diff --git a/lib/encryption.js b/lib/encryption.js
index 61e0401..4b86935 100644
--- a/lib/encryption.js
+++ b/lib/encryption.js
@@ -63,7 +63,7 @@ function decrypt(rec, peer, config) {
 
   // Decrypt
   const ciphertextBuf = ciphertextStrToBuffer(data)
-  const opts = { keys: keypairToSSBKeys(config.keypair) }
+  const opts = { keys: keypairToSSBKeys(config.global.keypair) }
   const plaintextBuf = encryptionFormat.decrypt(ciphertextBuf, opts)
   if (!plaintextBuf) return rec
 
diff --git a/lib/index.js b/lib/index.js
index d170fed..6f11b8e 100644
--- a/lib/index.js
+++ b/lib/index.js
@@ -28,12 +28,8 @@ const { decrypt } = require('./encryption')
  * @typedef {import('./msg-v4/tangle')} Tangle
  * @typedef {import('./encryption').EncryptionFormat} EncryptionFormat
  * @typedef {Buffer | Uint8Array} B4A
- * @typedef {{
- *   db: {
- *     path: string
- *   }
- * }} ExpectedConfig
- * @typedef {{db?: Partial<ExpectedConfig['db']>, keypair: Keypair;}} Config
+ * @typedef {{global: {keypair: Keypair; path: string}}} ExpectedConfig
+ * @typedef {{global: {keypair: Keypair; path?: string}}} Config
  */
 
 /**
@@ -80,8 +76,8 @@ const { decrypt } = require('./encryption')
  * @returns {asserts config is ExpectedConfig}
  */
 function assertValidConfig(config) {
-  if (typeof config.db?.path !== 'string') {
-    throw new Error('db requires config.db.path')
+  if (typeof config.global?.path !== 'string') {
+    throw new Error('db requires config.global.path')
   }
 }
 
@@ -211,7 +207,7 @@ function initDB(peer, config) {
     },
   }
 
-  const log = Log(Path.join(config.db.path, 'log'), {
+  const log = Log(Path.join(config.global.path, 'db', 'log'), {
     blockSize: 64 * 1024,
     codec,
     /**
@@ -227,7 +223,7 @@ function initDB(peer, config) {
     },
   })
 
-  const ghosts = new Ghosts(Path.join(config.db.path, 'ghosts'))
+  const ghosts = new Ghosts(Path.join(config.global.path, 'db', 'ghosts'))
 
   peer.close.hook(function (/** @type {any} */ fn, /** @type {any} */ args) {
     log.close(() => {
@@ -536,7 +532,7 @@ function initDB(peer, config) {
    * @param {CB<MsgID>} cb
    */
   function initializeFeed(opts, cb) {
-    const keypair = opts.keypair ?? config.keypair
+    const keypair = opts.keypair ?? config.global.keypair
     const { account, domain } = opts
 
     const mootID = findMoot(account, domain)?.id
@@ -571,8 +567,8 @@ function initDB(peer, config) {
 
   /**
    * Find the account that contains this `keypair` (or the implicit
-   * config.keypair) under the given `subdomain` (will be converted to an actual
-   * msg domain).
+   * config.global.keypair) under the given `subdomain` (will be converted to
+   * an actual msg domain).
    *
    * @public
    * @param {{
@@ -584,7 +580,7 @@ function initDB(peer, config) {
   function findAccount(opts, cb) {
     // prettier-ignore
     if (!opts.subdomain) return cb(new Error('account.find() requires a `subdomain`'))
-    const keypair = opts?.keypair ?? config.keypair
+    const keypair = opts?.keypair ?? config.global.keypair
     const domain = ACCOUNT_DOMAIN_PREFIX + opts.subdomain
 
     for (let i = 0; i < recs.length; i++) {
@@ -612,7 +608,8 @@ function initDB(peer, config) {
   }
 
   /**
-   * Does this `account` have this `keypair` (or the implicit config.keypair)?
+   * Does this `account` have this `keypair` (or the implicit
+   * config.global.keypair)?
    *
    * @public
    * @param {{
@@ -622,7 +619,7 @@ function initDB(peer, config) {
    * @returns {boolean}
    */
   function accountHas(opts) {
-    const keypair = opts?.keypair ?? config.keypair
+    const keypair = opts?.keypair ?? config.global.keypair
 
     const accountTangle = new DBTangle(opts.account, records(), get)
     for (const msgID of accountTangle.topoSort()) {
@@ -641,8 +638,8 @@ function initDB(peer, config) {
 
   /**
    * Create an account (root msg) for the given `keypair` (or the implicit
-   * config.keypair) under the given `subdomain` (will be converted to an actual
-   * msg domain).
+   * config.global.keypair) under the given `subdomain` (will be converted to an
+   * actual msg domain).
    *
    * @public
    * @param {{
@@ -655,7 +652,7 @@ function initDB(peer, config) {
   function createAccount(opts, cb) {
     // prettier-ignore
     if (!opts.subdomain) return cb(new Error('account.create() requires a `subdomain`'))
-    const keypair = opts?.keypair ?? config.keypair
+    const keypair = opts?.keypair ?? config.global.keypair
     const domain = ACCOUNT_DOMAIN_PREFIX + opts.subdomain
 
     let msg
@@ -676,8 +673,8 @@ function initDB(peer, config) {
 
   /**
    * Find or create an account (root msg) for the given `keypair` (or the
-   * implicit config.keypair) under the given `domain` (will be converted to an
-   * actual msg domain).
+   * implicit config.global.keypair) under the given `domain` (will be converted
+   * to an actual msg domain).
    *
    * @public
    * @param {{
@@ -725,7 +722,7 @@ function initDB(peer, config) {
 
   /**
    * Create a consent signature for the given `keypair` (or the implicit
-   * config.keypair) to be added to the given `account`.
+   * config.global.keypair) to be added to the given `account`.
    *
    * @public
    * @param {{
@@ -737,7 +734,7 @@ function initDB(peer, config) {
   function consentToAccount(opts) {
     // prettier-ignore
     if (!opts.account) throw new Error('account.consent() requires an `account`')
-    const keypair = opts?.keypair ?? config.keypair
+    const keypair = opts?.keypair ?? config.global.keypair
 
     const signableBuf = b4a.from(
       SIGNATURE_TAG_ACCOUNT_ADD + base58.decode(opts.account),
@@ -747,10 +744,10 @@ function initDB(peer, config) {
   }
 
   /**
-   * Add the given `keypair` (or the implicit config.keypair) to the given
-   * `account`, authorized by the given `consent` (or implicitly created on the
-   * fly if the `keypair` contains the private key) with the following `powers`
-   * (defaulting to no powers).
+   * Add the given `keypair` (or the implicit config.global.keypair) to the
+   * given `account`, authorized by the given `consent` (or implicitly created
+   * on the fly if the `keypair` contains the private key) with the following
+   * `powers` (defaulting to no powers).
    *
    * @param {{
    *   account: string;
@@ -783,7 +780,7 @@ function initDB(peer, config) {
     }
     const obeying = !opts._disobey
     const addedKeypair = opts.keypair
-    const signingKeypair = config.keypair
+    const signingKeypair = config.global.keypair
 
     // Verify consent:
     const signableBuf = b4a.from(
@@ -911,7 +908,7 @@ function initDB(peer, config) {
       }
     }
 
-    const keypair = opts.keypair ?? config.keypair
+    const keypair = opts.keypair ?? config.global.keypair
     initializeFeed(opts, (err, mootID) => {
       // prettier-ignore
       if (err) return cb(new Error('feed.publish() failed to initialize feed', { cause: err }));
diff --git a/package.json b/package.json
index 04b4d91..20dc37b 100644
--- a/package.json
+++ b/package.json
@@ -55,7 +55,8 @@
     "prettier": "^2.6.2",
     "pretty-quick": "^3.1.3",
     "rimraf": "^4.4.0",
-    "secret-stack": "^6.4.2",
+    "secret-stack": "8.0.0",
+    "secret-handshake-ext": "0.0.10",
     "ssb-box": "^1.0.1",
     "typescript": "^5.1.3"
   },
diff --git a/test/account-add.test.js b/test/account-add.test.js
index a21a30f..ea3b32f 100644
--- a/test/account-add.test.js
+++ b/test/account-add.test.js
@@ -4,9 +4,8 @@ const path = require('node:path')
 const p = require('node:util').promisify
 const os = require('node:os')
 const rimraf = require('rimraf')
-const SecretStack = require('secret-stack')
-const caps = require('ppppp-caps')
 const Keypair = require('ppppp-keypair')
+const { createPeer } = require('./util')
 
 const DIR = path.join(os.tmpdir(), 'ppppp-db-account-add')
 rimraf.sync(DIR)
@@ -16,10 +15,7 @@ test('account.add()', async (t) => {
     const keypair1 = Keypair.generate('ed25519', 'alice')
     const keypair2 = Keypair.generate('ed25519', 'bob')
 
-    const peer = SecretStack({ appKey: caps.shse })
-      .use(require('../lib'))
-      .use(require('ssb-box'))
-      .call(null, { keypair: keypair1, db: { path: DIR } })
+    const peer = createPeer({ keypair: keypair1, path: DIR })
 
     await peer.db.loaded()
     const account = await p(peer.db.account.create)({
@@ -75,10 +71,7 @@ test('account.add()', async (t) => {
     const keypair2 = Keypair.generate('ed25519', 'bob')
     const keypair3 = Keypair.generate('ed25519', 'carol')
 
-    const peer1 = SecretStack({ appKey: caps.shse })
-      .use(require('../lib'))
-      .use(require('ssb-box'))
-      .call(null, { keypair: keypair1, db: { path: DIR } })
+    const peer1 = createPeer({ keypair: keypair1, path: DIR })
 
     await peer1.db.loaded()
     const id = await p(peer1.db.account.create)({
@@ -99,10 +92,7 @@ test('account.add()', async (t) => {
     await p(peer1.close)()
     rimraf.sync(DIR)
 
-    const peer2 = SecretStack({ appKey: caps.shse })
-      .use(require('../lib'))
-      .use(require('ssb-box'))
-      .call(null, { keypair: keypair2, db: { path: DIR } })
+    const peer2 = createPeer({ keypair: keypair2, path: DIR })
 
     await peer2.db.loaded()
     await p(peer2.db.add)(msg1, id)
@@ -131,10 +121,7 @@ test('account.add()', async (t) => {
     await p(peer2.close)()
     rimraf.sync(DIR)
 
-    const peer1again = SecretStack({ appKey: caps.shse })
-      .use(require('../lib'))
-      .use(require('ssb-box'))
-      .call(null, { keypair: keypair1, db: { path: DIR } })
+    const peer1again = createPeer({ keypair: keypair1, path: DIR })
 
     await peer1again.db.loaded()
     await p(peer1again.db.add)(msg1, id) // re-add because lost during rimraf
@@ -155,10 +142,7 @@ test('account.add()', async (t) => {
     const keypair1 = Keypair.generate('ed25519', 'alice')
     const keypair2 = Keypair.generate('ed25519', 'bob')
 
-    let peer = SecretStack({ appKey: caps.shse })
-      .use(require('../lib'))
-      .use(require('ssb-box'))
-      .call(null, { keypair: keypair1, db: { path: DIR } })
+    let peer = createPeer({ keypair: keypair1, path: DIR })
 
     await peer.db.loaded()
 
@@ -210,10 +194,7 @@ test('account.add()', async (t) => {
     rimraf.sync(DIR)
     const keypair3 = Keypair.generate('ed25519', 'carol')
 
-    const carol = SecretStack({ appKey: caps.shse })
-      .use(require('../lib'))
-      .use(require('ssb-box'))
-      .call(null, { keypair: keypair3, db: { path: DIR } })
+    const carol = createPeer({ keypair: keypair3, path: DIR })
 
     await carol.db.loaded()
 
diff --git a/test/account-create.test.js b/test/account-create.test.js
index e9c84f1..cb29d6f 100644
--- a/test/account-create.test.js
+++ b/test/account-create.test.js
@@ -4,9 +4,8 @@ const path = require('node:path')
 const os = require('node:os')
 const p = require('node:util').promisify
 const rimraf = require('rimraf')
-const SecretStack = require('secret-stack')
-const caps = require('ppppp-caps')
 const Keypair = require('ppppp-keypair')
+const { createPeer } = require('./util')
 
 const DIR = path.join(os.tmpdir(), 'ppppp-db-account-create')
 rimraf.sync(DIR)
@@ -14,10 +13,7 @@ rimraf.sync(DIR)
 test('account.create() ', async (t) => {
   await t.test('create with just "domain"', async (t) => {
     const keypair = Keypair.generate('ed25519', 'alice')
-    const peer = SecretStack({ appKey: caps.shse })
-      .use(require('../lib'))
-      .use(require('ssb-box'))
-      .call(null, { keypair, db: { path: DIR } })
+    const peer = createPeer({ keypair, path: DIR })
 
     await peer.db.loaded()
     const account = await p(peer.db.account.create)({
@@ -56,10 +52,7 @@ test('account.create() ', async (t) => {
     rimraf.sync(DIR)
     const keypair = Keypair.generate('ed25519', 'alice')
 
-    const peer = SecretStack({ appKey: caps.shse })
-      .use(require('../lib'))
-      .use(require('ssb-box'))
-      .call(null, { keypair, db: { path: DIR } })
+    const peer = createPeer({ keypair, path: DIR })
 
     await peer.db.loaded()
     const account = await p(peer.db.account.create)({
@@ -86,10 +79,7 @@ test('account.create() ', async (t) => {
     const keypair = Keypair.generate('ed25519', 'alice')
     const subdomain = 'person'
 
-    const peer = SecretStack({ appKey: caps.shse })
-      .use(require('../lib'))
-      .use(require('ssb-box'))
-      .call(null, { keypair, db: { path: DIR } })
+    const peer = createPeer({ keypair, path: DIR })
 
     await peer.db.loaded()
     const account = await p(peer.db.account.create)({ keypair, subdomain })
@@ -106,10 +96,7 @@ test('account.create() ', async (t) => {
     const keypair = Keypair.generate('ed25519', 'alice')
     const subdomain = 'person'
 
-    const peer = SecretStack({ appKey: caps.shse })
-      .use(require('../lib'))
-      .use(require('ssb-box'))
-      .call(null, { keypair, db: { path: DIR } })
+    const peer = createPeer({ keypair, path: DIR })
 
     await peer.db.loaded()
     const account = await p(peer.db.account.create)({ keypair, subdomain })
@@ -126,10 +113,7 @@ test('account.create() ', async (t) => {
     const keypair = Keypair.generate('ed25519', 'alice')
     const subdomain = 'person'
 
-    const peer = SecretStack({ appKey: caps.shse })
-      .use(require('../lib'))
-      .use(require('ssb-box'))
-      .call(null, { keypair, db: { path: DIR } })
+    const peer = createPeer({ keypair, path: DIR })
 
     await peer.db.loaded()
 
diff --git a/test/add.test.js b/test/add.test.js
index e4284f8..f994bb4 100644
--- a/test/add.test.js
+++ b/test/add.test.js
@@ -4,20 +4,16 @@ const path = require('node:path')
 const os = require('node:os')
 const p = require('node:util').promisify
 const rimraf = require('rimraf')
-const SecretStack = require('secret-stack')
-const caps = require('ppppp-caps')
 const Keypair = require('ppppp-keypair')
 const MsgV4 = require('../lib/msg-v4')
+const { createPeer } = require('./util')
 
 const DIR = path.join(os.tmpdir(), 'ppppp-db-add')
 rimraf.sync(DIR)
 
 test('add()', async (t) => {
   const keypair = Keypair.generate('ed25519', 'alice')
-  const peer = SecretStack({ appKey: caps.shse })
-    .use(require('../lib'))
-    .use(require('ssb-box'))
-    .call(null, { keypair, db: { path: DIR } })
+  const peer = createPeer({ keypair, path: DIR })
 
   await peer.db.loaded()
 
diff --git a/test/del.test.js b/test/del.test.js
index 83bcca1..b1e9a03 100644
--- a/test/del.test.js
+++ b/test/del.test.js
@@ -4,19 +4,18 @@ const path = require('node:path')
 const os = require('node:os')
 const p = require('node:util').promisify
 const rimraf = require('rimraf')
-const SecretStack = require('secret-stack')
 const Log = require('../lib/log')
-const caps = require('ppppp-caps')
 const Keypair = require('ppppp-keypair')
+const { createPeer } = require('./util')
 
 const DIR = path.join(os.tmpdir(), 'ppppp-db-del')
 rimraf.sync(DIR)
 
 test('del()', async (t) => {
-  const keypair = Keypair.generate('ed25519', 'alice')
-  const peer = SecretStack({ appKey: caps.shse })
-    .use(require('../lib'))
-    .call(null, { keypair, db: { path: DIR } })
+  const peer = createPeer({
+    keypair: Keypair.generate('ed25519', 'alice'),
+    path: DIR,
+  })
 
   await peer.db.loaded()
 
@@ -71,7 +70,7 @@ test('del()', async (t) => {
 
   await p(peer.close)(true)
 
-  const log = Log(path.join(DIR, 'log'), {
+  const log = Log(path.join(DIR, 'db', 'log'), {
     cacheSize: 1,
     blockSize: 64 * 1024,
     codec: {
diff --git a/test/erase.test.js b/test/erase.test.js
index 69e3ec7..eceb333 100644
--- a/test/erase.test.js
+++ b/test/erase.test.js
@@ -4,19 +4,18 @@ const path = require('node:path')
 const os = require('node:os')
 const p = require('node:util').promisify
 const rimraf = require('rimraf')
-const SecretStack = require('secret-stack')
-const Log = require('../lib/log')
-const caps = require('ppppp-caps')
 const Keypair = require('ppppp-keypair')
+const Log = require('../lib/log')
+const { createPeer } = require('./util')
 
 const DIR = path.join(os.tmpdir(), 'ppppp-db-erase')
 rimraf.sync(DIR)
 
 test('erase()', async (t) => {
-  const keypair = Keypair.generate('ed25519', 'alice')
-  const peer = SecretStack({ appKey: caps.shse })
-    .use(require('../lib'))
-    .call(null, { keypair, db: { path: DIR } })
+  const peer = createPeer({
+    keypair: Keypair.generate('ed25519', 'alice'),
+    path: DIR,
+  })
 
   await peer.db.loaded()
 
@@ -82,7 +81,7 @@ test('erase()', async (t) => {
 
   await p(peer.close)(true)
 
-  const log = Log(path.join(DIR, 'log'), {
+  const log = Log(path.join(DIR, 'db', 'log'), {
     cacheSize: 1,
     blockSize: 64 * 1024,
     codec: {
diff --git a/test/feed-find-moot.test.js b/test/feed-find-moot.test.js
index 7de7128..b33ef4e 100644
--- a/test/feed-find-moot.test.js
+++ b/test/feed-find-moot.test.js
@@ -4,20 +4,16 @@ const path = require('node:path')
 const os = require('node:os')
 const p = require('node:util').promisify
 const rimraf = require('rimraf')
-const SecretStack = require('secret-stack')
-const caps = require('ppppp-caps')
 const Keypair = require('ppppp-keypair')
 const MsgV4 = require('../lib/msg-v4')
+const { createPeer } = require('./util')
 
 const DIR = path.join(os.tmpdir(), 'ppppp-db-feed-find-moot')
 rimraf.sync(DIR)
 
 test('feed.findMoot()', async (t) => {
   const keypair = Keypair.generate('ed25519', 'alice')
-  const peer = SecretStack({ appKey: caps.shse })
-    .use(require('../lib'))
-    .use(require('ssb-box'))
-    .call(null, { keypair, db: { path: DIR } })
+  const peer = createPeer({ keypair, path: DIR })
 
   await peer.db.loaded()
 
diff --git a/test/feed-get-id.test.js b/test/feed-get-id.test.js
index a1437a8..2a052ae 100644
--- a/test/feed-get-id.test.js
+++ b/test/feed-get-id.test.js
@@ -4,20 +4,16 @@ const path = require('node:path')
 const os = require('node:os')
 const p = require('node:util').promisify
 const rimraf = require('rimraf')
-const SecretStack = require('secret-stack')
-const caps = require('ppppp-caps')
 const Keypair = require('ppppp-keypair')
 const MsgV4 = require('../lib/msg-v4')
+const { createPeer } = require('./util')
 
 const DIR = path.join(os.tmpdir(), 'ppppp-db-feed-get-id')
 rimraf.sync(DIR)
 
 test('feed.getID()', async (t) => {
   const keypair = Keypair.generate('ed25519', 'alice')
-  const peer = SecretStack({ appKey: caps.shse })
-    .use(require('../lib'))
-    .use(require('ssb-box'))
-    .call(null, { keypair, db: { path: DIR } })
+  const peer = createPeer({ keypair, path: DIR })
 
   await peer.db.loaded()
 
diff --git a/test/feed-publish.test.js b/test/feed-publish.test.js
index d22d182..6d4c791 100644
--- a/test/feed-publish.test.js
+++ b/test/feed-publish.test.js
@@ -4,10 +4,9 @@ const path = require('node:path')
 const os = require('node:os')
 const p = require('node:util').promisify
 const rimraf = require('rimraf')
-const SecretStack = require('secret-stack')
-const caps = require('ppppp-caps')
 const Keypair = require('ppppp-keypair')
 const MsgV4 = require('../lib/msg-v4')
+const { createPeer } = require('./util')
 
 const DIR = path.join(os.tmpdir(), 'ppppp-db-feed-publish')
 rimraf.sync(DIR)
@@ -22,10 +21,7 @@ test('feed.publish()', async (t) => {
 
   // Setup
   {
-    peer = SecretStack({ appKey: caps.shse })
-      .use(require('../lib'))
-      .use(require('ssb-box'))
-      .call(null, { keypair, db: { path: DIR } })
+    peer = createPeer({ keypair, path: DIR })
 
     await peer.db.loaded()
 
diff --git a/test/get.test.js b/test/get.test.js
index 1b97f02..257d1ea 100644
--- a/test/get.test.js
+++ b/test/get.test.js
@@ -4,20 +4,18 @@ const path = require('node:path')
 const os = require('node:os')
 const p = require('node:util').promisify
 const rimraf = require('rimraf')
-const SecretStack = require('secret-stack')
-const caps = require('ppppp-caps')
 const Keypair = require('ppppp-keypair')
 const MsgV4 = require('../lib/msg-v4')
+const { createPeer } = require('./util')
 
 const DIR = path.join(os.tmpdir(), 'ppppp-db-get')
 rimraf.sync(DIR)
 
 test('get()', async (t) => {
-  const keypair = Keypair.generate('ed25519', 'alice')
-  const peer = SecretStack({ appKey: caps.shse })
-    .use(require('../lib'))
-    .use(require('ssb-box'))
-    .call(null, { keypair, db: { path: DIR } })
+  const peer = createPeer({
+    keypair: Keypair.generate('ed25519', 'alice'),
+    path: DIR,
+  })
 
   await peer.db.loaded()
 
diff --git a/test/getTangle.test.js b/test/getTangle.test.js
index 797e9b2..6bb61a3 100644
--- a/test/getTangle.test.js
+++ b/test/getTangle.test.js
@@ -4,9 +4,8 @@ const path = require('node:path')
 const os = require('node:os')
 const p = require('node:util').promisify
 const rimraf = require('rimraf')
-const SecretStack = require('secret-stack')
-const caps = require('ppppp-caps')
 const Keypair = require('ppppp-keypair')
+const { createPeer } = require('./util')
 
 const DIR = path.join(os.tmpdir(), 'ppppp-db-tangle')
 rimraf.sync(DIR)
@@ -28,10 +27,7 @@ test('getTangle()', async (t) => {
     const keypairB = Keypair.generate('ed25519', 'bob')
     const keypairC = Keypair.generate('ed25519', 'carol')
 
-    peer = SecretStack({ appKey: caps.shse })
-      .use(require('../lib'))
-      .use(require('ssb-box'))
-      .call(null, { keypair: keypairA, db: { path: DIR } })
+    peer = createPeer({ path: DIR, keypair: keypairA })
 
     await peer.db.loaded()
 
diff --git a/test/ghosts.tests.js b/test/ghosts.tests.js
index a893c37..4ecd2ba 100644
--- a/test/ghosts.tests.js
+++ b/test/ghosts.tests.js
@@ -4,19 +4,15 @@ const path = require('node:path')
 const os = require('node:os')
 const p = require('node:util').promisify
 const rimraf = require('rimraf')
-const SecretStack = require('secret-stack')
-const caps = require('ppppp-caps')
 const Keypair = require('ppppp-keypair')
+const { createPeer } = require('./util')
 
 const DIR = path.join(os.tmpdir(), 'ppppp-db-ghosts')
 rimraf.sync(DIR)
 
 const keypair = Keypair.generate('ed25519', 'alice')
 test('ghosts.add, ghosts.get, ghosts.getMinDepth', async (t) => {
-  const peer = SecretStack({ appKey: caps.shse })
-    .use(require('../lib'))
-    .use(require('ssb-box'))
-    .call(null, { keypair, db: { path: DIR } })
+  const peer = createPeer({ keypair, path: DIR })
 
   await peer.db.loaded()
 
@@ -59,10 +55,7 @@ test('ghosts.add, ghosts.get, ghosts.getMinDepth', async (t) => {
 })
 
 test('ghosts.add queues very-concurrent calls', async (t) => {
-  const peer = SecretStack({ appKey: caps.shse })
-    .use(require('../lib'))
-    .use(require('ssb-box'))
-    .call(null, { keypair, db: { path: DIR } })
+  const peer = createPeer({ keypair, path: DIR })
 
   await peer.db.loaded()
 
diff --git a/test/msgs-iterator.test.js b/test/msgs-iterator.test.js
index c6bd2d3..7f6e9c9 100644
--- a/test/msgs-iterator.test.js
+++ b/test/msgs-iterator.test.js
@@ -4,18 +4,15 @@ const path = require('node:path')
 const os = require('node:os')
 const p = require('node:util').promisify
 const rimraf = require('rimraf')
-const SecretStack = require('secret-stack')
-const caps = require('ppppp-caps')
 const Keypair = require('ppppp-keypair')
+const { createPeer } = require('./util')
 
 const DIR = path.join(os.tmpdir(), 'ppppp-db-msgs-iter')
 rimraf.sync(DIR)
 
 test('msgs() iterator', async (t) => {
   const keypair = Keypair.generate('ed25519', 'alice')
-  const peer = SecretStack({ appKey: caps.shse })
-    .use(require('../lib'))
-    .call(null, { keypair, db: { path: DIR } })
+  const peer = createPeer({ keypair, path: DIR })
 
   await peer.db.loaded()
 
diff --git a/test/on-record-added.test.js b/test/on-record-added.test.js
index 0c66259..2126e68 100644
--- a/test/on-record-added.test.js
+++ b/test/on-record-added.test.js
@@ -4,18 +4,17 @@ const path = require('node:path')
 const os = require('node:os')
 const p = require('node:util').promisify
 const rimraf = require('rimraf')
-const SecretStack = require('secret-stack')
-const caps = require('ppppp-caps')
 const Keypair = require('ppppp-keypair')
+const { createPeer } = require('./util')
 
 const DIR = path.join(os.tmpdir(), 'ppppp-db-on-msg-added')
 rimraf.sync(DIR)
 
 test('onRecordAdded', async (t) => {
-  const keypair = Keypair.generate('ed25519', 'alice')
-  const peer = SecretStack({ appKey: caps.shse })
-    .use(require('../lib'))
-    .call(null, { keypair, db: { path: DIR } })
+  const peer = createPeer({
+    keypair: Keypair.generate('ed25519', 'alice'),
+    path: DIR,
+  })
 
   await peer.db.loaded()
 
diff --git a/test/re-open.test.js b/test/re-open.test.js
index 31c5861..a7ec66f 100644
--- a/test/re-open.test.js
+++ b/test/re-open.test.js
@@ -4,19 +4,15 @@ const path = require('node:path')
 const os = require('node:os')
 const p = require('node:util').promisify
 const rimraf = require('rimraf')
-const SecretStack = require('secret-stack')
-const caps = require('ppppp-caps')
 const Keypair = require('ppppp-keypair')
+const { createPeer } = require('./util')
 
 const DIR = path.join(os.tmpdir(), 'ppppp-db-re-open')
 rimraf.sync(DIR)
 
 test('publish some msgs, close, re-open', async (t) => {
   const keypair = Keypair.generate('ed25519', 'alice')
-  const peer = SecretStack({ appKey: caps.shse })
-    .use(require('../lib'))
-    .use(require('ssb-box'))
-    .call(null, { keypair, db: { path: DIR } })
+  const peer = createPeer({ keypair, path: DIR })
 
   await peer.db.loaded()
   const account = await p(peer.db.account.create)({ subdomain: 'person' })
@@ -39,10 +35,7 @@ test('publish some msgs, close, re-open', async (t) => {
   await p(peer.close)(true)
   // t.pass('closed')
 
-  const peer2 = SecretStack({ appKey: caps.shse })
-    .use(require('../lib'))
-    .use(require('ssb-box'))
-    .call(null, { keypair, db: { path: DIR } })
+  const peer2 = createPeer({ keypair, path: DIR })
   // t.pass('re-opened')
 
   await peer2.db.loaded()
diff --git a/test/records-iterator.test.js b/test/records-iterator.test.js
index 6b20fe7..96ca92c 100644
--- a/test/records-iterator.test.js
+++ b/test/records-iterator.test.js
@@ -4,18 +4,15 @@ const path = require('node:path')
 const os = require('node:os')
 const p = require('node:util').promisify
 const rimraf = require('rimraf')
-const SecretStack = require('secret-stack')
-const caps = require('ppppp-caps')
 const Keypair = require('ppppp-keypair')
+const { createPeer } = require('./util')
 
 const DIR = path.join(os.tmpdir(), 'ppppp-db-records-iter')
 rimraf.sync(DIR)
 
 test('records() iterator', async (t) => {
   const keypair = Keypair.generate('ed25519', 'alice')
-  const peer = SecretStack({ appKey: caps.shse })
-    .use(require('../lib'))
-    .call(null, { keypair, db: { path: DIR } })
+  const peer = createPeer({ keypair, path: DIR })
 
   await peer.db.loaded()
   const account = await p(peer.db.account.create)({ subdomain: 'person' })
diff --git a/test/util.js b/test/util.js
new file mode 100644
index 0000000..c626419
--- /dev/null
+++ b/test/util.js
@@ -0,0 +1,12 @@
+function createPeer(globalConfig) {
+  return require('secret-stack/bare')()
+    .use(require('secret-stack/plugins/net'))
+    .use(require('secret-handshake-ext/secret-stack'))
+    .use(require('../lib'))
+    .use(require('ssb-box'))
+    .call(null, { shse: { caps: require('ppppp-caps') }, global: globalConfig })
+}
+
+module.exports = {
+  createPeer,
+}