diff --git a/test-integ/catalogv2/explicit_destinations_test.go b/test-integ/catalogv2/explicit_destinations_test.go
index 2c03384630..ab2a49fe79 100644
--- a/test-integ/catalogv2/explicit_destinations_test.go
+++ b/test-integ/catalogv2/explicit_destinations_test.go
@@ -37,7 +37,31 @@ import (
 // - default/nsa
 // - part1/nsa
 func TestBasicL4ExplicitDestinations(t *testing.T) {
-	cfg := testBasicL4ExplicitDestinationsCreator{}.NewConfig(t)
+
+	tenancies := []*pbresource.Tenancy{
+		{
+			Partition: "default",
+			Namespace: "default",
+		},
+	}
+	if utils.IsEnterprise() {
+		tenancies = append(tenancies, &pbresource.Tenancy{
+			Partition: "part1",
+			Namespace: "default",
+		})
+		tenancies = append(tenancies, &pbresource.Tenancy{
+			Partition: "part1",
+			Namespace: "nsa",
+		})
+		tenancies = append(tenancies, &pbresource.Tenancy{
+			Partition: "default",
+			Namespace: "nsa",
+		})
+	}
+
+	cfg := testBasicL4ExplicitDestinationsCreator{
+		tenancies: tenancies,
+	}.NewConfig(t)
 
 	sp := sprawltest.Launch(t, cfg)
 
@@ -55,13 +79,15 @@ func TestBasicL4ExplicitDestinations(t *testing.T) {
 	t.Log(topology.RenderRelationships(ships))
 
 	// Make sure things are in v2.
-	for _, name := range []string{
-		"single-server",
-		"single-client",
-		"multi-server",
-		"multi-client",
-	} {
-		libassert.CatalogV2ServiceHasEndpointCount(t, clientV2, name, nil, 1)
+	for _, ten := range tenancies {
+		for _, name := range []string{
+			"single-server",
+			"single-client",
+			"multi-server",
+			"multi-client",
+		} {
+			libassert.CatalogV2ServiceHasEndpointCount(t, clientV2, name, ten, 1)
+		}
 	}
 
 	// Check relationships
@@ -81,7 +107,9 @@ func TestBasicL4ExplicitDestinations(t *testing.T) {
 	}
 }
 
-type testBasicL4ExplicitDestinationsCreator struct{}
+type testBasicL4ExplicitDestinationsCreator struct {
+	tenancies []*pbresource.Tenancy
+}
 
 func (c testBasicL4ExplicitDestinationsCreator) NewConfig(t *testing.T) *topology.Config {
 	const clusterName = "dc1"
@@ -100,11 +128,8 @@ func (c testBasicL4ExplicitDestinationsCreator) NewConfig(t *testing.T) *topolog
 		return fmt.Sprintf("%s-box%d", clusterName, lastNode)
 	}
 
-	c.topologyConfigAddNodes(t, cluster, nodeName, "default", "default")
-	if cluster.Enterprise {
-		c.topologyConfigAddNodes(t, cluster, nodeName, "part1", "default")
-		c.topologyConfigAddNodes(t, cluster, nodeName, "part1", "nsa")
-		c.topologyConfigAddNodes(t, cluster, nodeName, "default", "nsa")
+	for _, ten := range c.tenancies {
+		c.topologyConfigAddNodes(t, cluster, nodeName, ten)
 	}
 
 	return &topology.Config{
@@ -123,34 +148,28 @@ func (c testBasicL4ExplicitDestinationsCreator) topologyConfigAddNodes(
 	t *testing.T,
 	cluster *topology.Cluster,
 	nodeName func() string,
-	partition,
-	namespace string,
+	tenancy *pbresource.Tenancy,
 ) {
 	clusterName := cluster.Name
+	tenancy.PeerName = "local"
 
-	newID := func(name string) topology.ID {
+	newID := func(name string, tenancy *pbresource.Tenancy) topology.ID {
 		return topology.ID{
-			Partition: partition,
-			Namespace: namespace,
+			Partition: tenancy.Partition,
+			Namespace: tenancy.Namespace,
 			Name:      name,
 		}
 	}
 
-	tenancy := &pbresource.Tenancy{
-		Partition: partition,
-		Namespace: namespace,
-		PeerName:  "local",
-	}
-
 	singleportServerNode := &topology.Node{
 		Kind:      topology.NodeKindDataplane,
 		Version:   topology.NodeVersionV2,
-		Partition: partition,
+		Partition: tenancy.Partition,
 		Name:      nodeName(),
 		Workloads: []*topology.Workload{
 			topoutil.NewFortioWorkloadWithDefaults(
 				clusterName,
-				newID("single-server"),
+				newID("single-server", tenancy),
 				topology.NodeVersionV2,
 				func(wrk *topology.Workload) {
 					wrk.WorkloadIdentity = "single-server-identity"
@@ -158,30 +177,42 @@ func (c testBasicL4ExplicitDestinationsCreator) topologyConfigAddNodes(
 			),
 		},
 	}
+	var singleportDestinations []*topology.Destination
+	for i, ten := range c.tenancies {
+		singleportDestinations = append(singleportDestinations, &topology.Destination{
+			ID:           newID("single-server", ten),
+			PortName:     "http",
+			LocalAddress: "0.0.0.0", // needed for an assertion
+			LocalPort:    5000 + i,
+		})
+	}
 	singleportClientNode := &topology.Node{
 		Kind:      topology.NodeKindDataplane,
 		Version:   topology.NodeVersionV2,
-		Partition: partition,
+		Partition: tenancy.Partition,
 		Name:      nodeName(),
 		Workloads: []*topology.Workload{
 			topoutil.NewFortioWorkloadWithDefaults(
 				clusterName,
-				newID("single-client"),
+				newID("single-client", tenancy),
 				topology.NodeVersionV2,
 				func(wrk *topology.Workload) {
 					delete(wrk.Ports, "grpc")  // v2 mode turns this on, so turn it off
 					delete(wrk.Ports, "http2") // v2 mode turns this on, so turn it off
 					wrk.WorkloadIdentity = "single-client-identity"
-					wrk.Destinations = []*topology.Destination{{
-						ID:           newID("single-server"),
-						PortName:     "http",
-						LocalAddress: "0.0.0.0", // needed for an assertion
-						LocalPort:    5000,
-					}}
+					wrk.Destinations = singleportDestinations
 				},
 			),
 		},
 	}
+	var sources []*pbauth.Source
+	for _, ten := range c.tenancies {
+		sources = append(sources, &pbauth.Source{
+			IdentityName: "single-client-identity",
+			Namespace:    ten.Namespace,
+			Partition:    ten.Partition,
+		})
+	}
 	singleportTrafficPerms := sprawltest.MustSetResourceData(t, &pbresource.Resource{
 		Id: &pbresource.ID{
 			Type:    pbauth.TrafficPermissionsType,
@@ -194,22 +225,19 @@ func (c testBasicL4ExplicitDestinationsCreator) topologyConfigAddNodes(
 		},
 		Action: pbauth.Action_ACTION_ALLOW,
 		Permissions: []*pbauth.Permission{{
-			Sources: []*pbauth.Source{{
-				IdentityName: "single-client-identity",
-				Namespace:    namespace,
-			}},
+			Sources: sources,
 		}},
 	})
 
 	multiportServerNode := &topology.Node{
 		Kind:      topology.NodeKindDataplane,
 		Version:   topology.NodeVersionV2,
-		Partition: partition,
+		Partition: tenancy.Partition,
 		Name:      nodeName(),
 		Workloads: []*topology.Workload{
 			topoutil.NewFortioWorkloadWithDefaults(
 				clusterName,
-				newID("multi-server"),
+				newID("multi-server", tenancy),
 				topology.NodeVersionV2,
 				func(wrk *topology.Workload) {
 					wrk.WorkloadIdentity = "multi-server-identity"
@@ -217,36 +245,47 @@ func (c testBasicL4ExplicitDestinationsCreator) topologyConfigAddNodes(
 			),
 		},
 	}
+	var multiportDestinations []*topology.Destination
+	for i, ten := range c.tenancies {
+		multiportDestinations = append(multiportDestinations, &topology.Destination{
+			ID:           newID("multi-server", ten),
+			PortName:     "http",
+			LocalAddress: "0.0.0.0", // needed for an assertion
+			LocalPort:    5000 + 2*i,
+		})
+		multiportDestinations = append(multiportDestinations, &topology.Destination{
+			ID:           newID("multi-server", ten),
+			PortName:     "http2",
+			LocalAddress: "0.0.0.0", // needed for an assertion
+			LocalPort:    5000 + 2*i + 1,
+		})
+	}
 	multiportClientNode := &topology.Node{
 		Kind:      topology.NodeKindDataplane,
 		Version:   topology.NodeVersionV2,
-		Partition: partition,
+		Partition: tenancy.Partition,
 		Name:      nodeName(),
 		Workloads: []*topology.Workload{
 			topoutil.NewFortioWorkloadWithDefaults(
 				clusterName,
-				newID("multi-client"),
+				newID("multi-client", tenancy),
 				topology.NodeVersionV2,
 				func(wrk *topology.Workload) {
 					wrk.WorkloadIdentity = "multi-client-identity"
-					wrk.Destinations = []*topology.Destination{
-						{
-							ID:           newID("multi-server"),
-							PortName:     "http",
-							LocalAddress: "0.0.0.0", // needed for an assertion
-							LocalPort:    5000,
-						},
-						{
-							ID:           newID("multi-server"),
-							PortName:     "http2",
-							LocalAddress: "0.0.0.0", // needed for an assertion
-							LocalPort:    5001,
-						},
-					}
+					wrk.Destinations = multiportDestinations
 				},
 			),
 		},
 	}
+
+	var multiportSources []*pbauth.Source
+	for _, ten := range c.tenancies {
+		multiportSources = append(multiportSources, &pbauth.Source{
+			IdentityName: "multi-client-identity",
+			Namespace:    ten.Namespace,
+			Partition:    ten.Partition,
+		})
+	}
 	multiportTrafficPerms := sprawltest.MustSetResourceData(t, &pbresource.Resource{
 		Id: &pbresource.ID{
 			Type:    pbauth.TrafficPermissionsType,
@@ -259,10 +298,7 @@ func (c testBasicL4ExplicitDestinationsCreator) topologyConfigAddNodes(
 		},
 		Action: pbauth.Action_ACTION_ALLOW,
 		Permissions: []*pbauth.Permission{{
-			Sources: []*pbauth.Source{{
-				IdentityName: "multi-client-identity",
-				Namespace:    namespace,
-			}},
+			Sources: multiportSources,
 		}},
 	})