diff --git a/client/vnc/server/server_x11.go b/client/vnc/server/server_x11.go
index dd5ab8e40..e10846410 100644
--- a/client/vnc/server/server_x11.go
+++ b/client/vnc/server/server_x11.go
@@ -21,9 +21,3 @@ func (s *Server) platformSessionManager() virtualSessionManager {
 func (s *Server) platformShutdown() {
 	// no-op on this platform
 }
-
-// newServiceAgentManager has no service mode to manage on this platform;
-// serviceAcceptLoop falls back to direct mode and never asks for it.
-func (s *Server) newServiceAgentManager() (sessionAgent, func()) {
-	return nil, nil
-}
diff --git a/client/vnc/server/service_agent.go b/client/vnc/server/service_agent.go
index ca90a07b1..cd6bef4fb 100644
--- a/client/vnc/server/service_agent.go
+++ b/client/vnc/server/service_agent.go
@@ -12,32 +12,6 @@ type sessionAgent interface {
 	Resolve(ctx context.Context) (socketPath, token string, peerUID uint32, err error)
 }
 
-// serviceAgent returns the one agent manager this server shares across every
-// service-mode accept loop, constructing it on first use.
-//
-// One per server, not one per listener: the manager owns the agent process for
-// the active session, so a second manager spawns a second agent on its own
-// socket path, and each accept loop then proxies to a different one. Only one of
-// those agents ends up serving, so connections arriving on the other listener
-// are refused with the agent socket actively refusing the dial. A dual-stack
-// server has two accept loops, since the v6 overlay listener is added after
-// Start, which is how that happened.
-//
-// Returns nil once the server has stopped, and on platforms with no service
-// mode.
-func (s *Server) serviceAgent() sessionAgent {
-	s.serviceAgentMu.Lock()
-	defer s.serviceAgentMu.Unlock()
-
-	if s.serviceAgentStopped {
-		return nil
-	}
-	if s.serviceAgentMgr == nil {
-		s.serviceAgentMgr, s.serviceAgentStop = s.newServiceAgentManager()
-	}
-	return s.serviceAgentMgr
-}
-
 // stopServiceAgent tears down the shared manager, if one was ever built, and
 // latches the server so a still-draining accept loop cannot build another.
 // Owned by Stop rather than by an accept loop: the loops share the manager, so
diff --git a/client/vnc/server/service_agent_platform.go b/client/vnc/server/service_agent_platform.go
new file mode 100644
index 000000000..023a8c766
--- /dev/null
+++ b/client/vnc/server/service_agent_platform.go
@@ -0,0 +1,29 @@
+//go:build darwin || windows
+
+package server
+
+// serviceAgent returns the one agent manager this server shares across every
+// service-mode accept loop, constructing it on first use.
+//
+// One per server, not one per listener: the manager owns the agent process for
+// the active session, so a second manager spawns a second agent on its own
+// socket path, and each accept loop then proxies to a different one. Only one of
+// those agents ends up serving, so connections arriving on the other listener
+// are refused with the agent socket actively refusing the dial. A dual-stack
+// server has two accept loops, since the v6 overlay listener is added after
+// Start, which is how that happened.
+//
+// Returns nil once the server has stopped, and on platforms with no service
+// mode.
+func (s *Server) serviceAgent() sessionAgent {
+	s.serviceAgentMu.Lock()
+	defer s.serviceAgentMu.Unlock()
+
+	if s.serviceAgentStopped {
+		return nil
+	}
+	if s.serviceAgentMgr == nil {
+		s.serviceAgentMgr, s.serviceAgentStop = s.newServiceAgentManager()
+	}
+	return s.serviceAgentMgr
+}