diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 64c76f3f..112843d8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -101,16 +101,18 @@ jobs:
           - manifest: crates/dpapi-native-transport/Cargo.toml
             crate-name: dpapi-native-transport
 
-          # Per-OS feature overrides for specific manifests
+          # Per-OS feature overrides for specific manifests.
+          # `__test-data` enables the `tests/sspi/client_server` suite (gated on
+          # `all(network_client, __test-data)`), which otherwise never runs in CI.
           - os: win
             manifest: Cargo.toml
-            additional-args: --features network_client,dns_resolver,scard,tsssp
+            additional-args: --features network_client,dns_resolver,scard,tsssp,__test-data
           - os: osx
             manifest: Cargo.toml
-            additional-args: --features network_client,scard
+            additional-args: --features network_client,scard,__test-data
           - os: linux
             manifest: Cargo.toml
-            additional-args: --features network_client,dns_resolver,scard
+            additional-args: --features network_client,dns_resolver,scard,__test-data
 
           - os: win
             manifest: ffi/Cargo.toml
diff --git a/tests/sspi/client_server/credssp.rs b/tests/sspi/client_server/credssp.rs
index e7d46679..5ead857a 100644
--- a/tests/sspi/client_server/credssp.rs
+++ b/tests/sspi/client_server/credssp.rs
@@ -143,6 +143,7 @@ fn credssp_kerberos() {
         max_time_skew: MAX_TIME_SKEW,
         ticket_decryption_key: None,
         service_name: target_service_name,
+        additional_service_keys: Vec::new(),
         user: Some(CredentialsBuffers::try_from(credentials.clone()).unwrap()),
         client: None,
         authenticators_cache: HashSet::new(),
diff --git a/tests/sspi/client_server/kerberos/mod.rs b/tests/sspi/client_server/kerberos/mod.rs
index 216eaadd..2f7e51cb 100644
--- a/tests/sspi/client_server/kerberos/mod.rs
+++ b/tests/sspi/client_server/kerberos/mod.rs
@@ -309,6 +309,7 @@ fn kerberos_auth() {
         max_time_skew: MAX_TIME_SKEW,
         ticket_decryption_key: Some(ticket_decryption_key.into()),
         service_name: target_service_name,
+        additional_service_keys: Vec::new(),
         user: None,
         client: None,
         authenticators_cache: HashSet::new(),
@@ -402,6 +403,7 @@ fn spnego_kerberos_u2u() {
         max_time_skew: MAX_TIME_SKEW,
         ticket_decryption_key: Some(ticket_decryption_key.into()),
         service_name: target_service_name,
+        additional_service_keys: Vec::new(),
         user: Some(credentials.clone()),
         client: None,
         authenticators_cache: HashSet::new(),
@@ -511,6 +513,7 @@ fn run_spnego(
         max_time_skew: MAX_TIME_SKEW,
         ticket_decryption_key: Some(ticket_decryption_key.into()),
         service_name: target_service_name,
+        additional_service_keys: Vec::new(),
         user: None,
         client: None,
         authenticators_cache: HashSet::new(),
@@ -742,6 +745,7 @@ fn spnego_kerberos_ntlm_fallback_spn_ip_address() {
         max_time_skew: MAX_TIME_SKEW,
         ticket_decryption_key: Some(ticket_decryption_key.into()),
         service_name: target_service_name,
+        additional_service_keys: Vec::new(),
         user: Some(credentials.clone()),
         client: None,
         authenticators_cache: HashSet::new(),