diff --git a/desktop/app/src/__tests__/disconnect.node.tsx b/desktop/app/src/__tests__/disconnect.node.tsx
index 1e816e137..4791e3cc5 100644
--- a/desktop/app/src/__tests__/disconnect.node.tsx
+++ b/desktop/app/src/__tests__/disconnect.node.tsx
@@ -225,7 +225,18 @@ test('new clients replace old ones', async () => {
   expect(instance.instanceApi.disconnect).toBeCalledTimes(0);
 
   const client2 = await createClient(device, 'AnotherApp', client.query, true);
-  handleClientConnected(null as any, store, logger, client2);
+  await handleClientConnected(
+    {
+      exec: (async () => {
+        return {
+          success: {}, // {plugins: []},
+        };
+      }) as any,
+    },
+    store,
+    logger,
+    client2,
+  );
 
   expect(client2.connected.get()).toBe(true);
   const instance2 = client2.sandyPluginStates.get(plugin.id)!;
diff --git a/desktop/app/src/dispatcher/flipperServer.tsx b/desktop/app/src/dispatcher/flipperServer.tsx
index 27ad23cbe..9fd4c0a3d 100644
--- a/desktop/app/src/dispatcher/flipperServer.tsx
+++ b/desktop/app/src/dispatcher/flipperServer.tsx
@@ -9,7 +9,7 @@
 
 import React from 'react';
 import {State, Store} from '../reducers/index';
-import {Logger} from 'flipper-common';
+import {FlipperServer, Logger} from 'flipper-common';
 import {FlipperServerImpl} from 'flipper-server-core';
 import {selectClient} from '../reducers/connections';
 import Client from '../Client';
@@ -168,7 +168,7 @@ export default async (store: Store, logger: Logger) => {
 };
 
 export async function handleClientConnected(
-  server: FlipperServerImpl,
+  server: Pick<FlipperServer, 'exec'>,
   store: Store,
   logger: Logger,
   {id, query}: ClientDescription,
diff --git a/desktop/app/src/test-utils/MockFlipper.tsx b/desktop/app/src/test-utils/MockFlipper.tsx
index bc4d53a31..d62eb2070 100644
--- a/desktop/app/src/test-utils/MockFlipper.tsx
+++ b/desktop/app/src/test-utils/MockFlipper.tsx
@@ -58,7 +58,7 @@ export default class MockFlipper {
   private _clients: Client[] = [];
   private _deviceCounter: number = 0;
   private _clientCounter: number = 0;
-  private _flipperServer: FlipperServer = createFlipperServerMock();
+  flipperServer: FlipperServer = createFlipperServerMock();
 
   public get store(): Store {
     return this._store;
@@ -98,7 +98,7 @@ export default class MockFlipper {
     this._store.dispatch(registerPlugins(plugins ?? []));
     this._store.dispatch({
       type: 'SET_FLIPPER_SERVER',
-      payload: this._flipperServer,
+      payload: this.flipperServer,
     });
   }
 
diff --git a/desktop/app/src/test-utils/createMockFlipperWithPlugin.tsx b/desktop/app/src/test-utils/createMockFlipperWithPlugin.tsx
index ccbb4082b..0d815075b 100644
--- a/desktop/app/src/test-utils/createMockFlipperWithPlugin.tsx
+++ b/desktop/app/src/test-utils/createMockFlipperWithPlugin.tsx
@@ -26,7 +26,7 @@ import BaseDevice from '../devices/BaseDevice';
 import {Store} from '../reducers/index';
 import Client from '../Client';
 
-import {ClientQuery, Logger} from 'flipper-common';
+import {ClientQuery, FlipperServer, Logger} from 'flipper-common';
 import {FlipperDevicePlugin, FlipperPlugin, PluginDefinition} from '../plugin';
 import PluginContainer from '../PluginContainer';
 import {isDevicePluginDefinition} from '../utils/pluginUtils';
@@ -42,6 +42,7 @@ export type MockFlipperResult = {
   client: Client;
   device: BaseDevice;
   store: Store;
+  server: FlipperServer;
   pluginKey: string;
   sendError(error: any, client?: Client): void;
   sendMessage(method: string, params: any, client?: Client): void;
@@ -126,6 +127,7 @@ export async function createMockFlipperWithPlugin(
   });
   const logger = mockFlipper.logger;
   const store = mockFlipper.store;
+  const server = mockFlipper.flipperServer;
 
   const createDevice = (options: Parameters<MockFlipper['createDevice']>[0]) =>
     mockFlipper.createDevice(options);
@@ -206,6 +208,7 @@ export async function createMockFlipperWithPlugin(
     client,
     device: device as any,
     store,
+    server,
     selectPlugin: selectPluginImpl,
     sendError(error: any, actualClient = client) {
       actualClient.onMessage(
diff --git a/desktop/flipper-plugin/src/plugin/PluginBase.tsx b/desktop/flipper-plugin/src/plugin/PluginBase.tsx
index ac4fadf6d..625a6a738 100644
--- a/desktop/flipper-plugin/src/plugin/PluginBase.tsx
+++ b/desktop/flipper-plugin/src/plugin/PluginBase.tsx
@@ -333,7 +333,11 @@ export abstract class BasePluginInstance {
     if (!this.activated) {
       this.flipperLib.enableMenuEntries(this.menuEntries);
       this.activated = true;
-      this.events.emit('activate');
+      try {
+        this.events.emit('activate');
+      } catch (e) {
+        console.error(`Failed to activate plugin: ${this.definition.id}`, e);
+      }
       this.flipperLib.logger.trackTimeSince(
         `activePlugin-${this.definition.id}`,
       );
@@ -347,7 +351,11 @@ export abstract class BasePluginInstance {
     if (this.activated) {
       this.activated = false;
       this.lastDeeplink = undefined;
-      this.events.emit('deactivate');
+      try {
+        this.events.emit('deactivate');
+      } catch (e) {
+        console.error(`Failed to deactivate plugin: ${this.definition.id}`, e);
+      }
     }
   }
 
diff --git a/desktop/flipper-plugin/src/test-utils/test-utils.tsx b/desktop/flipper-plugin/src/test-utils/test-utils.tsx
index eac8af608..74364fc72 100644
--- a/desktop/flipper-plugin/src/test-utils/test-utils.tsx
+++ b/desktop/flipper-plugin/src/test-utils/test-utils.tsx
@@ -334,8 +334,10 @@ export function startDevicePlugin<Module extends FlipperDevicePluginModule>(
     },
   };
   (res as any)._backingInstance = pluginInstance;
-  // we start connected
-  pluginInstance.activate();
+  if (!options?.startUnactivated) {
+    // we start connected
+    pluginInstance.activate();
+  }
   return res;
 }
 
diff --git a/desktop/flipper-server-core/src/utils/CertificateProvider.tsx b/desktop/flipper-server-core/src/utils/CertificateProvider.tsx
index 6116939b9..b477c8a4b 100644
--- a/desktop/flipper-server-core/src/utils/CertificateProvider.tsx
+++ b/desktop/flipper-server-core/src/utils/CertificateProvider.tsx
@@ -89,11 +89,11 @@ type CertificateProviderConfig = {
  * Flipper CA.
  */
 export default class CertificateProvider {
-  logger: Logger;
-  _adb: Promise<ADBClient> | undefined;
-  certificateSetup: Promise<void>;
-  config: CertificateProviderConfig;
-  server: ServerController;
+  private logger: Logger;
+  private _adb: Promise<ADBClient> | undefined;
+  private didCertificateSetup = false;
+  private config: CertificateProviderConfig;
+  private server: ServerController;
 
   get adb(): Promise<ADBClient> {
     if (this.config.enableAndroid) {
@@ -125,20 +125,6 @@ export default class CertificateProvider {
           this._adb = undefined; // no adb client available
         }) as Promise<ADBClient>)
       : undefined;
-    if (isTest()) {
-      this.certificateSetup = Promise.reject(
-        new Error('Server certificates not available in test'),
-      );
-    } else {
-      this.certificateSetup = reportPlatformFailures(
-        this.ensureServerCertExists(),
-        'ensureServerCertExists',
-      );
-      // make sure initialization failure is already logged
-      this.certificateSetup.catch((e) => {
-        console.error('Failed to find or generate certificates', e);
-      });
-    }
     this.config = config;
     this.server = server;
   }
@@ -162,6 +148,21 @@ export default class CertificateProvider {
     );
   };
 
+  async certificateSetup() {
+    if (this.didCertificateSetup) {
+      return;
+    }
+    if (isTest()) {
+      throw new Error('Server certificates not available in test');
+    } else {
+      await reportPlatformFailures(
+        this.ensureServerCertExists(),
+        'ensureServerCertExists',
+      );
+    }
+    this.didCertificateSetup = true;
+  }
+
   async processCertificateSigningRequest(
     unsanitizedCsr: string,
     os: string,
@@ -176,7 +177,7 @@ export default class CertificateProvider {
     const rootFolder = await promisify(tmp.dir)();
     const certFolder = rootFolder + '/FlipperCerts/';
     const certsZipPath = rootFolder + '/certs.zip';
-    await this.certificateSetup;
+    await this.certificateSetup();
     const caCert = await this.getCACertificate();
     await this.deployOrStageFileForMobileApp(
       appDirectory,