diff --git a/tests/unit/access-manager.t.cpp b/tests/unit/access-manager.t.cpp
index 13902e8..d15249f 100644
--- a/tests/unit/access-manager.t.cpp
+++ b/tests/unit/access-manager.t.cpp
@@ -20,10 +20,10 @@
 #include "access-manager.hpp"
 
 #include "tests/boost-test.hpp"
-#include "tests/dummy-forwarder.hpp"
 #include "tests/io-key-chain-fixture.hpp"
 
 #include <iostream>
+#include <ndn-cxx/util/dummy-client-face.hpp>
 #include <ndn-cxx/util/string-helper.hpp>
 
 namespace ndn {
@@ -34,8 +34,7 @@
 {
 public:
   AccessManagerFixture()
-    : fw(m_io, m_keyChain)
-    , face(static_cast<util::DummyClientFace&>(fw.addFace()))
+    : face(m_io, m_keyChain, {true, true})
     , accessIdentity(m_keyChain.createIdentity("/access/policy/identity"))
     , nacIdentity(m_keyChain.createIdentity("/access/policy/identity/NAC/dataset", // hack to get access to KEK key-id
                                             RsaKeyParams()))
@@ -51,8 +50,7 @@
   }
 
 public:
-  DummyForwarder fw;
-  util::DummyClientFace& face;
+  util::DummyClientFace face;
   Identity accessIdentity;
   Identity nacIdentity;
   std::vector<Identity> userIdentities;
diff --git a/tests/unit/decryptor.t.cpp b/tests/unit/decryptor.t.cpp
index e7c2a0f..1aeedbc 100644
--- a/tests/unit/decryptor.t.cpp
+++ b/tests/unit/decryptor.t.cpp
@@ -19,17 +19,17 @@
 
 #include "decryptor.hpp"
 
-#include "encryptor.hpp"
-#include "encrypted-content.hpp"
 #include "access-manager.hpp"
+#include "encrypted-content.hpp"
+#include "encryptor.hpp"
 
 #include "tests/boost-test.hpp"
-#include "tests/dummy-forwarder.hpp"
 #include "tests/io-key-chain-fixture.hpp"
 #include "tests/unit/static-data.hpp"
 
 #include <iostream>
 #include <boost/mpl/vector.hpp>
+#include <ndn-cxx/util/dummy-client-face.hpp>
 
 namespace ndn {
 namespace nac {
@@ -39,25 +39,22 @@
 {
 public:
   DecryptorStaticDataEnvironment()
-    : fw(m_io, m_keyChain)
-    , imsFace(static_cast<util::DummyClientFace&>(fw.addFace()))
   {
     StaticData data;
     for (const auto& block : data.managerPackets) {
       m_ims.insert(*make_shared<Data>(block));
     }
-
     for (const auto& block : data.encryptorPackets) {
       m_ims.insert(*make_shared<Data>(block));
     }
 
-    auto serveFromIms = [this] (const Name& prefix, const Interest& interest) {
+    auto serveFromIms = [this] (const Name&, const Interest& interest) {
       auto data = m_ims.find(interest);
       if (data != nullptr) {
-        imsFace.put(*data);
+        m_imsFace.put(*data);
       }
     };
-    imsFace.setInterestFilter("/", serveFromIms, [] (auto...) {});
+    m_imsFace.setInterestFilter("/", serveFromIms, [] (auto...) {});
     advanceClocks(1_ms, 10);
 
     // import "/first/user" identity
@@ -67,9 +64,10 @@
     m_keyChain.createIdentity("/not/authorized");
   }
 
-public:
-  DummyForwarder fw;
-  util::DummyClientFace& imsFace;
+protected:
+  util::DummyClientFace m_imsFace{m_io, m_keyChain, {false, true}};
+
+private:
   InMemoryStoragePersistent m_ims;
 };
 
@@ -78,14 +76,15 @@
 {
 public:
   DecryptorFixture()
-    : face(static_cast<util::DummyClientFace&>(fw.addFace()))
+    : face(m_io, m_keyChain, {false, true})
     , decryptor(m_keyChain.getPib().getIdentity(T().identity).getDefaultKey(), validator, m_keyChain, face)
   {
+    face.linkTo(m_imsFace);
     advanceClocks(1_ms, 10);
   }
 
 public:
-  util::DummyClientFace& face;
+  util::DummyClientFace face;
   ValidatorNull validator;
   Decryptor decryptor;
 };
diff --git a/tests/unit/encryptor.t.cpp b/tests/unit/encryptor.t.cpp
index dcbf579..9439fcc 100644
--- a/tests/unit/encryptor.t.cpp
+++ b/tests/unit/encryptor.t.cpp
@@ -20,11 +20,11 @@
 #include "encryptor.hpp"
 
 #include "tests/boost-test.hpp"
-#include "tests/dummy-forwarder.hpp"
 #include "tests/io-key-chain-fixture.hpp"
 #include "tests/unit/static-data.hpp"
 
 #include <iostream>
+#include <ndn-cxx/util/dummy-client-face.hpp>
 #include <ndn-cxx/util/string-helper.hpp>
 
 namespace ndn {
@@ -35,8 +35,6 @@
 {
 public:
   EncryptorStaticDataEnvironment(bool shouldPublishData)
-    : fw(m_io, m_keyChain)
-    , imsFace(static_cast<util::DummyClientFace&>(fw.addFace()))
   {
     if (shouldPublishData) {
       publishData();
@@ -45,14 +43,14 @@
     auto serveFromIms = [this] (const Name&, const Interest& interest) {
       auto data = m_ims.find(interest);
       if (data != nullptr) {
-        imsFace.put(*data);
+        m_imsFace.put(*data);
       }
     };
-    imsFace.setInterestFilter("/", serveFromIms, [] (auto...) {});
+    m_imsFace.setInterestFilter("/", serveFromIms, [] (auto...) {});
     advanceClocks(1_ms, 10);
 
-    imsFace.sentData.clear();
-    imsFace.sentInterests.clear();
+    m_imsFace.sentData.clear();
+    m_imsFace.sentInterests.clear();
   }
 
   void
@@ -65,9 +63,10 @@
     advanceClocks(1_ms, 10);
   }
 
-public:
-  DummyForwarder fw;
-  util::DummyClientFace& imsFace;
+protected:
+  util::DummyClientFace m_imsFace{m_io, m_keyChain, {true, true}};
+
+private:
   InMemoryStoragePersistent m_ims;
 };
 
@@ -77,18 +76,19 @@
 public:
   EncryptorFixture()
     : EncryptorStaticDataEnvironment(shouldPublishData)
-    , face(static_cast<util::DummyClientFace&>(fw.addFace()))
+    , face(m_io, m_keyChain, {true, true})
     , encryptor("/access/policy/identity/NAC/dataset", "/some/ck/prefix", signingWithSha256(),
                 [=] (const ErrorCode& code, const std::string& error) {
                   onFailure(code, error);
                 },
                 validator, m_keyChain, face)
   {
+    face.linkTo(m_imsFace);
     advanceClocks(1_ms, 10);
   }
 
 public:
-  util::DummyClientFace& face;
+  util::DummyClientFace face;
   ValidatorNull validator;
   Encryptor encryptor;
   util::Signal<EncryptorFixture, ErrorCode, std::string> onFailure;
@@ -121,7 +121,7 @@
   BOOST_CHECK_EQUAL(face.sentInterests.at(0).getName().getPrefix(6),
                     Name("/access/policy/identity/NAC/dataset/KEK"));
 
-  auto kek = imsFace.sentData.at(0);
+  auto kek = m_imsFace.sentData.at(0);
   BOOST_CHECK_EQUAL(kek.getName().getPrefix(6), Name("/access/policy/identity/NAC/dataset/KEK"));
   BOOST_CHECK_EQUAL(kek.getName().size(), 7);
 
@@ -155,15 +155,15 @@
   BOOST_CHECK_EQUAL(face.sentInterests.at(0).getName().getPrefix(6), Name("/access/policy/identity/NAC/dataset/KEK"));
 
   // and failed
-  BOOST_CHECK_EQUAL(imsFace.sentData.size(), 0);
+  BOOST_CHECK_EQUAL(m_imsFace.sentData.size(), 0);
 
   advanceClocks(1_s, 13); // 4_s default interest lifetime x 3
   BOOST_CHECK_EQUAL(nErrors, 1);
-  BOOST_CHECK_EQUAL(imsFace.sentData.size(), 0);
+  BOOST_CHECK_EQUAL(m_imsFace.sentData.size(), 0);
 
   advanceClocks(1_s, 730); // 60 seconds between attempts + ~12 seconds for each attempt
   BOOST_CHECK_EQUAL(nErrors, 11);
-  BOOST_CHECK_EQUAL(imsFace.sentData.size(), 0);
+  BOOST_CHECK_EQUAL(m_imsFace.sentData.size(), 0);
 
   // check recovery
 
@@ -171,7 +171,7 @@
 
   advanceClocks(1_s, 73);
 
-  auto kek = imsFace.sentData.at(0);
+  auto kek = m_imsFace.sentData.at(0);
   BOOST_CHECK_EQUAL(kek.getName().getPrefix(6), Name("/access/policy/identity/NAC/dataset/KEK"));
   BOOST_CHECK_EQUAL(kek.getName().size(), 7);
 }