diff --git a/testutil/daemon/daemon.go b/testutil/daemon/daemon.go
index 98230960c6..9c8d3f9471 100644
--- a/testutil/daemon/daemon.go
+++ b/testutil/daemon/daemon.go
@@ -99,7 +99,7 @@ type Daemon struct {
 func NewDaemon(workingDir string, ops ...Option) (*Daemon, error) {
 	storageDriver := os.Getenv("DOCKER_GRAPHDRIVER")
 
-	if err := os.MkdirAll(SockRoot, 0700); err != nil {
+	if err := os.MkdirAll(SockRoot, 0o700); err != nil {
 		return nil, errors.Wrapf(err, "failed to create daemon socket root %q", SockRoot)
 	}
 
@@ -110,7 +110,7 @@ func NewDaemon(workingDir string, ops ...Option) (*Daemon, error) {
 		return nil, err
 	}
 	daemonRoot := filepath.Join(daemonFolder, "root")
-	if err := os.MkdirAll(daemonRoot, 0755); err != nil {
+	if err := os.MkdirAll(daemonRoot, 0o755); err != nil {
 		return nil, errors.Wrapf(err, "failed to create daemon root %q", daemonRoot)
 	}
 
@@ -140,7 +140,7 @@ func NewDaemon(workingDir string, ops ...Option) (*Daemon, error) {
 	}
 
 	if d.rootlessUser != nil {
-		if err := os.Chmod(SockRoot, 0777); err != nil {
+		if err := os.Chmod(SockRoot, 0o777); err != nil {
 			return nil, err
 		}
 		uid, err := strconv.Atoi(d.rootlessUser.Uid)
@@ -157,20 +157,20 @@ func NewDaemon(workingDir string, ops ...Option) (*Daemon, error) {
 		if err := os.Chown(d.Root, uid, gid); err != nil {
 			return nil, err
 		}
-		if err := os.MkdirAll(filepath.Dir(d.execRoot), 0700); err != nil {
+		if err := os.MkdirAll(filepath.Dir(d.execRoot), 0o700); err != nil {
 			return nil, err
 		}
 		if err := os.Chown(filepath.Dir(d.execRoot), uid, gid); err != nil {
 			return nil, err
 		}
-		if err := os.MkdirAll(d.execRoot, 0700); err != nil {
+		if err := os.MkdirAll(d.execRoot, 0o700); err != nil {
 			return nil, err
 		}
 		if err := os.Chown(d.execRoot, uid, gid); err != nil {
 			return nil, err
 		}
 		d.rootlessXDGRuntimeDir = filepath.Join(d.Folder, "xdgrun")
-		if err := os.MkdirAll(d.rootlessXDGRuntimeDir, 0700); err != nil {
+		if err := os.MkdirAll(d.rootlessXDGRuntimeDir, 0o700); err != nil {
 			return nil, err
 		}
 		if err := os.Chown(d.rootlessXDGRuntimeDir, uid, gid); err != nil {
@@ -308,7 +308,7 @@ func (d *Daemon) Start(t testing.TB, args ...string) {
 // StartWithError starts the daemon and return once it is ready to receive requests.
 // It returns an error in case it couldn't start.
 func (d *Daemon) StartWithError(args ...string) error {
-	logFile, err := os.OpenFile(filepath.Join(d.Folder, "docker.log"), os.O_RDWR|os.O_CREATE|os.O_APPEND, 0600)
+	logFile, err := os.OpenFile(filepath.Join(d.Folder, "docker.log"), os.O_RDWR|os.O_CREATE|os.O_APPEND, 0o600)
 	if err != nil {
 		return errors.Wrapf(err, "[%s] failed to create logfile", d.id)
 	}
diff --git a/testutil/daemon/swarm.go b/testutil/daemon/swarm.go
index 8746a0e8a6..bbdc27c84a 100644
--- a/testutil/daemon/swarm.go
+++ b/testutil/daemon/swarm.go
@@ -16,9 +16,7 @@ const (
 	defaultSwarmListenAddr = "0.0.0.0"
 )
 
-var (
-	startArgs = []string{"--iptables=false", "--swarm-default-advertise-addr=lo"}
-)
+var startArgs = []string{"--iptables=false", "--swarm-default-advertise-addr=lo"}
 
 // StartNode (re)starts the daemon
 func (d *Daemon) StartNode(t testing.TB) {
diff --git a/testutil/fakecontext/context.go b/testutil/fakecontext/context.go
index 26f8b4a4ff..05dc56fcef 100644
--- a/testutil/fakecontext/context.go
+++ b/testutil/fakecontext/context.go
@@ -34,7 +34,7 @@ func newDir(fake *Fake) error {
 	if err != nil {
 		return err
 	}
-	if err := os.Chmod(tmp, 0755); err != nil {
+	if err := os.Chmod(tmp, 0o755); err != nil {
 		return err
 	}
 	fake.Dir = tmp
@@ -91,11 +91,11 @@ func (f *Fake) addFile(file string, content []byte) error {
 	fp := filepath.Join(f.Dir, filepath.FromSlash(file))
 	dirpath := filepath.Dir(fp)
 	if dirpath != "." {
-		if err := os.MkdirAll(dirpath, 0755); err != nil {
+		if err := os.MkdirAll(dirpath, 0o755); err != nil {
 			return err
 		}
 	}
-	return os.WriteFile(fp, content, 0644)
+	return os.WriteFile(fp, content, 0o644)
 }
 
 // Delete a file at a path
diff --git a/testutil/fakestorage/storage.go b/testutil/fakestorage/storage.go
index 8bcf1d8863..ae7c2a862a 100644
--- a/testutil/fakestorage/storage.go
+++ b/testutil/fakestorage/storage.go
@@ -97,7 +97,8 @@ type remoteFileServer struct {
 func (f *remoteFileServer) URL() string {
 	u := url.URL{
 		Scheme: "http",
-		Host:   f.host}
+		Host:   f.host,
+	}
 	return u.String()
 }
 
diff --git a/testutil/fixtures/plugin/basic/basic.go b/testutil/fixtures/plugin/basic/basic.go
index 09b84ba167..2eebe249fc 100644
--- a/testutil/fixtures/plugin/basic/basic.go
+++ b/testutil/fixtures/plugin/basic/basic.go
@@ -14,7 +14,7 @@ func main() {
 	if err != nil {
 		panic(err)
 	}
-	if err := os.MkdirAll(p, 0755); err != nil {
+	if err := os.MkdirAll(p, 0o755); err != nil {
 		panic(err)
 	}
 	l, err := net.Listen("unix", filepath.Join(p, "basic.sock"))
diff --git a/testutil/fixtures/plugin/plugin.go b/testutil/fixtures/plugin/plugin.go
index 62664ffd1a..9d89a1ee87 100644
--- a/testutil/fixtures/plugin/plugin.go
+++ b/testutil/fixtures/plugin/plugin.go
@@ -86,7 +86,7 @@ func CreateInRegistry(ctx context.Context, repo string, auth *registry.AuthConfi
 	defer os.RemoveAll(tmpDir)
 
 	inPath := filepath.Join(tmpDir, "plugin")
-	if err := os.MkdirAll(inPath, 0755); err != nil {
+	if err := os.MkdirAll(inPath, 0o755); err != nil {
 		return errors.Wrap(err, "error creating plugin root")
 	}
 
@@ -163,10 +163,10 @@ func makePluginBundle(inPath string, opts ...CreateOpt) (io.ReadCloser, error) {
 	if err != nil {
 		return nil, err
 	}
-	if err := os.WriteFile(filepath.Join(inPath, "config.json"), configJSON, 0644); err != nil {
+	if err := os.WriteFile(filepath.Join(inPath, "config.json"), configJSON, 0o644); err != nil {
 		return nil, err
 	}
-	if err := os.MkdirAll(filepath.Join(inPath, "rootfs", filepath.Dir(p.Entrypoint[0])), 0755); err != nil {
+	if err := os.MkdirAll(filepath.Join(inPath, "rootfs", filepath.Dir(p.Entrypoint[0])), 0o755); err != nil {
 		return nil, errors.Wrap(err, "error creating plugin rootfs dir")
 	}
 
@@ -181,7 +181,7 @@ func makePluginBundle(inPath string, opts ...CreateOpt) (io.ReadCloser, error) {
 		}
 
 		if stat == nil || stat.IsDir() {
-			var mode os.FileMode = 0755
+			var mode os.FileMode = 0o755
 			if stat != nil {
 				mode = stat.Mode()
 			}
@@ -189,7 +189,7 @@ func makePluginBundle(inPath string, opts ...CreateOpt) (io.ReadCloser, error) {
 				return nil, errors.Wrap(err, "error preparing plugin mount destination path")
 			}
 		} else {
-			if err := os.MkdirAll(filepath.Join(inPath, "rootfs", filepath.Dir(m.Destination)), 0755); err != nil {
+			if err := os.MkdirAll(filepath.Join(inPath, "rootfs", filepath.Dir(m.Destination)), 0o755); err != nil {
 				return nil, errors.Wrap(err, "error preparing plugin mount destination dir")
 			}
 			f, err := os.Create(filepath.Join(inPath, "rootfs", m.Destination))
diff --git a/testutil/registry/registry.go b/testutil/registry/registry.go
index 9213db2ba2..ad5a8153f7 100644
--- a/testutil/registry/registry.go
+++ b/testutil/registry/registry.go
@@ -78,7 +78,7 @@ http:
 		username = "testuser"
 		password = "testpassword"
 		email = "test@test.org"
-		err := os.WriteFile(htpasswdPath, []byte(userpasswd), os.FileMode(0644))
+		err := os.WriteFile(htpasswdPath, []byte(userpasswd), os.FileMode(0o644))
 		assert.NilError(t, err)
 		authTemplate = fmt.Sprintf(`auth:
     htpasswd:
@@ -190,7 +190,7 @@ func (r *V2) ReadBlobContents(t testing.TB, blobDigest digest.Digest) []byte {
 // WriteBlobContents write the file corresponding to the specified digest with the given content
 func (r *V2) WriteBlobContents(t testing.TB, blobDigest digest.Digest, data []byte) {
 	t.Helper()
-	err := os.WriteFile(r.getBlobFilename(blobDigest), data, os.FileMode(0644))
+	err := os.WriteFile(r.getBlobFilename(blobDigest), data, os.FileMode(0o644))
 	assert.NilError(t, err, "unable to write malicious data blob")
 }