diff --git a/authz/authz_test.go b/authz/authz_test.go
index b1a5eb2d5a4cd68a51c0614cfb2e7373f3316547..9cf5c09c1bb7e50488014eac2d8862a4be946761 100644
--- a/authz/authz_test.go
+++ b/authz/authz_test.go
@@ -13,7 +13,7 @@ 	"time"
 
 	"sourcecraft.dev/bigbes/sr-ht-core/config"
 	"sourcecraft.dev/bigbes/sr-ht-core/crypto"
-	"github.com/vaughan0/go-ini"
+	"sourcecraft.dev/bigbes/sr-ht-ecore/ecoretest"
 
 	"sourcecraft.dev/bigbes/sr-ht-compare/core"
 )
@@ -43,14 +43,12 @@ 	return auth.Name
 }
 
 // ctxFor returns a context carrying config that points git.sr.ht's API origin at
-// url, reusing the crypto keys established in TestMain.
+// url — the ephemeral httptest server of the calling test — over the synthetic
+// instance whose keyset TestMain installed.
 func ctxFor(url string) context.Context {
-	conf := ini.File{
-		"sr.ht":         testConf.Section("sr.ht"),
-		"webhooks":      testConf.Section("webhooks"),
-		"compare.sr.ht": ini.Section{"origin": "http://localhost"},
-		"git.sr.ht":     ini.Section{"api-origin": url},
-	}
+	conf := ecoretest.Config("compare.sr.ht",
+		ecoretest.Set("git.sr.ht", "api-origin", url),
+	)
 	return config.Context(context.Background(), conf, "compare.sr.ht")
 }
 
diff --git a/authz/identity_test.go b/authz/identity_test.go
index fd6a637beb1f76bf9705ca1b5a52ce971c118d6b..6d6e8314ea4a04fdbb35ce50fa44dfa4bdd9152a 100644
--- a/authz/identity_test.go
+++ b/authz/identity_test.go
@@ -1,8 +1,6 @@
 package authz
 
 import (
-	"crypto/rand"
-	"encoding/base64"
 	"encoding/json"
 	"net/http"
 	"net/http/httptest"
@@ -10,33 +8,15 @@ 	"os"
 	"testing"
 
 	"sourcecraft.dev/bigbes/sr-ht-core/crypto"
-	"github.com/fernet/fernet-go"
-	"github.com/vaughan0/go-ini"
+	"sourcecraft.dev/bigbes/sr-ht-ecore/ecoretest"
 )
 
-// testConf holds the crypto keys shared by every test. api-origin is filled in
-// per-test (it points at an ephemeral httptest server).
-var testConf ini.File
-
-// TestMain synthesizes an in-memory config with a fresh Fernet network-key and
-// an ed25519 webhook seed, then runs crypto.InitCrypto so Encrypt/Decrypt work.
+// TestMain installs ecore's fixed test keyset into core-go's process-global
+// crypto, so Encrypt/Decrypt work offline. The keys are constants and the call
+// is idempotent, which is what lets this package and web/ both initialise
+// without the second rotating what the first sealed with.
 func TestMain(m *testing.M) {
-	var fk fernet.Key
-	if err := fk.Generate(); err != nil {
-		panic("generate fernet key: " + err.Error())
-	}
-	seed := make([]byte, 32)
-	if _, err := rand.Read(seed); err != nil {
-		panic("generate webhook seed: " + err.Error())
-	}
-
-	testConf = ini.File{
-		"sr.ht":         ini.Section{"network-key": fk.Encode()},
-		"webhooks":      ini.Section{"private-key": base64.StdEncoding.EncodeToString(seed)},
-		"compare.sr.ht": ini.Section{"origin": "http://localhost"},
-	}
-	crypto.InitCrypto(testConf)
-
+	ecoretest.InitCrypto()
 	os.Exit(m.Run())
 }