diff --git a/.golangci.yml b/.golangci.yml
index 3a1385998f..24a9668f39 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -26,7 +26,6 @@ linters:
     - revive        # Metalinter; drop-in replacement for golint.
     - staticcheck
     - stylecheck    # Replacement for golint
-    - tenv          # Detects using os.Setenv instead of t.Setenv.
     - thelper       # Detects test helpers without t.Helper().
     - tparallel     # Detects inappropriate usage of t.Parallel().
     - typecheck
@@ -34,6 +33,7 @@ linters:
     - unparam
     - unused
     - usestdlibvars
+    - usetesting    # Reports uses of functions with replacement inside the testing package.
     - wastedassign
 
   disable:
@@ -42,6 +42,8 @@ linters:
 run:
   # prevent golangci-lint from deducting the go version to lint for through go.mod,
   # which causes it to fallback to go1.17 semantics.
+  #
+  # TODO(thaJeztah): update "usetesting" settings to enable go1.24 features once our minimum version is go1.24
   go: "1.23.6"
   timeout: 5m
 
@@ -111,6 +113,14 @@ linters-settings:
         severity: warning
         disabled: false
 
+  usetesting:
+    # FIXME(thaJeztah): Disable `os.Chdir()` detections; should be automatically disabled on Go < 1.24; see https://github.com/docker/cli/pull/5835#issuecomment-2665302478
+    os-chdir: false
+    # FIXME(thaJeztah): Disable `context.Background()` detections; should be automatically disabled on Go < 1.24; see https://github.com/docker/cli/pull/5835#issuecomment-2665302478
+    context-background: false
+    # FIXME(thaJeztah): Disable `context.TODO()` detections; should be automatically disabled on Go < 1.24; see https://github.com/docker/cli/pull/5835#issuecomment-2665302478
+    context-todo: false
+
 issues:
   # The default exclusion rules are a bit too permissive, so copying the relevant ones below
   exclude-use-default: false
diff --git a/cli/command/trust/signer_add_test.go b/cli/command/trust/signer_add_test.go
index 492c3df86e..31fd983611 100644
--- a/cli/command/trust/signer_add_test.go
+++ b/cli/command/trust/signer_add_test.go
@@ -68,19 +68,19 @@ func TestTrustSignerAddErrors(t *testing.T) {
 func TestSignerAddCommandNoTargetsKey(t *testing.T) {
 	config.SetDir(t.TempDir())
 
-	tmpfile, err := os.CreateTemp("", "pemfile")
+	tmpDir := t.TempDir()
+	tmpFile, err := os.CreateTemp(tmpDir, "pemfile")
 	assert.NilError(t, err)
-	tmpfile.Close()
-	defer os.Remove(tmpfile.Name())
+	assert.Check(t, tmpFile.Close())
 
 	cli := test.NewFakeCli(&fakeClient{})
 	cli.SetNotaryClient(notaryfake.GetEmptyTargetsNotaryRepository)
 	cmd := newSignerAddCommand(cli)
-	cmd.SetArgs([]string{"--key", tmpfile.Name(), "alice", "alpine", "linuxkit/alpine"})
+	cmd.SetArgs([]string{"--key", tmpFile.Name(), "alice", "alpine", "linuxkit/alpine"})
 
 	cmd.SetOut(io.Discard)
 	cmd.SetErr(io.Discard)
-	assert.Error(t, cmd.Execute(), fmt.Sprintf("could not parse public key from file: %s: no valid public key found", tmpfile.Name()))
+	assert.Error(t, cmd.Execute(), fmt.Sprintf("could not parse public key from file: %s: no valid public key found", tmpFile.Name()))
 }
 
 func TestSignerAddCommandBadKeyPath(t *testing.T) {
@@ -130,10 +130,10 @@ func TestIngestPublicKeys(t *testing.T) {
 	}
 	assert.Error(t, err, expectedError)
 	// Call with real file path
-	tmpfile, err := os.CreateTemp("", "pemfile")
+	tmpDir := t.TempDir()
+	tmpFile, err := os.CreateTemp(tmpDir, "pemfile")
 	assert.NilError(t, err)
-	tmpfile.Close()
-	defer os.Remove(tmpfile.Name())
-	_, err = ingestPublicKeys([]string{tmpfile.Name()})
-	assert.Error(t, err, fmt.Sprintf("could not parse public key from file: %s: no valid public key found", tmpfile.Name()))
+	assert.Check(t, tmpFile.Close())
+	_, err = ingestPublicKeys([]string{tmpFile.Name()})
+	assert.Error(t, err, fmt.Sprintf("could not parse public key from file: %s: no valid public key found", tmpFile.Name()))
 }
diff --git a/cli/debug/debug.go b/cli/debug/debug.go
index 1a9a46abcc..84002bd008 100644
--- a/cli/debug/debug.go
+++ b/cli/debug/debug.go
@@ -10,14 +10,14 @@ import (
 // Enable sets the DEBUG env var to true
 // and makes the logger to log at debug level.
 func Enable() {
-	os.Setenv("DEBUG", "1")
+	_ = os.Setenv("DEBUG", "1")
 	logrus.SetLevel(logrus.DebugLevel)
 }
 
 // Disable sets the DEBUG env var to false
 // and makes the logger to log at info level.
 func Disable() {
-	os.Setenv("DEBUG", "")
+	_ = os.Setenv("DEBUG", "")
 	logrus.SetLevel(logrus.InfoLevel)
 }
 
diff --git a/cli/debug/debug_test.go b/cli/debug/debug_test.go
index 903115283c..e8f156401f 100644
--- a/cli/debug/debug_test.go
+++ b/cli/debug/debug_test.go
@@ -9,9 +9,9 @@ import (
 
 func TestEnable(t *testing.T) {
 	defer func() {
-		os.Setenv("DEBUG", "")
 		logrus.SetLevel(logrus.InfoLevel)
 	}()
+	t.Setenv("DEBUG", "")
 	Enable()
 	if os.Getenv("DEBUG") != "1" {
 		t.Fatalf("expected DEBUG=1, got %s\n", os.Getenv("DEBUG"))
@@ -22,6 +22,7 @@ func TestEnable(t *testing.T) {
 }
 
 func TestDisable(t *testing.T) {
+	t.Setenv("DEBUG", "1")
 	Disable()
 	if os.Getenv("DEBUG") != "" {
 		t.Fatalf("expected DEBUG=\"\", got %s\n", os.Getenv("DEBUG"))
@@ -32,6 +33,7 @@ func TestDisable(t *testing.T) {
 }
 
 func TestEnabled(t *testing.T) {
+	t.Setenv("DEBUG", "")
 	Enable()
 	if !IsEnabled() {
 		t.Fatal("expected debug enabled, got false")
diff --git a/dockerfiles/Dockerfile.lint b/dockerfiles/Dockerfile.lint
index e73a1c2705..40c23da0b8 100644
--- a/dockerfiles/Dockerfile.lint
+++ b/dockerfiles/Dockerfile.lint
@@ -2,7 +2,7 @@
 
 ARG GO_VERSION=1.23.6
 ARG ALPINE_VERSION=3.21
-ARG GOLANGCI_LINT_VERSION=v1.63.4
+ARG GOLANGCI_LINT_VERSION=v1.64.5
 
 FROM golangci/golangci-lint:${GOLANGCI_LINT_VERSION}-alpine AS golangci-lint