google
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
@@ -18,6 +18,9 @@ on:
   schedule:
   - cron: '50 13 * * *'
 
+permissions:
+  contents: read
+
 jobs:
   test:
     strategy:
@@ -29,23 +32,26 @@ jobs:
         - '3.11'
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      with:
+        persist-credentials: false
     - name: Install cloud-spanner-emulator
       run: |
         # https://github.com/GoogleCloudPlatform/cloud-spanner-emulator#via-pre-built-linux-binaries
         VERSION=1.2.0
         wget https://storage.googleapis.com/cloud-spanner-emulator/releases/${VERSION}/cloud-spanner-emulator_linux_amd64-${VERSION}.tar.gz
         tar zxvf cloud-spanner-emulator_linux_amd64-${VERSION}.tar.gz
         chmod u+x gateway_main emulator_main
-    - uses: actions/setup-python@v2
+    - uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
       with:
         python-version: ${{ matrix.python-version }}
     - name: Install python dependencies
       run: |
         pip install \
           absl-py \
           google-api-core \
-          'google-cloud-spanner >= 3, <4' \
+          'google-cloud-spanner >= 3, < 3.64.0; python_version < "3.9"' \
+          'google-cloud-spanner >= 3, < 4; python_version >= "3.9"' \
           immutabledict \
           portpicker \
           pytest

diff --git a/setup.py b/setup.py
@@ -25,7 +25,8 @@
     include_package_data=True,
     python_requires='~=3.8',
     install_requires=[
-        'google-cloud-spanner >= 3, <4',
+        'google-cloud-spanner >= 3, < 3.64.0; python_version < "3.9"',
+        'google-cloud-spanner >= 3, < 4; python_version >= "3.9"',
         'immutabledict',
     ],
     tests_require=['absl-py', 'google-api-core', 'portpicker'],

diff --git a/spanner_orm/admin/api.py b/spanner_orm/admin/api.py
@@ -13,15 +13,14 @@
 # limitations under the License.
 """Class that handles API calls to Spanner that deal with table metadata."""
 
-from typing import Iterable, Optional
+from typing import Any, Iterable, Optional
 import warnings
 
-from spanner_orm import api
-from spanner_orm import error
-
 from google.auth import credentials as auth_credentials
 from google.cloud.spanner_v1 import database as spanner_database
 from google.cloud.spanner_v1 import pool as spanner_pool
+from spanner_orm import api
+from spanner_orm import error
 
 
 class SpannerAdminApi(api.SpannerReadApi, api.SpannerWriteApi):
@@ -58,7 +57,8 @@ def connect(instance: str,
             project: Optional[str] = None,
             credentials: Optional[auth_credentials.Credentials] = None,
             pool: Optional[spanner_pool.AbstractSessionPool] = None,
-            create_ddl: Optional[Iterable[str]] = None) -> SpannerAdminApi:
+            create_ddl: Optional[Iterable[str]] = None,
+            **client_kwargs: Any) -> SpannerAdminApi:
   """Connects the global Spanner admin API to a Spanner database.
 
   Deprecated in favor of from_connection().
@@ -72,7 +72,8 @@ def connect(instance: str,
       project=project,
       credentials=credentials,
       pool=pool,
-      create_ddl=create_ddl)
+      create_ddl=create_ddl,
+      **client_kwargs)
   return from_connection(connection)
 
 

diff --git a/spanner_orm/api.py b/spanner_orm/api.py
@@ -117,6 +117,7 @@ def __init__(
       *,
       client_options: Union[api_client_options.ClientOptions, Dict[Any, Any],
                             None] = None,
+      **client_kwargs: Any,
   ):
     """Connects to the specified Spanner database."""
     self._instance = instance
@@ -126,6 +127,7 @@ def __init__(
     self._pool = pool
     self._create_ddl = create_ddl
     self._client_options = client_options
+    self._client_kwargs = client_kwargs
     self.connect()
 
   def connect(self):
@@ -134,6 +136,7 @@ def connect(self):
         project=self._project,
         credentials=self._credentials,
         client_options=self._client_options,
+        **self._client_kwargs,
     )
     instance = client.instance(self._instance)
     self.database = instance.database(
@@ -159,12 +162,12 @@ def _connection(self):
 _api = None  # type: Optional[SpannerApi]
 
 
-def connect(
-    instance: str,
-    database: str,
-    project: Optional[str] = None,
-    credentials: Optional[auth_credentials.Credentials] = None,
-    pool: Optional[spanner_pool.AbstractSessionPool] = None) -> SpannerApi:
+def connect(instance: str,
+            database: str,
+            project: Optional[str] = None,
+            credentials: Optional[auth_credentials.Credentials] = None,
+            pool: Optional[spanner_pool.AbstractSessionPool] = None,
+            **client_kwargs: Any) -> SpannerApi:
   """Connects to the Spanner database and sets the global spanner_api.
 
   Deprecated in favor of from_connection().
@@ -174,7 +177,12 @@ def connect(
           'Please use '
           'spanner_orm.from_connection(spanner_orm.SpannerConnection(...))'))
   connection = SpannerConnection(
-      instance, database, project=project, credentials=credentials, pool=pool)
+      instance,
+      database,
+      project=project,
+      credentials=credentials,
+      pool=pool,
+      **client_kwargs)
   return from_connection(connection)
 
 

diff --git a/spanner_orm/tests/api_test.py b/spanner_orm/tests/api_test.py
@@ -73,6 +73,41 @@ def test_connection_args(self, client):
         client.mock_calls,
     )
 
+  @mock.patch.object(spanner, 'Client')
+  def test_connection_args_with_client_kwargs(self, client):
+    client.return_value.instance.return_value.database.return_value = (
+        'fake-database')
+    connection = api.SpannerConnection(
+        instance='some-instance',
+        database='some-database',
+        project='some-project',
+        credentials='fake-credentials',
+        pool='fake-pool',
+        create_ddl=('fake-ddl',),
+        client_options=dict(fake='options'),
+        disable_builtin_metrics=True,
+        route_to_leader_enabled=False,
+    )
+    self.assertEqual('fake-database', connection.database)
+    self.assertSequenceEqual(
+        (
+            mock.call(
+                project='some-project',
+                credentials='fake-credentials',
+                client_options=dict(fake='options'),
+                disable_builtin_metrics=True,
+                route_to_leader_enabled=False,
+            ),
+            mock.call().instance('some-instance'),
+            mock.call().instance().database(
+                'some-database',
+                pool='fake-pool',
+                ddl_statements=('fake-ddl',),
+            ),
+        ),
+        client.mock_calls,
+    )
+
   @mock.patch('google.cloud.spanner.Client')
   def test_api_connection(self, client):
     connection = self.mock_connection(client)