diff --git a/ipn/ipnlocal/local_test.go b/ipn/ipnlocal/local_test.go
index 36427d6dd..681c9cdd5 100644
--- a/ipn/ipnlocal/local_test.go
+++ b/ipn/ipnlocal/local_test.go
@@ -443,6 +443,7 @@ func TestLazyMachineKeyGeneration(t *testing.T) {
 	if err != nil {
 		t.Fatalf("NewFakeUserspaceEngine: %v", err)
 	}
+	t.Cleanup(eng.Close)
 	lb, err := NewLocalBackend(logf, "logid", store, eng)
 	if err != nil {
 		t.Fatalf("NewLocalBackend: %v", err)
diff --git a/ipn/ipnlocal/loglines_test.go b/ipn/ipnlocal/loglines_test.go
index 4db9b2006..cb6bb4cb6 100644
--- a/ipn/ipnlocal/loglines_test.go
+++ b/ipn/ipnlocal/loglines_test.go
@@ -52,6 +52,7 @@ func TestLocalLogLines(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
+	t.Cleanup(e.Close)
 
 	lb, err := NewLocalBackend(logf, idA.String(), store, e)
 	if err != nil {
diff --git a/ipn/ipnlocal/state_test.go b/ipn/ipnlocal/state_test.go
index 25b63efac..2895b51c0 100644
--- a/ipn/ipnlocal/state_test.go
+++ b/ipn/ipnlocal/state_test.go
@@ -284,6 +284,7 @@ func TestStateMachine(t *testing.T) {
 	if err != nil {
 		t.Fatalf("NewFakeUserspaceEngine: %v", err)
 	}
+	t.Cleanup(e.Close)
 
 	cc := newMockControl()
 	b, err := NewLocalBackend(logf, "logid", store, e)
diff --git a/ipn/ipnserver/server_test.go b/ipn/ipnserver/server_test.go
index 9a368c17f..c4197e41a 100644
--- a/ipn/ipnserver/server_test.go
+++ b/ipn/ipnserver/server_test.go
@@ -60,7 +60,7 @@ func TestRunMultipleAccepts(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	defer eng.Close()
+	t.Cleanup(eng.Close)
 
 	opts := ipnserver.Options{
 		SocketPath: socketPath,
diff --git a/wgengine/userspace_test.go b/wgengine/userspace_test.go
index bb4bd7efb..bda88ee3c 100644
--- a/wgengine/userspace_test.go
+++ b/wgengine/userspace_test.go
@@ -89,7 +89,7 @@ func TestUserspaceEngineReconfig(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	defer e.Close()
+	t.Cleanup(e.Close)
 	ue := e.(*userspaceEngine)
 
 	routerCfg := &router.Config{}
@@ -158,7 +158,7 @@ func TestUserspaceEnginePortReconfig(t *testing.T) {
 	if ue == nil {
 		t.Fatal("could not create a wgengine with a specific port")
 	}
-	defer ue.Close()
+	t.Cleanup(ue.Close)
 
 	startingPort := ue.magicConn.LocalPort()
 	nodeKey := nkFromHex("aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa")
diff --git a/wgengine/watchdog_test.go b/wgengine/watchdog_test.go
index 05ca79d7d..7297354cc 100644
--- a/wgengine/watchdog_test.go
+++ b/wgengine/watchdog_test.go
@@ -48,6 +48,7 @@ func TestWatchdog(t *testing.T) {
 		if err != nil {
 			t.Fatal(err)
 		}
+		t.Cleanup(e.Close)
 		usEngine := e.(*userspaceEngine)
 		e = NewWatchdog(e)
 		wdEngine := e.(*watchdogEngine)