diff --git a/bearer/bearer.go b/bearer/bearer.go
index 71f88b934b74126a84328d9146e86a211eaef41b..d974dddd0384cbc69de6e043f2f30958b37bb31d 100644
--- a/bearer/bearer.go
+++ b/bearer/bearer.go
@@ -47,7 +47,6 @@ package bearer
 
 import (
 	"context"
-	"encoding/json"
 	"errors"
 	"fmt"
 	"io"
@@ -59,9 +58,9 @@ 	"sync"
 	"time"
 
 	"sourcecraft.dev/bigbes/sr-ht-core/auth"
-	"sourcecraft.dev/bigbes/sr-ht-core/crypto"
 
 	"sourcecraft.dev/bigbes/sr-ht-ecore/grants"
+	"sourcecraft.dev/bigbes/sr-ht-ecore/internalauth"
 )
 
 // TokensClientID is the ClientID tokens.sr.ht stamps into every working token it
@@ -479,7 +478,12 @@
 	// The internal authorization is minted per request and cannot be cached: it
 	// is a fernet blob the daemon accepts only for thirty seconds, which is what
 	// stops a captured one being replayed for a week.
-	blob, err := json.Marshal(auth.InternalAuth{ClientID: v.clientID, NodeID: v.nodeID})
+	//
+	// Through internalauth rather than assembled here, so that this caller and
+	// every Guard on the instance read one definition of the payload. Minting it
+	// by hand next to a package whose whole purpose is to hold both ends of this
+	// handshake is the drift that package exists to prevent.
+	authorization, err := internalauth.Authorization(v.clientID, v.nodeID)
 	if err != nil {
 		return fmt.Errorf("%w: sealing the internal authorization: %s", ErrUnavailable, err)
 	}
@@ -489,7 +493,7 @@ 	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
 	if err != nil {
 		return fmt.Errorf("%w: building the request for %s: %s", ErrUnavailable, url, err)
 	}
-	req.Header.Set("Authorization", "Internal "+string(crypto.Encrypt(blob)))
+	req.Header.Set("Authorization", authorization)
 
 	resp, err := v.client.Do(req)
 	if err != nil {