diff --git a/Tests/VaporOAuthTests/AuthorizationTests/AuthorizationRequestTests.swift b/Tests/VaporOAuthTests/AuthorizationTests/AuthorizationRequestTests.swift
index 49d0ad8..47e1f85 100644
--- a/Tests/VaporOAuthTests/AuthorizationTests/AuthorizationRequestTests.swift
+++ b/Tests/VaporOAuthTests/AuthorizationTests/AuthorizationRequestTests.swift
@@ -6,6 +6,8 @@ class AuthorizationRequestTests: XCTestCase {
     // MARK: - Properties
 
     var app: Application!
+    /// used for some but not all tests
+    var customApp: Application?
     var fakeClientRetriever: FakeClientGetter!
     var capturingAuthoriseHandler: CapturingAuthoriseHandler!
 
@@ -33,6 +35,7 @@ class AuthorizationRequestTests: XCTestCase {
 
     override func tearDown() async throws {
         app.shutdown()
+        customApp?.shutdown()
         try await super.tearDown()
     }
 
@@ -221,8 +224,7 @@ class AuthorizationRequestTests: XCTestCase {
     }
 
     func testThatUnknownScopeReturnsInvalidScopeError() async throws {
-        app.shutdown()
-        app = try TestDataBuilder.getOAuth2Application(
+        customApp = try TestDataBuilder.getOAuth2Application(
             clientRetriever: fakeClientRetriever,
             authorizeHandler: capturingAuthoriseHandler,
             validScopes: ["email", "profile", "admin"]
@@ -232,7 +234,8 @@ class AuthorizationRequestTests: XCTestCase {
         let response = try await respondToOAuthRequest(
             clientID: clientID,
             redirectURI: redirectURI,
-            scope: invalidScope
+            scope: invalidScope,
+            on: customApp!
         )
 
         XCTAssertEqual(response.status, .seeOther)
@@ -292,8 +295,7 @@ class AuthorizationRequestTests: XCTestCase {
     }
 
     func testNonHTTPSRedirectURICanNotBeUsedWhenInProduction() async throws {
-        app.shutdown()
-        app = try TestDataBuilder.getOAuth2Application(
+        customApp = try TestDataBuilder.getOAuth2Application(
             clientRetriever: fakeClientRetriever,
             authorizeHandler: capturingAuthoriseHandler,
             environment: .production
@@ -307,7 +309,7 @@ class AuthorizationRequestTests: XCTestCase {
         )
         fakeClientRetriever.validClients[clientID] = httpClient
 
-        _ = try await respondToOAuthRequest(clientID: clientID, redirectURI: nonHTTPSRedirectURI)
+        _ = try await respondToOAuthRequest(clientID: clientID, redirectURI: nonHTTPSRedirectURI, on: customApp!)
 
         XCTAssertEqual(capturingAuthoriseHandler.authorizationError, .httpRedirectURI)
     }
@@ -370,9 +372,11 @@ class AuthorizationRequestTests: XCTestCase {
         clientID: String?,
         redirectURI: String?,
         scope: String? = nil,
-        state: String? = nil
+        state: String? = nil,
+        on customApp: Application? = nil
     ) async throws -> XCTHTTPResponse {
-        try await TestDataBuilder.getAuthRequestResponse(
+        let app: Application! = customApp ?? self.app
+        return try await TestDataBuilder.getAuthRequestResponse(
             with: app,
             responseType: responseType,
             clientID: clientID,
diff --git a/Tests/VaporOAuthTests/AuthorizationTests/AuthorizationResponseTests.swift b/Tests/VaporOAuthTests/AuthorizationTests/AuthorizationResponseTests.swift
index 5a960f9..78ec3e1 100644
--- a/Tests/VaporOAuthTests/AuthorizationTests/AuthorizationResponseTests.swift
+++ b/Tests/VaporOAuthTests/AuthorizationTests/AuthorizationResponseTests.swift
@@ -6,6 +6,7 @@ class AuthorizationResponseTests: XCTestCase {
     // MARK: - Properties
 
     var app: Application!
+    var customApp: Application?
     var fakeClientRetriever: FakeClientGetter!
     var capturingAuthoriseHandler: CapturingAuthoriseHandler!
     var fakeCodeManager: FakeCodeManager!
@@ -49,6 +50,7 @@ class AuthorizationResponseTests: XCTestCase {
 
     override func tearDown() async throws {
         app.shutdown()
+        customApp?.shutdown()
         try await super.tearDown()
     }
 
@@ -128,9 +130,7 @@ class AuthorizationResponseTests: XCTestCase {
     }
 
     func testThatRedirectURIMustBeHTTPSForProduction() async throws {
-        app.shutdown()
-
-        app = try TestDataBuilder.getOAuth2Application(
+        customApp = try TestDataBuilder.getOAuth2Application(
             clientRetriever: fakeClientRetriever,
             authorizeHandler: capturingAuthoriseHandler,
             environment: .production,
@@ -142,7 +142,7 @@ class AuthorizationResponseTests: XCTestCase {
         let newClient = OAuthClient(clientID: clientID, redirectURIs: [redirectURI], allowedGrantType: .authorization)
         fakeClientRetriever.validClients[clientID] = newClient
 
-        let response = try await getAuthResponse(clientID: clientID, redirectURI: redirectURI)
+        let response = try await getAuthResponse(clientID: clientID, redirectURI: redirectURI, on: customApp!)
 
         XCTAssertEqual(response.status, .badRequest)
     }
@@ -308,9 +308,11 @@ class AuthorizationResponseTests: XCTestCase {
         state: String? = nil,
         user: OAuthUser? = TestDataBuilder.anyOAuthUser(),
         csrfToken: String? = "the-csrf-token",
-        sessionID: String? = "the-session-ID"
+        sessionID: String? = "the-session-ID",
+        on customApp: Application? = nil
     ) async throws -> XCTHTTPResponse {
-        try await TestDataBuilder.getAuthResponseResponse(
+        let app: Application! = customApp ?? self.app
+        return try await TestDataBuilder.getAuthResponseResponse(
             with: app,
             approve: approve,
             clientID: clientID,
diff --git a/Tests/VaporOAuthTests/GrantTests/ImplicitGrantTests.swift b/Tests/VaporOAuthTests/GrantTests/ImplicitGrantTests.swift
index 36bb262..88c77f2 100644
--- a/Tests/VaporOAuthTests/GrantTests/ImplicitGrantTests.swift
+++ b/Tests/VaporOAuthTests/GrantTests/ImplicitGrantTests.swift
@@ -4,6 +4,8 @@ import XCTVapor
 class ImplicitGrantTests: XCTestCase {
     // MARK: - Properties
     var app: Application!
+    // used for some, but not all tests
+    var customApp: Application?
     var fakeClientGetter: FakeClientGetter!
     var fakeTokenManager: FakeTokenManager!
     var capturingAuthHandler: CapturingAuthoriseHandler!
@@ -49,6 +51,7 @@ class ImplicitGrantTests: XCTestCase {
 
     override func tearDown() async throws {
         app.shutdown()
+        customApp?.shutdown()
         try await super.tearDown()
     }
 
@@ -242,8 +245,7 @@ class ImplicitGrantTests: XCTestCase {
     }
 
     func testThatRedirectURIMustBeHTTPSForProduction() async throws {
-        app.shutdown()
-        app = try TestDataBuilder.getOAuth2Application(
+        customApp = try TestDataBuilder.getOAuth2Application(
             clientRetriever: fakeClientGetter,
             authorizeHandler: capturingAuthHandler,
             environment: .production,
@@ -255,7 +257,7 @@ class ImplicitGrantTests: XCTestCase {
         let newClient = OAuthClient(clientID: clientID, redirectURIs: [redirectURI], allowedGrantType: .implicit)
         fakeClientGetter.validClients[clientID] = newClient
 
-        let response = try await getImplicitGrantResponse(clientID: clientID, redirectURI: redirectURI)
+        let response = try await getImplicitGrantResponse(clientID: clientID, redirectURI: redirectURI, on: customApp!)
 
         XCTAssertEqual(response.status, .badRequest)
     }
@@ -350,8 +352,7 @@ class ImplicitGrantTests: XCTestCase {
         fakeTokenManager.accessTokenToReturn = accessToken
         let user = OAuthUser(userID: userID, username: "luke", emailAddress: "luke@skywalker.com", password: "obiwan")
 
-        app.shutdown()
-        app = try TestDataBuilder.getOAuth2Application(
+        customApp = try TestDataBuilder.getOAuth2Application(
             tokenManager: fakeTokenManager,
             clientRetriever: fakeClientGetter,
             authorizeHandler: capturingAuthHandler,
@@ -360,7 +361,7 @@ class ImplicitGrantTests: XCTestCase {
             registeredUsers: [user]
         )
 
-        _ = try await getImplicitGrantResponse(user: user)
+        _ = try await getImplicitGrantResponse(user: user, on: customApp!)
 
         guard let token = fakeTokenManager.getAccessToken(accessToken) else {
             XCTFail()
@@ -384,8 +385,7 @@ class ImplicitGrantTests: XCTestCase {
     }
 
     func testThatUserMustBeLoggedInWhenMakingImplicitTokenRequest() async throws {
-        app.shutdown()
-        app = try TestDataBuilder.getOAuth2Application(
+        customApp = try TestDataBuilder.getOAuth2Application(
             tokenManager: fakeTokenManager,
             clientRetriever: fakeClientGetter,
             authorizeHandler: capturingAuthHandler,
@@ -393,7 +393,7 @@ class ImplicitGrantTests: XCTestCase {
             sessions: fakeSessions
         )
 
-        let response = try await getImplicitGrantResponse(user: nil)
+        let response = try await getImplicitGrantResponse(user: nil, on: customApp!)
 
         XCTAssertEqual(response.status, .unauthorized)
     }
@@ -466,9 +466,18 @@ class ImplicitGrantTests: XCTestCase {
         clientID: String? = "ABCDEF",
         redirectURI: String? = "https://api.brokenhands.io/callback",
         scope: String? = nil,
-        state: String? = nil
+        state: String? = nil,
+        on customApp: Application? = nil
     ) async throws -> XCTHTTPResponse {
-        return try await TestDataBuilder.getAuthRequestResponse(with: app, responseType: responseType, clientID: clientID, redirectURI: redirectURI, scope: scope, state: state)
+        let app: Application! = customApp ?? self.app
+        return try await TestDataBuilder.getAuthRequestResponse(
+            with: app,
+            responseType: responseType,
+            clientID: clientID,
+            redirectURI: redirectURI,
+            scope: scope,
+            state: state
+        )
     }
 
     private func getImplicitGrantResponse(
@@ -480,8 +489,10 @@ class ImplicitGrantTests: XCTestCase {
         state: String? = nil,
         user: OAuthUser? = TestDataBuilder.anyOAuthUser(),
         csrfToken: String? = "the-csrf-token",
-        sessionID: String? = "the-session-ID"
+        sessionID: String? = "the-session-ID",
+        on customApp: Application? = nil
     ) async throws -> XCTHTTPResponse {
+        let app: Application! = customApp ?? self.app
         return try await TestDataBuilder.getAuthResponseResponse(
             with: app,
             approve: approve,