diff --git a/pkg/infra/proxy/proxyutil/proxyutil.go b/pkg/infra/proxy/proxyutil/proxyutil.go
index 080cdfbeda6..79f5e939be3 100644
--- a/pkg/infra/proxy/proxyutil/proxyutil.go
+++ b/pkg/infra/proxy/proxyutil/proxyutil.go
@@ -50,6 +50,9 @@ func SetupTestSecureSocksProxySettings(t *testing.T) *setting.SecureSocksDSProxy
 	})
 	require.NoError(t, err)
 
+	err = caCertFile.Close()
+	require.NoError(t, err)
+
 	// generate test client cert & key
 	cert := &x509.Certificate{
 		SerialNumber: big.NewInt(2019),
@@ -77,6 +80,10 @@ func SetupTestSecureSocksProxySettings(t *testing.T) *setting.SecureSocksDSProxy
 		Bytes: certBytes,
 	})
 	require.NoError(t, err)
+
+	err = certFile.Close()
+	require.NoError(t, err)
+
 	clientKey := filepath.Join(tempDir, "client.key")
 	// nolint:gosec
 	// The gosec G304 warning can be ignored because all values come from the test
@@ -88,6 +95,9 @@ func SetupTestSecureSocksProxySettings(t *testing.T) *setting.SecureSocksDSProxy
 	})
 	require.NoError(t, err)
 
+	err = keyFile.Close()
+	require.NoError(t, err)
+
 	return &setting.SecureSocksDSProxySettings{
 		ClientCert:   clientCert,
 		ClientKey:    clientKey,