diff --git a/.golangci.yml b/.golangci.yml
index 9306540caf..3d7c3aafa6 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -23,6 +23,7 @@ linters:
     - unparam
     - whitespace
     - gocritic
+    - copyloopvar
     - nolintlint
 
 linters-settings:
diff --git a/cmd/spire-agent/cli/run/run_test.go b/cmd/spire-agent/cli/run/run_test.go
index 29ab95b732..9591e214e6 100644
--- a/cmd/spire-agent/cli/run/run_test.go
+++ b/cmd/spire-agent/cli/run/run_test.go
@@ -123,8 +123,6 @@ func TestDownloadTrustBundle(t *testing.T) {
 	}
 
 	for _, testCase := range cases {
-		testCase := testCase
-
 		t.Run(testCase.msg, func(t *testing.T) {
 			testServer := httptest.NewServer(http.HandlerFunc(
 				func(w http.ResponseWriter, r *http.Request) {
@@ -629,8 +627,6 @@ func TestMergeInput(t *testing.T) {
 	cases = append(cases, mergeInputCasesOS()...)
 
 	for _, testCase := range cases {
-		testCase := testCase
-
 		fileInput := &Config{Agent: &agentConfig{}}
 		cliInput := &agentConfig{}
 
@@ -1042,8 +1038,6 @@ func TestNewAgentConfig(t *testing.T) {
 	}
 	cases = append(cases, newAgentConfigCasesOS(t)...)
 	for _, testCase := range cases {
-		testCase := testCase
-
 		input := defaultValidConfig()
 
 		testCase.input(input)
@@ -1206,8 +1200,6 @@ func TestWarnOnUnknownConfig(t *testing.T) {
 	}
 
 	for _, testCase := range cases {
-		testCase := testCase
-
 		c, err := ParseFile(filepath.Join(testFileDir, testCase.confFile), false)
 		require.NoError(t, err)
 
diff --git a/cmd/spire-server/cli/entry/util_test.go b/cmd/spire-server/cli/entry/util_test.go
index 3148e80366..5d9558baad 100644
--- a/cmd/spire-server/cli/entry/util_test.go
+++ b/cmd/spire-server/cli/entry/util_test.go
@@ -45,7 +45,6 @@ func TestParseEntryJSON(t *testing.T) {
 	}
 
 	for _, testCase := range testCases {
-		testCase := testCase
 		t.Run(testCase.name, func(t *testing.T) {
 			p := testCase.testDataPath
 
diff --git a/cmd/spire-server/cli/logger/printers_test.go b/cmd/spire-server/cli/logger/printers_test.go
index 2d98f31918..2e9460630e 100644
--- a/cmd/spire-server/cli/logger/printers_test.go
+++ b/cmd/spire-server/cli/logger/printers_test.go
@@ -53,7 +53,6 @@ Launch Level : info
 			expectedError: errors.New("internal error: unexpected type *types.Entry returned; please report this as a bug"),
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			tt.env = &commoncli.Env{
 				Stdout: &tt.outWriter,
diff --git a/cmd/spire-server/cli/run/run_test.go b/cmd/spire-server/cli/run/run_test.go
index de917cbb4b..76698ff117 100644
--- a/cmd/spire-server/cli/run/run_test.go
+++ b/cmd/spire-server/cli/run/run_test.go
@@ -470,8 +470,6 @@ func TestMergeInput(t *testing.T) {
 	cases = append(cases, mergeInputCasesOS(t)...)
 
 	for _, testCase := range cases {
-		testCase := testCase
-
 		fileInput := &Config{Server: &serverConfig{}}
 
 		testCase.fileInput(fileInput)
@@ -1213,8 +1211,6 @@ func TestNewServerConfig(t *testing.T) {
 	cases = append(cases, newServerConfigCasesOS(t)...)
 
 	for _, testCase := range cases {
-		testCase := testCase
-
 		input := defaultValidConfig()
 
 		testCase.input(input)
@@ -1337,7 +1333,6 @@ func TestValidateConfig(t *testing.T) {
 	}
 
 	for _, testCase := range testCases {
-		testCase := testCase
 		t.Run(testCase.name, func(t *testing.T) {
 			conf := defaultValidConfig()
 			testCase.applyConf(conf)
@@ -1550,8 +1545,6 @@ func TestWarnOnUnknownConfig(t *testing.T) {
 	}
 
 	for _, testCase := range cases {
-		testCase := testCase
-
 		c, err := ParseFile(filepath.Join(testFileDir, testCase.confFile), false)
 		require.NoError(t, err)
 
@@ -1759,7 +1752,6 @@ func TestHasCompatibleTTLs(t *testing.T) {
 	}
 
 	for _, testCase := range cases {
-		testCase := testCase
 		if testCase.caTTL == 0 {
 			testCase.caTTL = credtemplate.DefaultX509CATTL
 		}
diff --git a/pkg/agent/api/debug/v1/service_test.go b/pkg/agent/api/debug/v1/service_test.go
index afeeced626..d7d6f8a6c2 100644
--- a/pkg/agent/api/debug/v1/service_test.go
+++ b/pkg/agent/api/debug/v1/service_test.go
@@ -189,7 +189,6 @@ func TestGetInfo(t *testing.T) {
 			err:  "failed to verify agent SVID: x509svid: could not get leaf SPIFFE ID: certificate contains no URI SAN",
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			test := setupServiceTest(t)
 			defer test.Cleanup()
diff --git a/pkg/agent/api/delegatedidentity/v1/service_test.go b/pkg/agent/api/delegatedidentity/v1/service_test.go
index ca3a9aef3a..c95b8c756a 100644
--- a/pkg/agent/api/delegatedidentity/v1/service_test.go
+++ b/pkg/agent/api/delegatedidentity/v1/service_test.go
@@ -321,7 +321,6 @@ func TestSubscribeToX509SVIDs(t *testing.T) {
 			expectMetrics: generateSubscribeToX509SVIDMetrics(),
 		},
 	} {
-		tt := tt
 		t.Run(tt.testName, func(t *testing.T) {
 			metrics := fakemetrics.New()
 			params := testParams{
@@ -423,7 +422,6 @@ func TestSubscribeToX509Bundles(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
 		t.Run(tt.testName, func(t *testing.T) {
 			params := testParams{
 				CA:           ca,
@@ -663,7 +661,6 @@ func TestFetchJWTSVIDs(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
 		t.Run(tt.testName, func(t *testing.T) {
 			params := testParams{
 				CA:           ca,
@@ -764,7 +761,6 @@ func TestSubscribeToJWTBundles(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
 		t.Run(tt.testName, func(t *testing.T) {
 			params := testParams{
 				CA:           ca,
diff --git a/pkg/agent/api/health/v1/service_test.go b/pkg/agent/api/health/v1/service_test.go
index e7feb51f41..a134448c11 100644
--- a/pkg/agent/api/health/v1/service_test.go
+++ b/pkg/agent/api/health/v1/service_test.go
@@ -84,7 +84,6 @@ func TestServiceCheck(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			log, logHook := test.NewNullLogger()
 
diff --git a/pkg/agent/attestor/node/node_test.go b/pkg/agent/attestor/node/node_test.go
index 1cec8ad028..33bb29bc87 100644
--- a/pkg/agent/attestor/node/node_test.go
+++ b/pkg/agent/attestor/node/node_test.go
@@ -281,8 +281,6 @@ func TestAttestor(t *testing.T) {
 	}
 
 	for _, testCase := range testCases {
-		testCase := testCase
-
 		t.Run(testCase.name, func(t *testing.T) {
 			require := require.New(t)
 
@@ -527,7 +525,6 @@ func TestIsSVIDExpired(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.Desc, func(t *testing.T) {
 			isExpired := attestor.IsSVIDExpired(tt.SVID, func() time.Time { return now })
 			require.Equal(t, tt.ExpectExpired, isExpired)
diff --git a/pkg/agent/client/client_test.go b/pkg/agent/client/client_test.go
index 32ddae38e0..b6a6a2319f 100644
--- a/pkg/agent/client/client_test.go
+++ b/pkg/agent/client/client_test.go
@@ -403,7 +403,6 @@ func TestRenewSVID(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			logHook.Reset()
 			tc.agentServer.err = tt.agentErr
@@ -757,7 +756,6 @@ func TestFetchUpdatesReleaseConnectionIfItFailsToFetch(t *testing.T) {
 			err: "failed to fetch bundle: rpc error: code = Unknown desc = an error",
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			client, tc := createClient(t)
 			tt.setupTest(tc)
@@ -969,7 +967,6 @@ func TestFetchJWTSVID(t *testing.T) {
 			fetchErr: status.Error(codes.Internal, "NewJWTSVID fails"),
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			tt.setupTest(tt.fetchErr)
 			resp, err := client.NewJWTSVID(ctx, "entry-id", []string{"myAud"})
diff --git a/pkg/agent/common/sigstore/sigstore_test.go b/pkg/agent/common/sigstore/sigstore_test.go
index 7d516bb93f..d95406ec2b 100644
--- a/pkg/agent/common/sigstore/sigstore_test.go
+++ b/pkg/agent/common/sigstore/sigstore_test.go
@@ -381,7 +381,6 @@ func TestVerify(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 
diff --git a/pkg/agent/endpoints/endpoints_test.go b/pkg/agent/endpoints/endpoints_test.go
index 1b8e42d6db..ce12240d3c 100644
--- a/pkg/agent/endpoints/endpoints_test.go
+++ b/pkg/agent/endpoints/endpoints_test.go
@@ -163,7 +163,6 @@ func TestEndpoints(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			log, hook := test.NewNullLogger()
 			metrics := fakemetrics.New()
diff --git a/pkg/agent/endpoints/workload/handler_test.go b/pkg/agent/endpoints/workload/handler_test.go
index d2c90c3911..e60c02b146 100644
--- a/pkg/agent/endpoints/workload/handler_test.go
+++ b/pkg/agent/endpoints/workload/handler_test.go
@@ -266,7 +266,6 @@ func TestFetchX509SVID(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			params := testParams{
 				CA:         ca,
@@ -425,7 +424,6 @@ func TestFetchX509Bundles(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
 		t.Run(tt.testName, func(t *testing.T) {
 			params := testParams{
 				CA:                            ca,
@@ -837,7 +835,6 @@ func TestFetchJWTSVID(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			params := testParams{
 				CA:         ca,
@@ -1042,7 +1039,6 @@ func TestFetchJWTBundles(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			params := testParams{
 				CA:                            ca,
@@ -1476,7 +1472,6 @@ func TestValidateJWTSVID(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			params := testParams{
 				Updates:                 tt.updates,
diff --git a/pkg/agent/manager/cache/jwt_cache_test.go b/pkg/agent/manager/cache/jwt_cache_test.go
index 754ece5266..eb9748f3ea 100644
--- a/pkg/agent/manager/cache/jwt_cache_test.go
+++ b/pkg/agent/manager/cache/jwt_cache_test.go
@@ -201,7 +201,6 @@ func TestJWTSVIDCache(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			cache := NewJWTSVIDCache(log, fakeMetrics, 8)
 			if tt.setJWTSVIDsCached != nil {
diff --git a/pkg/agent/manager/storecache/cache_test.go b/pkg/agent/manager/storecache/cache_test.go
index 008748126a..17f4ccc39b 100644
--- a/pkg/agent/manager/storecache/cache_test.go
+++ b/pkg/agent/manager/storecache/cache_test.go
@@ -523,8 +523,6 @@ func TestUpdateEntries(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
-
 		t.Run(tt.name, func(t *testing.T) {
 			log, hook := test.NewNullLogger()
 			log.Level = logrus.DebugLevel
diff --git a/pkg/agent/plugin/keymanager/test/keymanagertest.go b/pkg/agent/plugin/keymanager/test/keymanagertest.go
index 01328e743a..ada6655df3 100644
--- a/pkg/agent/plugin/keymanager/test/keymanagertest.go
+++ b/pkg/agent/plugin/keymanager/test/keymanagertest.go
@@ -263,7 +263,6 @@ func assertRSAKey(t *testing.T, key keymanager.Key, bits int) {
 
 func testSignCertificates(t *testing.T, key keymanager.Key, signatureAlgorithms []x509.SignatureAlgorithm) {
 	for _, signatureAlgorithm := range signatureAlgorithms {
-		signatureAlgorithm := signatureAlgorithm
 		t.Run("sign data "+signatureAlgorithm.String(), func(t *testing.T) {
 			assertSignCertificate(t, key, signatureAlgorithm)
 		})
diff --git a/pkg/agent/plugin/keymanager/v1_test.go b/pkg/agent/plugin/keymanager/v1_test.go
index b465cc738a..95903cdb3f 100644
--- a/pkg/agent/plugin/keymanager/v1_test.go
+++ b/pkg/agent/plugin/keymanager/v1_test.go
@@ -72,7 +72,6 @@ func TestV1GenerateKey(t *testing.T) {
 			expectCode: codes.OK,
 		},
 	} {
-		tt := tt
 		t.Run(tt.test, func(t *testing.T) {
 			plugin := fakeV1Plugin{
 				generateKeyResponse: &keymanagerv1.GenerateKeyResponse{
@@ -137,7 +136,6 @@ func TestV1GetKey(t *testing.T) {
 			expectCode: codes.OK,
 		},
 	} {
-		tt := tt
 		t.Run(tt.test, func(t *testing.T) {
 			plugin := fakeV1Plugin{
 				getPublicKeyResponse: &keymanagerv1.GetPublicKeyResponse{
@@ -194,7 +192,6 @@ func TestV1GetKeys(t *testing.T) {
 			expectCode: codes.OK,
 		},
 	} {
-		tt := tt
 		t.Run(tt.test, func(t *testing.T) {
 			resp := &keymanagerv1.GetPublicKeysResponse{}
 			if tt.publicKey != nil {
@@ -291,7 +288,6 @@ func TestV1SignData(t *testing.T) {
 			expectCode:       codes.OK,
 		},
 	} {
-		tt := tt
 		t.Run(tt.test, func(t *testing.T) {
 			plugin := fakeV1Plugin{
 				expectSignerOpts: tt.expectSignerOpts,
diff --git a/pkg/agent/plugin/nodeattestor/gcpiit/iit_test.go b/pkg/agent/plugin/nodeattestor/gcpiit/iit_test.go
index 523e136948..bc0bc5a8c7 100644
--- a/pkg/agent/plugin/nodeattestor/gcpiit/iit_test.go
+++ b/pkg/agent/plugin/nodeattestor/gcpiit/iit_test.go
@@ -160,7 +160,6 @@ func TestRetrieveIdentity(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt // alias loop variable as it is used in the closure
 		t.Run(tt.msg, func(t *testing.T) {
 			url := tt.url
 			if tt.handleFunc != nil {
diff --git a/pkg/agent/plugin/nodeattestor/httpchallenge/httpchallenge_test.go b/pkg/agent/plugin/nodeattestor/httpchallenge/httpchallenge_test.go
index 4be50e94cc..19b33a6e6d 100644
--- a/pkg/agent/plugin/nodeattestor/httpchallenge/httpchallenge_test.go
+++ b/pkg/agent/plugin/nodeattestor/httpchallenge/httpchallenge_test.go
@@ -39,7 +39,6 @@ func TestConfigureCommon(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			plugin := newPlugin()
 
@@ -85,7 +84,6 @@ func TestAidAttestationFailures(t *testing.T) {
 		},
 	}
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			var err error
 			p := loadAndConfigurePlugin(t, tt.trustDomain, tt.config)
@@ -194,7 +192,6 @@ func TestAidAttestationSucceeds(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			var err error
 			expectPayload, err := json.Marshal(&tt.attestationData)
diff --git a/pkg/agent/plugin/nodeattestor/tpmdevid/devid_test.go b/pkg/agent/plugin/nodeattestor/tpmdevid/devid_test.go
index 562bb076d1..0e4966ecb9 100644
--- a/pkg/agent/plugin/nodeattestor/tpmdevid/devid_test.go
+++ b/pkg/agent/plugin/nodeattestor/tpmdevid/devid_test.go
@@ -166,7 +166,6 @@ func TestConfigureCommon(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			tpmdevid.AutoDetectTPMPath = func(string) (string, error) {
 				if isWindows {
@@ -265,7 +264,6 @@ func TestConfigurePosix(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			tpmdevid.AutoDetectTPMPath = func(string) (string, error) {
 				if tt.autoDetectTPMFails {
@@ -359,7 +357,6 @@ func TestConfigureWindows(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			tpmdevid.AutoDetectTPMPath = func(string) (string, error) {
 				return "", errors.New("autodetect is not supported on windows")
@@ -477,7 +474,6 @@ func TestAidAttestationFailures(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			sim := setupSimulator(t)
 
diff --git a/pkg/agent/plugin/nodeattestor/tpmdevid/tpmutil/session_test.go b/pkg/agent/plugin/nodeattestor/tpmdevid/tpmutil/session_test.go
index 1adc873b47..3c2d485f75 100644
--- a/pkg/agent/plugin/nodeattestor/tpmdevid/tpmutil/session_test.go
+++ b/pkg/agent/plugin/nodeattestor/tpmdevid/tpmutil/session_test.go
@@ -153,7 +153,6 @@ func TestNewSession(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			// Run hook if exists, generally used to intentionally cause an error
 			// and test more code paths.
@@ -251,7 +250,6 @@ func TestSolveDevIDChallenge(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			if isWindows {
 				tt.scfg.DevicePath = ""
@@ -325,7 +323,6 @@ func TestSolveCredActivationChallenge(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			nonce, err := tpm.SolveCredActivationChallenge(tt.credBlob, tt.encryptedSecret)
 			if tt.expErr != "" {
@@ -365,7 +362,6 @@ func TestCertifyDevIDKey(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			var devicePath string
 			if !isWindows {
@@ -463,7 +459,6 @@ func TestGetEKCert(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			if tt.hook != nil {
 				tt.hook()
@@ -521,7 +516,6 @@ func TestGetEKPublic(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			if tt.hook != nil {
 				tt.hook()
@@ -595,7 +589,6 @@ func TestAutoDetectTPMPath(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			// Create devices
 			for _, fileName := range tt.deviceNames {
diff --git a/pkg/agent/plugin/nodeattestor/v1_test.go b/pkg/agent/plugin/nodeattestor/v1_test.go
index dacf9a6a67..41beeeec6f 100644
--- a/pkg/agent/plugin/nodeattestor/v1_test.go
+++ b/pkg/agent/plugin/nodeattestor/v1_test.go
@@ -107,7 +107,6 @@ func TestV1(t *testing.T) {
 			expectMessage: "nodeattestor(test): plugin response missing challenge response",
 		},
 	} {
-		tt := tt
 		t.Run(tt.test, func(t *testing.T) {
 			nodeattestor := loadV1Plugin(t, tt.pluginImpl)
 			err := nodeattestor.Attest(context.Background(), tt.streamImpl)
diff --git a/pkg/agent/plugin/svidstore/gcpsecretmanager/gcloud_test.go b/pkg/agent/plugin/svidstore/gcpsecretmanager/gcloud_test.go
index a2645a2342..79be3fef4e 100644
--- a/pkg/agent/plugin/svidstore/gcpsecretmanager/gcloud_test.go
+++ b/pkg/agent/plugin/svidstore/gcpsecretmanager/gcloud_test.go
@@ -694,7 +694,6 @@ func TestPutX509SVID(t *testing.T) {
 			expectMsgPrefix: "svidstore(gcp_secretmanager): failed to add secret version: rpc error: code = DeadlineExceeded desc = some error",
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			ctx, cancel := context.WithTimeout(context.Background(), time.Minute)
 			defer cancel()
diff --git a/pkg/agent/plugin/svidstore/utils_test.go b/pkg/agent/plugin/svidstore/utils_test.go
index 8d38d2b972..6a8b84766b 100644
--- a/pkg/agent/plugin/svidstore/utils_test.go
+++ b/pkg/agent/plugin/svidstore/utils_test.go
@@ -92,7 +92,6 @@ func TestParseMetadata(t *testing.T) {
 			expectErr:  `metadata does not contain a colon: "invalid"`,
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			result, err := svidstore.ParseMetadata(tt.secretData)
 			if tt.expectErr != "" {
@@ -238,7 +237,6 @@ func TestSecretFromProto(t *testing.T) {
 			err: "failed to parse FederatedBundle \"federated1\": x509: malformed certificate",
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			resp, err := svidstore.SecretFromProto(tt.req)
 			if tt.err != "" {
diff --git a/pkg/agent/plugin/workloadattestor/docker/cgroup/dockerfinder_test.go b/pkg/agent/plugin/workloadattestor/docker/cgroup/dockerfinder_test.go
index 2c62e730a3..47a9d57a3b 100644
--- a/pkg/agent/plugin/workloadattestor/docker/cgroup/dockerfinder_test.go
+++ b/pkg/agent/plugin/workloadattestor/docker/cgroup/dockerfinder_test.go
@@ -123,7 +123,6 @@ func TestContainerIDFinders(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.msg, func(t *testing.T) {
 			cf, err := NewContainerIDFinder(tt.matchers)
 			if tt.expectErr != "" {
diff --git a/pkg/agent/plugin/workloadattestor/docker/docker_posix_test.go b/pkg/agent/plugin/workloadattestor/docker/docker_posix_test.go
index 9458952530..a7151886df 100644
--- a/pkg/agent/plugin/workloadattestor/docker/docker_posix_test.go
+++ b/pkg/agent/plugin/workloadattestor/docker/docker_posix_test.go
@@ -89,7 +89,6 @@ func TestContainerExtraction(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt // alias loop variable as it is used in the closure
 		t.Run(tt.desc, func(t *testing.T) {
 			withRootDirOpt := prepareRootDirOpt(t, tt.cgroups)
 			var d Docker = dockerError{}
diff --git a/pkg/agent/plugin/workloadattestor/docker/docker_test.go b/pkg/agent/plugin/workloadattestor/docker/docker_test.go
index ec583c859f..3380228366 100644
--- a/pkg/agent/plugin/workloadattestor/docker/docker_test.go
+++ b/pkg/agent/plugin/workloadattestor/docker/docker_test.go
@@ -76,7 +76,6 @@ func TestDockerSelectors(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt // alias loop variable as it is used in the closure
 		t.Run(tt.desc, func(t *testing.T) {
 			d := fakeContainer{
 				Labels: tt.mockContainerLabels,
diff --git a/pkg/agent/plugin/workloadattestor/k8s/k8s_posix_test.go b/pkg/agent/plugin/workloadattestor/k8s/k8s_posix_test.go
index 0acb2019cb..6969b4368c 100644
--- a/pkg/agent/plugin/workloadattestor/k8s/k8s_posix_test.go
+++ b/pkg/agent/plugin/workloadattestor/k8s/k8s_posix_test.go
@@ -307,7 +307,6 @@ func TestGetContainerIDFromCGroups(t *testing.T) {
 			expectMsg:         "multiple pod UIDs found in cgroups (11111111-b29f-11e7-9350-020968147796, 22222222-b29f-11e7-9350-020968147796)",
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			podUID, containerID, err := getPodUIDAndContainerIDFromCGroups(makeCGroups(tt.cgroupPaths))
 			spiretest.RequireGRPCStatus(t, err, tt.expectCode, tt.expectMsg)
@@ -411,7 +410,6 @@ func TestGetPodUIDAndContainerIDFromCGroupPath(t *testing.T) {
 			cgroupPath: "/kubepods/pod2732ca68f6358eba7703fb6f82a25c94",
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Logf("cgroup path=%s", tt.cgroupPath)
 			podUID, containerID, ok := getPodUIDAndContainerIDFromCGroupPath(tt.cgroupPath)
diff --git a/pkg/agent/plugin/workloadattestor/k8s/k8s_test.go b/pkg/agent/plugin/workloadattestor/k8s/k8s_test.go
index e270c106b5..18387ed06f 100644
--- a/pkg/agent/plugin/workloadattestor/k8s/k8s_test.go
+++ b/pkg/agent/plugin/workloadattestor/k8s/k8s_test.go
@@ -579,7 +579,6 @@ func (s *Suite) TestConfigure() {
 	}
 
 	for _, testCase := range testCases {
-		testCase := testCase // alias loop variable as it is used in the closure
 		s.T().Run(testCase.name, func(t *testing.T) {
 			p := s.newPlugin()
 
@@ -681,7 +680,6 @@ func (s *Suite) TestConfigureWithSigstore() {
 	}
 
 	for _, tc := range cases {
-		tc := tc
 		s.T().Run(tc.name, func(t *testing.T) {
 			p := s.newPlugin()
 
diff --git a/pkg/agent/plugin/workloadattestor/systemd/systemd_posix_test.go b/pkg/agent/plugin/workloadattestor/systemd/systemd_posix_test.go
index a947a642e9..cacdb8d14d 100644
--- a/pkg/agent/plugin/workloadattestor/systemd/systemd_posix_test.go
+++ b/pkg/agent/plugin/workloadattestor/systemd/systemd_posix_test.go
@@ -44,7 +44,6 @@ func TestPlugin(t *testing.T) {
 	}
 
 	for _, testCase := range testCases {
-		testCase := testCase
 		log, logHook := test.NewNullLogger()
 		t.Run(testCase.name, func(t *testing.T) {
 			p := loadPlugin(t, log)
diff --git a/pkg/agent/plugin/workloadattestor/unix/unix_posix_test.go b/pkg/agent/plugin/workloadattestor/unix/unix_posix_test.go
index ce014bf48c..f2ef844fcb 100644
--- a/pkg/agent/plugin/workloadattestor/unix/unix_posix_test.go
+++ b/pkg/agent/plugin/workloadattestor/unix/unix_posix_test.go
@@ -233,7 +233,6 @@ func (s *Suite) TestAttest() {
 	s.writeFile("exe", []byte("data"))
 
 	for _, testCase := range testCases {
-		testCase := testCase
 		s.T().Run(testCase.name, func(t *testing.T) {
 			defer s.logHook.Reset()
 
diff --git a/pkg/agent/svid/store/service_test.go b/pkg/agent/svid/store/service_test.go
index c3219b5077..d49ee3f689 100644
--- a/pkg/agent/svid/store/service_test.go
+++ b/pkg/agent/svid/store/service_test.go
@@ -109,7 +109,6 @@ func TestRun(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			ctx, cancel := context.WithTimeout(context.Background(), time.Minute)
 			defer cancel()
@@ -361,7 +360,6 @@ func TestRunDeleteSecrets(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			ctx, cancel := context.WithTimeout(context.Background(), time.Minute)
 			defer cancel()
diff --git a/pkg/common/api/middleware/metrics_test.go b/pkg/common/api/middleware/metrics_test.go
index 753c59cf1d..b5773d4178 100644
--- a/pkg/common/api/middleware/metrics_test.go
+++ b/pkg/common/api/middleware/metrics_test.go
@@ -46,7 +46,6 @@ func TestWithMetrics(t *testing.T) {
 			statusLabelValue: codes.PermissionDenied.String(),
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			var expectedLabels []telemetry.Label
 
diff --git a/pkg/common/bundleutil/bundle_test.go b/pkg/common/bundleutil/bundle_test.go
index 51a19e4c17..019460f9a2 100644
--- a/pkg/common/bundleutil/bundle_test.go
+++ b/pkg/common/bundleutil/bundle_test.go
@@ -88,7 +88,6 @@ func TestPruneBundle(t *testing.T) {
 			changed:    true,
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			log, _ := testlog.NewNullLogger()
 			newBundle, changed, err := PruneBundle(tt.bundle, tt.expiration, log)
@@ -217,7 +216,6 @@ func TestCommonBundleFromProto(t *testing.T) {
 			expectError: `bundle has an invalid trust domain "invalid TD": trust domain characters are limited to lowercase letters, numbers, dots, dashes, and underscores`,
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			bundle, err := CommonBundleFromProto(tt.bundle)
 
diff --git a/pkg/common/bundleutil/marshal_test.go b/pkg/common/bundleutil/marshal_test.go
index 332073a3fd..ae7d2f8633 100644
--- a/pkg/common/bundleutil/marshal_test.go
+++ b/pkg/common/bundleutil/marshal_test.go
@@ -141,7 +141,6 @@ func TestMarshal(t *testing.T) {
 	trustDomain := spiffeid.RequireTrustDomainFromString("domain.test")
 
 	for _, testCase := range testCases {
-		testCase := testCase
 		t.Run(testCase.name, func(t *testing.T) {
 			bundle := spiffebundle.New(trustDomain)
 			bundle.SetRefreshHint(time.Minute)
diff --git a/pkg/common/bundleutil/unmarshal_test.go b/pkg/common/bundleutil/unmarshal_test.go
index 8424cf8683..5cc7da925f 100644
--- a/pkg/common/bundleutil/unmarshal_test.go
+++ b/pkg/common/bundleutil/unmarshal_test.go
@@ -106,7 +106,6 @@ func TestUnmarshal(t *testing.T) {
 	}
 
 	for _, testCase := range testCases {
-		testCase := testCase
 		t.Run(testCase.name, func(t *testing.T) {
 			bundle, err := Unmarshal(trustDomain, []byte(testCase.doc))
 			if testCase.err != "" {
diff --git a/pkg/common/cli/trust_domain_test.go b/pkg/common/cli/trust_domain_test.go
index 158c22bdd6..8e1814a0c9 100644
--- a/pkg/common/cli/trust_domain_test.go
+++ b/pkg/common/cli/trust_domain_test.go
@@ -38,7 +38,6 @@ func TestParseTrustDomain(t *testing.T) {
 	}
 
 	for _, testCase := range testCases {
-		testCase := testCase
 		t.Run(testCase.msg, func(t *testing.T) {
 			logger, hook := logtest.NewNullLogger()
 			td, err := ParseTrustDomain(testCase.domain, logger)
diff --git a/pkg/common/diskutil/file_posix_test.go b/pkg/common/diskutil/file_posix_test.go
index bab3479188..ee96195a0d 100644
--- a/pkg/common/diskutil/file_posix_test.go
+++ b/pkg/common/diskutil/file_posix_test.go
@@ -94,7 +94,6 @@ func TestWriteFile(t *testing.T) {
 		},
 	}
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			file := filepath.Join(dir, "file")
 			err := tt.atomicWriteFunc(file, tt.data)
diff --git a/pkg/common/diskutil/file_windows_test.go b/pkg/common/diskutil/file_windows_test.go
index cf6789d87c..31e275cbcf 100644
--- a/pkg/common/diskutil/file_windows_test.go
+++ b/pkg/common/diskutil/file_windows_test.go
@@ -96,7 +96,6 @@ func TestWriteFile(t *testing.T) {
 		},
 	}
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			file := filepath.Join(dir, "file")
 			err := tt.atomicWriteFunc(file, tt.data)
diff --git a/pkg/common/hostservice/metricsservice/v1_test.go b/pkg/common/hostservice/metricsservice/v1_test.go
index 8b668deb08..761cf8ddf3 100644
--- a/pkg/common/hostservice/metricsservice/v1_test.go
+++ b/pkg/common/hostservice/metricsservice/v1_test.go
@@ -43,7 +43,6 @@ func TestV1SetGauge(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.desc, func(t *testing.T) {
 			expected := fakemetrics.New()
 			expected.SetGaugeWithLabels(tt.req.Key, tt.req.Val, v1ConvertToTelemetryLabels(tt.req.Labels))
@@ -89,7 +88,6 @@ func TestV1MeasureSince(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.desc, func(t *testing.T) {
 			expected := fakemetrics.New()
 			expected.MeasureSinceWithLabels(tt.req.Key, time.Unix(0, tt.req.Time), v1ConvertToTelemetryLabels(tt.req.Labels))
@@ -135,7 +133,6 @@ func TestV1IncrCounter(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.desc, func(t *testing.T) {
 			expected := fakemetrics.New()
 			expected.IncrCounterWithLabels(tt.req.Key, tt.req.Val, v1ConvertToTelemetryLabels(tt.req.Labels))
@@ -181,7 +178,6 @@ func TestV1AddSample(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.desc, func(t *testing.T) {
 			expected := fakemetrics.New()
 			expected.AddSampleWithLabels(tt.req.Key, tt.req.Val, v1ConvertToTelemetryLabels(tt.req.Labels))
@@ -214,7 +210,6 @@ func TestV1EmitKey(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.desc, func(t *testing.T) {
 			expected := fakemetrics.New()
 			expected.EmitKey(tt.req.Key, tt.req.Val)
@@ -320,7 +315,6 @@ func TestV1ConvertToTelemetryLabels(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.desc, func(t *testing.T) {
 			outLabels := v1ConvertToTelemetryLabels(tt.inLabels)
 
@@ -397,7 +391,6 @@ func TestV1ConvertToRPCLabels(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.desc, func(t *testing.T) {
 			outLabels := v1ConvertToRPCLabels(tt.inLabels)
 
diff --git a/pkg/common/jwtsvid/validate_test.go b/pkg/common/jwtsvid/validate_test.go
index 90cd1a4294..1156b1e2a0 100644
--- a/pkg/common/jwtsvid/validate_test.go
+++ b/pkg/common/jwtsvid/validate_test.go
@@ -76,7 +76,6 @@ func (s *TokenSuite) TestDifferentKeys() {
 	}
 
 	for _, testCase := range testCases {
-		testCase := testCase // alias loop variable as it is used in the closure
 		s.T().Run(testCase.kid, func(t *testing.T) {
 			token := s.signJWTSVID(fakeSpiffeID, fakeAudience, time.Now().Add(time.Hour), testCase.key, testCase.kid)
 
diff --git a/pkg/common/plugin/sshpop/handshake_test.go b/pkg/common/plugin/sshpop/handshake_test.go
index 1999eb1bd9..8f8845c550 100644
--- a/pkg/common/plugin/sshpop/handshake_test.go
+++ b/pkg/common/plugin/sshpop/handshake_test.go
@@ -211,7 +211,6 @@ func TestVerifyAttestationData(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.desc, func(t *testing.T) {
 			s.state = stateServerInit
 			s.s.canonicalDomain = tt.serverCanonicalDomain
@@ -278,7 +277,6 @@ func TestRespondToChallenge(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.desc, func(t *testing.T) {
 			c.state = stateProvidedAttestationData
 			_, err := c.RespondToChallenge(tt.challengeReq)
@@ -339,7 +337,6 @@ func TestVerifyChallengeResponse(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.desc, func(t *testing.T) {
 			s.state = stateAttestationDataVerified
 			s.cert = c.c.cert
@@ -393,7 +390,6 @@ func TestDecanonicalizeHostname(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.desc, func(t *testing.T) {
 			hostname, err := decanonicalizeHostname(tt.fqdn, tt.domain)
 			if tt.expectErr != "" {
diff --git a/pkg/common/plugin/sshpop/sshpop_test.go b/pkg/common/plugin/sshpop/sshpop_test.go
index 1a551f21b6..c441475c05 100644
--- a/pkg/common/plugin/sshpop/sshpop_test.go
+++ b/pkg/common/plugin/sshpop/sshpop_test.go
@@ -54,7 +54,6 @@ func TestNewClient(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.desc, func(t *testing.T) {
 			c, err := NewClient("example.org", tt.configString)
 			if tt.expectErr != "" {
@@ -139,7 +138,6 @@ func TestNewServer(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.desc, func(t *testing.T) {
 			s, err := NewServer(tt.trustDomain, tt.configString)
 			if tt.expectErr != "" {
@@ -192,7 +190,6 @@ func TestPubkeysFromPath(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.desc, func(t *testing.T) {
 			pubkeys, err := pubkeysFromPath(tt.pubkeyPath)
 			if tt.expectErr != "" {
diff --git a/pkg/common/plugin/x509pop/x509pop_test.go b/pkg/common/plugin/x509pop/x509pop_test.go
index 23ecc43bc1..9714d52c6d 100644
--- a/pkg/common/plugin/x509pop/x509pop_test.go
+++ b/pkg/common/plugin/x509pop/x509pop_test.go
@@ -154,7 +154,6 @@ func TestMakeAgentID(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.desc, func(t *testing.T) {
 			cert := &x509.Certificate{
 				Subject: pkix.Name{
diff --git a/pkg/common/selector/selector_test.go b/pkg/common/selector/selector_test.go
index 9c011a1de3..5f8dc3fe90 100644
--- a/pkg/common/selector/selector_test.go
+++ b/pkg/common/selector/selector_test.go
@@ -25,7 +25,6 @@ func TestValidate(t *testing.T) {
 	}
 
 	for _, test := range tests {
-		test := test // alias loop variable as it is used in the closure
 		t.Run(test.name, func(t *testing.T) {
 			s := &common.Selector{
 				Type: test.selectorType,
diff --git a/pkg/common/telemetry/agent/keymanager/wrapper_test.go b/pkg/common/telemetry/agent/keymanager/wrapper_test.go
index 3e6cef67d9..57647fb49f 100644
--- a/pkg/common/telemetry/agent/keymanager/wrapper_test.go
+++ b/pkg/common/telemetry/agent/keymanager/wrapper_test.go
@@ -72,7 +72,6 @@ func TestWithMetrics(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
 		m.Reset()
 		require.NoError(t, tt.call())
 		key := strings.Split(tt.key, ".")
diff --git a/pkg/common/telemetry/sanitize_test.go b/pkg/common/telemetry/sanitize_test.go
index 9b89a2da98..82cebce9b7 100644
--- a/pkg/common/telemetry/sanitize_test.go
+++ b/pkg/common/telemetry/sanitize_test.go
@@ -37,7 +37,6 @@ func TestSanitize(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.desc, func(t *testing.T) {
 			out := sanitize(tt.in)
 
@@ -73,7 +72,6 @@ func TestSanitizeLabel(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.desc, func(t *testing.T) {
 			out := sanitizeLabel(labelName, tt.in)
 
@@ -132,7 +130,6 @@ func TestGetSanitizedLabels(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.desc, func(t *testing.T) {
 			out := SanitizeLabels(tt.in)
 
diff --git a/pkg/common/telemetry/server/datastore/wrapper_test.go b/pkg/common/telemetry/server/datastore/wrapper_test.go
index 79c1a87f8e..9f77e73b8f 100644
--- a/pkg/common/telemetry/server/datastore/wrapper_test.go
+++ b/pkg/common/telemetry/server/datastore/wrapper_test.go
@@ -250,7 +250,6 @@ func TestWithMetrics(t *testing.T) {
 			methodName: "ListCAJournalsForTesting",
 		},
 	} {
-		tt := tt
 		methodType, ok := wt.MethodByName(tt.methodName)
 		require.True(t, ok, "method %q does not exist on DataStore interface", tt.methodName)
 		methodValue := wv.Method(methodType.Index)
diff --git a/pkg/common/telemetry/server/keymanager/wrapper_test.go b/pkg/common/telemetry/server/keymanager/wrapper_test.go
index ed4a543282..02626d24e2 100644
--- a/pkg/common/telemetry/server/keymanager/wrapper_test.go
+++ b/pkg/common/telemetry/server/keymanager/wrapper_test.go
@@ -81,7 +81,6 @@ func TestWithMetrics(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
 		m.Reset()
 		tt.call(t)
 
diff --git a/pkg/common/util/task.go b/pkg/common/util/task.go
index 4b0e9db263..cfaefea958 100644
--- a/pkg/common/util/task.go
+++ b/pkg/common/util/task.go
@@ -37,7 +37,6 @@ func RunTasks(ctx context.Context, tasks ...func(context.Context) error) error {
 
 	wg.Add(len(tasks))
 	for _, task := range tasks {
-		task := task
 		go func() {
 			errch <- runTask(task)
 		}()
diff --git a/pkg/server/api/agent/v1/service_test.go b/pkg/server/api/agent/v1/service_test.go
index b834ff7397..a8e62947a5 100644
--- a/pkg/server/api/agent/v1/service_test.go
+++ b/pkg/server/api/agent/v1/service_test.go
@@ -213,7 +213,6 @@ func TestCountAgents(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			test := setupServiceTest(t, 0)
 			defer test.Cleanup()
@@ -906,7 +905,6 @@ func TestListAgents(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			test.logHook.Reset()
 			test.ds.SetNextError(tt.dsError)
@@ -1161,7 +1159,6 @@ func TestBanAgent(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			test := setupServiceTest(t, 0)
 			defer test.Cleanup()
@@ -1405,7 +1402,6 @@ func TestDeleteAgent(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			test := setupServiceTest(t, 0)
 			defer test.Cleanup()
@@ -1637,7 +1633,6 @@ func TestGetAgent(t *testing.T) {
 			dsError: errors.New("datastore error"),
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			test := setupServiceTest(t, 0)
 			test.createTestNodes(ctx, t)
@@ -1981,7 +1976,6 @@ func TestRenewAgent(t *testing.T) {
 			expectDetail: &types.PermissionDeniedDetails{Reason: types.PermissionDeniedDetails_AGENT_MUST_REATTEST},
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			// Setup test
 			test := setupServiceTest(t, tt.agentSVIDTTL)
@@ -2163,7 +2157,6 @@ func TestCreateJoinToken(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			test := setupServiceTest(t, 0)
 			test.ds.SetNextError(tt.dsError)
@@ -3133,7 +3126,6 @@ func TestAttestAgent(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			// setup
 			test := setupServiceTest(t, 0)
diff --git a/pkg/server/api/agent_test.go b/pkg/server/api/agent_test.go
index 1f065fff10..3f60118031 100644
--- a/pkg/server/api/agent_test.go
+++ b/pkg/server/api/agent_test.go
@@ -67,7 +67,6 @@ func TestProtoFromAttestedNode(t *testing.T) {
 			expectErr: "scheme is missing or invalid",
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			a, err := api.ProtoFromAttestedNode(tt.n)
 
diff --git a/pkg/server/api/audit/audit_test.go b/pkg/server/api/audit/audit_test.go
index 3c6545f173..e2d902f652 100644
--- a/pkg/server/api/audit/audit_test.go
+++ b/pkg/server/api/audit/audit_test.go
@@ -235,7 +235,6 @@ func TestAuditWitTypesStatus(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			auditLog := audit.New(log)
 			logHook.Reset()
@@ -322,7 +321,6 @@ func TestAuditWithError(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			auditLog := audit.New(log)
 			logHook.Reset()
diff --git a/pkg/server/api/bundle/v1/service_test.go b/pkg/server/api/bundle/v1/service_test.go
index 86ce239281..1b92a84169 100644
--- a/pkg/server/api/bundle/v1/service_test.go
+++ b/pkg/server/api/bundle/v1/service_test.go
@@ -258,7 +258,6 @@ func TestGetFederatedBundle(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			test.logHook.Reset()
 			test.isAdmin = tt.isAdmin
@@ -360,7 +359,6 @@ func TestGetBundle(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			test := setupServiceTest(t)
 			defer test.Cleanup()
@@ -746,7 +744,6 @@ func TestAppendBundle(t *testing.T) {
 			noBundle: true,
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			test := setupServiceTest(t)
 			defer test.Cleanup()
@@ -1106,7 +1103,6 @@ func TestBatchDeleteFederatedBundle(t *testing.T) {
 			dsError:         status.New(codes.Internal, "datasource fails").Err(),
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			test := setupServiceTest(t)
 			defer test.Cleanup()
@@ -1376,7 +1372,6 @@ func TestPublishJWTAuthority(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			test.logHook.Reset()
 
@@ -1539,7 +1534,6 @@ func TestListFederatedBundles(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			test.logHook.Reset()
 
@@ -1693,7 +1687,6 @@ func TestCountBundles(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			test := setupServiceTest(t)
 			defer test.Cleanup()
@@ -2064,7 +2057,6 @@ func TestBatchCreateFederatedBundle(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			test.logHook.Reset()
 			clearDSBundles(t, test.ds)
@@ -2451,7 +2443,6 @@ func TestBatchUpdateFederatedBundle(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			test := setupServiceTest(t)
 			defer test.Cleanup()
@@ -2815,7 +2806,6 @@ func TestBatchSetFederatedBundle(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			test := setupServiceTest(t)
 			defer test.Cleanup()
diff --git a/pkg/server/api/bundle_test.go b/pkg/server/api/bundle_test.go
index 64007140e9..a6604ce4dd 100644
--- a/pkg/server/api/bundle_test.go
+++ b/pkg/server/api/bundle_test.go
@@ -90,7 +90,6 @@ func TestBundleToProto(t *testing.T) {
 			expectError: "invalid trust domain id: trust domain characters are limited to lowercase letters, numbers, dots, dashes, and underscores",
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			bundle, err := api.BundleToProto(tt.bundle)
 
@@ -214,7 +213,6 @@ func TestProtoToBundle(t *testing.T) {
 			expectError: "invalid trust domain: trust domain characters are limited to lowercase letters, numbers, dots, dashes, and underscores",
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			bundle, err := api.ProtoToBundle(tt.bundle)
 
diff --git a/pkg/server/api/debug/v1/service_test.go b/pkg/server/api/debug/v1/service_test.go
index b0d970e5be..1768f1a847 100644
--- a/pkg/server/api/debug/v1/service_test.go
+++ b/pkg/server/api/debug/v1/service_test.go
@@ -377,7 +377,6 @@ func TestGetInfo(t *testing.T) {
 			state: x509SVIDState,
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			test := setupServiceTest(t)
 			defer test.Cleanup()
diff --git a/pkg/server/api/entry/v1/service_test.go b/pkg/server/api/entry/v1/service_test.go
index b8bb18d7e0..636a5fd34b 100644
--- a/pkg/server/api/entry/v1/service_test.go
+++ b/pkg/server/api/entry/v1/service_test.go
@@ -141,7 +141,6 @@ func TestCountEntries(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			ds := fakedatastore.New(t)
 			test := setupServiceTest(t, ds)
@@ -1194,7 +1193,6 @@ func TestListEntries(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			test.logHook.Reset()
 			ds.SetNextError(tt.dsError)
@@ -1444,7 +1442,6 @@ func TestGetEntry(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			test.logHook.Reset()
 			ds.SetNextError(tt.dsError)
@@ -2390,7 +2387,6 @@ func TestBatchCreateEntry(t *testing.T) {
 			}},
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			ds := newFakeDS(t)
 
@@ -2651,7 +2647,6 @@ func TestBatchDeleteEntry(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			ds := fakedatastore.New(t)
 			test := setupServiceTest(t, ds)
@@ -2868,7 +2863,6 @@ func TestGetAuthorizedEntries(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			test := setupServiceTest(t, fakedatastore.New(t))
 			defer test.Cleanup()
@@ -3265,7 +3259,6 @@ func TestSyncAuthorizedEntries(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			test := setupServiceTest(t, fakedatastore.New(t))
 			defer func() {
@@ -4597,7 +4590,6 @@ func TestBatchUpdateEntry(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			ds := fakedatastore.New(t)
 			test := setupServiceTest(t, ds)
diff --git a/pkg/server/api/entry_test.go b/pkg/server/api/entry_test.go
index d0ae6de23b..27cd7694b3 100644
--- a/pkg/server/api/entry_test.go
+++ b/pkg/server/api/entry_test.go
@@ -95,7 +95,6 @@ func TestRegistrationEntryToProto(t *testing.T) {
 			err: "invalid SPIFFE ID: scheme is missing or invalid",
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			entry, err := api.RegistrationEntryToProto(tt.entry)
 			if tt.err != "" {
@@ -464,7 +463,6 @@ func TestProtoToRegistrationEntryWithMask(t *testing.T) {
 			err:  "hint is too long, max length is 1024 characters",
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			entry, err := api.ProtoToRegistrationEntryWithMask(context.Background(), td, tt.entry, tt.mask)
 			if tt.err != "" {
@@ -635,7 +633,6 @@ func TestProtoToRegistrationEntry(t *testing.T) {
 			err: "selector list is empty",
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			entry, err := api.ProtoToRegistrationEntry(context.Background(), td, tt.entry)
 			if tt.err != "" {
diff --git a/pkg/server/api/health/v1/service_test.go b/pkg/server/api/health/v1/service_test.go
index 01688182d6..7fb5714b7e 100644
--- a/pkg/server/api/health/v1/service_test.go
+++ b/pkg/server/api/health/v1/service_test.go
@@ -86,7 +86,6 @@ func TestServiceCheck(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			log, logHook := test.NewNullLogger()
 
diff --git a/pkg/server/api/id_test.go b/pkg/server/api/id_test.go
index 639b3d32d0..d97e32790a 100644
--- a/pkg/server/api/id_test.go
+++ b/pkg/server/api/id_test.go
@@ -50,7 +50,6 @@ func TestIDFromProto(t *testing.T) {
 	// runTests exercises all the test cases against the given function
 	runTests := func(t *testing.T, fn func(ctx context.Context, td spiffeid.TrustDomain, protoID *types.SPIFFEID) (spiffeid.ID, error), testCases []testCase) {
 		for _, testCase := range append(baseCases, testCases...) {
-			testCase := testCase
 			t.Run(testCase.name, func(t *testing.T) {
 				log, logHook := test.NewNullLogger()
 
@@ -233,7 +232,6 @@ func TestAttestedNodeToProto(t *testing.T) {
 	}
 
 	for _, testCase := range testCases {
-		testCase := testCase
 		t.Run(testCase.name, func(t *testing.T) {
 			agent, err := api.AttestedNodeToProto(testCase.attNode, testCase.selectors)
 			if testCase.err != "" {
diff --git a/pkg/server/api/logger/v1/service_test.go b/pkg/server/api/logger/v1/service_test.go
index d3731b7aae..728e2e367c 100644
--- a/pkg/server/api/logger/v1/service_test.go
+++ b/pkg/server/api/logger/v1/service_test.go
@@ -141,7 +141,6 @@ func TestGetLogger(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			test := setupServiceTest(t, tt.launchLevel)
 			defer test.Cleanup()
@@ -390,7 +389,6 @@ func TestSetLoggerThenGetLogger(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			test := setupServiceTest(t, tt.launchLevel)
 			defer test.Cleanup()
@@ -638,7 +636,6 @@ func TestResetLogger(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			test := setupServiceTest(t, tt.launchLevel)
 			defer test.Cleanup()
@@ -729,7 +726,6 @@ func TestUnsetSetLogLevelRequest(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			test := setupServiceTest(t, tt.launchLevel)
 			defer test.Cleanup()
diff --git a/pkg/server/api/middleware/authorization_test.go b/pkg/server/api/middleware/authorization_test.go
index 879a5dd644..c6f6fc58b7 100644
--- a/pkg/server/api/middleware/authorization_test.go
+++ b/pkg/server/api/middleware/authorization_test.go
@@ -321,7 +321,6 @@ func TestWithAuthorizationPreprocess(t *testing.T) {
 			expectMsg:  "failed to fetch caller entries: entry fetcher error",
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			ctx := context.Background()
 			policyEngine, err := authpolicy.NewEngineFromRego(ctx, tt.rego, inmem.NewFromObject(map[string]any{}))
diff --git a/pkg/server/api/middleware/caller_test.go b/pkg/server/api/middleware/caller_test.go
index ac3c10f101..2e4d883c0c 100644
--- a/pkg/server/api/middleware/caller_test.go
+++ b/pkg/server/api/middleware/caller_test.go
@@ -165,7 +165,6 @@ func TestCallerContextFromContext(t *testing.T) {
 			expectMsg:  "client certificate has a malformed URI SAN: scheme is missing or invalid",
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			ctxIn := context.Background()
 			if tt.peer != nil {
diff --git a/pkg/server/api/middleware/ratelimit_test.go b/pkg/server/api/middleware/ratelimit_test.go
index 443c051d45..a56ad2fa0b 100644
--- a/pkg/server/api/middleware/ratelimit_test.go
+++ b/pkg/server/api/middleware/ratelimit_test.go
@@ -264,7 +264,6 @@ func TestRateLimits(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			log, hook := test.NewNullLogger()
 			ctx := rpccontext.WithLogger(context.Background(), log)
diff --git a/pkg/server/api/selector_test.go b/pkg/server/api/selector_test.go
index 4b9711efd6..2e6377078c 100644
--- a/pkg/server/api/selector_test.go
+++ b/pkg/server/api/selector_test.go
@@ -67,7 +67,6 @@ func TestSelectorsFromProto(t *testing.T) {
 	}
 
 	for _, testCase := range testCases {
-		testCase := testCase
 		t.Run(testCase.name, func(t *testing.T) {
 			selectors, err := api.SelectorsFromProto(testCase.proto)
 			if testCase.err != "" {
diff --git a/pkg/server/api/status_test.go b/pkg/server/api/status_test.go
index 98cc26ab31..b2782d0b71 100644
--- a/pkg/server/api/status_test.go
+++ b/pkg/server/api/status_test.go
@@ -138,7 +138,6 @@ func TestMakeErr(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			log, hook := test.NewNullLogger()
 			err := api.MakeErr(log, tt.code, tt.msg, tt.err)
diff --git a/pkg/server/api/svid/v1/service_test.go b/pkg/server/api/svid/v1/service_test.go
index 361e1d8a06..d5a326b40f 100644
--- a/pkg/server/api/svid/v1/service_test.go
+++ b/pkg/server/api/svid/v1/service_test.go
@@ -528,7 +528,6 @@ func TestServiceMintX509SVID(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			test.logHook.Reset()
 
@@ -788,7 +787,6 @@ func TestServiceMintJWTSVID(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			test.logHook.Reset()
 
@@ -1089,7 +1087,6 @@ func TestServiceNewJWTSVID(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			test.logHook.Reset()
 
@@ -1717,7 +1714,6 @@ func TestServiceBatchNewX509SVID(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			test.logHook.Reset()
 
@@ -2002,7 +1998,6 @@ func TestNewDownstreamX509CA(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			test.logHook.Reset()
 			test.ef.err = tt.fetcherErr
diff --git a/pkg/server/api/trustdomain/v1/service_test.go b/pkg/server/api/trustdomain/v1/service_test.go
index 019a707ce1..dad4309eac 100644
--- a/pkg/server/api/trustdomain/v1/service_test.go
+++ b/pkg/server/api/trustdomain/v1/service_test.go
@@ -196,7 +196,6 @@ func TestGetFederationRelationship(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			ds := newFakeDS(t)
 			test := setupServiceTest(t, ds)
@@ -408,7 +407,6 @@ func TestListFederationRelationships(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			test.logHook.Reset()
 
diff --git a/pkg/server/authpolicy/policy_test.go b/pkg/server/authpolicy/policy_test.go
index dc91d0dfb5..012075ce56 100644
--- a/pkg/server/authpolicy/policy_test.go
+++ b/pkg/server/authpolicy/policy_test.go
@@ -209,7 +209,6 @@ func TestPolicy(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			var json map[string]any
 			err := util.UnmarshalJSON([]byte(tt.jsonData), &json)
@@ -386,7 +385,6 @@ func TestNewEngineFromConfig(t *testing.T) {
 			success: false,
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			ctx := context.Background()
 
@@ -425,7 +423,6 @@ func TestNewEngineFromRego(t *testing.T) {
 			success: false,
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			ctx := context.Background()
 			// Just create arbitrary store since there isn't a way to create
diff --git a/pkg/server/bundle/client/client_test.go b/pkg/server/bundle/client/client_test.go
index 5abc6243e8..8ced7d2ba7 100644
--- a/pkg/server/bundle/client/client_test.go
+++ b/pkg/server/bundle/client/client_test.go
@@ -91,7 +91,6 @@ func TestClient(t *testing.T) {
 	}
 
 	for _, testCase := range testCases {
-		testCase := testCase
 		t.Run(testCase.name, func(t *testing.T) {
 			serverCert, serverKey := createServerCertificate(t, testCase.serverID)
 
diff --git a/pkg/server/bundle/client/manager_test.go b/pkg/server/bundle/client/manager_test.go
index b2a4855bfc..f7a72e63cd 100644
--- a/pkg/server/bundle/client/manager_test.go
+++ b/pkg/server/bundle/client/manager_test.go
@@ -66,7 +66,6 @@ func TestManagerPeriodicBundleRefresh(t *testing.T) {
 	}
 
 	for _, testCase := range testCases {
-		testCase := testCase
 		t.Run(testCase.name, func(t *testing.T) {
 			test := newManagerTest(t, source,
 				func(spiffeid.TrustDomain) *spiffebundle.Bundle {
diff --git a/pkg/server/bundle/client/updater_test.go b/pkg/server/bundle/client/updater_test.go
index 1f4e17b60e..97decf57d1 100644
--- a/pkg/server/bundle/client/updater_test.go
+++ b/pkg/server/bundle/client/updater_test.go
@@ -81,7 +81,6 @@ func TestBundleUpdaterUpdateBundle(t *testing.T) {
 	}
 
 	for _, testCase := range testCases {
-		testCase := testCase
 		t.Run(testCase.name, func(t *testing.T) {
 			ds := fakedatastore.New(t)
 
diff --git a/pkg/server/bundle/datastore/wrapper_test.go b/pkg/server/bundle/datastore/wrapper_test.go
index 6fe3a42e3d..8100dbebeb 100644
--- a/pkg/server/bundle/datastore/wrapper_test.go
+++ b/pkg/server/bundle/datastore/wrapper_test.go
@@ -78,7 +78,6 @@ func TestWithBundlePublisher(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
 		ctx := context.Background()
 		t.Run(tt.name, func(t *testing.T) {
 			var ds datastore.DataStore = fakedatastore.New(t)
diff --git a/pkg/server/bundle/pubmanager/pubmanager.go b/pkg/server/bundle/pubmanager/pubmanager.go
index 37d5d91e28..bb1a66e10f 100644
--- a/pkg/server/bundle/pubmanager/pubmanager.go
+++ b/pkg/server/bundle/pubmanager/pubmanager.go
@@ -110,7 +110,6 @@ func (m *Manager) publishBundle(ctx context.Context) (err error) {
 	var wg sync.WaitGroup
 	wg.Add(len(m.bundlePublishers))
 	for _, bp := range m.bundlePublishers {
-		bp := bp
 		go func() {
 			defer wg.Done()
 
diff --git a/pkg/server/ca/ca_test.go b/pkg/server/ca/ca_test.go
index 6dcab1a468..265d27c402 100644
--- a/pkg/server/ca/ca_test.go
+++ b/pkg/server/ca/ca_test.go
@@ -367,7 +367,6 @@ func (s *CATestSuite) TestSignWorkloadX509SVIDWithSubject() {
 	}
 
 	for _, testCase := range testCases {
-		testCase := testCase
 		s.T().Run(testCase.name, func(t *testing.T) {
 			params := s.createWorkloadX509SVIDParams()
 			params.Subject = testCase.subject
diff --git a/pkg/server/ca/manager/manager_test.go b/pkg/server/ca/manager/manager_test.go
index 79462f00ec..165b15dd6f 100644
--- a/pkg/server/ca/manager/manager_test.go
+++ b/pkg/server/ca/manager/manager_test.go
@@ -934,7 +934,6 @@ func TestPruneCAJournals(t *testing.T) {
 
 	var expectedCAJournals []*datastore.CAJournal
 	for _, testCase := range testCases {
-		testCase := testCase
 		expectedCAJournals = []*datastore.CAJournal{}
 		t.Run(testCase.name, func(t *testing.T) {
 			// Have a fresh data store in each test case
@@ -1139,7 +1138,6 @@ func TestAlternateKeyTypes(t *testing.T) {
 	}
 
 	for _, testCase := range testCases {
-		testCase := testCase
 		t.Run(testCase.name, func(t *testing.T) {
 			ctx := context.Background()
 
diff --git a/pkg/server/ca/upstream_client_test.go b/pkg/server/ca/upstream_client_test.go
index 4921674c57..ce80d76b9d 100644
--- a/pkg/server/ca/upstream_client_test.go
+++ b/pkg/server/ca/upstream_client_test.go
@@ -100,7 +100,6 @@ func TestUpstreamClientMintX509CA_FailsOnBadFirstResponse(t *testing.T) {
 			expectMsg:  "X509 CA minted by upstream authority is invalid: oh no",
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			client, _, _ := setUpUpstreamClientTest(t, fakeupstreamauthority.Config{
 				TrustDomain:              trustDomain,
diff --git a/pkg/server/cache/dscache/cache_test.go b/pkg/server/cache/dscache/cache_test.go
index a433fcafa9..456802f26c 100644
--- a/pkg/server/cache/dscache/cache_test.go
+++ b/pkg/server/cache/dscache/cache_test.go
@@ -147,7 +147,6 @@ func TestBundleInvalidations(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			// Create datastore and cache
 			ds := fakedatastore.New(t)
diff --git a/pkg/server/datastore/sqlstore/migration_test.go b/pkg/server/datastore/sqlstore/migration_test.go
index 2f11bade86..9c0b11f64d 100644
--- a/pkg/server/datastore/sqlstore/migration_test.go
+++ b/pkg/server/datastore/sqlstore/migration_test.go
@@ -95,7 +95,6 @@ func TestGetDBCodeVersion(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt // alias loop variable as it is used in the closure
 		t.Run(tt.desc, func(t *testing.T) {
 			retVersion, err := getDBCodeVersion(tt.storedMigration)
 
@@ -157,7 +156,6 @@ func TestIsCompatibleCodeVersion(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt // alias loop variable as it is used in the closure
 		t.Run(tt.desc, func(t *testing.T) {
 			compatible := isCompatibleCodeVersion(tt.thisCodeVersion, tt.dbCodeVersion)
 
@@ -184,7 +182,6 @@ func TestIsDisabledMigrationAllowed(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt // alias loop variable as it is used in the closure
 		t.Run(tt.desc, func(t *testing.T) {
 			err := isDisabledMigrationAllowed(codeVersion, tt.dbCodeVersion)
 
diff --git a/pkg/server/datastore/sqlstore/sqlite_test.go b/pkg/server/datastore/sqlstore/sqlite_test.go
index 439c6632ca..daec15c929 100644
--- a/pkg/server/datastore/sqlstore/sqlite_test.go
+++ b/pkg/server/datastore/sqlstore/sqlite_test.go
@@ -65,7 +65,6 @@ func TestEmbellishSQLite3ConnString(t *testing.T) {
 	}
 
 	for _, testCase := range testCases {
-		testCase := testCase
 		t.Run(testCase.name, func(t *testing.T) {
 			actual, err := embellishSQLite3ConnString(testCase.in)
 			require.NoError(t, err)
diff --git a/pkg/server/datastore/sqlstore/sqlstore.go b/pkg/server/datastore/sqlstore/sqlstore.go
index 76c4f3ed5c..89b9fb6899 100644
--- a/pkg/server/datastore/sqlstore/sqlstore.go
+++ b/pkg/server/datastore/sqlstore/sqlstore.go
@@ -1343,7 +1343,6 @@ func listBundles(tx *gorm.DB, req *datastore.ListBundlesRequest) (*datastore.Lis
 		Pagination: p,
 	}
 	for _, model := range bundles {
-		model := model // alias the loop variable since we pass it by reference below
 		bundle, err := modelToBundle(&model)
 		if err != nil {
 			return nil, err
@@ -4283,7 +4282,6 @@ func listFederationRelationships(tx *gorm.DB, req *datastore.ListFederationRelat
 		FederationRelationships: []*datastore.FederationRelationship{},
 	}
 	for _, model := range federationRelationships {
-		model := model // alias the loop variable since we pass it by reference below
 		federationRelationship, err := modelToFederationRelationship(tx, &model)
 		if err != nil {
 			return nil, err
@@ -4788,7 +4786,6 @@ func listCAJournalsForTesting(tx *gorm.DB) (caJournals []*datastore.CAJournal, e
 	}
 
 	for _, model := range caJournalsModel {
-		model := model // alias the loop variable since we pass it by reference below
 		caJournals = append(caJournals, modelToCAJournal(model))
 	}
 	return caJournals, nil
diff --git a/pkg/server/datastore/sqlstore/sqlstore_test.go b/pkg/server/datastore/sqlstore/sqlstore_test.go
index e0d11ab020..c610b2f4b4 100644
--- a/pkg/server/datastore/sqlstore/sqlstore_test.go
+++ b/pkg/server/datastore/sqlstore/sqlstore_test.go
@@ -463,7 +463,6 @@ func (s *PluginSuite) TestListBundlesWithPagination() {
 		},
 	}
 	for _, test := range tests {
-		test := test
 		s.T().Run(test.name, func(t *testing.T) {
 			resp, err := s.ds.ListBundles(ctx, &datastore.ListBundlesRequest{
 				Pagination: test.pagination,
@@ -1180,7 +1179,6 @@ func (s *PluginSuite) TestListAttestedNodes() {
 			byCanReattest:       &canReattestFalse,
 		},
 	} {
-		tt := tt
 		for _, withPagination := range []bool{true, false} {
 			for _, withSelectors := range []bool{true, false} {
 				name := tt.test
@@ -1390,7 +1388,6 @@ func (s *PluginSuite) TestUpdateAttestedNode() {
 			},
 		},
 	} {
-		tt := tt
 		s.T().Run(tt.name, func(t *testing.T) {
 			s.ds = s.newPlugin()
 			defer s.ds.Close()
@@ -2076,7 +2073,6 @@ func (s *PluginSuite) TestFetchRegistrationEntry() {
 			},
 		},
 	} {
-		tt := tt
 		s.T().Run(tt.name, func(t *testing.T) {
 			createdEntry, err := s.ds.CreateRegistrationEntry(ctx, tt.entry)
 			s.Require().NoError(err)
@@ -2149,7 +2145,6 @@ func (s *PluginSuite) TestPruneRegistrationEntries() {
 			},
 		},
 	} {
-		tt := tt
 		s.T().Run(tt.name, func(t *testing.T) {
 			// Get latest event id
 			resp, err := s.ds.ListRegistrationEntryEvents(ctx, &datastore.ListRegistrationEntryEventsRequest{})
@@ -2812,7 +2807,6 @@ func (s *PluginSuite) testListRegistrationEntries(dataConsistency datastore.Data
 			expectPagedEntriesOut: [][]*common.RegistrationEntry{{foobarAD12}, {}},
 		},
 	} {
-		tt := tt
 		for _, withPagination := range []bool{true, false} {
 			name := tt.test
 			if withPagination {
@@ -3364,7 +3358,6 @@ func (s *PluginSuite) TestListParentIDEntries() {
 		},
 	}
 	for _, test := range tests {
-		test := test
 		s.T().Run(test.name, func(t *testing.T) {
 			ds := s.newPlugin()
 			defer ds.Close()
@@ -3414,7 +3407,6 @@ func (s *PluginSuite) TestListSelectorEntries() {
 		},
 	}
 	for _, test := range tests {
-		test := test
 		s.T().Run(test.name, func(t *testing.T) {
 			ds := s.newPlugin()
 			defer ds.Close()
@@ -3471,7 +3463,6 @@ func (s *PluginSuite) TestListEntriesBySelectorSubset() {
 		},
 	}
 	for _, test := range tests {
-		test := test
 		s.T().Run(test.name, func(t *testing.T) {
 			ds := s.newPlugin()
 			defer ds.Close()
@@ -3528,7 +3519,6 @@ func (s *PluginSuite) TestListSelectorEntriesSuperset() {
 		},
 	}
 	for _, test := range tests {
-		test := test
 		s.T().Run(test.name, func(t *testing.T) {
 			ds := s.newPlugin()
 			defer ds.Close()
@@ -3596,7 +3586,6 @@ func (s *PluginSuite) TestListEntriesBySelectorMatchAny() {
 		},
 	}
 	for _, test := range tests {
-		test := test
 		s.T().Run(test.name, func(t *testing.T) {
 			ds := s.newPlugin()
 			defer ds.Close()
@@ -3664,7 +3653,6 @@ func (s *PluginSuite) TestListEntriesByFederatesWithExact() {
 		},
 	}
 	for _, test := range tests {
-		test := test
 		s.T().Run(test.name, func(t *testing.T) {
 			ds := s.newPlugin()
 			defer ds.Close()
@@ -3732,7 +3720,6 @@ func (s *PluginSuite) TestListEntriesByFederatesWithSubset() {
 		},
 	}
 	for _, test := range tests {
-		test := test
 		s.T().Run(test.name, func(t *testing.T) {
 			ds := s.newPlugin()
 			defer ds.Close()
@@ -3805,7 +3792,6 @@ func (s *PluginSuite) TestListEntriesByFederatesWithMatchAny() {
 		},
 	}
 	for _, test := range tests {
-		test := test
 		s.T().Run(test.name, func(t *testing.T) {
 			ds := s.newPlugin()
 			defer ds.Close()
@@ -3877,7 +3863,6 @@ func (s *PluginSuite) TestListEntriesByFederatesWithSuperset() {
 		},
 	}
 	for _, test := range tests {
-		test := test
 		s.T().Run(test.name, func(t *testing.T) {
 			ds := s.newPlugin()
 			defer ds.Close()
@@ -4669,7 +4654,6 @@ func (s *PluginSuite) TestListFederationRelationships() {
 		},
 	}
 	for _, test := range tests {
-		test := test
 		s.T().Run(test.name, func(t *testing.T) {
 			resp, err := s.ds.ListFederationRelationships(ctx, &datastore.ListFederationRelationshipsRequest{
 				Pagination: test.pagination,
@@ -5224,7 +5208,6 @@ func (s *PluginSuite) TestConfigure() {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		s.T().Run(tt.desc, func(t *testing.T) {
 			dbPath := filepath.ToSlash(filepath.Join(s.dir, "test-datastore-configure.sqlite3"))
 
diff --git a/pkg/server/endpoints/authorized_entryfetcher_attested_nodes_test.go b/pkg/server/endpoints/authorized_entryfetcher_attested_nodes_test.go
index 7e4b8b187d..ee8e7f609c 100644
--- a/pkg/server/endpoints/authorized_entryfetcher_attested_nodes_test.go
+++ b/pkg/server/endpoints/authorized_entryfetcher_attested_nodes_test.go
@@ -584,7 +584,6 @@ func TestSearchBeforeFirstNodeEvent(t *testing.T) {
 			expectedFetches:           []string{},
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			scenario := NewNodeScenario(t, tt.setup)
 			attestedNodes, err := scenario.buildAttestedNodesCache()
@@ -812,7 +811,6 @@ func TestSelectedPolledNodeEvents(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			scenario := NewNodeScenario(t, tt.setup)
 			attestedNodes, err := scenario.buildAttestedNodesCache()
@@ -1065,7 +1063,6 @@ func TestScanForNewNodeEvents(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			scenario := NewNodeScenario(t, tt.setup)
 			attestedNodes, err := scenario.buildAttestedNodesCache()
@@ -1435,7 +1432,6 @@ func TestUpdateAttestedNodesCache(t *testing.T) {
 			expectedAuthorizedEntries: []string{},
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			scenario := NewNodeScenario(t, tt.setup)
 			attestedNodes, err := scenario.buildAttestedNodesCache()
diff --git a/pkg/server/endpoints/authorized_entryfetcher_registration_entries_test.go b/pkg/server/endpoints/authorized_entryfetcher_registration_entries_test.go
index d9e4d6d4e1..7642732a55 100644
--- a/pkg/server/endpoints/authorized_entryfetcher_registration_entries_test.go
+++ b/pkg/server/endpoints/authorized_entryfetcher_registration_entries_test.go
@@ -782,7 +782,6 @@ func TestSearchBeforeFirstEntryEvent(t *testing.T) {
 			expectedFetches:           []string{},
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			scenario := NewEntryScenario(t, tt.setup)
 			registrationEntries, err := scenario.buildRegistrationEntriesCache()
@@ -1015,7 +1014,6 @@ func TestSelectedPolledEntryEvents(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			scenario := NewEntryScenario(t, tt.setup)
 			registrationEntries, err := scenario.buildRegistrationEntriesCache()
@@ -1279,7 +1277,6 @@ func TestScanForNewEntryEvents(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			scenario := NewEntryScenario(t, tt.setup)
 			attestedEntries, err := scenario.buildRegistrationEntriesCache()
@@ -1791,7 +1788,6 @@ func TestUpdateRegistrationEntriesCache(t *testing.T) {
 			expectedAuthorizedEntries: []string{},
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			scenario := NewEntryScenario(t, tt.setup)
 			registeredEntries, err := scenario.buildRegistrationEntriesCache()
diff --git a/pkg/server/endpoints/bundle/server_test.go b/pkg/server/endpoints/bundle/server_test.go
index a27dba182a..7c22159386 100644
--- a/pkg/server/endpoints/bundle/server_test.go
+++ b/pkg/server/endpoints/bundle/server_test.go
@@ -146,7 +146,6 @@ func TestServer(t *testing.T) {
 	}
 
 	for _, testCase := range testCases {
-		testCase := testCase
 		t.Run(testCase.name, func(t *testing.T) {
 			addr, done := newTestServer(t,
 				testGetter(testCase.bundle),
diff --git a/pkg/server/hostservice/agentstore/agentstore_test.go b/pkg/server/hostservice/agentstore/agentstore_test.go
index 9090c20916..5e9910b60b 100644
--- a/pkg/server/hostservice/agentstore/agentstore_test.go
+++ b/pkg/server/hostservice/agentstore/agentstore_test.go
@@ -57,7 +57,6 @@ func TestAgentStore(t *testing.T) {
 	}
 
 	for _, testCase := range testCases {
-		testCase := testCase
 		t.Run(testCase.name, func(t *testing.T) {
 			assert := assert.New(t)
 			require := require.New(t)
diff --git a/pkg/server/plugin/bundlepublisher/v1_test.go b/pkg/server/plugin/bundlepublisher/v1_test.go
index c3740c2c2b..3b374b3101 100644
--- a/pkg/server/plugin/bundlepublisher/v1_test.go
+++ b/pkg/server/plugin/bundlepublisher/v1_test.go
@@ -49,7 +49,6 @@ func TestV1Publish(t *testing.T) {
 			expectMessage: "bundlepublisher(test): bundle is invalid: trust domain is missing",
 		},
 	} {
-		tt := tt
 		t.Run(tt.test, func(t *testing.T) {
 			bundlepublisher := loadV1Plugin(t, &fakeV1Plugin{err: tt.pluginErr})
 			err := bundlepublisher.PublishBundle(context.Background(), tt.bundle)
diff --git a/pkg/server/plugin/credentialcomposer/v1_test.go b/pkg/server/plugin/credentialcomposer/v1_test.go
index fec6955bd0..d4e3073b46 100644
--- a/pkg/server/plugin/credentialcomposer/v1_test.go
+++ b/pkg/server/plugin/credentialcomposer/v1_test.go
@@ -236,7 +236,6 @@ func TestV1ComposeServerX509CA(t *testing.T) {
 			expectMessage: `credentialcomposer(test): plugin returned invalid X509CA attributes: extra extensions: invalid OID: non-integer part "NOT AN OID"`,
 		},
 	} {
-		tt := tt
 		t.Run(tt.test, func(t *testing.T) {
 			plugin := &fakeV1Plugin{err: tt.pluginErr, composeServerX509CAResponseOut: tt.responseOut}
 			cc := loadV1Plugin(t, plugin)
@@ -384,7 +383,6 @@ func TestV1ComposeServerX509SVID(t *testing.T) {
 			expectMessage: `credentialcomposer(test): plugin returned invalid X509SVID attributes: extra extensions: invalid OID: non-integer part "NOT AN OID"`,
 		},
 	} {
-		tt := tt
 		t.Run(tt.test, func(t *testing.T) {
 			plugin := &fakeV1Plugin{err: tt.pluginErr, composeServerX509SVIDResponseOut: tt.responseOut}
 			cc := loadV1Plugin(t, plugin)
@@ -567,7 +565,6 @@ func TestV1ComposeAgentX509SVID(t *testing.T) {
 			expectMessage: `credentialcomposer(test): plugin returned invalid X509SVID attributes: extra extensions: invalid OID: non-integer part "NOT AN OID"`,
 		},
 	} {
-		tt := tt
 		t.Run(tt.test, func(t *testing.T) {
 			plugin := &fakeV1Plugin{err: tt.pluginErr, composeAgentX509SVIDResponseOut: tt.responseOut}
 			cc := loadV1Plugin(t, plugin)
@@ -750,7 +747,6 @@ func TestV1ComposeWorkloadX509SVID(t *testing.T) {
 			expectMessage: `credentialcomposer(test): plugin returned invalid X509SVID attributes: extra extensions: invalid OID: non-integer part "NOT AN OID"`,
 		},
 	} {
-		tt := tt
 		t.Run(tt.test, func(t *testing.T) {
 			plugin := &fakeV1Plugin{err: tt.pluginErr, composeWorkloadX509SVIDResponseOut: tt.responseOut}
 			cc := loadV1Plugin(t, plugin)
@@ -847,7 +843,6 @@ func TestV1ComposeWorkloadJWTSVID(t *testing.T) {
 			expectAttributesOut: credentialcomposer.JWTSVIDAttributes{Claims: map[string]any{"NEW_KEY": "NEW_VALUE"}},
 		},
 	} {
-		tt := tt
 		t.Run(tt.test, func(t *testing.T) {
 			plugin := &fakeV1Plugin{err: tt.pluginErr, composeWorkloadJWTSVIDResponseOut: tt.responseOut}
 			cc := loadV1Plugin(t, plugin)
diff --git a/pkg/server/plugin/keymanager/awskms/awskms.go b/pkg/server/plugin/keymanager/awskms/awskms.go
index f2bdc74d1e..ed3ebb7c0c 100644
--- a/pkg/server/plugin/keymanager/awskms/awskms.go
+++ b/pkg/server/plugin/keymanager/awskms/awskms.go
@@ -528,7 +528,6 @@ func (p *Plugin) refreshAliases(ctx context.Context) error {
 	defer p.mu.RUnlock()
 	var errs []string
 	for _, entry := range p.entries {
-		entry := entry
 		_, err := p.kmsClient.UpdateAlias(ctx, &kms.UpdateAliasInput{
 			AliasName:   &entry.AliasName,
 			TargetKeyId: &entry.Arn,
diff --git a/pkg/server/plugin/keymanager/awskms/awskms_test.go b/pkg/server/plugin/keymanager/awskms/awskms_test.go
index 2a1d8695fb..e47b9ee811 100644
--- a/pkg/server/plugin/keymanager/awskms/awskms_test.go
+++ b/pkg/server/plugin/keymanager/awskms/awskms_test.go
@@ -357,7 +357,6 @@ func TestConfigure(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			// setup
 			ts := setupTest(t)
@@ -738,7 +737,6 @@ func TestGenerateKey(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			// setup
 			ts := setupTest(t)
@@ -1061,7 +1059,6 @@ func TestSignData(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			// setup
 			ts := setupTest(t)
@@ -1131,7 +1128,6 @@ func TestGetPublicKey(t *testing.T) {
 			code: codes.InvalidArgument,
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			// setup
 			ts := setupTest(t)
@@ -1176,7 +1172,6 @@ func TestGetPublicKeys(t *testing.T) {
 			name: "non existing keys",
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			// setup
 			ts := setupTest(t)
@@ -1348,7 +1343,6 @@ func TestRefreshAliases(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			// setup
 			ts := setupTest(t)
@@ -1580,7 +1574,6 @@ func TestDisposeAliases(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			// setup
 			ts := setupTest(t)
@@ -1920,7 +1913,6 @@ func TestDisposeKeys(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			// setup
 			ts := setupTest(t)
diff --git a/pkg/server/plugin/keymanager/azurekeyvault/azure_key_vault_test.go b/pkg/server/plugin/keymanager/azurekeyvault/azure_key_vault_test.go
index bbda919591..0c9267bd12 100644
--- a/pkg/server/plugin/keymanager/azurekeyvault/azure_key_vault_test.go
+++ b/pkg/server/plugin/keymanager/azurekeyvault/azure_key_vault_test.go
@@ -209,7 +209,6 @@ func TestConfigure(t *testing.T) {
 			getKeyErr: "get key error",
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			// setup
 			ts := setupTest(t)
@@ -316,7 +315,6 @@ func TestGenerateKey(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			// setup
 			ts := setupTest(t)
@@ -633,7 +631,6 @@ func TestSignData(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			// setup
 			ts := setupTest(t)
@@ -688,7 +685,6 @@ func TestGetPublicKey(t *testing.T) {
 			generatedKeyID: "some-id",
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			// setup
 			ts := setupTest(t)
@@ -730,7 +726,6 @@ func TestGetPublicKeys(t *testing.T) {
 			name: "non existing keys",
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			// setup
 			ts := setupTest(t)
@@ -796,7 +791,6 @@ func TestRefreshKeys(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			// setup
 			ts := setupTest(t)
@@ -891,7 +885,6 @@ func TestDisposeKeys(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			// setup
 			ts := setupTest(t)
diff --git a/pkg/server/plugin/keymanager/gcpkms/gcpkms_test.go b/pkg/server/plugin/keymanager/gcpkms/gcpkms_test.go
index 849103728e..257f157336 100644
--- a/pkg/server/plugin/keymanager/gcpkms/gcpkms_test.go
+++ b/pkg/server/plugin/keymanager/gcpkms/gcpkms_test.go
@@ -386,7 +386,6 @@ func TestConfigure(t *testing.T) {
 			getPublicKeyErrCount: getPublicKeyMaxAttempts + 1,
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			ts := setupTest(t)
 			ts.fakeKMSClient.putFakeCryptoKeys(tt.fakeCryptoKeys)
@@ -966,7 +965,6 @@ func TestGenerateKey(t *testing.T) {
 			getTokenInfoErr: errors.New("error getting token info"),
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			ts := setupTest(t)
 			ts.fakeKMSClient.setDestroyTime(fakeTime)
@@ -1109,7 +1107,6 @@ func TestKeepActiveCryptoKeys(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			ts := setupTest(t)
 			ts.fakeKMSClient.putFakeCryptoKeys(tt.fakeCryptoKeys)
@@ -1215,7 +1212,6 @@ func TestGetPublicKeys(t *testing.T) {
 			name: "non existing keys",
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			ts := setupTest(t)
 			ts.fakeKMSClient.putFakeCryptoKeys(tt.fakeCryptoKeys)
@@ -1317,7 +1313,6 @@ func TestGetPublicKey(t *testing.T) {
 			expectCodeGetPublicKey: codes.InvalidArgument,
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			ts := setupTest(t)
 			ts.fakeKMSClient.setPEMCrc32C(tt.pemCrc32C)
@@ -1413,7 +1408,6 @@ func TestSetIAMPolicy(t *testing.T) {
 			useCustomPolicy: true,
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			ts := setupTest(t)
 			ts.fakeKMSClient.fakeIAMHandle.setPolicyError(tt.policyErr)
@@ -1650,7 +1644,6 @@ func TestSignData(t *testing.T) {
 			signatureCrc32C: &wrapperspb.Int64Value{Value: 1},
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			ts := setupTest(t)
 			ts.fakeKMSClient.setAsymmetricSignErr(tt.asymmetricSignErr)
diff --git a/pkg/server/plugin/keymanager/test/keymanagertest.go b/pkg/server/plugin/keymanager/test/keymanagertest.go
index 058c7e2df7..efa243ab8c 100644
--- a/pkg/server/plugin/keymanager/test/keymanagertest.go
+++ b/pkg/server/plugin/keymanager/test/keymanagertest.go
@@ -263,7 +263,6 @@ func assertRSAKey(t *testing.T, key keymanager.Key, bits int) {
 
 func testSignCertificates(t *testing.T, key keymanager.Key, signatureAlgorithms []x509.SignatureAlgorithm) {
 	for _, signatureAlgorithm := range signatureAlgorithms {
-		signatureAlgorithm := signatureAlgorithm
 		t.Run("sign data "+signatureAlgorithm.String(), func(t *testing.T) {
 			assertSignCertificate(t, key, signatureAlgorithm)
 		})
diff --git a/pkg/server/plugin/keymanager/v1_test.go b/pkg/server/plugin/keymanager/v1_test.go
index c38941e306..a0c5eee0a6 100644
--- a/pkg/server/plugin/keymanager/v1_test.go
+++ b/pkg/server/plugin/keymanager/v1_test.go
@@ -71,7 +71,6 @@ func TestV1GenerateKey(t *testing.T) {
 			expectCode: codes.OK,
 		},
 	} {
-		tt := tt
 		t.Run(tt.test, func(t *testing.T) {
 			plugin := fakeV1Plugin{
 				generateKeyResponse: &keymanagerv1.GenerateKeyResponse{
@@ -136,7 +135,6 @@ func TestV1GetKey(t *testing.T) {
 			expectCode: codes.OK,
 		},
 	} {
-		tt := tt
 		t.Run(tt.test, func(t *testing.T) {
 			plugin := fakeV1Plugin{
 				getPublicKeyResponse: &keymanagerv1.GetPublicKeyResponse{
@@ -193,7 +191,6 @@ func TestV1GetKeys(t *testing.T) {
 			expectCode: codes.OK,
 		},
 	} {
-		tt := tt
 		t.Run(tt.test, func(t *testing.T) {
 			resp := &keymanagerv1.GetPublicKeysResponse{}
 			if tt.publicKey != nil {
@@ -290,7 +287,6 @@ func TestV1SignData(t *testing.T) {
 			expectCode:       codes.OK,
 		},
 	} {
-		tt := tt
 		t.Run(tt.test, func(t *testing.T) {
 			plugin := fakeV1Plugin{
 				expectSignerOpts: tt.expectSignerOpts,
diff --git a/pkg/server/plugin/nodeattestor/awsiid/spiffeid_test.go b/pkg/server/plugin/nodeattestor/awsiid/spiffeid_test.go
index 34c7cfe2e8..b85fed7c82 100644
--- a/pkg/server/plugin/nodeattestor/awsiid/spiffeid_test.go
+++ b/pkg/server/plugin/nodeattestor/awsiid/spiffeid_test.go
@@ -43,7 +43,6 @@ func TestMakeSpiffeID(t *testing.T) {
 		},
 	}
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			got, err := makeAgentID(trustDomain, tt.agentPathTemplate, tt.doc, tt.tags)
 			require.NoError(t, err)
diff --git a/pkg/server/plugin/nodeattestor/httpchallenge/httpchallenge_test.go b/pkg/server/plugin/nodeattestor/httpchallenge/httpchallenge_test.go
index c0573027ef..b0ad9c13ae 100644
--- a/pkg/server/plugin/nodeattestor/httpchallenge/httpchallenge_test.go
+++ b/pkg/server/plugin/nodeattestor/httpchallenge/httpchallenge_test.go
@@ -106,7 +106,6 @@ func TestConfigure(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			plugin := httpchallenge.New()
 			resp, err := plugin.Configure(context.Background(), &configv1.ConfigureRequest{
@@ -323,7 +322,6 @@ func TestAttestFailures(t *testing.T) {
 		},
 	}
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			var testNonce string
 			if tt.tofu {
@@ -402,7 +400,6 @@ func TestAttestSucceeds(t *testing.T) {
 		},
 	}
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			testNonce := "123456789abcdefghijklmnopqrstuvwxyz"
 			plugin := loadPlugin(t, tt.hclConf, !tt.tofu, client, testNonce)
diff --git a/pkg/server/plugin/nodeattestor/tpmdevid/devid_test.go b/pkg/server/plugin/nodeattestor/tpmdevid/devid_test.go
index 50e66ec549..90603286c9 100644
--- a/pkg/server/plugin/nodeattestor/tpmdevid/devid_test.go
+++ b/pkg/server/plugin/nodeattestor/tpmdevid/devid_test.go
@@ -138,7 +138,6 @@ func TestConfigure(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			plugin := tpmdevid.New()
 			resp, err := plugin.Configure(context.Background(), &configv1.ConfigureRequest{
@@ -494,7 +493,6 @@ func TestAttestFailiures(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			plugin := loadPlugin(t, tt.hclConf)
 			result, err := plugin.Attest(context.Background(), tt.payload, tt.challengeFn)
@@ -611,7 +609,6 @@ func TestAttestSucceeds(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			// Create a TPM session to generate payload and challenge response data
 			session, err := tpmutil.NewSession(&tpmutil.SessionConfig{
diff --git a/pkg/server/plugin/nodeattestor/v1_test.go b/pkg/server/plugin/nodeattestor/v1_test.go
index 767e88f95a..3be8a6fc54 100644
--- a/pkg/server/plugin/nodeattestor/v1_test.go
+++ b/pkg/server/plugin/nodeattestor/v1_test.go
@@ -129,7 +129,6 @@ func TestV1(t *testing.T) {
 			expectResult:  resultWithSelectorsAndCanReattest,
 		},
 	} {
-		tt := tt
 		t.Run(tt.test, func(t *testing.T) {
 			nodeattestor := loadV1Plugin(t, tt.plugin)
 			result, err := nodeattestor.Attest(context.Background(), []byte(tt.payload),
diff --git a/pkg/server/plugin/nodeattestor/x509pop/x509pop_test.go b/pkg/server/plugin/nodeattestor/x509pop/x509pop_test.go
index 8c641b6987..d6b852c407 100644
--- a/pkg/server/plugin/nodeattestor/x509pop/x509pop_test.go
+++ b/pkg/server/plugin/nodeattestor/x509pop/x509pop_test.go
@@ -129,7 +129,6 @@ func (s *Suite) TestAttestSuccess() {
 	}
 
 	for _, tt := range tests {
-		tt := tt // alias loop variable as it is used in the closure
 		s.T().Run(tt.desc, func(t *testing.T) {
 			attestor := s.loadPlugin(t, tt.giveConfig)
 
diff --git a/pkg/server/plugin/notifier/gcsbundle/gcsbundle_test.go b/pkg/server/plugin/notifier/gcsbundle/gcsbundle_test.go
index d211bf816b..c02590f25a 100644
--- a/pkg/server/plugin/notifier/gcsbundle/gcsbundle_test.go
+++ b/pkg/server/plugin/notifier/gcsbundle/gcsbundle_test.go
@@ -85,7 +85,6 @@ func TestConfigure(t *testing.T) {
 	}
 
 	for _, tt := range testCases {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			idp := fakeidentityprovider.New()
 
@@ -204,7 +203,6 @@ func testUpdateBundleObject(t *testing.T, notify func(notifier.Notifier) error)
 			desc: "notifier(gcs_bundle): unable to update bundle object the-bucket/bundle.pem: googleapi: got HTTP response code 412 with body: ohno",
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			// Create a raw instance so we can hook the bucket client creation,
 			// possibly overriding with a test specific hook.
diff --git a/pkg/server/plugin/notifier/k8sbundle/k8sbundle_test.go b/pkg/server/plugin/notifier/k8sbundle/k8sbundle_test.go
index 68f002ab51..23abe7b760 100644
--- a/pkg/server/plugin/notifier/k8sbundle/k8sbundle_test.go
+++ b/pkg/server/plugin/notifier/k8sbundle/k8sbundle_test.go
@@ -693,7 +693,6 @@ func TestConfigure(t *testing.T) {
 			`,
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			test := setupTest(t, withNoConfigure())
 			_, err := test.rawPlugin.Configure(context.Background(), &configv1.ConfigureRequest{
diff --git a/pkg/server/plugin/upstreamauthority/awspca/pca_test.go b/pkg/server/plugin/upstreamauthority/awspca/pca_test.go
index f6eaa14f15..d5b8bc6639 100644
--- a/pkg/server/plugin/upstreamauthority/awspca/pca_test.go
+++ b/pkg/server/plugin/upstreamauthority/awspca/pca_test.go
@@ -202,7 +202,6 @@ badjson
 			expectMsgPrefix:         "failed to create client: MissingEndpoint: 'Endpoint' configuration is required for this service",
 		},
 	} {
-		tt := tt
 		t.Run(tt.test, func(t *testing.T) {
 			client := &pcaClientFake{t: t}
 			clock := clock.NewMock()
@@ -411,7 +410,6 @@ func TestMintX509CA(t *testing.T) {
 			expectMsgPrefix:         "upstreamauthority(aws_pca): failed to parse certificate chain from response: no PEM blocks",
 		},
 	} {
-		tt := tt
 		t.Run(tt.test, func(t *testing.T) {
 			client := &pcaClientFake{t: t}
 			clk := clock.NewMock()
diff --git a/pkg/server/plugin/upstreamauthority/awssecret/awssecret_test.go b/pkg/server/plugin/upstreamauthority/awssecret/awssecret_test.go
index 4f6051679a..a2e907cec4 100644
--- a/pkg/server/plugin/upstreamauthority/awssecret/awssecret_test.go
+++ b/pkg/server/plugin/upstreamauthority/awssecret/awssecret_test.go
@@ -197,7 +197,6 @@ func TestConfigure(t *testing.T) {
 			expectMsgPrefix: "unable to read missing_bundle: secret not found",
 		},
 	} {
-		tt := tt
 		t.Run(tt.test, func(t *testing.T) {
 			var err error
 
@@ -328,7 +327,6 @@ func TestMintX509CA(t *testing.T) {
 			expectMsgPrefix: "upstreamauthority(awssecret): unable to sign CSR: unable to parse CSR",
 		},
 	} {
-		tt := tt
 		t.Run(tt.test, func(t *testing.T) {
 			p := New()
 			p.hooks.clock = clk
diff --git a/pkg/server/plugin/upstreamauthority/disk/disk_test.go b/pkg/server/plugin/upstreamauthority/disk/disk_test.go
index eb21fe2393..46279df189 100644
--- a/pkg/server/plugin/upstreamauthority/disk/disk_test.go
+++ b/pkg/server/plugin/upstreamauthority/disk/disk_test.go
@@ -122,7 +122,6 @@ func TestMintX509CA(t *testing.T) {
 			expectedX509Authorities: []string{"spiffe://root"},
 		},
 	} {
-		tt := tt
 		t.Run(tt.test, func(t *testing.T) {
 			p := New()
 			p.clock = testData.Clock
@@ -307,7 +306,6 @@ func TestConfigure(t *testing.T) {
 			expectMsgPrefix:    "server core configuration must contain trust_domain",
 		},
 	} {
-		tt := tt
 		t.Run(tt.test, func(t *testing.T) {
 			var err error
 
diff --git a/pkg/server/plugin/upstreamauthority/spire/spire_test.go b/pkg/server/plugin/upstreamauthority/spire/spire_test.go
index 58ad8c78ae..6dae4c6e5a 100644
--- a/pkg/server/plugin/upstreamauthority/spire/spire_test.go
+++ b/pkg/server/plugin/upstreamauthority/spire/spire_test.go
@@ -80,7 +80,6 @@ func TestConfigure(t *testing.T) {
 	}
 	cases = append(cases, configureCasesOS(t)...)
 	for _, tt := range cases {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			var err error
 
@@ -261,7 +260,6 @@ func TestMintX509CA(t *testing.T) {
 
 	cases = append(cases, mintX509CACasesOS(t)...)
 	for _, c := range cases {
-		c := c
 		t.Run(c.name, func(t *testing.T) {
 			mockClock := clock.NewMock(t)
 
diff --git a/pkg/server/plugin/upstreamauthority/v1_test.go b/pkg/server/plugin/upstreamauthority/v1_test.go
index 159001b0c0..fad3e78f28 100644
--- a/pkg/server/plugin/upstreamauthority/v1_test.go
+++ b/pkg/server/plugin/upstreamauthority/v1_test.go
@@ -199,7 +199,6 @@ func TestV1MintX509CA(t *testing.T) {
 			expectStreamMessage: "upstreamauthority(test): ohno",
 		},
 	} {
-		tt := tt
 		t.Run(tt.test, func(t *testing.T) {
 			log, logHook := test.NewNullLogger()
 
@@ -364,7 +363,6 @@ func TestV1PublishJWTKey(t *testing.T) {
 			expectStreamMessage: "upstreamauthority(test): ohno",
 		},
 	} {
-		tt := tt
 		t.Run(tt.test, func(t *testing.T) {
 			log, logHook := test.NewNullLogger()
 
diff --git a/pkg/server/plugin/upstreamauthority/vault/vault_client_test.go b/pkg/server/plugin/upstreamauthority/vault/vault_client_test.go
index 941cabca9d..fae338bca4 100644
--- a/pkg/server/plugin/upstreamauthority/vault/vault_client_test.go
+++ b/pkg/server/plugin/upstreamauthority/vault/vault_client_test.go
@@ -91,7 +91,6 @@ func TestNewAuthenticatedClientCertAuth(t *testing.T) {
 			namespace: "test-ns",
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			fakeVaultServer.CertAuthResponse = tt.response
 
@@ -176,7 +175,6 @@ func TestNewAuthenticatedClientTokenAuth(t *testing.T) {
 			expectMsgPrefix: "token is empty",
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			fakeVaultServer.LookupSelfResponse = tt.response
 
@@ -244,7 +242,6 @@ func TestNewAuthenticatedClientAppRoleAuth(t *testing.T) {
 			namespace: "test-ns",
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			fakeVaultServer.AppRoleAuthResponse = tt.response
 
@@ -308,7 +305,6 @@ func TestNewAuthenticatedClientK8sAuth(t *testing.T) {
 			namespace: "test-ns",
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			fakeVaultServer.K8sAuthResponse = tt.response
 
diff --git a/pkg/server/plugin/upstreamauthority/vault/vault_test.go b/pkg/server/plugin/upstreamauthority/vault/vault_test.go
index 65f704f728..12fd59a84a 100644
--- a/pkg/server/plugin/upstreamauthority/vault/vault_test.go
+++ b/pkg/server/plugin/upstreamauthority/vault/vault_test.go
@@ -166,7 +166,6 @@ func TestConfigure(t *testing.T) {
 			expectMsgPrefix: "token_path is required",
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			var err error
 
@@ -667,7 +666,6 @@ func TestMintX509CA(t *testing.T) {
 			expectMsgPrefix: "upstreamauthority(vault): failed to parse CSR data:",
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			fakeVaultServer := tt.fakeServer()
 
diff --git a/support/oidc-discovery-provider/config_test.go b/support/oidc-discovery-provider/config_test.go
index 483b8a4e68..f8fac16a62 100644
--- a/support/oidc-discovery-provider/config_test.go
+++ b/support/oidc-discovery-provider/config_test.go
@@ -67,7 +67,6 @@ func TestParseConfig(t *testing.T) {
 	testCases = append(testCases, parseConfigCasesOS()...)
 
 	for _, testCase := range testCases {
-		testCase := testCase
 		t.Run(testCase.name, func(t *testing.T) {
 			actual, err := ParseConfig(testCase.in)
 			if testCase.err != "" {
diff --git a/support/oidc-discovery-provider/handler_test.go b/support/oidc-discovery-provider/handler_test.go
index 25862ff364..27ff97ddfd 100644
--- a/support/oidc-discovery-provider/handler_test.go
+++ b/support/oidc-discovery-provider/handler_test.go
@@ -164,7 +164,6 @@ func TestHandlerHTTPS(t *testing.T) {
 	}
 
 	for _, testCase := range testCases {
-		testCase := testCase
 		t.Run(testCase.name, func(t *testing.T) {
 			source := new(FakeKeySetSource)
 			source.SetKeySet(testCase.jwks, testCase.modTime, testCase.pollTime)
@@ -277,7 +276,6 @@ func TestHandlerHTTPInsecure(t *testing.T) {
 	}
 
 	for _, testCase := range testCases {
-		testCase := testCase
 		t.Run(testCase.name, func(t *testing.T) {
 			source := new(FakeKeySetSource)
 			source.SetKeySet(testCase.jwks, testCase.modTime, testCase.pollTime)
@@ -442,7 +440,6 @@ func TestHandlerHTTP(t *testing.T) {
 	}
 
 	for _, testCase := range testCases {
-		testCase := testCase
 		t.Run(testCase.name, func(t *testing.T) {
 			source := new(FakeKeySetSource)
 			source.SetKeySet(testCase.jwks, testCase.modTime, testCase.pollTime)
@@ -559,7 +556,6 @@ func TestHandlerProxied(t *testing.T) {
 		},
 	}
 	for _, testCase := range testCases {
-		testCase := testCase
 		t.Run(testCase.name, func(t *testing.T) {
 			source := new(FakeKeySetSource)
 			source.SetKeySet(testCase.jwks, testCase.modTime, testCase.pollTime)
@@ -697,7 +693,6 @@ func TestHandlerJWTIssuer(t *testing.T) {
 		},
 	}
 	for _, testCase := range testCases {
-		testCase := testCase
 		t.Run(testCase.name, func(t *testing.T) {
 			source := new(FakeKeySetSource)
 			source.SetKeySet(testCase.jwks, testCase.modTime, testCase.pollTime)
diff --git a/support/oidc-discovery-provider/healthchecks_handler_test.go b/support/oidc-discovery-provider/healthchecks_handler_test.go
index 2d373d67b3..4b9ee906f5 100644
--- a/support/oidc-discovery-provider/healthchecks_handler_test.go
+++ b/support/oidc-discovery-provider/healthchecks_handler_test.go
@@ -105,7 +105,6 @@ func TestHealthCheckHandler(t *testing.T) {
 	}
 
 	for _, testCase := range testCases {
-		testCase := testCase
 		t.Run(testCase.name, func(t *testing.T) {
 			source := new(FakeKeySetSource)
 			source.SetKeySet(testCase.jwks, testCase.modTime, testCase.pollTime)