diff --git a/packages/dev-env/src/network.ts b/packages/dev-env/src/network.ts
index c90e2c181f5..06fbd780060 100644
--- a/packages/dev-env/src/network.ts
+++ b/packages/dev-env/src/network.ts
@@ -3,12 +3,11 @@ import * as uint8arrays from 'uint8arrays'
 import getPort from 'get-port'
 import { wait } from '@atproto/common-web'
 import { createServiceJwt } from '@atproto/xrpc-server'
-import { Client as PlcClient } from '@did-plc/lib'
 import { TestServerParams } from './types'
 import { TestPlc } from './plc'
 import { TestPds } from './pds'
 import { TestBsky } from './bsky'
-import { TestOzone } from './ozone'
+import { TestOzone, createOzoneDid } from './ozone'
 import { mockNetworkUtilities } from './util'
 import { TestNetworkNoAppView } from './network-no-appview'
 import { Secp256k1Keypair } from '@atproto/crypto'
@@ -43,13 +42,7 @@ export class TestNetwork extends TestNetworkNoAppView {
     const ozonePort = params.ozone?.port ?? (await getPort())
 
     const ozoneKey = await Secp256k1Keypair.create({ exportable: true })
-    const ozoneDid = await new PlcClient(plc.url).createDid({
-      signingKey: ozoneKey.did(),
-      rotationKeys: [ozoneKey.did()],
-      handle: 'ozone.test',
-      pds: `http://pds.invalid`,
-      signer: ozoneKey,
-    })
+    const ozoneDid = await createOzoneDid(plc.url, ozoneKey)
 
     const bsky = await TestBsky.create({
       port: bskyPort,
diff --git a/packages/dev-env/src/ozone.ts b/packages/dev-env/src/ozone.ts
index 27e240b0518..d06e45eba13 100644
--- a/packages/dev-env/src/ozone.ts
+++ b/packages/dev-env/src/ozone.ts
@@ -2,7 +2,7 @@ import getPort from 'get-port'
 import * as ui8 from 'uint8arrays'
 import * as ozone from '@atproto/ozone'
 import { AtpAgent } from '@atproto/api'
-import { Secp256k1Keypair } from '@atproto/crypto'
+import { Keypair, Secp256k1Keypair } from '@atproto/crypto'
 import * as plc from '@did-plc/lib'
 import { OzoneConfig } from './types'
 import { ADMIN_PASSWORD, MOD_PASSWORD, TRIAGE_PASSWORD } from './const'
@@ -21,27 +21,7 @@ export class TestOzone {
     const signingKeyHex = ui8.toString(await serviceKeypair.export(), 'hex')
     let serverDid = config.serverDid
     if (!serverDid) {
-      const plcClient = new plc.Client(config.plcUrl)
-      const plcOp = await plc.signOperation(
-        {
-          type: 'plc_operation',
-          alsoKnownAs: [],
-          rotationKeys: [serviceKeypair.did()],
-          verificationMethods: {
-            atproto_label: serviceKeypair.did(),
-          },
-          services: {
-            atproto_labeler: {
-              type: 'AtprotoLabeler',
-              endpoint: 'https://ozone.public.url',
-            },
-          },
-          prev: null,
-        },
-        serviceKeypair,
-      )
-      serverDid = await plc.didForCreateOp(plcOp)
-      await plcClient.sendOperation(serverDid, plcOp)
+      serverDid = await createOzoneDid(config.plcUrl, serviceKeypair)
     }
 
     const port = config.port || (await getPort())
@@ -130,3 +110,31 @@ export class TestOzone {
     await this.server.destroy()
   }
 }
+
+export const createOzoneDid = async (
+  plcUrl: string,
+  keypair: Keypair,
+): Promise<string> => {
+  const plcClient = new plc.Client(plcUrl)
+  const plcOp = await plc.signOperation(
+    {
+      type: 'plc_operation',
+      alsoKnownAs: [],
+      rotationKeys: [keypair.did()],
+      verificationMethods: {
+        atproto_label: keypair.did(),
+      },
+      services: {
+        atproto_labeler: {
+          type: 'AtprotoLabeler',
+          endpoint: 'https://ozone.public.url',
+        },
+      },
+      prev: null,
+    },
+    keypair,
+  )
+  const did = await plc.didForCreateOp(plcOp)
+  await plcClient.sendOperation(did, plcOp)
+  return did
+}
diff --git a/packages/ozone/src/context.ts b/packages/ozone/src/context.ts
index e7168881bac..5205e54f848 100644
--- a/packages/ozone/src/context.ts
+++ b/packages/ozone/src/context.ts
@@ -172,7 +172,7 @@ export class AppContext {
   }
 
   async serviceAuthHeaders(aud: string) {
-    const iss = this.cfg.service.did
+    const iss = `${this.cfg.service.did}#atproto_labeler`
     return createServiceAuthHeaders({
       iss,
       aud,