diff --git a/test/core/transport/chttp2/BUILD b/test/core/transport/chttp2/BUILD
index 51818b5a60b..c870e3f1851 100644
--- a/test/core/transport/chttp2/BUILD
+++ b/test/core/transport/chttp2/BUILD
@@ -25,10 +25,12 @@ grpc_proto_fuzzer(
     srcs = ["hpack_parser_fuzzer_test.cc"],
     corpus = "hpack_parser_corpus",
     proto = "hpack_parser_fuzzer.proto",
+    proto_deps = ["//test/core/util:fuzz_config_vars_proto"],
     tags = ["no_windows"],
     uses_polling = False,
     deps = [
         "//:grpc",
+        "//test/core/util:fuzz_config_vars",
         "//test/core/util:grpc_test_util",
     ],
 )
@@ -38,10 +40,12 @@ grpc_proto_fuzzer(
     srcs = ["hpack_sync_fuzzer.cc"],
     corpus = "hpack_sync_corpus",
     proto = "hpack_sync_fuzzer.proto",
+    proto_deps = ["//test/core/util:fuzz_config_vars_proto"],
     tags = ["no_windows"],
     uses_polling = False,
     deps = [
         "//:grpc",
+        "//test/core/util:fuzz_config_vars",
         "//test/core/util:grpc_test_util",
     ],
 )
diff --git a/test/core/transport/chttp2/hpack_parser_fuzzer.proto b/test/core/transport/chttp2/hpack_parser_fuzzer.proto
index 2088f5039c3..f3824f906e3 100644
--- a/test/core/transport/chttp2/hpack_parser_fuzzer.proto
+++ b/test/core/transport/chttp2/hpack_parser_fuzzer.proto
@@ -16,6 +16,8 @@ syntax = "proto3";
 
 package hpack_parser_fuzzer;
 
+import "test/core/util/fuzz_config_vars.proto";
+
 message Empty {}
 
 message Frame {
@@ -30,5 +32,5 @@ message Frame {
 
 message Msg {
   repeated Frame frames = 2;
+  grpc.testing.FuzzConfigVars config_vars = 3;
 }
-
diff --git a/test/core/transport/chttp2/hpack_parser_fuzzer_test.cc b/test/core/transport/chttp2/hpack_parser_fuzzer_test.cc
index 7ed49a38d73..987935db691 100644
--- a/test/core/transport/chttp2/hpack_parser_fuzzer_test.cc
+++ b/test/core/transport/chttp2/hpack_parser_fuzzer_test.cc
@@ -30,6 +30,7 @@
 #include <grpc/support/log.h>
 
 #include "src/core/ext/transport/chttp2/transport/hpack_parser.h"
+#include "src/core/lib/experiments/config.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
 #include "src/core/lib/gprpp/status_helper.h"
 #include "src/core/lib/iomgr/error.h"
@@ -40,6 +41,7 @@
 #include "src/core/lib/transport/metadata_batch.h"
 #include "src/libfuzzer/libfuzzer_macro.h"
 #include "test/core/transport/chttp2/hpack_parser_fuzzer.pb.h"
+#include "test/core/util/fuzz_config_vars.h"
 
 // IWYU pragma: no_include <google/protobuf/repeated_ptr_field.h>
 
@@ -50,6 +52,8 @@ static void dont_log(gpr_log_func_args* /*args*/) {}
 
 DEFINE_PROTO_FUZZER(const hpack_parser_fuzzer::Msg& msg) {
   if (squelch) gpr_set_log_function(dont_log);
+  grpc_core::ApplyFuzzConfigVars(msg.config_vars());
+  grpc_core::TestOnlyReloadExperimentsFromConfigVariables();
   grpc_init();
   auto cleanup = absl::MakeCleanup(grpc_shutdown);
   auto memory_allocator = grpc_core::ResourceQuota::Default()
diff --git a/test/core/transport/chttp2/hpack_sync_fuzzer.cc b/test/core/transport/chttp2/hpack_sync_fuzzer.cc
index 3046d501bf8..471c71bef7e 100644
--- a/test/core/transport/chttp2/hpack_sync_fuzzer.cc
+++ b/test/core/transport/chttp2/hpack_sync_fuzzer.cc
@@ -33,6 +33,7 @@
 #include "src/core/ext/transport/chttp2/transport/hpack_encoder_table.h"
 #include "src/core/ext/transport/chttp2/transport/hpack_parser.h"
 #include "src/core/ext/transport/chttp2/transport/hpack_parser_table.h"
+#include "src/core/lib/experiments/config.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
 #include "src/core/lib/gprpp/status_helper.h"
 #include "src/core/lib/iomgr/error.h"
@@ -45,6 +46,7 @@
 #include "src/core/lib/transport/metadata_batch.h"
 #include "src/libfuzzer/libfuzzer_macro.h"
 #include "test/core/transport/chttp2/hpack_sync_fuzzer.pb.h"
+#include "test/core/util/fuzz_config_vars.h"
 
 bool squelch = true;
 bool leak_check = true;
@@ -169,5 +171,7 @@ void FuzzOneInput(const hpack_sync_fuzzer::Msg& msg) {
 
 DEFINE_PROTO_FUZZER(const hpack_sync_fuzzer::Msg& msg) {
   if (squelch) gpr_set_log_function(dont_log);
+  grpc_core::ApplyFuzzConfigVars(msg.config_vars());
+  grpc_core::TestOnlyReloadExperimentsFromConfigVariables();
   grpc_core::FuzzOneInput(msg);
 }
diff --git a/test/core/transport/chttp2/hpack_sync_fuzzer.proto b/test/core/transport/chttp2/hpack_sync_fuzzer.proto
index 7cdacfeb1e7..b4485c0aab4 100644
--- a/test/core/transport/chttp2/hpack_sync_fuzzer.proto
+++ b/test/core/transport/chttp2/hpack_sync_fuzzer.proto
@@ -16,6 +16,8 @@ syntax = "proto3";
 
 package hpack_sync_fuzzer;
 
+import "test/core/util/fuzz_config_vars.proto";
+
 message Empty {}
 
 message StringKeyValue {
@@ -40,4 +42,5 @@ message Header {
 message Msg {
   bool use_true_binary_metadata = 1;
   repeated Header headers = 2;
+  grpc.testing.FuzzConfigVars config_vars = 3;
 }