diff --git a/cmd/cosign/cli/trustedroot/trustedroot_test.go b/cmd/cosign/cli/trustedroot/trustedroot_test.go
index 3b2f4878af6..b5e56f9225e 100644
--- a/cmd/cosign/cli/trustedroot/trustedroot_test.go
+++ b/cmd/cosign/cli/trustedroot/trustedroot_test.go
@@ -79,6 +79,8 @@ func makeChain(t *testing.T, path string, size int) {
 	fd, err := os.Create(path)
 	checkErr(t, err)
 
+	defer fd.Close()
+
 	chainCert := &x509.Certificate{
 		SerialNumber:          big.NewInt(1),
 		BasicConstraintsValid: true,