diff --git a/test/integration/e2e_test.go b/test/integration/e2e_test.go
index 35f67e1d..ba77759b 100644
--- a/test/integration/e2e_test.go
+++ b/test/integration/e2e_test.go
@@ -26,6 +26,7 @@ import (
 	authorizationv1 "k8s.io/api/authorization/v1"
 	corev1 "k8s.io/api/core/v1"
 	rbacv1 "k8s.io/api/rbac/v1"
+	clientcmdapi "k8s.io/client-go/tools/clientcmd/api"
 
 	authv1alpha "go.pinniped.dev/generated/latest/apis/concierge/authentication/v1alpha1"
 	configv1alpha1 "go.pinniped.dev/generated/latest/apis/supervisor/config/v1alpha1"
@@ -162,6 +163,17 @@ func TestE2EFullIntegration(t *testing.T) {
 	restConfig := library.NewRestConfigFromKubeconfig(t, kubeconfigYAML)
 	require.NotNil(t, restConfig.ExecProvider)
 	require.Equal(t, []string{"login", "oidc"}, restConfig.ExecProvider.Args[:2])
+
+	// If there is a proxy, we always want the "pinniped login oidc" command to use it, even if the
+	// parent kubectl process is connecting to an external load balancer and not using the proxy.
+	if env.Proxy != "" {
+		restConfig.ExecProvider.Env = append(restConfig.ExecProvider.Env,
+			clientcmdapi.ExecEnvVar{Name: "http_proxy", Value: env.Proxy},
+			clientcmdapi.ExecEnvVar{Name: "https_proxy", Value: env.Proxy},
+			clientcmdapi.ExecEnvVar{Name: "no_proxy", Value: "127.0.0.1"},
+		)
+	}
+
 	kubeconfigPath := filepath.Join(tempDir, "kubeconfig.yaml")
 	require.NoError(t, ioutil.WriteFile(kubeconfigPath, []byte(kubeconfigYAML), 0600))