diff --git a/ca/certificates_test.go b/ca/certificates_test.go
index 9543578920..be9d9af384 100644
--- a/ca/certificates_test.go
+++ b/ca/certificates_test.go
@@ -82,13 +82,13 @@ func TestCreateRootCASaveRootCA(t *testing.T) {
 	paths := ca.NewConfigPaths(tempBaseDir)
 
 	rootCA, err := ca.CreateRootCA("rootCN")
-	assert.NoError(t, err)
+	require.NoError(t, err)
 
 	err = ca.SaveRootCA(rootCA, paths.RootCA)
-	assert.NoError(t, err)
+	require.NoError(t, err)
 
 	perms, err := permbits.Stat(paths.RootCA.Cert)
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	assert.False(t, perms.GroupWrite())
 	assert.False(t, perms.OtherWrite())
 
@@ -97,20 +97,20 @@ func TestCreateRootCASaveRootCA(t *testing.T) {
 
 	// ensure that the cert that was written is already normalized
 	written, err := os.ReadFile(paths.RootCA.Cert)
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	assert.Equal(t, written, ca.NormalizePEMs(written))
 }
 
 func TestCreateRootCAExpiry(t *testing.T) {
 	rootCA, err := ca.CreateRootCA("rootCN")
-	assert.NoError(t, err)
+	require.NoError(t, err)
 
 	// Convert the certificate into an object to create a RootCA
 	parsedCert, err := helpers.ParseCertificatePEM(rootCA.Certs)
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	duration, err := time.ParseDuration(ca.RootCAExpiration)
-	assert.NoError(t, err)
-	assert.True(t, time.Now().Add(duration).AddDate(0, -1, 0).Before(parsedCert.NotAfter))
+	require.NoError(t, err)
+	assert.Less(t, time.Now().Add(duration).AddDate(0, -1, 0), parsedCert.NotAfter)
 }
 
 func TestGetLocalRootCA(t *testing.T) {
@@ -123,37 +123,37 @@ func TestGetLocalRootCA(t *testing.T) {
 
 	// Create the local Root CA to ensure that we can reload it correctly.
 	rootCA, err := ca.CreateRootCA("rootCN")
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	s, err := rootCA.Signer()
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	err = ca.SaveRootCA(rootCA, paths.RootCA)
-	assert.NoError(t, err)
+	require.NoError(t, err)
 
 	// No private key here
 	rootCA2, err := ca.GetLocalRootCA(paths.RootCA)
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	assert.Equal(t, rootCA.Certs, rootCA2.Certs)
 	_, err = rootCA2.Signer()
 	assert.Equal(t, err, ca.ErrNoValidSigner)
 
 	// write private key and assert we can load it and sign
-	assert.NoError(t, os.WriteFile(paths.RootCA.Key, s.Key, os.FileMode(0o600)))
+	require.NoError(t, os.WriteFile(paths.RootCA.Key, s.Key, os.FileMode(0o600)))
 	rootCA3, err := ca.GetLocalRootCA(paths.RootCA)
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	assert.Equal(t, rootCA.Certs, rootCA3.Certs)
 	_, err = rootCA3.Signer()
-	assert.NoError(t, err)
+	require.NoError(t, err)
 
 	// Try with a private key that does not match the CA cert public key.
 	privKey, err := ecdsa.GenerateKey(elliptic.P256(), cryptorand.Reader)
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	privKeyBytes, err := x509.MarshalECPrivateKey(privKey)
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	privKeyPem := pem.EncodeToMemory(&pem.Block{
 		Type:  "EC PRIVATE KEY",
 		Bytes: privKeyBytes,
 	})
-	assert.NoError(t, os.WriteFile(paths.RootCA.Key, privKeyPem, os.FileMode(0o600)))
+	require.NoError(t, os.WriteFile(paths.RootCA.Key, privKeyPem, os.FileMode(0o600)))
 
 	_, err = ca.GetLocalRootCA(paths.RootCA)
 	assert.EqualError(t, err, "certificate key mismatch")
@@ -191,13 +191,13 @@ some random garbage\n
 
 func TestParseValidateAndSignCSR(t *testing.T) {
 	rootCA, err := ca.CreateRootCA("rootCN")
-	assert.NoError(t, err)
+	require.NoError(t, err)
 
 	csr, _, err := ca.GenerateNewCSR()
-	assert.NoError(t, err)
+	require.NoError(t, err)
 
 	signedCert, err := rootCA.ParseValidateAndSignCSR(csr, "CN", "OU", "ORG")
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	assert.NotNil(t, signedCert)
 
 	assert.Len(t, checkLeafCert(t, signedCert, "rootCN", "CN", "OU", "ORG"), 1)
@@ -205,7 +205,7 @@ func TestParseValidateAndSignCSR(t *testing.T) {
 
 func TestParseValidateAndSignMaliciousCSR(t *testing.T) {
 	rootCA, err := ca.CreateRootCA("rootCN")
-	assert.NoError(t, err)
+	require.NoError(t, err)
 
 	req := &cfcsr.CertificateRequest{
 		Names: []cfcsr.Name{
@@ -221,10 +221,10 @@ func TestParseValidateAndSignMaliciousCSR(t *testing.T) {
 	}
 
 	csr, _, err := cfcsr.ParseRequest(req)
-	assert.NoError(t, err)
+	require.NoError(t, err)
 
 	signedCert, err := rootCA.ParseValidateAndSignCSR(csr, "CN", "OU", "ORG")
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	assert.NotNil(t, signedCert)
 
 	assert.Len(t, checkLeafCert(t, signedCert, "rootCN", "CN", "OU", "ORG"), 1)
@@ -267,7 +267,7 @@ func TestGetRemoteCA(t *testing.T) {
 		if err == nil {
 			return fmt.Errorf("testca's rootca hasn't updated yet")
 		}
-		require.Contains(t, err.Error(), "remote CA does not match fingerprint")
+		require.ErrorContains(t, err, "remote CA does not match fingerprint")
 		return nil
 	}))
 
@@ -277,7 +277,7 @@ func TestGetRemoteCA(t *testing.T) {
 	downloadedRootCA, err = ca.GetRemoteCA(tc.Context, d, tc.ConnBroker)
 	require.NoError(t, err)
 	require.Equal(t, comboCertBundle, downloadedRootCA.Certs)
-	require.Equal(t, 2, len(downloadedRootCA.Pool.Subjects()))
+	require.Len(t, downloadedRootCA.Pool.Subjects(), 2)
 
 	for _, rootCA := range []ca.RootCA{tc.RootCA, otherRootCA} {
 		krw := ca.NewKeyReadWriter(paths.Node, nil, nil)
@@ -503,23 +503,23 @@ func TestGetRemoteSignedCertificate(t *testing.T) {
 
 	// Create a new CSR to be signed
 	csr, _, err := ca.GenerateNewCSR()
-	assert.NoError(t, err)
+	require.NoError(t, err)
 
 	certs, err := ca.GetRemoteSignedCertificate(tc.Context, csr, tc.RootCA.Pool,
 		ca.CertificateRequestConfig{
 			Token:      tc.ManagerToken,
 			ConnBroker: tc.ConnBroker,
 		})
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	assert.NotNil(t, certs)
 
 	// Test the expiration for a manager certificate
 	parsedCerts, err := helpers.ParseCertificatesPEM(certs)
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	assert.Len(t, parsedCerts, 1)
-	assert.True(t, time.Now().Add(ca.DefaultNodeCertExpiration).AddDate(0, 0, -1).Before(parsedCerts[0].NotAfter))
-	assert.True(t, time.Now().Add(ca.DefaultNodeCertExpiration).AddDate(0, 0, 1).After(parsedCerts[0].NotAfter))
-	assert.Equal(t, parsedCerts[0].Subject.OrganizationalUnit[0], ca.ManagerRole)
+	assert.Less(t, time.Now().Add(ca.DefaultNodeCertExpiration).AddDate(0, 0, -1), parsedCerts[0].NotAfter)
+	assert.Greater(t, time.Now().Add(ca.DefaultNodeCertExpiration).AddDate(0, 0, 1), parsedCerts[0].NotAfter)
+	assert.Equal(t, ca.ManagerRole, parsedCerts[0].Subject.OrganizationalUnit[0])
 
 	// Test the expiration for an worker certificate
 	certs, err = ca.GetRemoteSignedCertificate(tc.Context, csr, tc.RootCA.Pool,
@@ -527,14 +527,14 @@ func TestGetRemoteSignedCertificate(t *testing.T) {
 			Token:      tc.WorkerToken,
 			ConnBroker: tc.ConnBroker,
 		})
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	assert.NotNil(t, certs)
 	parsedCerts, err = helpers.ParseCertificatesPEM(certs)
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	assert.Len(t, parsedCerts, 1)
-	assert.True(t, time.Now().Add(ca.DefaultNodeCertExpiration).AddDate(0, 0, -1).Before(parsedCerts[0].NotAfter))
-	assert.True(t, time.Now().Add(ca.DefaultNodeCertExpiration).AddDate(0, 0, 1).After(parsedCerts[0].NotAfter))
-	assert.Equal(t, parsedCerts[0].Subject.OrganizationalUnit[0], ca.WorkerRole)
+	assert.Less(t, time.Now().Add(ca.DefaultNodeCertExpiration).AddDate(0, 0, -1), parsedCerts[0].NotAfter)
+	assert.Greater(t, time.Now().Add(ca.DefaultNodeCertExpiration).AddDate(0, 0, 1), parsedCerts[0].NotAfter)
+	assert.Equal(t, ca.WorkerRole, parsedCerts[0].Subject.OrganizationalUnit[0])
 }
 
 func TestGetRemoteSignedCertificateNodeInfo(t *testing.T) {
@@ -543,14 +543,14 @@ func TestGetRemoteSignedCertificateNodeInfo(t *testing.T) {
 
 	// Create a new CSR to be signed
 	csr, _, err := ca.GenerateNewCSR()
-	assert.NoError(t, err)
+	require.NoError(t, err)
 
 	cert, err := ca.GetRemoteSignedCertificate(tc.Context, csr, tc.RootCA.Pool,
 		ca.CertificateRequestConfig{
 			Token:      tc.WorkerToken,
 			ConnBroker: tc.ConnBroker,
 		})
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	assert.NotNil(t, cert)
 }
 
@@ -712,7 +712,7 @@ func TestGetRemoteSignedCertificateWithPending(t *testing.T) {
 	case <-time.After(2500 * time.Millisecond):
 		// good, it's still polling so we can proceed with the test
 	}
-	require.True(t, atomic.LoadInt64(&fakeCAServer.nodeStatusCalled) > 1, "expected NodeCertificateStatus to have been polled more than once")
+	require.Greater(t, atomic.LoadInt64(&fakeCAServer.nodeStatusCalled), 1, "expected NodeCertificateStatus to have been polled more than once")
 
 	// Directly update the status of the store
 	err = tc.MemoryStore.Update(func(tx store.Tx) error {
@@ -742,7 +742,7 @@ func TestGetRemoteSignedCertificateWithPending(t *testing.T) {
 	select {
 	case err = <-completed:
 		s, _ := status.FromError(err)
-		require.Equal(t, s.Code(), codes.DeadlineExceeded)
+		require.Equal(t, codes.DeadlineExceeded, s.Code())
 	case <-time.After(3 * time.Second):
 		require.FailNow(t, "GetRemoteSignedCertificate should have been canceled after 1 second, and it has been 3")
 	}
@@ -865,7 +865,7 @@ func TestGetRemoteSignedCertificateConnectionErrors(t *testing.T) {
 	// wait for 5 seconds and ensure that GetRemoteSignedCertificate has returned with an error.
 	select {
 	case err = <-completed:
-		require.Contains(t, err.Error(), "no more peers")
+		require.ErrorContains(t, err, "no more peers")
 	case <-time.After(5 * time.Second):
 		require.FailNow(t, "GetRemoteSignedCertificate should errored after 5 seconds")
 	}
@@ -909,68 +909,68 @@ func TestNewRootCABundle(t *testing.T) {
 
 	// make one rootCA
 	firstRootCA, err := ca.CreateRootCA("rootCN1")
-	assert.NoError(t, err)
+	require.NoError(t, err)
 
 	// make a second root CA
 	secondRootCA, err := ca.CreateRootCA("rootCN2")
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	s, err := firstRootCA.Signer()
 	require.NoError(t, err)
 
 	// Overwrite the bytes of the second Root CA with the bundle, creating a valid 2 cert bundle
 	bundle := append(firstRootCA.Certs, secondRootCA.Certs...)
 	err = os.WriteFile(paths.RootCA.Cert, bundle, 0o644)
-	assert.NoError(t, err)
+	require.NoError(t, err)
 
 	newRootCA, err := ca.NewRootCA(bundle, firstRootCA.Certs, s.Key, ca.DefaultNodeCertExpiration, nil)
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	assert.Equal(t, bundle, newRootCA.Certs)
-	assert.Equal(t, 2, len(newRootCA.Pool.Subjects()))
+	assert.Len(t, newRootCA.Pool.Subjects(), 2)
 
 	// If I use newRootCA's IssueAndSaveNewCertificates to sign certs, I'll get the correct CA in the chain
 	kw := ca.NewKeyReadWriter(paths.Node, nil, nil)
 	_, _, err = newRootCA.IssueAndSaveNewCertificates(kw, "CN", "OU", "ORG")
-	assert.NoError(t, err)
+	require.NoError(t, err)
 
 	certBytes, err := os.ReadFile(paths.Node.Cert)
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	assert.Len(t, checkLeafCert(t, certBytes, "rootCN1", "CN", "OU", "ORG"), 1)
 }
 
 func TestNewRootCANonDefaultExpiry(t *testing.T) {
 	rootCA, err := ca.CreateRootCA("rootCN")
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	s, err := rootCA.Signer()
 	require.NoError(t, err)
 
 	newRootCA, err := ca.NewRootCA(rootCA.Certs, rootCA.Certs, s.Key, 1*time.Hour, nil)
-	assert.NoError(t, err)
+	require.NoError(t, err)
 
 	// Create and sign a new CSR
 	csr, _, err := ca.GenerateNewCSR()
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	cert, err := newRootCA.ParseValidateAndSignCSR(csr, "CN", ca.ManagerRole, "ORG")
-	assert.NoError(t, err)
+	require.NoError(t, err)
 
 	parsedCerts, err := helpers.ParseCertificatesPEM(cert)
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	assert.Len(t, parsedCerts, 1)
-	assert.True(t, time.Now().Add(time.Minute*59).Before(parsedCerts[0].NotAfter))
-	assert.True(t, time.Now().Add(time.Hour).Add(time.Minute).After(parsedCerts[0].NotAfter))
+	assert.Less(t, time.Now().Add(time.Minute*59), parsedCerts[0].NotAfter)
+	assert.Greater(t, time.Now().Add(time.Hour).Add(time.Minute), parsedCerts[0].NotAfter)
 
 	// Sign the same CSR again, this time with a 59 Minute expiration RootCA (under the 60 minute minimum).
 	// This should use the default of 3 months
 	newRootCA, err = ca.NewRootCA(rootCA.Certs, rootCA.Certs, s.Key, 59*time.Minute, nil)
-	assert.NoError(t, err)
+	require.NoError(t, err)
 
 	cert, err = newRootCA.ParseValidateAndSignCSR(csr, "CN", ca.ManagerRole, "ORG")
-	assert.NoError(t, err)
+	require.NoError(t, err)
 
 	parsedCerts, err = helpers.ParseCertificatesPEM(cert)
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	assert.Len(t, parsedCerts, 1)
-	assert.True(t, time.Now().Add(ca.DefaultNodeCertExpiration).AddDate(0, 0, -1).Before(parsedCerts[0].NotAfter))
-	assert.True(t, time.Now().Add(ca.DefaultNodeCertExpiration).AddDate(0, 0, 1).After(parsedCerts[0].NotAfter))
+	assert.Less(t, time.Now().Add(ca.DefaultNodeCertExpiration).AddDate(0, 0, -1), parsedCerts[0].NotAfter)
+	assert.Greater(t, time.Now().Add(ca.DefaultNodeCertExpiration).AddDate(0, 0, 1), parsedCerts[0].NotAfter)
 }
 
 type invalidNewRootCATestCase struct {
@@ -1158,8 +1158,7 @@ func TestNewRootCAInvalidCertAndKeys(t *testing.T) {
 
 	for i, invalid := range invalids {
 		_, err := ca.NewRootCA(invalid.roots, invalid.cert, invalid.key, ca.DefaultNodeCertExpiration, invalid.intermediates)
-		require.Error(t, err, fmt.Sprintf("expected error containing: \"%s\", test case (%d)", invalid.errorStr, i))
-		require.Contains(t, err.Error(), invalid.errorStr, fmt.Sprintf("%d", i))
+		require.ErrorContains(t, err, invalid.errorStr, "%d", i)
 	}
 }
 
@@ -1217,7 +1216,7 @@ func TestRootCAWithCrossSignedIntermediates(t *testing.T) {
 			require.NoError(t, err)
 			require.Len(t, parsedCerts, 2)
 			require.Len(t, chains, 1)
-			require.True(t, len(chains[0]) >= 2) // there are always at least 2 certs at minimum: the leaf and the root
+			require.GreaterOrEqual(t, len(chains[0]), 2) // there are always at least 2 certs at minimum: the leaf and the root
 			require.Equal(t, parsedCerts[0], chains[0][0])
 			require.Equal(t, parsedIntermediate.Raw, parsedCerts[1].Raw)
 
@@ -1373,8 +1372,7 @@ func TestValidateCertificateChain(t *testing.T) {
 		pool := x509.NewCertPool()
 		pool.AppendCertsFromPEM(invalid.root)
 		_, _, err := ca.ValidateCertChain(pool, invalid.cert, invalid.allowExpiry)
-		require.Error(t, err, invalid.errorStr)
-		require.Contains(t, err.Error(), invalid.errorStr)
+		require.ErrorContains(t, err, invalid.errorStr)
 	}
 
 	// these will default to using the root pool, so we don't have to specify the root pool
@@ -1402,7 +1400,7 @@ func TestValidateCertificateChain(t *testing.T) {
 		require.NotEmpty(t, chain)
 		for _, chain := range chains {
 			require.Equal(t, parsedCerts[0], chain[0]) // the leaf certs are equal
-			require.True(t, len(chain) >= 2)
+			require.GreaterOrEqual(t, len(chain), 2)
 		}
 	}
 }
diff --git a/ca/config_test.go b/ca/config_test.go
index 77f9ce2b4d..191c23f000 100644
--- a/ca/config_test.go
+++ b/ca/config_test.go
@@ -55,7 +55,7 @@ func testDownloadRootCASuccess(t *testing.T, fips bool) {
 	require.True(t, strings.HasPrefix(token, prefix))
 
 	// Remove the CA cert
-	assert.NoError(t, os.RemoveAll(tc.Paths.RootCA.Cert))
+	require.NoError(t, os.RemoveAll(tc.Paths.RootCA.Cert))
 
 	rootCA, err := ca.DownloadRootCA(tc.Context, tc.Paths.RootCA, token, tc.ConnBroker)
 	require.NoError(t, err)
@@ -66,7 +66,7 @@ func testDownloadRootCASuccess(t *testing.T, fips bool) {
 	require.Equal(t, tc.RootCA.Certs, rootCA.Certs)
 
 	// Remove the CA cert
-	assert.NoError(t, os.RemoveAll(tc.Paths.RootCA.Cert))
+	require.NoError(t, os.RemoveAll(tc.Paths.RootCA.Cert))
 
 	// downloading without a join token also succeeds
 	rootCA, err = ca.DownloadRootCA(tc.Context, tc.Paths.RootCA, "", tc.ConnBroker)
@@ -83,7 +83,7 @@ func TestDownloadRootCAWrongCAHash(t *testing.T) {
 	defer tc.Stop()
 
 	// Remove the CA cert
-	assert.NoError(t, os.RemoveAll(tc.Paths.RootCA.Cert))
+	require.NoError(t, os.RemoveAll(tc.Paths.RootCA.Cert))
 
 	// invalid token
 	for _, invalid := range []string{
@@ -93,8 +93,7 @@ func TestDownloadRootCAWrongCAHash(t *testing.T) {
 		"SWMTKN-0-1fhvpatk6ms36i3uc64tsv1ybyuxkb899zbjpq4ib64qwbibz4-1g3as27iwmko5yqh1byv868hx", // invalid version
 	} {
 		_, err := ca.DownloadRootCA(tc.Context, tc.Paths.RootCA, invalid, tc.ConnBroker)
-		require.Error(t, err)
-		require.Contains(t, err.Error(), "invalid join token")
+		require.ErrorContains(t, err, "invalid join token")
 	}
 
 	// invalid hash token - can get the wrong hash from both version 1 and version 2
@@ -103,8 +102,7 @@ func TestDownloadRootCAWrongCAHash(t *testing.T) {
 		"SWMTKN-2-0-1kxftv4ofnc6mt30lmgipg6ngf9luhwqopfk1tz6bdmnkubg0e-4myj5xihyto11dg1cn55w8p61",
 	} {
 		_, err := ca.DownloadRootCA(tc.Context, tc.Paths.RootCA, wrongToken, tc.ConnBroker)
-		require.Error(t, err)
-		require.Contains(t, err.Error(), "remote CA does not match fingerprint.")
+		require.ErrorContains(t, err, "remote CA does not match fingerprint.")
 	}
 }
 
@@ -114,14 +112,14 @@ func TestCreateSecurityConfigEmptyDir(t *testing.T) {
 	}
 	tc := cautils.NewTestCA(t)
 	defer tc.Stop()
-	assert.NoError(t, tc.CAServer.Stop())
+	require.NoError(t, tc.CAServer.Stop())
 
 	// Remove all the contents from the temp dir and try again with a new node
 	for _, org := range []string{
 		"",
 		"my_org",
 	} {
-		assert.NoError(t, os.RemoveAll(tc.TempDir))
+		require.NoError(t, os.RemoveAll(tc.TempDir))
 		krw := ca.NewKeyReadWriter(tc.Paths.Node, nil, nil)
 		nodeConfig, cancel, err := tc.RootCA.CreateSecurityConfig(tc.Context, krw,
 			ca.CertificateRequestConfig{
@@ -140,7 +138,7 @@ func TestCreateSecurityConfigEmptyDir(t *testing.T) {
 		}
 
 		root, err := helpers.ParseCertificatePEM(tc.RootCA.Certs)
-		assert.NoError(t, err)
+		require.NoError(t, err)
 
 		issuerInfo := nodeConfig.IssuerInfo()
 		assert.NotNil(t, issuerInfo)
@@ -186,9 +184,9 @@ func TestCreateSecurityConfigNoCerts(t *testing.T) {
 
 	// Remove only the node certificates form the directory, get a new rootCA, and attest that we get
 	// new certificates that are issued by the remote CA
-	assert.NoError(t, os.RemoveAll(tc.Paths.Node.Cert))
+	require.NoError(t, os.RemoveAll(tc.Paths.Node.Cert))
 	rootCA, err := ca.GetLocalRootCA(tc.Paths.RootCA)
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	validateNodeConfig(&rootCA)
 }
 
@@ -267,7 +265,7 @@ func TestLoadSecurityConfigInvalidCert(t *testing.T) {
 	err := os.WriteFile(tc.Paths.Node.Cert, []byte(`-----BEGIN CERTIFICATE-----\n
 some random garbage\n
 -----END CERTIFICATE-----`), 0o644)
-	assert.NoError(t, err)
+	require.NoError(t, err)
 
 	krw := ca.NewKeyReadWriter(tc.Paths.Node, nil, nil)
 
@@ -286,7 +284,7 @@ func TestLoadSecurityConfigInvalidKey(t *testing.T) {
 	err := os.WriteFile(tc.Paths.Node.Key, []byte(`-----BEGIN PRIVATE KEY-----\n
 some random garbage\n
 -----END PRIVATE KEY-----`), 0o644)
-	assert.NoError(t, err)
+	require.NoError(t, err)
 
 	krw := ca.NewKeyReadWriter(tc.Paths.Node, nil, nil)
 
@@ -831,13 +829,13 @@ func TestRenewTLSConfigUpdateRootCARace(t *testing.T) {
 				s = *signer
 			}
 			updatedRootCA, err := ca.NewRootCA(append(rootCA.Certs, cert...), s.Cert, s.Key, ca.DefaultNodeCertExpiration, nil)
-			require.NoError(t, err)
-			require.NoError(t, secConfig.UpdateRootCA(&updatedRootCA))
+			assert.NoError(t, err)
+			assert.NoError(t, secConfig.UpdateRootCA(&updatedRootCA))
 		}()
 
 		go func() {
 			defer close(done2)
-			require.NoError(t, ca.RenewTLSConfigNow(ctx, secConfig, tc.ConnBroker, tc.Paths.RootCA))
+			assert.NoError(t, ca.RenewTLSConfigNow(ctx, secConfig, tc.ConnBroker, tc.Paths.RootCA))
 		}()
 
 		<-done1
@@ -863,7 +861,7 @@ func writeAlmostExpiringCertToDisk(t *testing.T, tc *cautils.TestCA, cn, ou, org
 	// Because of the default backdate of 5 minutes, this issues certificates
 	// valid for 1 minute.
 	newRootCA, err := ca.NewRootCA(tc.RootCA.Certs, s.Cert, s.Key, ca.DefaultNodeCertExpiration, nil)
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	newSigner, err := newRootCA.Signer()
 	require.NoError(t, err)
 	newSigner.SetPolicy(&cfconfig.Signing{
@@ -891,7 +889,7 @@ func TestRenewTLSConfigWorker(t *testing.T) {
 	// Get a new nodeConfig with a TLS cert that has the default Cert duration, but overwrite
 	// the cert on disk with one that expires in 1 minute
 	nodeConfig, err := tc.WriteNewNodeConfig(ca.WorkerRole)
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	c := nodeConfig.ClientTLSCreds
 	writeAlmostExpiringCertToDisk(t, tc, c.NodeID(), c.Role(), c.Organization())
 
@@ -901,13 +899,13 @@ func TestRenewTLSConfigWorker(t *testing.T) {
 	case <-time.After(10 * time.Second):
 		assert.Fail(t, "TestRenewTLSConfig timed-out")
 	case certUpdate := <-updates:
-		assert.NoError(t, certUpdate.Err)
+		require.NoError(t, certUpdate.Err)
 		assert.NotNil(t, certUpdate)
 		assert.Equal(t, ca.WorkerRole, certUpdate.Role)
 	}
 
 	root, err := helpers.ParseCertificatePEM(tc.RootCA.Certs)
-	assert.NoError(t, err)
+	require.NoError(t, err)
 
 	issuerInfo := nodeConfig.IssuerInfo()
 	assert.NotNil(t, issuerInfo)
@@ -927,7 +925,7 @@ func TestRenewTLSConfigManager(t *testing.T) {
 	// Get a new nodeConfig with a TLS cert that has the default Cert duration, but overwrite
 	// the cert on disk with one that expires in 1 minute
 	nodeConfig, err := tc.WriteNewNodeConfig(ca.WorkerRole)
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	c := nodeConfig.ClientTLSCreds
 	writeAlmostExpiringCertToDisk(t, tc, c.NodeID(), c.Role(), c.Organization())
 
@@ -937,13 +935,13 @@ func TestRenewTLSConfigManager(t *testing.T) {
 	case <-time.After(10 * time.Second):
 		assert.Fail(t, "TestRenewTLSConfig timed-out")
 	case certUpdate := <-updates:
-		assert.NoError(t, certUpdate.Err)
+		require.NoError(t, certUpdate.Err)
 		assert.NotNil(t, certUpdate)
 		assert.Equal(t, ca.WorkerRole, certUpdate.Role)
 	}
 
 	root, err := helpers.ParseCertificatePEM(tc.RootCA.Certs)
-	assert.NoError(t, err)
+	require.NoError(t, err)
 
 	issuerInfo := nodeConfig.IssuerInfo()
 	assert.NotNil(t, issuerInfo)
@@ -963,7 +961,7 @@ func TestRenewTLSConfigWithNoNode(t *testing.T) {
 	// Get a new nodeConfig with a TLS cert that has the default Cert duration, but overwrite
 	// the cert on disk with one that expires in 1 minute
 	nodeConfig, err := tc.WriteNewNodeConfig(ca.WorkerRole)
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	c := nodeConfig.ClientTLSCreds
 	writeAlmostExpiringCertToDisk(t, tc, c.NodeID(), c.Role(), c.Organization())
 
@@ -973,7 +971,7 @@ func TestRenewTLSConfigWithNoNode(t *testing.T) {
 		assert.NotNil(t, node)
 		return store.DeleteNode(tx, nodeConfig.ClientTLSCreds.NodeID())
 	})
-	assert.NoError(t, err)
+	require.NoError(t, err)
 
 	renewer := ca.NewTLSRenewer(nodeConfig, tc.ConnBroker, tc.Paths.RootCA)
 	updates := renewer.Start(ctx)
@@ -981,7 +979,6 @@ func TestRenewTLSConfigWithNoNode(t *testing.T) {
 	case <-time.After(10 * time.Second):
 		assert.Fail(t, "TestRenewTLSConfig timed-out")
 	case certUpdate := <-updates:
-		assert.Error(t, certUpdate.Err)
-		assert.Contains(t, certUpdate.Err.Error(), "not found when attempting to renew certificate")
+		assert.ErrorContains(t, certUpdate.Err, "not found when attempting to renew certificate")
 	}
 }
diff --git a/ca/keyreadwriter_test.go b/ca/keyreadwriter_test.go
index ff0445909e..421c5d0abb 100644
--- a/ca/keyreadwriter_test.go
+++ b/ca/keyreadwriter_test.go
@@ -11,7 +11,6 @@ import (
 	"github.com/moby/swarmkit/v2/ca/keyutils"
 	"github.com/moby/swarmkit/v2/ca/pkcs8"
 	"github.com/moby/swarmkit/v2/ca/testutils"
-	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
@@ -218,8 +217,7 @@ func TestKeyReadWriterViewAndUpdateHeaders(t *testing.T) {
 		require.Nil(t, h)
 		return nil, fmt.Errorf("nope")
 	})
-	require.Error(t, err)
-	require.Equal(t, "nope", err.Error())
+	require.EqualError(t, err, "nope")
 
 	// updating headers succeed and is called with the latest kek data
 	err = k.ViewAndUpdateHeaders(func(h ca.PEMKeyHeaders) (ca.PEMKeyHeaders, error) {
@@ -337,7 +335,7 @@ func TestTwoPhaseReadWrite(t *testing.T) {
 
 	// remove the directory, to simulate it failing to write the first time
 	err = os.RemoveAll(path.Node.Cert)
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	readCert, readKey, err := krw.Read()
 	require.NoError(t, err)
 	require.Equal(t, cert2, readCert)
diff --git a/ca/renewer_test.go b/ca/renewer_test.go
index 02f6e440a4..984015d380 100644
--- a/ca/renewer_test.go
+++ b/ca/renewer_test.go
@@ -24,7 +24,7 @@ func TestForceRenewTLSConfig(t *testing.T) {
 
 	// Get a new managerConfig with a TLS cert that has 15 minutes to live
 	nodeConfig, err := tc.WriteNewNodeConfig(ca.ManagerRole)
-	assert.NoError(t, err)
+	require.NoError(t, err)
 
 	renewer := ca.NewTLSRenewer(nodeConfig, tc.ConnBroker, tc.Paths.RootCA)
 	updates := renewer.Start(ctx)
@@ -33,9 +33,9 @@ func TestForceRenewTLSConfig(t *testing.T) {
 	case <-time.After(10 * time.Second):
 		assert.Fail(t, "TestForceRenewTLSConfig timed-out")
 	case certUpdate := <-updates:
-		assert.NoError(t, certUpdate.Err)
+		require.NoError(t, certUpdate.Err)
 		assert.NotNil(t, certUpdate)
-		assert.Equal(t, certUpdate.Role, ca.ManagerRole)
+		assert.Equal(t, ca.ManagerRole, certUpdate.Role)
 	}
 }
 
@@ -50,14 +50,14 @@ func TestForceRenewExpectedRole(t *testing.T) {
 
 	// Get a new managerConfig with a TLS cert that has 15 minutes to live
 	nodeConfig, err := tc.WriteNewNodeConfig(ca.ManagerRole)
-	assert.NoError(t, err)
+	require.NoError(t, err)
 
 	go func() {
 		time.Sleep(750 * time.Millisecond)
 
 		err := tc.MemoryStore.Update(func(tx store.Tx) error {
 			node := store.GetNode(tx, nodeConfig.ClientTLSCreds.NodeID())
-			require.NotNil(t, node)
+			assert.NotNil(t, node)
 
 			node.Spec.DesiredRole = api.NodeRoleWorker
 			node.Role = api.NodeRoleWorker
@@ -76,7 +76,7 @@ func TestForceRenewExpectedRole(t *testing.T) {
 		case <-time.After(10 * time.Second):
 			t.Fatal("timed out")
 		case certUpdate := <-updates:
-			assert.NoError(t, certUpdate.Err)
+			require.NoError(t, certUpdate.Err)
 			assert.NotNil(t, certUpdate)
 			if certUpdate.Role == ca.WorkerRole {
 				return
diff --git a/ca/server_test.go b/ca/server_test.go
index 6ee6fdc77d..1be26822e1 100644
--- a/ca/server_test.go
+++ b/ca/server_test.go
@@ -34,7 +34,7 @@ func TestGetRootCACertificate(t *testing.T) {
 	defer tc.Stop()
 
 	resp, err := tc.CAClients[0].GetRootCACertificate(tc.Context, &api.GetRootCACertificateRequest{})
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	assert.NotEmpty(t, resp.Certificate)
 }
 
@@ -43,7 +43,7 @@ func TestRestartRootCA(t *testing.T) {
 	defer tc.Stop()
 
 	_, err := tc.NodeCAClients[0].NodeCertificateStatus(tc.Context, &api.NodeCertificateStatusRequest{NodeID: "foo"})
-	assert.Error(t, err)
+	require.Error(t, err)
 	assert.Equal(t, codes.NotFound, testutils.ErrorCode(err))
 
 	tc.CAServer.Stop()
@@ -52,7 +52,7 @@ func TestRestartRootCA(t *testing.T) {
 	<-tc.CAServer.Ready()
 
 	_, err = tc.NodeCAClients[0].NodeCertificateStatus(tc.Context, &api.NodeCertificateStatusRequest{NodeID: "foo"})
-	assert.Error(t, err)
+	require.Error(t, err)
 	assert.Equal(t, codes.NotFound, testutils.ErrorCode(err))
 }
 
@@ -61,11 +61,11 @@ func TestIssueNodeCertificate(t *testing.T) {
 	defer tc.Stop()
 
 	csr, _, err := ca.GenerateNewCSR()
-	assert.NoError(t, err)
+	require.NoError(t, err)
 
 	issueRequest := &api.IssueNodeCertificateRequest{CSR: csr, Token: tc.WorkerToken}
 	issueResponse, err := tc.NodeCAClients[0].IssueNodeCertificate(tc.Context, issueRequest)
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	assert.NotNil(t, issueResponse.NodeID)
 	assert.Equal(t, api.NodeMembershipAccepted, issueResponse.NodeMembership)
 
@@ -83,11 +83,11 @@ func TestForceRotationIsNoop(t *testing.T) {
 
 	// Get a new Certificate issued
 	csr, _, err := ca.GenerateNewCSR()
-	assert.NoError(t, err)
+	require.NoError(t, err)
 
 	issueRequest := &api.IssueNodeCertificateRequest{CSR: csr, Token: tc.WorkerToken}
 	issueResponse, err := tc.NodeCAClients[0].IssueNodeCertificate(tc.Context, issueRequest)
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	assert.NotNil(t, issueResponse.NodeID)
 	assert.Equal(t, api.NodeMembershipAccepted, issueResponse.NodeMembership)
 
@@ -108,7 +108,7 @@ func TestForceRotationIsNoop(t *testing.T) {
 		node.Certificate.Status.State = api.IssuanceStateRotate
 		return store.UpdateNode(tx, node)
 	})
-	assert.NoError(t, err)
+	require.NoError(t, err)
 
 	// Wait a bit and check that the certificate hasn't changed/been reissued
 	time.Sleep(250 * time.Millisecond)
@@ -129,7 +129,7 @@ func TestIssueNodeCertificateBrokenCA(t *testing.T) {
 	defer tc.Stop()
 
 	csr, _, err := ca.GenerateNewCSR()
-	assert.NoError(t, err)
+	require.NoError(t, err)
 
 	tc.ExternalSigningServer.Flake()
 
@@ -139,7 +139,7 @@ func TestIssueNodeCertificateBrokenCA(t *testing.T) {
 	}()
 	issueRequest := &api.IssueNodeCertificateRequest{CSR: csr, Token: tc.WorkerToken}
 	issueResponse, err := tc.NodeCAClients[0].IssueNodeCertificate(tc.Context, issueRequest)
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	assert.NotNil(t, issueResponse.NodeID)
 	assert.Equal(t, api.NodeMembershipAccepted, issueResponse.NodeMembership)
 
@@ -158,7 +158,7 @@ func TestIssueNodeCertificateWithInvalidCSR(t *testing.T) {
 
 	issueRequest := &api.IssueNodeCertificateRequest{CSR: []byte("random garbage"), Token: tc.WorkerToken}
 	issueResponse, err := tc.NodeCAClients[0].IssueNodeCertificate(tc.Context, issueRequest)
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	assert.NotNil(t, issueResponse.NodeID)
 	assert.Equal(t, api.NodeMembershipAccepted, issueResponse.NodeMembership)
 
@@ -175,12 +175,12 @@ func TestIssueNodeCertificateWorkerRenewal(t *testing.T) {
 	defer tc.Stop()
 
 	csr, _, err := ca.GenerateNewCSR()
-	assert.NoError(t, err)
+	require.NoError(t, err)
 
 	role := api.NodeRoleWorker
 	issueRequest := &api.IssueNodeCertificateRequest{CSR: csr, Role: role}
 	issueResponse, err := tc.NodeCAClients[1].IssueNodeCertificate(tc.Context, issueRequest)
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	assert.NotNil(t, issueResponse.NodeID)
 	assert.Equal(t, api.NodeMembershipAccepted, issueResponse.NodeMembership)
 
@@ -197,7 +197,7 @@ func TestIssueNodeCertificateManagerRenewal(t *testing.T) {
 	defer tc.Stop()
 
 	csr, _, err := ca.GenerateNewCSR()
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	assert.NotNil(t, csr)
 
 	role := api.NodeRoleManager
@@ -220,7 +220,7 @@ func TestIssueNodeCertificateWorkerFromDifferentOrgRenewal(t *testing.T) {
 	defer tc.Stop()
 
 	csr, _, err := ca.GenerateNewCSR()
-	assert.NoError(t, err)
+	require.NoError(t, err)
 
 	// Since we're using a client that has a different Organization, this request will be treated
 	// as a new certificate request, not allowing auto-renewal. Therefore, the request will fail.
@@ -234,18 +234,18 @@ func TestNodeCertificateRenewalsDoNotRequireToken(t *testing.T) {
 	defer tc.Stop()
 
 	csr, _, err := ca.GenerateNewCSR()
-	assert.NoError(t, err)
+	require.NoError(t, err)
 
 	role := api.NodeRoleManager
 	issueRequest := &api.IssueNodeCertificateRequest{CSR: csr, Role: role}
 	issueResponse, err := tc.NodeCAClients[2].IssueNodeCertificate(tc.Context, issueRequest)
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	assert.NotNil(t, issueResponse.NodeID)
 	assert.Equal(t, api.NodeMembershipAccepted, issueResponse.NodeMembership)
 
 	statusRequest := &api.NodeCertificateStatusRequest{NodeID: issueResponse.NodeID}
 	statusResponse, err := tc.NodeCAClients[2].NodeCertificateStatus(tc.Context, statusRequest)
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	assert.Equal(t, api.IssuanceStateIssued, statusResponse.Status.State)
 	assert.NotNil(t, statusResponse.Certificate.Certificate)
 	assert.Equal(t, role, statusResponse.Certificate.Role)
@@ -272,35 +272,35 @@ func TestNewNodeCertificateRequiresToken(t *testing.T) {
 	defer tc.Stop()
 
 	csr, _, err := ca.GenerateNewCSR()
-	assert.NoError(t, err)
+	require.NoError(t, err)
 
 	// Issuance fails if no secret is provided
 	role := api.NodeRoleManager
 	issueRequest := &api.IssueNodeCertificateRequest{CSR: csr, Role: role}
 	_, err = tc.NodeCAClients[0].IssueNodeCertificate(tc.Context, issueRequest)
-	assert.EqualError(t, err, "rpc error: code = InvalidArgument desc = A valid join token is necessary to join this cluster")
+	require.EqualError(t, err, "rpc error: code = InvalidArgument desc = A valid join token is necessary to join this cluster")
 
 	role = api.NodeRoleWorker
 	issueRequest = &api.IssueNodeCertificateRequest{CSR: csr, Role: role}
 	_, err = tc.NodeCAClients[0].IssueNodeCertificate(tc.Context, issueRequest)
-	assert.EqualError(t, err, "rpc error: code = InvalidArgument desc = A valid join token is necessary to join this cluster")
+	require.EqualError(t, err, "rpc error: code = InvalidArgument desc = A valid join token is necessary to join this cluster")
 
 	// Issuance fails if wrong secret is provided
 	role = api.NodeRoleManager
 	issueRequest = &api.IssueNodeCertificateRequest{CSR: csr, Role: role, Token: "invalid-secret"}
 	_, err = tc.NodeCAClients[0].IssueNodeCertificate(tc.Context, issueRequest)
-	assert.EqualError(t, err, "rpc error: code = InvalidArgument desc = A valid join token is necessary to join this cluster")
+	require.EqualError(t, err, "rpc error: code = InvalidArgument desc = A valid join token is necessary to join this cluster")
 
 	role = api.NodeRoleWorker
 	issueRequest = &api.IssueNodeCertificateRequest{CSR: csr, Role: role, Token: "invalid-secret"}
 	_, err = tc.NodeCAClients[0].IssueNodeCertificate(tc.Context, issueRequest)
-	assert.EqualError(t, err, "rpc error: code = InvalidArgument desc = A valid join token is necessary to join this cluster")
+	require.EqualError(t, err, "rpc error: code = InvalidArgument desc = A valid join token is necessary to join this cluster")
 
 	// Issuance succeeds if correct token is provided
 	role = api.NodeRoleManager
 	issueRequest = &api.IssueNodeCertificateRequest{CSR: csr, Role: role, Token: tc.ManagerToken}
 	_, err = tc.NodeCAClients[0].IssueNodeCertificate(tc.Context, issueRequest)
-	assert.NoError(t, err)
+	require.NoError(t, err)
 
 	role = api.NodeRoleWorker
 	issueRequest = &api.IssueNodeCertificateRequest{CSR: csr, Role: role, Token: tc.WorkerToken}
@@ -334,18 +334,18 @@ func TestNewNodeCertificateRequiresToken(t *testing.T) {
 	}))
 
 	// Old token should fail
-	assert.EqualError(t, err, "rpc error: code = InvalidArgument desc = A valid join token is necessary to join this cluster")
+	require.EqualError(t, err, "rpc error: code = InvalidArgument desc = A valid join token is necessary to join this cluster")
 
 	role = api.NodeRoleWorker
 	issueRequest = &api.IssueNodeCertificateRequest{CSR: csr, Role: role, Token: tc.WorkerToken}
 	_, err = tc.NodeCAClients[0].IssueNodeCertificate(tc.Context, issueRequest)
-	assert.EqualError(t, err, "rpc error: code = InvalidArgument desc = A valid join token is necessary to join this cluster")
+	require.EqualError(t, err, "rpc error: code = InvalidArgument desc = A valid join token is necessary to join this cluster")
 
 	// New token should succeed
 	role = api.NodeRoleManager
 	issueRequest = &api.IssueNodeCertificateRequest{CSR: csr, Role: role, Token: newManagerToken}
 	_, err = tc.NodeCAClients[0].IssueNodeCertificate(tc.Context, issueRequest)
-	assert.NoError(t, err)
+	require.NoError(t, err)
 
 	role = api.NodeRoleWorker
 	issueRequest = &api.IssueNodeCertificateRequest{CSR: csr, Role: role, Token: newWorkerToken}
@@ -358,13 +358,13 @@ func TestNewNodeCertificateBadToken(t *testing.T) {
 	defer tc.Stop()
 
 	csr, _, err := ca.GenerateNewCSR()
-	assert.NoError(t, err)
+	require.NoError(t, err)
 
 	// Issuance fails if wrong secret is provided
 	role := api.NodeRoleManager
 	issueRequest := &api.IssueNodeCertificateRequest{CSR: csr, Role: role, Token: "invalid-secret"}
 	_, err = tc.NodeCAClients[0].IssueNodeCertificate(tc.Context, issueRequest)
-	assert.EqualError(t, err, "rpc error: code = InvalidArgument desc = A valid join token is necessary to join this cluster")
+	require.EqualError(t, err, "rpc error: code = InvalidArgument desc = A valid join token is necessary to join this cluster")
 
 	role = api.NodeRoleWorker
 	issueRequest = &api.IssueNodeCertificateRequest{CSR: csr, Role: role, Token: "invalid-secret"}
@@ -480,7 +480,7 @@ func TestServerExternalCAGetsTLSKeypairUpdates(t *testing.T) {
 		}
 		return nil
 	}, 2*time.Second))
-	require.Contains(t, errors.Cause(err).Error(), "remote error: tls: expired certificate")
+	require.ErrorContains(t, errors.Cause(err), "remote error: tls: expired certificate")
 }
 
 func TestCAServerUpdateRootCA(t *testing.T) {
@@ -1149,7 +1149,7 @@ func TestRootRotationReconciliationNoChanges(t *testing.T) {
 		}
 		s, err := rt.tc.CAServer.RootCA().Signer()
 		require.NoError(t, err, testcase.descr)
-		require.Equal(t, s.Key, expectedKey, testcase.descr)
+		require.Equal(t, expectedKey, s.Key, testcase.descr)
 	}
 }