diff --git a/internal/cmd/oohelper/internal/client.go b/internal/cmd/oohelper/internal/client.go
index b724008..1d0a690 100644
--- a/internal/cmd/oohelper/internal/client.go
+++ b/internal/cmd/oohelper/internal/client.go
@@ -45,7 +45,7 @@ type Resolver interface {
 // OOClient is a client for the OONI Web Connectivity test helper.
 type OOClient struct {
 	// HTTPClient is the HTTP client to use.
-	HTTPClient *http.Client
+	HTTPClient model.HTTPClient
 
 	// Resolver is the resolver to user.
 	Resolver Resolver
diff --git a/internal/cmd/oohelper/oohelper.go b/internal/cmd/oohelper/oohelper.go
index 3dda531..5ac8987 100644
--- a/internal/cmd/oohelper/oohelper.go
+++ b/internal/cmd/oohelper/oohelper.go
@@ -7,40 +7,33 @@ import (
 	"encoding/json"
 	"flag"
 	"fmt"
-	"net/http"
 
 	"github.com/apex/log"
 	"github.com/ooni/probe-cli/v3/internal/cmd/oohelper/internal"
-	"github.com/ooni/probe-cli/v3/internal/engine/netx"
 	"github.com/ooni/probe-cli/v3/internal/model"
+	"github.com/ooni/probe-cli/v3/internal/netxlite"
 	"github.com/ooni/probe-cli/v3/internal/runtimex"
 )
 
 var (
 	ctx, cancel = context.WithCancel(context.Background())
 	debug       = flag.Bool("debug", false, "Toggle debug mode")
-	httpClient  *http.Client
+	httpClient  model.HTTPClient
 	resolver    model.Resolver
 	server      = flag.String("server", "", "URL of the test helper")
 	target      = flag.String("target", "", "Target URL for the test helper")
 )
 
-func newhttpclient() *http.Client {
+func init() {
 	// Use a nonstandard resolver, which is enough to work around the
 	// puzzling https://github.com/ooni/probe/issues/1409 issue.
-	childResolver, err := netx.NewDNSClient(
-		netx.Config{Logger: log.Log}, "dot://8.8.8.8:853")
-	runtimex.PanicOnError(err, "netx.NewDNSClient should not fail here")
-	txp := netx.NewHTTPTransport(netx.Config{
-		BaseResolver: childResolver,
-		Logger:       log.Log,
-	})
-	return &http.Client{Transport: txp}
-}
-
-func init() {
-	httpClient = newhttpclient()
-	resolver = netx.NewResolver(netx.Config{Logger: log.Log})
+	const resolverURL = "https://8.8.8.8/dns-query"
+	resolver = netxlite.NewParallelDNSOverHTTPSResolver(log.Log, resolverURL)
+	thx := netxlite.NewTLSHandshakerStdlib(log.Log)
+	dialer := netxlite.NewDialerWithResolver(log.Log, resolver)
+	tlsDialer := netxlite.NewTLSDialer(dialer, thx)
+	txp := netxlite.NewHTTPTransport(log.Log, dialer, tlsDialer)
+	httpClient = netxlite.NewHTTPClient(txp)
 }
 
 func main() {
diff --git a/internal/netxlite/http.go b/internal/netxlite/http.go
index 6d583cb..41969f7 100644
--- a/internal/netxlite/http.go
+++ b/internal/netxlite/http.go
@@ -332,6 +332,11 @@ func NewHTTPTransportStdlib(logger model.DebugLogger) model.HTTPTransport {
 // standard library for TLS and DNS resolutions.
 func NewHTTPClientStdlib(logger model.DebugLogger) model.HTTPClient {
 	txp := NewHTTPTransportStdlib(logger)
+	return NewHTTPClient(txp)
+}
+
+// NewHTTPClient creates a new, wrapped HTTPClient using the given transport.
+func NewHTTPClient(txp model.HTTPTransport) model.HTTPClient {
 	return WrapHTTPClient(&http.Client{Transport: txp})
 }