diff --git a/cli/command/cli_test.go b/cli/command/cli_test.go
index 73e17d7e4c..85a49aca17 100644
--- a/cli/command/cli_test.go
+++ b/cli/command/cli_test.go
@@ -23,7 +23,6 @@ import (
 	"github.com/docker/docker/client"
 	"github.com/pkg/errors"
 	"gotest.tools/v3/assert"
-	"gotest.tools/v3/env"
 	"gotest.tools/v3/fs"
 )
 
@@ -89,8 +88,8 @@ func TestNewAPIClientFromFlagsWithCustomHeaders(t *testing.T) {
 
 func TestNewAPIClientFromFlagsWithAPIVersionFromEnv(t *testing.T) {
 	customVersion := "v3.3.3"
-	defer env.Patch(t, "DOCKER_API_VERSION", customVersion)()
-	defer env.Patch(t, "DOCKER_HOST", ":2375")()
+	t.Setenv("DOCKER_API_VERSION", customVersion)
+	t.Setenv("DOCKER_HOST", ":2375")
 
 	opts := &flags.CommonOptions{}
 	configFile := &configfile.ConfigFile{}
diff --git a/cli/command/defaultcontextstore_test.go b/cli/command/defaultcontextstore_test.go
index cb45c60dd4..4b00b49f9e 100644
--- a/cli/command/defaultcontextstore_test.go
+++ b/cli/command/defaultcontextstore_test.go
@@ -10,7 +10,6 @@ import (
 	cliflags "github.com/docker/cli/cli/flags"
 	"github.com/docker/go-connections/tlsconfig"
 	"gotest.tools/v3/assert"
-	"gotest.tools/v3/env"
 	"gotest.tools/v3/golden"
 )
 
@@ -53,7 +52,7 @@ func testStore(t *testing.T, meta store.Metadata, tls store.ContextTLSData) stor
 func TestDefaultContextInitializer(t *testing.T) {
 	cli, err := NewDockerCli()
 	assert.NilError(t, err)
-	defer env.Patch(t, "DOCKER_HOST", "ssh://someswarmserver")()
+	t.Setenv("DOCKER_HOST", "ssh://someswarmserver")
 	cli.configFile = &configfile.ConfigFile{}
 	ctx, err := ResolveDefaultContext(&cliflags.CommonOptions{
 		TLS: true,
diff --git a/cli/command/image/build_test.go b/cli/command/image/build_test.go
index 94ea7a4411..bb308869d2 100644
--- a/cli/command/image/build_test.go
+++ b/cli/command/image/build_test.go
@@ -17,13 +17,12 @@ import (
 	"github.com/docker/docker/pkg/archive"
 	"github.com/google/go-cmp/cmp"
 	"gotest.tools/v3/assert"
-	"gotest.tools/v3/env"
 	"gotest.tools/v3/fs"
 	"gotest.tools/v3/skip"
 )
 
 func TestRunBuildDockerfileFromStdinWithCompress(t *testing.T) {
-	defer env.Patch(t, "DOCKER_BUILDKIT", "0")()
+	t.Setenv("DOCKER_BUILDKIT", "0")
 	buffer := new(bytes.Buffer)
 	fakeBuild := newFakeBuild()
 	fakeImageBuild := func(ctx context.Context, context io.Reader, options types.ImageBuildOptions) (types.ImageBuildResponse, error) {
@@ -59,8 +58,8 @@ func TestRunBuildDockerfileFromStdinWithCompress(t *testing.T) {
 }
 
 func TestRunBuildResetsUidAndGidInContext(t *testing.T) {
-	defer env.Patch(t, "DOCKER_BUILDKIT", "0")()
 	skip.If(t, os.Getuid() != 0, "root is required to chown files")
+	t.Setenv("DOCKER_BUILDKIT", "0")
 	fakeBuild := newFakeBuild()
 	cli := test.NewFakeCli(&fakeClient{imageBuildFunc: fakeBuild.build})
 
@@ -90,7 +89,7 @@ func TestRunBuildResetsUidAndGidInContext(t *testing.T) {
 }
 
 func TestRunBuildDockerfileOutsideContext(t *testing.T) {
-	defer env.Patch(t, "DOCKER_BUILDKIT", "0")()
+	t.Setenv("DOCKER_BUILDKIT", "0")
 	dir := fs.NewDir(t, t.Name(),
 		fs.WithFile("data", "data file"))
 	defer dir.Remove()
@@ -123,7 +122,7 @@ COPY data /data
 // TODO: test "context selection" logic directly when runBuild is refactored
 // to support testing (ex: docker/cli#294)
 func TestRunBuildFromGitHubSpecialCase(t *testing.T) {
-	defer env.Patch(t, "DOCKER_BUILDKIT", "0")()
+	t.Setenv("DOCKER_BUILDKIT", "0")
 	cmd := NewBuildCommand(test.NewFakeCli(&fakeClient{}))
 	// Clone a small repo that exists so git doesn't prompt for credentials
 	cmd.SetArgs([]string{"github.com/docker/for-win"})
@@ -137,7 +136,7 @@ func TestRunBuildFromGitHubSpecialCase(t *testing.T) {
 // starting with `github.com` takes precedence over the `github.com` special
 // case.
 func TestRunBuildFromLocalGitHubDir(t *testing.T) {
-	defer env.Patch(t, "DOCKER_BUILDKIT", "0")()
+	t.Setenv("DOCKER_BUILDKIT", "0")
 
 	buildDir := filepath.Join(t.TempDir(), "github.com", "docker", "no-such-repository")
 	err := os.MkdirAll(buildDir, 0777)
@@ -154,7 +153,7 @@ func TestRunBuildFromLocalGitHubDir(t *testing.T) {
 }
 
 func TestRunBuildWithSymlinkedContext(t *testing.T) {
-	defer env.Patch(t, "DOCKER_BUILDKIT", "0")()
+	t.Setenv("DOCKER_BUILDKIT", "0")
 	dockerfile := `
 FROM alpine:3.6
 RUN echo hello world
diff --git a/cli/command/image/trust_test.go b/cli/command/image/trust_test.go
index 3fcf77c52c..eba38cbb97 100644
--- a/cli/command/image/trust_test.go
+++ b/cli/command/image/trust_test.go
@@ -13,7 +13,7 @@ import (
 )
 
 func TestENVTrustServer(t *testing.T) {
-	defer env.PatchAll(t, map[string]string{"DOCKER_CONTENT_TRUST_SERVER": "https://notary-test.example.com:5000"})()
+	env.PatchAll(t, map[string]string{"DOCKER_CONTENT_TRUST_SERVER": "https://notary-test.example.com:5000"})
 	indexInfo := &registrytypes.IndexInfo{Name: "testserver"}
 	output, err := trust.Server(indexInfo)
 	expectedStr := "https://notary-test.example.com:5000"
@@ -23,7 +23,7 @@ func TestENVTrustServer(t *testing.T) {
 }
 
 func TestHTTPENVTrustServer(t *testing.T) {
-	defer env.PatchAll(t, map[string]string{"DOCKER_CONTENT_TRUST_SERVER": "http://notary-test.example.com:5000"})()
+	env.PatchAll(t, map[string]string{"DOCKER_CONTENT_TRUST_SERVER": "http://notary-test.example.com:5000"})
 	indexInfo := &registrytypes.IndexInfo{Name: "testserver"}
 	_, err := trust.Server(indexInfo)
 	if err == nil {
diff --git a/cli/compose/interpolation/interpolation_test.go b/cli/compose/interpolation/interpolation_test.go
index 536da0013b..0e70d1bbbd 100644
--- a/cli/compose/interpolation/interpolation_test.go
+++ b/cli/compose/interpolation/interpolation_test.go
@@ -1,13 +1,11 @@
 package interpolation
 
 import (
-	"testing"
-
 	"strconv"
+	"testing"
 
 	"gotest.tools/v3/assert"
 	is "gotest.tools/v3/assert/cmp"
-	"gotest.tools/v3/env"
 )
 
 var defaults = map[string]string{
@@ -62,7 +60,7 @@ func TestInvalidInterpolation(t *testing.T) {
 }
 
 func TestInterpolateWithDefaults(t *testing.T) {
-	defer env.Patch(t, "FOO", "BARZ")()
+	t.Setenv("FOO", "BARZ")
 
 	config := map[string]interface{}{
 		"networks": map[string]interface{}{
diff --git a/cli/config/config_test.go b/cli/config/config_test.go
index 9af2490870..1f95f25306 100644
--- a/cli/config/config_test.go
+++ b/cli/config/config_test.go
@@ -97,7 +97,7 @@ func TestOldJSONFallbackDeprecationWarning(t *testing.T) {
 	js := `{"https://index.docker.io/v1/":{"auth":"am9lam9lOmhlbGxv","email":"user@example.com"}}`
 	tmpHome := fs.NewDir(t, t.Name(), fs.WithFile(oldConfigfile, js))
 	defer tmpHome.Remove()
-	defer env.PatchAll(t, map[string]string{homeKey: tmpHome.Path(), "DOCKER_CONFIG": ""})()
+	env.PatchAll(t, map[string]string{homeKey: tmpHome.Path(), "DOCKER_CONFIG": ""})
 
 	// reset the homeDir, configDir, and its sync.Once, to force them being resolved again
 	resetHomeDir()
diff --git a/cmd/docker/builder_test.go b/cmd/docker/builder_test.go
index c7e70d61f4..b4ade48912 100644
--- a/cmd/docker/builder_test.go
+++ b/cmd/docker/builder_test.go
@@ -9,7 +9,6 @@ import (
 	"github.com/docker/cli/cli/command"
 	"github.com/docker/cli/internal/test/output"
 	"gotest.tools/v3/assert"
-	"gotest.tools/v3/env"
 	"gotest.tools/v3/fs"
 )
 
@@ -45,7 +44,7 @@ echo '{"SchemaVersion":"0.1.0","Vendor":"Docker Inc.","Version":"v0.6.3","ShortD
 }
 
 func TestBuildkitDisabled(t *testing.T) {
-	defer env.Patch(t, "DOCKER_BUILDKIT", "0")()
+	t.Setenv("DOCKER_BUILDKIT", "0")
 
 	dir := fs.NewDir(t, t.Name(),
 		fs.WithFile(pluginFilename, `#!/bin/sh exit 1`, fs.WithMode(0777)),
@@ -102,7 +101,7 @@ func TestBuilderBroken(t *testing.T) {
 }
 
 func TestBuilderBrokenEnforced(t *testing.T) {
-	defer env.Patch(t, "DOCKER_BUILDKIT", "1")()
+	t.Setenv("DOCKER_BUILDKIT", "1")
 
 	dir := fs.NewDir(t, t.Name(),
 		fs.WithFile(pluginFilename, `#!/bin/sh exit 1`, fs.WithMode(0777)),
diff --git a/e2e/image/build_test.go b/e2e/image/build_test.go
index db298e40e7..00e79e5c52 100644
--- a/e2e/image/build_test.go
+++ b/e2e/image/build_test.go
@@ -12,14 +12,13 @@ import (
 	"github.com/docker/cli/internal/test/output"
 	"gotest.tools/v3/assert"
 	is "gotest.tools/v3/assert/cmp"
-	"gotest.tools/v3/env"
 	"gotest.tools/v3/fs"
 	"gotest.tools/v3/icmd"
 	"gotest.tools/v3/skip"
 )
 
 func TestBuildFromContextDirectoryWithTag(t *testing.T) {
-	defer env.Patch(t, "DOCKER_BUILDKIT", "0")()
+	t.Setenv("DOCKER_BUILDKIT", "0")
 
 	dir := fs.NewDir(t, "test-build-context-dir",
 		fs.WithFile("run", "echo running", fs.WithMode(0755)),
@@ -58,7 +57,7 @@ func TestBuildFromContextDirectoryWithTag(t *testing.T) {
 
 func TestTrustedBuild(t *testing.T) {
 	skip.If(t, environment.RemoteDaemon())
-	defer env.Patch(t, "DOCKER_BUILDKIT", "0")()
+	t.Setenv("DOCKER_BUILDKIT", "0")
 
 	dir := fixtures.SetupConfigFile(t)
 	defer dir.Remove()
@@ -93,7 +92,7 @@ func TestTrustedBuild(t *testing.T) {
 
 func TestTrustedBuildUntrustedImage(t *testing.T) {
 	skip.If(t, environment.RemoteDaemon())
-	defer env.Patch(t, "DOCKER_BUILDKIT", "0")()
+	t.Setenv("DOCKER_BUILDKIT", "0")
 
 	dir := fixtures.SetupConfigFile(t)
 	defer dir.Remove()
@@ -120,7 +119,7 @@ func TestTrustedBuildUntrustedImage(t *testing.T) {
 
 func TestBuildIidFileSquash(t *testing.T) {
 	environment.SkipIfNotExperimentalDaemon(t)
-	defer env.Patch(t, "DOCKER_BUILDKIT", "0")()
+	t.Setenv("DOCKER_BUILDKIT", "0")
 
 	dir := fs.NewDir(t, "test-iidfile-squash")
 	defer dir.Remove()
diff --git a/opts/parse_test.go b/opts/parse_test.go
index c6152f815b..f7ab13a299 100644
--- a/opts/parse_test.go
+++ b/opts/parse_test.go
@@ -4,7 +4,6 @@ import (
 	"testing"
 
 	"gotest.tools/v3/assert"
-	"gotest.tools/v3/env"
 	"gotest.tools/v3/fs"
 )
 
@@ -23,7 +22,7 @@ NO_SUCH_ENV
 	defer envFile1.Remove()
 	envFile2 := fs.NewFile(t, t.Name(), fs.WithContent("Z2=z\nA2=a"))
 	defer envFile2.Remove()
-	defer env.Patch(t, "FROM_ENV", "from-env")()
+	t.Setenv("FROM_ENV", "from-env")
 
 	tests := []struct {
 		name      string