diff --git a/ChangeLog.md b/ChangeLog.md
--- a/ChangeLog.md
+++ b/ChangeLog.md
@@ -1,3 +1,7 @@
+## 0.3.4.2
+
+* Never throw exceptions on 401 status in `applyDigestAuth`
+
 ## 0.3.4.1
 
 * Better exception cleanup behavior
diff --git a/Network/HTTP/Client/TLS.hs b/Network/HTTP/Client/TLS.hs
--- a/Network/HTTP/Client/TLS.hs
+++ b/Network/HTTP/Client/TLS.hs
@@ -299,7 +299,7 @@
                 -> Request
                 -> Manager
                 -> m (n Request)
-applyDigestAuth user pass req man = liftIO $ do
+applyDigestAuth user pass req0 man = liftIO $ do
     res <- httpNoBody req man
     let throw' = throwM . DigestAuthException req res
     return $ do
@@ -360,6 +360,10 @@
             , cookieJar = Just $ responseCookieJar res
             }
   where
+    -- Since we're expecting a non-200 response, ensure we do not
+    -- throw exceptions for such responses.
+    req = req0 { checkResponse = \_ _ -> return () }
+
     stripCI x y
         | CI.mk x == CI.mk (S.take len y) = Just $ S.drop len y
         | otherwise = Nothing
diff --git a/http-client-tls.cabal b/http-client-tls.cabal
--- a/http-client-tls.cabal
+++ b/http-client-tls.cabal
@@ -1,5 +1,5 @@
 name:                http-client-tls
-version:             0.3.4.1
+version:             0.3.4.2
 synopsis:            http-client backend using the connection package and tls library
 description:         Hackage documentation generation is not reliable. For up to date documentation, please see: <https://www.stackage.org/package/http-client-tls>.
 homepage:            https://github.com/snoyberg/http-client