diff --git a/services/wspr/internal/account/account.go b/services/wspr/internal/account/account.go
index f577b59..0289534 100644
--- a/services/wspr/internal/account/account.go
+++ b/services/wspr/internal/account/account.go
@@ -146,9 +146,9 @@
 		return security.Caveat{}, zeroTime, fmt.Errorf("time.parseDuration(%v) failed: %v", arg, err)
 	}
 	expirationTime := time.Now().Add(dur)
-	cav, err := security.ExpiryCaveat(expirationTime)
+	cav, err := security.NewExpiryCaveat(expirationTime)
 	if err != nil {
-		return security.Caveat{}, zeroTime, fmt.Errorf("security.ExpiryCaveat(%v) failed: %v", expirationTime, err)
+		return security.Caveat{}, zeroTime, fmt.Errorf("security.NewExpiryCaveat(%v) failed: %v", expirationTime, err)
 	}
 	return cav, expirationTime, nil
 }
@@ -158,5 +158,5 @@
 	if len(args) == 0 {
 		return security.Caveat{}, fmt.Errorf("must pass at least one method")
 	}
-	return security.MethodCaveat(args[0], args[1:]...)
+	return security.NewMethodCaveat(args[0], args[1:]...)
 }
diff --git a/services/wspr/internal/principal/principal_test.go b/services/wspr/internal/principal/principal_test.go
index 492688b..2f86ef4 100644
--- a/services/wspr/internal/principal/principal_test.go
+++ b/services/wspr/internal/principal/principal_test.go
@@ -42,7 +42,7 @@
 	}
 
 	// Test AddOrigin.
-	cav, err := security.MethodCaveat("Foo")
+	cav, err := security.NewMethodCaveat("Foo")
 	if err != nil {
 		return fmt.Errorf("security.MethodCaveat failed: %v", err)
 	}
@@ -197,7 +197,7 @@
 	// Test with no expiration caveat.
 	origin1 := "http://origin-1.com"
 
-	methodCav, err := security.MethodCaveat("Foo")
+	methodCav, err := security.NewMethodCaveat("Foo")
 	if err != nil {
 		fmt.Errorf("security.MethodCaveat failed: %v", err)
 	}
@@ -214,9 +214,9 @@
 	origin2 := "http://origin-2.com"
 	futureTime := time.Now().Add(5 * time.Minute)
 
-	futureExpCav, err := security.ExpiryCaveat(futureTime)
+	futureExpCav, err := security.NewExpiryCaveat(futureTime)
 	if err != nil {
-		fmt.Errorf("security.ExpiryCaveat(%v) failed: %v", futureTime, err)
+		fmt.Errorf("security.NewExpiryCaveat(%v) failed: %v", futureTime, err)
 	}
 
 	if err := m.AddOrigin(origin2, googleAccount, []security.Caveat{futureExpCav}, []time.Time{futureTime}); err != nil {
@@ -231,9 +231,9 @@
 	origin3 := "http://origin-3.com"
 	pastTime := time.Now().Add(-5 * time.Minute)
 
-	pastExpCav, err := security.ExpiryCaveat(pastTime)
+	pastExpCav, err := security.NewExpiryCaveat(pastTime)
 	if err != nil {
-		fmt.Errorf("security.ExpiryCaveat(%v) failed: %v", pastTime, err)
+		fmt.Errorf("security.NewExpiryCaveat(%v) failed: %v", pastTime, err)
 	}
 
 	if err := m.AddOrigin(origin3, googleAccount, []security.Caveat{futureExpCav, pastExpCav}, []time.Time{futureTime, pastTime}); err != nil {
diff --git a/services/wspr/internal/rpc/server/server.go b/services/wspr/internal/rpc/server/server.go
index 9ab5309..2069d8c 100644
--- a/services/wspr/internal/rpc/server/server.go
+++ b/services/wspr/internal/rpc/server/server.go
@@ -410,7 +410,7 @@
 // CaveatValidation implements a function suitable for passing to
 // security.OverrideCaveatValidation.
 //
-// Certain caveats (PublicKeyThirdPartyCaveatX) are intercepted and handled in
+// Certain caveats (PublicKeyThirdPartyCaveat) are intercepted and handled in
 // go, while all other caveats are evaluated in javascript.
 func CaveatValidation(ctx *context.T, call security.Call, cavs [][]security.Caveat) []error {
 	// If the server isn't set in the context, we just perform validation in Go.
@@ -446,7 +446,7 @@
 			default:
 			}
 			switch cav.Id {
-			case security.PublicKeyThirdPartyCaveatX.Id:
+			case security.PublicKeyThirdPartyCaveat.Id:
 				res := cav.Validate(ctx, call)
 				if res != nil {
 					valStatus[i] = validationStatus{