diff --git a/.golangci.yaml b/.golangci.yaml
index 4e1d3d500f..29b3318d4b 100644
--- a/.golangci.yaml
+++ b/.golangci.yaml
@@ -23,6 +23,7 @@ linters:
     - ineffassign
     - staticcheck
     - unused
+    - tenv
 
 linters-settings: # please keep this alphabetized
   staticcheck:
diff --git a/nodeup/pkg/bootstrap/install_test.go b/nodeup/pkg/bootstrap/install_test.go
index 0440eeb161..729bb3fc7b 100644
--- a/nodeup/pkg/bootstrap/install_test.go
+++ b/nodeup/pkg/bootstrap/install_test.go
@@ -17,7 +17,6 @@ limitations under the License.
 package bootstrap
 
 import (
-	"os"
 	"path/filepath"
 	"testing"
 
@@ -26,11 +25,7 @@ import (
 )
 
 func TestBootstarapBuilder_Simple(t *testing.T) {
-	origRegion := os.Getenv("AWS_REGION")
-	os.Setenv("AWS_REGION", "us-test1")
-	defer func() {
-		os.Setenv("AWS_REGION", origRegion)
-	}()
+	t.Setenv("AWS_REGION", "us-test1")
 
 	runInstallBuilderTest(t, "tests/simple")
 }
diff --git a/pkg/featureflag/featureflag_test.go b/pkg/featureflag/featureflag_test.go
index fc01631ad2..48a9dac670 100644
--- a/pkg/featureflag/featureflag_test.go
+++ b/pkg/featureflag/featureflag_test.go
@@ -17,7 +17,6 @@ limitations under the License.
 package featureflag
 
 import (
-	"os"
 	"testing"
 
 	"k8s.io/klog/v2"
@@ -49,7 +48,7 @@ func TestSetenv(t *testing.T) {
 		t.Fatalf("Flag did not default true")
 	}
 
-	os.Setenv("KOPS_FEATURE_FLAGS", "-UnitTest2")
+	t.Setenv("KOPS_FEATURE_FLAGS", "-UnitTest2")
 	if !f.Enabled() {
 		t.Fatalf("Flag was reparsed immediately after os.Setenv")
 	}
diff --git a/pkg/instancegroups/rollingupdate_os_test.go b/pkg/instancegroups/rollingupdate_os_test.go
index ef5f4854b5..1c4c4a427e 100644
--- a/pkg/instancegroups/rollingupdate_os_test.go
+++ b/pkg/instancegroups/rollingupdate_os_test.go
@@ -18,7 +18,6 @@ package instancegroups
 
 import (
 	"context"
-	"os"
 	"testing"
 	"time"
 
@@ -103,11 +102,7 @@ var TempTestSkip = func(t *testing.T, message string) {
 func TestRollingUpdateDisabledSurgeOS(t *testing.T) {
 	TempTestSkip(t, "Failing in new release PR when build is not yet published")
 
-	origRegion := os.Getenv("OS_REGION_NAME")
-	os.Setenv("OS_REGION_NAME", "us-test1")
-	defer func() {
-		os.Setenv("OS_REGION_NAME", origRegion)
-	}()
+	t.Setenv("OS_REGION_NAME", "us-test1")
 
 	c, cloud := getTestSetupOS(t)
 
diff --git a/upup/pkg/fi/cloudup/networking_test.go b/upup/pkg/fi/cloudup/networking_test.go
index df4c248662..ec9750e9cb 100644
--- a/upup/pkg/fi/cloudup/networking_test.go
+++ b/upup/pkg/fi/cloudup/networking_test.go
@@ -17,7 +17,6 @@ limitations under the License.
 package cloudup
 
 import (
-	"os"
 	"testing"
 
 	api "k8s.io/kops/pkg/apis/kops"
@@ -29,12 +28,8 @@ func Test_FindCNIAssetFromEnvironmentVariable(t *testing.T) {
 	desiredCNIVersion := "https://storage.googleapis.com/kubernetes-release/network-plugins/cni-TEST-VERSION.tar.gz"
 	desiredCNIVersionHash := "sha256:0000000000000000000000000000000000000000000000000000000000000000"
 
-	os.Setenv(ENV_VAR_CNI_ASSET_URL, desiredCNIVersion)
-	os.Setenv(ENV_VAR_CNI_ASSET_HASH, desiredCNIVersionHash)
-	defer func() {
-		os.Unsetenv(ENV_VAR_CNI_ASSET_URL)
-		os.Unsetenv(ENV_VAR_CNI_ASSET_HASH)
-	}()
+	t.Setenv(ENV_VAR_CNI_ASSET_URL, desiredCNIVersion)
+	t.Setenv(ENV_VAR_CNI_ASSET_HASH, desiredCNIVersionHash)
 
 	cluster := &api.Cluster{}
 	cluster.Spec.KubernetesVersion = "v1.18.0"
diff --git a/util/pkg/vfs/tests/s3fs_test.go b/util/pkg/vfs/tests/s3fs_test.go
index 637931be7d..065e0c9c12 100644
--- a/util/pkg/vfs/tests/s3fs_test.go
+++ b/util/pkg/vfs/tests/s3fs_test.go
@@ -19,7 +19,6 @@ package tests
 import (
 	"encoding/json"
 	"fmt"
-	"os"
 	"strings"
 	"testing"
 
@@ -52,13 +51,9 @@ func TestS3RenderTerraform(t *testing.T) {
 			`,
 		},
 	}
-	origEndpoint := os.Getenv("S3_ENDPOINT")
-	os.Setenv("S3_ENDPOINT", "foo.s3.amazonaws.com")
-	defer os.Setenv("S3_ENDPOINT", origEndpoint)
+	t.Setenv("S3_ENDPOINT", "foo.s3.amazonaws.com")
 
-	origACL := os.Getenv("KOPS_STATE_S3_ACL")
-	os.Setenv("KOPS_STATE_S3_ACL", "bucket-owner-full-control")
-	defer os.Setenv("KOPS_STATE_S3_ACL", origACL)
+	t.Setenv("KOPS_STATE_S3_ACL", "bucket-owner-full-control")
 	for _, tc := range grid {
 
 		t.Run(tc.s3Path, func(t *testing.T) {