diff --git a/Cargo.toml b/Cargo.toml
index 4483e8d02..388c7bca1 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -52,7 +52,7 @@ http = "1.1.0"
 http-body = "1.0.0"
 http-body-util = "0.1.2"
 hyper = "1.2.0"
-hyper-util = "0.1.3"
+hyper-util = "0.1.9"
 hyper-openssl = "0.10.2"
 hyper-rustls = { version = "0.27.1", default-features = false }
 hyper-socks2 = { version = "0.9.0", default-features = false }
@@ -84,8 +84,8 @@ tokio = "1.14.0"
 tokio-test = "0.4.0"
 tokio-tungstenite = "0.24.0"
 tokio-util = "0.7.0"
-tower = "0.4.13"
-tower-http = "0.5.2"
+tower = "0.5.1"
+tower-http = "0.6.1"
 tower-test = "0.4.0"
 tracing = "0.1.36"
 tracing-subscriber = "0.3.17"
diff --git a/examples/custom_client.rs b/examples/custom_client.rs
index 795b0421a..0b61a8810 100644
--- a/examples/custom_client.rs
+++ b/examples/custom_client.rs
@@ -1,6 +1,7 @@
 use hyper_util::rt::TokioExecutor;
 // Minimal custom client example.
 use k8s_openapi::api::core::v1::Pod;
+use tower::BoxError;
 use tracing::*;
 
 use kube::{client::ConfigExt, Api, Client, Config, ResourceExt};
@@ -15,6 +16,7 @@ async fn main() -> anyhow::Result<()> {
     let service = tower::ServiceBuilder::new()
         .layer(config.base_uri_layer())
         .option_layer(config.auth_layer()?)
+        .map_err(BoxError::from)
         .service(hyper_util::client::legacy::Client::builder(TokioExecutor::new()).build(https));
     let client = Client::new(service, config.default_namespace);
 
diff --git a/examples/custom_client_trace.rs b/examples/custom_client_trace.rs
index 866a5dbd3..25cb1aa6c 100644
--- a/examples/custom_client_trace.rs
+++ b/examples/custom_client_trace.rs
@@ -4,7 +4,7 @@ use hyper::body::Incoming;
 use hyper_util::rt::TokioExecutor;
 use k8s_openapi::api::core::v1::Pod;
 use std::time::Duration;
-use tower::ServiceBuilder;
+use tower::{BoxError, ServiceBuilder};
 use tower_http::{decompression::DecompressionLayer, trace::TraceLayer};
 use tracing::{Span, *};
 
@@ -54,6 +54,7 @@ async fn main() -> anyhow::Result<()> {
                     tracing::debug!("finished in {}ms", latency.as_millis())
                 }),
         )
+        .map_err(BoxError::from)
         .service(hyper_util::client::legacy::Client::builder(TokioExecutor::new()).build(https));
 
     let client = Client::new(service, config.default_namespace);
diff --git a/kube-client/src/client/builder.rs b/kube-client/src/client/builder.rs
index f7c631896..05edf80b4 100644
--- a/kube-client/src/client/builder.rs
+++ b/kube-client/src/client/builder.rs
@@ -213,6 +213,7 @@ where
                     }
                 }),
         )
+        .map_err(BoxError::from)
         .service(client);
 
     Ok(ClientBuilder::new(
diff --git a/kube-client/src/client/config_ext.rs b/kube-client/src/client/config_ext.rs
index 2861ad3c8..0874e0f00 100644
--- a/kube-client/src/client/config_ext.rs
+++ b/kube-client/src/client/config_ext.rs
@@ -167,14 +167,14 @@ impl ConfigExt for Config {
     fn auth_layer(&self) -> Result<Option<AuthLayer>> {
         Ok(match Auth::try_from(&self.auth_info).map_err(Error::Auth)? {
             Auth::None => None,
-            Auth::Basic(user, pass) => Some(AuthLayer(Either::A(
+            Auth::Basic(user, pass) => Some(AuthLayer(Either::Left(
                 AddAuthorizationLayer::basic(&user, pass.expose_secret()).as_sensitive(true),
             ))),
-            Auth::Bearer(token) => Some(AuthLayer(Either::A(
+            Auth::Bearer(token) => Some(AuthLayer(Either::Left(
                 AddAuthorizationLayer::bearer(token.expose_secret()).as_sensitive(true),
             ))),
             Auth::RefreshableToken(refreshable) => {
-                Some(AuthLayer(Either::B(AsyncFilterLayer::new(refreshable))))
+                Some(AuthLayer(Either::Right(AsyncFilterLayer::new(refreshable))))
             }
             Auth::Certificate(_client_certificate_data, _client_key_data) => None,
         })
diff --git a/kube-client/src/client/mod.rs b/kube-client/src/client/mod.rs
index 768a06100..cd6c9ac9e 100644
--- a/kube-client/src/client/mod.rs
+++ b/kube-client/src/client/mod.rs
@@ -8,7 +8,7 @@
 //! The [`Client`] can also be used with [`Discovery`](crate::Discovery) to dynamically
 //! retrieve the resources served by the kubernetes API.
 use either::{Either, Left, Right};
-use futures::{AsyncBufRead, StreamExt, TryStream, TryStreamExt};
+use futures::{future::BoxFuture, AsyncBufRead, StreamExt, TryStream, TryStreamExt};
 use http::{self, Request, Response};
 use http_body_util::BodyExt;
 #[cfg(feature = "ws")] use hyper_util::rt::TokioIo;
@@ -75,8 +75,8 @@ pub use builder::{ClientBuilder, DynBody};
 #[derive(Clone)]
 pub struct Client {
     // - `Buffer` for cheap clone
-    // - `BoxService` for dynamic response future type
-    inner: Buffer<BoxService<Request<Body>, Response<Body>, BoxError>, Request<Body>>,
+    // - `BoxFuture` for dynamic response future type
+    inner: Buffer<Request<Body>, BoxFuture<'static, Result<Response<Body>, BoxError>>>,
     default_ns: String,
 }
 
@@ -102,13 +102,14 @@ impl Client {
     /// ```rust
     /// # async fn doc() -> Result<(), Box<dyn std::error::Error>> {
     /// use kube::{client::ConfigExt, Client, Config};
-    /// use tower::ServiceBuilder;
+    /// use tower::{BoxError, ServiceBuilder};
     /// use hyper_util::rt::TokioExecutor;
     ///
     /// let config = Config::infer().await?;
     /// let service = ServiceBuilder::new()
     ///     .layer(config.base_uri_layer())
     ///     .option_layer(config.auth_layer()?)
+    ///     .map_err(BoxError::from)
     ///     .service(hyper_util::client::legacy::Client::builder(TokioExecutor::new()).build_http());
     /// let client = Client::new(service, config.default_namespace);
     /// # Ok(())