self::Error>
-    where
-        T: Serialize,
-    {
+    fn serialize_some<T: Serialize + ?Sized>(self, value: &T) -> Result<Self::Ok, Self::Error> {
         value.serialize(self)
     }
-    fn serialize_newtype_struct<T: ?Sized>(
+    fn serialize_newtype_struct<T: Serialize + ?Sized>(
         self,
         _name: &'static str,
         value: &T,
-    ) -> Result<Self::Ok, Self::Error>
-    where
-        T: Serialize,
-    {
+    ) -> Result<Self::Ok, Self::Error> {
         value.serialize(self)
     }
 
@@ -252,16 +257,13 @@ impl Serializer for RequestIdSerializer {
     // We apply serde_json's handling of complex variants. That is,
     // the body is placed within a struct with one field, named the same thing as the variant.
 
-    fn serialize_newtype_variant<T: ?Sized>(
+    fn serialize_newtype_variant<T: Serialize + ?Sized>(
         self,
         name: &'static str,
         _variant_index: u32,
         variant: &'static str,
         value: &T,
-    ) -> Result<Self::Ok, Self::Error>
-    where
-        T: Serialize,
-    {
+    ) -> Result<Self::Ok, Self::Error> {
         let mut s = self.serialize_struct(name, 1)?;
         SerializeStruct::serialize_field(&mut s, variant, value)?;
         SerializeStruct::end(s)
@@ -303,10 +305,7 @@ impl Serializer for RequestIdSerializer {
         false
     }
     // Optimized version of serialize_str for types that serialize by rendering themselves to strings.
-    fn collect_str<T: ?Sized>(self, value: &T) -> Result<Self::Ok, Self::Error>
-    where
-        T: std::fmt::Display,
-    {
+    fn collect_str<T: Display + ?Sized>(self, value: &T) -> Result<Self::Ok, Self::Error> {
         let mut hasher = Sha256::new();
         write!(hasher, "{value}").map_err(|e| RequestIdError::CustomSerdeError(format!("{e}")))?;
         Ok(Some(hasher.finalize().into()))
@@ -323,14 +322,11 @@ struct StructSerializer {
 impl SerializeStruct for StructSerializer {
     type Ok = Option<Sha256Hash>;
     type Error = RequestIdError;
-    fn serialize_field<T: ?Sized>(
+    fn serialize_field<T: Serialize + ?Sized>(
         &mut self,
         key: &'static str,
         value: &T,
-    ) -> Result<(), Self::Error>
-    where
-        T: Serialize,
-    {
+    ) -> Result<(), Self::Error> {
         if let Some(hash) = value.serialize(RequestIdSerializer)? {
             self.fields
                 .push((Sha256::digest(key.as_bytes()).into(), hash));
@@ -338,7 +334,7 @@ impl SerializeStruct for StructSerializer {
         Ok(())
     }
     fn end(mut self) -> Result<Self::Ok, Self::Error> {
-        self.fields.sort();
+        self.fields.sort_unstable();
         let mut hasher = Sha256::new();
         for (key, value) in self.fields {
             hasher.update(key);
@@ -353,10 +349,7 @@ impl SerializeMap for StructSerializer {
     type Error = RequestIdError;
     // This implementation naïvely assumes serialize_key is called before serialize_value, with no checks.
     // SerializeMap's documentation states that such a case is 'allowed to panic or produce bogus results.'
-    fn serialize_key<T: ?Sized>(&mut self, key: &T) -> Result<(), Self::Error>
-    where
-        T: Serialize,
-    {
+    fn serialize_key<T: Serialize + ?Sized>(&mut self, key: &T) -> Result<(), Self::Error> {
         match key.serialize(RequestIdSerializer)? {
             Some(hash) => {
                 self.field_name = hash;
@@ -365,10 +358,7 @@ impl SerializeMap for StructSerializer {
             None => Err(RequestIdError::KeyWasNone),
         }
     }
-    fn serialize_value<T: ?Sized>(&mut self, value: &T) -> Result<(), Self::Error>
-    where
-        T: Serialize,
-    {
+    fn serialize_value<T: Serialize + ?Sized>(&mut self, value: &T) -> Result<(), Self::Error> {
         if let Some(hash) = value.serialize(RequestIdSerializer)? {
             self.fields.push((self.field_name, hash));
         }
@@ -388,10 +378,7 @@ struct SeqSerializer {
 impl SerializeSeq for SeqSerializer {
     type Ok = Option<Sha256Hash>;
     type Error = RequestIdError;
-    fn serialize_element<T: ?Sized>(&mut self, value: &T) -> Result<(), Self::Error>
-    where
-        T: Serialize,
-    {
+    fn serialize_element<T: Serialize + ?Sized>(&mut self, value: &T) -> Result<(), Self::Error> {
         if let Some(hash) = value.serialize(RequestIdSerializer)? {
             self.elems.push(hash);
         }
@@ -409,10 +396,7 @@ impl SerializeSeq for SeqSerializer {
 impl SerializeTuple for SeqSerializer {
     type Ok = Option<Sha256Hash>;
     type Error = RequestIdError;
-    fn serialize_element<T: ?Sized>(&mut self, value: &T) -> Result<(), Self::Error>
-    where
-        T: Serialize,
-    {
+    fn serialize_element<T: Serialize + ?Sized>(&mut self, value: &T) -> Result<(), Self::Error> {
         SerializeSeq::serialize_element(self, value)
     }
     fn end(self) -> Result<Self::Ok, Self::Error> {
@@ -423,10 +407,7 @@ impl SerializeTuple for SeqSerializer {
 impl SerializeTupleStruct for SeqSerializer {
     type Ok = Option<Sha256Hash>;
     type Error = RequestIdError;
-    fn serialize_field<T: ?Sized>(&mut self, value: &T) -> Result<(), Self::Error>
-    where
-        T: Serialize,
-    {
+    fn serialize_field<T: Serialize + ?Sized>(&mut self, value: &T) -> Result<(), Self::Error> {
         SerializeSeq::serialize_element(self, value)
     }
     fn end(self) -> Result<Self::Ok, Self::Error> {
@@ -445,14 +426,11 @@ struct StructVariantSerializer {
 impl SerializeStructVariant for StructVariantSerializer {
     type Ok = Option<Sha256Hash>;
     type Error = RequestIdError;
-    fn serialize_field<T: ?Sized>(
+    fn serialize_field<T: Serialize + ?Sized>(
         &mut self,
         key: &'static str,
         value: &T,
-    ) -> Result<(), Self::Error>
-    where
-        T: Serialize,
-    {
+    ) -> Result<(), Self::Error> {
         SerializeStruct::serialize_field(&mut self.struct_ser, key, value)
     }
     fn end(self) -> Result<Self::Ok, Self::Error> {
@@ -478,10 +456,7 @@ struct TupleVariantSerializer {
 impl SerializeTupleVariant for TupleVariantSerializer {
     type Ok = Option<Sha256Hash>;
     type Error = RequestIdError;
-    fn serialize_field<T: ?Sized>(&mut self, value: &T) -> Result<(), Self::Error>
-    where
-        T: Serialize,
-    {
+    fn serialize_field<T: Serialize + ?Sized>(&mut self, value: &T) -> Result<(), Self::Error> {
         SerializeSeq::serialize_element(&mut self.seq_ser, value)
     }
     fn end(self) -> Result<Self::Ok, Self::Error> {
@@ -600,7 +575,7 @@ mod tests {
         let current = PublicSpecExampleStruct {
             request_type: "call",
             sender: Some(Principal::anonymous()),
-            ingress_expiry: Some(1685570400000000000),
+            ingress_expiry: Some(1_685_570_400_000_000_000),
             canister_id: Principal::from_slice(b"\x00\x00\x00\x00\x00\x00\x04\xD2"),
             method_name: "hello",
             arg: b"DIDL\x00\xFD*",
@@ -630,7 +605,7 @@ mod tests {
         );
     }
 
-    /// The same example as above, except we use the ApiClient enum newtypes.
+    /// The same example as above, except we use the `ApiClient` enum newtypes.
     #[test]
     fn public_spec_example_api_client() {
         #[derive(Serialize)]
@@ -648,7 +623,7 @@ mod tests {
         }
         let current = PublicSpec::Call {
             sender: Some(Principal::anonymous()),
-            ingress_expiry: Some(1685570400000000000),
+            ingress_expiry: Some(1_685_570_400_000_000_000),
             canister_id: Principal::from_slice(b"\x00\x00\x00\x00\x00\x00\x04\xD2"),
             method_name: "hello".to_owned(),
             arg: Some(b"DIDL\x00\xFD*".to_vec()),
diff --git a/ic-transport-types/src/request_id/error.rs b/ic-transport-types/src/request_id/error.rs
index 58028860..f53a6c02 100644
--- a/ic-transport-types/src/request_id/error.rs
+++ b/ic-transport-types/src/request_id/error.rs
@@ -1,7 +1,7 @@
-//! Error type for the RequestId calculation.
+//! Error type for the `RequestId` calculation.
 use thiserror::Error;
 
-/// Errors from reading a RequestId from a string. This is not the same as
+/// Errors from reading a `RequestId` from a string. This is not the same as
 /// deserialization.
 #[derive(Error, Debug)]
 pub enum RequestIdFromStringError {
@@ -14,7 +14,7 @@ pub enum RequestIdFromStringError {
     FromHexError(hex::FromHexError),
 }
 
-/// An error during the calculation of the RequestId.
+/// An error during the calculation of the `RequestId`.
 ///
 /// Since we use serde for serializing a data type into a hash, this has to support traits that
 /// serde expects, such as Display
diff --git a/ic-transport-types/src/signed.rs b/ic-transport-types/src/signed.rs
index 468cb910..aa2261da 100644
--- a/ic-transport-types/src/signed.rs
+++ b/ic-transport-types/src/signed.rs
@@ -6,6 +6,8 @@ use serde::{Deserialize, Serialize};
 
 /// A signed query request message. Produced by
 /// [`QueryBuilder::sign`](https://docs.rs/ic-agent/latest/ic_agent/agent/struct.QueryBuilder.html#method.sign).
+///
+/// To submit this request, pass the `signed_query` field to [`Agent::query_signed`](https://docs.rs/ic-agent/latest/ic_agent/struct.Agent.html#method.query_signed).
 #[derive(Debug, Clone, Deserialize, Serialize)]
 pub struct SignedQuery {
     /// The Unix timestamp that the request will expire at.
@@ -22,6 +24,7 @@ pub struct SignedQuery {
     /// The [effective canister ID](https://internetcomputer.org/docs/current/references/ic-interface-spec#http-effective-canister-id) of the destination.
     pub effective_canister_id: Principal,
     /// The CBOR-encoded [authentication envelope](https://internetcomputer.org/docs/current/references/ic-interface-spec#authentication) for the request.
+    /// This field can be passed to [`Agent::query_signed`](https://docs.rs/ic-agent/latest/ic_agent/struct.Agent.html#method.query_signed).
     #[serde(with = "serde_bytes")]
     pub signed_query: Vec<u8>,
     /// A nonce to uniquely identify this query call.
@@ -33,6 +36,8 @@ pub struct SignedQuery {
 
 /// A signed update request message. Produced by
 /// [`UpdateBuilder::sign`](https://docs.rs/ic-agent/latest/ic_agent/agent/struct.UpdateBuilder.html#method.sign).
+///
+/// To submit this request, pass the `signed_update` field to [`Agent::update_signed`](https://docs.rs/ic-agent/latest/ic_agent/struct.Agent.html#method.update_signed).
 #[derive(Debug, Clone, Deserialize, Serialize)]
 pub struct SignedUpdate {
     /// A nonce to uniquely identify this update call.
@@ -55,6 +60,7 @@ pub struct SignedUpdate {
     pub effective_canister_id: Principal,
     #[serde(with = "serde_bytes")]
     /// The CBOR-encoded [authentication envelope](https://internetcomputer.org/docs/current/references/ic-interface-spec#authentication) for the request.
+    /// This field can be passed to [`Agent::update_signed`](https://docs.rs/ic-agent/latest/ic_agent/struct.Agent.html#method.update_signed).
     pub signed_update: Vec<u8>,
     /// The request ID.
     pub request_id: RequestId,
@@ -62,6 +68,8 @@ pub struct SignedUpdate {
 
 /// A signed request-status request message. Produced by
 /// [`Agent::sign_request_status`](https://docs.rs/ic-agent/latest/ic_agent/agent/struct.Agent.html#method.sign_request_status).
+///
+/// To submit this request, pass the `signed_request_status` field to [`Agent::request_status_signed`](https://docs.rs/ic-agent/latest/ic_agent/struct.Agent.html#method.request_status_signed).
 #[derive(Debug, Clone, Deserialize, Serialize)]
 pub struct SignedRequestStatus {
     /// The Unix timestamp that the request will expire at.
@@ -73,6 +81,7 @@ pub struct SignedRequestStatus {
     /// The request ID.
     pub request_id: RequestId,
     /// The CBOR-encoded [authentication envelope](https://internetcomputer.org/docs/current/references/ic-interface-spec#authentication) for the request.
+    /// This field can be passed to [`Agent::request_status_signed`](https://docs.rs/ic-agent/latest/ic_agent/struct.Agent.html#method.request_status_signed).
     #[serde(with = "serde_bytes")]
     pub signed_request_status: Vec<u8>,
 }
diff --git a/ic-utils/Cargo.toml b/ic-utils/Cargo.toml
index dd0b1774..4ae5f8f5 100644
--- a/ic-utils/Cargo.toml
+++ b/ic-utils/Cargo.toml
@@ -14,8 +14,6 @@ categories = ["api-bindings", "data-structures", "no-std"]
 keywords = ["internet-computer", "agent", "utility", "icp", "dfinity"]
 include = ["src", "Cargo.toml", "../LICENSE", "README.md"]
 
-# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
-
 [dependencies]
 async-trait = "0.1.68"
 candid = { workspace = true, features = ["value"] }
@@ -33,8 +31,9 @@ semver = "1.0.7"
 once_cell = "1.10.0"
 
 [dev-dependencies]
+ed25519-consensus = { workspace = true }
 ic-agent = { workspace = true, default-features = true }
-ring = { workspace = true }
+rand = { workspace = true }
 tokio = { workspace = true, features = ["full"] }
 
 [features]
diff --git a/ic-utils/src/call.rs b/ic-utils/src/call.rs
index 6889bee3..e22fa003 100644
--- a/ic-utils/src/call.rs
+++ b/ic-utils/src/call.rs
@@ -33,7 +33,7 @@ pub trait SyncCall: CallIntoFuture<Output = Result<Self::Value, AgentError>> {
 }
 
 /// A type that implements asynchronous calls (ie. 'update' calls).
-/// This can call synchronous and return a [RequestId], or it can wait for the result
+/// This can call synchronous and return a [`RequestId`](ic_agent::RequestId), or it can wait for the result
 /// by polling the agent, and return a type.
 ///
 /// The return type must be a tuple type that represents all the values the return
@@ -43,15 +43,15 @@ pub trait SyncCall: CallIntoFuture<Output = Result<Self::Value, AgentError>> {
 pub trait AsyncCall: CallIntoFuture<Output = Result<Self::Value, AgentError>> {
     /// The return type of the Candid function being called.
     type Value: for<'de> ArgumentDecoder<'de> + Send;
-    /// Execute the call, but returns the RequestId. Waiting on the request Id must be
+    /// Execute the call, but returns the `RequestId`. Waiting on the request Id must be
     /// managed by the caller using the Agent directly.
     ///
     /// Since the return type is encoded in the trait itself, this can lead to types
     /// that are not compatible to `Out` when getting the result from the Request Id.
     /// For example, you might hold a [`AsyncCall<u8>`], use `call()` and poll for
-    /// the result, and try to deserialize it as a [String]. This would be caught by
-    /// Rust type system, but in this case it will be checked at runtime (as Request
-    /// Id does not have a type associated with it).
+    /// the result, and try to deserialize it as a [`String`]. This would be caught by
+    /// Rust type system, but in this case it will be checked at runtime (as `RequestId`
+    /// does not have a type associated with it).
     async fn call(self) -> Result<CallResponse<Self::Value>, AgentError>;
 
     /// Execute the call, and wait for an answer using an exponential-backoff strategy. The return
@@ -72,13 +72,8 @@ pub trait AsyncCall: CallIntoFuture<Output = Result<Self::Value, AgentError>> {
     /// async fn create_a_canister() -> Result<Principal, Box<dyn std::error::Error>> {
     /// # let canister_wasm = b"\0asm\x01\0\0\0";
     /// # fn create_identity() -> impl Identity {
-    /// #     let rng = ring::rand::SystemRandom::new();
-    /// #     let key_pair = ring::signature::Ed25519KeyPair::generate_pkcs8(&rng)
-    /// #         .expect("Could not generate a key pair.");
-    /// #
-    /// #     BasicIdentity::from_key_pair(
-    /// #         ring::signature::Ed25519KeyPair::from_pkcs8(key_pair.as_ref())
-    /// #           .expect("Could not read the key pair."),
+    /// #     BasicIdentity::from_signing_key(
+    /// #         ed25519_consensus::SigningKey::new(rand::thread_rng()),
     /// #     )
     /// # }
     /// #
@@ -246,7 +241,7 @@ impl<'agent, Out> AsyncCaller<'agent, Out>
 where
     Out: for<'de> ArgumentDecoder<'de> + Send + 'agent,
 {
-    /// Build an UpdateBuilder call that can be used directly with the [Agent]. This is
+    /// Build an `UpdateBuilder` call that can be used directly with the [Agent]. This is
     /// essentially downleveling this type into the lower level [ic-agent] abstraction.
     pub fn build_call(self) -> Result<UpdateBuilder<'agent>, AgentError> {
         let mut builder = self.agent.update(&self.canister_id, &self.method_name);
@@ -260,7 +255,7 @@ where
     /// See [`AsyncCall::call`].
     pub async fn call(self) -> Result<CallResponse<Out>, AgentError> {
         let response_bytes = match self.build_call()?.call().await? {
-            CallResponse::Response(response_bytes) => response_bytes,
+            CallResponse::Response((response_bytes, _)) => response_bytes,
             CallResponse::Poll(request_id) => return Ok(CallResponse::Poll(request_id)),
         };
 
@@ -325,7 +320,7 @@ where
     }
 }
 
-/// An AsyncCall that applies a transform function to the result of the call. Because of
+/// An `AsyncCall` that applies a transform function to the result of the call. Because of
 /// constraints on the type system in Rust, both the input and output to the function must be
 /// deserializable.
 pub struct AndThenAsyncCaller<
diff --git a/ic-utils/src/canister.rs b/ic-utils/src/canister.rs
index b9c5041c..ed19dca2 100644
--- a/ic-utils/src/canister.rs
+++ b/ic-utils/src/canister.rs
@@ -97,7 +97,7 @@ impl<'agent> Canister<'agent> {
         &self.canister_id
     }
 
-    /// Create an AsyncCallBuilder to do an update call.
+    /// Create an `AsyncCallBuilder` to do an update call.
     /// Prefer using [`update`](Canister::update) instead.
     pub fn update_<'canister>(
         &'canister self,
@@ -106,7 +106,7 @@ impl<'agent> Canister<'agent> {
         AsyncCallBuilder::new(self, method_name)
     }
 
-    /// Create an AsyncCallBuilder to do an update call.
+    /// Create an `AsyncCallBuilder` to do an update call.
     pub fn update<'canister>(
         &'canister self,
         method_name: &str,
@@ -114,7 +114,7 @@ impl<'agent> Canister<'agent> {
         AsyncCallBuilder::new(self, method_name)
     }
 
-    /// Create a SyncCallBuilder to do a query call.
+    /// Create a `SyncCallBuilder` to do a query call.
     /// Prefer using [`query`](Canister::query) instead.
     pub fn query_<'canister>(
         &'canister self,
@@ -123,7 +123,7 @@ impl<'agent> Canister<'agent> {
         SyncCallBuilder::new(self, method_name)
     }
 
-    /// Create a SyncCallBuilder to do a query call.
+    /// Create a `SyncCallBuilder` to do a query call.
     pub fn query<'canister>(
         &'canister self,
         method_name: &str,
@@ -131,12 +131,15 @@ impl<'agent> Canister<'agent> {
         SyncCallBuilder::new(self, method_name)
     }
 
-    /// Call request_status on the RequestId in a loop and return the response as a byte vector.
+    /// Call `request_status` on the `RequestId` in a loop and return the response as a byte vector.
     pub async fn wait<'canister>(
         &'canister self,
         request_id: &RequestId,
     ) -> Result<Vec<u8>, AgentError> {
-        self.agent.wait(request_id, self.canister_id).await
+        self.agent
+            .wait(request_id, self.canister_id)
+            .await
+            .map(|x| x.0)
     }
 
     /// Creates a copy of this canister, changing the canister ID to the provided principal.
@@ -155,7 +158,7 @@ impl<'agent> Canister<'agent> {
         }
     }
 
-    /// Create a CanisterBuilder instance to build a canister abstraction.
+    /// Create a `CanisterBuilder` instance to build a canister abstraction.
     pub fn builder() -> CanisterBuilder<'agent> {
         Default::default()
     }
@@ -174,7 +177,7 @@ impl Argument {
         }
     }
 
-    /// Set an IDLValue Argument. Can only be called at most once.
+    /// Set an `IDLValue` Argument. Can only be called at most once.
     pub fn set_value_arg(&mut self, arg: IDLValue) {
         match self.0 {
             None => {
@@ -182,7 +185,7 @@ impl Argument {
                 let result = builder
                     .value_arg(&arg)
                     .and_then(|builder| builder.serialize_to_vec())
-                    .map_err(|e| e.into());
+                    .map_err(Into::into);
                 self.0 = Some(result);
             }
             Some(_) => panic!("argument is being set more than once"),
@@ -217,20 +220,20 @@ impl Argument {
         Self(Some(Ok(raw)))
     }
 
-    /// Creates an argument from an existing Candid ArgumentEncoder.
+    /// Creates an argument from an existing Candid `ArgumentEncoder`.
     pub fn from_candid(tuple: impl ArgumentEncoder) -> Self {
         let mut builder = IDLBuilder::new();
         let result = tuple
             .encode(&mut builder)
             .and_then(|_| builder.serialize_to_vec())
-            .map_err(|e| e.into());
+            .map_err(Into::into);
         Self(Some(result))
     }
 }
 
 /// A builder for a synchronous call (ie. query) to the Internet Computer.
 ///
-/// See [SyncCaller] for a description of this structure once built.
+/// See [`SyncCaller`] for a description of this structure once built.
 #[derive(Debug)]
 pub struct SyncCallBuilder<'agent, 'canister> {
     canister: &'canister Canister<'agent>,
@@ -240,7 +243,7 @@ pub struct SyncCallBuilder<'agent, 'canister> {
 }
 
 impl<'agent: 'canister, 'canister> SyncCallBuilder<'agent, 'canister> {
-    /// Create a new instance of an AsyncCallBuilder.
+    /// Create a new instance of an `AsyncCallBuilder`.
     pub(super) fn new<M: Into<String>>(
         canister: &'canister Canister<'agent>,
         method_name: M,
@@ -265,14 +268,12 @@ impl<'agent: 'canister, 'canister> SyncCallBuilder<'agent, 'canister> {
     }
     /// Set the argument with multiple arguments as tuple. Can be called at most once.
     pub fn with_args(mut self, tuple: impl ArgumentEncoder) -> Self {
-        if self.arg.0.is_some() {
-            panic!("argument is being set more than once");
-        }
+        assert!(self.arg.0.is_none(), "argument is being set more than once");
         self.arg = Argument::from_candid(tuple);
         self
     }
 
-    /// Set the argument with IDLValue argument. Can be called at most once.
+    /// Set the argument with `IDLValue` argument. Can be called at most once.
     ///
     /// TODO: make this method unnecessary ([#132](https://github.com/dfinity/agent-rs/issues/132))
     pub fn with_value_arg(mut self, arg: IDLValue) -> Self {
@@ -292,7 +293,7 @@ impl<'agent: 'canister, 'canister> SyncCallBuilder<'agent, 'canister> {
         self
     }
 
-    /// Builds a [SyncCaller] from this builder's state.
+    /// Builds a [`SyncCaller`] from this builder's state.
     pub fn build<Output>(self) -> SyncCaller<'agent, Output>
     where
         Output: for<'de> ArgumentDecoder<'de> + Send + Sync,
@@ -312,7 +313,7 @@ impl<'agent: 'canister, 'canister> SyncCallBuilder<'agent, 'canister> {
 
 /// A builder for an asynchronous call (ie. update) to the Internet Computer.
 ///
-/// See [AsyncCaller] for a description of this structure.
+/// See [`AsyncCaller`] for a description of this structure.
 #[derive(Debug)]
 pub struct AsyncCallBuilder<'agent, 'canister> {
     canister: &'canister Canister<'agent>,
@@ -322,7 +323,7 @@ pub struct AsyncCallBuilder<'agent, 'canister> {
 }
 
 impl<'agent: 'canister, 'canister> AsyncCallBuilder<'agent, 'canister> {
-    /// Create a new instance of an AsyncCallBuilder.
+    /// Create a new instance of an `AsyncCallBuilder`.
     pub(super) fn new(
         canister: &'canister Canister<'agent>,
         method_name: &str,
@@ -347,9 +348,7 @@ impl<'agent: 'canister, 'canister> AsyncCallBuilder<'agent, 'canister> {
     }
     /// Set the argument with multiple arguments as tuple. Can be called at most once.
     pub fn with_args(mut self, tuple: impl ArgumentEncoder) -> Self {
-        if self.arg.0.is_some() {
-            panic!("argument is being set more than once");
-        }
+        assert!(self.arg.0.is_none(), "argument is being set more than once");
         self.arg = Argument::from_candid(tuple);
         self
     }
@@ -366,7 +365,7 @@ impl<'agent: 'canister, 'canister> AsyncCallBuilder<'agent, 'canister> {
         self
     }
 
-    /// Builds an [AsyncCaller] from this builder's state.
+    /// Builds an [`AsyncCaller`] from this builder's state.
     pub fn build<Output>(self) -> AsyncCaller<'agent, Output>
     where
         Output: for<'de> ArgumentDecoder<'de> + Send + Sync,
@@ -389,7 +388,9 @@ mod tests {
     use super::super::interfaces::ManagementCanister;
     use crate::call::AsyncCall;
     use candid::Principal;
+    use ed25519_consensus::SigningKey;
     use ic_agent::identity::BasicIdentity;
+    use rand::thread_rng;
 
     fn get_effective_canister_id() -> Principal {
         Principal::from_text("rwlgt-iiaaa-aaaaa-aaaaa-cai").unwrap()
@@ -400,14 +401,7 @@ mod tests {
     async fn simple() {
         use super::Canister;
 
-        let rng = ring::rand::SystemRandom::new();
-        let key_pair = ring::signature::Ed25519KeyPair::generate_pkcs8(&rng)
-            .expect("Could not generate a key pair.");
-
-        let identity = BasicIdentity::from_key_pair(
-            ring::signature::Ed25519KeyPair::from_pkcs8(key_pair.as_ref())
-                .expect("Could not read the key pair."),
-        );
+        let identity = BasicIdentity::from_signing_key(SigningKey::new(thread_rng()));
 
         let port = std::env::var("IC_REF_PORT").unwrap_or_else(|_| "4943".into());
 
diff --git a/ic-utils/src/interfaces/bitcoin_canister.rs b/ic-utils/src/interfaces/bitcoin_canister.rs
index 184c7ce8..f34ca52e 100644
--- a/ic-utils/src/interfaces/bitcoin_canister.rs
+++ b/ic-utils/src/interfaces/bitcoin_canister.rs
@@ -269,7 +269,7 @@ pub struct GetUtxosResponse {
     pub next_page: Option<Vec<u8>>,
 }
 
-/// Response type for the ``.
+/// Response type for the [`BitcoinCanister::get_block_headers`] function.
 #[derive(Debug, Clone, CandidType, Deserialize)]
 pub struct GetBlockHeadersResponse {
     /// The tip of the chain, current to when the headers were fetched.
diff --git a/ic-utils/src/interfaces/http_request.rs b/ic-utils/src/interfaces/http_request.rs
index fa5ee82f..ab7e7363 100644
--- a/ic-utils/src/interfaces/http_request.rs
+++ b/ic-utils/src/interfaces/http_request.rs
@@ -576,13 +576,13 @@ mod test {
         fn decode<C: CandidType + DeserializeOwned>(bytes: &[u8]) {
             let response = Decode!(bytes, HttpResponse::<_, C>).unwrap();
             assert_eq!(response.status_code, 100);
-            let token = match response.streaming_strategy {
-                Some(StreamingStrategy::Callback(CallbackStrategy { token, .. })) => token,
-                _ => panic!("streaming_strategy was missing"),
+            let Some(StreamingStrategy::Callback(CallbackStrategy { token, .. })) =
+                response.streaming_strategy
+            else {
+                panic!("streaming_strategy was missing");
             };
-            let fields = match token {
-                Token(IDLValue::Record(fields)) => fields,
-                _ => panic!("token type mismatched {:?}", token),
+            let Token(IDLValue::Record(fields)) = token else {
+                panic!("token type mismatched {token:?}");
             };
             assert!(fields.contains(&IDLField {
                 id: Label::Named("key".into()),
@@ -669,9 +669,8 @@ mod test {
 
         let response = Decode!(&bytes, StreamingCallbackHttpResponse).unwrap();
         assert_eq!(response.body, b"this is a body");
-        let fields = match response.token {
-            Some(Token(IDLValue::Record(fields))) => fields,
-            _ => panic!("token type mismatched {:?}", response.token),
+        let Some(Token(IDLValue::Record(fields))) = response.token else {
+            panic!("token type mismatched {:?}", response.token);
         };
         assert!(fields.contains(&IDLField {
             id: Label::Named("key".into()),
diff --git a/ic-utils/src/interfaces/management_canister.rs b/ic-utils/src/interfaces/management_canister.rs
index 7d833c69..7b194f8b 100644
--- a/ic-utils/src/interfaces/management_canister.rs
+++ b/ic-utils/src/interfaces/management_canister.rs
@@ -51,7 +51,7 @@ pub enum MgmtMethod {
     DepositCycles,
     /// See [`ManagementCanister::raw_rand`].
     RawRand,
-    /// See [`ManagementCanister::provisional_create_canister_with_cycles`].
+    /// See [`CreateCanisterBuilder::as_provisional_create_with_amount`].
     ProvisionalCreateCanisterWithCycles,
     /// See [`ManagementCanister::provisional_top_up_canister`].
     ProvisionalTopUpCanister,
@@ -89,6 +89,8 @@ pub enum MgmtMethod {
     BitcoinSendTransaction,
     /// There is no corresponding agent function as only canisters can call it. Use [`BitcoinCanister`](super::BitcoinCanister) instead.
     BitcoinGetCurrentFeePercentiles,
+    /// There is no corresponding agent function as only canisters can call it. Use [`BitcoinCanister`](super::BitcoinCanister) instead.
+    BitcoinGetBlockHeaders,
     /// There is no corresponding agent function as only canisters can call it.
     NodeMetricsHistory,
 }
@@ -112,7 +114,7 @@ impl<'agent> ManagementCanister<'agent> {
 }
 
 /// The complete canister status information of a canister. This includes
-/// the CanisterStatus, a hash of the module installed on the canister (None if nothing installed),
+/// the `CanisterStatus`, a hash of the module installed on the canister (None if nothing installed),
 /// the controller of the canister, the canister's memory size, and its balance in cycles.
 #[derive(Clone, Debug, Deserialize, CandidType)]
 pub struct StatusCallResult {
@@ -236,10 +238,10 @@ pub struct ChunkHash {
     pub hash: Vec<u8>,
 }
 
-/// Return type of [ManagementCanister::stored_chunks].
+/// Return type of [`ManagementCanister::stored_chunks`].
 pub type StoreChunksResult = Vec<ChunkHash>;
 
-/// Return type of [ManagementCanister::upload_chunk].
+/// Return type of [`ManagementCanister::upload_chunk`].
 pub type UploadChunkResult = ChunkHash;
 
 /// A recorded snapshot of a canister. Can be restored with [`ManagementCanister::load_canister_snapshot`].
@@ -311,9 +313,9 @@ impl<'agent> ManagementCanister<'agent> {
     }
 
     /// Until developers can convert real ICP tokens to a top up an existing canister,
-    /// the system provides the provisional_top_up_canister method.
+    /// the system provides the `provisional_top_up_canister` method.
     /// It adds amount cycles to the balance of canister identified by amount
-    /// (implicitly capping it at MAX_CANISTER_BALANCE).
+    /// (implicitly capping it at `MAX_CANISTER_BALANCE`).
     pub fn provisional_top_up_canister(
         &self,
         canister_id: &Principal,
diff --git a/ic-utils/src/interfaces/management_canister/attributes.rs b/ic-utils/src/interfaces/management_canister/attributes.rs
index 3134e644..d0f00ea4 100644
--- a/ic-utils/src/interfaces/management_canister/attributes.rs
+++ b/ic-utils/src/interfaces/management_canister/attributes.rs
@@ -157,7 +157,7 @@ pub enum ReservedCyclesLimitError {
 
 /// A reserved cycles limit for a canister. Can be anywhere from 0 to 2^128-1 inclusive.
 ///
-/// This represents the upper limit of reserved_cycles for the canister.
+/// This represents the upper limit of `reserved_cycles` for the canister.
 ///
 /// Reserved cycles are cycles that the system sets aside for future use by the canister.
 /// If a subnet's storage exceeds 450 GiB, then every time a canister allocates new storage bytes,
@@ -337,7 +337,7 @@ fn can_convert_reserved_cycles_limit() {
 
     assert_eq!(
         ReservedCyclesLimit::try_from(2u128.pow(127) + 6).unwrap().0,
-        170141183460469231731687303715884105734u128
+        170_141_183_460_469_231_731_687_303_715_884_105_734_u128
     );
 
     let ft = ReservedCyclesLimit(100);
@@ -368,7 +368,7 @@ fn can_convert_wasm_memory_limit() {
     ));
 
     assert!(matches!(
-        WasmMemoryLimit::try_from(562949953421312_u64).unwrap_err(),
-        WasmMemoryLimitError::InvalidMemoryLimit(562949953421312)
+        WasmMemoryLimit::try_from(562_949_953_421_312_u64).unwrap_err(),
+        WasmMemoryLimitError::InvalidMemoryLimit(562_949_953_421_312)
     ));
 }
diff --git a/ic-utils/src/interfaces/management_canister/builders.rs b/ic-utils/src/interfaces/management_canister/builders.rs
index f81d19af..623c3cac 100644
--- a/ic-utils/src/interfaces/management_canister/builders.rs
+++ b/ic-utils/src/interfaces/management_canister/builders.rs
@@ -52,7 +52,7 @@ pub struct CanisterSettings {
     /// If unspecified and a canister is being created with these settings, defaults to 2592000, i.e. ~30 days.
     pub freezing_threshold: Option<Nat>,
 
-    /// The upper limit of reserved_cycles for the canister.
+    /// The upper limit of `reserved_cycles` for the canister.
     ///
     /// Reserved cycles are cycles that the system sets aside for future use by the canister.
     /// If a subnet's storage exceeds 450 GiB, then every time a canister allocates new storage bytes,
@@ -100,7 +100,7 @@ pub struct CreateCanisterBuilder<'agent, 'canister: 'agent> {
 }
 
 impl<'agent, 'canister: 'agent> CreateCanisterBuilder<'agent, 'canister> {
-    /// Create an CreateCanister builder, which is also an AsyncCall implementation.
+    /// Create an `CreateCanister` builder, which is also an `AsyncCall` implementation.
     pub fn builder(canister: &'canister Canister<'agent>) -> Self {
         Self {
             canister,
@@ -119,10 +119,10 @@ impl<'agent, 'canister: 'agent> CreateCanisterBuilder<'agent, 'canister> {
     }
 
     /// Until developers can convert real ICP tokens to provision a new canister with cycles,
-    /// the system provides the provisional_create_canister_with_cycles method.
-    /// It behaves as create_canister, but initializes the canister’s balance with amount fresh cycles
-    /// (using MAX_CANISTER_BALANCE if amount = null, else capping the balance at MAX_CANISTER_BALANCE).
-    /// Cycles added to this call via ic0.call_cycles_add are returned to the caller.
+    /// the system provides the `provisional_create_canister_with_cycles` method.
+    /// It behaves as `create_canister`, but initializes the canister’s balance with amount fresh cycles
+    /// (using `MAX_CANISTER_BALANCE` if amount = null, else capping the balance at `MAX_CANISTER_BALANCE`).
+    /// Cycles added to this call via `ic0.call_cycles_add` are returned to the caller.
     /// This method is only available in local development instances, and will be removed in the future.
     #[allow(clippy::wrong_self_convention)]
     pub fn as_provisional_create_with_amount(self, amount: Option<u128>) -> Self {
@@ -135,7 +135,7 @@ impl<'agent, 'canister: 'agent> CreateCanisterBuilder<'agent, 'canister> {
 
     /// Specify the canister id.
     ///
-    /// The effective_canister_id will also be set with the same value so that ic-ref can determine
+    /// The `effective_canister_id` will also be set with the same value so that ic-ref can determine
     /// the target subnet of this request. The replica implementation ignores it.
     pub fn as_provisional_create_with_specified_id(self, specified_id: Principal) -> Self {
         Self {
@@ -170,7 +170,7 @@ impl<'agent, 'canister: 'agent> CreateCanisterBuilder<'agent, 'canister> {
     {
         let controller_to_add: Option<Result<Principal, _>> = controller.map(|ca| {
             ca.try_into()
-                .map_err(|e| AgentError::MessageError(format!("{}", e)))
+                .map_err(|e| AgentError::MessageError(format!("{e}")))
         });
         let controllers: Option<Result<Vec<Principal>, _>> =
             match (controller_to_add, self.controllers) {
@@ -209,7 +209,7 @@ impl<'agent, 'canister: 'agent> CreateCanisterBuilder<'agent, 'canister> {
         Self {
             compute_allocation: compute_allocation.map(|ca| {
                 ca.try_into()
-                    .map_err(|e| AgentError::MessageError(format!("{}", e)))
+                    .map_err(|e| AgentError::MessageError(format!("{e}")))
             }),
             ..self
         }
@@ -234,7 +234,7 @@ impl<'agent, 'canister: 'agent> CreateCanisterBuilder<'agent, 'canister> {
         Self {
             memory_allocation: memory_allocation.map(|ma| {
                 ma.try_into()
-                    .map_err(|e| AgentError::MessageError(format!("{}", e)))
+                    .map_err(|e| AgentError::MessageError(format!("{e}")))
             }),
             ..self
         }
@@ -259,7 +259,7 @@ impl<'agent, 'canister: 'agent> CreateCanisterBuilder<'agent, 'canister> {
         Self {
             freezing_threshold: freezing_threshold.map(|ma| {
                 ma.try_into()
-                    .map_err(|e| AgentError::MessageError(format!("{}", e)))
+                    .map_err(|e| AgentError::MessageError(format!("{e}")))
             }),
             ..self
         }
@@ -294,7 +294,7 @@ impl<'agent, 'canister: 'agent> CreateCanisterBuilder<'agent, 'canister> {
             reserved_cycles_limit: limit.map(|limit| {
                 limit
                     .try_into()
-                    .map_err(|e| AgentError::MessageError(format!("{}", e)))
+                    .map_err(|e| AgentError::MessageError(format!("{e}")))
             }),
             ..self
         }
@@ -320,7 +320,7 @@ impl<'agent, 'canister: 'agent> CreateCanisterBuilder<'agent, 'canister> {
             wasm_memory_limit: wasm_memory_limit.map(|limit| {
                 limit
                     .try_into()
-                    .map_err(|e| AgentError::MessageError(format!("{}", e)))
+                    .map_err(|e| AgentError::MessageError(format!("{e}")))
             }),
             ..self
         }
@@ -346,47 +346,47 @@ impl<'agent, 'canister: 'agent> CreateCanisterBuilder<'agent, 'canister> {
             log_visibility: log_visibility.map(|visibility| {
                 visibility
                     .try_into()
-                    .map_err(|e| AgentError::MessageError(format!("{}", e)))
+                    .map_err(|e| AgentError::MessageError(format!("{e}")))
             }),
             ..self
         }
     }
 
-    /// Create an [AsyncCall] implementation that, when called, will create a
+    /// Create an [`AsyncCall`] implementation that, when called, will create a
     /// canister.
     pub fn build(self) -> Result<impl 'agent + AsyncCall<Value = (Principal,)>, AgentError> {
         let controllers = match self.controllers {
-            Some(Err(x)) => return Err(AgentError::MessageError(format!("{}", x))),
+            Some(Err(x)) => return Err(AgentError::MessageError(format!("{x}"))),
             Some(Ok(x)) => Some(x),
             None => None,
         };
         let compute_allocation = match self.compute_allocation {
-            Some(Err(x)) => return Err(AgentError::MessageError(format!("{}", x))),
+            Some(Err(x)) => return Err(AgentError::MessageError(format!("{x}"))),
             Some(Ok(x)) => Some(Nat::from(u8::from(x))),
             None => None,
         };
         let memory_allocation = match self.memory_allocation {
-            Some(Err(x)) => return Err(AgentError::MessageError(format!("{}", x))),
+            Some(Err(x)) => return Err(AgentError::MessageError(format!("{x}"))),
             Some(Ok(x)) => Some(Nat::from(u64::from(x))),
             None => None,
         };
         let freezing_threshold = match self.freezing_threshold {
-            Some(Err(x)) => return Err(AgentError::MessageError(format!("{}", x))),
+            Some(Err(x)) => return Err(AgentError::MessageError(format!("{x}"))),
             Some(Ok(x)) => Some(Nat::from(u64::from(x))),
             None => None,
         };
         let reserved_cycles_limit = match self.reserved_cycles_limit {
-            Some(Err(x)) => return Err(AgentError::MessageError(format!("{}", x))),
+            Some(Err(x)) => return Err(AgentError::MessageError(format!("{x}"))),
             Some(Ok(x)) => Some(Nat::from(u128::from(x))),
             None => None,
         };
         let wasm_memory_limit = match self.wasm_memory_limit {
-            Some(Err(x)) => return Err(AgentError::MessageError(format!("{}", x))),
+            Some(Err(x)) => return Err(AgentError::MessageError(format!("{x}"))),
             Some(Ok(x)) => Some(Nat::from(u64::from(x))),
             None => None,
         };
         let log_visibility = match self.log_visibility {
-            Some(Err(x)) => return Err(AgentError::MessageError(format!("{}", x))),
+            Some(Err(x)) => return Err(AgentError::MessageError(format!("{x}"))),
             Some(Ok(x)) => Some(x),
             None => None,
         };
@@ -440,12 +440,12 @@ impl<'agent, 'canister: 'agent> CreateCanisterBuilder<'agent, 'canister> {
             .map(|result: (Out,)| (result.0.canister_id,)))
     }
 
-    /// Make a call. This is equivalent to the [AsyncCall::call].
+    /// Make a call. This is equivalent to the [`AsyncCall::call`].
     pub async fn call(self) -> Result<CallResponse<(Principal,)>, AgentError> {
         self.build()?.call().await
     }
 
-    /// Make a call. This is equivalent to the [AsyncCall::call_and_wait].
+    /// Make a call. This is equivalent to the [`AsyncCall::call_and_wait`].
     pub async fn call_and_wait(self) -> Result<(Principal,), AgentError> {
         self.build()?.call_and_wait().await
     }
@@ -496,8 +496,8 @@ pub struct CanisterUpgradeOptions {
 }
 
 /// The install mode of the canister to install. If a canister is already installed,
-/// using [InstallMode::Install] will be an error. [InstallMode::Reinstall] overwrites
-/// the module, and [InstallMode::Upgrade] performs an Upgrade step.
+/// using [`InstallMode::Install`] will be an error. [`InstallMode::Reinstall`] overwrites
+/// the module, and [`InstallMode::Upgrade`] performs an Upgrade step.
 #[derive(Debug, Copy, Clone, CandidType, Deserialize, Eq, PartialEq)]
 pub enum InstallMode {
     /// Install the module into the empty canister.
@@ -534,7 +534,7 @@ impl FromStr for InstallMode {
             "install" => Ok(InstallMode::Install),
             "reinstall" => Ok(InstallMode::Reinstall),
             "upgrade" => Ok(InstallMode::Upgrade(None)),
-            &_ => Err(format!("Invalid install mode: {}", s)),
+            &_ => Err(format!("Invalid install mode: {s}")),
         }
     }
 }
@@ -550,7 +550,7 @@ pub struct InstallCodeBuilder<'agent, 'canister: 'agent> {
 }
 
 impl<'agent, 'canister: 'agent> InstallCodeBuilder<'agent, 'canister> {
-    /// Create an InstallCode builder, which is also an AsyncCall implementation.
+    /// Create an `InstallCode` builder, which is also an `AsyncCall` implementation.
     pub fn builder(
         canister: &'canister Canister<'agent>,
         canister_id: &Principal,
@@ -587,7 +587,7 @@ impl<'agent, 'canister: 'agent> InstallCodeBuilder<'agent, 'canister> {
         self
     }
 
-    /// Pass in the [InstallMode].
+    /// Pass in the [`InstallMode`].
     pub fn with_mode(self, mode: InstallMode) -> Self {
         Self {
             mode: Some(mode),
@@ -595,7 +595,7 @@ impl<'agent, 'canister: 'agent> InstallCodeBuilder<'agent, 'canister> {
         }
     }
 
-    /// Create an [AsyncCall] implementation that, when called, will install the
+    /// Create an [`AsyncCall`] implementation that, when called, will install the
     /// canister.
     pub fn build(self) -> Result<impl 'agent + AsyncCall<Value = ()>, AgentError> {
         Ok(self
@@ -611,12 +611,12 @@ impl<'agent, 'canister: 'agent> InstallCodeBuilder<'agent, 'canister> {
             .build())
     }
 
-    /// Make a call. This is equivalent to the [AsyncCall::call].
+    /// Make a call. This is equivalent to the [`AsyncCall::call`].
     pub async fn call(self) -> Result<CallResponse<()>, AgentError> {
         self.build()?.call().await
     }
 
-    /// Make a call. This is equivalent to the [AsyncCall::call_and_wait].
+    /// Make a call. This is equivalent to the [`AsyncCall::call_and_wait`].
     pub async fn call_and_wait(self) -> Result<(), AgentError> {
         self.build()?.call_and_wait().await
     }
@@ -840,7 +840,7 @@ impl<'agent: 'canister, 'canister: 'builder, 'builder> InstallBuilder<'agent, 'c
         self
     }
 
-    /// Pass in the [InstallMode].
+    /// Pass in the [`InstallMode`].
     pub fn with_mode(self, mode: InstallMode) -> Self {
         Self { mode, ..self }
     }
@@ -895,7 +895,7 @@ impl<'agent: 'canister, 'canister: 'builder, 'builder> InstallBuilder<'agent, 'c
                                 .call_and_wait()
                                 .await?;
                             Ok(())
-                        })
+                        });
                     }
                     let install_chunked_code_stream = async move {
                         let results = all_chunks.iter().map(|(hash,_)| ChunkHash{ hash: hash.clone() }).collect();
@@ -960,7 +960,7 @@ pub struct UpdateCanisterBuilder<'agent, 'canister: 'agent> {
 }
 
 impl<'agent, 'canister: 'agent> UpdateCanisterBuilder<'agent, 'canister> {
-    /// Create an UpdateCanister builder, which is also an AsyncCall implementation.
+    /// Create an `UpdateCanister` builder, which is also an `AsyncCall` implementation.
     pub fn builder(canister: &'canister Canister<'agent>, canister_id: &Principal) -> Self {
         Self {
             canister,
@@ -984,7 +984,7 @@ impl<'agent, 'canister: 'agent> UpdateCanisterBuilder<'agent, 'canister> {
     {
         let controller_to_add: Option<Result<Principal, _>> = controller.map(|ca| {
             ca.try_into()
-                .map_err(|e| AgentError::MessageError(format!("{}", e)))
+                .map_err(|e| AgentError::MessageError(format!("{e}")))
         });
         let controllers: Option<Result<Vec<Principal>, _>> =
             match (controller_to_add, self.controllers) {
@@ -1024,7 +1024,7 @@ impl<'agent, 'canister: 'agent> UpdateCanisterBuilder<'agent, 'canister> {
         Self {
             compute_allocation: compute_allocation.map(|ca| {
                 ca.try_into()
-                    .map_err(|e| AgentError::MessageError(format!("{}", e)))
+                    .map_err(|e| AgentError::MessageError(format!("{e}")))
             }),
             ..self
         }
@@ -1049,7 +1049,7 @@ impl<'agent, 'canister: 'agent> UpdateCanisterBuilder<'agent, 'canister> {
         Self {
             memory_allocation: memory_allocation.map(|ma| {
                 ma.try_into()
-                    .map_err(|e| AgentError::MessageError(format!("{}", e)))
+                    .map_err(|e| AgentError::MessageError(format!("{e}")))
             }),
             ..self
         }
@@ -1074,7 +1074,7 @@ impl<'agent, 'canister: 'agent> UpdateCanisterBuilder<'agent, 'canister> {
         Self {
             freezing_threshold: freezing_threshold.map(|ma| {
                 ma.try_into()
-                    .map_err(|e| AgentError::MessageError(format!("{}", e)))
+                    .map_err(|e| AgentError::MessageError(format!("{e}")))
             }),
             ..self
         }
@@ -1108,7 +1108,7 @@ impl<'agent, 'canister: 'agent> UpdateCanisterBuilder<'agent, 'canister> {
         Self {
             reserved_cycles_limit: limit.map(|ma| {
                 ma.try_into()
-                    .map_err(|e| AgentError::MessageError(format!("{}", e)))
+                    .map_err(|e| AgentError::MessageError(format!("{e}")))
             }),
             ..self
         }
@@ -1134,7 +1134,7 @@ impl<'agent, 'canister: 'agent> UpdateCanisterBuilder<'agent, 'canister> {
             wasm_memory_limit: wasm_memory_limit.map(|limit| {
                 limit
                     .try_into()
-                    .map_err(|e| AgentError::MessageError(format!("{}", e)))
+                    .map_err(|e| AgentError::MessageError(format!("{e}")))
             }),
             ..self
         }
@@ -1160,13 +1160,13 @@ impl<'agent, 'canister: 'agent> UpdateCanisterBuilder<'agent, 'canister> {
             log_visibility: log_visibility.map(|limit| {
                 limit
                     .try_into()
-                    .map_err(|e| AgentError::MessageError(format!("{}", e)))
+                    .map_err(|e| AgentError::MessageError(format!("{e}")))
             }),
             ..self
         }
     }
 
-    /// Create an [AsyncCall] implementation that, when called, will update a
+    /// Create an [`AsyncCall`] implementation that, when called, will update a
     /// canisters settings.
     pub fn build(self) -> Result<impl 'agent + AsyncCall<Value = ()>, AgentError> {
         #[derive(CandidType)]
@@ -1176,37 +1176,37 @@ impl<'agent, 'canister: 'agent> UpdateCanisterBuilder<'agent, 'canister> {
         }
 
         let controllers = match self.controllers {
-            Some(Err(x)) => return Err(AgentError::MessageError(format!("{}", x))),
+            Some(Err(x)) => return Err(AgentError::MessageError(format!("{x}"))),
             Some(Ok(x)) => Some(x),
             None => None,
         };
         let compute_allocation = match self.compute_allocation {
-            Some(Err(x)) => return Err(AgentError::MessageError(format!("{}", x))),
+            Some(Err(x)) => return Err(AgentError::MessageError(format!("{x}"))),
             Some(Ok(x)) => Some(Nat::from(u8::from(x))),
             None => None,
         };
         let memory_allocation = match self.memory_allocation {
-            Some(Err(x)) => return Err(AgentError::MessageError(format!("{}", x))),
+            Some(Err(x)) => return Err(AgentError::MessageError(format!("{x}"))),
             Some(Ok(x)) => Some(Nat::from(u64::from(x))),
             None => None,
         };
         let freezing_threshold = match self.freezing_threshold {
-            Some(Err(x)) => return Err(AgentError::MessageError(format!("{}", x))),
+            Some(Err(x)) => return Err(AgentError::MessageError(format!("{x}"))),
             Some(Ok(x)) => Some(Nat::from(u64::from(x))),
             None => None,
         };
         let reserved_cycles_limit = match self.reserved_cycles_limit {
-            Some(Err(x)) => return Err(AgentError::MessageError(format!("{}", x))),
+            Some(Err(x)) => return Err(AgentError::MessageError(format!("{x}"))),
             Some(Ok(x)) => Some(Nat::from(u128::from(x))),
             None => None,
         };
         let wasm_memory_limit = match self.wasm_memory_limit {
-            Some(Err(x)) => return Err(AgentError::MessageError(format!("{}", x))),
+            Some(Err(x)) => return Err(AgentError::MessageError(format!("{x}"))),
             Some(Ok(x)) => Some(Nat::from(u64::from(x))),
             None => None,
         };
         let log_visibility = match self.log_visibility {
-            Some(Err(x)) => return Err(AgentError::MessageError(format!("{}", x))),
+            Some(Err(x)) => return Err(AgentError::MessageError(format!("{x}"))),
             Some(Ok(x)) => Some(x),
             None => None,
         };
@@ -1230,12 +1230,12 @@ impl<'agent, 'canister: 'agent> UpdateCanisterBuilder<'agent, 'canister> {
             .build())
     }
 
-    /// Make a call. This is equivalent to the [AsyncCall::call].
+    /// Make a call. This is equivalent to the [`AsyncCall::call`].
     pub async fn call(self) -> Result<CallResponse<()>, AgentError> {
         self.build()?.call().await
     }
 
-    /// Make a call. This is equivalent to the [AsyncCall::call_and_wait].
+    /// Make a call. This is equivalent to the [`AsyncCall::call_and_wait`].
     pub async fn call_and_wait(self) -> Result<(), AgentError> {
         self.build()?.call_and_wait().await
     }
diff --git a/ic-utils/src/interfaces/wallet.rs b/ic-utils/src/interfaces/wallet.rs
index a93041b8..f9019076 100644
--- a/ic-utils/src/interfaces/wallet.rs
+++ b/ic-utils/src/interfaces/wallet.rs
@@ -95,14 +95,14 @@ where
             self.wallet.update("wallet_call128").with_arg(In {
                 canister: self.destination,
                 method_name: self.method_name,
-                args: self.arg.serialize()?.to_vec(),
+                args: self.arg.serialize()?,
                 cycles: self.amount,
             })
         } else {
             self.wallet.update("wallet_call").with_arg(In {
                 canister: self.destination,
                 method_name: self.method_name,
-                args: self.arg.serialize()?.to_vec(),
+                args: self.arg.serialize()?,
                 cycles: u64::try_from(self.amount).map_err(|_| {
                     AgentError::WalletUpgradeRequired(
                         "The installed wallet does not support cycle counts >2^64-1".to_string(),
@@ -239,21 +239,21 @@ impl From<EventKind<u64>> for EventKind {
                 method_name,
             } => CanisterCalled {
                 canister,
-                cycles: cycles as u128,
+                cycles: cycles.into(),
                 method_name,
             },
             CanisterCreated { canister, cycles } => CanisterCreated {
                 canister,
-                cycles: cycles as u128,
+                cycles: cycles.into(),
             },
             CyclesReceived { amount, from, memo } => CyclesReceived {
-                amount: amount as u128,
+                amount: amount.into(),
                 from,
                 memo,
             },
             CyclesSent { amount, refund, to } => CyclesSent {
-                amount: amount as u128,
-                refund: refund as u128,
+                amount: amount.into(),
+                refund: refund.into(),
                 to,
             },
         }
@@ -365,15 +365,15 @@ impl From<ManagedCanisterEventKind<u64>> for ManagedCanisterEventKind {
                 cycles,
                 method_name,
             } => Called {
-                cycles: cycles as u128,
+                cycles: cycles.into(),
                 method_name,
             },
             Created { cycles } => Created {
-                cycles: cycles as u128,
+                cycles: cycles.into(),
             },
             CyclesSent { amount, refund } => CyclesSent {
-                amount: amount as u128,
-                refund: refund as u128,
+                amount: amount.into(),
+                refund: refund.into(),
             },
         }
     }
@@ -543,7 +543,7 @@ impl<'agent> WalletCanister<'agent> {
                 .call()
                 .await
                 .map(|(r,)| BalanceResult {
-                    amount: r.amount as u128,
+                    amount: r.amount.into(),
                 })
         }
     }
@@ -932,7 +932,7 @@ impl<'agent> WalletCanister<'agent> {
     }
 
     /// Store the wallet WASM inside the wallet canister.
-    /// This is needed to enable wallet_create_wallet
+    /// This is needed to enable `wallet_create_wallet`
     pub fn wallet_store_wallet_wasm(
         &self,
         wasm_module: Vec<u8>,
@@ -1017,7 +1017,7 @@ impl<'agent> WalletCanister<'agent> {
             self.get_events64(from, to)
                 .call()
                 .await
-                .map(|(events,)| events.into_iter().map(|event| event.into()).collect())
+                .map(|(events,)| events.into_iter().map(Event::into).collect())
         }
     }
 
@@ -1037,7 +1037,7 @@ impl<'agent> WalletCanister<'agent> {
             wallet: self,
             destination,
             method_name: method_name.into(),
-            amount: amount as u128,
+            amount: amount.into(),
             arg,
             phantom_out: std::marker::PhantomData,
             u128: false,
@@ -1159,7 +1159,8 @@ impl<'agent> WalletCanister<'agent> {
                 .call()
                 .await
                 .map(|(events,)| {
-                    events.map(|events| events.into_iter().map(|event| event.into()).collect())
+                    events
+                        .map(|events| events.into_iter().map(ManagedCanisterEvent::into).collect())
                 })
         }
     }
diff --git a/icx-cert/src/pprint.rs b/icx-cert/src/pprint.rs
index 852843c4..be0b6fee 100644
--- a/icx-cert/src/pprint.rs
+++ b/icx-cert/src/pprint.rs
@@ -99,16 +99,13 @@ pub fn pprint(url: String, accept_encodings: Option<Vec<String>>) -> Result<()>
         .bytes()
         .with_context(|| "failed to get response body")?;
     let certificate_str = certificate_header.to_str().with_context(|| {
-        format!(
-            "failed to convert certificate header {:?} to string",
-            certificate_header
-        )
+        format!("failed to convert certificate header {certificate_header:?} to string")
     })?;
     let structured_header = parse_structured_cert_header(certificate_str)?;
     let tree: HashTree = parse_base64_cbor(structured_header.tree)?;
     let cert: ReplicaCertificate = parse_base64_cbor(structured_header.certificate)?;
 
-    println!("STATUS: {}", status);
+    println!("STATUS: {status}");
     println!("ROOT HASH: {}", hex::encode(cert.tree.digest()));
     if let Some(content_encoding) = content_encoding {
         println!("CONTENT-ENCODING: {}", content_encoding.to_str().unwrap());
@@ -122,12 +119,12 @@ pub fn pprint(url: String, accept_encodings: Option<Vec<String>>) -> Result<()>
     if let LookupResult::Found(mut date_bytes) = cert.tree.lookup_path(&["time"]) {
         let timestamp_nanos = leb128::read::unsigned(&mut date_bytes)
             .with_context(|| "failed to decode certificate time as LEB128")?;
-        let dt = OffsetDateTime::from_unix_timestamp_nanos(timestamp_nanos as i128)
+        let dt = OffsetDateTime::from_unix_timestamp_nanos(timestamp_nanos.into())
             .context("timestamp out of range")?;
         println!("CERTIFICATE TIME: {}", dt.format(&Rfc3339)?);
     }
     println!("CERTIFICATE TREE: {:#?}", cert.tree);
-    println!("TREE:             {:#?}", tree);
+    println!("TREE:             {tree:#?}");
     Ok(())
 }
 
diff --git a/icx/Cargo.toml b/icx/Cargo.toml
index 61eb7f6d..db8f197f 100644
--- a/icx/Cargo.toml
+++ b/icx/Cargo.toml
@@ -23,11 +23,12 @@ anyhow = { version = "1.0", features = ["backtrace"] }
 candid = { workspace = true, features = ["value"] }
 candid_parser = { workspace = true }
 clap = { workspace = true, features = ["derive", "cargo", "color"] }
+ed25519-consensus = { workspace = true }
 hex = { workspace = true }
 humantime = "2.0.1"
 ic-agent = { workspace = true, default-features = true }
 ic-utils = { workspace = true }
-ring = { workspace = true }
+rand = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }
 tokio = { workspace = true, features = ["full"] }
diff --git a/icx/src/main.rs b/icx/src/main.rs
index 1b74c074..d6ab7c3f 100644
--- a/icx/src/main.rs
+++ b/icx/src/main.rs
@@ -6,6 +6,7 @@ use candid::{
 };
 use candid_parser::{check_prog, parse_idl_args, parse_idl_value, IDLProg};
 use clap::{crate_authors, crate_version, Parser, ValueEnum};
+use ed25519_consensus::SigningKey;
 use ic_agent::{
     agent::{
         self,
@@ -21,7 +22,7 @@ use ic_utils::interfaces::management_canister::{
     builders::{CanisterInstall, CanisterSettings},
     MgmtMethod,
 };
-use ring::signature::Ed25519KeyPair;
+use rand::thread_rng;
 use std::{
     collections::VecDeque, convert::TryFrom, io::BufRead, path::PathBuf, str::FromStr,
     time::Duration,
@@ -36,7 +37,7 @@ const DEFAULT_IC_GATEWAY: &str = "https://ic0.app";
     propagate_version(true),
 )]
 struct Opts {
-    /// Some input. Because this isn't an Option<T> it's required to be used
+    /// The URL of the replica.
     #[clap(default_value = "http://localhost:8000/")]
     replica: String,
 
@@ -114,7 +115,7 @@ impl std::str::FromStr for ArgType {
         match s {
             "idl" => Ok(ArgType::Idl),
             "raw" => Ok(ArgType::Raw),
-            other => Err(format!("invalid argument type: {}", other)),
+            other => Err(format!("invalid argument type: {other}")),
         }
     }
 }
@@ -129,25 +130,21 @@ struct PrincipalConvertOpts {
     to_hex: Option<String>,
 }
 
-/// Parse IDL file into TypeEnv. This is a best effort function: it will succeed if
+/// Parse IDL file into `TypeEnv`. This is a best effort function: it will succeed if
 /// the IDL file can be parsed and type checked in Rust parser, and has an
 /// actor in the IDL file. If anything fails, it returns None.
 pub fn get_candid_type(
     idl_path: &std::path::Path,
     method_name: &str,
 ) -> Result<Option<(TypeEnv, Function)>> {
-    let (env, ty) = check_candid_file(idl_path).with_context(|| {
-        format!(
-            "Failed when checking candid file: {}",
-            idl_path.to_string_lossy()
-        )
-    })?;
+    let (env, ty) = check_candid_file(idl_path)
+        .with_context(|| format!("Failed when checking candid file: {}", idl_path.display()))?;
     match ty {
         None => Ok(None),
         Some(actor) => {
             let method = env
                 .get_method(&actor, method_name)
-                .with_context(|| format!("Failed to get method: {}", method_name))?
+                .with_context(|| format!("Failed to get method: {method_name}"))?
                 .clone();
             Ok(Some((env, method)))
         }
@@ -157,17 +154,14 @@ pub fn get_candid_type(
 pub fn check_candid_file(idl_path: &std::path::Path) -> Result<(TypeEnv, Option<Type>)> {
     let idl_file = std::fs::read_to_string(idl_path)
         .with_context(|| format!("Failed to read Candid file: {}", idl_path.to_string_lossy()))?;
-    let ast = idl_file.parse::<IDLProg>().with_context(|| {
-        format!(
-            "Failed to parse the Candid file: {}",
-            idl_path.to_string_lossy()
-        )
-    })?;
+    let ast = idl_file
+        .parse::<IDLProg>()
+        .with_context(|| format!("Failed to parse the Candid file: {}", idl_path.display()))?;
     let mut env = TypeEnv::new();
     let actor = check_prog(&mut env, &ast).with_context(|| {
         format!(
             "Failed to type check the Candid file: {}",
-            idl_path.to_string_lossy()
+            idl_path.display()
         )
     })?;
     Ok((env, actor))
@@ -236,7 +230,7 @@ fn print_idl_blob(
     let hex_string = hex::encode(blob);
     match output_type {
         ArgType::Raw => {
-            println!("{}", hex_string);
+            println!("{hex_string}");
         }
         ArgType::Idl => {
             let result = match method_type {
@@ -245,7 +239,7 @@ fn print_idl_blob(
             };
             println!(
                 "{}",
-                result.with_context(|| format!("Failed to deserialize blob 0x{}", hex_string))?
+                result.with_context(|| format!("Failed to deserialize blob 0x{hex_string}"))?
             );
         }
     }
@@ -270,10 +264,7 @@ pub fn get_effective_canister_id(
 ) -> Result<Principal> {
     if is_management_canister {
         let method_name = MgmtMethod::from_str(method_name).with_context(|| {
-            format!(
-                "Attempted to call an unsupported management canister method: {}",
-                method_name
-            )
+            format!("Attempted to call an unsupported management canister method: {method_name}")
         })?;
         match method_name {
             MgmtMethod::CreateCanister | MgmtMethod::RawRand => bail!(
@@ -332,6 +323,7 @@ pub fn get_effective_canister_id(
             | MgmtMethod::BitcoinGetUtxos
             | MgmtMethod::BitcoinSendTransaction
             | MgmtMethod::BitcoinGetCurrentFeePercentiles
+            | MgmtMethod::BitcoinGetBlockHeaders
             | MgmtMethod::EcdsaPublicKey
             | MgmtMethod::SignWithEcdsa
             | MgmtMethod::NodeMetricsHistory => {
@@ -347,15 +339,7 @@ fn create_identity(maybe_pem: Option<PathBuf>) -> impl Identity {
     if let Some(pem_path) = maybe_pem {
         BasicIdentity::from_pem_file(pem_path).expect("Could not read the key pair.")
     } else {
-        let rng = ring::rand::SystemRandom::new();
-        let pkcs8_bytes = ring::signature::Ed25519KeyPair::generate_pkcs8(&rng)
-            .expect("Could not generate a key pair.")
-            .as_ref()
-            .to_vec();
-
-        BasicIdentity::from_key_pair(
-            Ed25519KeyPair::from_pkcs8(&pkcs8_bytes).expect("Could not generate the key pair."),
-        )
+        BasicIdentity::from_signing_key(SigningKey::new(thread_rng()))
     }
 }
 
@@ -374,7 +358,7 @@ async fn main() -> Result<()> {
     match &opts.subcommand {
         SubCommand::Update(t) | SubCommand::Query(t) => {
             let maybe_candid_path = t.candid.as_ref();
-            let expire_after: Option<std::time::Duration> = opts.ttl.map(|ht| ht.into());
+            let expire_after: Option<std::time::Duration> = opts.ttl.map(Into::into);
 
             let method_type = match maybe_candid_path {
                 None => None,
@@ -393,7 +377,51 @@ async fn main() -> Result<()> {
             )
             .context("Failed to get effective_canister_id for this call")?;
 
-            if !t.serialize {
+            if t.serialize {
+                match &opts.subcommand {
+                    SubCommand::Update(_) => {
+                        // For local emulator, we need to fetch the root key for updates.
+                        // So on an air-gapped machine, we can only generate message for the IC main net
+                        // which agent hard-coded its root key
+                        fetch_root_key_from_non_ic(&agent, &opts.replica).await?;
+
+                        let mut builder = agent.update(&t.canister_id, &t.method_name);
+                        if let Some(d) = expire_after {
+                            builder = builder.expire_after(d);
+                        }
+                        let signed_update = builder
+                            .with_arg(arg)
+                            .with_effective_canister_id(effective_canister_id)
+                            .sign()
+                            .context("Failed to sign the update call")?;
+                        let serialized = serde_json::to_string(&signed_update).unwrap();
+                        println!("{serialized}");
+
+                        let signed_request_status = agent
+                            .sign_request_status(effective_canister_id, signed_update.request_id)
+                            .context(
+                                "Failed to sign the request_status call accompany with the update",
+                            )?;
+                        let serialized = serde_json::to_string(&signed_request_status).unwrap();
+                        println!("{serialized}");
+                    }
+                    &SubCommand::Query(_) => {
+                        fetch_root_key_from_non_ic(&agent, &opts.replica).await?;
+                        let mut builder = agent.query(&t.canister_id, &t.method_name);
+                        if let Some(d) = expire_after {
+                            builder = builder.expire_after(d);
+                        }
+                        let signed_query = builder
+                            .with_arg(arg)
+                            .with_effective_canister_id(effective_canister_id)
+                            .sign()
+                            .context("Failed to sign the query call")?;
+                        let serialized = serde_json::to_string(&signed_query).unwrap();
+                        println!("{serialized}");
+                    }
+                    _ => unreachable!(),
+                }
+            } else {
                 let result = match &opts.subcommand {
                     SubCommand::Update(_) => {
                         // We need to fetch the root key for updates.
@@ -450,11 +478,11 @@ async fn main() -> Result<()> {
                         content,
                     })) => {
                         let mut error_message =
-                            format!("Server returned an HTTP Error:\n  Code: {}\n", status);
+                            format!("Server returned an HTTP Error:\n  Code: {status}\n");
                         match content_type.as_deref() {
                             None => error_message
                                 .push_str(&format!("  Content: {}\n", hex::encode(content))),
-                            Some("text/plain; charset=UTF-8") | Some("text/plain") => {
+                            Some("text/plain; charset=UTF-8" | "text/plain") => {
                                 error_message.push_str("  ContentType: text/plain\n");
                                 error_message.push_str(&format!(
                                     "  Content:     {}\n",
@@ -462,7 +490,7 @@ async fn main() -> Result<()> {
                                 ));
                             }
                             Some(x) => {
-                                error_message.push_str(&format!("  ContentType: {}\n", x));
+                                error_message.push_str(&format!("  ContentType: {x}\n"));
                                 error_message.push_str(&format!(
                                     "  Content:     {}\n",
                                     hex::encode(&content)
@@ -473,50 +501,6 @@ async fn main() -> Result<()> {
                     }
                     Err(s) => Err(s).context("Got an error when make the canister call")?,
                 }
-            } else {
-                match &opts.subcommand {
-                    SubCommand::Update(_) => {
-                        // For local emulator, we need to fetch the root key for updates.
-                        // So on an air-gapped machine, we can only generate message for the IC main net
-                        // which agent hard-coded its root key
-                        fetch_root_key_from_non_ic(&agent, &opts.replica).await?;
-
-                        let mut builder = agent.update(&t.canister_id, &t.method_name);
-                        if let Some(d) = expire_after {
-                            builder = builder.expire_after(d);
-                        }
-                        let signed_update = builder
-                            .with_arg(arg)
-                            .with_effective_canister_id(effective_canister_id)
-                            .sign()
-                            .context("Failed to sign the update call")?;
-                        let serialized = serde_json::to_string(&signed_update).unwrap();
-                        println!("{}", serialized);
-
-                        let signed_request_status = agent
-                            .sign_request_status(effective_canister_id, signed_update.request_id)
-                            .context(
-                                "Failed to sign the request_status call accompany with the update",
-                            )?;
-                        let serialized = serde_json::to_string(&signed_request_status).unwrap();
-                        println!("{}", serialized);
-                    }
-                    &SubCommand::Query(_) => {
-                        fetch_root_key_from_non_ic(&agent, &opts.replica).await?;
-                        let mut builder = agent.query(&t.canister_id, &t.method_name);
-                        if let Some(d) = expire_after {
-                            builder = builder.expire_after(d);
-                        }
-                        let signed_query = builder
-                            .with_arg(arg)
-                            .with_effective_canister_id(effective_canister_id)
-                            .sign()
-                            .context("Failed to sign the query call")?;
-                        let serialized = serde_json::to_string(&signed_query).unwrap();
-                        println!("{}", serialized);
-                    }
-                    _ => unreachable!(),
-                }
             }
         }
         SubCommand::Status => {
@@ -524,13 +508,13 @@ async fn main() -> Result<()> {
                 .status()
                 .await
                 .context("Failed to get network status")?;
-            println!("{:#}", status);
+            println!("{status:#}");
         }
         SubCommand::PrincipalConvert(t) => {
             if let Some(hex) = &t.from_hex {
                 let p = Principal::try_from(hex::decode(hex).expect("Could not decode hex: {}"))
                     .expect("Could not transform into a Principal: {}");
-                eprintln!("Principal: {}", p);
+                eprintln!("Principal: {p}");
             } else if let Some(txt) = &t.to_hex {
                 let p = Principal::from_text(txt.as_str())
                     .expect("Could not transform into a Principal: {}");
@@ -548,7 +532,7 @@ async fn main() -> Result<()> {
                 buffer.push_str(&line);
             }
 
-            println!("{}", buffer);
+            println!("{buffer}");
 
             if let Ok(signed_update) = serde_json::from_str::<SignedUpdate>(&buffer) {
                 fetch_root_key_from_non_ic(&agent, &opts.replica).await?;
@@ -583,7 +567,7 @@ async fn main() -> Result<()> {
                 serde_json::from_str::<SignedRequestStatus>(&buffer)
             {
                 fetch_root_key_from_non_ic(&agent, &opts.replica).await?;
-                let response = agent
+                let (response, _) = agent
                     .request_status_signed(
                         &signed_request_status.request_id,
                         signed_request_status.effective_canister_id,
diff --git a/ref-tests/Cargo.toml b/ref-tests/Cargo.toml
index c4505767..6a568013 100644
--- a/ref-tests/Cargo.toml
+++ b/ref-tests/Cargo.toml
@@ -8,10 +8,13 @@ publish = false
 
 [dependencies]
 candid = { workspace = true }
+ed25519-consensus = { workspace = true }
 ic-agent = { path = "../ic-agent" }
 ic-identity-hsm = { path = "../ic-identity-hsm" }
 ic-utils = { path = "../ic-utils", features = ["raw"] }
-ring = { workspace = true }
+k256 = { workspace = true }
+p256 = { workspace = true }
+rand = { workspace = true }
 serde = { workspace = true, features = ["derive"] }
 sha2 = { workspace = true }
 tokio = { workspace = true, features = ["full"] }
diff --git a/ref-tests/src/utils.rs b/ref-tests/src/utils.rs
index d6938dfc..186e7c29 100644
--- a/ref-tests/src/utils.rs
+++ b/ref-tests/src/utils.rs
@@ -1,8 +1,9 @@
+use ed25519_consensus::SigningKey;
 use ic_agent::identity::{Prime256v1Identity, Secp256k1Identity};
 use ic_agent::{export::Principal, identity::BasicIdentity, Agent, Identity};
 use ic_identity_hsm::HardwareIdentity;
 use ic_utils::interfaces::{management_canister::builders::MemoryAllocation, ManagementCanister};
-use ring::signature::Ed25519KeyPair;
+use rand::thread_rng;
 use std::{convert::TryFrom, error::Error, future::Future, path::Path};
 
 const HSM_PKCS11_LIBRARY_PATH: &str = "HSM_PKCS11_LIBRARY_PATH";
@@ -49,13 +50,9 @@ fn get_hsm_pin() -> Result<String, String> {
 //
 // A shared container of Ctx objects might be possible instead, but my rust-fu is inadequate.
 pub fn create_basic_identity() -> Result<BasicIdentity, String> {
-    let rng = ring::rand::SystemRandom::new();
-    let key_pair = ring::signature::Ed25519KeyPair::generate_pkcs8(&rng)
-        .expect("Could not generate a key pair.");
+    let sk = SigningKey::new(thread_rng());
 
-    Ok(BasicIdentity::from_key_pair(
-        Ed25519KeyPair::from_pkcs8(key_pair.as_ref()).expect("Could not read the key pair."),
-    ))
+    Ok(BasicIdentity::from_signing_key(sk))
 }
 
 /// Create a secp256k1identity, which unfortunately will always be the same one
diff --git a/ref-tests/tests/ic-ref.rs b/ref-tests/tests/ic-ref.rs
index b0fb6975..fa005d7e 100644
--- a/ref-tests/tests/ic-ref.rs
+++ b/ref-tests/tests/ic-ref.rs
@@ -892,7 +892,7 @@ mod management_canister {
     fn subnet_metrics() {
         with_universal_canister(|agent, _| async move {
             let metrics = agent
-                .read_state_subnet_metrics(Principal::self_authenticating(&agent.read_root_key()))
+                .read_state_subnet_metrics(Principal::self_authenticating(agent.read_root_key()))
                 .await?;
             assert!(
                 metrics.num_canisters >= 1,
diff --git a/ref-tests/tests/integration.rs b/ref-tests/tests/integration.rs
index 8ad2b4ec..4288ff19 100644
--- a/ref-tests/tests/integration.rs
+++ b/ref-tests/tests/integration.rs
@@ -138,7 +138,7 @@ fn wait_signed() {
 
         let read_envelope_serialized = serialized_bytes(read_state_envelope);
 
-        let result = agent
+        let (result, _) = agent
             .wait_signed(&call_request_id, canister_id, read_envelope_serialized)
             .await
             .unwrap();
@@ -261,7 +261,7 @@ fn wallet_canister_create_and_install() {
         let args = Argument::from_candid((install_config,));
 
         wallet
-            .call64(Principal::management_canister(), "install_code", args, 0)
+            .call64::<(), _>(Principal::management_canister(), "install_code", args, 0)
             .call_and_wait()
             .await?;
 
@@ -629,7 +629,7 @@ mod sign_send {
             let ten_secs = time::Duration::from_secs(10);
             thread::sleep(ten_secs);
 
-            let response = agent
+            let (response, _) = agent
                 .request_status_signed(
                     &signed_request_status.request_id,
                     signed_request_status.effective_canister_id,
@@ -673,27 +673,60 @@ mod sign_send {
 
 mod identity {
     use candid::Principal;
+    use ed25519_consensus::SigningKey;
     use ic_agent::{
-        identity::{BasicIdentity, DelegatedIdentity, Delegation, SignedDelegation},
+        identity::{
+            BasicIdentity, DelegatedIdentity, Delegation, Prime256v1Identity, Secp256k1Identity,
+            SignedDelegation,
+        },
         Identity,
     };
+    use rand::thread_rng;
     use ref_tests::{universal_canister::payload, with_universal_canister_as};
-    use ring::{
-        rand::{SecureRandom, SystemRandom},
-        signature::Ed25519KeyPair,
-    };
 
     #[ignore]
     #[test]
-    fn delegated_identity() {
-        let random = SystemRandom::new();
-        let mut seed = [0; 32];
-        random.fill(&mut seed).unwrap();
+    fn delegated_eddsa_identity() {
+        let mut random = thread_rng();
+        let sending_identity = BasicIdentity::from_signing_key(SigningKey::new(&mut random));
+        let signing_identity = BasicIdentity::from_signing_key(SigningKey::new(&mut random));
+        let delegation = Delegation {
+            expiration: i64::MAX as u64,
+            pubkey: signing_identity.public_key().unwrap(),
+            targets: None,
+        };
+        let signature = sending_identity.sign_delegation(&delegation).unwrap();
+        let delegated_identity = DelegatedIdentity::new(
+            signature.public_key.unwrap(),
+            Box::new(signing_identity),
+            vec![SignedDelegation {
+                delegation,
+                signature: signature.signature.unwrap(),
+            }],
+        )
+        .unwrap();
+        with_universal_canister_as(delegated_identity, |agent, canister| async move {
+            let payload = payload().caller().append_and_reply().build();
+            let caller_resp = agent
+                .query(&canister, "query")
+                .with_arg(payload)
+                .call()
+                .await
+                .unwrap();
+            let caller = Principal::from_slice(&caller_resp);
+            assert_eq!(caller, sending_identity.sender().unwrap());
+            Ok(())
+        })
+    }
+
+    #[ignore]
+    #[test]
+    fn delegated_ecdsa_identity() {
+        let mut random = thread_rng();
         let sending_identity =
-            BasicIdentity::from_key_pair(Ed25519KeyPair::from_seed_unchecked(&seed).unwrap());
-        random.fill(&mut seed).unwrap();
+            Secp256k1Identity::from_private_key(k256::SecretKey::random(&mut random));
         let signing_identity =
-            BasicIdentity::from_key_pair(Ed25519KeyPair::from_seed_unchecked(&seed).unwrap());
+            Prime256v1Identity::from_private_key(p256::SecretKey::random(&mut random));
         let delegation = Delegation {
             expiration: i64::MAX as u64,
             pubkey: signing_identity.public_key().unwrap(),
@@ -707,7 +740,8 @@ mod identity {
                 delegation,
                 signature: signature.signature.unwrap(),
             }],
-        );
+        )
+        .unwrap();
         with_universal_canister_as(delegated_identity, |agent, canister| async move {
             let payload = payload().caller().append_and_reply().build();
             let caller_resp = agent