diff --git a/internal/e2e/manifest.go b/internal/e2e/manifest.go
index 85d306eb2..19e0590a2 100644
--- a/internal/e2e/manifest.go
+++ b/internal/e2e/manifest.go
@@ -94,7 +94,7 @@ func yamlListBlock[T any](t *testing.T, key string, items []T, indent int) strin
 	return strings.Join(out, "\n")
 }
 
-// koApply builds and pushes the ko:// images named in manifest and applies it.
+// KoApply builds and pushes the ko:// images named in manifest and applies it.
 //
 // Through the repo's pinned ko (hack/run-tool.sh), because CI does not install
 // ko on PATH and every other deploy in this repo goes through that wrapper. The
@@ -103,7 +103,7 @@ func yamlListBlock[T any](t *testing.T, key string, items []T, indent int) strin
 // because ko resolves .ko.yaml from its working directory, which is the test's
 // package dir rather than the repo root; without it the build silently loses
 // defaultPlatforms and produces images that cannot run on the cluster's nodes.
-func koApply(t *testing.T, manifest string) {
+func KoApply(t *testing.T, manifest string) {
 	t.Helper()
 	root, err := FindRepoRoot()
 	if err != nil {
diff --git a/internal/e2e/probe.go b/internal/e2e/probe.go
index 0ec12cabc..70e100876 100644
--- a/internal/e2e/probe.go
+++ b/internal/e2e/probe.go
@@ -70,7 +70,7 @@ func DeployProbe(t *testing.T, bucket, name string, opts ...ProbeOption) string
 	// One manifest, rendered for the sandbox class under test, so both apply
 	// and delete consume the same file without any shell involved.
 	manifest := renderProbeManifest(t, bucket, name, cfg)
-	koApply(t, manifest)
+	KoApply(t, manifest)
 
 	// Unlike the fixtures that live in a namespace CreateNamespace tears down,
 	// this one installs into a fixed namespace it shares with nothing, so it has
diff --git a/internal/e2e/serverpod.go b/internal/e2e/serverpod.go
index e16b2c7df..56fd87cf9 100644
--- a/internal/e2e/serverpod.go
+++ b/internal/e2e/serverpod.go
@@ -101,7 +101,7 @@ func DeployServerPod(t *testing.T, ctx context.Context, spec ServerPod) Server {
 		namespace = CreateNamespace(t).Name
 	}
 
-	koApply(t, renderServerPod(t, spec, namespace))
+	KoApply(t, renderServerPod(t, spec, namespace))
 	WaitForPodReady(t, ctx, namespace, spec.Name, serverPodReadyTimeout)
 
 	service, err := GetClients().K8s.CoreV1().Services(namespace).Get(ctx, spec.Name, metav1.GetOptions{})
diff --git a/internal/e2e/suites/capabilities/capabilities_test.go b/internal/e2e/suites/capabilities/capabilities_test.go
index 321cd63d0..37dac9cf8 100644
--- a/internal/e2e/suites/capabilities/capabilities_test.go
+++ b/internal/e2e/suites/capabilities/capabilities_test.go
@@ -19,7 +19,6 @@ import (
 	"encoding/json"
 	"io"
 	"net/http"
-	"path/filepath"
 	"slices"
 	"testing"
 	"time"
@@ -136,25 +135,13 @@ func assertSameCapabilities(t *testing.T, set string, got, want []string) {
 // suffix so the gVisor and micro-VM lanes never share one.
 func deployFixture(t *testing.T, bucket string) string {
 	t.Helper()
-	root, err := e2e.FindRepoRoot()
-	if err != nil {
-		t.Fatalf("FindRepoRoot: %v", err)
-	}
-
 	namespace := e2e.FixtureName("ate-e2e") + "-capabilities"
 
 	// One manifest, rendered for the sandbox class under test (mirrors the
 	// sizing suite).
 	manifest := e2e.RenderFixtureManifest(t, "internal/e2e/fixtures/capabilities/capabilities.yaml.tmpl", bucket, "capabilities")
 
-	// Build/push the probe image and apply through the repo's pinned ko, as the
-	// identity suite does; CI does not install ko on PATH, and KO_CONFIG_PATH is
-	// required because ko resolves .ko.yaml from its working directory.
-	applyArgs := []string{"ko", "apply", "-f", manifest}
-	if e2e.KubeContext != "" {
-		applyArgs = append(applyArgs, "--", "--context="+e2e.KubeContext)
-	}
-	e2e.RunCmdWithEnv(t, []string{"KO_CONFIG_PATH=" + root}, filepath.Join(root, "hack/run-tool.sh"), applyArgs...)
+	e2e.KoApply(t, manifest)
 
 	t.Cleanup(func() {
 		delArgs := []string{"delete", "--ignore-not-found", "-f", manifest}
diff --git a/internal/e2e/suites/egressauthz/egressauthz_test.go b/internal/e2e/suites/egressauthz/egressauthz_test.go
index a83469cdb..dfdd5a650 100644
--- a/internal/e2e/suites/egressauthz/egressauthz_test.go
+++ b/internal/e2e/suites/egressauthz/egressauthz_test.go
@@ -167,11 +167,7 @@ func startProbe(t *testing.T, ctx context.Context) *probeClient {
 		t.Fatalf("writing rendered egressprobe manifest: %v", err)
 	}
 
-	applyArgs := []string{"ko", "apply", "-f", manifest}
-	if e2e.KubeContext != "" {
-		applyArgs = append(applyArgs, "--", "--context="+e2e.KubeContext)
-	}
-	e2e.RunCmdWithEnv(t, []string{"KO_CONFIG_PATH=" + root}, filepath.Join(root, "hack/run-tool.sh"), applyArgs...)
+	e2e.KoApply(t, manifest)
 
 	waitForProbeReady(t, ctx, ns)
 
diff --git a/internal/e2e/suites/sizing/sizing_test.go b/internal/e2e/suites/sizing/sizing_test.go
index d47dbe492..bbe8304d9 100644
--- a/internal/e2e/suites/sizing/sizing_test.go
+++ b/internal/e2e/suites/sizing/sizing_test.go
@@ -19,7 +19,6 @@ import (
 	"encoding/json"
 	"io"
 	"net/http"
-	"path/filepath"
 	"testing"
 	"time"
 
@@ -114,23 +113,11 @@ func TestActorSizing_SandboxObservesDeclaredLimits(t *testing.T) {
 
 func deploySizedProbe(t *testing.T, bucket string) {
 	t.Helper()
-	root, err := e2e.FindRepoRoot()
-	if err != nil {
-		t.Fatalf("FindRepoRoot: %v", err)
-	}
-
 	// One manifest, rendered for the sandbox class under test (mirrors the
 	// identity suite).
 	manifest := e2e.RenderFixtureManifest(t, "internal/e2e/fixtures/probe/probe-sized.yaml.tmpl", bucket, "sizing")
 
-	// Build/push the probe image and apply through the repo's pinned ko. See the
-	// identity suite's deployProbe for why KO_CONFIG_PATH and the trailing
-	// `-- --context=...` are required.
-	applyArgs := []string{"ko", "apply", "-f", manifest}
-	if e2e.KubeContext != "" {
-		applyArgs = append(applyArgs, "--", "--context="+e2e.KubeContext)
-	}
-	e2e.RunCmdWithEnv(t, []string{"KO_CONFIG_PATH=" + root}, filepath.Join(root, "hack/run-tool.sh"), applyArgs...)
+	e2e.KoApply(t, manifest)
 
 	t.Cleanup(func() {
 		delArgs := []string{"delete", "--ignore-not-found", "-f", manifest}