diff --git a/cpp/src/parquet/encryption/file_key_wrapper.cc b/cpp/src/parquet/encryption/file_key_wrapper.cc
index fd870ed1f3bb..50fe197c48d1 100644
--- a/cpp/src/parquet/encryption/file_key_wrapper.cc
+++ b/cpp/src/parquet/encryption/file_key_wrapper.cc
@@ -40,7 +40,7 @@ FileKeyWrapper::FileKeyWrapper(KeyToolkit* key_toolkit,
   key_toolkit->kms_client_cache_per_token().CheckCacheForExpiredTokens(
       cache_entry_lifetime_seconds_);
   kms_client_ =
-      key_toolkit->GetKmsClient(kms_connection_config, cache_entry_lifetime_seconds_);
+      key_toolkit->GetKmsClient(kms_connection_config_, cache_entry_lifetime_seconds_);
 
   if (double_wrapping) {
     key_toolkit->kek_write_cache_per_token().CheckCacheForExpiredTokens(
diff --git a/cpp/src/parquet/encryption/key_management_test.cc b/cpp/src/parquet/encryption/key_management_test.cc
index 80ef28b766b3..2a65a177def5 100644
--- a/cpp/src/parquet/encryption/key_management_test.cc
+++ b/cpp/src/parquet/encryption/key_management_test.cc
@@ -566,9 +566,9 @@ TEST_F(TestEncryptionKeyManagement, ReadKmsUrlFromFileDuringKeyRotation) {
 
   ASSERT_EQ(requests.size(), 2);
   // The first KMS creation request is for wrapping new keys.
-  // This uses the empty config provided.
-  EXPECT_EQ(requests[0].kms_instance_id, "");
-  EXPECT_EQ(requests[0].kms_instance_url, "");
+  // Empty values in the provided config are replaced with defaults.
+  EXPECT_EQ(requests[0].kms_instance_id, KmsClient::kKmsInstanceIdDefault);
+  EXPECT_EQ(requests[0].kms_instance_url, KmsClient::kKmsInstanceUrlDefault);
   // The KMS client used to unwrap the previous keys should be configured
   // with the instance ID and url provided at write time.
   EXPECT_EQ(requests[1].kms_instance_id, "123");
@@ -582,9 +582,9 @@ TEST_F(TestEncryptionKeyManagement, KeyRotationWithoutReadingKmsUrl) {
 
   ASSERT_EQ(requests.size(), 2);
   // The first KMS creation request is for wrapping new keys.
-  // This uses the empty config provided.
-  EXPECT_EQ(requests[0].kms_instance_id, "");
-  EXPECT_EQ(requests[0].kms_instance_url, "");
+  // Empty values in the provided config are replaced with defaults.
+  EXPECT_EQ(requests[0].kms_instance_id, KmsClient::kKmsInstanceIdDefault);
+  EXPECT_EQ(requests[0].kms_instance_url, KmsClient::kKmsInstanceUrlDefault);
   // When unwrapping the existing keys, the URL in the key material is
   // ignored and the default used.
   EXPECT_EQ(requests[1].kms_instance_id, "123");
diff --git a/python/pyarrow/tests/parquet/test_encryption.py b/python/pyarrow/tests/parquet/test_encryption.py
index 5185bf6a3013..b80d5c2b7787 100644
--- a/python/pyarrow/tests/parquet/test_encryption.py
+++ b/python/pyarrow/tests/parquet/test_encryption.py
@@ -763,12 +763,14 @@ def test_key_rotation_reads_kms_url_from_file(reusable_tempdir, data_table,
         rotation_config, path, read_kms_url=read_kms_url)
 
     if read_kms_url:
-        # The empty config provided is used to wrap new keys,
-        # and the config from the file was used to unwrap the original keys.
-        assert created_configs == [("", ""), (KMS_INSTANCE_ID, KMS_INSTANCE_URL)]
+        # Defaults are used to wrap new keys, and the config from the file
+        # is used to unwrap the original keys.
+        assert created_configs == [
+            ("DEFAULT", "DEFAULT"), (KMS_INSTANCE_ID, KMS_INSTANCE_URL)]
     else:
         # The default URL is used when unwrapping the original keys.
-        assert created_configs == [("", ""), (KMS_INSTANCE_ID, "DEFAULT")]
+        assert created_configs == [
+            ("DEFAULT", "DEFAULT"), (KMS_INSTANCE_ID, "DEFAULT")]
 
     # New key material always uses the provided KMS connection configuration
     rotated_keys = read_external_keys_to_dict(path)
diff --git a/python/pyarrow/tests/test_dataset_encryption.py b/python/pyarrow/tests/test_dataset_encryption.py
index ceb75ca603b7..a913707ad05c 100644
--- a/python/pyarrow/tests/test_dataset_encryption.py
+++ b/python/pyarrow/tests/test_dataset_encryption.py
@@ -133,12 +133,14 @@ def assert_decrypts(
         encrypt_kms_connection_config = create_kms_connection_config(write_keys)
         decrypt_kms_connection_config = create_kms_connection_config(read_keys)
 
-        crypto_factory = pe.CryptoFactory(kms_factory)
+        encrypt_crypto_factory = pe.CryptoFactory(kms_factory)
+        # Keep the writer's cached keys out of the reader's configuration.
+        decrypt_crypto_factory = pe.CryptoFactory(kms_factory)
         parquet_encryption_cfg = ds.ParquetEncryptionConfig(
-            crypto_factory, encrypt_kms_connection_config, encryption_config
+            encrypt_crypto_factory, encrypt_kms_connection_config, encryption_config
         )
         parquet_decryption_cfg = ds.ParquetDecryptionConfig(
-            crypto_factory, decrypt_kms_connection_config, decryption_config
+            decrypt_crypto_factory, decrypt_kms_connection_config, decryption_config
         )
 
         # create write_options with dataset encryption config
@@ -176,7 +178,7 @@ def assert_decrypts(
                 assert table.select(read_columns).equals(dataset.to_table(read_columns))
 
         # set decryption properties for parquet fragment scan options
-        decryption_properties = crypto_factory.file_decryption_properties(
+        decryption_properties = decrypt_crypto_factory.file_decryption_properties(
             decrypt_kms_connection_config, decryption_config)
         pq_scan_opts = ds.ParquetFragmentScanOptions(
             decryption_properties=decryption_properties