Comment by spikej

Those one-offs can always be in a separate VM (in Hyper-V or something)