diff --git a/tests/test_csrf.py b/tests/test_csrf.py
index c20738c..38f602b 100644
--- a/tests/test_csrf.py
+++ b/tests/test_csrf.py
@@ -91,9 +91,7 @@ class TestCSRFValidation:
         app = _make_app()
         async with AsyncClient(transport=ASGITransport(app=app), base_url="http://testserver") as client:
             token, _ = await _get_token_and_cookies(client)
-            response = await client.post(
-                "/echo", data={"csrf_token": token, "payload": "hello"}
-            )
+            response = await client.post("/echo", data={"csrf_token": token, "payload": "hello"})
             assert response.status_code == 200
             assert response.text == "hello"
 
diff --git a/tests/test_oidc/test_e2e_flow.py b/tests/test_oidc/test_e2e_flow.py
index df74047..6471e62 100644
--- a/tests/test_oidc/test_e2e_flow.py
+++ b/tests/test_oidc/test_e2e_flow.py
@@ -347,16 +347,12 @@ async def test_refresh_grant_does_not_mint_id_token(client: AsyncClient) -> None
     assert "id_token" not in refreshed
 
 
-async def _add_webauthn_credential(
-    app: FastAPI, userid: str
-) -> tuple[ec.EllipticCurvePrivateKey, bytes]:
+async def _add_webauthn_credential(app: FastAPI, userid: str) -> tuple[ec.EllipticCurvePrivateKey, bytes]:
     """Register a WebAuthn credential for an existing user; return (key, cred_id)."""
     private_key = ec.generate_private_key(ec.SECP256R1())
     cose_key = ES256.from_cryptography_key(private_key.public_key())
     credential_id = secrets.token_bytes(32)
-    attested = AttestedCredentialData.create(
-        aaguid=Aaguid.NONE, credential_id=credential_id, public_key=cose_key
-    )
+    attested = AttestedCredentialData.create(aaguid=Aaguid.NONE, credential_id=credential_id, public_key=cose_key)
     await app.state.credential_repo.create_webauthn(
         WebAuthnCredential(user_id=userid, credential_id=credential_id, public_key=bytes(attested))
     )
@@ -364,9 +360,14 @@ async def _add_webauthn_credential(
 
 
 async def _login_webauthn_and_authorize(
-    client: AsyncClient, userid: str, private_key: ec.EllipticCurvePrivateKey, credential_id: bytes, state: str, nonce: str
+    client: AsyncClient,
+    userid: str,
+    credential: tuple[ec.EllipticCurvePrivateKey, bytes],
+    state: str,
+    nonce: str,
 ) -> str:
     """Authorize, log in via WebAuthn assertion, consent, return the auth code."""
+    private_key, credential_id = credential
     auth_res = await client.get(
         "/authorization",
         params={
@@ -432,6 +433,6 @@ async def test_webauthn_login_emits_mfa_acr(client: AsyncClient) -> None:
     private_key, credential_id = await _add_webauthn_credential(app, "lusab-bansen")
 
     state, nonce = secrets.token_urlsafe(16), secrets.token_urlsafe(16)
-    code = await _login_webauthn_and_authorize(client, "lusab-bansen", private_key, credential_id, state, nonce)
+    code = await _login_webauthn_and_authorize(client, "lusab-bansen", (private_key, credential_id), state, nonce)
     token_data = await _exchange_token(client, code)
     await _validate_id_token(client, token_data["id_token"], nonce, expected_acr=ACR_WEBAUTHN)