diff --git a/oras/provider.py b/oras/provider.py
index 8056ce47..b6941ec1 100644
--- a/oras/provider.py
+++ b/oras/provider.py
@@ -950,6 +950,7 @@ def do_request(
             json=json,
             headers=headers,
             stream=stream,
+            verify=self._tls_verify,
         )
 
         # One retry if 403 denied (need new token?)
@@ -957,11 +958,14 @@ def do_request(
             headers, changed = self.auth.authenticate_request(
                 response, headers, refresh=True
             )
-        return self.session.request(
-            method,
-            url,
-            data=data,
-            json=json,
-            headers=headers,
-            stream=stream,
-        )
+            response = self.session.request(
+                method,
+                url,
+                data=data,
+                json=json,
+                headers=headers,
+                stream=stream,
+                verify=self._tls_verify,
+            )
+
+        return response