diff --git a/client/src/pages/AppView/AppView.js b/client/src/pages/AppView/AppView.js
index d5b7d0428..f50a79fdd 100644
--- a/client/src/pages/AppView/AppView.js
+++ b/client/src/pages/AppView/AppView.js
@@ -5,6 +5,7 @@ import {
     Card,
     Divider,
     Button,
+    Tag,
 } from '@dhis2/ui'
 import classnames from 'classnames'
 import PropTypes from 'prop-types'
@@ -17,7 +18,13 @@ import Screenshots from 'src/components/Screenshots/Screenshots'
 import Versions from 'src/components/Versions/Versions'
 import { renderDhisVersionsCompatibility } from 'src/lib/render-dhis-versions-compatibility'
 
-const HeaderSection = ({ appName, appDeveloper, appType, logoSrc }) => (
+const HeaderSection = ({
+    appName,
+    appDeveloper,
+    appType,
+    logoSrc,
+    isCoreApp,
+}) => (
     <section
         className={classnames(styles.appCardSection, styles.appCardHeader)}
     >
@@ -27,6 +34,7 @@ const HeaderSection = ({ appName, appDeveloper, appType, logoSrc }) => (
             <span className={styles.appCardDeveloper}>by {appDeveloper}</span>
             <span className={styles.appCardType}>{appType}</span>
         </div>
+        {isCoreApp && <Tag>Core App</Tag>}
     </section>
 )
 
@@ -34,6 +42,7 @@ HeaderSection.propTypes = {
     appDeveloper: PropTypes.string.isRequired,
     appName: PropTypes.string.isRequired,
     appType: PropTypes.string.isRequired,
+    isCoreApp: PropTypes.bool,
     logoSrc: PropTypes.string,
 }
 
@@ -111,6 +120,7 @@ const AppView = ({ match }) => {
                 appDeveloper={appDeveloper}
                 appType={config.ui.appTypeToDisplayName[app.appType]}
                 logoSrc={logoSrc}
+                isCoreApp={app.coreApp}
             />
             <Divider />
             <AboutSection
diff --git a/client/src/pages/AppView/AppView.module.css b/client/src/pages/AppView/AppView.module.css
index 6bed4edff..9a7f6e469 100644
--- a/client/src/pages/AppView/AppView.module.css
+++ b/client/src/pages/AppView/AppView.module.css
@@ -18,7 +18,7 @@
 
 .appCardHeader {
     display: grid;
-    grid-template-columns: 72px auto;
+    grid-template-columns: 72px auto 67px;
     grid-gap: var(--spacers-dp12);
 }
 
diff --git a/client/src/pages/Apps/AppCards/AppCardItem/AppCardItem.js b/client/src/pages/Apps/AppCards/AppCardItem/AppCardItem.js
index 21016ae66..c8200f1e5 100644
--- a/client/src/pages/Apps/AppCards/AppCardItem/AppCardItem.js
+++ b/client/src/pages/Apps/AppCards/AppCardItem/AppCardItem.js
@@ -1,3 +1,4 @@
+import { Tag } from '@dhis2/ui'
 import PropTypes from 'prop-types'
 import React from 'react'
 import { Link } from 'react-router-dom'
@@ -13,7 +14,15 @@ const summarise = text => {
     return text
 }
 
-const AppCardItem = ({ id, name, developer, type, description, images }) => {
+const AppCardItem = ({
+    id,
+    name,
+    developer,
+    type,
+    description,
+    images,
+    isCoreApp,
+}) => {
     const logo = images.find(elem => elem.logo)
 
     return (
@@ -29,6 +38,7 @@ const AppCardItem = ({ id, name, developer, type, description, images }) => {
                         {config.ui.appTypeToDisplayName[type]}
                     </span>
                 </div>
+                {isCoreApp && <Tag>Core App</Tag>}
             </header>
 
             <p className={styles.appCardDescription}>
@@ -48,6 +58,7 @@ AppCardItem.propTypes = {
     type: PropTypes.string.isRequired,
     description: PropTypes.string,
     images: PropTypes.array,
+    isCoreApp: PropTypes.bool,
 }
 
 export default AppCardItem
diff --git a/client/src/pages/Apps/AppCards/AppCardItem/AppCardItem.module.css b/client/src/pages/Apps/AppCards/AppCardItem/AppCardItem.module.css
index 87b723e91..cbe826fd8 100644
--- a/client/src/pages/Apps/AppCards/AppCardItem/AppCardItem.module.css
+++ b/client/src/pages/Apps/AppCards/AppCardItem/AppCardItem.module.css
@@ -17,7 +17,7 @@
 
 .appCardHeader {
     display: grid;
-    grid-template-columns: 72px auto;
+    grid-template-columns: 72px auto 67px;
     grid-gap: var(--spacers-dp12);
 }
 
@@ -50,3 +50,7 @@
     font-size: 15px;
     line-height: 21px;
 }
+
+.coreAppIcon {
+    width: 25px
+}
diff --git a/client/src/pages/Apps/AppCards/AppCards.js b/client/src/pages/Apps/AppCards/AppCards.js
index 4c7818836..888e6793f 100644
--- a/client/src/pages/Apps/AppCards/AppCards.js
+++ b/client/src/pages/Apps/AppCards/AppCards.js
@@ -39,6 +39,7 @@ const AppCards = ({ isLoading, error, apps }) => {
                     type={app.appType}
                     description={app.description}
                     images={app.images}
+                    isCoreApp={app.coreApp}
                 />
             ))}
         </div>
diff --git a/client/src/pages/UserApp/DetailsCard/DetailsCard.js b/client/src/pages/UserApp/DetailsCard/DetailsCard.js
index 31107cf7c..0ac5a2fae 100644
--- a/client/src/pages/UserApp/DetailsCard/DetailsCard.js
+++ b/client/src/pages/UserApp/DetailsCard/DetailsCard.js
@@ -1,4 +1,4 @@
-import { Card, Button, Divider } from '@dhis2/ui'
+import { Card, Button, Divider, Tag } from '@dhis2/ui'
 import PropTypes from 'prop-types'
 import { useState, useRef } from 'react'
 import { Link } from 'react-router-dom'
@@ -92,6 +92,7 @@ const DetailsCard = ({ app, mutate }) => {
                     </span>
                     <span className={styles.detailsCardType}>{appType}</span>
                 </div>
+                {app.coreApp && <Tag>Core App</Tag>}
             </section>
             <Divider />
             <section>
diff --git a/client/src/pages/UserApp/DetailsCard/DetailsCard.module.css b/client/src/pages/UserApp/DetailsCard/DetailsCard.module.css
index bc236da6c..ddeb2a039 100644
--- a/client/src/pages/UserApp/DetailsCard/DetailsCard.module.css
+++ b/client/src/pages/UserApp/DetailsCard/DetailsCard.module.css
@@ -1,6 +1,6 @@
 .detailsCardHeader {
     display: grid;
-    grid-template-columns: 120px auto;
+    grid-template-columns: 120px auto 67px;
     grid-gap: var(--spacers-dp12);
     margin-bottom: var(--spacers-dp8);
 }
diff --git a/client/src/pages/UserAppEdit/UserAppEdit.js b/client/src/pages/UserAppEdit/UserAppEdit.js
index 4f2804274..01451d25e 100644
--- a/client/src/pages/UserAppEdit/UserAppEdit.js
+++ b/client/src/pages/UserAppEdit/UserAppEdit.js
@@ -7,15 +7,18 @@ import {
     ReactFinalForm,
     InputFieldFF,
     TextAreaFieldFF,
+    SwitchFieldFF,
     hasValue,
     url,
 } from '@dhis2/ui'
 import PropTypes from 'prop-types'
+import { useSelector } from 'react-redux'
 import { useHistory } from 'react-router-dom'
 import styles from './UserAppEdit.module.css'
 import { useQueryV1 } from 'src/api'
 import * as api from 'src/api'
 import { useSuccessAlert, useErrorAlert } from 'src/lib/use-alert'
+import { isManager as isManagerSelector } from 'src/selectors/userSelectors'
 
 const UserAppEdit = ({ match }) => {
     const { appId } = match.params
@@ -23,6 +26,7 @@ const UserAppEdit = ({ match }) => {
     const history = useHistory()
     const successAlert = useSuccessAlert()
     const errorAlert = useErrorAlert()
+    const isManager = useSelector(isManagerSelector)
 
     const handleSubmit = async values => {
         try {
@@ -101,6 +105,18 @@ const UserAppEdit = ({ match }) => {
                             className={styles.field}
                             validate={url}
                         />
+                        {isManager && (
+                            <ReactFinalForm.Field
+                                name="coreApp"
+                                label="Core App"
+                                type="checkbox"
+                                placeholder="e.g. https://github.com/user/app"
+                                helpText="Set the app as an Core app, normally this is set from the manifest when uploading an app."
+                                initialValue={app.coreApp}
+                                component={SwitchFieldFF}
+                                className={styles.field}
+                            />
+                        )}
                         <Button
                             primary
                             type="submit"
diff --git a/server/migrations/20210705145813_core-app.js b/server/migrations/20210705145813_core-app.js
new file mode 100644
index 000000000..019991427
--- /dev/null
+++ b/server/migrations/20210705145813_core-app.js
@@ -0,0 +1,96 @@
+exports.up = async function (knex) {
+    await knex.schema.table('app', table => {
+        table.boolean('core_app').defaultTo(false)
+    })
+    await knex.raw('DROP VIEW apps_view')
+    // update app-view with column
+    await knex.raw(`
+    CREATE VIEW apps_view AS
+    SELECT  app.id AS app_id,
+            app.type,
+            app.core_app,
+            appver.version, appver.id AS version_id, appver.created_at AS version_created_at, appver.source_url, appver.demo_url,
+            media.app_media_id AS media_id, media.original_filename, media.created_at AS media_created_at, media.media_type,
+            localisedapp.language_code, localisedapp.name, localisedapp.description, localisedapp.slug AS appver_slug,
+            s.status, s.created_at AS status_created_at,
+            ac.min_dhis2_version, ac.max_dhis2_version,
+            c.name AS channel_name, c.id AS channel_id,
+            app.contact_email AS contact_email,
+            users.id as owner_id, users.name as owner_name, users.email as owner_email,
+            org.name AS organisation, org.slug AS organisation_slug, org.email as organisation_email
+
+        FROM app
+
+        INNER JOIN app_status AS s
+            ON s.app_id = app.id
+
+        INNER JOIN app_version AS appver
+            ON appver.app_id = s.app_id
+
+        LEFT JOIN app_media_view AS media
+            ON media.app_id = s.app_id
+
+        INNER JOIN app_version_localised AS localisedapp
+            ON localisedapp.app_version_id = appver.id
+
+        INNER JOIN app_channel AS ac
+            ON ac.app_version_id = appver.id
+
+        INNER JOIN channel AS c
+            ON c.id = ac.channel_id
+
+        INNER JOIN users
+            ON users.id = app.created_by_user_id
+
+        INNER JOIN organisation AS org
+            ON org.id = app.organisation_id
+`)
+}
+
+exports.down = async function (knex) {
+    await knex.raw('DROP VIEW apps_view')
+    await knex.schema.table('app', table => {
+        table.dropColumn('core_app')
+    })
+
+    await knex.raw(`
+    CREATE VIEW apps_view AS
+    SELECT  app.id AS app_id,
+          app.type,
+          appver.version, appver.id AS version_id, appver.created_at AS version_created_at, appver.source_url, appver.demo_url,
+          media.app_media_id AS media_id, media.original_filename, media.created_at AS media_created_at, media.media_type,
+          localisedapp.language_code, localisedapp.name, localisedapp.description, localisedapp.slug AS appver_slug,
+          s.status, s.created_at AS status_created_at,
+          ac.min_dhis2_version, ac.max_dhis2_version,
+          c.name AS channel_name, c.id AS channel_id,
+          app.contact_email AS contact_email,
+          users.id as owner_id, users.name as owner_name, users.email as owner_email,
+          org.name AS organisation, org.slug AS organisation_slug, org.email as organisation_email
+
+      FROM app
+
+      INNER JOIN app_status AS s
+          ON s.app_id = app.id
+
+      INNER JOIN app_version AS appver
+          ON appver.app_id = s.app_id
+
+      LEFT JOIN app_media_view AS media
+          ON media.app_id = s.app_id
+
+      INNER JOIN app_version_localised AS localisedapp
+          ON localisedapp.app_version_id = appver.id
+
+      INNER JOIN app_channel AS ac
+          ON ac.app_version_id = appver.id
+
+      INNER JOIN channel AS c
+          ON c.id = ac.channel_id
+
+      INNER JOIN users
+          ON users.id = app.created_by_user_id
+
+      INNER JOIN organisation AS org
+          ON org.id = app.organisation_id
+`)
+}
diff --git a/server/src/data/createApp.js b/server/src/data/createApp.js
index 0db5aceba..51c77f4c6 100644
--- a/server/src/data/createApp.js
+++ b/server/src/data/createApp.js
@@ -1,25 +1,18 @@
 const joi = require('@hapi/joi')
-
 const debug = require('debug')('apphub:server:data:createApp')
-
 const { AppTypes } = require('../enums')
 
 const paramsSchema = joi
     .object()
     .keys({
-        userId: joi
-            .string()
-            .uuid()
-            .required(),
+        userId: joi.string().uuid().required(),
         contactEmail: joi.string().email(),
-        orgId: joi
-            .string()
-            .uuid()
-            .required(),
+        orgId: joi.string().uuid().required(),
         appType: joi
             .string()
             .required()
             .valid(...AppTypes),
+        coreApp: joi.bool(),
     })
     .options({ allowUnknown: true })
 
@@ -48,7 +41,7 @@ const createApp = async (params, knex) => {
     }
 
     debug('params: ', params)
-    const { userId, contactEmail, orgId, appType } = params
+    const { userId, contactEmail, orgId, appType, coreApp } = params
 
     //generate a new uuid to insert
 
@@ -60,6 +53,7 @@ const createApp = async (params, knex) => {
                 contact_email: contactEmail,
                 organisation_id: orgId,
                 type: appType,
+                core_app: coreApp,
             })
             .returning('id')
 
diff --git a/server/src/data/getApps.js b/server/src/data/getApps.js
index 7ed67be28..52abd6bf5 100644
--- a/server/src/data/getApps.js
+++ b/server/src/data/getApps.js
@@ -42,11 +42,8 @@ const getApps = (
                 })
             }
 
-            if (coreApp) {
-                builder.where('organisation', 'DHIS2')
-            }
-            if (coreApp === false) {
-                builder.whereNot('organisation', 'DHIS2')
+            if (typeof coreApp === 'boolean') {
+                builder.where('core_app', coreApp)
             }
 
             if (query) {
diff --git a/server/src/data/updateApp.js b/server/src/data/updateApp.js
index 4962af99f..6ed4ae7a2 100644
--- a/server/src/data/updateApp.js
+++ b/server/src/data/updateApp.js
@@ -1,18 +1,12 @@
 const joi = require('@hapi/joi')
-const { slugify } = require('../utils/slugify')
 const { AppTypes } = require('../enums')
+const { slugify } = require('../utils/slugify')
 
 const paramsSchema = joi
     .object()
     .keys({
-        id: joi
-            .string()
-            .uuid()
-            .required(),
-        userId: joi
-            .string()
-            .uuid()
-            .required(),
+        id: joi.string().uuid().required(),
+        userId: joi.string().uuid().required(),
         name: joi.string().max(100),
         description: joi.string().allow(''),
         appType: joi.string().valid(...AppTypes),
@@ -23,10 +17,8 @@ const paramsSchema = joi
             .uri({
                 scheme: ['http', 'https'],
             }),
-        languageCode: joi
-            .string()
-            .max(2)
-            .required(),
+        languageCode: joi.string().max(2).required(),
+        coreApp: joi.bool(),
     })
     .options({ allowUnknown: true })
 
@@ -71,6 +63,7 @@ const updateApp = async (params, knex) => {
         appType,
         description,
         languageCode,
+        coreApp,
     } = params
 
     try {
@@ -85,6 +78,7 @@ const updateApp = async (params, knex) => {
                 type: appType,
                 updated_at: knex.fn.now(),
                 updated_by_user_id: userId,
+                core_app: coreApp,
             })
             .where({
                 id,
diff --git a/server/src/models/v1/in/CreateAppModel.js b/server/src/models/v1/in/CreateAppModel.js
index bcbc070f6..31864dd1b 100644
--- a/server/src/models/v1/in/CreateAppModel.js
+++ b/server/src/models/v1/in/CreateAppModel.js
@@ -18,6 +18,7 @@ const CreateModelAppData = Joi.object().keys({
         demoUrl: Joi.string().uri().allow(''),
         channel: Joi.string(),
     }),
+    coreApp: Joi.bool(),
 })
 
 const payloadSchema = Joi.object({
diff --git a/server/src/models/v1/in/EditAppModel.js b/server/src/models/v1/in/EditAppModel.js
index 62b16a343..5999e8a18 100644
--- a/server/src/models/v1/in/EditAppModel.js
+++ b/server/src/models/v1/in/EditAppModel.js
@@ -1,5 +1,4 @@
 const joi = require('@hapi/joi')
-
 const { AppTypes } = require('../../../enums')
 
 const payloadSchema = joi.object({
@@ -13,6 +12,7 @@ const payloadSchema = joi.object({
     }),
     name: joi.string().max(100),
     sourceUrl: joi.string().allow(''),
+    coreApp: joi.bool(),
 })
 
 const EditAppModel = payloadSchema
diff --git a/server/src/models/v1/out/App.js b/server/src/models/v1/out/App.js
index 673355173..8ee921e15 100644
--- a/server/src/models/v1/out/App.js
+++ b/server/src/models/v1/out/App.js
@@ -1,10 +1,8 @@
 const Joi = require('@hapi/joi')
-
 const { AppStatuses, AppTypes } = require('../../../enums')
-
-const Version = require('./Version')
-const Developer = require('./User')
 const Image = require('./Image')
+const Developer = require('./User')
+const Version = require('./Version')
 
 // v1 api schema
 const def = Joi.object().keys({
@@ -15,40 +13,29 @@ const def = Joi.object().keys({
     created: Joi.number(),
 
     description: Joi.string().allow(''),
+    coreApp: Joi.bool(),
 
     developer: Developer.required(),
 
-    images: Joi.array()
-        .items(Image)
-        .required(),
+    images: Joi.array().items(Image).required(),
 
-    id: Joi.string()
-        .uuid()
-        .required(),
+    id: Joi.string().uuid().required(),
 
     lastUpdated: Joi.number(),
 
-    name: Joi.string()
-        .max(255, 'utf8')
-        .required(),
+    name: Joi.string().max(255, 'utf8').required(),
 
     owner: Joi.string().required(),
 
-    reviews: Joi.array()
-        .items(Joi.any())
-        .required(),
+    reviews: Joi.array().items(Joi.any()).required(),
 
-    sourceUrl: Joi.string()
-        .uri()
-        .allow(''),
+    sourceUrl: Joi.string().uri().allow(''),
 
     status: Joi.string()
         .required()
         .valid(...AppStatuses),
 
-    versions: Joi.array()
-        .items(Version)
-        .min(1),
+    versions: Joi.array().items(Version).min(1),
 })
 
 module.exports = {
diff --git a/server/src/models/v2/in/CreateAppModel.js b/server/src/models/v2/in/CreateAppModel.js
index 54a6732cd..102648344 100644
--- a/server/src/models/v2/in/CreateAppModel.js
+++ b/server/src/models/v2/in/CreateAppModel.js
@@ -6,6 +6,7 @@ const CreateModelAppData = Joi.object().keys({
     developer: Joi.object().keys({
         organisationId: Joi.string(),
     }),
+    coreApp: Joi.bool(),
 })
 
 const payloadSchema = Joi.object({
diff --git a/server/src/routes/v1/apps/formatting/convertAppsToApiV1Format.js b/server/src/routes/v1/apps/formatting/convertAppsToApiV1Format.js
index 7f9114aa5..c3ec3adf3 100644
--- a/server/src/routes/v1/apps/formatting/convertAppsToApiV1Format.js
+++ b/server/src/routes/v1/apps/formatting/convertAppsToApiV1Format.js
@@ -1,10 +1,8 @@
 const debug = require('debug')(
     'apphub:server:routes:v1:apps:formatting:convertAppsToApiV1Format'
 )
-
-const getServerUrl = require('../../../../utils/getServerUrl')
-
 const { MediaType } = require('../../../../enums')
+const getServerUrl = require('../../../../utils/getServerUrl')
 
 const convertDbAppViewRowToAppApiV1Object = app => ({
     appType: app.type,
@@ -17,7 +15,7 @@ const convertDbAppViewRowToAppApiV1Object = app => ({
 
     name: app.name,
     description: app.description || '',
-
+    coreApp: app.core_app,
     versions: [],
 
     //TODO: set address
diff --git a/server/src/routes/v1/apps/handlers/createApp.js b/server/src/routes/v1/apps/handlers/createApp.js
index e0e0f8b9b..1be923725 100644
--- a/server/src/routes/v1/apps/handlers/createApp.js
+++ b/server/src/routes/v1/apps/handlers/createApp.js
@@ -1,4 +1,5 @@
 const Boom = require('@hapi/boom')
+const Bounce = require('@hapi/bounce')
 const { AppStatus, MediaType } = require('../../../../enums')
 const CreateAppModel = require('../../../../models/v1/in/CreateAppModel')
 const {
@@ -48,9 +49,8 @@ module.exports = {
 
         const { payload } = request
         const appJsonPayload = JSON.parse(payload.app)
-        const appJsonValidationResult = CreateAppModel.def.validate(
-            appJsonPayload
-        )
+        const appJsonValidationResult =
+            CreateAppModel.def.validate(appJsonPayload)
 
         if (appJsonValidationResult.error) {
             throw Boom.badRequest(appJsonValidationResult.error)
@@ -79,6 +79,37 @@ module.exports = {
 
         const app = await db.transaction(async trx => {
             const { appType } = appJsonPayload
+            const { file } = payload
+
+            const { name, description, sourceUrl } = appJsonPayload
+            const {
+                version,
+                demoUrl,
+                minDhisVersion,
+                maxDhisVersion,
+                channel,
+            } = appJsonPayload.version
+
+            let isCoreApp
+            try {
+                const { manifest } = verifyBundle({
+                    buffer: file._data,
+                    appId: null, // this can never be identical on first upload
+                    appName: name,
+                    version,
+                    organisationName: organisation.name,
+                })
+
+                isCoreApp = manifest.core_app
+                if (isCoreApp && !isManager) {
+                    throw Boom.unauthorized(
+                        `You don't have permission to upload core apps`
+                    )
+                }
+            } catch (error) {
+                Bounce.rethrow(error, 'system')
+                throw Boom.badRequest(error)
+            }
             const app = await App.create(
                 {
                     userId: currentUserId,
@@ -86,18 +117,11 @@ module.exports = {
                     organisationId,
                     appType,
                     status: AppStatus.PENDING,
+                    coreApp: isCoreApp,
                 },
                 trx
             )
 
-            const { name, description, sourceUrl } = appJsonPayload
-            const {
-                version,
-                demoUrl,
-                minDhisVersion,
-                maxDhisVersion,
-                channel,
-            } = appJsonPayload.version
             const appVersion = await App.createVersionForApp(
                 app.id,
                 {
@@ -131,18 +155,6 @@ module.exports = {
                 trx
             )
 
-            const { file } = payload
-            try {
-                verifyBundle({
-                    buffer: file._data,
-                    appId: app.id,
-                    appName: name,
-                    version,
-                    organisationName: organisation.name,
-                })
-            } catch (error) {
-                throw Boom.badRequest(error)
-            }
             const appUpload = saveFile(
                 `${app.id}/${appVersion.id}`,
                 'app.zip',
diff --git a/server/src/routes/v1/apps/handlers/editApp.js b/server/src/routes/v1/apps/handlers/editApp.js
index d47299095..a53172d5e 100644
--- a/server/src/routes/v1/apps/handlers/editApp.js
+++ b/server/src/routes/v1/apps/handlers/editApp.js
@@ -52,7 +52,8 @@ module.exports = {
         debug('appsUserCanEdit:', appsUserCanEdit)
         debug('userCanEditApp:', userCanEditApp)
 
-        if (currentUserIsManager(request) || userCanEditApp) {
+        const isManager = currentUserIsManager(request)
+        if (isManager || userCanEditApp) {
             //can edit app
             const transaction = await db.transaction()
 
@@ -62,6 +63,7 @@ module.exports = {
                     description,
                     appType,
                     sourceUrl,
+                    coreApp
                 } = request.payload
 
                 await updateApp(
@@ -73,6 +75,7 @@ module.exports = {
                         sourceUrl,
                         appType,
                         languageCode: 'en',
+                        coreApp: isManager ? coreApp : undefined
                     },
                     db,
                     transaction
diff --git a/server/src/security/verifyBundle.js b/server/src/security/verifyBundle.js
index 81ce99696..af42971d8 100644
--- a/server/src/security/verifyBundle.js
+++ b/server/src/security/verifyBundle.js
@@ -10,7 +10,7 @@ const isValidJSON = json => {
 }
 
 const checkManifest = ({ manifest, appId, appName, version, canBeCoreApp }) => {
-    if (manifest.app_hub_id && manifest.app_hub_id !== appId) {
+    if (appId && manifest.app_hub_id && manifest.app_hub_id !== appId) {
         throw new Error('Manifest App Hub ID does not match app ID')
     }
     if (manifest.name !== appName) {
@@ -29,7 +29,7 @@ const checkManifest = ({ manifest, appId, appName, version, canBeCoreApp }) => {
 }
 
 const checkD2Config = ({ d2Config, appId, appName, version, canBeCoreApp }) => {
-    if (d2Config.id && d2Config.id !== appId) {
+    if (appId && d2Config.id && d2Config.id !== appId) {
         throw new Error('D2 config App Hub ID does not match app ID')
     }
     if (d2Config.title !== appName) {
@@ -65,10 +65,9 @@ module.exports = ({ buffer, appId, appName, version, organisationName }) => {
         version,
         canBeCoreApp,
     })
-
     // D2 config is optional
     if (!entries.includes(d2ConfigPath)) {
-        return
+        return { manifest }
     }
     const d2ConfigJson = zip.readAsText(d2ConfigPath)
     if (!isValidJSON(d2ConfigJson)) {
@@ -82,4 +81,9 @@ module.exports = ({ buffer, appId, appName, version, organisationName }) => {
         version,
         canBeCoreApp,
     })
+
+    return {
+        manifest,
+        d2Config,
+    }
 }
diff --git a/server/src/services/app.js b/server/src/services/app.js
index 0ad922c6b..1eed5f43d 100644
--- a/server/src/services/app.js
+++ b/server/src/services/app.js
@@ -8,7 +8,14 @@ const {
 } = require('../data')
 
 exports.create = async (
-    { userId: currentUserId, contactEmail, organisationId, appType, status },
+    {
+        userId: currentUserId,
+        contactEmail,
+        organisationId,
+        appType,
+        status,
+        coreApp,
+    },
     db
 ) => {
     const app = await createApp(
@@ -17,6 +24,7 @@ exports.create = async (
             contactEmail,
             orgId: organisationId,
             appType: appType,
+            coreApp,
         },
         db
     )