diff --git a/internal/pkg/httpclient/pool_test.go b/internal/pkg/httpclient/pool_test.go
index f945758..62619c6 100644
--- a/internal/pkg/httpclient/pool_test.go
+++ b/internal/pkg/httpclient/pool_test.go
@@ -113,3 +113,121 @@ func TestValidatedTransport_ValidationErrorStopsRoundTrip(t *testing.T) {
 	require.ErrorIs(t, err, expectedErr)
 	require.Equal(t, int32(0), atomic.LoadInt32(&baseCalls))
 }
+
+func TestBuildClientKey(t *testing.T) {
+	opts1 := Options{
+		ProxyURL:              "http://proxy:8080",
+		Timeout:               30 * time.Second,
+		ResponseHeaderTimeout: 10 * time.Second,
+		InsecureSkipVerify:    false,
+		ValidateResolvedIP:    true,
+		AllowPrivateHosts:     false,
+		MaxIdleConns:          100,
+		MaxIdleConnsPerHost:   10,
+		MaxConnsPerHost:       0,
+	}
+
+	key1 := buildClientKey(opts1)
+	require.NotEmpty(t, key1)
+
+	// Same options should produce same key
+	key2 := buildClientKey(opts1)
+	require.Equal(t, key1, key2)
+
+	// Different options should produce different key
+	opts2 := opts1
+	opts2.Timeout = 60 * time.Second
+	key3 := buildClientKey(opts2)
+	require.NotEqual(t, key1, key3)
+}
+
+func TestBuildClientKeyTrimsSpaces(t *testing.T) {
+	opts1 := Options{ProxyURL: "http://proxy:8080"}
+	opts2 := Options{ProxyURL: "  http://proxy:8080  "}
+
+	key1 := buildClientKey(opts1)
+	key2 := buildClientKey(opts2)
+
+	require.Equal(t, key1, key2)
+}
+
+func TestIsValidatedHost(t *testing.T) {
+	base := roundTripFunc(func(_ *http.Request) (*http.Response, error) {
+		return &http.Response{StatusCode: http.StatusOK}, nil
+	})
+
+	transport := newValidatedTransport(base)
+	now := time.Unix(1730000000, 0)
+	transport.now = func() time.Time { return now }
+
+	host := "example.com"
+	transport.validatedHosts.Store(host, now.Add(validatedHostTTL))
+
+	require.True(t, transport.isValidatedHost(host, now))
+	require.False(t, transport.isValidatedHost(host, now.Add(validatedHostTTL+1)))
+	require.False(t, transport.isValidatedHost("other.com", now))
+}
+
+func TestIsValidatedHostNilTransport(t *testing.T) {
+	var transport *validatedTransport
+	now := time.Now()
+	require.False(t, transport.isValidatedHost("example.com", now))
+}
+
+func TestNewValidatedTransport(t *testing.T) {
+	base := roundTripFunc(func(_ *http.Request) (*http.Response, error) {
+		return &http.Response{StatusCode: http.StatusOK}, nil
+	})
+
+	transport := newValidatedTransport(base)
+	require.NotNil(t, transport)
+	require.NotNil(t, transport.base)
+	require.NotNil(t, transport.now)
+}
+
+func TestBuildClient(t *testing.T) {
+	t.Run("valid options", func(t *testing.T) {
+		opts := Options{
+			Timeout:            30 * time.Second,
+			MaxIdleConns:       100,
+			MaxIdleConnsPerHost: 10,
+		}
+
+		client, err := buildClient(opts)
+		require.NoError(t, err)
+		require.NotNil(t, client)
+	})
+
+	t.Run("insecure skip verify not allowed", func(t *testing.T) {
+		opts := Options{
+			InsecureSkipVerify: true,
+		}
+
+		_, err := buildClient(opts)
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "insecure_skip_verify is not allowed")
+	})
+}
+
+func TestBuildTransport(t *testing.T) {
+	t.Run("default values", func(t *testing.T) {
+		opts := Options{}
+		transport, err := buildTransport(opts)
+		require.NoError(t, err)
+		require.NotNil(t, transport)
+		require.Equal(t, defaultMaxIdleConns, transport.MaxIdleConns)
+		require.Equal(t, defaultMaxIdleConnsPerHost, transport.MaxIdleConnsPerHost)
+	})
+
+	t.Run("custom values", func(t *testing.T) {
+		opts := Options{
+			MaxIdleConns:        50,
+			MaxIdleConnsPerHost: 5,
+		}
+		transport, err := buildTransport(opts)
+		require.NoError(t, err)
+		require.NotNil(t, transport)
+		require.Equal(t, 50, transport.MaxIdleConns)
+		require.Equal(t, 5, transport.MaxIdleConnsPerHost)
+	})
+}