diff --git a/src/AVEVA.Historian.Client/Wcf/HistorianWcfAuthChainHelper.cs b/src/AVEVA.Historian.Client/Wcf/HistorianWcfAuthChainHelper.cs
index 5031b24..934d5ed 100644
--- a/src/AVEVA.Historian.Client/Wcf/HistorianWcfAuthChainHelper.cs
+++ b/src/AVEVA.Historian.Client/Wcf/HistorianWcfAuthChainHelper.cs
@@ -41,7 +41,7 @@ internal static class HistorianWcfAuthChainHelper
 
         try
         {
-            IHistoryServiceContract2 historyChannel = historyFactory.CreateChannel();
+            IHistoryServiceContract2 historyChannel = HistorianWcfClientCredentialsHelper.CreateChannel(historyFactory, options);
             ICommunicationObject historyChannelCo = (ICommunicationObject)historyChannel;
             try
             {
diff --git a/src/AVEVA.Historian.Client/Wcf/HistorianWcfClientCredentialsHelper.cs b/src/AVEVA.Historian.Client/Wcf/HistorianWcfClientCredentialsHelper.cs
index b8689f5..83bec42 100644
--- a/src/AVEVA.Historian.Client/Wcf/HistorianWcfClientCredentialsHelper.cs
+++ b/src/AVEVA.Historian.Client/Wcf/HistorianWcfClientCredentialsHelper.cs
@@ -2,7 +2,6 @@ using System.IdentityModel.Selectors;
 using System.IdentityModel.Tokens;
 using System.Security.Cryptography.X509Certificates;
 using System.ServiceModel;
-using System.ServiceModel.Description;
 using System.ServiceModel.Security;
 
 namespace AVEVA.Historian.Client.Wcf;
@@ -29,14 +28,24 @@ internal static class HistorianWcfClientCredentialsHelper
                 RevocationMode = X509RevocationMode.NoCheck,
             };
         }
+    }
 
-        // Tunnel/proxy support: connect to the Via address while still addressing the message To the
-        // logical endpoint (Host/Port). Lets a port-forward whose local port differs from the server's
-        // real service port satisfy the server-side WCF AddressFilter (which checks the To header).
-        if (!string.IsNullOrWhiteSpace(options.ConnectViaAddress))
-        {
-            factory.Endpoint.EndpointBehaviors.Add(new ClientViaBehavior(new Uri(options.ConnectViaAddress)));
-        }
+    /// <summary>
+    /// Creates a channel from <paramref name="factory"/>, honoring
+    /// <see cref="HistorianClientOptions.ConnectViaAddress"/> when set: the channel <b>connects</b> to
+    /// the Via address while still addressing the SOAP message <c>To</c> the factory's logical endpoint.
+    /// This lets a port-forward whose local port differs from the server's real service port satisfy the
+    /// server-side WCF AddressFilter (which validates the To header). Use this in place of
+    /// <c>factory.CreateChannel()</c> at every WCF event/read channel-creation site.
+    /// </summary>
+    public static TChannel CreateChannel<TChannel>(ChannelFactory<TChannel> factory, HistorianClientOptions options)
+    {
+        ArgumentNullException.ThrowIfNull(factory);
+        ArgumentNullException.ThrowIfNull(options);
+
+        return string.IsNullOrWhiteSpace(options.ConnectViaAddress)
+            ? factory.CreateChannel()
+            : factory.CreateChannel(factory.Endpoint.Address, new Uri(options.ConnectViaAddress));
     }
 
     private sealed class AcceptAnyCertificateValidator : X509CertificateValidator
diff --git a/src/AVEVA.Historian.Client/Wcf/HistorianWcfEventOrchestrator.cs b/src/AVEVA.Historian.Client/Wcf/HistorianWcfEventOrchestrator.cs
index c8f81a5..d1aaca5 100644
--- a/src/AVEVA.Historian.Client/Wcf/HistorianWcfEventOrchestrator.cs
+++ b/src/AVEVA.Historian.Client/Wcf/HistorianWcfEventOrchestrator.cs
@@ -167,7 +167,7 @@ internal sealed class HistorianWcfEventOrchestrator
 
         try
         {
-            IRetrievalServiceContract4 channel = factory.CreateChannel();
+            IRetrievalServiceContract4 channel = HistorianWcfClientCredentialsHelper.CreateChannel(factory, _options);
             ICommunicationObject channelCo = (ICommunicationObject)channel;
             try
             {