Those one-offs can always be in a separate VM (in Hyper-V or something)