diff --git a/lib/services/phishing-detector.ts b/lib/services/phishing-detector.ts
index a88de0f..a732c2c 100644
--- a/lib/services/phishing-detector.ts
+++ b/lib/services/phishing-detector.ts
@@ -14,7 +14,7 @@
 
 import { createHash } from 'crypto';
 import { postgresClient } from './postgres-client';
-import { AutotaskClient } from './autotask-client';
+import { getAutotaskClient } from './autotask-factory';
 
 // =============================================================================
 // Pure detection logic — pattern matcher + content hash
@@ -109,19 +109,6 @@ export interface EvidencePayload {
   attachments: EvidenceAttachment[];
 }
 
-let _autotaskClient: AutotaskClient | null = null;
-function getAutotaskClient(): AutotaskClient {
-  if (!_autotaskClient) {
-    _autotaskClient = new AutotaskClient({
-      apiUrl: process.env.AUTOTASK_API_URL || '',
-      username: process.env.AUTOTASK_USERNAME || '',
-      password: process.env.AUTOTASK_SECRET || '',
-      apiIntegrationCode: process.env.AUTOTASK_API_INTEGRATION_CODE || '',
-    });
-  }
-  return _autotaskClient;
-}
-
 /**
  * Gather EVID-01 evidence for a candidate ticket: company name, ticket notes,
  * time entries, and attachment metadata (never base64 `data` — content fetch