diff --git a/package.json b/package.json
index 6f81d56536e..eced648db3b 100644
--- a/package.json
+++ b/package.json
@@ -70,7 +70,7 @@
     "@parcel/watcher": "2.1.0",
     "@vscode/iconv-lite-umd": "0.7.0",
     "@vscode/policy-watcher": "^1.1.4",
-    "@vscode/proxy-agent": "^0.17.0",
+    "@vscode/proxy-agent": "^0.17.1",
     "@vscode/ripgrep": "^1.15.5",
     "@vscode/spdlog": "^0.13.10",
     "@vscode/sqlite3": "5.1.6-vscode",
diff --git a/remote/package.json b/remote/package.json
index d5ccd114e25..c68f4105b30 100644
--- a/remote/package.json
+++ b/remote/package.json
@@ -7,7 +7,7 @@
     "@microsoft/1ds-post-js": "^3.2.2",
     "@parcel/watcher": "2.1.0",
     "@vscode/iconv-lite-umd": "0.7.0",
-    "@vscode/proxy-agent": "^0.17.0",
+    "@vscode/proxy-agent": "^0.17.1",
     "@vscode/ripgrep": "^1.15.5",
     "@vscode/spdlog": "^0.13.10",
     "@vscode/vscode-languagedetection": "1.0.21",
diff --git a/remote/yarn.lock b/remote/yarn.lock
index 15557fa622e..0034d6a8a56 100644
--- a/remote/yarn.lock
+++ b/remote/yarn.lock
@@ -58,10 +58,10 @@
   resolved "https://registry.yarnpkg.com/@vscode/iconv-lite-umd/-/iconv-lite-umd-0.7.0.tgz#d2f1e0664ee6036408f9743fee264ea0699b0e48"
   integrity sha512-bRRFxLfg5dtAyl5XyiVWz/ZBPahpOpPrNYnnHpOpUZvam4tKH35wdhP4Kj6PbM0+KdliOsPzbGWpkxcdpNB/sg==
 
-"@vscode/proxy-agent@^0.17.0":
-  version "0.17.0"
-  resolved "https://registry.yarnpkg.com/@vscode/proxy-agent/-/proxy-agent-0.17.0.tgz#e60d43e2779c07c223d3bad9b7de8eedf7ca1294"
-  integrity sha512-p4gJ57KeWGw0CEG9R13dmsgmWmszoOQ836pf/PVbAf+ZRF27il3QcFvOhA10XE2QFHaOcRxuJnnIpUD1lSMvqQ==
+"@vscode/proxy-agent@^0.17.1":
+  version "0.17.1"
+  resolved "https://registry.yarnpkg.com/@vscode/proxy-agent/-/proxy-agent-0.17.1.tgz#00ea42fb3565c78c38bc99a73d4460db538aef4e"
+  integrity sha512-KWQ5y2uB6547Oudx2TMV28PdcdqNzI4J7TZzhZht1kNra8spqOzQJXw6gBdoh2mMFVpNiKgVhZ9YinWR0BZHiw==
   dependencies:
     "@tootallnate/once" "^3.0.0"
     agent-base "^7.0.1"
diff --git a/src/vs/workbench/api/node/proxyResolver.ts b/src/vs/workbench/api/node/proxyResolver.ts
index 280c66597e4..475367d27b5 100644
--- a/src/vs/workbench/api/node/proxyResolver.ts
+++ b/src/vs/workbench/api/node/proxyResolver.ts
@@ -32,7 +32,7 @@ export function connectProxyResolver(
 	const doUseHostProxy = typeof useHostProxy === 'boolean' ? useHostProxy : !initData.remote.isRemote;
 	const params: ProxyAgentParams = {
 		resolveProxy: url => extHostWorkspace.resolveProxy(url),
-		lookupProxyAuthorization: lookupProxyAuthorization.bind(undefined, extHostLogService, configProvider, {}, {}),
+		lookupProxyAuthorization: lookupProxyAuthorization.bind(undefined, extHostLogService, configProvider, {}),
 		getProxyURL: () => configProvider.getConfiguration('http').get('proxy'),
 		getProxySupport: () => configProvider.getConfiguration('http').get<ProxySupportSetting>('proxySupport') || 'off',
 		getSystemCertificatesV1: () => certSettingV1(configProvider),
@@ -121,9 +121,9 @@ async function lookupProxyAuthorization(
 	extHostLogService: ILogService,
 	configProvider: ExtHostConfigProvider,
 	proxyAuthenticateCache: Record<string, string | string[] | undefined>,
-	pendingLookups: Record<string, Promise<string | undefined>>,
 	proxyURL: string,
-	proxyAuthenticate?: string | string[]
+	proxyAuthenticate: string | string[] | undefined,
+	state: { kerberosRequested?: boolean }
 ): Promise<string | undefined> {
 	const cached = proxyAuthenticateCache[proxyURL];
 	if (proxyAuthenticate) {
@@ -132,25 +132,20 @@ async function lookupProxyAuthorization(
 	extHostLogService.trace('ProxyResolver#lookupProxyAuthorization callback', `proxyURL:${proxyURL}`, `proxyAuthenticate:${proxyAuthenticate}`, `proxyAuthenticateCache:${cached}`);
 	const header = proxyAuthenticate || cached;
 	const authenticate = Array.isArray(header) ? header : typeof header === 'string' ? [header] : [];
-	if (authenticate.some(a => /^(Negotiate|Kerberos)( |$)/i.test(a))) {
-		const lookupKey = `${proxyURL}:Negotiate`;
-		return pendingLookups[lookupKey] ??= (async () => {
-			try {
-				const kerberos = await import('kerberos');
-				const url = new URL(proxyURL);
-				const spn = configProvider.getConfiguration('http').get<string>('proxyKerberosServicePrincipal')
-					|| (process.platform === 'win32' ? `HTTP/${url.hostname}` : `HTTP@${url.hostname}`);
-				extHostLogService.debug('ProxyResolver#lookupProxyAuthorization Kerberos authentication lookup', `proxyURL:${proxyURL}`, `spn:${spn}`);
-				const client = await kerberos.initializeClient(spn);
-				const response = await client.step('');
-				return 'Negotiate ' + response;
-			} catch (err) {
-				extHostLogService.error('ProxyResolver#lookupProxyAuthorization Kerberos authentication failed', err);
-				return undefined;
-			} finally {
-				delete pendingLookups[lookupKey];
-			}
-		})();
+	if (authenticate.some(a => /^(Negotiate|Kerberos)( |$)/i.test(a)) && !state.kerberosRequested) {
+		try {
+			state.kerberosRequested = true;
+			const kerberos = await import('kerberos');
+			const url = new URL(proxyURL);
+			const spn = configProvider.getConfiguration('http').get<string>('proxyKerberosServicePrincipal')
+				|| (process.platform === 'win32' ? `HTTP/${url.hostname}` : `HTTP@${url.hostname}`);
+			extHostLogService.debug('ProxyResolver#lookupProxyAuthorization Kerberos authentication lookup', `proxyURL:${proxyURL}`, `spn:${spn}`);
+			const client = await kerberos.initializeClient(spn);
+			const response = await client.step('');
+			return 'Negotiate ' + response;
+		} catch (err) {
+			extHostLogService.error('ProxyResolver#lookupProxyAuthorization Kerberos authentication failed', err);
+		}
 	}
 	return undefined;
 }
diff --git a/yarn.lock b/yarn.lock
index 974dcf393b4..651bda6187c 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -1309,10 +1309,10 @@
     bindings "^1.5.0"
     node-addon-api "^6.0.0"
 
-"@vscode/proxy-agent@^0.17.0":
-  version "0.17.0"
-  resolved "https://registry.yarnpkg.com/@vscode/proxy-agent/-/proxy-agent-0.17.0.tgz#e60d43e2779c07c223d3bad9b7de8eedf7ca1294"
-  integrity sha512-p4gJ57KeWGw0CEG9R13dmsgmWmszoOQ836pf/PVbAf+ZRF27il3QcFvOhA10XE2QFHaOcRxuJnnIpUD1lSMvqQ==
+"@vscode/proxy-agent@^0.17.1":
+  version "0.17.1"
+  resolved "https://registry.yarnpkg.com/@vscode/proxy-agent/-/proxy-agent-0.17.1.tgz#00ea42fb3565c78c38bc99a73d4460db538aef4e"
+  integrity sha512-KWQ5y2uB6547Oudx2TMV28PdcdqNzI4J7TZzhZht1kNra8spqOzQJXw6gBdoh2mMFVpNiKgVhZ9YinWR0BZHiw==
   dependencies:
     "@tootallnate/once" "^3.0.0"
     agent-base "^7.0.1"