diff --git a/ChangeLog.md b/ChangeLog.md
--- a/ChangeLog.md
+++ b/ChangeLog.md
@@ -1,3 +1,8 @@
+## 0.3.5.2
+
+* [#289](https://github.com/snoyberg/http-client/issues/289):
+  Keep original `TLSSettings` when creating a `Manager` using `newTlsManagerWith`.
+
 ## 0.3.5.1
 
 * Also catch TLSError exceptions [#273](https://github.com/snoyberg/http-client/pull/273)
diff --git a/Network/HTTP/Client/TLS.hs b/Network/HTTP/Client/TLS.hs
--- a/Network/HTTP/Client/TLS.hs
+++ b/Network/HTTP/Client/TLS.hs
@@ -196,6 +196,14 @@
         settings' = maybe id (const $ managerSetInsecureProxy proxyFromRequest) msocksHTTP
                   $ maybe id (const $ managerSetSecureProxy proxyFromRequest) msocksHTTPS
                     settings
+                        -- We want to keep the original TLS settings that were
+                        -- passed in. Sadly they aren't available as a record
+                        -- field on `ManagerSettings`. So instead we grab the
+                        -- fields that depend on the TLS settings.
+                        -- https://github.com/snoyberg/http-client/issues/289
+                        { managerTlsConnection = managerTlsConnection set
+                        , managerTlsProxyConnection = managerTlsProxyConnection set
+                        }
     newManager settings'
 
 parseSocksSettings :: [(String, String)] -- ^ original environment
diff --git a/bench/Bench.hs b/bench/Bench.hs
--- a/bench/Bench.hs
+++ b/bench/Bench.hs
@@ -1,6 +1,11 @@
+{-# LANGUAGE CPP #-}
 module Main where
 
-import Criterion.Main
+#if MIN_VERSION_gauge(0, 2, 0)
+import Gauge
+#else
+import Gauge.Main
+#endif
 import Network.HTTP.Client
 import Network.HTTP.Client.TLS
 
diff --git a/http-client-tls.cabal b/http-client-tls.cabal
--- a/http-client-tls.cabal
+++ b/http-client-tls.cabal
@@ -1,5 +1,5 @@
 name:                http-client-tls
-version:             0.3.5.1
+version:             0.3.5.2
 synopsis:            http-client backend using the connection package and tls library
 description:         Hackage documentation generation is not reliable. For up to date documentation, please see: <https://www.stackage.org/package/http-client-tls>.
 homepage:            https://github.com/snoyberg/http-client
@@ -41,6 +41,7 @@
   hs-source-dirs:      test
   default-language:    Haskell2010
   build-depends:       base
+                     , connection
                      , hspec
                      , http-client
                      , http-client-tls
@@ -52,6 +53,6 @@
   hs-source-dirs:      bench
   default-language:    Haskell2010
   build-depends:       base
-                     , criterion
+                     , gauge
                      , http-client
                      , http-client-tls
diff --git a/test/Spec.hs b/test/Spec.hs
--- a/test/Spec.hs
+++ b/test/Spec.hs
@@ -1,5 +1,6 @@
 {-# LANGUAGE OverloadedStrings #-}
 import Test.Hspec
+import Network.Connection
 import Network.HTTP.Client
 import Network.HTTP.Client.TLS
 import Network.HTTP.Types
@@ -27,3 +28,19 @@
         join (applyDigestAuth "user" "passwd" "http://httpbin.org/" man)
             `shouldThrow` \(DigestAuthException _ _ det) ->
                 det == UnexpectedStatusCode
+
+    -- https://github.com/snoyberg/http-client/issues/289
+    it "accepts TLS settings" $ do
+        let
+          tlsSettings = TLSSettingsSimple
+            { settingDisableCertificateValidation = True
+            , settingDisableSession = False
+            , settingUseServerName = False
+            }
+          socketSettings = Nothing
+          managerSettings = mkManagerSettings tlsSettings socketSettings
+        manager <- newTlsManagerWith managerSettings
+        let url = "https://wrong.host.badssl.com"
+        request <- parseRequest url
+        response <- httpNoBody request manager
+        responseStatus response `shouldBe` status200