diff --git a/Cargo.lock b/Cargo.lock
index 2e7529b819..a2860b9976 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4024,7 +4024,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0c2a198fb6b0eada2a8df47933734e6d35d350665a33a3593d7164fa52c75c19"
 dependencies = [
  "cfg-if",
- "windows-targets 0.48.5",
+ "windows-targets 0.52.5",
 ]
 
 [[package]]
@@ -4489,83 +4489,36 @@ name = "nexus-auth"
 version = "0.1.0"
 dependencies = [
  "anyhow",
- "assert_matches",
- "async-bb8-diesel",
  "async-trait",
  "authz-macros",
  "base64 0.22.1",
- "bb8",
- "camino",
- "camino-tempfile",
  "chrono",
- "const_format",
  "cookie 0.18.1",
- "db-macros",
- "diesel",
- "diesel-dtrace",
  "dropshot",
- "expectorate",
  "futures",
- "gateway-client",
  "headers",
  "http 0.2.12",
  "hyper 0.14.28",
- "hyper-rustls 0.26.0",
- "illumos-utils",
- "internal-dns",
- "ipnetwork",
- "itertools 0.12.1",
- "macaddr",
  "newtype_derive",
- "nexus-config",
  "nexus-db-fixed-data",
  "nexus-db-model",
- "nexus-inventory",
- "nexus-reconfigurator-planning",
- "nexus-test-utils",
  "nexus-types",
  "omicron-common",
- "omicron-passwords",
  "omicron-rpaths",
  "omicron-test-utils",
  "omicron-uuid-kinds",
  "omicron-workspace-hack",
  "once_cell",
- "openapiv3",
  "openssl",
  "oso",
- "oximeter",
- "oxnet",
- "paste",
- "pem",
- "petgraph",
  "pq-sys",
- "predicates",
- "pretty_assertions",
- "rand 0.8.5",
- "rcgen",
- "ref-cast",
- "regex",
- "rustls 0.22.4",
  "samael",
- "schemars",
- "semver 1.0.23",
  "serde",
- "serde_json",
  "serde_urlencoded",
- "serde_with",
- "sled-agent-client",
  "slog",
- "slog-error-chain",
- "static_assertions",
- "steno",
  "strum",
- "subprocess",
- "swrite",
- "term",
  "thiserror",
  "tokio",
- "usdt 0.5.0",
  "uuid",
 ]
 
@@ -4615,83 +4568,14 @@ dependencies = [
 name = "nexus-db-fixed-data"
 version = "0.1.0"
 dependencies = [
- "anyhow",
- "assert_matches",
- "async-bb8-diesel",
- "async-trait",
- "authz-macros",
- "base64 0.22.1",
- "bb8",
- "camino",
- "camino-tempfile",
- "chrono",
- "const_format",
- "cookie 0.18.1",
- "db-macros",
- "diesel",
- "diesel-dtrace",
- "dropshot",
- "expectorate",
- "futures",
- "gateway-client",
- "headers",
- "http 0.2.12",
- "hyper 0.14.28",
- "hyper-rustls 0.26.0",
- "illumos-utils",
- "internal-dns",
- "ipnetwork",
- "itertools 0.12.1",
- "macaddr",
- "newtype_derive",
- "nexus-config",
  "nexus-db-model",
- "nexus-inventory",
- "nexus-reconfigurator-planning",
- "nexus-test-utils",
  "nexus-types",
  "omicron-common",
- "omicron-passwords",
  "omicron-rpaths",
- "omicron-sled-agent",
- "omicron-uuid-kinds",
  "omicron-workspace-hack",
  "once_cell",
- "openapiv3",
- "openssl",
- "oso",
- "oximeter",
- "oxnet",
- "paste",
- "pem",
- "petgraph",
  "pq-sys",
- "predicates",
- "pretty_assertions",
- "rand 0.8.5",
- "rcgen",
- "ref-cast",
- "regex",
- "rustls 0.22.4",
- "samael",
- "schemars",
- "semver 1.0.23",
- "serde",
- "serde_json",
- "serde_urlencoded",
- "serde_with",
- "sled-agent-client",
- "slog",
- "slog-error-chain",
- "static_assertions",
- "steno",
  "strum",
- "subprocess",
- "swrite",
- "term",
- "thiserror",
- "tokio",
- "usdt 0.5.0",
  "uuid",
 ]
 
@@ -4748,14 +4632,11 @@ dependencies = [
  "assert_matches",
  "async-bb8-diesel",
  "async-trait",
- "authz-macros",
- "base64 0.22.1",
  "bb8",
  "camino",
  "camino-tempfile",
  "chrono",
  "const_format",
- "cookie 0.18.1",
  "db-macros",
  "diesel",
  "diesel-dtrace",
@@ -4763,16 +4644,12 @@ dependencies = [
  "expectorate",
  "futures",
  "gateway-client",
- "headers",
- "http 0.2.12",
- "hyper 0.14.28",
  "hyper-rustls 0.26.0",
  "illumos-utils",
  "internal-dns",
  "ipnetwork",
  "itertools 0.12.1",
  "macaddr",
- "newtype_derive",
  "nexus-auth",
  "nexus-config",
  "nexus-db-fixed-data",
@@ -4790,7 +4667,6 @@ dependencies = [
  "omicron-workspace-hack",
  "once_cell",
  "openapiv3",
- "openssl",
  "oso",
  "oximeter",
  "oxnet",
@@ -4805,12 +4681,10 @@ dependencies = [
  "ref-cast",
  "regex",
  "rustls 0.22.4",
- "samael",
  "schemars",
  "semver 1.0.23",
  "serde",
  "serde_json",
- "serde_urlencoded",
  "serde_with",
  "sled-agent-client",
  "slog",
diff --git a/nexus/Cargo.toml b/nexus/Cargo.toml
index a9a89720ce..58a1e824cb 100644
--- a/nexus/Cargo.toml
+++ b/nexus/Cargo.toml
@@ -88,7 +88,6 @@ uuid.workspace = true
 
 nexus-auth.workspace = true
 nexus-defaults.workspace = true
-nexus-db-fixed-data.workspace = true
 nexus-db-model.workspace = true
 nexus-db-queries.workspace = true
 nexus-inventory.workspace = true
diff --git a/nexus/auth/Cargo.toml b/nexus/auth/Cargo.toml
index 62140377d0..1a926f1789 100644
--- a/nexus/auth/Cargo.toml
+++ b/nexus/auth/Cargo.toml
@@ -12,84 +12,37 @@ omicron-rpaths.workspace = true
 
 [dependencies]
 anyhow.workspace = true
-async-bb8-diesel.workspace = true
 async-trait.workspace = true
 base64.workspace = true
-bb8.workspace = true
-camino.workspace = true
 chrono.workspace = true
-const_format.workspace = true
 cookie.workspace = true
-diesel.workspace = true
-diesel-dtrace.workspace = true
 dropshot.workspace = true
 futures.workspace = true
 headers.workspace = true
 http.workspace = true
 hyper.workspace = true
-ipnetwork.workspace = true
-macaddr.workspace = true
 newtype_derive.workspace = true
+# See omicron-rpaths for more about the "pq-sys" dependency.
+pq-sys = "*"
 once_cell.workspace = true
 openssl.workspace = true
 oso.workspace = true
-oxnet.workspace = true
-paste.workspace = true
-# See omicron-rpaths for more about the "pq-sys" dependency.
-pq-sys = "*"
-rand.workspace = true
-ref-cast.workspace = true
 samael.workspace = true
-schemars.workspace = true
-semver.workspace = true
 serde.workspace = true
-serde_json.workspace = true
 serde_urlencoded.workspace = true
-serde_with.workspace = true
-sled-agent-client.workspace = true
 slog.workspace = true
-slog-error-chain.workspace = true
-static_assertions.workspace = true
-steno.workspace = true
 strum.workspace = true
-swrite.workspace = true
 thiserror.workspace = true
 tokio = { workspace = true, features = ["full"] }
 uuid.workspace = true
-usdt.workspace = true
 
 authz-macros.workspace = true
-db-macros.workspace = true
-nexus-config.workspace = true
 nexus-db-fixed-data.workspace = true
 nexus-db-model.workspace = true
 nexus-types.workspace = true
 omicron-common.workspace = true
-omicron-passwords.workspace = true
 omicron-uuid-kinds.workspace = true
-oximeter.workspace = true
 omicron-workspace-hack.workspace = true
 
 [dev-dependencies]
-assert_matches.workspace = true
-camino-tempfile.workspace = true
-expectorate.workspace = true
-hyper-rustls.workspace = true
-gateway-client.workspace = true
-illumos-utils.workspace = true
-internal-dns.workspace = true
-itertools.workspace = true
-nexus-inventory.workspace = true
-nexus-reconfigurator-planning.workspace = true
-nexus-test-utils.workspace = true
 omicron-test-utils.workspace = true
-openapiv3.workspace = true
-pem.workspace = true
-petgraph.workspace = true
-predicates.workspace = true
-pretty_assertions.workspace = true
-rcgen.workspace = true
-regex.workspace = true
-rustls.workspace = true
-subprocess.workspace = true
-term.workspace = true
diff --git a/nexus/db-fixed-data/Cargo.toml b/nexus/db-fixed-data/Cargo.toml
index d60d3b6015..d24bf25c7d 100644
--- a/nexus/db-fixed-data/Cargo.toml
+++ b/nexus/db-fixed-data/Cargo.toml
@@ -11,84 +11,14 @@ workspace = true
 omicron-rpaths.workspace = true
 
 [dependencies]
-anyhow.workspace = true
-async-bb8-diesel.workspace = true
-async-trait.workspace = true
-base64.workspace = true
-bb8.workspace = true
-camino.workspace = true
-chrono.workspace = true
-const_format.workspace = true
-cookie.workspace = true
-diesel.workspace = true
-diesel-dtrace.workspace = true
-dropshot.workspace = true
-futures.workspace = true
-headers.workspace = true
-http.workspace = true
-hyper.workspace = true
-ipnetwork.workspace = true
-macaddr.workspace = true
-newtype_derive.workspace = true
 once_cell.workspace = true
-openssl.workspace = true
-oso.workspace = true
-oxnet.workspace = true
-paste.workspace = true
 # See omicron-rpaths for more about the "pq-sys" dependency.
 pq-sys = "*"
-rand.workspace = true
-ref-cast.workspace = true
-samael.workspace = true
-schemars.workspace = true
-semver.workspace = true
-serde.workspace = true
-serde_json.workspace = true
-serde_urlencoded.workspace = true
-serde_with.workspace = true
-sled-agent-client.workspace = true
-slog.workspace = true
-slog-error-chain.workspace = true
-static_assertions.workspace = true
-steno.workspace = true
 strum.workspace = true
-swrite.workspace = true
-thiserror.workspace = true
-tokio = { workspace = true, features = ["full"] }
 uuid.workspace = true
-usdt.workspace = true
 
-authz-macros.workspace = true
-db-macros.workspace = true
-nexus-config.workspace = true
 nexus-db-model.workspace = true
 nexus-types.workspace = true
 omicron-common.workspace = true
-omicron-passwords.workspace = true
-omicron-uuid-kinds.workspace = true
-oximeter.workspace = true
 omicron-workspace-hack.workspace = true
 
-[dev-dependencies]
-assert_matches.workspace = true
-camino-tempfile.workspace = true
-expectorate.workspace = true
-hyper-rustls.workspace = true
-gateway-client.workspace = true
-illumos-utils.workspace = true
-internal-dns.workspace = true
-itertools.workspace = true
-nexus-inventory.workspace = true
-nexus-reconfigurator-planning.workspace = true
-nexus-test-utils.workspace = true
-omicron-sled-agent.workspace = true
-openapiv3.workspace = true
-pem.workspace = true
-petgraph.workspace = true
-predicates.workspace = true
-pretty_assertions.workspace = true
-rcgen.workspace = true
-regex.workspace = true
-rustls.workspace = true
-subprocess.workspace = true
-term.workspace = true
diff --git a/nexus/db-queries/Cargo.toml b/nexus/db-queries/Cargo.toml
index f5b46edb75..5fcb98dd9e 100644
--- a/nexus/db-queries/Cargo.toml
+++ b/nexus/db-queries/Cargo.toml
@@ -14,24 +14,17 @@ omicron-rpaths.workspace = true
 anyhow.workspace = true
 async-bb8-diesel.workspace = true
 async-trait.workspace = true
-base64.workspace = true
 bb8.workspace = true
 camino.workspace = true
 chrono.workspace = true
 const_format.workspace = true
-cookie.workspace = true
 diesel.workspace = true
 diesel-dtrace.workspace = true
 dropshot.workspace = true
 futures.workspace = true
-headers.workspace = true
-http.workspace = true
-hyper.workspace = true
 ipnetwork.workspace = true
 macaddr.workspace = true
-newtype_derive.workspace = true
 once_cell.workspace = true
-openssl.workspace = true
 oso.workspace = true
 oxnet.workspace = true
 paste.workspace = true
@@ -39,12 +32,10 @@ paste.workspace = true
 pq-sys = "*"
 rand.workspace = true
 ref-cast.workspace = true
-samael.workspace = true
 schemars.workspace = true
 semver.workspace = true
 serde.workspace = true
 serde_json.workspace = true
-serde_urlencoded.workspace = true
 serde_with.workspace = true
 sled-agent-client.workspace = true
 slog.workspace = true
@@ -58,7 +49,6 @@ tokio = { workspace = true, features = ["full"] }
 uuid.workspace = true
 usdt.workspace = true
 
-authz-macros.workspace = true
 db-macros.workspace = true
 nexus-auth.workspace = true
 nexus-config.workspace = true
diff --git a/nexus/src/populate.rs b/nexus/src/populate.rs
index ffe67baeae..724b25162d 100644
--- a/nexus/src/populate.rs
+++ b/nexus/src/populate.rs
@@ -388,7 +388,7 @@ mod test {
             logctx.log.clone(),
             Arc::new(authz::Authz::new(&logctx.log)),
             authn::Context::internal_db_init(),
-            Arc::clone(&datastore),
+            Arc::clone(&datastore) as Arc<dyn nexus_auth::storage::Storage>,
         );
         let log = &logctx.log;
 
@@ -444,7 +444,7 @@ mod test {
             logctx.log.clone(),
             Arc::new(authz::Authz::new(&logctx.log)),
             authn::Context::internal_db_init(),
-            Arc::clone(&datastore),
+            Arc::clone(&datastore) as Arc<dyn nexus_auth::storage::Storage>,
         );
 
         info!(&log, "cleaning up database");
diff --git a/nexus/tests/integration_tests/silos.rs b/nexus/tests/integration_tests/silos.rs
index e240edac47..2e6c21bb79 100644
--- a/nexus/tests/integration_tests/silos.rs
+++ b/nexus/tests/integration_tests/silos.rs
@@ -4,9 +4,7 @@
 
 use crate::integration_tests::saml::SAML_IDP_DESCRIPTOR;
 use dropshot::ResultsPage;
-use nexus_db_queries::authn::silos::{
-    AuthenticatedSubject, IdentityProviderType,
-};
+use nexus_db_queries::authn::silos::AuthenticatedSubject;
 use nexus_db_queries::authn::{USER_TEST_PRIVILEGED, USER_TEST_UNPRIVILEGED};
 use nexus_db_queries::authz::{self};
 use nexus_db_queries::context::OpContext;