diff --git a/tests/conftest.py b/tests/conftest.py
index 987fe246..db828a71 100644
--- a/tests/conftest.py
+++ b/tests/conftest.py
@@ -1,10 +1,42 @@
 from __future__ import annotations
 
 import os
+from typing import TYPE_CHECKING, Any
 from unittest.mock import MagicMock
 
 import pytest
 
+if TYPE_CHECKING:
+    from turnstone.core.oidc import OIDCConfig
+
+
+def make_oidc_test_config(**overrides: Any) -> OIDCConfig:
+    """Build a test ``OIDCConfig`` with sensible defaults.
+
+    Shared between ``test_oidc.py`` and ``test_oidc_handlers.py`` so the
+    defaults (including the now-required ``redirect_base``) stay aligned.
+    """
+    from turnstone.core.oidc import OIDCConfig
+
+    defaults: dict[str, Any] = {
+        "enabled": True,
+        "issuer": "https://idp.example.com",
+        "client_id": "my-client",
+        "client_secret": "my-secret",
+        "scopes": "openid email profile",
+        "provider_name": "TestIDP",
+        "role_claim": "",
+        "role_map": {},
+        "password_enabled": True,
+        "redirect_base": "https://app.example.com",
+        "authorization_endpoint": "https://idp.example.com/authorize",
+        "token_endpoint": "https://idp.example.com/token",
+        "userinfo_endpoint": "https://idp.example.com/userinfo",
+        "jwks_uri": "https://idp.example.com/.well-known/jwks.json",
+    }
+    defaults.update(overrides)
+    return OIDCConfig(**defaults)
+
 
 def pytest_addoption(parser: pytest.Parser) -> None:
     parser.addoption(
diff --git a/tests/test_oidc.py b/tests/test_oidc.py
index 6ed05913..32872887 100644
--- a/tests/test_oidc.py
+++ b/tests/test_oidc.py
@@ -15,8 +15,8 @@ import httpx
 import jwt as pyjwt
 import pytest
 
+from tests.conftest import make_oidc_test_config as _make_config
 from turnstone.core.oidc import (
-    OIDCConfig,
     OIDCError,
     OIDCKeyNotFoundError,
     _ensure_default_role,
@@ -39,27 +39,6 @@ from turnstone.core.oidc import (
 # ---------------------------------------------------------------------------
 
 
-def _make_config(**overrides) -> OIDCConfig:
-    """Build a test OIDCConfig with sensible defaults."""
-    defaults = {
-        "enabled": True,
-        "issuer": "https://idp.example.com",
-        "client_id": "my-client",
-        "client_secret": "my-secret",
-        "scopes": "openid email profile",
-        "provider_name": "TestIDP",
-        "role_claim": "",
-        "role_map": {},
-        "password_enabled": True,
-        "authorization_endpoint": "https://idp.example.com/authorize",
-        "token_endpoint": "https://idp.example.com/token",
-        "userinfo_endpoint": "https://idp.example.com/userinfo",
-        "jwks_uri": "https://idp.example.com/.well-known/jwks.json",
-    }
-    defaults.update(overrides)
-    return OIDCConfig(**defaults)
-
-
 def _mock_storage(**overrides):
     """Build a MagicMock with sensible storage defaults."""
     s = MagicMock()
diff --git a/tests/test_oidc_handlers.py b/tests/test_oidc_handlers.py
index 7b7d9055..9f9a83f9 100644
--- a/tests/test_oidc_handlers.py
+++ b/tests/test_oidc_handlers.py
@@ -18,10 +18,7 @@ from starlette.middleware.base import BaseHTTPMiddleware
 from starlette.routing import Mount, Route
 from starlette.testclient import TestClient
 
-if TYPE_CHECKING:
-    from starlette.requests import Request
-    from starlette.responses import Response
-
+from tests.conftest import make_oidc_test_config as _make_oidc_config
 from turnstone.console.server import (
     admin_delete_oidc_identity,
     admin_list_oidc_identities,
@@ -35,32 +32,9 @@ from turnstone.core.auth import (
 from turnstone.core.oidc import OIDCConfig, OIDCError, OIDCKeyNotFoundError
 from turnstone.core.storage._sqlite import SQLiteBackend
 
-# ---------------------------------------------------------------------------
-# Helpers
-# ---------------------------------------------------------------------------
-
-
-def _make_oidc_config(**overrides: Any) -> OIDCConfig:
-    """Build a test OIDCConfig with sensible defaults."""
-    defaults: dict[str, Any] = {
-        "enabled": True,
-        "issuer": "https://idp.example.com",
-        "client_id": "my-client",
-        "client_secret": "my-secret",
-        "scopes": "openid email profile",
-        "provider_name": "TestIDP",
-        "role_claim": "",
-        "role_map": {},
-        "password_enabled": True,
-        "redirect_base": "https://app.example.com",
-        "authorization_endpoint": "https://idp.example.com/authorize",
-        "token_endpoint": "https://idp.example.com/token",
-        "userinfo_endpoint": "https://idp.example.com/userinfo",
-        "jwks_uri": "https://idp.example.com/.well-known/jwks.json",
-    }
-    defaults.update(overrides)
-    return OIDCConfig(**defaults)
-
+if TYPE_CHECKING:
+    from starlette.requests import Request
+    from starlette.responses import Response
 
 # ---------------------------------------------------------------------------
 # Thin handler wrappers — match the pattern used in server.py / console
diff --git a/turnstone/core/oidc.py b/turnstone/core/oidc.py
index b6d098e7..f69af2dc 100644
--- a/turnstone/core/oidc.py
+++ b/turnstone/core/oidc.py
@@ -76,7 +76,7 @@ _KNOWN_TRUSTED_ENDPOINT_HOSTS: dict[str, frozenset[str]] = {
 
 
 # ---------------------------------------------------------------------------
-# Exception
+# Exceptions
 # ---------------------------------------------------------------------------