diff --git a/requirements/base.in b/requirements/base.in
index d764f73a..be11cfe5 100644
--- a/requirements/base.in
+++ b/requirements/base.in
@@ -1 +1,2 @@
 open-api-framework
+git+https://github.com/maykinmedia/commonground-api-common.git@move-middleware-file#egg=commonground-api-common
diff --git a/requirements/base.txt b/requirements/base.txt
index 0d61323a..72f2d036 100644
--- a/requirements/base.txt
+++ b/requirements/base.txt
@@ -56,8 +56,10 @@ click-plugins==1.1.1
     # via celery
 click-repl==0.3.0
     # via celery
-commonground-api-common==1.13.3
-    # via open-api-framework
+commonground-api-common @ git+https://github.com/maykinmedia/commonground-api-common.git@move-middleware-file
+    # via
+    #   -r requirements/base.in
+    #   open-api-framework
 coreapi==2.3.3
     # via commonground-api-common
 coreschema==0.0.4
diff --git a/requirements/ci.txt b/requirements/ci.txt
index fdf434f2..f3991b3d 100644
--- a/requirements/ci.txt
+++ b/requirements/ci.txt
@@ -97,7 +97,7 @@ click-repl==0.3.0
     #   celery
 codecov==2.1.13
     # via -r requirements/ci.in
-commonground-api-common==1.13.3
+commonground-api-common @ git+https://github.com/maykinmedia/commonground-api-common.git@move-middleware-file
     # via
     #   -r requirements/base.txt
     #   open-api-framework
diff --git a/requirements/dev.txt b/requirements/dev.txt
index e8ee2d37..6fdceae1 100644
--- a/requirements/dev.txt
+++ b/requirements/dev.txt
@@ -98,7 +98,7 @@ click-repl==0.3.0
     # via
     #   -r requirements/base.txt
     #   celery
-commonground-api-common==1.13.3
+commonground-api-common @ git+https://github.com/maykinmedia/commonground-api-common.git@move-middleware-file
     # via
     #   -r requirements/base.txt
     #   open-api-framework
diff --git a/src/openklant/conf/base.py b/src/openklant/conf/base.py
index 3eb48d9c..8e45fbc5 100644
--- a/src/openklant/conf/base.py
+++ b/src/openklant/conf/base.py
@@ -19,11 +19,6 @@
 # but we don't want to rely on it anymore (e.g. when generating the label for 2FA)
 INSTALLED_APPS.remove("django.contrib.sites")
 
-# FIXME should these be part of OAf?
-MIDDLEWARE.insert(
-    MIDDLEWARE.index("django.contrib.auth.middleware.AuthenticationMiddleware") + 1,
-    "vng_api_common.middleware.AuthMiddleware",
-)
 MIDDLEWARE = MIDDLEWARE + ["openklant.utils.middleware.APIVersionHeaderMiddleware"]
 
 #
diff --git a/src/openklant/tests/test_cors_configuration.py b/src/openklant/tests/test_cors_configuration.py
index 1bc51902..acb53c9a 100644
--- a/src/openklant/tests/test_cors_configuration.py
+++ b/src/openklant/tests/test_cors_configuration.py
@@ -149,7 +149,7 @@ def test_credentialed_request(self):
         response = self.client.get(
             "/cors",
             HTTP_ORIGIN="http://localhost:3000",
-            HTTP_AUTHORIZATION="Bearer foobarbaz",
+            HTTP_AUTHORIZATION="Token foobarbaz",
         )
 
         self.assertEqual(response["Access-Control-Allow-Origin"], "*")