diff --git a/src/allmydata/storage_client.py b/src/allmydata/storage_client.py
index 65c65f535..832f03858 100644
--- a/src/allmydata/storage_client.py
+++ b/src/allmydata/storage_client.py
@@ -111,7 +111,7 @@ class StorageFarmBroker(service.MultiService):
     # these two are used in unit tests
     def test_add_rref(self, serverid, rref, ann):
         s = NativeStorageServer(serverid, ann.copy(), self._tub_maker, {})
-        s.rref = rref
+        s._rref = rref
         s._is_connected = True
         self.servers[serverid] = s
 
@@ -315,7 +315,7 @@ class NativeStorageServer(service.MultiService):
         self.last_connect_time = None
         self.last_loss_time = None
         self.remote_host = None
-        self.rref = None
+        self._rref = None
         self._is_connected = False
         self._reconnector = None
         self._trigger_cb = None
@@ -344,8 +344,8 @@ class NativeStorageServer(service.MultiService):
     def get_permutation_seed(self):
         return self._permutation_seed
     def get_version(self):
-        if self.rref:
-            return self.rref.version
+        if self._rref:
+            return self._rref.version
         return None
     def get_name(self): # keep methodname short
         # TODO: decide who adds [] in the short description. It should
@@ -367,8 +367,8 @@ class NativeStorageServer(service.MultiService):
 
     def get_connection_status(self):
         last_received = None
-        if self.rref:
-            last_received = self.rref.getDataLastReceivedAt()
+        if self._rref:
+            last_received = self._rref.getDataLastReceivedAt()
         return connection_status.from_foolscap_reconnector(self._reconnector,
                                                            last_received)
 
@@ -414,18 +414,18 @@ class NativeStorageServer(service.MultiService):
 
         self.last_connect_time = time.time()
         self.remote_host = rref.getLocationHints()
-        self.rref = rref
+        self._rref = rref
         self._is_connected = True
         rref.notifyOnDisconnect(self._lost)
 
     def get_rref(self):
-        return self.rref
+        return self._rref
 
     def _lost(self):
         log.msg(format="lost connection to %(name)s", name=self.get_name(),
                 facility="tahoe.storage_broker", umid="zbRllw")
         self.last_loss_time = time.time()
-        # self.rref is now stale: all callRemote()s will get a
+        # self._rref is now stale: all callRemote()s will get a
         # DeadReferenceError. We leave the stale reference in place so that
         # uploader/downloader code (which received this IServer through
         # get_connected_servers() or get_servers_for_psi()) can continue to