diff --git a/src/verify_cert.rs b/src/verify_cert.rs
index 7d0f098c..7d82bdae 100644
--- a/src/verify_cert.rs
+++ b/src/verify_cert.rs
@@ -54,12 +54,11 @@ impl<'a, 'p: 'a> PathBuilder<'a, 'p> {
     ///   public key is not validated against this list.
     /// * `trust_anchors` is the list of root CAs to trust in the built path.
     pub fn new(
-        eku: &'p dyn ExtendedKeyUsageValidator,
         supported_sig_algs: &'a [&'a dyn SignatureVerificationAlgorithm],
         trust_anchors: &'p [TrustAnchor<'p>],
     ) -> Self {
         Self {
-            eku,
+            eku: &ExtendedKeyUsage::SERVER_AUTH,
             supported_sig_algs,
             trust_anchors,
             intermediate_certs: &[],
@@ -76,6 +75,15 @@ impl<'a, 'p: 'a> PathBuilder<'a, 'p> {
         self
     }
 
+    /// Set the extended key usage validator to use for path building.
+    ///
+    /// Defaults to [`ExtendedKeyUsage::SERVER_AUTH`], which requires the certificate to have the
+    /// EKU for server authentication if it has any EKUs.
+    pub fn with_eku_validator(mut self, eku: &'a dyn ExtendedKeyUsageValidator) -> Self {
+        self.eku = eku;
+        self
+    }
+
     /// Set the revocation options to use for path building.
     ///
     /// By default, revocation checking is disabled.
@@ -1422,12 +1430,8 @@ mod tests {
         let time = UnixTime::since_unix_epoch(Duration::from_secs(0x1fed_f00d));
         let mut path = PartialPath::new(ee_cert);
 
-        let builder = PathBuilder::new(
-            &ExtendedKeyUsage::SERVER_AUTH,
-            rustls_aws_lc_rs::ALL_VERIFICATION_ALGS,
-            trust_anchors,
-        )
-        .with_intermediate_certs(intermediate_certs);
+        let builder = PathBuilder::new(rustls_aws_lc_rs::ALL_VERIFICATION_ALGS, trust_anchors)
+            .with_intermediate_certs(intermediate_certs);
         let builder = match verify_path {
             Some(verify) => builder.with_path_verification(verify),
             None => builder,
diff --git a/tests/amazon.rs b/tests/amazon.rs
index 7e2955d1..6e9954ec 100644
--- a/tests/amazon.rs
+++ b/tests/amazon.rs
@@ -6,9 +6,8 @@ use core::time::Duration;
 use pki_types::{CertificateDer, ServerName, UnixTime};
 use rustls_aws_lc_rs::ALL_VERIFICATION_ALGS;
 use webpki::{
-    CertRevocationList, EndEntityCert, ExtendedKeyUsage, OwnedCertRevocationList, PathBuilder,
-    RevocationCheckDepth, RevocationOptions, RevocationOptionsBuilder, UnknownStatusPolicy,
-    anchor_from_trusted_cert,
+    CertRevocationList, EndEntityCert, OwnedCertRevocationList, PathBuilder, RevocationCheckDepth,
+    RevocationOptions, RevocationOptionsBuilder, UnknownStatusPolicy, anchor_from_trusted_cert,
 };
 
 fn revocation_options_for_test<'a>(
@@ -236,12 +235,8 @@ pub fn amazon() {
             Some(&intermediates_crls),
             Some(&all_crls),
         ] {
-            let builder = PathBuilder::new(
-                &ExtendedKeyUsage::SERVER_AUTH,
-                ALL_VERIFICATION_ALGS,
-                &anchors,
-            )
-            .with_intermediate_certs(&intermediates);
+            let builder = PathBuilder::new(ALL_VERIFICATION_ALGS, &anchors)
+                .with_intermediate_certs(&intermediates);
 
             let builder = match crls {
                 Some(crls) => builder.with_revocation(revocation_options_for_test(crls)),
@@ -250,12 +245,8 @@ pub fn amazon() {
 
             assert!(builder.build(&cert, time).is_ok());
 
-            let builder = PathBuilder::new(
-                &ExtendedKeyUsage::SERVER_AUTH,
-                ALL_VERIFICATION_ALGS,
-                &legacy_anchors,
-            )
-            .with_intermediate_certs(&intermediates_legacy);
+            let builder = PathBuilder::new(ALL_VERIFICATION_ALGS, &legacy_anchors)
+                .with_intermediate_certs(&intermediates_legacy);
 
             let builder = match crls {
                 Some(crls) => builder.with_revocation(revocation_options_for_test(crls)),
@@ -264,12 +255,8 @@ pub fn amazon() {
 
             assert!(builder.build(&cert, time).is_ok());
 
-            let builder = PathBuilder::new(
-                &ExtendedKeyUsage::SERVER_AUTH,
-                ALL_VERIFICATION_ALGS,
-                &all_anchors,
-            )
-            .with_intermediate_certs(&intermediates_legacy);
+            let builder = PathBuilder::new(ALL_VERIFICATION_ALGS, &all_anchors)
+                .with_intermediate_certs(&intermediates_legacy);
 
             let builder = match crls {
                 Some(crls) => builder.with_revocation(revocation_options_for_test(crls)),
@@ -278,12 +265,8 @@ pub fn amazon() {
 
             assert!(builder.build(&cert, time).is_ok());
 
-            let builder = PathBuilder::new(
-                &ExtendedKeyUsage::SERVER_AUTH,
-                ALL_VERIFICATION_ALGS,
-                &all_anchors,
-            )
-            .with_intermediate_certs(&intermediates_legacy);
+            let builder = PathBuilder::new(ALL_VERIFICATION_ALGS, &all_anchors)
+                .with_intermediate_certs(&intermediates_legacy);
 
             let builder = match crls {
                 Some(crls) => builder.with_revocation(revocation_options_for_test(crls)),
@@ -301,12 +284,8 @@ pub fn amazon() {
         let cert = EndEntityCert::try_from(&cert).unwrap();
 
         for &crls in &[None, Some(&roots_crls)] {
-            let builder = PathBuilder::new(
-                &ExtendedKeyUsage::SERVER_AUTH,
-                ALL_VERIFICATION_ALGS,
-                &anchors,
-            )
-            .with_intermediate_certs(&intermediates);
+            let builder = PathBuilder::new(ALL_VERIFICATION_ALGS, &anchors)
+                .with_intermediate_certs(&intermediates);
 
             let builder = match crls {
                 Some(crls) => builder.with_revocation(revocation_options_for_test(crls)),
@@ -317,13 +296,9 @@ pub fn amazon() {
         }
 
         for &crls in &[&intermediates_crls, &all_crls] {
-            let builder = PathBuilder::new(
-                &ExtendedKeyUsage::SERVER_AUTH,
-                ALL_VERIFICATION_ALGS,
-                &anchors,
-            )
-            .with_intermediate_certs(&intermediates)
-            .with_revocation(revocation_options_for_test(crls));
+            let builder = PathBuilder::new(ALL_VERIFICATION_ALGS, &anchors)
+                .with_intermediate_certs(&intermediates)
+                .with_revocation(revocation_options_for_test(crls));
 
             assert!(
                 builder
@@ -334,12 +309,8 @@ pub fn amazon() {
     }
 
     for &(cert, _dns_name) in expired_certs {
-        let builder = PathBuilder::new(
-            &ExtendedKeyUsage::SERVER_AUTH,
-            ALL_VERIFICATION_ALGS,
-            &anchors,
-        )
-        .with_intermediate_certs(&intermediates);
+        let builder = PathBuilder::new(ALL_VERIFICATION_ALGS, &anchors)
+            .with_intermediate_certs(&intermediates);
 
         let cert = CertificateDer::from(cert);
         let cert = EndEntityCert::try_from(&cert).unwrap();
diff --git a/tests/client_auth.rs b/tests/client_auth.rs
index 0383be48..1905553d 100644
--- a/tests/client_auth.rs
+++ b/tests/client_auth.rs
@@ -78,11 +78,8 @@ fn cert_with_serverauth_eku_rejected_for_client_auth() {
 
 fn check_cert(ee: &[u8], ca: CertificateDer<'static>) -> Result<(), webpki::Error> {
     let anchors = &[anchor_from_trusted_cert(&ca).unwrap()];
-    let builder = PathBuilder::new(
-        &ExtendedKeyUsage::CLIENT_AUTH,
-        rustls_aws_lc_rs::ALL_VERIFICATION_ALGS,
-        anchors,
-    );
+    let builder = PathBuilder::new(rustls_aws_lc_rs::ALL_VERIFICATION_ALGS, anchors)
+        .with_eku_validator(&ExtendedKeyUsage::CLIENT_AUTH);
 
     let time = UnixTime::since_unix_epoch(Duration::from_secs(0x1fed_f00d));
     let ee = CertificateDer::from(ee);
diff --git a/tests/client_auth_revocation.rs b/tests/client_auth_revocation.rs
index 8d4bc1c9..f93fa75a 100644
--- a/tests/client_auth_revocation.rs
+++ b/tests/client_auth_revocation.rs
@@ -50,8 +50,9 @@ fn check_cert(
         .map(|cert| CertificateDer::from(*cert))
         .collect::<Vec<_>>();
 
-    let builder = PathBuilder::new(&ExtendedKeyUsage::CLIENT_AUTH, ALGS, anchors)
-        .with_intermediate_certs(&intermediates);
+    let builder = PathBuilder::new(ALGS, anchors)
+        .with_intermediate_certs(&intermediates)
+        .with_eku_validator(&ExtendedKeyUsage::CLIENT_AUTH);
 
     let builder = match revocation {
         Some(crls) => builder.with_revocation(crls),
diff --git a/tests/custom_ekus.rs b/tests/custom_ekus.rs
index 4f5d8f6c..d3228d95 100644
--- a/tests/custom_ekus.rs
+++ b/tests/custom_ekus.rs
@@ -14,7 +14,8 @@ fn check_cert(
 ) {
     let ca = CertificateDer::from(ca);
     let anchors = [anchor_from_trusted_cert(&ca).unwrap()];
-    let builder = PathBuilder::new(eku, rustls_aws_lc_rs::ALL_VERIFICATION_ALGS, &anchors);
+    let builder =
+        PathBuilder::new(rustls_aws_lc_rs::ALL_VERIFICATION_ALGS, &anchors).with_eku_validator(eku);
 
     let ee = CertificateDer::from(ee);
     let cert = webpki::EndEntityCert::try_from(&ee).unwrap();
diff --git a/tests/integration.rs b/tests/integration.rs
index ea7bc62b..129cb427 100644
--- a/tests/integration.rs
+++ b/tests/integration.rs
@@ -19,7 +19,7 @@ use core::time::Duration;
 use pki_types::{CertificateDer, UnixTime};
 use rustls_aws_lc_rs::ALL_VERIFICATION_ALGS;
 use webpki::sct::LogIdAndTimestamp;
-use webpki::{ExtendedKeyUsage, PathBuilder, anchor_from_trusted_cert};
+use webpki::{PathBuilder, anchor_from_trusted_cert};
 
 /* Checks we can verify netflix's cert chain.  This is notable
  * because they're rooted at a Verisign v1 root. */
@@ -32,12 +32,8 @@ fn netflix() {
 
     let anchors = [anchor_from_trusted_cert(&ca).unwrap()];
     let intermediates = &[inter];
-    let builder = PathBuilder::new(
-        &ExtendedKeyUsage::SERVER_AUTH,
-        ALL_VERIFICATION_ALGS,
-        &anchors,
-    )
-    .with_intermediate_certs(intermediates);
+    let builder =
+        PathBuilder::new(ALL_VERIFICATION_ALGS, &anchors).with_intermediate_certs(intermediates);
 
     let time = UnixTime::since_unix_epoch(Duration::from_secs(1_492_441_716)); // 2017-04-17T15:08:36Z
     let ee = CertificateDer::from(ee);
@@ -55,12 +51,8 @@ fn sanofi_rsa_signature_with_absent_algorithm_params() {
 
     let anchors = [anchor_from_trusted_cert(&ca).unwrap()];
     let intermediates = &[inter];
-    let builder = PathBuilder::new(
-        &ExtendedKeyUsage::SERVER_AUTH,
-        ALL_VERIFICATION_ALGS,
-        &anchors,
-    )
-    .with_intermediate_certs(intermediates);
+    let builder =
+        PathBuilder::new(ALL_VERIFICATION_ALGS, &anchors).with_intermediate_certs(intermediates);
 
     let time = UnixTime::since_unix_epoch(Duration::from_secs(1_746_549_566)); // 2025-05-06T17:39:26Z
     let ee = CertificateDer::from(ee);
@@ -80,12 +72,8 @@ fn cloudflare_dns() {
 
     let anchors = [anchor_from_trusted_cert(&ca).unwrap()];
     let intermediates = &[inter];
-    let builder = PathBuilder::new(
-        &ExtendedKeyUsage::SERVER_AUTH,
-        ALL_VERIFICATION_ALGS,
-        &anchors,
-    )
-    .with_intermediate_certs(intermediates);
+    let builder =
+        PathBuilder::new(ALL_VERIFICATION_ALGS, &anchors).with_intermediate_certs(intermediates);
 
     let time = UnixTime::since_unix_epoch(Duration::from_secs(1_663_495_771));
     let ee = CertificateDer::from(ee);
@@ -130,11 +118,7 @@ fn wpt() {
     let ca = CertificateDer::from(&include_bytes!("wpt/ca.der")[..]);
 
     let anchors = [anchor_from_trusted_cert(&ca).unwrap()];
-    let builder = PathBuilder::new(
-        &ExtendedKeyUsage::SERVER_AUTH,
-        ALL_VERIFICATION_ALGS,
-        &anchors,
-    );
+    let builder = PathBuilder::new(ALL_VERIFICATION_ALGS, &anchors);
 
     let time = UnixTime::since_unix_epoch(Duration::from_secs(1_619_256_684)); // 2021-04-24T09:31:24Z
     let cert = webpki::EndEntityCert::try_from(&ee).unwrap();
@@ -147,11 +131,7 @@ fn ed25519() {
     let ca = CertificateDer::from(&include_bytes!("ed25519/ca.der")[..]);
 
     let anchors = [anchor_from_trusted_cert(&ca).unwrap()];
-    let builder = PathBuilder::new(
-        &ExtendedKeyUsage::SERVER_AUTH,
-        ALL_VERIFICATION_ALGS,
-        &anchors,
-    );
+    let builder = PathBuilder::new(ALL_VERIFICATION_ALGS, &anchors);
 
     let time = UnixTime::since_unix_epoch(Duration::from_secs(1_547_363_522)); // 2019-01-13T07:12:02Z
     let cert = webpki::EndEntityCert::try_from(&ee).unwrap();
@@ -166,12 +146,8 @@ fn critical_extensions() {
 
     let anchors = [anchor_from_trusted_cert(&root).unwrap()];
     let intermediates = &[ca];
-    let builder = PathBuilder::new(
-        &ExtendedKeyUsage::SERVER_AUTH,
-        ALL_VERIFICATION_ALGS,
-        &anchors,
-    )
-    .with_intermediate_certs(intermediates);
+    let builder =
+        PathBuilder::new(ALL_VERIFICATION_ALGS, &anchors).with_intermediate_certs(intermediates);
 
     let time = UnixTime::since_unix_epoch(Duration::from_secs(1_670_779_098));
     let ee = CertificateDer::from(
@@ -214,11 +190,7 @@ fn read_ee_with_neg_serial() {
     let ee = CertificateDer::from(&include_bytes!("misc/serial_neg_ee.der")[..]);
 
     let anchors = [anchor_from_trusted_cert(&ca).unwrap()];
-    let builder = PathBuilder::new(
-        &ExtendedKeyUsage::SERVER_AUTH,
-        ALL_VERIFICATION_ALGS,
-        &anchors,
-    );
+    let builder = PathBuilder::new(ALL_VERIFICATION_ALGS, &anchors);
 
     let time = UnixTime::since_unix_epoch(Duration::from_secs(1_667_401_500)); // 2022-11-02T15:05:00Z
     let cert = webpki::EndEntityCert::try_from(&ee).unwrap();
@@ -379,12 +351,8 @@ fn cert_time_validity() {
     let ca = CertificateDer::from(&include_bytes!("netflix/ca.der")[..]);
 
     let anchors = [anchor_from_trusted_cert(&ca).unwrap()];
-    let builder = PathBuilder::new(
-        &ExtendedKeyUsage::SERVER_AUTH,
-        ALL_VERIFICATION_ALGS,
-        &anchors,
-    )
-    .with_intermediate_certs(slice::from_ref(&inter));
+    let builder = PathBuilder::new(ALL_VERIFICATION_ALGS, &anchors)
+        .with_intermediate_certs(slice::from_ref(&inter));
 
     let not_before = UnixTime::since_unix_epoch(Duration::from_secs(1_478_563_200));
     let not_after = UnixTime::since_unix_epoch(Duration::from_secs(1_541_203_199));
diff --git a/tests/tls_server_certs.rs b/tests/tls_server_certs.rs
index 3c04cca8..af65e9cc 100644
--- a/tests/tls_server_certs.rs
+++ b/tests/tls_server_certs.rs
@@ -21,7 +21,7 @@ use rcgen::{
     DistinguishedName, DnType, GeneralSubtree, IsCa, KeyPair, NameConstraints, SanType,
     date_time_ymd,
 };
-use webpki::{ExtendedKeyUsage, InvalidNameContext, PathBuilder, anchor_from_trusted_cert};
+use webpki::{InvalidNameContext, PathBuilder, anchor_from_trusted_cert};
 
 mod common;
 use common::issuer_params;
@@ -36,11 +36,7 @@ fn check_cert(
 ) -> Result<(), webpki::Error> {
     let ca_cert_der = CertificateDer::from(ca);
     let anchors = [anchor_from_trusted_cert(&ca_cert_der).unwrap()];
-    let builder = PathBuilder::new(
-        &ExtendedKeyUsage::SERVER_AUTH,
-        rustls_aws_lc_rs::ALL_VERIFICATION_ALGS,
-        &anchors,
-    );
+    let builder = PathBuilder::new(rustls_aws_lc_rs::ALL_VERIFICATION_ALGS, &anchors);
 
     let ee_der = CertificateDer::from(ee);
     let time = UnixTime::since_unix_epoch(Duration::from_secs(0x1fed_f00d));
diff --git a/tests/x509_limbo.rs b/tests/x509_limbo.rs
index 72f9dcb1..71f4b081 100644
--- a/tests/x509_limbo.rs
+++ b/tests/x509_limbo.rs
@@ -11,8 +11,8 @@ use serde::{Deserialize, Serialize};
 use pki_types::pem::PemObject;
 use pki_types::{CertificateDer, CertificateRevocationListDer, ServerName, UnixTime};
 use webpki::{
-    EndEntityCert, ExpirationPolicy, ExtendedKeyUsage, OwnedCertRevocationList, PathBuilder,
-    RevocationCheckDepth, RevocationOptionsBuilder, UnknownStatusPolicy, anchor_from_trusted_cert,
+    EndEntityCert, ExpirationPolicy, OwnedCertRevocationList, PathBuilder, RevocationCheckDepth,
+    RevocationOptionsBuilder, UnknownStatusPolicy, anchor_from_trusted_cert,
 };
 
 #[ignore] // Runs slower than other unit tests - opt-in with `cargo test -- --include-ignored`
@@ -107,12 +107,8 @@ fn run_validation(tc: &Testcase) -> Result<(), String> {
         .map(|ic| cert_der_from_pem(ic))
         .collect::<Vec<_>>();
 
-    let builder = PathBuilder::new(
-        &ExtendedKeyUsage::SERVER_AUTH,
-        rustls_aws_lc_rs::ALL_VERIFICATION_ALGS,
-        &trust_anchors,
-    )
-    .with_intermediate_certs(&intermediates);
+    let builder = PathBuilder::new(rustls_aws_lc_rs::ALL_VERIFICATION_ALGS, &trust_anchors)
+        .with_intermediate_certs(&intermediates);
 
     let crls = tc
         .crls