diff --git a/app/controllers/oauth/dynamic_registrations_controller.rb b/app/controllers/oauth/dynamic_registrations_controller.rb
index 9574ab379d0135970176b639b514cf3981ac9b1b..42d861724138a0ba03378c8d84932e7c3fbe9e0a 100644
--- a/app/controllers/oauth/dynamic_registrations_controller.rb
+++ b/app/controllers/oauth/dynamic_registrations_controller.rb
@@ -35,7 +35,9 @@ def create
         redirect_uri: Array(redirect_uris).join("\n"),
         scopes: scopes,
         confidential: false,
-        dynamic: true
+        dynamic: true,
+        # TODO: confirm the correct way to find the organization in this context
+        organization: ::Organizations::Organization.first # rubocop:disable Gitlab/PreventOrganizationFirst -- needed
       )
 
       if application.persisted?
diff --git a/db/post_migrate/20251210222353_change_oauth_applications_organization_id_to_not_null.rb b/db/post_migrate/20251210222353_change_oauth_applications_organization_id_to_not_null.rb
new file mode 100644
index 0000000000000000000000000000000000000000..cd23879cde9493cf303cfdffb25e0e60d992a3e1
--- /dev/null
+++ b/db/post_migrate/20251210222353_change_oauth_applications_organization_id_to_not_null.rb
@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+# See https://docs.gitlab.com/ee/development/migration_style_guide.html
+# for more information on how to write migrations for GitLab.
+
+class ChangeOauthApplicationsOrganizationIdToNotNull < Gitlab::Database::Migration[2.3]
+  disable_ddl_transaction!
+  milestone '18.8'
+
+  def up
+    add_not_null_constraint :oauth_applications, :organization_id
+  end
+
+  def down
+    remove_not_null_constraint :oauth_applications, :organization_id
+  end
+end
diff --git a/db/schema_migrations/20251210222353 b/db/schema_migrations/20251210222353
new file mode 100644
index 0000000000000000000000000000000000000000..f6e8930c1bb5bb08ef295c80297cdc26d523a9e9
--- /dev/null
+++ b/db/schema_migrations/20251210222353
@@ -0,0 +1 @@
+9bcd2fd04a7e4ce9236c684a43b8f72b6b2c772b1fd89db1de1f91297d0d5a2f
\ No newline at end of file
diff --git a/db/structure.sql b/db/structure.sql
index 3059ddcc7554d1720dd64d469ebf167c25e6521a..848699090c5999c78ded06c2f21769de423245f2 100644
--- a/db/structure.sql
+++ b/db/structure.sql
@@ -21829,7 +21829,8 @@ CREATE TABLE oauth_applications (
     ropc_enabled boolean DEFAULT true NOT NULL,
     dynamic boolean DEFAULT false NOT NULL,
     organization_id bigint,
-    CONSTRAINT check_75750847b8 CHECK ((char_length(scopes) <= 2048))
+    CONSTRAINT check_75750847b8 CHECK ((char_length(scopes) <= 2048)),
+    CONSTRAINT check_77eda6baaa CHECK ((organization_id IS NOT NULL))
 );
 
 CREATE SEQUENCE oauth_applications_id_seq
diff --git a/ee/app/models/geo_node.rb b/ee/app/models/geo_node.rb
index 94468eab75eaafce77c72a8f3a89607dfe41d860..d4bc3998dc9682413473b61cfa54a92f7fc1af2b 100644
--- a/ee/app/models/geo_node.rb
+++ b/ee/app/models/geo_node.rb
@@ -318,6 +318,7 @@ def update_clone_url
     self.clone_url_prefix = Gitlab.config.gitlab_shell.ssh_path_prefix
   end
 
+  # TODO: this creates an `oauth_applications` row on save
   def update_oauth_application!
     return unless uri
 
@@ -329,6 +330,10 @@ def update_oauth_application!
 
     oauth_application.name = "Geo node: #{url}"
     oauth_application.redirect_uri = oauth_callback_url
+    # TODO: verify the correct way to associate an organization here.
+    #   * It appears that `Geo::Node` objects can have multiple organizations -- how do we select from among them?
+    #   * What if there are no `organizations`? Do we use the instance default in that case?
+    oauth_application.organization = ::Organizations::Organization.first # rubocop:disable Gitlab/PreventOrganizationFirst -- todo
   end
 
   def expire_cache!
diff --git a/ee/lib/remote_development/workspaces_server_operations/server_config/main.rb b/ee/lib/remote_development/workspaces_server_operations/server_config/main.rb
index 9dfda417ec6d2ccb7edaa43b8ae2d535031a52a5..5f28a7b5df396b963a564267c7197cbe60188dff 100644
--- a/ee/lib/remote_development/workspaces_server_operations/server_config/main.rb
+++ b/ee/lib/remote_development/workspaces_server_operations/server_config/main.rb
@@ -12,6 +12,8 @@ class Main
         def self.main(context)
           initial_result = Gitlab::Fp::Result.ok(context)
 
+          # TODO: This flow creates an OAuth application. There was discussion about that here which may need to be
+          # revisited: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/194652#note_2662912641
           result =
             initial_result
               .map(OauthApplicationAttributesGenerator.method(:generate))
diff --git a/ee/lib/remote_development/workspaces_server_operations/server_config/oauth_application_attributes_generator.rb b/ee/lib/remote_development/workspaces_server_operations/server_config/oauth_application_attributes_generator.rb
index a49212bffb106ed89c1db6c98d404b59fade698f..1e08059d79e4311d6c121783ce5557c8d962cb76 100644
--- a/ee/lib/remote_development/workspaces_server_operations/server_config/oauth_application_attributes_generator.rb
+++ b/ee/lib/remote_development/workspaces_server_operations/server_config/oauth_application_attributes_generator.rb
@@ -26,12 +26,15 @@ def self.generate(context)
           redirect_uri = api_external_url.dup
           redirect_uri.path = "#{redirect_uri.path}/#{OAUTH_REDIRECT_URI_PATH_SEGMENT}"
 
+          # TODO: need to set a realistic organization ID here, see
+          #   https://gitlab.com/gitlab-org/gitlab/-/merge_requests/194652#note_2662912641
           attributes = {
             name: OAUTH_NAME,
             redirect_uri: redirect_uri.to_s,
             scopes: "openid",
             trusted: TRUSTED,
-            confidential: CONFIDENTIAL
+            confidential: CONFIDENTIAL,
+            organization_id: ::Organizations::Organization.first&.id # rubocop:disable Gitlab/PreventOrganizationFirst -- todo
           }
 
           context.merge(
diff --git a/ee/spec/controllers/concerns/internal_redirect_spec.rb b/ee/spec/controllers/concerns/internal_redirect_spec.rb
index c00218a146d4a22cb161e81407b5372c9e16479c..87022c1d4370ee3d0ef5e778659070955826a649 100644
--- a/ee/spec/controllers/concerns/internal_redirect_spec.rb
+++ b/ee/spec/controllers/concerns/internal_redirect_spec.rb
@@ -3,6 +3,8 @@
 require 'spec_helper'
 
 RSpec.describe InternalRedirect, feature_category: :geo_replication do
+  let_it_be(:default_organization) { create(:organization, :default) } # rubocop:disable Gitlab/RSpec/AvoidCreateDefaultOrganization -- todo
+
   let(:controller_class) do
     Class.new do
       include InternalRedirect
diff --git a/ee/spec/controllers/ee/root_controller_spec.rb b/ee/spec/controllers/ee/root_controller_spec.rb
index de12d1322b971092ba9591118ea95a298527a981..5b1fb4a4c16b432b91003992a35354bb99ed5530 100644
--- a/ee/spec/controllers/ee/root_controller_spec.rb
+++ b/ee/spec/controllers/ee/root_controller_spec.rb
@@ -4,6 +4,7 @@
 
 RSpec.describe RootController, feature_category: :geo_replication do
   include ::EE::GeoHelpers
+  let_it_be(:default_organization) { create(:organization, :default) } # rubocop:disable Gitlab/RSpec/AvoidCreateDefaultOrganization -- todo
 
   describe 'GET #index' do
     context 'when user is not logged in' do
diff --git a/ee/spec/controllers/ee/sessions_controller_spec.rb b/ee/spec/controllers/ee/sessions_controller_spec.rb
index 7b2ed63437de86711243b37ccaf4f1f006aae039..fe51b22808b17958b595531a85af7cf4c4182043 100644
--- a/ee/spec/controllers/ee/sessions_controller_spec.rb
+++ b/ee/spec/controllers/ee/sessions_controller_spec.rb
@@ -12,6 +12,7 @@
 
   describe '#new' do
     context 'on a Geo secondary node' do
+      let_it_be(:default_organization) { create(:organization, :default) } # rubocop:disable Gitlab/RSpec/AvoidCreateDefaultOrganization -- todo
       let_it_be(:primary_node) { create(:geo_node, :primary) }
       let_it_be(:secondary_node) { create(:geo_node) }
 
diff --git a/ee/spec/controllers/oauth/geo_auth_controller_spec.rb b/ee/spec/controllers/oauth/geo_auth_controller_spec.rb
index 33ccdb3c10f31b913ee76d368793f0aeff8c41db..33637a657c3a0b456de12448d5bf79b6068dd352 100644
--- a/ee/spec/controllers/oauth/geo_auth_controller_spec.rb
+++ b/ee/spec/controllers/oauth/geo_auth_controller_spec.rb
@@ -5,6 +5,7 @@
 RSpec.describe Oauth::GeoAuthController, :geo, feature_category: :geo_replication do
   include EE::GeoHelpers
 
+  let_it_be(:default_organization) { create(:organization, :default) } # rubocop:disable Gitlab/RSpec/AvoidCreateDefaultOrganization -- todo
   # The Geo OAuth workflow depends on the OAuth application and the URL
   # defined on the Geo primary node, so we use let! instead of let here
   # to define a memoized helper method that is called in a `before` hook
diff --git a/ee/spec/features/admin/geo/admin_geo_nodes_spec.rb b/ee/spec/features/admin/geo/admin_geo_nodes_spec.rb
index fc60fcfc749b7379e8b3109786c1e6e1c49b8ff0..6fad71b415a6bbb112684a0696587d5b770f3188 100644
--- a/ee/spec/features/admin/geo/admin_geo_nodes_spec.rb
+++ b/ee/spec/features/admin/geo/admin_geo_nodes_spec.rb
@@ -3,7 +3,7 @@
 require 'spec_helper'
 
 RSpec.describe 'Admin Geo Sites', :js, :geo, feature_category: :geo_replication do
-  let_it_be(:admin) { create(:admin) }
+  let_it_be(:admin) { create(:admin) } # This creates an org, so nothing new necessary. Seems very implicit.
 
   let!(:geo_site) { create(:geo_node) }
 
diff --git a/ee/spec/lib/ee/gitlab/usage_data_spec.rb b/ee/spec/lib/ee/gitlab/usage_data_spec.rb
index 95e06b5674e504ef5bb7fdbbe676d435311ad8e2..115029a48ceb863a4b08f92a86dfdea2807409d1 100644
--- a/ee/spec/lib/ee/gitlab/usage_data_spec.rb
+++ b/ee/spec/lib/ee/gitlab/usage_data_spec.rb
@@ -5,6 +5,8 @@
 RSpec.describe Gitlab::UsageData, feature_category: :service_ping do
   include UsageDataHelpers
 
+  let_it_be(:default_organization) { create(:organization, :default) } # rubocop:disable Gitlab/RSpec/AvoidCreateDefaultOrganization -- todo
+
   before do
     stub_usage_data_connections
     stub_database_flavor_check
diff --git a/ee/spec/lib/geo/console/show_sync_failures_for_replicator_class_action_spec.rb b/ee/spec/lib/geo/console/show_sync_failures_for_replicator_class_action_spec.rb
index 809bb4cdd837ef19a8be6d36a309bfea5a221362..3e8159c99118ab51ab1f18d902859f27bb9e660f 100644
--- a/ee/spec/lib/geo/console/show_sync_failures_for_replicator_class_action_spec.rb
+++ b/ee/spec/lib/geo/console/show_sync_failures_for_replicator_class_action_spec.rb
@@ -5,6 +5,7 @@
 RSpec.describe Geo::Console::ShowSyncFailuresForReplicatorClassAction, feature_category: :geo_replication do
   include EE::GeoHelpers
 
+  let_it_be(:default_organization) { create(:organization, :default) } # rubocop:disable Gitlab/RSpec/AvoidCreateDefaultOrganization -- todo
   let(:action) do
     described_class.new(
       replicator_class: Geo::UploadReplicator,
diff --git a/ee/spec/lib/geo/system_check/ssh_port_check_spec.rb b/ee/spec/lib/geo/system_check/ssh_port_check_spec.rb
index 079b71aa217842fb6f5f8c68c4ad6661995a2a0e..5fc39d38c989a456a79f7ddecf4f239f0794c42b 100644
--- a/ee/spec/lib/geo/system_check/ssh_port_check_spec.rb
+++ b/ee/spec/lib/geo/system_check/ssh_port_check_spec.rb
@@ -7,6 +7,7 @@
 
   subject(:ssh_port_check) { described_class.new }
 
+  let_it_be(:default_organization) { create(:organization, :default) } # rubocop:disable Gitlab/RSpec/AvoidCreateDefaultOrganization -- todo
   let_it_be(:primary_node) { create(:geo_node, :primary) }
   let_it_be(:secondary_node) { create(:geo_node) }
 
diff --git a/ee/spec/lib/gitlab/geo/geo_node_status_check_spec.rb b/ee/spec/lib/gitlab/geo/geo_node_status_check_spec.rb
index 443744e878540854b562dfff6fee72a448f75c5d..1b0d19e063c875c7b0a2a5a4f3f243c26b01d557 100644
--- a/ee/spec/lib/gitlab/geo/geo_node_status_check_spec.rb
+++ b/ee/spec/lib/gitlab/geo/geo_node_status_check_spec.rb
@@ -5,6 +5,7 @@
 RSpec.describe Gitlab::Geo::GeoNodeStatusCheck, :geo, feature_category: :geo_replication do
   include ::EE::GeoHelpers
 
+  let_it_be(:default_organization) { create(:organization, :default) } # rubocop:disable Gitlab/RSpec/AvoidCreateDefaultOrganization -- todo
   let_it_be(:current_node) { create(:geo_node) }
 
   let(:geo_node_status) do
diff --git a/ee/spec/lib/gitlab/geo/geo_tasks_spec.rb b/ee/spec/lib/gitlab/geo/geo_tasks_spec.rb
index 3a35e4815c131757255a1d146088b40771744cab..833dddd1e19fb93a4a04a36dcbde57a433b824b5 100644
--- a/ee/spec/lib/gitlab/geo/geo_tasks_spec.rb
+++ b/ee/spec/lib/gitlab/geo/geo_tasks_spec.rb
@@ -5,6 +5,8 @@
 RSpec.describe Gitlab::Geo::GeoTasks, feature_category: :geo_replication do
   include ::EE::GeoHelpers
 
+  let_it_be(:default_organization) { create(:organization, :default) } # rubocop:disable Gitlab/RSpec/AvoidCreateDefaultOrganization -- todo
+
   describe '.set_primary_geo_node' do
     before do
       allow(GeoNode).to receive(:current_node_name).and_return('https://primary.geo.example.com')
diff --git a/ee/spec/lib/gitlab/geo/git_push_http_spec.rb b/ee/spec/lib/gitlab/geo/git_push_http_spec.rb
index a6a23ea08c6d060483d2206155aca5a2470f5541..95fc0156681e004d894b8cff8dc3d21892be0587 100644
--- a/ee/spec/lib/gitlab/geo/git_push_http_spec.rb
+++ b/ee/spec/lib/gitlab/geo/git_push_http_spec.rb
@@ -7,6 +7,7 @@
   feature_category: :geo_replication do
   include EE::GeoHelpers
 
+  let_it_be(:default_organization) { create(:organization, :default) } # rubocop:disable Gitlab/RSpec/AvoidCreateDefaultOrganization -- todo
   let(:gl_id) { 'user-1234' }
   let(:gl_repository) { 'project-77777' }
   let(:cache_key) { "#{described_class::CACHE_KEY_PREFIX}:#{gl_id}:#{gl_repository}" }
diff --git a/ee/spec/lib/gitlab/geo/health_check_spec.rb b/ee/spec/lib/gitlab/geo/health_check_spec.rb
index e1a895a16bdbf0fd9998a3699df1679772541c3f..7b7f350a65d15a404378b53e2b93f4c469b91173 100644
--- a/ee/spec/lib/gitlab/geo/health_check_spec.rb
+++ b/ee/spec/lib/gitlab/geo/health_check_spec.rb
@@ -6,6 +6,7 @@
   include ::EE::GeoHelpers
   using RSpec::Parameterized::TableSyntax
 
+  let_it_be(:default_organization) { create(:organization, :default) } # rubocop:disable Gitlab/RSpec/AvoidCreateDefaultOrganization -- todo
   let_it_be(:secondary) { create(:geo_node) }
 
   describe '#perform_checks' do
diff --git a/ee/spec/lib/gitlab/geo/replication/blob_downloader_spec.rb b/ee/spec/lib/gitlab/geo/replication/blob_downloader_spec.rb
index f8a43d9fba9890f6cf7aa13421f4fd97fc48f2a6..9ab83e62d56474d6e258bebc70ffda6a8c3f5195 100644
--- a/ee/spec/lib/gitlab/geo/replication/blob_downloader_spec.rb
+++ b/ee/spec/lib/gitlab/geo/replication/blob_downloader_spec.rb
@@ -5,6 +5,7 @@
 RSpec.describe Gitlab::Geo::Replication::BlobDownloader, feature_category: :geo_replication do
   include ::EE::GeoHelpers
 
+  let_it_be(:default_organization) { create(:organization, :default) } # rubocop:disable Gitlab/RSpec/AvoidCreateDefaultOrganization -- todo
   let_it_be(:primary) { create(:geo_node, :primary) }
   let_it_be(:secondary) { create(:geo_node) }
 
diff --git a/ee/spec/lib/gitlab/geo_spec.rb b/ee/spec/lib/gitlab/geo_spec.rb
index 0214c3f00f8172f04bce73a16241c8353ec69e62..ffbf8e2550065d341d0f51e92c4056046b849c0d 100644
--- a/ee/spec/lib/gitlab/geo_spec.rb
+++ b/ee/spec/lib/gitlab/geo_spec.rb
@@ -6,6 +6,7 @@
   using RSpec::Parameterized::TableSyntax
   include ::EE::GeoHelpers
 
+  let_it_be(:default_organization) { create(:organization, :default) } # rubocop:disable Gitlab/RSpec/AvoidCreateDefaultOrganization -- todo
   let_it_be(:primary_node)   { create(:geo_node, :primary) }
   let_it_be(:secondary_node) { create(:geo_node) }
 
diff --git a/ee/spec/lib/system_check/rake_task/geo_task_spec.rb b/ee/spec/lib/system_check/rake_task/geo_task_spec.rb
index 77c337929f2c079dc66700173ac93102ca94509f..ed12347e4b317e43ccf05f559059c7c3c712ebfb 100644
--- a/ee/spec/lib/system_check/rake_task/geo_task_spec.rb
+++ b/ee/spec/lib/system_check/rake_task/geo_task_spec.rb
@@ -5,6 +5,7 @@
 RSpec.describe SystemCheck::RakeTask::GeoTask, feature_category: :geo_replication do
   include ::EE::GeoHelpers
 
+  let!(:default_organization) { create(:organization, :default) } # rubocop:disable Gitlab/RSpec/AvoidCreateDefaultOrganization -- todo
   let(:common_checks) do
     [
       Geo::SystemCheck::LicenseCheck,
diff --git a/ee/spec/models/concerns/geo/verification_state_spec.rb b/ee/spec/models/concerns/geo/verification_state_spec.rb
index 08ec04fe93a50b59d2c1233e38c0d35c7ae988b3..7b94f3da6362350fe6afaadcc7b2fc409b44721c 100644
--- a/ee/spec/models/concerns/geo/verification_state_spec.rb
+++ b/ee/spec/models/concerns/geo/verification_state_spec.rb
@@ -5,6 +5,7 @@
 RSpec.describe Geo::VerificationState, feature_category: :geo_replication do
   include ::EE::GeoHelpers
 
+  let_it_be(:default_organization) { create(:organization, :default) } # rubocop:disable Gitlab/RSpec/AvoidCreateDefaultOrganization -- todo
   let_it_be(:primary_node) { create(:geo_node, :primary) }
   let_it_be(:secondary_node) { create(:geo_node, :secondary) }
 
diff --git a/ee/spec/models/geo_node_spec.rb b/ee/spec/models/geo_node_spec.rb
index 89ab746809c1dccf998dd44250d8c71ffbe17f78..dade6c1fa6bf97241fc57be08c8a5fb8d4820455 100644
--- a/ee/spec/models/geo_node_spec.rb
+++ b/ee/spec/models/geo_node_spec.rb
@@ -6,6 +6,7 @@
   using RSpec::Parameterized::TableSyntax
   include ::EE::GeoHelpers
 
+  let_it_be(:default_organization) { create(:organization, :default) } # rubocop:disable Gitlab/RSpec/AvoidCreateDefaultOrganization -- todo
   let(:dummy_url) { 'https://localhost:3000/gitlab' }
   let(:new_node_attrs) { { url: dummy_url } }
   let(:new_node) { create(:geo_node, new_node_attrs) }
diff --git a/ee/spec/models/geo_node_status_spec.rb b/ee/spec/models/geo_node_status_spec.rb
index 23f43ba09acff94abd73e1760c2b01760a1a8748..b08bd60764c014ff9ec3adcd87f4f31e79560127 100644
--- a/ee/spec/models/geo_node_status_spec.rb
+++ b/ee/spec/models/geo_node_status_spec.rb
@@ -7,6 +7,7 @@
 
   using RSpec::Parameterized::TableSyntax
 
+  let_it_be(:default_organization) { create(:organization, :default) } # rubocop:disable Gitlab/RSpec/AvoidCreateDefaultOrganization -- todo
   let_it_be(:primary) { create(:geo_node, :primary) }
   let_it_be(:secondary) { create(:geo_node, :secondary) }
 
diff --git a/ee/spec/models/repository_spec.rb b/ee/spec/models/repository_spec.rb
index 3277e7e8b487ccaffb9da10251918202889c9615..2791630e3de2f7f6678f300558557da9750afac8 100644
--- a/ee/spec/models/repository_spec.rb
+++ b/ee/spec/models/repository_spec.rb
@@ -11,6 +11,7 @@
     stub_feature_flags(geo_project_repository_replication_v2: false)
   end
 
+  let_it_be(:default_organization) { create(:organization, :default) } # rubocop:disable Gitlab/RSpec/AvoidCreateDefaultOrganization -- todo
   let_it_be(:primary_node)   { create(:geo_node, :primary) }
   let_it_be(:secondary_node) { create(:geo_node) }
 
diff --git a/ee/spec/models/upload_spec.rb b/ee/spec/models/upload_spec.rb
index 570addb4edb5f6b69e9566278a6cf2bfcbef74ea..0d02a5a5b18e096d64439225e7efc1e92303c385 100644
--- a/ee/spec/models/upload_spec.rb
+++ b/ee/spec/models/upload_spec.rb
@@ -5,6 +5,8 @@
 RSpec.describe Upload, feature_category: :geo_replication do
   include EE::GeoHelpers
 
+  let_it_be(:default_organization) { create(:organization, :default) } # rubocop:disable Gitlab/RSpec/AvoidCreateDefaultOrganization -- todo
+
   it { is_expected.to have_one(:upload_state).inverse_of(:upload).class_name('Geo::UploadState') }
 
   include_examples 'a verifiable model for verification state' do
diff --git a/ee/spec/policies/geo_node_policy_spec.rb b/ee/spec/policies/geo_node_policy_spec.rb
index c3d9c8a297ee9e074ba5be5b0bccb114f550eb93..ebbef54eb112a42ca47358d13bab55987e160e41 100644
--- a/ee/spec/policies/geo_node_policy_spec.rb
+++ b/ee/spec/policies/geo_node_policy_spec.rb
@@ -3,6 +3,7 @@
 require 'spec_helper'
 
 RSpec.describe GeoNodePolicy, feature_category: :geo_replication do
+  let_it_be(:default_organization) { create(:organization, :default) } # rubocop:disable Gitlab/RSpec/AvoidCreateDefaultOrganization -- todo
   let_it_be(:geo_node) { create(:geo_node) }
 
   subject(:policy) { described_class.new(current_user, geo_node) }
diff --git a/ee/spec/replicators/geo/container_repository_replicator_spec.rb b/ee/spec/replicators/geo/container_repository_replicator_spec.rb
index 2dafe09d7494636ecddfe81ee00859eaca940243..91831882668fd2401b60fdc1713f4b654d72c015 100644
--- a/ee/spec/replicators/geo/container_repository_replicator_spec.rb
+++ b/ee/spec/replicators/geo/container_repository_replicator_spec.rb
@@ -5,6 +5,7 @@
 RSpec.describe Geo::ContainerRepositoryReplicator, :geo, feature_category: :geo_replication do
   include_context 'container registry client stubs'
 
+  let_it_be(:default_organization) { create(:organization, :default) } # rubocop:disable Gitlab/RSpec/AvoidCreateDefaultOrganization -- todo
   let_it_be(:primary) { create(:geo_node, :primary) }
   let_it_be(:secondary) { create(:geo_node) }
 
diff --git a/ee/spec/replicators/geo/design_management_repository_replicator_spec.rb b/ee/spec/replicators/geo/design_management_repository_replicator_spec.rb
index 67e624d4209169063f4c69dbd53f6b13aaf97020..fc585608f7436b92d7e29b3616d2083e0307403f 100644
--- a/ee/spec/replicators/geo/design_management_repository_replicator_spec.rb
+++ b/ee/spec/replicators/geo/design_management_repository_replicator_spec.rb
@@ -3,6 +3,7 @@
 require 'spec_helper'
 
 RSpec.describe Geo::DesignManagementRepositoryReplicator, feature_category: :geo_replication do
+  let_it_be(:default_organization) { create(:organization, :default) } # rubocop:disable Gitlab/RSpec/AvoidCreateDefaultOrganization -- todo
   let(:model_record) { create(:design_management_repository, project: create(:project)) }
 
   include_examples 'a repository replicator' do
diff --git a/ee/spec/replicators/geo/pages_deployment_replicator_spec.rb b/ee/spec/replicators/geo/pages_deployment_replicator_spec.rb
index 7f360ddd449133faaed259030760d2757e53c4a7..e5bbfea39ee621f99421dfcc0374ffc6a916eb3b 100644
--- a/ee/spec/replicators/geo/pages_deployment_replicator_spec.rb
+++ b/ee/spec/replicators/geo/pages_deployment_replicator_spec.rb
@@ -3,6 +3,7 @@
 require 'spec_helper'
 
 RSpec.describe Geo::PagesDeploymentReplicator, feature_category: :geo_replication do
+  let_it_be(:default_organization) { create(:organization, :default) } # rubocop:disable Gitlab/RSpec/AvoidCreateDefaultOrganization -- todo
   let(:model_record) { create(:pages_deployment) }
 
   include_examples 'a blob replicator'
diff --git a/ee/spec/replicators/geo/pipeline_artifact_replicator_spec.rb b/ee/spec/replicators/geo/pipeline_artifact_replicator_spec.rb
index b9e0c7934d62f52aaa9eb44c59328c947c3e63c7..252bf6dccff180fa472406358f503268015972bd 100644
--- a/ee/spec/replicators/geo/pipeline_artifact_replicator_spec.rb
+++ b/ee/spec/replicators/geo/pipeline_artifact_replicator_spec.rb
@@ -3,6 +3,7 @@
 require 'spec_helper'
 
 RSpec.describe Geo::PipelineArtifactReplicator, feature_category: :geo_replication do
+  let_it_be(:default_organization) { create(:organization, :default) } # rubocop:disable Gitlab/RSpec/AvoidCreateDefaultOrganization -- todo
   let(:model_record) { create(:ci_pipeline_artifact, :with_coverage_report) }
 
   include_examples 'a blob replicator'
diff --git a/ee/spec/replicators/geo/project_repository_replicator_spec.rb b/ee/spec/replicators/geo/project_repository_replicator_spec.rb
index d3b8eff04d1d708bcb2bfab06156d713984c27d8..871c0e7e81a84906904d008dec1decd1111081ea 100644
--- a/ee/spec/replicators/geo/project_repository_replicator_spec.rb
+++ b/ee/spec/replicators/geo/project_repository_replicator_spec.rb
@@ -5,6 +5,7 @@
 RSpec.describe Geo::ProjectRepositoryReplicator, feature_category: :geo_replication do
   include EE::GeoHelpers
 
+  let_it_be(:default_organization) { create(:organization, :default) } # rubocop:disable Gitlab/RSpec/AvoidCreateDefaultOrganization -- todo
   let(:project) { create(:project_with_repo) }
   let(:model_record) { project }
   let(:primary_node) { create(:geo_node, :primary) }
diff --git a/ee/spec/replicators/geo/upload_replicator_spec.rb b/ee/spec/replicators/geo/upload_replicator_spec.rb
index 3f1db176d3c97c10c9dd7a6a60ae9963de846913..b3da89979468b4c38c58b3bae7446700b01dac7f 100644
--- a/ee/spec/replicators/geo/upload_replicator_spec.rb
+++ b/ee/spec/replicators/geo/upload_replicator_spec.rb
@@ -3,6 +3,7 @@
 require 'spec_helper'
 
 RSpec.describe Geo::UploadReplicator, feature_category: :geo_replication do
+  let_it_be(:default_organization) { create(:organization, :default) } # rubocop:disable Gitlab/RSpec/AvoidCreateDefaultOrganization -- todo
   let(:model_record) { create(:upload, :with_file) }
 
   include_examples 'a blob replicator'
diff --git a/ee/spec/requests/api/admin/data_management_spec.rb b/ee/spec/requests/api/admin/data_management_spec.rb
index 49369f8db5652a738bf35f7d47aece71b14be8d5..3cdcd640e54802fabe8416e2b5f57b52ed63dfa0 100644
--- a/ee/spec/requests/api/admin/data_management_spec.rb
+++ b/ee/spec/requests/api/admin/data_management_spec.rb
@@ -6,6 +6,7 @@
   include ApiHelpers
   include EE::GeoHelpers
 
+  let_it_be(:default_organization) { create(:organization, :default) } # rubocop:disable Gitlab/RSpec/AvoidCreateDefaultOrganization -- todo
   let_it_be(:admin) { create(:admin) }
   let_it_be(:user) { create(:user) }
 
diff --git a/ee/spec/requests/api/graphql/geo/registries_spec.rb b/ee/spec/requests/api/graphql/geo/registries_spec.rb
index f723e729b61f4c66862471a3fb7a6017b4b54baf..56e0a5d7e318623ac0fe5db94ab09a0f78e37897 100644
--- a/ee/spec/requests/api/graphql/geo/registries_spec.rb
+++ b/ee/spec/requests/api/graphql/geo/registries_spec.rb
@@ -3,6 +3,8 @@
 require 'spec_helper'
 
 RSpec.describe 'Gets registries', feature_category: :geo_replication do
+  let_it_be(:default_organization) { create(:organization, :default) } # rubocop:disable Gitlab/RSpec/AvoidCreateDefaultOrganization -- todo
+
   it_behaves_like 'gets registries for', {
     field_name: 'mergeRequestDiffRegistries',
     registry_class_name: 'MergeRequestDiffRegistry',
diff --git a/ee/spec/requests/api/graphql/mutations/geo/registries/update_spec.rb b/ee/spec/requests/api/graphql/mutations/geo/registries/update_spec.rb
index 7ecd3dd2e3491829f59cad492faff254cc69d9d4..feb40de085430ee9a95ade2c35943214192a357f 100644
--- a/ee/spec/requests/api/graphql/mutations/geo/registries/update_spec.rb
+++ b/ee/spec/requests/api/graphql/mutations/geo/registries/update_spec.rb
@@ -6,6 +6,8 @@
   include GraphqlHelpers
   include EE::GeoHelpers
 
+  let_it_be(:default_organization) { create(:organization, :default) } # rubocop:disable Gitlab/RSpec/AvoidCreateDefaultOrganization -- todo
+
   let(:mutation_name) { :geo_registries_update }
 
   let_it_be(:current_user) { create(:user, :admin) }
diff --git a/ee/spec/requests/api/graphql_spec.rb b/ee/spec/requests/api/graphql_spec.rb
index 63db675cfa4fcabdf92ae3f384b05251d7a081c5..7ded4179b7060ef2753860120f2630952ce2d536 100644
--- a/ee/spec/requests/api/graphql_spec.rb
+++ b/ee/spec/requests/api/graphql_spec.rb
@@ -6,6 +6,7 @@
   include GraphqlHelpers
   include ::EE::GeoHelpers
 
+  let_it_be(:default_organization) { create(:organization, :default) } # rubocop:disable Gitlab/RSpec/AvoidCreateDefaultOrganization -- todo
   let_it_be(:project) { create(:project, :public) }
   let_it_be(:current_user) { create(:user, developer_of: [project]) }
   let_it_be(:resource) { create(:issue, project: project) }
diff --git a/ee/spec/requests/api/internal/base_spec.rb b/ee/spec/requests/api/internal/base_spec.rb
index 0d80acf46317c9a4f56184921dee2a96327b0b0a..efd9bf17e3d69841b4a0e5a16d1caa7630df4402 100644
--- a/ee/spec/requests/api/internal/base_spec.rb
+++ b/ee/spec/requests/api/internal/base_spec.rb
@@ -8,6 +8,7 @@
   include NamespaceStorageHelpers
   include GitlabSubscriptions::SubscriptionHelpers
 
+  let_it_be(:default_organization) { create(:organization, :default) } # rubocop:disable Gitlab/RSpec/AvoidCreateDefaultOrganization -- todo
   let_it_be(:primary_url) { 'http://primary.example.com' }
   let_it_be(:secondary_url) { 'http://secondary.example.com' }
   let_it_be(:primary_node, reload: true) { create(:geo_node, :primary, url: primary_url) }
diff --git a/ee/spec/requests/git_http_geo_spec.rb b/ee/spec/requests/git_http_geo_spec.rb
index b27652a1ec73339a8e211ed8ff7d8d822767203a..27e0982b4f43b4717e8aca5624edfd1302f7d7bd 100644
--- a/ee/spec/requests/git_http_geo_spec.rb
+++ b/ee/spec/requests/git_http_geo_spec.rb
@@ -9,6 +9,7 @@
   include WorkhorseHelpers
   using RSpec::Parameterized::TableSyntax
 
+  let_it_be(:default_organization) { create(:organization, :default) } # rubocop:disable Gitlab/RSpec/AvoidCreateDefaultOrganization -- todo
   let_it_be(:project_with_repo) { create(:project, :repository, :private) }
   let_it_be(:project_no_repo) { create(:project, :private) }
   let_it_be(:project_registry_with_repo) { create(:geo_project_repository_registry, :verification_succeeded, project: project_with_repo, last_synced_at: project_with_repo.last_repository_updated_at + 10.seconds) }
@@ -314,6 +315,7 @@ def make_request
               end
             end
 
+            # rubocop:disable RSpec/MultipleMemoizedHelpers -- todo
             context 'when the repository does not exist' do
               let_it_be(:project) { project_no_repo }
 
@@ -321,6 +323,7 @@ def make_request
 
               it_behaves_like 'a Geo 302 redirect to Primary'
             end
+            # rubocop:enable RSpec/MultipleMemoizedHelpers
 
             context 'batch requests' do
               let_it_be(:project) { project_with_repo }
@@ -338,6 +341,7 @@ def make_request
                 end
               end
 
+              # rubocop:disable RSpec/MultipleMemoizedHelpers -- todo
               context 'objects are not in sync' do
                 let(:redirect_url) { full_redirected_url }
                 let(:registry) { create(:geo_lfs_object_registry, :started) }
@@ -345,6 +349,7 @@ def make_request
 
                 it_behaves_like 'a Geo 302 redirect to Primary'
               end
+              # rubocop:enable RSpec/MultipleMemoizedHelpers
             end
 
             where(:description, :version) do
diff --git a/ee/spec/services/ai/amazon_q/create_service_spec.rb b/ee/spec/services/ai/amazon_q/create_service_spec.rb
index ce125f3418f006ba5588602df2b8978d5aff0fe7..a7161b315fa99079fe6508ab6d333c1641dc413f 100644
--- a/ee/spec/services/ai/amazon_q/create_service_spec.rb
+++ b/ee/spec/services/ai/amazon_q/create_service_spec.rb
@@ -7,6 +7,7 @@
     let_it_be(:add_on_purchase) { create(:gitlab_subscription_add_on_purchase, :duo_amazon_q) }
     let_it_be(:organization) { create(:organization) }
     let_it_be(:user) { create(:admin, organizations: [organization]) }
+    # TODO: needs `organization_id`
     let_it_be(:doorkeeper_application) { create(:doorkeeper_application) }
     let_it_be(:base_params) do
       { role_arn: 'a', availability: 'default_on', auto_review_enabled: true, organization_id: organization.id }
diff --git a/ee/spec/services/ee/post_receive_service_spec.rb b/ee/spec/services/ee/post_receive_service_spec.rb
index 5653b043bbee4a93cc2d6b7e7ab669d1b0c626fc..76e274f15dfff50a283e44000c3db94b0de3e8d5 100644
--- a/ee/spec/services/ee/post_receive_service_spec.rb
+++ b/ee/spec/services/ee/post_receive_service_spec.rb
@@ -5,6 +5,7 @@
 RSpec.describe PostReceiveService, :geo, feature_category: :team_planning do
   include EE::GeoHelpers
 
+  let_it_be(:default_organization) { create(:organization, :default) } # rubocop:disable Gitlab/RSpec/AvoidCreateDefaultOrganization -- todo
   let_it_be(:primary_url) { 'http://primary.example.com' }
   let_it_be(:secondary_url) { 'http://secondary.example.com' }
   let_it_be(:primary_node, reload: true) { create(:geo_node, :primary, url: primary_url) }
diff --git a/ee/spec/services/geo/blob_download_service_spec.rb b/ee/spec/services/geo/blob_download_service_spec.rb
index 827cc68275ebb6144949f7e646efea83a04728fd..28960fcc0cac23a955a4db1b7b218965cdf78292 100644
--- a/ee/spec/services/geo/blob_download_service_spec.rb
+++ b/ee/spec/services/geo/blob_download_service_spec.rb
@@ -6,6 +6,7 @@
   include ::EE::GeoHelpers
   include ExclusiveLeaseHelpers
 
+  let_it_be(:default_organization) { create(:organization, :default) } # rubocop:disable Gitlab/RSpec/AvoidCreateDefaultOrganization -- todo
   let_it_be(:primary) { create(:geo_node, :primary) }
   let_it_be(:secondary) { create(:geo_node) }
 
diff --git a/ee/spec/services/geo/event_service_spec.rb b/ee/spec/services/geo/event_service_spec.rb
index 1deec62761b2f151e63ee13ebacf9e1133fea367..d223cf29e7281172cd736a794626fcbe6fbb4cac 100644
--- a/ee/spec/services/geo/event_service_spec.rb
+++ b/ee/spec/services/geo/event_service_spec.rb
@@ -5,6 +5,7 @@
 RSpec.describe Geo::EventService, feature_category: :geo_replication do
   include ::EE::GeoHelpers
 
+  let_it_be(:default_organization) { create(:organization, :default) } # rubocop:disable Gitlab/RSpec/AvoidCreateDefaultOrganization -- todo
   let_it_be(:primary) { create(:geo_node, :primary) }
   let_it_be(:secondary) { create(:geo_node) }
 
diff --git a/ee/spec/services/geo/file_registry_removal_service_spec.rb b/ee/spec/services/geo/file_registry_removal_service_spec.rb
index 4d2334a561a6172d300eed0ae097605200a71612..e86c3ca9a5dd0f4084fdfd1ffdf16756af7b3195 100644
--- a/ee/spec/services/geo/file_registry_removal_service_spec.rb
+++ b/ee/spec/services/geo/file_registry_removal_service_spec.rb
@@ -6,6 +6,7 @@
   include ::EE::GeoHelpers
   include ExclusiveLeaseHelpers
 
+  let_it_be(:default_organization) { create(:organization, :default) } # rubocop:disable Gitlab/RSpec/AvoidCreateDefaultOrganization -- todo
   let_it_be(:secondary) { create(:geo_node) }
 
   before do
diff --git a/ee/spec/services/geo/graphql_request_service_spec.rb b/ee/spec/services/geo/graphql_request_service_spec.rb
index 5c2b492a51bbe17c3bd7fde493ba3e6c8d15131a..e80b284ed8a2ba9efc948dba9b809452ac8983e5 100644
--- a/ee/spec/services/geo/graphql_request_service_spec.rb
+++ b/ee/spec/services/geo/graphql_request_service_spec.rb
@@ -6,6 +6,7 @@
   include ::EE::GeoHelpers
   include ApiHelpers
 
+  let_it_be(:default_organization) { create(:organization, :default) } # rubocop:disable Gitlab/RSpec/AvoidCreateDefaultOrganization -- todo
   let_it_be(:primary)   { create(:geo_node, :primary) }
   let_it_be(:secondary) { create(:geo_node) }
   let_it_be(:user) { create(:user) }
diff --git a/ee/spec/services/geo/node_update_service_spec.rb b/ee/spec/services/geo/node_update_service_spec.rb
index a6579039cfc62d30267b17e0caacc8aa28f2bec1..77089ad8afd1e69685dc178c6d2d927bfaa36eb0 100644
--- a/ee/spec/services/geo/node_update_service_spec.rb
+++ b/ee/spec/services/geo/node_update_service_spec.rb
@@ -5,6 +5,7 @@
 RSpec.describe Geo::NodeUpdateService, feature_category: :geo_replication do
   include EE::GeoHelpers
 
+  let_it_be(:default_organization) { create(:organization, :default) } # rubocop:disable Gitlab/RSpec/AvoidCreateDefaultOrganization -- todo
   let_it_be(:primary, reload: true) { create(:geo_node, :primary) }
   let!(:geo_node) { create(:geo_node) }
 
diff --git a/ee/spec/services/geo/registry_consistency_service_spec.rb b/ee/spec/services/geo/registry_consistency_service_spec.rb
index 581fe7192853dc6303369185d17c530d26b3878e..37036ca43a307e5ba423fbaea2574ee413d775ba 100644
--- a/ee/spec/services/geo/registry_consistency_service_spec.rb
+++ b/ee/spec/services/geo/registry_consistency_service_spec.rb
@@ -8,6 +8,7 @@
   feature_category: :geo_replication do
   include EE::GeoHelpers
 
+  let_it_be(:default_organization) { create(:organization, :default) } # rubocop:disable Gitlab/RSpec/AvoidCreateDefaultOrganization -- todo
   let(:secondary) { create(:geo_node) }
 
   before do
diff --git a/ee/spec/services/projects/destroy_service_spec.rb b/ee/spec/services/projects/destroy_service_spec.rb
index 787025c1fce8c17dafd8f0cc9481f99878362694..7b8d4adec8319e7e136ab24325fd0bd2ad8f4f81 100644
--- a/ee/spec/services/projects/destroy_service_spec.rb
+++ b/ee/spec/services/projects/destroy_service_spec.rb
@@ -6,6 +6,7 @@
   include EE::GeoHelpers
   include BatchDestroyDependentAssociationsHelper
 
+  let_it_be(:default_organization) { create(:organization, :default) } # rubocop:disable Gitlab/RSpec/AvoidCreateDefaultOrganization -- todo
   let!(:user) { create(:user) }
   let!(:project) { create(:project, :repository, namespace: user.namespace) }
   let!(:project_id) { project.id }
diff --git a/ee/spec/support/shared_examples/graphql/geo/geo_registries_resolver_shared_examples.rb b/ee/spec/support/shared_examples/graphql/geo/geo_registries_resolver_shared_examples.rb
index 82c3d8f2d3bfeabdbddee6aabf725de7af8969c5..10ec43e2070894e11082f7fe9d502e22ee3b9ad2 100644
--- a/ee/spec/support/shared_examples/graphql/geo/geo_registries_resolver_shared_examples.rb
+++ b/ee/spec/support/shared_examples/graphql/geo/geo_registries_resolver_shared_examples.rb
@@ -4,6 +4,7 @@
   include GraphqlHelpers
   include EE::GeoHelpers
 
+  let_it_be(:default_organization) { create(:organization, :default) } # rubocop:disable Gitlab/RSpec/AvoidCreateDefaultOrganization -- todo
   let_it_be(:secondary) { create(:geo_node) }
 
   before do
diff --git a/ee/spec/support/shared_examples/models/concerns/blob_replicator_strategy_shared_examples.rb b/ee/spec/support/shared_examples/models/concerns/blob_replicator_strategy_shared_examples.rb
index d6d9b85fbb0b9c4ab5025e244e88238c269b7d5e..b873a037058d6ad7468003177d87752761195a0c 100644
--- a/ee/spec/support/shared_examples/models/concerns/blob_replicator_strategy_shared_examples.rb
+++ b/ee/spec/support/shared_examples/models/concerns/blob_replicator_strategy_shared_examples.rb
@@ -12,6 +12,7 @@
 RSpec.shared_examples 'a blob replicator' do
   include EE::GeoHelpers
 
+  let_it_be(:default_organization) { create(:organization, :default) } # rubocop:disable Gitlab/RSpec/AvoidCreateDefaultOrganization -- todo
   let_it_be(:primary) { create(:geo_node, :primary) }
   let_it_be(:secondary) { create(:geo_node) }
 
diff --git a/ee/spec/support/shared_examples/models/concerns/repository_replicator_strategy_shared_examples.rb b/ee/spec/support/shared_examples/models/concerns/repository_replicator_strategy_shared_examples.rb
index aabfe4a57c14a7cd96b8efd06e82ab2dcd3334a7..c9177ca5d7d0bfbad92f1df9896d3b23f20d4663 100644
--- a/ee/spec/support/shared_examples/models/concerns/repository_replicator_strategy_shared_examples.rb
+++ b/ee/spec/support/shared_examples/models/concerns/repository_replicator_strategy_shared_examples.rb
@@ -12,6 +12,7 @@
 RSpec.shared_examples 'a repository replicator' do
   include EE::GeoHelpers
 
+  let_it_be(:default_organization) { create(:organization, :default) } # rubocop:disable Gitlab/RSpec/AvoidCreateDefaultOrganization -- todo
   let_it_be(:primary) { create(:geo_node, :primary) }
   let_it_be(:secondary) { create(:geo_node) }
 
diff --git a/ee/spec/support/shared_examples/workers/geo/framework_registry_sync_worker_shared_examples.rb b/ee/spec/support/shared_examples/workers/geo/framework_registry_sync_worker_shared_examples.rb
index 00134270dbef2beb8409287056152d87ef48bf5d..753a545aa36a39d5f383782382e75540a1784be6 100644
--- a/ee/spec/support/shared_examples/workers/geo/framework_registry_sync_worker_shared_examples.rb
+++ b/ee/spec/support/shared_examples/workers/geo/framework_registry_sync_worker_shared_examples.rb
@@ -4,6 +4,7 @@
   describe '#perform', :use_sql_query_cache_for_tracking_db do
     include ExclusiveLeaseHelpers
 
+    let_it_be(:default_organization) { create(:organization, :default) } # rubocop:disable Gitlab/RSpec/AvoidCreateDefaultOrganization -- todo
     let!(:primary) { create(:geo_node, :primary) }
     let(:secondary) { create(:geo_node) }
 
diff --git a/ee/spec/tasks/geo_rake_spec.rb b/ee/spec/tasks/geo_rake_spec.rb
index 92159ef28353e864c053487e51c111d0ab03b9b2..023245eb14719ce24270167b9cd6f4880a20b61a 100644
--- a/ee/spec/tasks/geo_rake_spec.rb
+++ b/ee/spec/tasks/geo_rake_spec.rb
@@ -5,6 +5,8 @@
 RSpec.describe 'geo rake tasks', :geo, :silence_stdout, feature_category: :geo_replication do
   include ::EE::GeoHelpers
 
+  let!(:default_organization) { create(:organization, :default) } # rubocop:disable Gitlab/RSpec/AvoidCreateDefaultOrganization -- todo
+
   before do
     Rake.application.rake_require 'active_record/railties/databases'
     Rake.application.rake_require 'tasks/gitlab/db'
diff --git a/ee/spec/views/layouts/header/_read_only_banner.html.haml_spec.rb b/ee/spec/views/layouts/header/_read_only_banner.html.haml_spec.rb
index 74785175f457cae6d46b7adb6d6abdb9b9396971..6f445c8e66bd053143edf09acb80e097faa90ace 100644
--- a/ee/spec/views/layouts/header/_read_only_banner.html.haml_spec.rb
+++ b/ee/spec/views/layouts/header/_read_only_banner.html.haml_spec.rb
@@ -5,6 +5,7 @@
 RSpec.describe 'layouts/header/_read_only_banner' do
   include EE::GeoHelpers
 
+  let_it_be(:default_organization) { create(:organization, :default) } # rubocop:disable Gitlab/RSpec/AvoidCreateDefaultOrganization -- todo
   let_it_be(:geo_primary) { create(:geo_node, :primary) }
   let_it_be(:geo_secondary) { create(:geo_node) }
 
diff --git a/ee/spec/workers/ee/repository_check/batch_worker_spec.rb b/ee/spec/workers/ee/repository_check/batch_worker_spec.rb
index f3558b1408a963b398194426d23673c080444a59..5ae608bd82c380967200cacbc489960b1b312ca5 100644
--- a/ee/spec/workers/ee/repository_check/batch_worker_spec.rb
+++ b/ee/spec/workers/ee/repository_check/batch_worker_spec.rb
@@ -5,6 +5,7 @@
 RSpec.describe EE::RepositoryCheck::BatchWorker, feature_category: :source_code_management do
   include ::EE::GeoHelpers
 
+  let_it_be(:default_organization) { create(:organization, :default) } # rubocop:disable Gitlab/RSpec/AvoidCreateDefaultOrganization -- todo
   let(:shard_name) { 'default' }
 
   subject(:worker) { RepositoryCheck::BatchWorker.new }
diff --git a/ee/spec/workers/geo/prune_event_log_worker_spec.rb b/ee/spec/workers/geo/prune_event_log_worker_spec.rb
index 1cbe9ac8fc26ec365a780cfed40d45f20d0dbfe1..cbdea36147ea06e7d79a69265b72cce60e251cb5 100644
--- a/ee/spec/workers/geo/prune_event_log_worker_spec.rb
+++ b/ee/spec/workers/geo/prune_event_log_worker_spec.rb
@@ -7,6 +7,7 @@
 
   subject(:worker) { described_class.new }
 
+  let_it_be(:default_organization) { create(:organization, :default) } # rubocop:disable Gitlab/RSpec/AvoidCreateDefaultOrganization -- todo
   let_it_be(:primary) { create(:geo_node, :primary) }
   let_it_be(:secondary, refind: true) { create(:geo_node) }
 
diff --git a/ee/spec/workers/geo/secondary/registry_consistency_worker_spec.rb b/ee/spec/workers/geo/secondary/registry_consistency_worker_spec.rb
index 8fc396eca3076620cc0b187c1ff41ae612351c2b..4de492b34350271f7d65492a22a25b17bf2d37ed 100644
--- a/ee/spec/workers/geo/secondary/registry_consistency_worker_spec.rb
+++ b/ee/spec/workers/geo/secondary/registry_consistency_worker_spec.rb
@@ -6,6 +6,7 @@
   include EE::GeoHelpers
   include ExclusiveLeaseHelpers
 
+  let_it_be(:default_organization) { create(:organization, :default) } # rubocop:disable Gitlab/RSpec/AvoidCreateDefaultOrganization -- todo
   let_it_be(:primary) { create(:geo_node, :primary) }
   let_it_be(:secondary) { create(:geo_node) }
 
diff --git a/spec/channels/application_cable/connection_spec.rb b/spec/channels/application_cable/connection_spec.rb
index 7c7690326cee54967db91d84c934c18a3e15b8be..cd80ba44b789e225404dae5a7f9a3241538dc243 100644
--- a/spec/channels/application_cable/connection_spec.rb
+++ b/spec/channels/application_cable/connection_spec.rb
@@ -96,7 +96,7 @@
         let(:user) { create(:user) }
 
         let(:application) do
-          Authn::OauthApplication.create!(name: "MyApp", redirect_uri: "https://app.com", owner: user)
+          create(:oauth_application, owner: user)
         end
 
         let(:oauth_token) do
diff --git a/spec/factories/doorkeeper.rb b/spec/factories/doorkeeper.rb
index 7cb09e6c25a4de194876cfb0fc61e0eabf1c0740..5867bfc825849ed76090ba201c746a23aeb33cf4 100644
--- a/spec/factories/doorkeeper.rb
+++ b/spec/factories/doorkeeper.rb
@@ -22,5 +22,6 @@
   factory :doorkeeper_application, class: 'Authn::OauthApplication' do
     sequence(:name) { |n| "Application #{n}" }
     redirect_uri { 'https://app.com/callback' }
+    organization
   end
 end
diff --git a/spec/factories/oauth_applications.rb b/spec/factories/oauth_applications.rb
index aa28c4e904fbe7fb6aba141134acae190bb2e27e..a85144d759ca98de24882e70c798a3ca30e5742c 100644
--- a/spec/factories/oauth_applications.rb
+++ b/spec/factories/oauth_applications.rb
@@ -2,11 +2,13 @@
 
 FactoryBot.define do
   factory :oauth_application, class: 'Authn::OauthApplication', aliases: [:application] do
+    # TODO: this needs organization
     sequence(:name) { |n| "OAuth App #{n}" }
     uid { Doorkeeper::OAuth::Helpers::UniqueToken.generate }
     redirect_uri { generate(:url) }
     owner
     owner_type { 'User' }
+    organization # Maybe this is good enough
   end
 
   trait :group_owned do
diff --git a/spec/lib/gitlab/auth_spec.rb b/spec/lib/gitlab/auth_spec.rb
index 49fd0c130ff47d899a449275bf4cf278d8821003..991633ff8982df4255ffcd69e757b945a9cdb164 100644
--- a/spec/lib/gitlab/auth_spec.rb
+++ b/spec/lib/gitlab/auth_spec.rb
@@ -544,7 +544,7 @@ def operation
       let_it_be(:organization) { create(:organization) }
 
       let(:user) { create(:user, organizations: [organization]) }
-      let(:application) { Authn::OauthApplication.create!(name: 'MyApp', redirect_uri: 'https://app.com', owner: user) }
+      let(:application) { create(:oauth_application, owner: user) }
       let(:scopes) { 'api' }
 
       let(:token) do
diff --git a/spec/lib/gitlab/organizations/sharding_key_spec.rb b/spec/lib/gitlab/organizations/sharding_key_spec.rb
index 5499b288fe21645c332b0e72e07d5b9304005c30..fdc1c7b3033dcbf81c78cf699da1977d6a892782 100644
--- a/spec/lib/gitlab/organizations/sharding_key_spec.rb
+++ b/spec/lib/gitlab/organizations/sharding_key_spec.rb
@@ -47,8 +47,7 @@
         bulk_import_batch_trackers.project_id
       ], # https://gitlab.com/gitlab-org/gitlab/-/merge_requests/213933
       'security_scans.project_id', # NOT NULL constraint NOT VALID
-      'keys.organization_id', # https://gitlab.com/gitlab-org/gitlab/-/issues/577246
-      'oauth_applications.organization_id' # https://gitlab.com/gitlab-org/gitlab/-/issues/579291
+      'keys.organization_id' # https://gitlab.com/gitlab-org/gitlab/-/issues/577246
     ]
   end
 
diff --git a/spec/lib/mattermost/session_spec.rb b/spec/lib/mattermost/session_spec.rb
index 36d5449abfe0eea1ca823b21990341d86570ab85..17adee9b3500a53ff6e988434a313130263ba99a 100644
--- a/spec/lib/mattermost/session_spec.rb
+++ b/spec/lib/mattermost/session_spec.rb
@@ -46,10 +46,12 @@
 
     context 'with oauth_uri' do
       let!(:doorkeeper) do
-        Authn::OauthApplication.create!(
+        create(
+          :oauth_application,
           name: 'GitLab Mattermost',
           redirect_uri: "#{mattermost_url}/signup/gitlab/complete\n#{mattermost_url}/login/gitlab/complete",
-          scopes: '')
+          scopes: ''
+        )
       end
 
       context 'without token_uri' do
diff --git a/spec/requests/api/doorkeeper_access_spec.rb b/spec/requests/api/doorkeeper_access_spec.rb
index 51aeb79e8b4910036f4ec6a8b583b12d358c2a13..bd13485c17aeef5a0bb4f3f1d5cc3ab4eee85013 100644
--- a/spec/requests/api/doorkeeper_access_spec.rb
+++ b/spec/requests/api/doorkeeper_access_spec.rb
@@ -5,7 +5,7 @@
 RSpec.describe 'doorkeeper access', feature_category: :system_access do
   let_it_be(:organization) { create(:organization) }
   let_it_be_with_reload(:user) { create(:user) }
-  let!(:application) { Authn::OauthApplication.create!(name: "MyApp", redirect_uri: "https://app.com", owner: user) }
+  let!(:application) { create(:oauth_application, owner: user) }
   let!(:token) { Doorkeeper::AccessToken.create! application_id: application.id, resource_owner_id: user.id, scopes: "api", organization_id: organization.id }
 
   describe 'access token with composite identity scope', :request_store do
diff --git a/spec/requests/git_http_spec.rb b/spec/requests/git_http_spec.rb
index fee92d486b5a6c62f03a5ebec2f162b44a576e19..886a9389f8a5d878b417a402bd14e98e68ecc7fe 100644
--- a/spec/requests/git_http_spec.rb
+++ b/spec/requests/git_http_spec.rb
@@ -652,12 +652,7 @@
                   .plaintext_token
                 end
 
-                let(:application) do
-                  Authn::OauthApplication.create!(
-                    name: "MyApp",
-                    redirect_uri: "https://app.com",
-                    owner: user)
-                end
+                let(:application) { create(:oauth_application, owner: user) }
 
                 let(:scopes) { 'api' }
                 let(:path) { "#{project.full_path}.git" }
@@ -1431,12 +1426,7 @@ def pull
                   .plaintext_token
                 end
 
-                let(:application) do
-                  Authn::OauthApplication.create!(
-                    name: "MyApp",
-                    redirect_uri: "https://app.com",
-                    owner: user)
-                end
+                let(:application) { create(:oauth_application, owner: user) }
 
                 let(:path) { "#{project.full_path}.git" }
                 let(:env) { { user: 'oauth2', password: token } }
diff --git a/spec/requests/oauth/dynamic_registrations_controller_spec.rb b/spec/requests/oauth/dynamic_registrations_controller_spec.rb
index 8c56efa12fd076bc7734fd96b09b261eac95010b..2f41aef66bd26dcf545fbac02f1799d7136b7754 100644
--- a/spec/requests/oauth/dynamic_registrations_controller_spec.rb
+++ b/spec/requests/oauth/dynamic_registrations_controller_spec.rb
@@ -3,6 +3,9 @@
 require 'spec_helper'
 
 RSpec.describe Oauth::DynamicRegistrationsController, feature_category: :system_access do
+  # TODO: confirm: in practice, is it possible for a GitLab install to have _no_ organization created? If so, then
+  # using Organization.first does not work.
+  let!(:default_organization) { create(:organization) }
   let(:oauth_registration_path) { Gitlab::Routing.url_helpers.oauth_register_path }
 
   let(:valid_request_body) do
diff --git a/spec/requests/rack_attack_global_spec.rb b/spec/requests/rack_attack_global_spec.rb
index b19a41f801d6c80c96b12d6c580544748641056b..88ad4b7e5afcfc1451ad6939215f801ee5cb39fa 100644
--- a/spec/requests/rack_attack_global_spec.rb
+++ b/spec/requests/rack_attack_global_spec.rb
@@ -147,11 +147,11 @@
 
   describe 'API requests authenticated with OAuth token', :api do
     let(:user) { create(:user) }
-    let(:application) { Authn::OauthApplication.create!(name: "MyApp", redirect_uri: "https://app.com", owner: user) }
+    let(:application) { create(:oauth_application, owner: user) }
     let(:token) { create(:oauth_access_token, application_id: application.id, resource_owner_id: user.id, scopes: "api", expires_in: period_in_seconds + 1) }
 
     let(:other_user) { create(:user) }
-    let(:other_user_application) { Authn::OauthApplication.create!(name: "MyApp", redirect_uri: "https://app.com", owner: other_user) }
+    let(:other_user_application) { create(:oauth_application, owner: other_user) }
     let(:other_user_token) { create(:oauth_access_token, application_id: application.id, resource_owner_id: other_user.id, scopes: "api") }
 
     let(:throttle_setting_prefix) { 'throttle_authenticated_api' }
@@ -1436,7 +1436,7 @@ def expect_authenticated_request
     end
 
     context 'authenticated with OAuth token' do
-      let(:application) { Authn::OauthApplication.create!(name: "MyApp", redirect_uri: "https://app.com", owner: user) }
+      let(:application) { create(:oauth_application, owner: user) }
       let(:oauth_token) { create(:oauth_access_token, application_id: application.id, resource_owner_id: user.id, scopes: "api", expires_in: period_in_seconds + 1) }
 
       it 'request is authenticated by token in query string' do
diff --git a/spec/services/applications/create_service_spec.rb b/spec/services/applications/create_service_spec.rb
index 82c16cbac6def91789acb30a27fc1612e0881183..6001b41e71007199172ff7ed43b845e851da444c 100644
--- a/spec/services/applications/create_service_spec.rb
+++ b/spec/services/applications/create_service_spec.rb
@@ -7,7 +7,8 @@
 
   let(:user) { create(:user) }
 
-  subject(:service) { described_class.new(user, test_request, params) }
+  # TODO: validate the _correct_ way to structure this
+  subject(:service) { described_class.new(user, test_request, params.merge(organization_id: user.organization.id)) }
 
   context 'when scopes are present' do
     let(:params) { attributes_for(:application, scopes: ['read_user']) }
@@ -15,7 +16,7 @@
     it { expect { subject.execute }.to change { Authn::OauthApplication.count }.by(1) }
 
     it 'leaves ROPC enabled' do
-      expect(service.execute.ropc_enabled?).to be_truthy
+      expect(subject.execute.ropc_enabled?).to be_truthy
     end
   end
 
diff --git a/spec/support/shared_examples/requests/api/read_user_shared_examples.rb b/spec/support/shared_examples/requests/api/read_user_shared_examples.rb
index 8873b5a198e7f4e13d5a0f54bc52a1f9487317a9..4f60d8cd2f274740e6a0b46b079f6cefed398913 100644
--- a/spec/support/shared_examples/requests/api/read_user_shared_examples.rb
+++ b/spec/support/shared_examples/requests/api/read_user_shared_examples.rb
@@ -52,7 +52,7 @@
   end
 
   context 'for doorkeeper (OAuth) tokens' do
-    let!(:application) { Authn::OauthApplication.create!(name: "MyApp", redirect_uri: "https://app.com", owner: user) }
+    let!(:application) { create(:oauth_application, owner: user) }
 
     context 'when the requesting token has the "api" scope' do
       let!(:token) do