diff --git a/src/sso/sso.c b/src/sso/sso.c
index 905e5d9d974ba7e422d58eaddd4d6fc23af42774..f1b7e28be6d48257ce594f40dc88cb99c0cf40ca 100644
--- a/src/sso/sso.c
+++ b/src/sso/sso.c
@@ -60,19 +60,26 @@ static char *strdup_or_null(const char *s) {
   return strdup(s);
 }
 
-sso_ticket_t sso_ticket_new(const char *user, const char *service,
-                            const char *domain, const char *nonce,
-                            const char **groups, int validity_seconds) {
+static sso_ticket_t sso_ticket_new_with_expiry(const char *user, const char *service,
+                                               const char *domain, const char *nonce,
+                                               const char **groups, time_t expires) {
   sso_ticket_t t = (sso_ticket_t)malloc(sizeof(struct sso_ticket));
   t->user = strdup_or_null(user);
   t->service = strdup_or_null(service);
   t->domain = strdup_or_null(domain);
   t->nonce = strdup_or_null(nonce);
   t->groups = group_list_dup(groups);
-  t->expires = time(NULL) + validity_seconds;
+  t->expires = expires;
   return t;
 }
 
+sso_ticket_t sso_ticket_new(const char *user, const char *service,
+                            const char *domain, const char *nonce,
+                            const char **groups, int validity_seconds) {
+  time_t expires = time(NULL) + validity_seconds;
+  return sso_ticket_new_with_expiry(user, service, domain, nonce, groups, expires);
+}
+
 void sso_ticket_free(sso_ticket_t t) {
   if (t->user != NULL) {
     free(t->user);
@@ -275,7 +282,7 @@ static int sso_ticket_deserialize(sso_ticket_t *t, const char *s, int sz) {
     goto fail;
   }
 
-  *t = sso_ticket_new(user, service, domain, nonce, (const char **)groups, expires);
+  *t = sso_ticket_new_with_expiry(user, service, domain, nonce, (const char **)groups, expires);
 
  fail:
   if (version != NULL)