diff --git a/test/integration/concierge_tls_spec_test.go b/test/integration/concierge_tls_spec_test.go
index b9a42c5e7..669a3357c 100644
--- a/test/integration/concierge_tls_spec_test.go
+++ b/test/integration/concierge_tls_spec_test.go
@@ -178,7 +178,7 @@ func TestTLSSpecKubeBuilderValidationConcierge_Parallel(t *testing.T) {
 			})
 
 			t.Run("apply jwt authenticator", func(t *testing.T) {
-				_, supervisorIssuer := env.SupervisorUpstreamOIDC.InferTheIssuerURL(t)
+				_, supervisorIssuer := env.InferSupervisorIssuerURL(t)
 
 				jwtAuthenticatorResourceName := "test-jwt-authenticator-" + testlib.RandHex(t, 7)
 				jwtAuthenticatorYamlBytes := []byte(fmt.Sprintf(jwtAuthenticatorYamlTemplate,
diff --git a/test/integration/e2e_test.go b/test/integration/e2e_test.go
index 935b6d5ea..bf4b14c4d 100644
--- a/test/integration/e2e_test.go
+++ b/test/integration/e2e_test.go
@@ -70,7 +70,7 @@ func TestE2EFullIntegration_Browser(t *testing.T) {
 	// Build pinniped CLI.
 	pinnipedExe := testlib.PinnipedCLIPath(t)
 
-	issuerURL, _ := env.SupervisorUpstreamOIDC.InferTheIssuerURL(t)
+	issuerURL, _ := env.InferSupervisorIssuerURL(t)
 
 	// Generate a CA bundle with which to serve this provider.
 	t.Logf("generating test CA")
diff --git a/test/integration/supervisor_login_test.go b/test/integration/supervisor_login_test.go
index 6555143fa..ee4490fa2 100644
--- a/test/integration/supervisor_login_test.go
+++ b/test/integration/supervisor_login_test.go
@@ -1240,7 +1240,6 @@ func TestSupervisorLogin_Browser(t *testing.T) {
 			},
 			wantDownstreamIDTokenGroups: env.SupervisorUpstreamActiveDirectory.TestUserIndirectGroupsSAMAccountPlusDomainNames,
 		},
-		// TODO: this test is disabled- where can this be run?
 		{
 			name:      "active directory IDP using secret of type opaque to source ca bundle with all default options",
 			maybeSkip: skipActiveDirectoryTests,
@@ -1282,7 +1281,6 @@ func TestSupervisorLogin_Browser(t *testing.T) {
 			},
 			wantDownstreamIDTokenGroups: env.SupervisorUpstreamActiveDirectory.TestUserIndirectGroupsSAMAccountPlusDomainNames,
 		},
-		// TODO: this test is disabled- where can this be run?
 		{
 			name:      "active directory IDP using secret of type TLS to source ca bundle with all default options",
 			maybeSkip: skipActiveDirectoryTests,
@@ -1326,7 +1324,6 @@ func TestSupervisorLogin_Browser(t *testing.T) {
 			},
 			wantDownstreamIDTokenGroups: env.SupervisorUpstreamActiveDirectory.TestUserIndirectGroupsSAMAccountPlusDomainNames,
 		},
-		// TODO: this test is disabled- where can this be run?
 		{
 			name:      "active directory IDP using configmaps to source ca bundle with all default options",
 			maybeSkip: skipActiveDirectoryTests,
@@ -2948,7 +2945,7 @@ func testSupervisorLogin(
 	ctx, cancel := context.WithTimeout(context.Background(), 7*time.Minute)
 	defer cancel()
 
-	issuerURL, _ := env.SupervisorUpstreamOIDC.InferTheIssuerURL(t)
+	issuerURL, _ := env.InferSupervisorIssuerURL(t)
 
 	// Generate a CA bundle with which to serve this provider.
 	t.Logf("generating test CA")
diff --git a/test/integration/supervisor_warnings_test.go b/test/integration/supervisor_warnings_test.go
index a2a6d4536..f633d7fb3 100644
--- a/test/integration/supervisor_warnings_test.go
+++ b/test/integration/supervisor_warnings_test.go
@@ -48,7 +48,7 @@ func TestSupervisorWarnings_Browser(t *testing.T) {
 	pinnipedExe := testlib.PinnipedCLIPath(t)
 	tempDir := t.TempDir()
 
-	issuerURL, _ := env.SupervisorUpstreamOIDC.InferTheIssuerURL(t)
+	issuerURL, _ := env.InferSupervisorIssuerURL(t)
 
 	// Generate a CA bundle with which to serve this provider.
 	t.Logf("generating test CA")
diff --git a/test/testlib/env.go b/test/testlib/env.go
index 2e4e57611..23833c783 100644
--- a/test/testlib/env.go
+++ b/test/testlib/env.go
@@ -84,10 +84,10 @@ type TestOIDCUpstream struct {
 	ExpectedGroups   []string `json:"expectedGroups"`
 }
 
-// InferTheIssuerURL infers the downstream issuer URL from the callback associated with the upstream test client registration.
-func (upstream *TestOIDCUpstream) InferTheIssuerURL(t *testing.T) (*url.URL, string) {
+// InferSupervisorIssuerURL infers the downstream issuer URL from the callback associated with the upstream test client registration.
+func (e *TestEnv) InferSupervisorIssuerURL(t *testing.T) (*url.URL, string) {
 	t.Helper()
-	issuerURL, err := url.Parse(upstream.CallbackURL)
+	issuerURL, err := url.Parse(e.SupervisorUpstreamOIDC.CallbackURL)
 	require.NoError(t, err)
 	require.True(t, strings.HasSuffix(issuerURL.Path, "/callback"))
 	issuerURL.Path = strings.TrimSuffix(issuerURL.Path, "/callback")