diff --git a/cli/exp_scaletest.go b/cli/exp_scaletest.go
index a4b8b3f53d..ca1b2f366e 100644
--- a/cli/exp_scaletest.go
+++ b/cli/exp_scaletest.go
@@ -1004,9 +1004,10 @@ func (r *RootCmd) scaletestWorkspaceTraffic() *serpent.Command {
 						return xerrors.Errorf("parse workspace proxy URL: %w", err)
 					}
 
-					webClient = codersdk.New(u)
-					webClient.HTTPClient = client.HTTPClient
-					webClient.SetSessionToken(client.SessionToken())
+					webClient = codersdk.New(u,
+						codersdk.WithHTTPClient(client.HTTPClient),
+						codersdk.WithSessionToken(client.SessionToken()),
+					)
 
 					appConfig, err = createWorkspaceAppConfig(webClient, appHost.Host, app, ws, agent)
 					if err != nil {
@@ -1240,8 +1241,9 @@ func (r *RootCmd) scaletestDashboard() *serpent.Command {
 					return xerrors.Errorf("create token for user: %w", err)
 				}
 
-				userClient := codersdk.New(client.URL)
-				userClient.SetSessionToken(userTokResp.Key)
+				userClient := codersdk.New(client.URL,
+					codersdk.WithSessionToken(userTokResp.Key),
+				)
 
 				config := dashboard.Config{
 					Interval: interval,
diff --git a/coderd/coderdtest/coderdtest.go b/coderd/coderdtest/coderdtest.go
index 090b56f260..ab1c641c0c 100644
--- a/coderd/coderdtest/coderdtest.go
+++ b/coderd/coderdtest/coderdtest.go
@@ -845,8 +845,7 @@ func createAnotherUserRetry(t testing.TB, client *codersdk.Client, organizationI
 		require.NoError(t, err)
 	}
 
-	other := codersdk.New(client.URL)
-	other.SetSessionToken(sessionToken)
+	other := codersdk.New(client.URL, codersdk.WithSessionToken(sessionToken))
 	t.Cleanup(func() {
 		other.HTTPClient.CloseIdleConnections()
 	})
diff --git a/coderd/insights_test.go b/coderd/insights_test.go
index 99bf9b9a66..a4a47bea39 100644
--- a/coderd/insights_test.go
+++ b/coderd/insights_test.go
@@ -1467,8 +1467,7 @@ func TestUserActivityInsights_Golden(t *testing.T) {
 				TokenName: "no-password-user-token",
 			})
 			require.NoError(t, err)
-			userClient := codersdk.New(client.URL)
-			userClient.SetSessionToken(token.Key)
+			userClient := codersdk.New(client.URL, codersdk.WithSessionToken(token.Key))
 
 			coderUser, err := userClient.User(context.Background(), user.id.String())
 			require.NoError(t, err)
diff --git a/coderd/mcp_http.go b/coderd/mcp_http.go
index 51082858fe..b18387f86e 100644
--- a/coderd/mcp_http.go
+++ b/coderd/mcp_http.go
@@ -32,10 +32,9 @@ func (api *API) mcpHTTPHandler() http.Handler {
 			})
 			return
 		}
-		authenticatedClient := codersdk.New(api.AccessURL)
 		// Extract the original session token from the request
-		authenticatedClient.SetSessionToken(httpmw.APITokenFromRequest(r))
-
+		authenticatedClient := codersdk.New(api.AccessURL,
+			codersdk.WithSessionToken(httpmw.APITokenFromRequest(r)))
 		toolset := MCPToolset(r.URL.Query().Get("toolset"))
 		// Default to standard toolset if no toolset is specified.
 		if toolset == "" {
diff --git a/coderd/workspaceapps/apptest/setup.go b/coderd/workspaceapps/apptest/setup.go
index 05bfb66219..fdede20cc4 100644
--- a/coderd/workspaceapps/apptest/setup.go
+++ b/coderd/workspaceapps/apptest/setup.go
@@ -137,8 +137,7 @@ type Details struct {
 //
 // The client is authenticated as the first user by default.
 func (d *Details) AppClient(t *testing.T) *codersdk.Client {
-	client := codersdk.New(d.PathAppBaseURL)
-	client.SetSessionToken(d.SDKClient.SessionToken())
+	client := codersdk.New(d.PathAppBaseURL, codersdk.WithSessionToken(d.SDKClient.SessionToken()))
 	forceURLTransport(t, client)
 	client.HTTPClient.CheckRedirect = func(_ *http.Request, _ []*http.Request) error {
 		return http.ErrUseLastResponse