diff --git a/changes/ticket32185 b/changes/ticket32185
new file mode 100644
index 0000000000..86f5dc5af1
--- /dev/null
+++ b/changes/ticket32185
@@ -0,0 +1,4 @@
+  o Code simplification and refactoring:
+    - Simplify the options_validate() code so that it looks at the default
+      options directly, rather than taking default options as an argument.
+      This change lets us simplify its interface. Closes ticket 32185.
diff --git a/src/app/config/config.c b/src/app/config/config.c
index 77b73f8851..f07c9bbc2a 100644
--- a/src/app/config/config.c
+++ b/src/app/config/config.c
@@ -3434,7 +3434,7 @@ options_validate_single_onion(or_options_t *options, char **msg)
  */
 STATIC int
 options_validate(or_options_t *old_options, or_options_t *options,
-                 or_options_t *default_options, int from_setconf_unused,
+                 or_options_t *default_options_unused, int from_setconf_unused,
                  char **msg)
 {
   config_line_t *cl;
@@ -3442,6 +3442,7 @@ options_validate(or_options_t *old_options, or_options_t *options,
   int n_ports=0;
   int world_writable_control_socket=0;
   (void)from_setconf_unused; /* 29211 TODO: Remove this from the API. */
+  (void)default_options_unused; /* 29211 TODO: Remove this from the API. */
 
   tor_assert(msg);
   *msg = NULL;
@@ -4486,12 +4487,17 @@ options_validate(or_options_t *old_options, or_options_t *options,
            "AlternateDirAuthority and AlternateBridgeAuthority configured.");
   }
 
+  /* Check for options that can only be changed from the defaults in testing
+     networks.  */
+  or_options_t *dflt_options = options_new();
+  options_init(dflt_options);
 #define CHECK_DEFAULT(arg)                                              \
   STMT_BEGIN                                                            \
     if (!options->TestingTorNetwork &&                                  \
         !options->UsingTestNetworkDefaults_ &&                          \
-        !config_is_same(get_options_mgr(),options,                        \
-                        default_options,#arg)) {                        \
+        !config_is_same(get_options_mgr(),options,                      \
+                        dflt_options,#arg)) {                           \
+      or_options_free(dflt_options);                                    \
       REJECT(#arg " may only be changed in testing Tor "                \
              "networks!");                                              \
     } STMT_END
@@ -4515,6 +4521,7 @@ options_validate(or_options_t *old_options, or_options_t *options,
   CHECK_DEFAULT(TestingAuthKeySlop);
   CHECK_DEFAULT(TestingLinkKeySlop);
 #undef CHECK_DEFAULT
+  or_options_free(dflt_options);
 
   if (!options->ClientDNSRejectInternalAddresses &&
       !(options->DirAuthorities ||