diff --git a/graph/graph_test.go b/graph/graph_test.go
index 3500668cde63aa591383bd30ae00d57a0d1201ea..3b2e19916947a0795d7ecbcd18c0e83c00e7a079 100644
--- a/graph/graph_test.go
+++ b/graph/graph_test.go
@@ -2,9 +2,7 @@ package graph
 
 import (
 	"context"
-	"crypto/rand"
 	"crypto/sha1"
-	"encoding/base64"
 	"encoding/hex"
 	"encoding/json"
 	"fmt"
@@ -16,12 +14,11 @@ 	"strings"
 	"testing"
 	"time"
 
-	"github.com/fernet/fernet-go"
 	"github.com/go-chi/chi/v5"
-	"github.com/vaughan0/go-ini"
 	"sourcecraft.dev/bigbes/sr-ht-core/auth"
 	"sourcecraft.dev/bigbes/sr-ht-core/crypto"
 	"sourcecraft.dev/bigbes/sr-ht-ecore/bearer"
+	"sourcecraft.dev/bigbes/sr-ht-ecore/ecoretest"
 
 	"sourcecraft.dev/bigbes/sr-ht-spec/authn"
 	"sourcecraft.dev/bigbes/sr-ht-spec/core"
@@ -30,25 +27,13 @@ 	"sourcecraft.dev/bigbes/sr-ht-spec/search"
 	"sourcecraft.dev/bigbes/sr-ht-spec/service"
 )
 
-// testConf carries the crypto keys established in TestMain, so a test can seal
-// a unified-login cookie the way meta.sr.ht does and drive the schema through
-// the same middleware the daemon installs.
-var testConf ini.File
-
+// TestMain installs sr-ht-ecore's fixed test keyset, so a test can seal a
+// unified-login cookie the way meta.sr.ht does and drive the schema through the
+// same middleware the daemon installs. The keys are constants there, so this
+// package and web/ can both call it without the second rotating what the first
+// sealed with.
 func TestMain(m *testing.M) {
-	var fk fernet.Key
-	if err := fk.Generate(); err != nil {
-		panic("generate fernet key: " + err.Error())
-	}
-	seed := make([]byte, 32)
-	if _, err := rand.Read(seed); err != nil {
-		panic("generate webhook seed: " + err.Error())
-	}
-	testConf = ini.File{
-		"sr.ht":    ini.Section{"network-key": fk.Encode()},
-		"webhooks": ini.Section{"private-key": base64.StdEncoding.EncodeToString(seed)},
-	}
-	crypto.InitCrypto(testConf)
+	ecoretest.InitCrypto()
 	os.Exit(m.Run())
 }