diff --git a/lib/auth/helpers.go b/lib/auth/helpers.go
index 64e5179a6947e..8e603541da7db 100644
--- a/lib/auth/helpers.go
+++ b/lib/auth/helpers.go
@@ -302,11 +302,12 @@ func NewTestAuthServer(cfg TestAuthServerConfig) (*TestAuthServer, error) {
 
 	if cfg.CacheEnabled {
 		srv.AuthServer.Cache, err = accesspoint.NewAccessCache(accesspoint.AccessCacheConfig{
-			Context:   ctx,
+			Context:   srv.AuthServer.CloseContext(),
 			Services:  srv.AuthServer.Services,
 			Setup:     cache.ForAuth,
 			CacheName: []string{teleport.ComponentAuth},
 			Events:    true,
+			Unstarted: true,
 		})
 		if err != nil {
 			return nil, trace.Wrap(err)
@@ -432,6 +433,13 @@ func NewTestAuthServer(cfg TestAuthServerConfig) (*TestAuthServer, error) {
 		return nil, trace.Wrap(err)
 	}
 
+	// Auth initialization is done (including creation/updating of all singleton
+	// configuration resources) so now we can start the cache.
+	if c, ok := srv.AuthServer.Cache.(*cache.Cache); ok {
+		if err := c.Start(); err != nil {
+			return nil, trace.NewAggregate(err, c.Close())
+		}
+	}
 	return srv, nil
 }