diff --git a/pallas/_fastagent_patch.py b/pallas/_fastagent_patch.py
index c6001ec..2e67732 100644
--- a/pallas/_fastagent_patch.py
+++ b/pallas/_fastagent_patch.py
@@ -82,7 +82,7 @@ class _DynamicBearerAuth(httpx.Auth):
     def _current_token(self) -> str | None:
         return _lookup_bearer(self._server_config)
 
-    def sync_auth_flow(self, request: httpx.Request):
+    def _inject(self, request: httpx.Request) -> None:
         token = self._current_token()
         if token:
             request.headers["Authorization"] = f"Bearer {token}"
@@ -97,13 +97,18 @@ class _DynamicBearerAuth(httpx.Auth):
                 "forward.skipped server=%s reason=no_inbound_bearer via=auth_flow",
                 self._server_name,
             )
-        yield request
 
-    async def async_auth_flow(self, request: httpx.Request):
-        # httpx calls this generator per-request; all our work is
-        # pre-response so we yield once and we're done.
-        for item in self.sync_auth_flow(request):
-            yield item
+    def auth_flow(self, request: httpx.Request):
+        # Both ``sync_auth_flow`` and ``async_auth_flow`` on httpx.Auth
+        # delegate to ``auth_flow`` when subclasses override only the
+        # generic path, which is exactly what we want: one implementation
+        # that works for both sync and async clients.  httpx drives this
+        # as a *plain* generator (the async side resolves the yielded
+        # request via its own await machinery), so do NOT mark this
+        # ``async def`` — that triggers
+        # ``object NoneType can't be used in 'await' expression``.
+        self._inject(request)
+        yield request
 
 # ── Opt-in server names discovered from raw YAML ──────────────────────────────
 # Fast-agent's ``Settings(**merged)`` pipeline silently discards unknown keys