diff --git a/routes/routes.php b/routes/routes.php
index 31a12883ff2..aac9aa2d14f 100644
--- a/routes/routes.php
+++ b/routes/routes.php
@@ -1,5 +1,6 @@
 <?php
 
+use Illuminate\Support\Arr;
 use Illuminate\Support\Facades\Route;
 use Statamic\API\Middleware\Cache;
 use Statamic\API\Middleware\HandleAuthentication;
@@ -11,13 +12,12 @@
     Route::middleware([
         RequireStatamicPro::class,
         HandleAuthentication::class,
+        ...Arr::wrap(config('statamic.api.middleware')),
         Cache::class,
-    ])->group(function () {
-        Route::middleware(config('statamic.api.middleware'))
-            ->name('statamic.api.')
-            ->prefix(config('statamic.api.route'))
-            ->group(__DIR__.'/api.php');
-    });
+    ])
+        ->name('statamic.api.')
+        ->prefix(config('statamic.api.route'))
+        ->group(__DIR__.'/api.php');
 }
 
 if (config('statamic.cp.enabled')) {
diff --git a/src/GraphQL/DefaultSchema.php b/src/GraphQL/DefaultSchema.php
index ed2e70278a4..b963f68eb8b 100644
--- a/src/GraphQL/DefaultSchema.php
+++ b/src/GraphQL/DefaultSchema.php
@@ -78,9 +78,10 @@ private function getQueries()
     private function getMiddleware()
     {
         return array_merge(
-            [HandleAuthentication::class, CacheResponse::class],
+            [HandleAuthentication::class],
             config('statamic.graphql.middleware', []),
-            GraphQL::getExtraMiddleware()
+            GraphQL::getExtraMiddleware(),
+            [CacheResponse::class],
         );
     }
 
diff --git a/tests/API/APITest.php b/tests/API/APITest.php
index e48647caf0d..e90ce1ab634 100644
--- a/tests/API/APITest.php
+++ b/tests/API/APITest.php
@@ -1143,7 +1143,7 @@ class FakeTokenHandler
 {
     public function handle(\Statamic\Contracts\Tokens\Token $token, \Illuminate\Http\Request $request, \Closure $next)
     {
-        return $next($token);
+        return $next($request);
     }
 }
 
diff --git a/tests/API/CustomMiddlewareTest.php b/tests/API/CustomMiddlewareTest.php
new file mode 100644
index 00000000000..95f63cf7804
--- /dev/null
+++ b/tests/API/CustomMiddlewareTest.php
@@ -0,0 +1,76 @@
+<?php
+
+namespace Tests\API;
+
+use Facades\Tests\Factories\EntryFactory;
+use Illuminate\Contracts\Http\Kernel;
+use Illuminate\Routing\Middleware\SubstituteBindings;
+use PHPUnit\Framework\Attributes\Test;
+use Statamic\Facades;
+use Tests\PreventSavingStacheItemsToDisk;
+use Tests\TestCase;
+
+class CustomMiddlewareTest extends TestCase
+{
+    use PreventSavingStacheItemsToDisk;
+
+    protected function getEnvironmentSetUp($app)
+    {
+        parent::getEnvironmentSetUp($app);
+
+        $app[Kernel::class]->setMiddlewareGroups(array_merge(
+            $app[Kernel::class]->getMiddlewareGroups(),
+            ['secure-api' => [RequireApiKeyHeader::class, SubstituteBindings::class]],
+        ));
+
+        $app['config']->set('statamic.api.middleware', 'secure-api');
+    }
+
+    public function setUp(): void
+    {
+        parent::setUp();
+
+        Facades\Config::set('statamic.api.resources.collections', true);
+
+        $collection = Facades\Collection::make('articles')->save();
+
+        EntryFactory::id('apple')->slug('apple')->collection($collection)->create();
+    }
+
+    #[Test]
+    public function custom_middleware_is_applied()
+    {
+        $this
+            ->getJson('/api/collections/articles/entries')
+            ->assertUnauthorized();
+
+        $this
+            ->getJson('/api/collections/articles/entries', ['X-Api-Key' => 'secret'])
+            ->assertOk()
+            ->assertJsonPath('data.0.id', 'apple');
+    }
+
+    #[Test]
+    public function custom_middleware_runs_before_the_cached_response_is_returned()
+    {
+        $this
+            ->getJson('/api/collections/articles/entries', ['X-Api-Key' => 'secret'])
+            ->assertOk();
+
+        $this
+            ->getJson('/api/collections/articles/entries')
+            ->assertUnauthorized();
+    }
+}
+
+class RequireApiKeyHeader
+{
+    public function handle($request, $next)
+    {
+        if ($request->header('X-Api-Key') !== 'secret') {
+            abort(401);
+        }
+
+        return $next($request);
+    }
+}
diff --git a/tests/Feature/GraphQL/CustomMiddlewareTest.php b/tests/Feature/GraphQL/CustomMiddlewareTest.php
index b39238c90c6..e582485bc41 100644
--- a/tests/Feature/GraphQL/CustomMiddlewareTest.php
+++ b/tests/Feature/GraphQL/CustomMiddlewareTest.php
@@ -41,7 +41,7 @@ protected function addCustomMiddlewareWithMethod($app)
     }
 
     #[Test]
-    #[DefineEnvironment('addCustomMiddlewareWithMethod')]
+    #[DefineEnvironment('addCustomMiddlewareThroughConfig')]
     public function a_custom_middleware_can_be_added_to_the_default_schema_through_config()
     {
         $this->post('/graphql', ['query' => '{ping}']);
@@ -53,6 +53,16 @@ protected function addCustomMiddlewareThroughConfig($app)
     {
         $app['config']->set('statamic.graphql.middleware', [CountRequests::class]);
     }
+
+    #[Test]
+    #[DefineEnvironment('addCustomMiddlewareThroughConfig')]
+    public function custom_middleware_runs_before_the_cached_response_is_returned()
+    {
+        $this->post('/graphql', ['query' => '{ping}']);
+        $this->post('/graphql', ['query' => '{ping}']);
+
+        $this->assertEquals(2, app('request-count'));
+    }
 }
 
 class CountRequests
diff --git a/tests/Feature/GraphQL/RequestCacheTest.php b/tests/Feature/GraphQL/RequestCacheTest.php
index 97f6c2927ff..2a143296174 100644
--- a/tests/Feature/GraphQL/RequestCacheTest.php
+++ b/tests/Feature/GraphQL/RequestCacheTest.php
@@ -27,7 +27,6 @@ public function getEnvironmentSetup($app)
 
         GraphQL::addQuery(QueryOne::class);
         GraphQL::addQuery(QueryTwo::class);
-        GraphQL::addMiddleware(TrackRequests::class);
     }
 
     #[Test]
@@ -254,6 +253,11 @@ class QueryOne extends PingQuery
 
     public function resolve()
     {
+        app('request-tracking')[] = [
+            'query' => request()->input('query'),
+            'variables' => request()->input('variables'),
+        ];
+
         return 'one';
     }
 }
@@ -268,19 +272,6 @@ public function resolve()
     }
 }
 
-class TrackRequests
-{
-    public function handle($request, $next)
-    {
-        app('request-tracking')[] = [
-            'query' => $request->input('query'),
-            'variables' => $request->input('variables'),
-        ];
-
-        return $next($request);
-    }
-}
-
 class TestTokenHandler
 {
     public function handle($token, $request, $next)