diff --git a/paramiko/client.py b/paramiko/client.py
index fbd252532ab7462a12a8f884d68a4ff407549eb2_cGFyYW1pa28vY2xpZW50LnB5..83057e0532f44a493ca755a9151c974850633563_cGFyYW1pa28vY2xpZW50LnB5 100644
--- a/paramiko/client.py
+++ b/paramiko/client.py
@@ -237,7 +237,7 @@
         gss_trust_dns=True,
         passphrase=None,
         disabled_algorithms=None,
-        transport_factory=Transport,
+        transport_factory=None,
     ):
         """
         Connect to an SSH server and authenticate to it.  The server's host key
@@ -376,6 +376,8 @@
             if len(errors) == len(to_try):
                 raise NoValidConnectionsError(errors)
 
+        if transport_factory is None:
+            transport_factory = Transport
         t = self._transport = transport_factory(
             sock,
             gss_kex=gss_kex,
diff --git a/tests/test_client.py b/tests/test_client.py
index fbd252532ab7462a12a8f884d68a4ff407549eb2_dGVzdHMvdGVzdF9jbGllbnQucHk=..83057e0532f44a493ca755a9151c974850633563_dGVzdHMvdGVzdF9jbGllbnQucHk= 100644
--- a/tests/test_client.py
+++ b/tests/test_client.py
@@ -739,6 +739,40 @@
         call_arg = Transport.call_args[1]["disabled_algorithms"]
         assert call_arg == {"keys": ["ssh-dss"]}
 
+    @patch("paramiko.client.Transport")
+    def test_transport_factory_defaults_to_Transport(self, Transport):
+        sock, kex, creds, algos = Mock(), Mock(), Mock(), Mock()
+        SSHClient().connect(
+            "host",
+            sock=sock,
+            password="no",
+            gss_kex=kex,
+            gss_deleg_creds=creds,
+            disabled_algorithms=algos,
+        )
+        Transport.assert_called_once_with(
+            sock, gss_kex=kex, gss_deleg_creds=creds, disabled_algorithms=algos
+        )
+
+    @patch("paramiko.client.Transport")
+    def test_transport_factory_may_be_specified(self, Transport):
+        factory = Mock()
+        sock, kex, creds, algos = Mock(), Mock(), Mock(), Mock()
+        SSHClient().connect(
+            "host",
+            sock=sock,
+            password="no",
+            gss_kex=kex,
+            gss_deleg_creds=creds,
+            disabled_algorithms=algos,
+            transport_factory=factory,
+        )
+        factory.assert_called_once_with(
+            sock, gss_kex=kex, gss_deleg_creds=creds, disabled_algorithms=algos
+        )
+        # Safety check
+        assert not Transport.called
+
 
 class PasswordPassphraseTests(ClientTest):
     # TODO: most of these could reasonably be set up to use mocks/assertions