diff --git a/go.mod b/go.mod
index 9c23401..b3d6e85 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,8 @@
 module raybeam
 
-go 1.25.1
+go 1.26
+
+toolchain go1.26.5
 
 require (
 	github.com/go-ldap/ldap/v3 v3.4.14
diff --git a/internal/server/ldap_client.go b/internal/server/ldap_client.go
new file mode 100644
index 0000000..33ed25d
--- /dev/null
+++ b/internal/server/ldap_client.go
@@ -0,0 +1,13 @@
+package server
+
+import (
+	ldap "github.com/netresearch/simple-ldap-go"
+)
+
+// LDAPClient interface defines the LDAP operations needed by the server.
+// This interface allows for mock implementations in tests.
+type LDAPClient interface {
+	FindUserBySAMAccountName(sAMAccountName string) (*ldap.User, error)
+	FindUsersBySAMAccountNames(sAMAccountNames []string) ([]*ldap.User, error)
+	CheckPasswordForSAMAccountName(sAMAccountName, password string) (*ldap.User, error)
+}
diff --git a/internal/server/test_helpers.go b/internal/server/test_helpers_test.go
similarity index 91%
rename from internal/server/test_helpers.go
rename to internal/server/test_helpers_test.go
index 00e85a9..86aa8ef 100644
--- a/internal/server/test_helpers.go
+++ b/internal/server/test_helpers_test.go
@@ -11,14 +11,6 @@ import (
 	"go.etcd.io/bbolt"
 )
 
-// LDAPClient interface defines the LDAP operations needed by the server.
-// This interface allows for mock implementations in tests.
-type LDAPClient interface {
-	FindUserBySAMAccountName(sAMAccountName string) (*ldap.User, error)
-	FindUsersBySAMAccountNames(sAMAccountNames []string) ([]*ldap.User, error)
-	CheckPasswordForSAMAccountName(sAMAccountName, password string) (*ldap.User, error)
-}
-
 // MockLDAP implements LDAPClient for testing.
 type MockLDAP struct {
 	users    map[string]*ldap.User
@@ -26,6 +18,11 @@ type MockLDAP struct {
 }
 
 // setObjectDN uses reflection to set the DN field in an ldap.Object (which has unexported fields).
+//
+// simple-ldap-go exposes no constructor that takes a DN — Object.dn is written
+// only by objectFromEntry when decoding a directory response — so a fixture
+// cannot be built through the public API. This lives in a _test.go file so the
+// unsafe write is compiled into the test binary only.
 func setObjectDN(obj interface{}, dn string) {
 	// Get the reflect.Value of the object
 	v := reflect.ValueOf(obj).Elem()