diff --git a/ariadne/auth/keycloak.py b/ariadne/auth/keycloak.py
index 2b3b39d..74ee6d2 100644
--- a/ariadne/auth/keycloak.py
+++ b/ariadne/auth/keycloak.py
@@ -30,11 +30,11 @@ class KeycloakOIDC:
     def verify(self, token: str) -> dict[str, Any]:
         if not token:
             raise ValueError("missing token")
-        jwks = self._get_jwks()
         header = jwt.get_unverified_header(token)
         kid = header.get("kid")
         if not isinstance(kid, str):
             raise ValueError("token missing kid")
+        jwks = self._get_jwks()
         key = None
         for candidate in jwks.get("keys", []) if isinstance(jwks, dict) else []:
             if isinstance(candidate, dict) and candidate.get("kid") == kid:
diff --git a/ariadne/services/mailu.py b/ariadne/services/mailu.py
index 0600741..5ded199 100644
--- a/ariadne/services/mailu.py
+++ b/ariadne/services/mailu.py
@@ -61,3 +61,6 @@ class MailuService:
         if isinstance(raw, str) and raw.strip():
             return raw.strip()
         return f"{username}@{settings.mailu_domain}"
+
+
+mailu = MailuService()
diff --git a/pytest.ini b/pytest.ini
new file mode 100644
index 0000000..a635c5c
--- /dev/null
+++ b/pytest.ini
@@ -0,0 +1,2 @@
+[pytest]
+pythonpath = .
diff --git a/requirements.txt b/requirements.txt
index 9fd66ff..5cc0b65 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,7 +1,7 @@
 fastapi==0.115.11
 uvicorn[standard]==0.30.6
 httpx==0.27.2
-PyJWT==2.10.1
+PyJWT[crypto]==2.10.1
 psycopg[binary]==3.2.6
 psycopg-pool==3.2.6
 croniter==2.0.7