diff --git a/Sources/Orders/OrdersServiceCustom.swift b/Sources/Orders/OrdersServiceCustom.swift
index 057ee44..664ae80 100644
--- a/Sources/Orders/OrdersServiceCustom.swift
+++ b/Sources/Orders/OrdersServiceCustom.swift
@@ -83,8 +83,8 @@ where O == R.OrderType, D == R.DeviceType {
             apnsConfig = APNSClientConfiguration(
                 authenticationMethod: try .tls(
                     privateKey: .privateKey(
-                        NIOSSLPrivateKey(file: privateKeyPath, format: .pem) { closure in
-                            closure(password.utf8)
+                        NIOSSLPrivateKey(file: privateKeyPath, format: .pem) { passphraseCallback in
+                            passphraseCallback(password.utf8)
                         }),
                     certificateChain: NIOSSLCertificate.fromPEMFile(pemPath).map {
                         .certificate($0)
@@ -143,7 +143,7 @@ where O == R.OrderType, D == R.DeviceType {
 
 // MARK: - API Routes
 extension OrdersServiceCustom {
-    func latestVersionOfOrder(req: Request) async throws -> Response {
+    fileprivate func latestVersionOfOrder(req: Request) async throws -> Response {
         logger?.debug("Called latestVersionOfOrder")
 
         var ifModifiedSince: TimeInterval = 0
@@ -180,7 +180,7 @@ extension OrdersServiceCustom {
         )
     }
 
-    func registerDevice(req: Request) async throws -> HTTPStatus {
+    fileprivate func registerDevice(req: Request) async throws -> HTTPStatus {
         logger?.debug("Called register device")
 
         let pushToken: String
@@ -236,7 +236,7 @@ extension OrdersServiceCustom {
         return .created
     }
 
-    func ordersForDevice(req: Request) async throws -> OrdersForDeviceDTO {
+    fileprivate func ordersForDevice(req: Request) async throws -> OrdersForDeviceDTO {
         logger?.debug("Called ordersForDevice")
 
         let orderTypeIdentifier = req.parameters.get("orderTypeIdentifier")!
@@ -268,7 +268,7 @@ extension OrdersServiceCustom {
         return OrdersForDeviceDTO(with: orderIdentifiers, maxDate: maxDate)
     }
 
-    func logError(req: Request) async throws -> HTTPStatus {
+    fileprivate func logError(req: Request) async throws -> HTTPStatus {
         logger?.debug("Called logError")
 
         let body: ErrorLogDTO
@@ -286,7 +286,7 @@ extension OrdersServiceCustom {
         return .ok
     }
 
-    func unregisterDevice(req: Request) async throws -> HTTPStatus {
+    fileprivate func unregisterDevice(req: Request) async throws -> HTTPStatus {
         logger?.debug("Called unregisterDevice")
 
         guard let orderIdentifier = req.parameters.get("orderIdentifier", as: UUID.self) else {
@@ -310,7 +310,7 @@ extension OrdersServiceCustom {
     }
 
     // MARK: - Push Routes
-    func pushUpdatesForOrder(req: Request) async throws -> HTTPStatus {
+    fileprivate func pushUpdatesForOrder(req: Request) async throws -> HTTPStatus {
         logger?.debug("Called pushUpdatesForOrder")
 
         guard let id = req.parameters.get("orderIdentifier", as: UUID.self) else {
@@ -322,7 +322,7 @@ extension OrdersServiceCustom {
         return .noContent
     }
 
-    func tokensForOrderUpdate(req: Request) async throws -> [String] {
+    fileprivate func tokensForOrderUpdate(req: Request) async throws -> [String] {
         logger?.debug("Called tokensForOrderUpdate")
 
         guard let id = req.parameters.get("orderIdentifier", as: UUID.self) else {
@@ -330,8 +330,7 @@ extension OrdersServiceCustom {
         }
         let orderTypeIdentifier = req.parameters.get("orderTypeIdentifier")!
 
-        return try await Self.registrationsForOrder(id: id, of: orderTypeIdentifier, on: req.db)
-            .map { $0.device.pushToken }
+        return try await Self.registrationsForOrder(id: id, of: orderTypeIdentifier, on: req.db).map { $0.device.pushToken }
     }
 }
 
@@ -375,7 +374,7 @@ extension OrdersServiceCustom {
         try await sendPushNotificationsForOrder(id: order.requireID(), of: order.orderTypeIdentifier, on: db)
     }
 
-    static func registrationsForOrder(id: UUID, of orderTypeIdentifier: String, on db: any Database) async throws -> [R] {
+    private static func registrationsForOrder(id: UUID, of orderTypeIdentifier: String, on db: any Database) async throws -> [R] {
         // This could be done by enforcing the caller to have a Siblings property wrapper,
         // but there's not really any value to forcing that on them when we can just do the query ourselves like this.
         try await R.query(on: db)
diff --git a/Sources/Passes/PassesServiceCustom.swift b/Sources/Passes/PassesServiceCustom.swift
index b3893bf..a447be6 100644
--- a/Sources/Passes/PassesServiceCustom.swift
+++ b/Sources/Passes/PassesServiceCustom.swift
@@ -86,8 +86,8 @@ where P == R.PassType, D == R.DeviceType, U == P.UserPersonalizationType {
             apnsConfig = APNSClientConfiguration(
                 authenticationMethod: try .tls(
                     privateKey: .privateKey(
-                        NIOSSLPrivateKey(file: privateKeyPath, format: .pem) { closure in
-                            closure(password.utf8)
+                        NIOSSLPrivateKey(file: privateKeyPath, format: .pem) { passphraseCallback in
+                            passphraseCallback(password.utf8)
                         }),
                     certificateChain: NIOSSLCertificate.fromPEMFile(pemPath).map {
                         .certificate($0)
@@ -144,7 +144,7 @@ where P == R.PassType, D == R.DeviceType, U == P.UserPersonalizationType {
 
 // MARK: - API Routes
 extension PassesServiceCustom {
-    func registerDevice(req: Request) async throws -> HTTPStatus {
+    fileprivate func registerDevice(req: Request) async throws -> HTTPStatus {
         logger?.debug("Called register device")
 
         let pushToken: String
@@ -203,7 +203,7 @@ extension PassesServiceCustom {
         return .created
     }
 
-    func passesForDevice(req: Request) async throws -> PassesForDeviceDTO {
+    fileprivate func passesForDevice(req: Request) async throws -> PassesForDeviceDTO {
         logger?.debug("Called passesForDevice")
 
         let passTypeIdentifier = req.parameters.get("passTypeIdentifier")!
@@ -235,7 +235,7 @@ extension PassesServiceCustom {
         return PassesForDeviceDTO(with: serialNumbers, maxDate: maxDate)
     }
 
-    func latestVersionOfPass(req: Request) async throws -> Response {
+    fileprivate func latestVersionOfPass(req: Request) async throws -> Response {
         logger?.debug("Called latestVersionOfPass")
 
         var ifModifiedSince: TimeInterval = 0
@@ -272,7 +272,7 @@ extension PassesServiceCustom {
         )
     }
 
-    func unregisterDevice(req: Request) async throws -> HTTPStatus {
+    fileprivate func unregisterDevice(req: Request) async throws -> HTTPStatus {
         logger?.debug("Called unregisterDevice")
 
         guard let passId = req.parameters.get("passSerial", as: UUID.self) else {
@@ -295,7 +295,7 @@ extension PassesServiceCustom {
         return .ok
     }
 
-    func logError(req: Request) async throws -> HTTPStatus {
+    fileprivate func logError(req: Request) async throws -> HTTPStatus {
         logger?.debug("Called logError")
 
         let body: ErrorLogDTO
@@ -313,7 +313,7 @@ extension PassesServiceCustom {
         return .ok
     }
 
-    func personalizedPass(req: Request) async throws -> Response {
+    fileprivate func personalizedPass(req: Request) async throws -> Response {
         logger?.debug("Called personalizedPass")
 
         guard let passTypeIdentifier = req.parameters.get("passTypeIdentifier"),
@@ -345,8 +345,7 @@ extension PassesServiceCustom {
         pass._$userPersonalization.id = try userPersonalization.requireID()
         try await pass.update(on: req.db)
 
-        let tmp = FileManager.default.temporaryDirectory
-        let root = tmp.appendingPathComponent(UUID().uuidString, isDirectory: true)
+        let root = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString, isDirectory: true)
         try FileManager.default.createDirectory(at: root, withIntermediateDirectories: true)
         defer { _ = try? FileManager.default.removeItem(at: root) }
 
@@ -415,7 +414,7 @@ extension PassesServiceCustom {
     }
 
     // MARK: - Push Routes
-    func pushUpdatesForPass(req: Request) async throws -> HTTPStatus {
+    fileprivate func pushUpdatesForPass(req: Request) async throws -> HTTPStatus {
         logger?.debug("Called pushUpdatesForPass")
 
         guard let id = req.parameters.get("passSerial", as: UUID.self) else {
@@ -427,7 +426,7 @@ extension PassesServiceCustom {
         return .noContent
     }
 
-    func tokensForPassUpdate(req: Request) async throws -> [String] {
+    fileprivate func tokensForPassUpdate(req: Request) async throws -> [String] {
         logger?.debug("Called tokensForPassUpdate")
 
         guard let id = req.parameters.get("passSerial", as: UUID.self) else {
@@ -435,8 +434,7 @@ extension PassesServiceCustom {
         }
         let passTypeIdentifier = req.parameters.get("passTypeIdentifier")!
 
-        return try await Self.registrationsForPass(id: id, of: passTypeIdentifier, on: req.db)
-            .map { $0.device.pushToken }
+        return try await Self.registrationsForPass(id: id, of: passTypeIdentifier, on: req.db).map { $0.device.pushToken }
     }
 }
 
@@ -480,7 +478,7 @@ extension PassesServiceCustom {
         try await sendPushNotificationsForPass(id: pass.requireID(), of: pass.passTypeIdentifier, on: db)
     }
 
-    static func registrationsForPass(id: UUID, of passTypeIdentifier: String, on db: any Database) async throws -> [R] {
+    private static func registrationsForPass(id: UUID, of passTypeIdentifier: String, on db: any Database) async throws -> [R] {
         // This could be done by enforcing the caller to have a Siblings property wrapper,
         // but there's not really any value to forcing that on them when we can just do the query ourselves like this.
         try await R.query(on: db)
@@ -620,8 +618,7 @@ extension PassesServiceCustom {
             throw PassesError.invalidNumberOfPasses
         }
 
-        let tmp = FileManager.default.temporaryDirectory
-        let root = tmp.appendingPathComponent(UUID().uuidString, isDirectory: true)
+        let root = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString, isDirectory: true)
         try FileManager.default.createDirectory(at: root, withIntermediateDirectories: true)
         defer { _ = try? FileManager.default.removeItem(at: root) }
 
diff --git a/Tests/OrdersTests/OrdersTests.swift b/Tests/OrdersTests/OrdersTests.swift
index 247e4de..24ab490 100644
--- a/Tests/OrdersTests/OrdersTests.swift
+++ b/Tests/OrdersTests/OrdersTests.swift
@@ -18,9 +18,10 @@ struct OrdersTests {
             try await orderData.create(on: app.db)
             let order = try await orderData.$order.get(on: app.db)
             let data = try await ordersService.generateOrderContent(for: order, on: app.db)
-            let orderURL = FileManager.default.temporaryDirectory.appendingPathComponent("test.order")
+            let orderURL = FileManager.default.temporaryDirectory.appendingPathComponent("\(UUID().uuidString).order")
             try data.write(to: orderURL)
-            let orderFolder = try Zip.quickUnzipFile(orderURL)
+            let orderFolder = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString, isDirectory: true)
+            try Zip.unzipFile(orderURL, destination: orderFolder)
 
             #expect(FileManager.default.fileExists(atPath: orderFolder.path.appending("/signature")))
 
@@ -34,8 +35,7 @@ struct OrdersTests {
             let manifestJSONData = try String(contentsOfFile: orderFolder.path.appending("/manifest.json")).data(using: .utf8)
             let manifestJSON = try decoder.decode([String: String].self, from: manifestJSONData!)
             let iconData = try Data(contentsOf: orderFolder.appendingPathComponent("/icon.png"))
-            let iconHash = SHA256.hash(data: iconData).hex
-            #expect(manifestJSON["icon.png"] == iconHash)
+            #expect(manifestJSON["icon.png"] == SHA256.hash(data: iconData).hex)
             #expect(manifestJSON["pet_store_logo.png"] != nil)
         }
     }
diff --git a/Tests/PassesTests/PassesTests.swift b/Tests/PassesTests/PassesTests.swift
index 7f87345..27c525b 100644
--- a/Tests/PassesTests/PassesTests.swift
+++ b/Tests/PassesTests/PassesTests.swift
@@ -18,9 +18,10 @@ struct PassesTests {
             try await passData.create(on: app.db)
             let pass = try await passData.$pass.get(on: app.db)
             let data = try await passesService.generatePassContent(for: pass, on: app.db)
-            let passURL = FileManager.default.temporaryDirectory.appendingPathComponent("test.pkpass")
+            let passURL = FileManager.default.temporaryDirectory.appendingPathComponent("\(UUID().uuidString).pkpass")
             try data.write(to: passURL)
-            let passFolder = try Zip.quickUnzipFile(passURL)
+            let passFolder = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString, isDirectory: true)
+            try Zip.unzipFile(passURL, destination: passFolder)
 
             #expect(FileManager.default.fileExists(atPath: passFolder.path.appending("/signature")))
 
@@ -35,8 +36,7 @@ struct PassesTests {
             let manifestJSONData = try String(contentsOfFile: passFolder.path.appending("/manifest.json")).data(using: .utf8)
             let manifestJSON = try decoder.decode([String: String].self, from: manifestJSONData!)
             let iconData = try Data(contentsOf: passFolder.appendingPathComponent("/icon.png"))
-            let iconHash = Insecure.SHA1.hash(data: iconData).hex
-            #expect(manifestJSON["icon.png"] == iconHash)
+            #expect(manifestJSON["icon.png"] == Insecure.SHA1.hash(data: iconData).hex)
             #expect(manifestJSON["logo.png"] != nil)
             #expect(manifestJSON["personalizationLogo.png"] != nil)
         }
@@ -72,9 +72,10 @@ struct PassesTests {
             try await passData.create(on: app.db)
             let pass = try await passData.$pass.get(on: app.db)
             let data = try await passesService.generatePassContent(for: pass, on: app.db)
-            let passURL = FileManager.default.temporaryDirectory.appendingPathComponent("test.pkpass")
+            let passURL = FileManager.default.temporaryDirectory.appendingPathComponent("\(UUID().uuidString).pkpass")
             try data.write(to: passURL)
-            let passFolder = try Zip.quickUnzipFile(passURL)
+            let passFolder = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString, isDirectory: true)
+            try Zip.unzipFile(passURL, destination: passFolder)
 
             #expect(FileManager.default.fileExists(atPath: passFolder.path.appending("/signature")))
 
@@ -93,8 +94,7 @@ struct PassesTests {
             let manifestJSONData = try String(contentsOfFile: passFolder.path.appending("/manifest.json")).data(using: .utf8)
             let manifestJSON = try decoder.decode([String: String].self, from: manifestJSONData!)
             let iconData = try Data(contentsOf: passFolder.appendingPathComponent("/personalizationLogo.png"))
-            let iconHash = Insecure.SHA1.hash(data: iconData).hex
-            #expect(manifestJSON["personalizationLogo.png"] == iconHash)
+            #expect(manifestJSON["personalizationLogo.png"] == Insecure.SHA1.hash(data: iconData).hex)
         }
     }