diff --git a/tck/README.md b/tck/README.md
index fc85f927..1f82ab9c 100644
--- a/tck/README.md
+++ b/tck/README.md
@@ -58,6 +58,76 @@ This sub-repo contains working applications that demonstrate and test various as
   * Test URL: http://localhost:8080/app-securitycontext-auth/servlet?name=rezax (fails authentication via exception)
   * Test URL: http://localhost:8080/app-securitycontext-auth/servlet?name=rezax (fails authentication via status return code)
 
+## Running tests in parallel (`mvn -T<N>`)
+
+The default `mvn verify` already uses the GlassFish pool (provisioned by
+`glassfish-pool-maven-plugin`, started/cloned per slot, leased by each test
+JVM). Adding `-T<N>` runs reactor modules in parallel and is a large
+wall-clock win, 10x faster on average.
+
+The pool itself is parallel-safe (`PoolBootstrap.up` is JVM-wide synchronized
++ idempotent, slot leasing uses `FileChannel.tryLock`), but test modules
+have to follow a few rules to be `-T`-safe. Existing modules already comply;
+when adding a new one, check the points below.
+
+### 1. No host-port collisions across modules
+
+Modules that start an embedded server bound to `localhost:<port>` (UnboundID
+LDAP, Tomcat for the Mitre OP, …) must each pick a distinct port. Under `-T`
+two modules on the same port fight: only one binds, the other silently
+fails, and tests get cryptic 500s or HTTP timeouts.
+
+Conventions in use:
+
+- LDAP modules: 33389 (`app-ldap`), 33390 (`app-ldap2`), 33391 (`app-ldap3`),
+  12389-12413 for `app-ldap-*`. Pick the next free integer when adding one.
+- Tomcat (Mitre OP) modules: 8443 + 8005 (`app-openid2`), 8444 + 8006
+  (`app-openid3`). Pick another (8445/8007, …) for any new openid-with-Mitre
+  module, and keep `server.xml` + the `ProtectedServlet` `providerURI`
+  annotation + the antrun `<replace token="http://localhost:8080" value="…">`
+  in sync.
+
+### 2. No assumption that GF runs on a known port
+
+Pool slots get ports from `adminBase + (slot-1) * portStride` (default
+14848 + N*100), and a test JVM may lease any slot. Do NOT hardcode a slot's
+HTTP/HTTPS port in app code. Use `@ArquillianResource URL base` for the
+deployed-app URL; for outbound URLs that have to be configured at deployment
+time (e.g. Soteria's `OpenIdAuthenticationMechanismDefinition.providerURI`),
+use an EL expression backed by a `@RequestScoped`/`@Dependent` CDI bean that
+reads `request.getServerName()/getServerPort()` at request time —
+`app-openid`'s `OpenIdConfig.getProviderURI()` is the reference.
+
+### 3. Pre-register every slot when an external service validates redirect URIs
+
+When a third-party server (e.g. Mitre OP) validates redirect URIs against a
+fixed allowlist, register one entry per *possible* slot. The openid-client
+deployment may end up on slot 1, 2, … N, and Mitre rejects any redirect URI
+not pre-registered. `app-openid2`/`app-openid3`'s antrun loops slot
+1..`${session.request.degreeOfConcurrency}` into `clients.sql` using the
+pool's `adminBase` + `portStride` — that property is Maven's `-TN` value
+(defaults to 1) and is also the upper bound on how far the pool can grow,
+since each Maven thread leases at most one slot at a time.
+
+### 4. Wipe Tomcat `work/` before startup
+
+If a module starts its own Tomcat in pre-integration-test, add
+`<delete dir="${tomcat.dir}/work" quiet="true"/>` to the antrun *before*
+`startup.sh`. Tomcat's `StandardManager` persists HTTP sessions to
+`work/Catalina/localhost/<webapp>/SESSIONS.ser` on shutdown and rehydrates
+them at startup; without the wipe, a re-run without `mvn clean` resurrects
+the previous run's sessions and can skip flows the test depends on (e.g.
+the OpenID consent page).
+
+### 5. Don't race on shared paths in a `<plugins>` execution
+
+Anything inheritable that writes to `${maven.multiModuleProjectDirectory}/…`
+runs once per module under `-T` and races. The parent's source-staging step
+uses a `mkdir`-based lock + marker file inside an `antrun` so first-acquirer
+does the work and others fast-exit; copy that pattern for any new shared
+preparation. Plain `maven-dependency-plugin:unpack` into a shared directory
+is NOT thread-safe for the first-extraction window even with markers.
+
 ## Running the TCK in Docker
 
 (needs updating to recent versions)
diff --git a/tck/app-ldap2/src/main/java/ee/jakarta/tck/security/test/LdapSetup.java b/tck/app-ldap2/src/main/java/ee/jakarta/tck/security/test/LdapSetup.java
index 29078e1b..a6f4c65d 100644
--- a/tck/app-ldap2/src/main/java/ee/jakarta/tck/security/test/LdapSetup.java
+++ b/tck/app-ldap2/src/main/java/ee/jakarta/tck/security/test/LdapSetup.java
@@ -28,7 +28,7 @@
 import jakarta.ejb.Startup;
 
 /**
- * Starts up the embedded Unboundid LDAP server on port 33389 and loads a test directory
+ * Starts up the embedded Unboundid LDAP server on port 33390 and loads a test directory
  * into it containing the same caller- and roles names as the Database and Embedded idenity
  * stores are using.
  *
@@ -45,7 +45,7 @@ public void init() {
         try {
             InMemoryDirectoryServerConfig config = new InMemoryDirectoryServerConfig("dc=net");
             config.setListenerConfigs(
-                    new InMemoryListenerConfig("myListener", null, 33389, null, null, null));
+                    new InMemoryListenerConfig("myListener", null, 33390, null, null, null));
 
             directoryServer = new InMemoryDirectoryServer(config);
 
diff --git a/tck/app-ldap2/src/main/java/ee/jakarta/tck/security/test/Servlet.java b/tck/app-ldap2/src/main/java/ee/jakarta/tck/security/test/Servlet.java
index 8a77f87e..c13c6627 100644
--- a/tck/app-ldap2/src/main/java/ee/jakarta/tck/security/test/Servlet.java
+++ b/tck/app-ldap2/src/main/java/ee/jakarta/tck/security/test/Servlet.java
@@ -30,7 +30,7 @@
  * this caller is in any of the roles {foo, bar, kaz}
  */
 @LdapIdentityStoreDefinition(
-    url = "ldap://localhost:33389/",
+    url = "ldap://localhost:33390/",
     bindDn = "uid=ldap,ou=apps,dc=jsr375,dc=net",
     bindDnPassword = "changeOnInstall",
     callerSearchBase = "dc=jsr375,dc=net",
diff --git a/tck/app-ldap3/src/main/java/ee/jakarta/tck/security/test/LdapSetup.java b/tck/app-ldap3/src/main/java/ee/jakarta/tck/security/test/LdapSetup.java
index 29078e1b..8deb8940 100644
--- a/tck/app-ldap3/src/main/java/ee/jakarta/tck/security/test/LdapSetup.java
+++ b/tck/app-ldap3/src/main/java/ee/jakarta/tck/security/test/LdapSetup.java
@@ -28,7 +28,7 @@
 import jakarta.ejb.Startup;
 
 /**
- * Starts up the embedded Unboundid LDAP server on port 33389 and loads a test directory
+ * Starts up the embedded Unboundid LDAP server on port 33391 and loads a test directory
  * into it containing the same caller- and roles names as the Database and Embedded idenity
  * stores are using.
  *
@@ -45,7 +45,7 @@ public void init() {
         try {
             InMemoryDirectoryServerConfig config = new InMemoryDirectoryServerConfig("dc=net");
             config.setListenerConfigs(
-                    new InMemoryListenerConfig("myListener", null, 33389, null, null, null));
+                    new InMemoryListenerConfig("myListener", null, 33391, null, null, null));
 
             directoryServer = new InMemoryDirectoryServer(config);
 
diff --git a/tck/app-ldap3/src/main/java/ee/jakarta/tck/security/test/Servlet.java b/tck/app-ldap3/src/main/java/ee/jakarta/tck/security/test/Servlet.java
index efc7571c..f7540ddf 100644
--- a/tck/app-ldap3/src/main/java/ee/jakarta/tck/security/test/Servlet.java
+++ b/tck/app-ldap3/src/main/java/ee/jakarta/tck/security/test/Servlet.java
@@ -30,7 +30,7 @@
  * this caller is in any of the roles {foo, bar, kaz}
  */
 @LdapIdentityStoreDefinition(
-    url = "ldap://localhost:33389/",
+    url = "ldap://localhost:33391/",
     bindDn = "uid=ldap,ou=apps,dc=jsr375,dc=net",
     bindDnPassword = "changeOnInstall",
     callerSearchBase = "dc=jsr375,dc=net",
diff --git a/tck/app-openid/src/main/java/ee/jakarta/tck/security/test/client/defaulttests/OpenIdConfig.java b/tck/app-openid/src/main/java/ee/jakarta/tck/security/test/client/defaulttests/OpenIdConfig.java
index b7616568..a5d2ecab 100644
--- a/tck/app-openid/src/main/java/ee/jakarta/tck/security/test/client/defaulttests/OpenIdConfig.java
+++ b/tck/app-openid/src/main/java/ee/jakarta/tck/security/test/client/defaulttests/OpenIdConfig.java
@@ -22,7 +22,9 @@
 
 import jakarta.annotation.PostConstruct;
 import jakarta.enterprise.context.Dependent;
+import jakarta.inject.Inject;
 import jakarta.inject.Named;
+import jakarta.servlet.http.HttpServletRequest;
 
 @Named
 @Dependent
@@ -35,6 +37,9 @@ public class OpenIdConfig {
 
     private Properties config;
 
+    @Inject
+    private HttpServletRequest request;
+
     @PostConstruct
     public void init() {
         config = new Properties();
@@ -71,4 +76,14 @@ public String getClientSecret() {
 
         return OidcProvider.CLIENT_SECRET_VALUE;
     }
+
+    /**
+     * Provider URI computed from the live request's host:port so the test runs
+     * against whatever HTTP listener the GlassFish slot has bound (the dist's
+     * default 8080, the pool's 14849, etc.) without recompiling.
+     */
+    public String getProviderURI() {
+        return "http://" + request.getServerName() + ":" + request.getServerPort()
+                + "/openid-server/webresources/oidc-provider-demo";
+    }
 }
diff --git a/tck/app-openid/src/main/java/ee/jakarta/tck/security/test/client/defaulttests/SecuredServlet.java b/tck/app-openid/src/main/java/ee/jakarta/tck/security/test/client/defaulttests/SecuredServlet.java
index 046953f4..10919f02 100644
--- a/tck/app-openid/src/main/java/ee/jakarta/tck/security/test/client/defaulttests/SecuredServlet.java
+++ b/tck/app-openid/src/main/java/ee/jakarta/tck/security/test/client/defaulttests/SecuredServlet.java
@@ -37,7 +37,7 @@
  */
 @WebServlet("/Secured")
 @OpenIdAuthenticationMechanismDefinition(
-    providerURI = "http://localhost:8080/openid-server/webresources/oidc-provider-demo",
+    providerURI = "${openIdConfig.providerURI}",
     clientId = CLIENT_ID_VALUE,
     clientSecret = CLIENT_SECRET_VALUE,
     redirectURI = "${baseURL}/Callback")
diff --git a/tck/app-openid/src/main/java/ee/jakarta/tck/security/test/client/defaulttests/SecuredServletWithEL.java b/tck/app-openid/src/main/java/ee/jakarta/tck/security/test/client/defaulttests/SecuredServletWithEL.java
index a72f3f29..e9c7046d 100644
--- a/tck/app-openid/src/main/java/ee/jakarta/tck/security/test/client/defaulttests/SecuredServletWithEL.java
+++ b/tck/app-openid/src/main/java/ee/jakarta/tck/security/test/client/defaulttests/SecuredServletWithEL.java
@@ -34,7 +34,7 @@
  */
 @WebServlet("/Secured")
 @OpenIdAuthenticationMechanismDefinition(
-        providerURI = "http://localhost:8080/openid-server/webresources/oidc-provider-demo",
+        providerURI = "${openIdConfig.providerURI}",
         clientId = "${openIdConfig.clientId}",
         clientSecret = "${openIdConfig.clientSecret}",
         redirectURI = "${openIdConfig.redirectURI}")
diff --git a/tck/app-openid/src/main/java/ee/jakarta/tck/security/test/server/OidcProvider.java b/tck/app-openid/src/main/java/ee/jakarta/tck/security/test/server/OidcProvider.java
index e765c295..2221bd87 100644
--- a/tck/app-openid/src/main/java/ee/jakarta/tck/security/test/server/OidcProvider.java
+++ b/tck/app-openid/src/main/java/ee/jakarta/tck/security/test/server/OidcProvider.java
@@ -73,9 +73,11 @@
 import jakarta.ws.rs.PathParam;
 import jakarta.ws.rs.Produces;
 import jakarta.ws.rs.QueryParam;
+import jakarta.ws.rs.core.Context;
 import jakarta.ws.rs.core.MediaType;
 import jakarta.ws.rs.core.Response;
 import jakarta.ws.rs.core.Response.ResponseBuilder;
+import jakarta.ws.rs.core.UriInfo;
 
 /**
  * @author Gaurav Gupta
@@ -97,6 +99,18 @@ public class OidcProvider {
 
     private static final String HTTPS_HOST = "https://localhost:";
 
+    /**
+     * Hardcoded base URL inside the static openid-configuration.json template
+     * and the JWT issuer claim. Rewritten at request time to {@link #issuer()}
+     * so the metadata and tokens match whatever HTTP listener GlassFish is
+     * actually bound to (the dist's default 8080, the pool's 14849, etc.).
+     */
+    private static final String TEMPLATE_BASE_URL =
+            "http://localhost:8080/openid-server/webresources/oidc-provider-demo";
+
+    @Context
+    private UriInfo uriInfo;
+
     private static String nonce;
 
     boolean rolesInUserInfoEndpoint;
@@ -133,21 +147,20 @@ public Response getConfiguration() {
             }
         } catch (IOException ex) {}
 
-        if (oidcProviderHttpsPort != null && !oidcProviderHttpsPort.isEmpty()) {
-            String httpsHostAndPort = HTTPS_HOST + oidcProviderHttpsPort;
-            result = useHttpsHostAndPort(result, "http://localhost:8080/openid-server/webresources/oidc-provider-demo/auth", httpsHostAndPort);
-            result = useHttpsHostAndPort(result, "http://localhost:8080/openid-server/webresources/oidc-provider-demo/token", httpsHostAndPort);
-            result = useHttpsHostAndPort(result, "http://localhost:8080/openid-server/webresources/oidc-provider-demo/userinfo", httpsHostAndPort);
-            result = useHttpsHostAndPort(result, "http://localhost:8080/openid-server/webresources/oidc-provider-demo/revoke", httpsHostAndPort);
-            result = useHttpsHostAndPort(result, "http://localhost:8080/openid-server/webresources/oidc-provider-demo/certs", httpsHostAndPort);
-        }
+        // Rewrite every TEMPLATE_BASE_URL/<path> in the metadata to either the live
+        // HTTPS host:port (when configured) or the live HTTP base. Done in one pass
+        // so the issuer URL also tracks the live request.
+        String liveBase = (oidcProviderHttpsPort != null && !oidcProviderHttpsPort.isEmpty())
+                ? HTTPS_HOST + oidcProviderHttpsPort + "/openid-server/webresources/oidc-provider-demo"
+                : issuer();
+        result = result.replace(TEMPLATE_BASE_URL, liveBase);
 
         return Response.ok(result).header("Access-Control-Allow-Origin", "*").build();
     }
 
-    private String useHttpsHostAndPort(String result, String endpoint, String httpsHostAndPort) {
-        String path = endpoint.substring(21);
-        return result.replace(endpoint, httpsHostAndPort + path);
+    /** Live request's base URL for this resource — used as both metadata issuer and JWT iss claim. */
+    private String issuer() {
+        return uriInfo.getBaseUriBuilder().path("oidc-provider-demo").build().toString();
     }
 
     @GET
@@ -209,7 +222,7 @@ public Response tokenEndpoint(
                     .build();
 
             JWTClaimsSet.Builder jwtClaimsBuilder = new JWTClaimsSet.Builder()
-                    .issuer("http://localhost:8080/openid-server/webresources/oidc-provider-demo")
+                    .issuer(issuer())
                     .subject(getSubject())
                     .audience(List.of(CLIENT_ID_VALUE))
                     .expirationTime(new Date(now.getTime() + 1000 * 60 * 10))
diff --git a/tck/app-openid/src/test/java/ee/jakarta/tck/security/test/OpenIdTestUtil.java b/tck/app-openid/src/test/java/ee/jakarta/tck/security/test/OpenIdTestUtil.java
index 939f549d..aa6f6e06 100644
--- a/tck/app-openid/src/test/java/ee/jakarta/tck/security/test/OpenIdTestUtil.java
+++ b/tck/app-openid/src/test/java/ee/jakarta/tck/security/test/OpenIdTestUtil.java
@@ -34,6 +34,7 @@
 import ee.jakarta.tck.security.test.client.CallbackServlet;
 import ee.jakarta.tck.security.test.client.UnsecuredServlet;
 import ee.jakarta.tck.security.test.client.UserNameServlet;
+import ee.jakarta.tck.security.test.client.defaulttests.OpenIdConfig;
 import ee.jakarta.tck.security.test.server.ApplicationConfig;
 import ee.jakarta.tck.security.test.server.OidcProvider;
 
@@ -81,6 +82,9 @@ public static WebArchive createClientDeployment(Class<?>... additionalClasses) {
                 .addClass(CallbackServlet.class)
                 .addClass(UnsecuredServlet.class)
                 .addClass(UserNameServlet.class)
+                // OpenIdConfig is the @Named CDI bean now backing every Secured*
+                // servlet's providerURI EL expression — needed by all client deployments.
+                .addClass(OpenIdConfig.class)
                 .addClasses(additionalClasses)
                 .addAsWebInfResource("beans.xml");
 
diff --git a/tck/app-openid2/pom.xml b/tck/app-openid2/pom.xml
index a07ade7a..9293a7bf 100644
--- a/tck/app-openid2/pom.xml
+++ b/tck/app-openid2/pom.xml
@@ -132,15 +132,30 @@
                                 <replace token="http://localhost:8080" value="https://localhost:8443" dir="${tomcat.dir}/webapps/openid-connect-server-webapp/WEB-INF" summary="yes">
                                     <include name="server-config.xml" />
                                 </replace>
-                                <replace token="http://localhost/" value="http://localhost:8080/openid-client/Callback" dir="${tomcat.dir}/webapps/openid-connect-server-webapp/WEB-INF/classes/db/hsql" summary="yes">
-                                    <include name="clients.sql" />
-                                </replace>
+                                <!-- 
+									 Register the openid-client Callback URL for every slot the
+                                     pool may grow to (= ${maven.degreeOfConcurrency}, ie -TN).
+                                     Mitre rejects redirect_uris not pre-registered, and the
+                                     openid-client may land on any leased slot. Slot N's HTTP
+                                     port = adminBase + (N-1)*portStride + 1.
+                                -->
+                                <exec executable="bash" failonerror="true">
+                                    <arg value="-c"/>
+                                    <arg value="set -e; F='${tomcat.dir}/webapps/openid-connect-server-webapp/WEB-INF/classes/db/hsql/clients.sql'; awk -v base=${gf.pool.adminBase} -v stride=${gf.pool.portStride} -v slots=${maven.degreeOfConcurrency} -v marker=&quot;'http://localhost/'&quot; 'index($0, marker) { for (i=1; i&lt;=slots; i++) { port = base + (i-1)*stride + 1; printf &quot;\t(%cclient%c, %chttp://localhost:%d/openid-client/Callback%c),\n&quot;, 39, 39, 39, port, 39 } next } { print }' &quot;$F&quot; &gt; &quot;${F}.new&quot; &amp;&amp; mv &quot;${F}.new&quot; &quot;$F&quot;"/>
+                                </exec>
                                 
                                 <copy file="server.xml" todir="${tomcat.dir}/conf" verbose="true" overwrite="true" force="true"/>
                                 <copy file="localhost-rsa.jks" todir="${tomcat.dir}/conf" verbose="true"/>
 
                                 <chmod dir="${tomcat.dir}/bin" perm="ugo+rx" includes="*" />
 
+                                <!--
+									 Drop Tomcat's persisted SESSIONS.ser so a re-run without
+                                     `mvn clean` doesn't resurrect Mitre's "client already
+                                     authorized" session and skip the consent page.
+                                -->
+                                <delete dir="${tomcat.dir}/work" quiet="true"/>
+
                                 <exec executable="${tomcat.dir}/bin/startup.sh" dir="${tomcat.dir}" >
                                     <env key="CATALINA_PID" value="${tomcat.pidfile}" />
                                 </exec>
@@ -172,42 +187,8 @@
                     </execution>
                 </executions>
             </plugin>
-            <plugin>
-                <groupId>org.codehaus.mojo</groupId>
-                <artifactId>keytool-maven-plugin</artifactId>
-                <version>2.0.2</version>
-                <executions>
-                    <execution>
-                        <id>import-tomcat-cert</id>
-                        <phase>pre-integration-test</phase>
-                        <goals>
-                            <goal>importCertificate</goal>
-                        </goals>
-                        <configuration>
-                            <file>${project.basedir}/tomcat.cert</file>
-                            <alias>tomcat</alias>
-                            <keystore>${trustStore.path}</keystore>
-                            <storepass>${trustStore.password}</storepass>
-                            <noprompt>true</noprompt>
-                            <trustcacerts>true</trustcacerts>
-                            <verbose>true</verbose>
-                        </configuration>
-                    </execution>
-                    <execution>
-                        <id>delete-tomcat-cert</id>
-                        <phase>post-integration-test</phase>
-                        <goals>
-                            <goal>deleteAlias</goal>
-                        </goals>
-                        <configuration>
-                            <alias>tomcat</alias>
-                            <keystore>${trustStore.path}</keystore>
-                            <storepass>${trustStore.password}</storepass>
-                            <verbose>true</verbose>
-                        </configuration>
-                    </execution>
-                </executions>
-            </plugin>
+
+            <!-- NOTE: Tomcat cert import lives in the parent pom (must run before pool:up clones the source GF). -->
         </plugins>
 
         <pluginManagement>
diff --git a/tck/app-openid3/localhost-rsa.jks b/tck/app-openid3/localhost-rsa.jks
index f5226568..0cb11e0a 100644
Binary files a/tck/app-openid3/localhost-rsa.jks and b/tck/app-openid3/localhost-rsa.jks differ
diff --git a/tck/app-openid3/pom.xml b/tck/app-openid3/pom.xml
index 6da44468..85df9c8a 100644
--- a/tck/app-openid3/pom.xml
+++ b/tck/app-openid3/pom.xml
@@ -124,18 +124,33 @@
                             <target>
                                 <echo level="info">Replacing in ${tomcat.dir}</echo>
 
-                                <replace token="http://localhost:8080" value="https://localhost:8443" dir="${tomcat.dir}/webapps/openid-connect-server-webapp/WEB-INF" summary="yes">
+                                <replace token="http://localhost:8080" value="https://localhost:8444" dir="${tomcat.dir}/webapps/openid-connect-server-webapp/WEB-INF" summary="yes">
                                     <include name="server-config.xml" />
                                 </replace>
-                                <replace token="http://localhost/" value="http://localhost:8080/openid-client/Callback" dir="${tomcat.dir}/webapps/openid-connect-server-webapp/WEB-INF/classes/db/hsql" summary="yes">
-                                    <include name="clients.sql" />
-                                </replace>
+                                <!--
+									 Register the openid-client Callback URL for every slot the
+                                     pool may grow to (= ${maven.degreeOfConcurrency}, ie -TN).
+                                     Mitre rejects redirect_uris not pre-registered, and the
+                                     openid-client may land on any leased slot. Slot N's HTTP
+                                     port = adminBase + (N-1)*portStride + 1.
+                                -->
+                                <exec executable="bash" failonerror="true">
+                                    <arg value="-c"/>
+                                    <arg value="set -e; F='${tomcat.dir}/webapps/openid-connect-server-webapp/WEB-INF/classes/db/hsql/clients.sql'; awk -v base=${gf.pool.adminBase} -v stride=${gf.pool.portStride} -v slots=${maven.degreeOfConcurrency} -v marker=&quot;'http://localhost/'&quot; 'index($0, marker) { for (i=1; i&lt;=slots; i++) { port = base + (i-1)*stride + 1; printf &quot;\t(%cclient%c, %chttp://localhost:%d/openid-client/Callback%c),\n&quot;, 39, 39, 39, port, 39 } next } { print }' &quot;$F&quot; &gt; &quot;${F}.new&quot; &amp;&amp; mv &quot;${F}.new&quot; &quot;$F&quot;"/>
+                                </exec>
                                 
                                 <copy file="server.xml" todir="${tomcat.dir}/conf" verbose="true" overwrite="true" force="true" />
                                 <copy file="localhost-rsa.jks" todir="${tomcat.dir}/conf" verbose="true" />
 
                                 <chmod dir="${tomcat.dir}/bin" perm="ugo+rx" includes="*" />
 
+                                <!--
+									 Drop Tomcat's persisted SESSIONS.ser so a re-run without
+                                     `mvn clean` doesn't resurrect Mitre's "client already
+                                     authorized" session and skip the consent page.
+                                -->
+                                <delete dir="${tomcat.dir}/work" quiet="true"/>
+
                                 <exec executable="${tomcat.dir}/bin/startup.sh" dir="${tomcat.dir}" >
                                     <env key="CATALINA_PID" value="${tomcat.pidfile}" />
                                 </exec>
@@ -167,42 +182,8 @@
                     </execution>
                 </executions>
             </plugin>
-            <plugin>
-                <groupId>org.codehaus.mojo</groupId>
-                <artifactId>keytool-maven-plugin</artifactId>
-                <version>2.0.2</version>
-                <executions>
-                    <execution>
-                        <id>import-tomcat-cert</id>
-                        <phase>pre-integration-test</phase>
-                        <goals>
-                            <goal>importCertificate</goal>
-                        </goals>
-                        <configuration>
-                            <file>${project.basedir}/tomcat.cert</file>
-                            <alias>tomcat</alias>
-                            <keystore>${trustStore.path}</keystore>
-                            <storepass>${trustStore.password}</storepass>
-                            <noprompt>true</noprompt>
-                            <trustcacerts>true</trustcacerts>
-                            <verbose>true</verbose>
-                        </configuration>
-                    </execution>
-                    <execution>
-                        <id>delete-tomcat-cert</id>
-                        <phase>post-integration-test</phase>
-                        <goals>
-                            <goal>deleteAlias</goal>
-                        </goals>
-                        <configuration>
-                            <alias>tomcat</alias>
-                            <keystore>${trustStore.path}</keystore>
-                            <storepass>${trustStore.password}</storepass>
-                            <verbose>true</verbose>
-                        </configuration>
-                    </execution>
-                </executions>
-            </plugin>
+
+            <!-- NOTE: Tomcat cert import lives in the parent pom (must run before pool:up clones the source GF). -->
         </plugins>
 
         <pluginManagement>
diff --git a/tck/app-openid3/server.xml b/tck/app-openid3/server.xml
index 43188665..e3cff4ab 100644
--- a/tck/app-openid3/server.xml
+++ b/tck/app-openid3/server.xml
@@ -15,7 +15,7 @@
 
 -->
 
-<Server port="8005" shutdown="SHUTDOWN">
+<Server port="8006" shutdown="SHUTDOWN">
 
     <Listener className="org.apache.catalina.startup.VersionLoggerListener" />
     <Listener className="org.apache.catalina.core.AprLifecycleListener" />
@@ -32,7 +32,7 @@
   </GlobalNamingResources>
 
     <Service name="Catalina">
-        <Connector port="8443"
+        <Connector port="8444"
             protocol="org.apache.coyote.http11.Http11NioProtocol"
             maxThreads="150" SSLEnabled="true">
             <SSLHostConfig>
diff --git a/tck/app-openid3/src/main/java/ee/jakarta/tck/security/test/ProtectedServlet.java b/tck/app-openid3/src/main/java/ee/jakarta/tck/security/test/ProtectedServlet.java
index eac9bb24..eb40857c 100644
--- a/tck/app-openid3/src/main/java/ee/jakarta/tck/security/test/ProtectedServlet.java
+++ b/tck/app-openid3/src/main/java/ee/jakarta/tck/security/test/ProtectedServlet.java
@@ -38,7 +38,7 @@
 
     // The Mitre "openid-connect-server-webapp" provider that we deploy via pom.xml
     // The OpenId authentication mechanism directs us to here when logging in.
-    providerURI =  "https://localhost:8443/openid-connect-server-webapp",
+    providerURI =  "https://localhost:8444/openid-connect-server-webapp",
 
     // The ID of default client provided by Mitre.
     // See openid-connect-server-webapp/WEB-INF/classes/db/hsql/clients.sql:
diff --git a/tck/app-openid3/tomcat.cert b/tck/app-openid3/tomcat.cert
index 34ecbe05..8c336d34 100644
--- a/tck/app-openid3/tomcat.cert
+++ b/tck/app-openid3/tomcat.cert
@@ -1,21 +1,21 @@
 -----BEGIN CERTIFICATE-----
-MIIDeTCCAmGgAwIBAgIIcK6YkkSkzCwwDQYJKoZIhvcNAQELBQAwazELMAkGA1UE
+MIIDeTCCAmGgAwIBAgIIA7nA+YhYdgswDQYJKoZIhvcNAQELBQAwazELMAkGA1UE
 BhMCbmwxEDAOBgNVBAgTB2hvbGxhbmQxEjAQBgNVBAcTCWFtc3RlcmRhbTEQMA4G
 A1UEChMHZWNsaXBzZTEQMA4GA1UECxMHamFrYXJ0YTESMBAGA1UEAxMJbG9jYWxo
-b3N0MB4XDTIyMTIwOTIyMjM1OVoXDTIzMDMwOTIyMjM1OVowazELMAkGA1UEBhMC
+b3N0MB4XDTI1MDgwNjE1NTYzOVoXDTM1MDgwNDE1NTYzOVowazELMAkGA1UEBhMC
 bmwxEDAOBgNVBAgTB2hvbGxhbmQxEjAQBgNVBAcTCWFtc3RlcmRhbTEQMA4GA1UE
 ChMHZWNsaXBzZTEQMA4GA1UECxMHamFrYXJ0YTESMBAGA1UEAxMJbG9jYWxob3N0
-MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyVui1k3XIof7ub0zn8VW
-TRkRHK0cgbPLKRiyv/K4kFANWfsAil8jAkFEMkzCOsAtEGSkb5VtXZPXFKNxqLms
-F4SXZf6BlthVm4Llk/HrBjR1AA4WoRe6GmOtAvJkPzHC18ysQiGT+lODh4Rk3tDn
-R845ACw1dwMXsU1Vku58tbrllqfTFmrLzuOgTMn72RZS4WShvSW9Q2oPzMvX8+xl
-lU6XP0Sg+zfujVj8HVjZWqjbRmhp8AN1tdBKd6tQ97f3cwdHr7NzTaHwEYdu9iSy
-7PXvCsfjcZW03f7urCvVcti7gdqxHpWJxUGZsaah0E+jfdXZ56vHvifKibIlxPwL
-4wIDAQABoyEwHzAdBgNVHQ4EFgQUJOd5/soSTVLtSKFd76h9Aax/qUAwDQYJKoZI
-hvcNAQELBQADggEBAJJNB1Z/wEZh5tP4cPBNxqrvRqhwyTBoQVOfMz44ws16Ephm
-BxquCim/vX/XstbRlxPgV4RUS1UWrvdJYrbZq5b+TNOfEn+Dz1yZ9VTlp1cbGHKG
-a8IcjuQnXxEQYUfA1DeD5uEVoZsOUCw/BU/1pDFVsvxlsGnKvU3q7MD9OyM5Tqz/
-ImKmFTxH1qf9D0lFZj8qzhBONBXh+eEeq64NFNouGr9ya7V8FH2tKmeSXTnSuK/z
-b+VxkfKwogO++JFYoNSifhpKzzPInK9qUsX4xfTLBF2K7THkBbm99wsw8jp4lkd8
-mLifgwyUQJ0zEP7OOkzVSh8/V5gt/N5IcvFFvLk=
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAoeMV3BN5XH8XtL4uUuS9
+cRoyfa9hAruDiZlV7X+5atdONZV45IQrz/TpS/a07bPG9iRaqA8i4PSGroADBpuP
+9YtPzqZvGc+OBsISiTW9X6GddC3YHGbfrIcDVx37mbSIXn1NZbpz1FZD8nYOHQEn
+WKwgNcLKHbnMST/Wm8Q9LYjQjWV0Fjg5DEgTi6IDoZV3rTTaiHnxQ+FXy90NmIv/
+fnxtBSDQJ6mEmHDomF4IqFSstM+jQqOpx935q5SuRM9tews+SXjVFg0U8KxcAq9Y
+UZcpTUpWv5DPA7NUkTNAEwGpDhZdCRbMQ+0NrCeesKtT3prBle8u84qn2KgQDkMp
+ywIDAQABoyEwHzAdBgNVHQ4EFgQUlNlERDXVaatRCss/2aSwyEXoc1QwDQYJKoZI
+hvcNAQELBQADggEBAB67LkMg8wIjMaqcjb7QPomkpLp8MDYxwHQrp6pIeJfzqNBQ
+J7TKL4/08LRTShLjYDPUXZ5km9eEBmoTX+wGzw1Lla7mPn7OS+jWbUlMGAVUMJ9K
+vfz7DdRLuFn44kJGJG7Tgan/3mYXwoAKNn9hRuUTRy4gDAecFQkHzAWNCWCQK/eP
+6ZpAWu0sj5vEMmrBlwbUTIUfuAGt55G5g/JWNL6YKXftys6FtawwgpZxxpV/BLMH
+cYW7s5Q6s0rZKvG5fcXsO4T3btw9Eq0U+Ul1DFHXbLOI8r5tSDabZLNIxrqKkrT/
+5Fs8NE6j63mbBfrHGN5MS4mjFh+MqklHotGitp8=
 -----END CERTIFICATE-----
diff --git a/tck/common/src/main/resources/arquillian.xml b/tck/common/src/main/resources/arquillian.xml
index 0c4517c7..b4e728a3 100644
--- a/tck/common/src/main/resources/arquillian.xml
+++ b/tck/common/src/main/resources/arquillian.xml
@@ -22,6 +22,19 @@
 
     <defaultProtocol type="Servlet 3.0"/>
 
+    <!--
+        Pool container. Leases one of the pre-warmed GlassFish slots provisioned
+        by glassfish-pool-maven-plugin. The slot's adminPort/httpPort/etc. are
+        filled in at start() time from the slot's published ports.properties; the
+        only required configuration is poolDir, which is forwarded to the test
+        JVM as the gf.pool.dir system property by the glassfish-ci-managed profile.
+    -->
+    <container qualifier="glassfish-pool" default="true">
+        <configuration>
+            <property name="poolDir">${gf.pool.dir}</property>
+        </configuration>
+    </container>
+
     <container qualifier="liberty">
         <configuration>
             <property name="deployType">xml</property>
diff --git a/tck/pom.xml b/tck/pom.xml
index 8b49f045..bed6cb73 100644
--- a/tck/pom.xml
+++ b/tck/pom.xml
@@ -192,7 +192,30 @@
         <licenseFile>${project.basedir}/LICENSE_EFTL.md</licenseFile>
         <security-api.version>5.0.0-SNAPSHOT</security-api.version>
         <arquillian.version>1.10.1.Final</arquillian.version>
-        
+
+        <!-- GlassFish + arquillian-glassfish-server-pool wiring (used by glassfish-ci-managed) -->
+        <glassfish.version>9.0.0-SNAPSHOT</glassfish.version>
+        <glassfish.arquillian.version>2.2.0-SNAPSHOT</glassfish.arquillian.version>
+        <security.api.update>false</security.api.update>
+        <soteria.update>false</soteria.update>
+        <soteria.version>5.0.0</soteria.version>
+
+        <!-- GlassFish pool layout -->
+        <gf.pool.size>1</gf.pool.size>
+        <gf.pool.dir>${maven.multiModuleProjectDirectory}/target/pool</gf.pool.dir>
+        <gf.pool.dist>${maven.multiModuleProjectDirectory}/target/dist</gf.pool.dist>
+        <gf.pool.source>${gf.pool.dist}/glassfish9</gf.pool.source>
+        <gf.pool.adminBase>14848</gf.pool.adminBase>
+        <gf.pool.portStride>100</gf.pool.portStride>
+        <!--
+			 Source-staging is owned by the parent's antrun below (so it can also import
+             the Mitre cert into cacerts.p12 before the slot clone). GF caches the default
+             SSLContext on first SSL use, so the cert MUST be in the truststore at GF
+             startup; pool-plugin's unpack would happen too late, hence we do it manually.
+        -->
+        <gf.pool.unpack.skip>true</gf.pool.unpack.skip>
+        <gf.pool.restartOnRelease>false</gf.pool.restartOnRelease>
+
         <buildDirectory>${project.basedir}/target</buildDirectory>
 
         <!-- Used for OpenID testing with Mitre -->
@@ -400,6 +423,49 @@
                     <artifactId>maven-site-plugin</artifactId>
                     <version>3.21.0</version>
                 </plugin>
+                <plugin>
+                    <groupId>ee.omnifish.arquillian</groupId>
+                    <artifactId>glassfish-pool-maven-plugin</artifactId>
+                    <version>${glassfish.arquillian.version}</version>
+                    <configuration>
+                        <poolDir>${gf.pool.dir}</poolDir>
+                        <poolSource>${gf.pool.source}</poolSource>
+                        <poolSize>${gf.pool.size}</poolSize>
+                        <adminPortBase>${gf.pool.adminBase}</adminPortBase>
+                        <portStride>${gf.pool.portStride}</portStride>
+                        <stageDir>${gf.pool.dist}</stageDir>
+                        <unpackSkip>${gf.pool.unpack.skip}</unpackSkip>
+                        <distribution>
+                            <groupId>org.glassfish.main.distributions</groupId>
+                            <artifactId>glassfish</artifactId>
+                            <version>${glassfish.version}</version>
+                            <type>zip</type>
+                        </distribution>
+                        <overlays>
+                            <overlay>
+                                <groupId>jakarta.security.enterprise</groupId>
+                                <artifactId>jakarta.security.enterprise-api</artifactId>
+                                <version>${security-api.version}</version>
+                                <destFileName>jakarta.security-api.jar</destFileName>
+                                <skip>${security.api.noupdate}</skip>
+                            </overlay>
+                            <overlay>
+                                <groupId>org.glassfish.soteria</groupId>
+                                <artifactId>soteria</artifactId>
+                                <version>${soteria.version}</version>
+                                <destFileName>soteria.jar</destFileName>
+                                <skip>${soteria.noupdate}</skip>
+                            </overlay>
+                            <overlay>
+                                <groupId>org.glassfish.soteria</groupId>
+                                <artifactId>soteria.spi.bean.decorator.weld</artifactId>
+                                <version>${soteria.version}</version>
+                                <destFileName>soteria.spi.bean.decorator.weld.jar</destFileName>
+                                <skip>${soteria.noupdate}</skip>
+                            </overlay>
+                        </overlays>
+                    </configuration>
+                </plugin>
             </plugins>
         </pluginManagement>
         <plugins>
@@ -457,6 +523,8 @@
                 <version>3.5.5</version>
                 <executions>
                     <execution>
+                        <id>aggregate-failsafe-report</id>
+                        <inherited>false</inherited>
                         <phase>post-integration-test</phase>
                         <goals>
                             <goal>failsafe-report-only</goal>
@@ -467,6 +535,26 @@
                     <aggregate>true</aggregate>
                 </configuration>
             </plugin>
+
+            <plugin>
+                <!-- Override the cyclonedx execution inherited from org.eclipse.ee4j:project's 'sbom' profile to run once at root. Skip with -DskipSBOM. -->
+                <groupId>org.cyclonedx</groupId>
+                <artifactId>cyclonedx-maven-plugin</artifactId>
+                <executions>
+                    <execution>
+                        <id>default</id>
+                        <phase>none</phase>
+                    </execution>
+                    <execution>
+                        <id>aggregate-bom-root</id>
+                        <inherited>false</inherited>
+                        <phase>verify</phase>
+                        <goals>
+                            <goal>makeAggregateBom</goal>
+                        </goals>
+                    </execution>
+                </executions>
+            </plugin>
         </plugins>
     </build>
 
@@ -496,24 +584,10 @@
             </activation>
 
             <properties>
-                <glassfish.version>9.0.0-SNAPSHOT</glassfish.version>
-                <glassfish.arquillian.version>2.1.3</glassfish.arquillian.version>
-                <glassfish.port>8080</glassfish.port>
-                <glassfish.dirName>glassfish9</glassfish.dirName>
-                <glassfish.root>${project.build.directory}</glassfish.root>
-                
-                <glassfish.home>${glassfish.root}/${glassfish.dirName}</glassfish.home>
-                <glassfish.javax.net.debug></glassfish.javax.net.debug>
-
-                <trustStore.suffix>p12</trustStore.suffix>
-                <trustStore.path>${glassfish.home}/glassfish/domains/domain1/config/cacerts.${trustStore.suffix}</trustStore.path>
+	            <trustStore.suffix>p12</trustStore.suffix>
+                <trustStore.path>${gf.pool.dir}/slot-1/glassfish/glassfish/domains/domain1/config/cacerts.${trustStore.suffix}</trustStore.path>
                 <trustStore.password>changeit</trustStore.password>
-                
-                <security.api.update>false</security.api.update>
-                
-                <soteria.update>false</soteria.update>
-                <soteria.version>5.0.0</soteria.version>
-                
+
                 <!--
                     Exact artefact used by GlassFish that holds the API classes. The actual API
                     jar in the GlassFish root folder is installed to these coordinates below.
@@ -533,7 +607,7 @@
                 </dependency>
                 <dependency>
                     <groupId>ee.omnifish.arquillian</groupId>
-                    <artifactId>arquillian-glassfish-server-managed</artifactId>
+                    <artifactId>arquillian-glassfish-server-pool</artifactId>
                     <version>${glassfish.arquillian.version}</version>
                     <scope>test</scope>
                 </dependency>
@@ -563,135 +637,115 @@
                                     </properties>
                                 </configuration>
                             </execution>
-                        </executions>
-                    </plugin>
-                    
-                    <plugin>
-                        <groupId>org.apache.maven.plugins</groupId>
-                        <artifactId>maven-dependency-plugin</artifactId>
-                        <executions>
+                            <!--
+								 Expose Maven's -TN value (default 1) as a top-level project
+                                 property so antrun's <exec> args can interpolate it; Maven
+                                 only resolves ${session.request.X} bean expressions when
+                                 reading typed Plexus parameters (like this <source> String).
+                            -->
                             <execution>
-                                <id>unpack</id>
-                                <phase>process-test-classes</phase>
-                                <goals>
-                                    <goal>unpack</goal>
-                                </goals>
-                                <configuration>
-                                    <skip>${skipITs}</skip>
-                                    <outputDirectory>${glassfish.root}</outputDirectory>
-                                    <markersDirectory>${glassfish.root}/dependency-maven-plugin-markers</markersDirectory>
-                                    <artifactItems>
-                                        <artifactItem>
-                                            <groupId>org.glassfish.main.distributions</groupId>
-                                            <artifactId>glassfish</artifactId>
-                                            <version>${glassfish.version}</version>
-                                            <type>zip</type>
-                                            <overWrite>true</overWrite>
-                                            <outputDirectory>${glassfish.root}</outputDirectory>
-                                        </artifactItem>
-                                    </artifactItems>
-                                </configuration>
-                            </execution>
-                            
-                            <!-- Optionally update Security API jar in GlassFish -->
-                            <execution>
-                                <id>update-security-api</id>
-                                <phase>process-test-classes</phase>
+                                <id>expose-degree-of-concurrency</id>
+                                <phase>initialize</phase>
                                 <goals>
-                                    <goal>copy</goal>
+                                    <goal>bsh-property</goal>
                                 </goals>
                                 <configuration>
-                                    <skip>${security.api.noupdate}</skip>
-                                    <artifactItems>
-                                        <artifactItem>
-                                            <groupId>jakarta.security.enterprise</groupId>
-                                            <artifactId>jakarta.security.enterprise-api</artifactId>
-                                            <version>${security-api.version}</version>
-                                            <type>jar</type>
-                                            <overWrite>true</overWrite>
-                                            <outputDirectory>${glassfish.root}/glassfish9/glassfish/modules</outputDirectory>
-                                            <destFileName>jakarta.security-api.jar</destFileName>
-                                        </artifactItem>
-                                    </artifactItems>
+                                    <source>
+                                        maven.degreeOfConcurrency = ${session.request.degreeOfConcurrency};
+                                    </source>
+                                    <properties>
+                                        <property>maven.degreeOfConcurrency</property>
+                                    </properties>
                                 </configuration>
                             </execution>
+                        </executions>
+                    </plugin>
 
-                            <!-- Optionally update Security IMPL (Soteria) jar in GlassFish -->
+                    <!--
+						 Resolve the GF dist into the local Maven repo so the antrun below
+                         can extract it. dependency:get's resolver is thread-safe under -T.
+                    -->
+                    <plugin>
+                        <groupId>org.apache.maven.plugins</groupId>
+                        <artifactId>maven-dependency-plugin</artifactId>
+                        <executions>
                             <execution>
-                                <id>update-security-impl</id>
-                                <phase>process-test-classes</phase>
-                                <goals>
-                                    <goal>copy</goal>
-                                </goals>
+                                <id>resolve-glassfish-dist</id>
+                                <phase>validate</phase>
+                                <goals><goal>get</goal></goals>
                                 <configuration>
-                                    <skip>${soteria.noupdate}</skip>
-                                    <artifactItems>
-                                        <artifactItem>
-                                            <groupId>org.glassfish.soteria</groupId>
-                                            <artifactId>soteria</artifactId>
-                                            <version>${soteria.version}</version>
-                                            <type>jar</type>
-                                            <overWrite>true</overWrite>
-                                            <outputDirectory>${glassfish.root}/glassfish9/glassfish/modules</outputDirectory>
-                                            <destFileName>soteria.jar</destFileName>
-                                        </artifactItem>
-                                        <artifactItem>
-                                            <groupId>org.glassfish.soteria</groupId>
-                                            <artifactId>soteria.spi.bean.decorator.weld</artifactId>
-                                            <version>${soteria.version}</version>
-                                            <type>jar</type>
-                                            <overWrite>true</overWrite>
-                                            <outputDirectory>${glassfish.root}/glassfish9/glassfish/modules</outputDirectory>
-                                            <destFileName>soteria.spi.bean.decorator.weld.jar</destFileName>
-                                        </artifactItem>
-                                    </artifactItems>
+                                    <artifact>org.glassfish.main.distributions:glassfish:${glassfish.version}:zip</artifact>
                                 </configuration>
                             </execution>
                         </executions>
                     </plugin>
+
+                    <!--
+						 Stage the source GF before pool:up clones slots: unzip the dist
+                         and import the Mitre cert into cacerts.p12. The cert must be in
+                         the truststore at GF startup since the default SSLContext is
+                         loaded once and never reloads from disk. Inherited because Maven
+                         -T schedules parent and children in parallel; the lock + marker
+                         make the work happen exactly once.
+                    -->
                     <plugin>
                         <groupId>org.apache.maven.plugins</groupId>
                         <artifactId>maven-antrun-plugin</artifactId>
                         <version>3.0.0</version>
                         <executions>
                             <execution>
-                                <id>set-port</id>
-                                <phase>pre-integration-test</phase>
-                                <goals>
-                                    <goal>run</goal>
-                                </goals>
+                                <id>prepare-source-glassfish</id>
+                                <phase>validate</phase>
+                                <goals><goal>run</goal></goals>
                                 <configuration>
-                                    <skip>${skipITs}</skip>
                                     <target>
-                                        <echo level="info">Replacing in ${glassfish.home}</echo>
-                                        <replace token="8080"
-                                            value="${glassfish.port}"
-                                            dir="${glassfish.home}/glassfish/domains/domain1/config/"
-                                            summary="yes">
-                                            <include name="domain.xml" />
-                                        </replace>
+                                        <exec executable="bash" failonerror="true">
+                                            <arg value="-c"/>
+                                            <arg value="set -e; mkdir -p '${gf.pool.dist}'; LOCK='${gf.pool.dist}/.staging.lock.d'; MARKER='${gf.pool.dist}/.staging.done'; while ! mkdir &quot;$LOCK&quot; 2&gt;/dev/null; do sleep 0.2; done; trap 'rmdir &quot;$LOCK&quot;' EXIT; if [ -f &quot;$MARKER&quot; ]; then exit 0; fi; ZIP='${settings.localRepository}/org/glassfish/main/distributions/glassfish/${glassfish.version}/glassfish-${glassfish.version}.zip'; cd '${gf.pool.dist}'; unzip -q -o &quot;$ZIP&quot;; K='${gf.pool.source}/glassfish/domains/domain1/config/cacerts.${trustStore.suffix}'; C='${maven.multiModuleProjectDirectory}/app-openid2/tomcat.cert'; keytool -importcert -keystore &quot;$K&quot; -storepass changeit -alias tomcat -file &quot;$C&quot; -noprompt -trustcacerts; touch &quot;$MARKER&quot;"/>
+                                        </exec>
                                     </target>
                                 </configuration>
                             </execution>
                         </executions>
                     </plugin>
-                    
+
+                    <plugin>
+                        <groupId>ee.omnifish.arquillian</groupId>
+                        <artifactId>glassfish-pool-maven-plugin</artifactId>
+                        <configuration>
+                            <systemProperties>
+                                javax.net.ssl.trustStorePassword=${trustStore.password}
+                            </systemProperties>
+                        </configuration>
+                        <executions>
+                            <execution>
+                                <id>pool-up</id>
+                                <phase>initialize</phase>
+                                <goals><goal>up</goal></goals>
+                            </execution>
+                        </executions>
+                    </plugin>
+
                     <!--
-                        Installs the jakarta.security.enterprise.jar from GF on the filesystem to the
-                        coordinates expected by the signature test.
+						 Install the jakarta.security.enterprise-api.jar from the pooled GF
+                         under the coordinates security-signaturetest declares. Aggregator
+                         goal: bind once at the root. security-signaturetest is the last
+                         reactor module, so the artifact is in the local repo by the time
+                         its dep resolution runs.
                     -->
                     <plugin>
                         <artifactId>maven-install-plugin</artifactId>
                         <version>3.1.4</version>
                         <executions>
                             <execution>
-                                <id>unpack</id>
-                                <phase>pre-integration-test</phase>
+                                <id>install-vendor-api</id>
+                                <inherited>false</inherited>
+                                <phase>initialize</phase>
                                 <goals>
                                     <goal>install-file</goal>
                                 </goals>
                                 <configuration>
-                                    <file>${glassfish.root}/glassfish9/glassfish/modules/jakarta.security.enterprise-api.jar</file>
+                                    <file>${gf.pool.source}/glassfish/modules/jakarta.security.enterprise-api.jar</file>
                                     <groupId>${sigtest.api.groupId}</groupId>
                                     <artifactId>${sigtest.api.artifactId}</artifactId>
                                     <version>${sigtest.api.version}</version>
@@ -700,19 +754,19 @@
                             </execution>
                         </executions>
                     </plugin>
-                    
+
                     <plugin>
                         <groupId>org.apache.maven.plugins</groupId>
                         <artifactId>maven-failsafe-plugin</artifactId>
                         <configuration>
                             <systemPropertyVariables>
-                                <glassfish.home>${glassfish.home}</glassfish.home>
+                                <gf.pool.dir>${gf.pool.dir}</gf.pool.dir>
+                                <gf.pool.source>${gf.pool.source}</gf.pool.source>
+                                <gf.pool.adminBase>${gf.pool.adminBase}</gf.pool.adminBase>
+                                <gf.pool.portStride>${gf.pool.portStride}</gf.pool.portStride>
+                                <gf.pool.restartOnRelease>${gf.pool.restartOnRelease}</gf.pool.restartOnRelease>
                                 <javax.net.ssl.trustStore>${trustStore.path}</javax.net.ssl.trustStore>
                                 <javax.net.ssl.trustStorePassword>${trustStore.password}</javax.net.ssl.trustStorePassword>
-                                <glassfish.systemProperties>
-                                    javax.net.debug=${glassfish.javax.net.debug}
-                                    javax.net.ssl.trustStorePassword=${trustStore.password}
-                                </glassfish.systemProperties>
                             </systemPropertyVariables>
                         </configuration>
                     </plugin>