diff --git a/backend/app/cmd/server.go b/backend/app/cmd/server.go
index 22c6902d..82aa5dd4 100644
--- a/backend/app/cmd/server.go
+++ b/backend/app/cmd/server.go
@@ -261,7 +261,7 @@ func (s *ServerCommand) newServerApp() (*serverApp, error) {
 		Migrator:         migr,
 		ReadOnlyAge:      s.ReadOnlyAge,
 		SharedSecret:     s.SharedSecret,
-		Authenticator:    *authenticator,
+		Authenticator:    authenticator,
 		Cache:            loadingCache,
 		NotifyService:    notifyService,
 		SSLConfig:        sslConfig,
diff --git a/backend/app/rest/api/admin.go b/backend/app/rest/api/admin.go
index 107a6675..34db4411 100644
--- a/backend/app/rest/api/admin.go
+++ b/backend/app/rest/api/admin.go
@@ -23,7 +23,7 @@ import (
 type admin struct {
 	dataService   *service.DataStore
 	cache         cache.LoadingCache
-	authenticator auth.Service
+	authenticator *auth.Service
 	readOnlyAge   int
 	migrator      *Migrator
 }
diff --git a/backend/app/rest/api/rest.go b/backend/app/rest/api/rest.go
index 86b826bf..4ab25249 100644
--- a/backend/app/rest/api/rest.go
+++ b/backend/app/rest/api/rest.go
@@ -39,7 +39,7 @@ type Rest struct {
 	Version string
 
 	DataService      *service.DataStore
-	Authenticator    auth.Service
+	Authenticator    *auth.Service
 	Cache            cache.LoadingCache
 	ImageProxy       *proxy.Image
 	CommentFormatter *store.CommentFormatter
diff --git a/backend/app/rest/api/rest_test.go b/backend/app/rest/api/rest_test.go
index 7ed3be28..11143548 100644
--- a/backend/app/rest/api/rest_test.go
+++ b/backend/app/rest/api/rest_test.go
@@ -62,7 +62,7 @@ func TestRest_GetStarted(t *testing.T) {
 }
 
 func TestRest_Shutdown(t *testing.T) {
-	srv := Rest{Authenticator: auth.Service{}, ImageProxy: &proxy.Image{}}
+	srv := Rest{Authenticator: &auth.Service{}, ImageProxy: &proxy.Image{}}
 
 	go func() {
 		time.Sleep(100 * time.Millisecond)
@@ -91,7 +91,7 @@ func TestRest_filterComments(t *testing.T) {
 
 func TestRest_RunStaticSSLMode(t *testing.T) {
 	srv := Rest{
-		Authenticator: *auth.NewService(auth.Opts{
+		Authenticator: auth.NewService(auth.Opts{
 			AvatarStore:       avatar.NewLocalFS("/tmp"),
 			AvatarResizeLimit: 300,
 		}),
@@ -143,7 +143,7 @@ func TestRest_RunStaticSSLMode(t *testing.T) {
 
 func TestRest_RunAutocertModeHTTPOnly(t *testing.T) {
 	srv := Rest{
-		Authenticator: auth.Service{},
+		Authenticator: &auth.Service{},
 		ImageProxy:    &proxy.Image{},
 		SSLConfig: SSLConfig{
 			SSLMode: Auto,
@@ -191,7 +191,7 @@ func prep(t *testing.T) (srv *Rest, ts *httptest.Server) {
 
 	srv = &Rest{
 		DataService: dataStore,
-		Authenticator: *auth.NewService(auth.Opts{
+		Authenticator: auth.NewService(auth.Opts{
 			DevPasswd:         "password",
 			SecretReader:      token.SecretFunc(func(id string) (string, error) { return "secret", nil }),
 			AvatarStore:       avatar.NewLocalFS("/tmp"),