diff --git a/api/core/v1/pod_webhook_test.go b/api/core/v1/pod_webhook_test.go
index 7509487c..de1f601b 100644
--- a/api/core/v1/pod_webhook_test.go
+++ b/api/core/v1/pod_webhook_test.go
@@ -35,8 +35,8 @@ var podStub = corev1.Pod{
 func TestRewriteImages(t *testing.T) {
 	podStub := *podStub.DeepCopy()
 
-	g := NewWithT(t)
 	t.Run("Rewrite image", func(t *testing.T) {
+		g := NewWithT(t)
 		ir := ImageRewriter{
 			ProxyPort: 4242,
 		}
@@ -78,8 +78,8 @@ func TestRewriteImages(t *testing.T) {
 func TestRewriteImagesWithIgnore(t *testing.T) {
 	podStub := *podStub.DeepCopy()
 
-	g := NewWithT(t)
 	t.Run("Rewrite image", func(t *testing.T) {
+		g := NewWithT(t)
 		ir := ImageRewriter{
 			ProxyPort: 4242,
 			IgnoreImages: []*regexp.Regexp{
@@ -118,8 +118,8 @@ func TestRewriteImagesWithIgnore(t *testing.T) {
 func TestRewriteImagesWithAccept(t *testing.T) {
 	podStub := *podStub.DeepCopy()
 
-	g := NewWithT(t)
 	t.Run("Rewrite image", func(t *testing.T) {
+		g := NewWithT(t)
 		ir := ImageRewriter{
 			ProxyPort: 4242,
 			AcceptImages: []*regexp.Regexp{
@@ -233,9 +233,9 @@ func Test_isImageRewritable(t *testing.T) {
 		},
 	}
 
-	g := NewWithT(t)
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			g := NewWithT(t)
 			imageRewriter := ImageRewriter{
 				IgnoreImages:           tt.regexps,
 				IgnorePullPolicyAlways: tt.ignorePullPolicyAlways,
diff --git a/api/kuik/v1alpha1/cachedimage_webhook_test.go b/api/kuik/v1alpha1/cachedimage_webhook_test.go
index dc061f72..52ddbb28 100644
--- a/api/kuik/v1alpha1/cachedimage_webhook_test.go
+++ b/api/kuik/v1alpha1/cachedimage_webhook_test.go
@@ -11,7 +11,6 @@ import (
 func TestDefault(t *testing.T) {
 	cachedImageStub := CachedImage{}
 
-	g := NewWithT(t)
 	tests := []struct {
 		name                    string
 		sourceImage             string
@@ -37,6 +36,7 @@ func TestDefault(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			g := NewWithT(t)
 			cachedImage := cachedImageStub.DeepCopy()
 			cachedImage.Spec.SourceImage = tt.sourceImage
 
diff --git a/internal/controller/core/pod_controller_test.go b/internal/controller/core/pod_controller_test.go
index 54216cf1..e103b6bd 100644
--- a/internal/controller/core/pod_controller_test.go
+++ b/internal/controller/core/pod_controller_test.go
@@ -76,9 +76,9 @@ func TestDesiredCachedImages(t *testing.T) {
 		},
 	}
 
-	g := NewWithT(t)
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			g := NewWithT(t)
 			cachedImages := DesiredCachedImages(context.Background(), &tt.pod)
 			g.Expect(cachedImages).To(HaveLen(len(tt.cachedImages)))
 			for i, cachedImage := range cachedImages {
@@ -115,9 +115,9 @@ func Test_cachedImageFromSourceImage(t *testing.T) {
 		},
 	}
 
-	g := NewWithT(t)
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			g := NewWithT(t)
 			cachedImage, err := cachedImageFromSourceImage(tt.sourceImage)
 			g.Expect(err).ToNot(HaveOccurred())
 
diff --git a/internal/proxy/bearer_test.go b/internal/proxy/bearer_test.go
index 2b5bfae8..d07f5b12 100644
--- a/internal/proxy/bearer_test.go
+++ b/internal/proxy/bearer_test.go
@@ -35,9 +35,9 @@ func Test_parseWwwAuthenticate(t *testing.T) {
 		},
 	}
 
-	g := NewWithT(t)
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			g := NewWithT(t)
 			wwwAuthenticateHeader := fmt.Sprintf("Bearer realm=\"%s\",service=\"%s\",scope=\"%s\"", tt.realm, tt.service, tt.scope)
 			wwwAuthenticate := parseWwwAuthenticate(wwwAuthenticateHeader)
 			g.Expect(wwwAuthenticate).To(Not(BeNil()))
@@ -93,9 +93,9 @@ func TestNewBearer(t *testing.T) {
 		},
 	}
 
-	g := NewWithT(t)
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			g := NewWithT(t)
 			gh := ghttp.NewGHTTPWithGomega(g)
 			server := ghttp.NewServer()
 			defer server.Close()
@@ -167,6 +167,7 @@ func TestNewBearer(t *testing.T) {
 	}
 
 	t.Run("Fail on first request", func(t *testing.T) {
+		g := NewWithT(t)
 		_, err := NewBearer("http://localhost:100000", "/")
 		g.Expect(err).To(HaveOccurred())
 		g.Expect(err.Error()).To(ContainSubstring("invalid port"))
@@ -174,19 +175,21 @@ func TestNewBearer(t *testing.T) {
 }
 
 func TestGetToken(t *testing.T) {
-	g := NewWithT(t)
 	bearer := &Bearer{AccessToken: "my-access-token"}
 
 	t.Run("Token set", func(t *testing.T) {
+		g := NewWithT(t)
 		g.Expect(bearer.GetToken()).To(Equal(bearer.AccessToken))
 	})
 
 	t.Run("Token and AccessToken set", func(t *testing.T) {
+		g := NewWithT(t)
 		bearer.Token = "my-token"
 		g.Expect(bearer.GetToken()).To(Equal(bearer.Token))
 	})
 
 	t.Run("AccessToken set", func(t *testing.T) {
+		g := NewWithT(t)
 		bearer.AccessToken = ""
 		g.Expect(bearer.GetToken()).To(Equal(bearer.Token))
 	})
diff --git a/internal/proxy/server_test.go b/internal/proxy/server_test.go
index 3478c8b4..dd20f6b6 100644
--- a/internal/proxy/server_test.go
+++ b/internal/proxy/server_test.go
@@ -89,9 +89,9 @@ func Test_handleOriginRegistryPort(t *testing.T) {
 		},
 	}
 
-	g := NewWithT(t)
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			g := NewWithT(t)
 			originRegistry := handleOriginRegistryPort(tt.originRegistry)
 			g.Expect(originRegistry).To(Equal(tt.expectedOutput))
 		})
diff --git a/internal/registry/keychain_test.go b/internal/registry/keychain_test.go
index 6d4d6dc8..beb04830 100644
--- a/internal/registry/keychain_test.go
+++ b/internal/registry/keychain_test.go
@@ -234,9 +234,9 @@ func TestGetKeychains(t *testing.T) {
 		},
 	}
 
-	g := NewWithT(t)
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			g := NewWithT(t)
 			if tt.repositoryName == "" {
 				tt.repositoryName = "alpine"
 			}
@@ -254,12 +254,14 @@ func TestGetKeychains(t *testing.T) {
 	}
 
 	t.Run("Not from Amazon ECR", func(t *testing.T) {
+		g := NewWithT(t)
 		keychains, err := GetKeychains("alpine", []corev1.Secret{})
 		g.Expect(err).To(BeNil())
 		g.Expect(keychains).ToNot(ContainElement(authn.NewKeychainFromHelper(ecrLogin.NewECRHelper())))
 	})
 
 	t.Run("From Amazon ECR", func(t *testing.T) {
+		g := NewWithT(t)
 		keychains, err := GetKeychains("000000000000.dkr.ecr.eu-west-1.amazonaws.com/some-image", []corev1.Secret{})
 		g.Expect(err).To(BeNil())
 		g.Expect(keychains).To(ContainElement(authn.NewKeychainFromHelper(ecrLogin.NewECRHelper())))
@@ -308,9 +310,9 @@ func TestGetPullSecrets(t *testing.T) {
 		},
 	}
 
-	g := NewWithT(t)
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			g := NewWithT(t)
 			namespace := make([]byte, 10)
 			rand.Read(namespace)
 
diff --git a/internal/registry/registry_test.go b/internal/registry/registry_test.go
index a7635388..af135502 100644
--- a/internal/registry/registry_test.go
+++ b/internal/registry/registry_test.go
@@ -72,9 +72,9 @@ func Test_parseLocalReference(t *testing.T) {
 		},
 	}
 
-	g := NewWithT(t)
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			g := NewWithT(t)
 			reference, err := parseLocalReference(tt.image)
 
 			if tt.wantErr != "" {
@@ -122,9 +122,9 @@ func Test_ImageIsCached(t *testing.T) {
 		},
 	}
 
-	g := NewWithT(t)
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			g := NewWithT(t)
 			gh := ghttp.NewGHTTPWithGomega(g)
 			server := ghttp.NewServer()
 			defer server.Close()
@@ -193,9 +193,9 @@ func Test_DeleteImage(t *testing.T) {
 		},
 	}
 
-	g := NewWithT(t)
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			g := NewWithT(t)
 			gh := ghttp.NewGHTTPWithGomega(g)
 			server := ghttp.NewServer()
 			defer server.Close()
@@ -250,9 +250,9 @@ func Test_CacheImage(t *testing.T) {
 		},
 	}
 
-	g := NewWithT(t)
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			g := NewWithT(t)
 			gh := ghttp.NewGHTTPWithGomega(g)
 
 			digestSha := "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
@@ -369,9 +369,9 @@ func TestSanitizeName(t *testing.T) {
 		},
 	}
 
-	g := NewWithT(t)
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			g := NewWithT(t)
 			label := SanitizeName(tt.image)
 			g.Expect(label).To(Equal(tt.expectedSanitizedImage))
 		})
@@ -406,9 +406,9 @@ func TestRepositoryLabel(t *testing.T) {
 		},
 	}
 
-	g := NewWithT(t)
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			g := NewWithT(t)
 			label := RepositoryLabel(tt.repositoryName)
 			g.Expect(label).To(Equal(tt.expectedLabel))
 		})
@@ -462,9 +462,9 @@ func TestContainerAnnotationKey(t *testing.T) {
 		},
 	}
 
-	g := NewWithT(t)
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			g := NewWithT(t)
 			annotationKey := ContainerAnnotationKey(tt.containerName, tt.initContainer)
 			g.Expect(annotationKey).To(Equal(tt.expectedAnnotationKey))
 		})