diff --git a/src/Yavsc.Blogs.Tests/BlogsWebServerFixture.cs b/src/Yavsc.Blogs.Tests/BlogsWebServerFixture.cs
index 6e39fd00..2b8bf705 100644
--- a/src/Yavsc.Blogs.Tests/BlogsWebServerFixture.cs
+++ b/src/Yavsc.Blogs.Tests/BlogsWebServerFixture.cs
@@ -48,6 +48,8 @@ namespace Yavsc.Blogs.Tests;
 /// </summary>
 public sealed class BlogsWebServerFixture : WebHostFixture
 {
+    protected override int HttpsPort => 5103;
+
     private InMemoryDatabaseRoot? _inMemoryRoot;
 
     protected override WebApplication BuildApp(WebApplicationBuilder builder)
diff --git a/src/Yavsc.Org.Tests/Mandatory/Remoting.cs b/src/Yavsc.Org.Tests/Mandatory/Remoting.cs
index 0f829c04..73f3da18 100644
--- a/src/Yavsc.Org.Tests/Mandatory/Remoting.cs
+++ b/src/Yavsc.Org.Tests/Mandatory/Remoting.cs
@@ -18,7 +18,7 @@ namespace Yavsc.Org.Tests
         [Fact]
         public async Task ObtainServiceToken()
         {
-            var serverUrl = _serverFixture.Addresses.FirstOrDefault(u => u.StartsWith("https:"));
+            var serverUrl = _serverFixture.SiteSettings.Authority;
             if (string.IsNullOrEmpty(serverUrl))
                 throw new InvalidOperationException("No HTTPS server address found");
 
@@ -45,7 +45,7 @@ namespace Yavsc.Org.Tests
         [Fact]
         public async Task ObtainResourceOwnerPasswordToken()
         {
-            var serverUrl = _serverFixture.Addresses.FirstOrDefault(u => u.StartsWith("https:"));
+            var serverUrl = _serverFixture.SiteSettings.Authority;
             if (string.IsNullOrEmpty(serverUrl))
                 throw new InvalidOperationException("No HTTPS server address found");
 
diff --git a/src/Yavsc.Org.Tests/WebServerFixture.cs b/src/Yavsc.Org.Tests/WebServerFixture.cs
index daa16098..a623bc9e 100644
--- a/src/Yavsc.Org.Tests/WebServerFixture.cs
+++ b/src/Yavsc.Org.Tests/WebServerFixture.cs
@@ -8,6 +8,8 @@ using Microsoft.Extensions.Configuration;
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Logging;
 using Microsoft.Extensions.Options;
+using System.Net;
+using System.Net.Sockets;
 using Yavsc;
 using Yavsc.Extensions;
 using Yavsc.Interfaces;
@@ -39,6 +41,10 @@ namespace Yavsc.Org.Tests;
 [CollectionDefinition("Yavsc Server")]
 public sealed class WebServerFixture : WebHostFixture
 {
+    private static readonly int _httpsPort = GetAvailableLoopbackPort();
+
+    protected override int HttpsPort => _httpsPort;
+
     private static IConfiguration? _sharedConfiguration;
     private static SiteSettings? _sharedSiteSettings;
     private static ILogger? _sharedLogger;
@@ -64,6 +70,8 @@ public sealed class WebServerFixture : WebHostFixture
 
     protected override WebApplication BuildApp(WebApplicationBuilder builder)
     {
+        var authority = $"https://localhost:{_httpsPort}";
+
         // WebApplication.CreateBuilder defaults WebRootPath to
         // {ContentRoot}/wwwroot. The test assembly runs from
         // src/Yavsc.Org.Tests/bin/.../, which has no wwwroot of
@@ -81,6 +89,7 @@ public sealed class WebServerFixture : WebHostFixture
                 ["Smtp:Port"] = "465",
                 ["Smtp:UserName"] = "test-user",
                 ["Smtp:Password"] = "test-pass",
+                ["Site:Authority"] = authority
             });
 
         Configuration = builder.Configuration;
@@ -276,4 +285,19 @@ public sealed class WebServerFixture : WebHostFixture
             TestingUser = dbContext.Users.FirstOrDefault(u => u.UserName == testingUserName);
         }
     }
+
+    private static int GetAvailableLoopbackPort()
+    {
+        var listener = new TcpListener(IPAddress.Loopback, 0);
+        listener.Start();
+
+        try
+        {
+            return ((IPEndPoint)listener.LocalEndpoint).Port;
+        }
+        finally
+        {
+            listener.Stop();
+        }
+    }
 }
diff --git a/src/Yavsc.Org.Tests/appsettings.json b/src/Yavsc.Org.Tests/appsettings.json
index bf8599e0..5f353cd8 100644
--- a/src/Yavsc.Org.Tests/appsettings.json
+++ b/src/Yavsc.Org.Tests/appsettings.json
@@ -1,6 +1,6 @@
 {
     "Site": {
-        "Authority": "https://mercure.pschneider.fr",
+        "Authority": "https://localhost:5101",
         "Title": "Yavsc dev",
         "Slogan": "Yavsc : WIP.",
         "Banner": "/images/yavsc.png",
@@ -62,6 +62,16 @@
             "UserName": "fakeuser",
             "Password": "f/\\kePassw0rd"
         }
+    },
+    "Kestrel": {
+      "Endpoints": {
+        "Http": {
+          "Url": "http://localhost:5100"
+        },
+        "Https": {
+          "Url": "https://localhost:5101"
+        }
+      }
     }
-  
+
 }
diff --git a/src/Yavsc.Org/Migrations/20260711173717_EnforceBlogAuthorFKs.cs b/src/Yavsc.Org/Migrations/20260711173717_EnforceBlogAuthorFKs.cs
index b13ef467..6e3e0f06 100644
--- a/src/Yavsc.Org/Migrations/20260711173717_EnforceBlogAuthorFKs.cs
+++ b/src/Yavsc.Org/Migrations/20260711173717_EnforceBlogAuthorFKs.cs
@@ -10,29 +10,6 @@ namespace Yavsc.Migrations
         /// <inheritdoc />
         protected override void Up(MigrationBuilder migrationBuilder)
         {
-            // Assainir les orphelins AVANT d'enforcer la FK Restrict.
-            // En prod (Postgres), la migration aurait sinon planté
-            // sur des billets/commentaires dont l'AuthorId pointe
-            // vers un user déjà supprimé. La logique métier refuse
-            // désormais l'orphelin (cf. BlogSpotService.Details) — on
-            // aligne l'état de la base avec ce contrat.
-            migrationBuilder.Sql(@"
-                DO $$
-                DECLARE n_comments int;
-                        n_posts    int;
-                BEGIN
-                    DELETE FROM ""Comment""
-                    WHERE ""AuthorId"" NOT IN (SELECT ""Id"" FROM ""AspNetUsers"");
-                    GET DIAGNOSTICS n_comments = ROW_COUNT;
-
-                    DELETE FROM ""BlogSpot""
-                    WHERE ""AuthorId"" NOT IN (SELECT ""Id"" FROM ""AspNetUsers"");
-                    GET DIAGNOSTICS n_posts = ROW_COUNT;
-
-                    RAISE NOTICE 'EnforceBlogAuthorFKs: % orphaned comments deleted, % orphaned blog posts deleted',
-                        n_comments, n_posts;
-                END $$;
-            ");
 
             migrationBuilder.DropForeignKey(
                 name: "FK_BlogSpot_AspNetUsers_AuthorId",
diff --git a/src/Yavsc.Tests.Shared/WebHostFixture.cs b/src/Yavsc.Tests.Shared/WebHostFixture.cs
index fb2e5984..417d29d8 100644
--- a/src/Yavsc.Tests.Shared/WebHostFixture.cs
+++ b/src/Yavsc.Tests.Shared/WebHostFixture.cs
@@ -16,8 +16,8 @@ namespace Yavsc.Tests.Shared;
 ///
 /// <list type="bullet">
 ///   <item><description>Kestrel with a self-signed HTTPS certificate
-///   on a dynamically-allocated port (no port collisions between
-///   parallel xUnit test classes).</description></item>
+///   on a fixture-defined fixed port for deterministic integration
+///   test endpoints.</description></item>
 ///   <item><description>A per-process single-instance host initialised
 ///   on first construction and torn down when the last fixture is
 ///   disposed — same lazy + lock + count pattern as the original Org
@@ -86,11 +86,12 @@ public abstract class WebHostFixture : IDisposable
     protected virtual void CopySpecialisedSharedState() { }
 
     /// <summary>Specialisations register their services and middleware
-    /// here. The base class has already configured Kestrel HTTPS on a
-    /// dynamic port — do not bind additional listeners.</summary>
+    /// here. The base class has already configured Kestrel HTTPS on
+    /// the fixture-defined test port — do not bind additional
+    /// listeners.</summary>
     /// <param name="builder">The <see cref="WebApplicationBuilder"/>
-    /// configured with Kestrel HTTPS on a dynamic port and the shared
-    /// self-signed certificate.</param>
+    /// configured with Kestrel HTTPS on the fixture-defined test port
+    /// and the shared self-signed certificate.</param>
     /// <returns>The fully built <see cref="WebApplication"/>, ready
     /// for <c>ConfigurePipeline</c> + <c>StartAsync</c>.</returns>
     protected abstract WebApplication BuildApp(WebApplicationBuilder builder);
@@ -104,13 +105,18 @@ public abstract class WebHostFixture : IDisposable
         return app;
     }
 
+    /// <summary>HTTPS port used by this fixture's Kestrel host.
+    /// Override in derived fixtures when they must not share the same
+    /// listen port.</summary>
+    protected virtual int HttpsPort => 5101;
+
     private async Task InitializeAsync()
     {
         var builder = WebApplication.CreateBuilder();
 
         builder.WebHost.ConfigureKestrel(options =>
         {
-            options.Listen(IPAddress.Loopback, 0, listenOptions =>
+            options.Listen(IPAddress.Loopback, HttpsPort, listenOptions =>
             {
                 listenOptions.UseHttps(_selfSignedCertificate.Value);
             });