diff --git a/internal/daemon/controller/common/common.go b/internal/daemon/controller/common/common.go
index 75c175f77..82635347d 100644
--- a/internal/daemon/controller/common/common.go
+++ b/internal/daemon/controller/common/common.go
@@ -25,7 +25,7 @@ type (
 	StaticRepoFactory            func() (*static.Repository, error)
 	PluginHostRepoFactory        func() (*pluginhost.Repository, error)
 	HostPluginRepoFactory        func() (*hostplugin.Repository, error)
-	SessionRepoFactory           func() (*session.Repository, error)
+	SessionRepoFactory           session.RepositoryFactory // TODO refactor and remove this
 	ConnectionRepoFactory        func() (*session.ConnectionRepository, error)
 	TargetRepoFactory            func() (*target.Repository, error)
 	WorkerAuthRepoStorageFactory func() (*server.WorkerAuthRepositoryStorage, error)
diff --git a/internal/daemon/controller/common/scopeids/scope_ids_test.go b/internal/daemon/controller/common/scopeids/scope_ids_test.go
index 77e35b8ed..e65b9e9ae 100644
--- a/internal/daemon/controller/common/scopeids/scope_ids_test.go
+++ b/internal/daemon/controller/common/scopeids/scope_ids_test.go
@@ -44,8 +44,8 @@ func TestListingScopeIds(t *testing.T) {
 	s, err := groups.NewService(iamRepoFn)
 	require.NoError(t, err)
 
-	sessionsRepoFn := func() (*session.Repository, error) {
-		return session.NewRepository(rw, rw, kms)
+	sessionsRepoFn := func(opt ...session.Option) (*session.Repository, error) {
+		return session.NewRepository(rw, rw, kms, opt...)
 	}
 	sess, err := sessions.NewService(sessionsRepoFn, iamRepoFn)
 	require.NoError(t, err)
diff --git a/internal/daemon/controller/controller.go b/internal/daemon/controller/controller.go
index 637c6ec12..5cfbcd0a4 100644
--- a/internal/daemon/controller/controller.go
+++ b/internal/daemon/controller/controller.go
@@ -336,8 +336,8 @@ func New(ctx context.Context, conf *Config) (*Controller, error) {
 	c.TargetRepoFn = func() (*target.Repository, error) {
 		return target.NewRepository(dbase, dbase, c.kms)
 	}
-	c.SessionRepoFn = func() (*session.Repository, error) {
-		return session.NewRepository(dbase, dbase, c.kms)
+	c.SessionRepoFn = func(opt ...session.Option) (*session.Repository, error) {
+		return session.NewRepository(dbase, dbase, c.kms, opt...)
 	}
 	c.ConnectionRepoFn = func() (*session.ConnectionRepository, error) {
 		return session.NewConnectionRepository(ctx, dbase, dbase, c.kms)
diff --git a/internal/daemon/controller/handlers/targets/tcp/target_service_test.go b/internal/daemon/controller/handlers/targets/tcp/target_service_test.go
index 359d32d66..676f0f728 100644
--- a/internal/daemon/controller/handlers/targets/tcp/target_service_test.go
+++ b/internal/daemon/controller/handlers/targets/tcp/target_service_test.go
@@ -85,8 +85,8 @@ func testService(t *testing.T, ctx context.Context, conn *db.DB, kms *kms.Kms, w
 	serversRepoFn := func() (*server.Repository, error) {
 		return server.NewRepository(rw, rw, kms)
 	}
-	sessionRepoFn := func() (*session.Repository, error) {
-		return session.NewRepository(rw, rw, kms)
+	sessionRepoFn := func(opts ...session.Option) (*session.Repository, error) {
+		return session.NewRepository(rw, rw, kms, opts...)
 	}
 	staticHostRepoFn := func() (*static.Repository, error) {
 		return static.NewRepository(rw, rw, kms)
@@ -2749,8 +2749,8 @@ func TestAuthorizeSession(t *testing.T) {
 	serversRepoFn := func() (*server.Repository, error) {
 		return server.NewRepository(rw, rw, kms)
 	}
-	sessionRepoFn := func() (*session.Repository, error) {
-		return session.NewRepository(rw, rw, kms)
+	sessionRepoFn := func(opts ...session.Option) (*session.Repository, error) {
+		return session.NewRepository(rw, rw, kms, opts...)
 	}
 	staticRepo, err := static.NewRepository(rw, rw, kms)
 	require.NoError(t, err)
@@ -3009,8 +3009,8 @@ func TestAuthorizeSessionTypedCredentials(t *testing.T) {
 	serversRepoFn := func() (*server.Repository, error) {
 		return server.NewRepository(rw, rw, kms)
 	}
-	sessionRepoFn := func() (*session.Repository, error) {
-		return session.NewRepository(rw, rw, kms)
+	sessionRepoFn := func(opts ...session.Option) (*session.Repository, error) {
+		return session.NewRepository(rw, rw, kms, opts...)
 	}
 	staticHostRepoFn := func() (*static.Repository, error) {
 		return static.NewRepository(rw, rw, kms)
@@ -3588,8 +3588,8 @@ func TestAuthorizeSession_Errors(t *testing.T) {
 	serversRepoFn := func() (*server.Repository, error) {
 		return server.NewRepository(rw, rw, kms)
 	}
-	sessionRepoFn := func() (*session.Repository, error) {
-		return session.NewRepository(rw, rw, kms)
+	sessionRepoFn := func(opts ...session.Option) (*session.Repository, error) {
+		return session.NewRepository(rw, rw, kms, opts...)
 	}
 	staticHostRepoFn := func() (*static.Repository, error) {
 		return static.NewRepository(rw, rw, kms)