diff --git a/tests/DodoSSH.SystemTests/M1VerticalSliceTests.cs b/tests/DodoSSH.SystemTests/M1VerticalSliceTests.cs
index b71bbdc..9f88548 100644
--- a/tests/DodoSSH.SystemTests/M1VerticalSliceTests.cs
+++ b/tests/DodoSSH.SystemTests/M1VerticalSliceTests.cs
@@ -61,21 +61,7 @@ public sealed class M1VerticalSliceTests(DevStack stack) : IClassFixture<DevStac
         var account = DevStack.RealmUser;
         var browser = new ScriptedBrowser(account.Username, account.Password);
 
-        // The plaintext exemption is stated here rather than inferred from the address, and that is the
-        // whole point of stating it. ServerConnection allows an http authority only when it is loopback,
-        // which is a sound rule and not one this suite can rely on: Testcontainers reports the host it
-        // can actually be reached at, so a developer running the tests directly gets localhost and passes,
-        // while the same suite inside a container gets the bridge gateway — 172.17.0.1 — and is refused.
-        // That is the product being right. 172.17.0.1 is not loopback, and a client that quietly accepted
-        // plaintext metadata from a routable address would be a real weakness for everyone who is not a
-        // test. So the test says out loud that it accepts plaintext from the throwaway Keycloak it started
-        // itself, and the rule stays as strict as it was for everybody else.
-        using var connection = await ServerConnection.SignInAsync(
-            stack.ApiBaseUrl,
-            browser,
-            TimeProvider.System,
-            Token,
-            configureOidc: options => options with { RequireHttpsMetadata = false });
+        using var connection = await SignInToTheStackAsync(browser);
 
         AssertDiscoveredFromTheServer(connection);
 
@@ -127,6 +113,32 @@ public sealed class M1VerticalSliceTests(DevStack stack) : IClassFixture<DevStac
 
     // ---- Steps ----
 
+    /// <summary>Signs in against the Keycloak this suite started for itself.</summary>
+    /// <remarks>
+    /// <para>
+    /// The plaintext exemption is stated here rather than inherited from the shape of an address, and
+    /// saying it out loud is the point. <see cref="ServerConnection"/> allows an <c>http</c> authority
+    /// only when it is loopback — a sound rule, and not one this suite can lean on. Testcontainers
+    /// reports the host a caller can actually reach it at, so running these tests directly yields
+    /// <c>localhost</c> and passes, while running them inside a container yields the bridge gateway
+    /// <c>172.17.0.1</c> and is refused.
+    /// </para>
+    /// <para>
+    /// That refusal is the product being correct. 172.17.0.1 is genuinely not loopback, and a client
+    /// that quietly accepted plaintext metadata from a routable address would be a real weakness for
+    /// everybody who is not a test. So the exemption is claimed here, by the one caller that knows it
+    /// started the provider itself and that it lives for the length of one test, and the rule stays
+    /// exactly as strict for everyone else.
+    /// </para>
+    /// </remarks>
+    private Task<ServerConnection> SignInToTheStackAsync(ScriptedBrowser browser) =>
+        ServerConnection.SignInAsync(
+            stack.ApiBaseUrl,
+            browser,
+            TimeProvider.System,
+            Token,
+            configureOidc: options => options with { RequireHttpsMetadata = false });
+
     /// <remarks>
     /// The user typed one server URL. Everything about the identity provider — the authority, the client
     /// id, the scopes — came back from the server, which is the whole onboarding story.