diff --git a/hscontrol/servertest/client.go b/hscontrol/servertest/client.go
index c046b2a1..f315594a 100644
--- a/hscontrol/servertest/client.go
+++ b/hscontrol/servertest/client.go
@@ -105,9 +105,13 @@ func NewClient(tb testing.TB, server *TestServer, name string, opts ...ClientOpt
 	uid := types.UserID(user.ID)
 
 	var authKey string
-	if cc.ephemeral {
+
+	switch {
+	case cc.ephemeral:
 		authKey = server.CreateEphemeralPreAuthKey(tb, uid)
-	} else {
+	case len(cc.tags) > 0:
+		authKey = server.CreateTaggedPreAuthKey(tb, uid, cc.tags)
+	default:
 		authKey = server.CreatePreAuthKey(tb, uid)
 	}
 
diff --git a/hscontrol/servertest/server.go b/hscontrol/servertest/server.go
index 981b7234..0f1504af 100644
--- a/hscontrol/servertest/server.go
+++ b/hscontrol/servertest/server.go
@@ -175,6 +175,20 @@ func (s *TestServer) CreatePreAuthKey(tb testing.TB, userID types.UserID) string
 	return pak.Key
 }
 
+// CreateTaggedPreAuthKey creates a reusable pre-auth key with ACL tags.
+func (s *TestServer) CreateTaggedPreAuthKey(tb testing.TB, userID types.UserID, tags []string) string {
+	tb.Helper()
+
+	uid := userID
+
+	pak, err := s.st.CreatePreAuthKey(&uid, true, false, nil, tags)
+	if err != nil {
+		tb.Fatalf("servertest: CreateTaggedPreAuthKey: %v", err)
+	}
+
+	return pak.Key
+}
+
 // CreateEphemeralPreAuthKey creates an ephemeral pre-auth key.
 func (s *TestServer) CreateEphemeralPreAuthKey(tb testing.TB, userID types.UserID) string {
 	tb.Helper()