diff --git a/coderd/coderdtest/oidctest/idp.go b/coderd/coderdtest/oidctest/idp.go
index 5f6a8587dd..d7e4ee336b 100644
--- a/coderd/coderdtest/oidctest/idp.go
+++ b/coderd/coderdtest/oidctest/idp.go
@@ -1413,9 +1413,28 @@ func (f *FakeIDP) httpHandler(t testing.TB) http.Handler {
 		}.Encode())
 	}))
 
-	mux.NotFound(func(_ http.ResponseWriter, r *http.Request) {
-		f.logger.Error(r.Context(), "http call not found", slogRequestFields(r)...)
-		t.Errorf("unexpected request to IDP at path %q. Not supported", r.URL.Path)
+	mux.NotFound(func(rw http.ResponseWriter, r *http.Request) {
+		// When the IDP runs as a real HTTP server (WithServing), OS
+		// port reuse can route stale connections from other tests to
+		// this server. Only fail the test for paths that look like
+		// legitimate IDP requests (OIDC protocol paths). Non-IDP
+		// paths (e.g. /api/v2/.../provisionerdaemons/serve, /derp)
+		// are cross-test contamination; return an error to the caller
+		// so the offending test can be traced, but do not fail this
+		// test.
+		idpPath := strings.HasPrefix(r.URL.Path, "/oauth2/") ||
+			strings.HasPrefix(r.URL.Path, "/.well-known/") ||
+			strings.HasPrefix(r.URL.Path, "/login/") ||
+			strings.HasPrefix(r.URL.Path, "/external-auth-validate/")
+		if idpPath {
+			f.logger.Error(r.Context(), "unexpected IDP request at unhandled path", slogRequestFields(r)...)
+			t.Errorf("unexpected request to IDP at path %q. Not supported", r.URL.Path)
+			http.Error(rw, fmt.Sprintf("unexpected IDP request at path %q", r.URL.Path), http.StatusNotFound)
+		} else {
+			f.logger.Warn(r.Context(), "non-IDP request received, likely cross-test port reuse", slogRequestFields(r)...)
+			t.Logf("ignoring non-IDP request at path %q (likely cross-test port reuse)", r.URL.Path)
+			http.Error(rw, fmt.Sprintf("misdirected request to IDP at path %q", r.URL.Path), http.StatusMisdirectedRequest)
+		}
 	})
 
 	return mux