diff --git a/ChangeLog.md b/ChangeLog.md
--- a/ChangeLog.md
+++ b/ChangeLog.md
@@ -1,3 +1,7 @@
+## 0.3.2
+
+* Add `mkManagerSettingsContext` [#228](https://github.com/snoyberg/http-client/issues/228)
+
 ## 0.3.1.1
 
 * Minor doc updates
diff --git a/Network/HTTP/Client/TLS.hs b/Network/HTTP/Client/TLS.hs
--- a/Network/HTTP/Client/TLS.hs
+++ b/Network/HTTP/Client/TLS.hs
@@ -8,6 +8,7 @@
     ( -- * Settings
       tlsManagerSettings
     , mkManagerSettings
+    , mkManagerSettingsContext
       -- * Digest authentication
     , applyDigestAuth
       -- * Global manager
@@ -40,13 +41,28 @@
 mkManagerSettings :: NC.TLSSettings
                   -> Maybe NC.SockSettings
                   -> ManagerSettings
-mkManagerSettings tls sock = defaultManagerSettings
-    { managerTlsConnection = getTlsConnection (Just tls) sock
-    , managerTlsProxyConnection = getTlsProxyConnection tls sock
+mkManagerSettings = mkManagerSettingsContext Nothing
+
+-- | Same as 'mkManagerSettings', but also takes an optional
+-- 'NC.ConnectionContext'. Providing this externally can be an
+-- optimization, though that may change in the future. For more
+-- information, see:
+--
+-- <https://github.com/snoyberg/http-client/pull/227>
+--
+-- @since 0.3.2
+mkManagerSettingsContext
+    :: Maybe NC.ConnectionContext
+    -> NC.TLSSettings
+    -> Maybe NC.SockSettings
+    -> ManagerSettings
+mkManagerSettingsContext mcontext tls sock = defaultManagerSettings
+    { managerTlsConnection = getTlsConnection mcontext (Just tls) sock
+    , managerTlsProxyConnection = getTlsProxyConnection mcontext tls sock
     , managerRawConnection =
         case sock of
             Nothing -> managerRawConnection defaultManagerSettings
-            Just _ -> getTlsConnection Nothing sock
+            Just _ -> getTlsConnection mcontext Nothing sock
     , managerRetryableException = \e ->
         case () of
             ()
@@ -70,11 +86,12 @@
 tlsManagerSettings :: ManagerSettings
 tlsManagerSettings = mkManagerSettings def Nothing
 
-getTlsConnection :: Maybe NC.TLSSettings
+getTlsConnection :: Maybe NC.ConnectionContext
+                 -> Maybe NC.TLSSettings
                  -> Maybe NC.SockSettings
                  -> IO (Maybe HostAddress -> String -> Int -> IO Connection)
-getTlsConnection tls sock = do
-    context <- NC.initConnectionContext
+getTlsConnection mcontext tls sock = do
+    context <- maybe NC.initConnectionContext return mcontext
     return $ \_ha host port -> do
         conn <- NC.connectTo context NC.ConnectionParams
             { NC.connectionHostname = host
@@ -85,11 +102,12 @@
         convertConnection conn
 
 getTlsProxyConnection
-    :: NC.TLSSettings
+    :: Maybe NC.ConnectionContext
+    -> NC.TLSSettings
     -> Maybe NC.SockSettings
     -> IO (S.ByteString -> (Connection -> IO ()) -> String -> Maybe HostAddress -> String -> Int -> IO Connection)
-getTlsProxyConnection tls sock = do
-    context <- NC.initConnectionContext
+getTlsProxyConnection mcontext tls sock = do
+    context <- maybe NC.initConnectionContext return mcontext
     return $ \connstr checkConn serverName _ha host port -> do
         --error $ show (connstr, host, port)
         conn <- NC.connectTo context NC.ConnectionParams
diff --git a/http-client-tls.cabal b/http-client-tls.cabal
--- a/http-client-tls.cabal
+++ b/http-client-tls.cabal
@@ -1,5 +1,5 @@
 name:                http-client-tls
-version:             0.3.1.1
+version:             0.3.2
 synopsis:            http-client backend using the connection package and tls library
 description:         Hackage documentation generation is not reliable. For up to date documentation, please see: <https://www.stackage.org/package/http-client-tls>.
 homepage:            https://github.com/snoyberg/http-client