diff --git a/spinifex/handlers/ec2/vpc/paging_test.go b/spinifex/handlers/ec2/vpc/paging_test.go
index 87acb78c1..599bd847c 100644
--- a/spinifex/handlers/ec2/vpc/paging_test.go
+++ b/spinifex/handlers/ec2/vpc/paging_test.go
@@ -1,3 +1,5 @@
+//test:in-package — reuses the in-package VPC service fixtures (setupTestVPCService, createTestVPC)
+
 package handlers_ec2_vpc
 
 import (
diff --git a/spinifex/paging/paging_test.go b/spinifex/paging/paging_test.go
index f3a0caeec..06afccc93 100644
--- a/spinifex/paging/paging_test.go
+++ b/spinifex/paging/paging_test.go
@@ -1,4 +1,4 @@
-package paging
+package paging_test
 
 import (
 	"encoding/base64"
@@ -7,6 +7,7 @@ import (
 
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/mulgadc/spinifex/spinifex/awserrors"
+	"github.com/mulgadc/spinifex/spinifex/paging"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -16,14 +17,14 @@ func identity(s string) string { return s }
 func TestPage_WalksEveryItemOnceInKeyOrder(t *testing.T) {
 	items := []string{"d", "a", "e", "c", "b"}
 	var seen []string
-	req := Request{Limit: 2}
+	req := paging.Request{Limit: 2}
 	for range len(items) {
-		page, next := Page(items, identity, req)
+		page, next := paging.Page(items, identity, req)
 		seen = append(seen, page...)
 		if next == "" {
 			break
 		}
-		from, err := DecodeToken(next)
+		from, err := paging.DecodeToken(next)
 		require.NoError(t, err)
 		req.From = from
 	}
@@ -31,21 +32,21 @@ func TestPage_WalksEveryItemOnceInKeyOrder(t *testing.T) {
 }
 
 func TestPage_ResumesPastADeletedItem(t *testing.T) {
-	_, next := Page([]string{"a", "b", "c", "d"}, identity, Request{Limit: 2})
-	from, err := DecodeToken(next)
+	_, next := paging.Page([]string{"a", "b", "c", "d"}, identity, paging.Request{Limit: 2})
+	from, err := paging.DecodeToken(next)
 	require.NoError(t, err)
 	require.Equal(t, "c", from)
 
-	page, _ := Page([]string{"a", "b", "d"}, identity, Request{Limit: 2, From: from})
+	page, _ := paging.Page([]string{"a", "b", "d"}, identity, paging.Request{Limit: 2, From: from})
 	assert.Equal(t, []string{"d"}, page)
 }
 
 func TestPage_NoLimitReturnsEverythingWithoutToken(t *testing.T) {
-	page, next := Page([]string{"b", "a"}, identity, Request{})
+	page, next := paging.Page([]string{"b", "a"}, identity, paging.Request{})
 	assert.Equal(t, []string{"a", "b"}, page)
 	assert.Empty(t, next)
 
-	page, next = Page([]string{"a", "b"}, identity, Request{Limit: 2})
+	page, next = paging.Page([]string{"a", "b"}, identity, paging.Request{Limit: 2})
 	assert.Len(t, page, 2)
 	assert.Empty(t, next, "an exactly full last page carries no token")
 }
@@ -54,10 +55,10 @@ func TestDecodeToken_RejectsTokensItDidNotIssue(t *testing.T) {
 	for _, token := range []string{
 		"garbage!",
 		base64.RawURLEncoding.EncodeToString([]byte("subnet-123")),
-		base64.RawURLEncoding.EncodeToString([]byte(tokenPrefix)),
+		paging.EncodeToken(""),
 	} {
-		_, err := DecodeToken(token)
-		assert.ErrorIs(t, err, ErrInvalidToken, token)
+		_, err := paging.DecodeToken(token)
+		assert.ErrorIs(t, err, paging.ErrInvalidToken, token)
 	}
 }
 
@@ -70,20 +71,20 @@ func requireAWSError(t *testing.T, err error, code, message string) {
 }
 
 func TestEC2Parse(t *testing.T) {
-	p := EC2{
+	p := paging.EC2{
 		MaxResults: 1000,
 		TooLarge:   "too large %d",
 		TooSmall:   "too small %d",
 		WithIDs:    "ids and max",
 	}
 
-	req, err := p.Parse(aws.Int64(1000), aws.String(EncodeToken("subnet-b")), 0)
+	req, err := p.Parse(aws.Int64(1000), aws.String(paging.EncodeToken("subnet-b")), 0)
 	require.NoError(t, err)
-	assert.Equal(t, Request{Limit: 1000, From: "subnet-b"}, req)
+	assert.Equal(t, paging.Request{Limit: 1000, From: "subnet-b"}, req)
 
 	req, err = p.Parse(nil, nil, 2)
 	require.NoError(t, err, "IDs without MaxResults are fine")
-	assert.Equal(t, Request{}, req)
+	assert.Equal(t, paging.Request{}, req)
 
 	_, err = p.Parse(aws.Int64(5), nil, 0)
 	require.NoError(t, err)