diff --git a/cmd/sharded-test-server/shard.go b/cmd/sharded-test-server/shard.go
index 863cb3e6bbd..ddc84ee1509 100644
--- a/cmd/sharded-test-server/shard.go
+++ b/cmd/sharded-test-server/shard.go
@@ -89,6 +89,9 @@ func newShard(ctx context.Context, n int, args []string, standaloneVW bool, serv
 		"--requestheader-extra-headers-prefix=X-Remote-Extra-",
 		fmt.Sprintf("--service-account-key-file=%s", filepath.Join(workDirPath, ".kcp/service-account.crt")),
 		fmt.Sprintf("--service-account-private-key-file=%s", filepath.Join(workDirPath, ".kcp/service-account.key")),
+		fmt.Sprintf("--service-account-signing-key-file=%s", filepath.Join(workDirPath, ".kcp/service-account.key")),
+		// TODO(sttts): remove this flag as soon as we have service account token lookup configured.
+		"--service-account-lookup=false",
 		"--audit-log-path", auditFilePath,
 		fmt.Sprintf("--shard-external-url=https://%s:%d", hostIP, 6443),
 		fmt.Sprintf("--tls-cert-file=%s", filepath.Join(workDirPath, fmt.Sprintf(".kcp-%d/apiserver.crt", n))),