diff --git a/Cargo.lock b/Cargo.lock
index 88357f7c97..523a46f747 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -95,12 +95,6 @@ dependencies = [
  "libc",
 ]
 
-[[package]]
-name = "anes"
-version = "0.1.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4b46cbb362ab8752921c97e041f5e366ee6297bd428a31275b9fcf1e380f7299"
-
 [[package]]
 name = "ansi_colours"
 version = "1.2.3"
@@ -564,7 +558,7 @@ dependencies = [
  "pin-project-lite",
  "rustls 0.21.12",
  "rustls 0.23.31",
- "rustls-native-certs 0.8.3",
+ "rustls-native-certs",
  "rustls-pki-types",
  "tokio",
  "tokio-rustls 0.26.4",
@@ -1192,7 +1186,7 @@ checksum = "f280f65ce85b880919349bbfcb204930291251eedcb2e5f84ce2f51df969c162"
 dependencies = [
  "git-version",
  "shell-escape",
- "sysinfo 0.33.1",
+ "sysinfo",
 ]
 
 [[package]]
@@ -1281,12 +1275,6 @@ dependencies = [
  "pkg-config",
 ]
 
-[[package]]
-name = "cast"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "37b2a672a2cb129a2e41c10b1224bb368f9f37a2b16b612598138befd7b37eb5"
-
 [[package]]
 name = "cbc"
 version = "0.1.2"
@@ -1359,33 +1347,6 @@ dependencies = [
  "windows-link 0.2.1",
 ]
 
-[[package]]
-name = "ciborium"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "42e69ffd6f0917f5c029256a24d0161db17cea3997d185db0d35926308770f0e"
-dependencies = [
- "ciborium-io",
- "ciborium-ll",
- "serde",
-]
-
-[[package]]
-name = "ciborium-io"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05afea1e0a06c9be33d539b876f1ce3692f4afea2cb41f740e7743225ed1c757"
-
-[[package]]
-name = "ciborium-ll"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "57663b653d948a338bfb3eeba9bb2fd5fcfaecb9e199e87e1eda4d9e8b240fd9"
-dependencies = [
- "ciborium-io",
- "half",
-]
-
 [[package]]
 name = "cipher"
 version = "0.4.4"
@@ -1775,42 +1736,6 @@ dependencies = [
  "cfg-if",
 ]
 
-[[package]]
-name = "criterion"
-version = "0.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2b12d017a929603d80db1831cd3a24082f8137ce19c69e6447f54f5fc8d692f"
-dependencies = [
- "anes",
- "cast",
- "ciborium",
- "clap",
- "criterion-plot",
- "is-terminal",
- "itertools 0.10.5",
- "num-traits",
- "once_cell",
- "oorandom",
- "plotters",
- "rayon",
- "regex",
- "serde",
- "serde_derive",
- "serde_json",
- "tinytemplate",
- "walkdir",
-]
-
-[[package]]
-name = "criterion-plot"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6b50826342786a51a89e2da3a28f1c32b06e387201bc2d19791f622c673706b1"
-dependencies = [
- "cast",
- "itertools 0.10.5",
-]
-
 [[package]]
 name = "croner"
 version = "2.2.0"
@@ -2973,7 +2898,6 @@ dependencies = [
 name = "goose"
 version = "1.21.0"
 dependencies = [
- "agent-client-protocol-schema",
  "ahash",
  "anyhow",
  "async-stream",
@@ -2983,12 +2907,11 @@ dependencies = [
  "aws-sdk-sagemakerruntime",
  "aws-smithy-types",
  "axum 0.8.8",
- "base64 0.21.7",
+ "base64 0.22.1",
  "blake3",
  "boa_engine",
  "chrono",
  "clap",
- "criterion",
  "ctor",
  "dashmap",
  "dirs 5.0.1",
@@ -3032,7 +2955,6 @@ dependencies = [
  "shellexpand",
  "sqlx",
  "sys-info",
- "temp-env",
  "tempfile",
  "test-case",
  "thiserror 1.0.69",
@@ -3076,7 +2998,6 @@ dependencies = [
  "test-case",
  "tokio",
  "tokio-util",
- "tower-http 0.6.8",
  "tracing",
  "url",
  "wiremock",
@@ -3137,15 +3058,12 @@ dependencies = [
  "serde",
  "serde_json",
  "serde_yaml",
- "serial_test",
  "shlex",
  "tar",
- "temp-env",
  "tempfile",
- "test-case",
  "tokio",
  "tokio-util",
- "tower-http 0.5.2",
+ "tower-http",
  "tracing",
  "tracing-appender",
  "tracing-subscriber",
@@ -3160,9 +3078,8 @@ name = "goose-mcp"
 version = "1.21.0"
 dependencies = [
  "anyhow",
- "base64 0.21.7",
+ "base64 0.22.1",
  "chrono",
- "colored",
  "devgen-tree-sitter-swift",
  "docx-rs",
  "etcetera 0.11.0",
@@ -3177,15 +3094,13 @@ dependencies = [
  "once_cell",
  "rayon",
  "regex",
- "reqwest 0.11.27",
+ "reqwest 0.12.28",
  "rmcp 0.13.0",
  "schemars",
  "serde",
  "serde_json",
  "serial_test",
  "shellexpand",
- "sysinfo 0.32.1",
- "temp-env",
  "tempfile",
  "tokio",
  "tokio-stream",
@@ -3203,7 +3118,6 @@ dependencies = [
  "tree-sitter-rust",
  "umya-spreadsheet",
  "url",
- "utoipa",
  "which 8.0.0",
  "xcap",
 ]
@@ -3213,9 +3127,8 @@ name = "goose-server"
 version = "1.21.0"
 dependencies = [
  "anyhow",
- "async-trait",
  "axum 0.8.8",
- "base64 0.21.7",
+ "base64 0.22.1",
  "bytes",
  "chrono",
  "clap",
@@ -3236,14 +3149,13 @@ dependencies = [
  "serde_path_to_error",
  "serde_yaml",
  "socket2 0.6.1",
- "tempfile",
  "thiserror 1.0.69",
  "tokio",
  "tokio-stream",
  "tokio-tungstenite",
  "tokio-util",
  "tower 0.5.2",
- "tower-http 0.5.2",
+ "tower-http",
  "tracing",
  "tracing-appender",
  "tracing-subscriber",
@@ -3584,7 +3496,7 @@ dependencies = [
  "hyper 1.8.1",
  "hyper-util",
  "rustls 0.23.31",
- "rustls-native-certs 0.8.3",
+ "rustls-native-certs",
  "rustls-pki-types",
  "tokio",
  "tokio-rustls 0.26.4",
@@ -3941,17 +3853,6 @@ dependencies = [
  "once_cell",
 ]
 
-[[package]]
-name = "is-terminal"
-version = "0.4.17"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3640c1c38b8e4e43584d8df18be5fc6b0aa314ce6ebf51b53313d4306cca8e46"
-dependencies = [
- "hermit-abi",
- "libc",
- "windows-sys 0.61.2",
-]
-
 [[package]]
 name = "is-wsl"
 version = "0.4.0"
@@ -3968,15 +3869,6 @@ version = "1.70.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a6cb138bb79a146c1bd460005623e142ef0181e3d0219cb493e02f7d08a35695"
 
-[[package]]
-name = "itertools"
-version = "0.10.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b0fd2260e829bddf4cb6ea802289de2f86d6a7a690192fbe91b3f46e0f2c8473"
-dependencies = [
- "either",
-]
-
 [[package]]
 name = "itertools"
 version = "0.12.1"
@@ -5108,12 +5000,6 @@ dependencies = [
  "pkg-config",
 ]
 
-[[package]]
-name = "oorandom"
-version = "11.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d6790f58c7ff633d8771f42965289203411a5e5c68388703c06e14f24770b41e"
-
 [[package]]
 name = "open"
 version = "5.3.3"
@@ -5151,12 +5037,6 @@ dependencies = [
  "syn 2.0.111",
 ]
 
-[[package]]
-name = "openssl-probe"
-version = "0.1.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d05e27ee213611ffe7d6348b942e8f942b37114c00cc03cec254295a4a17852e"
-
 [[package]]
 name = "openssl-probe"
 version = "0.2.0"
@@ -5561,34 +5441,6 @@ dependencies = [
  "time",
 ]
 
-[[package]]
-name = "plotters"
-version = "0.3.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5aeb6f403d7a4911efb1e33402027fc44f29b5bf6def3effcc22d7bb75f2b747"
-dependencies = [
- "num-traits",
- "plotters-backend",
- "plotters-svg",
- "wasm-bindgen",
- "web-sys",
-]
-
-[[package]]
-name = "plotters-backend"
-version = "0.3.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df42e13c12958a16b3f7f4386b9ab1f3e7933914ecea48da7139435263a4172a"
-
-[[package]]
-name = "plotters-svg"
-version = "0.3.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "51bae2ac328883f7acdfea3d66a7c35751187f870bc81f94563733a154d7a670"
-dependencies = [
- "plotters-backend",
-]
-
 [[package]]
 name = "png"
 version = "0.17.16"
@@ -6154,7 +6006,6 @@ dependencies = [
  "percent-encoding",
  "pin-project-lite",
  "rustls 0.21.12",
- "rustls-native-certs 0.6.3",
  "rustls-pemfile",
  "serde",
  "serde_json",
@@ -6201,7 +6052,7 @@ dependencies = [
  "pin-project-lite",
  "quinn",
  "rustls 0.23.31",
- "rustls-native-certs 0.8.3",
+ "rustls-native-certs",
  "rustls-pki-types",
  "serde",
  "serde_json",
@@ -6211,7 +6062,7 @@ dependencies = [
  "tokio-rustls 0.26.4",
  "tokio-util",
  "tower 0.5.2",
- "tower-http 0.6.8",
+ "tower-http",
  "tower-service",
  "url",
  "wasm-bindgen",
@@ -6456,25 +6307,13 @@ dependencies = [
  "zeroize",
 ]
 
-[[package]]
-name = "rustls-native-certs"
-version = "0.6.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a9aace74cb666635c918e9c12bc0d348266037aa8eb599b5cba565709a8dff00"
-dependencies = [
- "openssl-probe 0.1.6",
- "rustls-pemfile",
- "schannel",
- "security-framework 2.11.1",
-]
-
 [[package]]
 name = "rustls-native-certs"
 version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "612460d5f7bea540c490b2b6395d8e34a953e52b491accd6c86c8164c5932a63"
 dependencies = [
- "openssl-probe 0.2.0",
+ "openssl-probe",
  "rustls-pki-types",
  "schannel",
  "security-framework 3.5.1",
@@ -7456,20 +7295,6 @@ dependencies = [
  "libc",
 ]
 
-[[package]]
-name = "sysinfo"
-version = "0.32.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4c33cd241af0f2e9e3b5c32163b873b29956890b5342e6745b917ce9d490f4af"
-dependencies = [
- "core-foundation-sys",
- "libc",
- "memchr",
- "ntapi",
- "rayon",
- "windows 0.57.0",
-]
-
 [[package]]
 name = "sysinfo"
 version = "0.33.1"
@@ -7528,16 +7353,6 @@ dependencies = [
  "xattr",
 ]
 
-[[package]]
-name = "temp-env"
-version = "0.3.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "96374855068f47402c3121c6eed88d29cb1de8f3ab27090e273e420bdabcf050"
-dependencies = [
- "futures",
- "parking_lot",
-]
-
 [[package]]
 name = "tempfile"
 version = "3.24.0"
@@ -7788,16 +7603,6 @@ dependencies = [
  "zerovec",
 ]
 
-[[package]]
-name = "tinytemplate"
-version = "1.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "be4d6b5f19ff7664e8c98d03e2139cb510db9b0a60b55f8e8709b689d939b6bc"
-dependencies = [
- "serde",
- "serde_json",
-]
-
 [[package]]
 name = "tinyvec"
 version = "1.10.0"
@@ -7896,7 +7701,7 @@ dependencies = [
  "futures-util",
  "log",
  "rustls 0.23.31",
- "rustls-native-certs 0.8.3",
+ "rustls-native-certs",
  "rustls-pki-types",
  "tokio",
  "tokio-rustls 0.26.4",
@@ -8069,32 +7874,6 @@ dependencies = [
  "tracing",
 ]
 
-[[package]]
-name = "tower-http"
-version = "0.5.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e9cd434a998747dd2c4276bc96ee2e0c7a2eadf3cae88e52be55a05fa9053f5"
-dependencies = [
- "base64 0.21.7",
- "bitflags 2.10.0",
- "bytes",
- "futures-util",
- "http 1.4.0",
- "http-body 1.0.1",
- "http-body-util",
- "http-range-header",
- "httpdate",
- "mime",
- "mime_guess",
- "percent-encoding",
- "pin-project-lite",
- "tokio",
- "tokio-util",
- "tower-layer",
- "tower-service",
- "tracing",
-]
-
 [[package]]
 name = "tower-http"
 version = "0.6.8"
diff --git a/Cargo.toml b/Cargo.toml
index 146cbcc6d7..d1a7fe2de7 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -30,3 +30,9 @@ crunchy = "0.2.4"
 env-lock = "1.0.1"
 wiremock = "0.6"
 serial_test = "3.2.0"
+test-case = "3.3.1"
+base64 = "0.22.1"
+reqwest = { version = "0.12.28", default-features = false }
+tower = "0.5.2"
+tower-http = "0.6.8"
+url = "2.5.8"
diff --git a/crates/goose-acp/Cargo.toml b/crates/goose-acp/Cargo.toml
index ffa618dc4f..bce7afd945 100644
--- a/crates/goose-acp/Cargo.toml
+++ b/crates/goose-acp/Cargo.toml
@@ -18,17 +18,16 @@ anyhow = { workspace = true }
 tokio = { workspace = true }
 tokio-util = { version = "0.7.15", features = ["compat", "rt"] }
 tracing = { workspace = true }
-url = "2.5"
 serde_json = { workspace = true }
 futures = { workspace = true }
 regex = { workspace = true }
 fs-err = "3"
+url = { workspace = true }
 
 [dev-dependencies]
 assert-json-diff = "2.0.2"
 wiremock = { workspace = true }
 tempfile = "3"
-test-case = "3.3"
+test-case = { workspace = true }
 axum = "0.8"
-tower-http = { version = "0.6", features = ["cors", "fs", "auth"] }
 rmcp = { workspace = true, features = ["transport-streamable-http-server"] }
diff --git a/crates/goose-cli/Cargo.toml b/crates/goose-cli/Cargo.toml
index e7a45c8e77..824225baa6 100644
--- a/crates/goose-cli/Cargo.toml
+++ b/crates/goose-cli/Cargo.toml
@@ -42,12 +42,12 @@ tracing-subscriber = { version = "0.3", features = ["env-filter", "fmt", "json",
 tracing-appender = "0.2"
 shlex = "1.3.0"
 async-trait = "0.1.89"
-base64 = "0.22.1"
+base64 = { workspace = true }
 regex = "1.11.1"
 tar = "0.4"
 # Web server dependencies
 axum = { version = "0.8.1", features = ["ws", "macros"] }
-tower-http = { version = "0.5", features = ["cors", "fs", "auth"] }
+tower-http = { workspace = true, features = ["cors", "fs", "auth"] }
 http = "1.0"
 webbrowser = {workspace = true}
 indicatif = "0.18.1"
@@ -66,7 +66,4 @@ disable-update = []
 
 [dev-dependencies]
 tempfile = "3"
-temp-env = { version = "0.3.6", features = ["async_closure"] }
-test-case = "3.3"
 tokio = { workspace = true }
-serial_test = { workspace = true }
diff --git a/crates/goose-mcp/Cargo.toml b/crates/goose-mcp/Cargo.toml
index b060cd5b22..b1ccb06dac 100644
--- a/crates/goose-mcp/Cargo.toml
+++ b/crates/goose-mcp/Cargo.toml
@@ -18,18 +18,15 @@ tokio-stream = { version = "0.1", features = ["io-util"] }
 tracing = { workspace = true }
 tracing-subscriber = { version = "0.3", features = ["env-filter"] }
 tracing-appender = "0.2"
-url = "2.5"
-base64 = "0.21"
+url = { workspace = true }
+base64 = { workspace = true }
 serde = { version = "1.0", features = ["derive"] }
 serde_json = { workspace = true }
 schemars = "1.0"
 shellexpand = "3.1.0"
 indoc = "2.0.5"
 xcap = "=0.4.0"
-reqwest = { version = "0.11", features = [
-    "json",
-    "rustls-tls-native-roots",
-], default-features = false }
+reqwest = { workspace = true, features = ["json", "rustls-tls-native-roots"], default-features = false }
 chrono = { version = "0.4.38", features = ["serde"] }
 etcetera = { workspace = true }
 tempfile = "3.8"
@@ -41,7 +38,6 @@ lopdf = "0.36.0"
 docx-rs = "0.4.7"
 image = "0.24.9"
 umya-spreadsheet = "2.2.3"
-utoipa = { version = "4.1", optional = true }
 which = {workspace = true}
 lru = "0.16"
 tree-sitter = "0.21"
@@ -62,10 +58,6 @@ mpatch = "=0.2.0"
 tokio-util = "0.7.16"
 
 [dev-dependencies]
-sysinfo = "0.32.1"
-temp-env = "0.3.6"
-colored = "2"
 serial_test = { workspace = true }
 
 [features]
-utoipa = ["dep:utoipa"]
diff --git a/crates/goose-server/Cargo.toml b/crates/goose-server/Cargo.toml
index 7a6142a1bc..6e2073822f 100644
--- a/crates/goose-server/Cargo.toml
+++ b/crates/goose-server/Cargo.toml
@@ -17,7 +17,7 @@ rmcp = { workspace = true }
 axum = { version = "0.8.1", features = ["ws", "macros"] }
 tokio = { workspace = true }
 chrono = "0.4"
-tower-http = { version = "0.5", features = ["cors"] }
+tower-http = { workspace = true, features = ["cors"] }
 serde = { version = "1.0", features = ["derive"] }
 serde_json = { workspace = true, features = ["preserve_order"] }
 futures = { workspace = true }
@@ -28,17 +28,17 @@ tokio-stream = "0.1"
 anyhow = { workspace = true }
 bytes = "1.5"
 http = "1.0"
-base64 = "0.21"
+base64 = { workspace = true }
 config = { version = "0.15.13", features = ["toml"] }
 thiserror = "1.0"
 clap = { version = "4.4", features = ["derive"] }
 serde_yaml = "0.9.34"
 utoipa = { version = "4.1", features = ["axum_extras", "chrono"] }
-reqwest = { version = "0.12.9", features = ["json", "rustls-tls", "blocking", "multipart"], default-features = false }
+reqwest = { workspace = true, features = ["json", "rustls-tls", "blocking", "multipart"], default-features = false }
 tokio-util = "0.7.15"
 serde_path_to_error = "0.1.20"
 tokio-tungstenite = { version = "0.28.0", features = ["rustls-tls-native-roots"] }
-url = "2.5.7"
+url = { workspace = true }
 rand = "0.9.2"
 hex = "0.4.3"
 socket2 = "0.6.1"
@@ -58,8 +58,6 @@ name = "generate_schema"
 path = "src/bin/generate_schema.rs"
 
 [dev-dependencies]
-tower = "0.5"
-async-trait = "0.1.89"
-tempfile = "3.15.0"
+tower = { workspace = true }
 env-lock = { workspace = true }
 wiremock = { workspace = true }
diff --git a/crates/goose/Cargo.toml b/crates/goose/Cargo.toml
index e76a8fe154..3aadb82adb 100644
--- a/crates/goose/Cargo.toml
+++ b/crates/goose/Cargo.toml
@@ -12,7 +12,7 @@ workspace = true
 
 [build-dependencies]
 tokio = { workspace = true }
-reqwest = { version = "0.12.9", features = ["json", "rustls-tls-native-roots"], default-features = false }
+reqwest = { workspace = true, features = ["json", "rustls-tls-native-roots"], default-features = false }
 
 [dependencies]
 lru = "0.16"
@@ -27,19 +27,7 @@ anyhow = { workspace = true }
 thiserror = "1.0"
 futures = { workspace = true }
 dirs = "5.0"
-reqwest = { version = "0.12.9", features = [
-    "rustls-tls-native-roots",
-    "json",
-    "cookies",
-    "gzip",
-    "brotli",
-    "deflate",
-    "zstd",
-    "charset",
-    "http2",
-    "stream",
-    "blocking"
-], default-features = false }
+reqwest = { workspace = true, features = ["rustls-tls-native-roots", "json", "cookies", "gzip", "brotli", "deflate", "zstd", "charset", "http2", "stream", "blocking"], default-features = false }
 tokio = { workspace = true }
 serde = { version = "1.0", features = ["derive"] }
 serde_json = { workspace = true }
@@ -57,8 +45,8 @@ clap = { version = "4.4", features = ["derive"] }
 indoc = "2.0.5"
 nanoid = "0.4"
 sha2 = "0.10"
-base64 = "0.21"
-url = "2.5"
+base64 = { workspace = true }
+url = { workspace = true }
 axum = "0.8.1"
 webbrowser = {workspace = true}
 lazy_static = "1.5.0"
@@ -118,17 +106,14 @@ unbinder = "0.1.7"
 winapi = { version = "0.3", features = ["wincred"] }
 
 [dev-dependencies]
-agent-client-protocol-schema = "0.10.5"
-criterion = "0.5"
 serial_test = { workspace = true }
 mockall = "0.13.1"
 wiremock = { workspace = true }
 tokio = { workspace = true }
 tokio-util = { version = "0.7.15", features = ["compat"] }
-temp-env = "0.3.6"
 dotenvy = "0.15.7"
 ctor = "0.2.9"
-test-case = "3.3"
+test-case = { workspace = true }
 env-lock = { workspace = true }
 rmcp = { workspace = true, features = ["transport-streamable-http-server"] }
 
diff --git a/crates/goose/src/config/base.rs b/crates/goose/src/config/base.rs
index f35fbef1d4..a769d2ab95 100644
--- a/crates/goose/src/config/base.rs
+++ b/crates/goose/src/config/base.rs
@@ -1630,55 +1630,46 @@ mod tests {
 
     #[test]
     fn get_secrets_primary_from_env_uses_env_for_secondary() {
-        temp_env::with_vars(
-            [
-                ("TEST_PRIMARY", Some("primary_env")),
-                ("TEST_SECONDARY", Some("secondary_env")),
-            ],
-            || {
-                let config = new_test_config();
-                let secrets = config
-                    .get_secrets("TEST_PRIMARY", &["TEST_SECONDARY"])
-                    .unwrap();
+        let _guard = env_lock::lock_env([
+            ("TEST_PRIMARY", Some("primary_env")),
+            ("TEST_SECONDARY", Some("secondary_env")),
+        ]);
+        let config = new_test_config();
+        let secrets = config
+            .get_secrets("TEST_PRIMARY", &["TEST_SECONDARY"])
+            .unwrap();
 
-                assert_eq!(secrets["TEST_PRIMARY"], "primary_env");
-                assert_eq!(secrets["TEST_SECONDARY"], "secondary_env");
-            },
-        );
+        assert_eq!(secrets["TEST_PRIMARY"], "primary_env");
+        assert_eq!(secrets["TEST_SECONDARY"], "secondary_env");
     }
 
     #[test]
     fn get_secrets_primary_from_secret_uses_secret_for_secondary() {
-        temp_env::with_vars(
-            [("TEST_PRIMARY", None::<&str>), ("TEST_SECONDARY", None)],
-            || {
-                let config = new_test_config();
-                config
-                    .set_secret("TEST_PRIMARY", &"primary_secret")
-                    .unwrap();
-                config
-                    .set_secret("TEST_SECONDARY", &"secondary_secret")
-                    .unwrap();
+        let _guard = env_lock::lock_env([("TEST_PRIMARY", None::<&str>), ("TEST_SECONDARY", None)]);
+        let config = new_test_config();
+        config
+            .set_secret("TEST_PRIMARY", &"primary_secret")
+            .unwrap();
+        config
+            .set_secret("TEST_SECONDARY", &"secondary_secret")
+            .unwrap();
 
-                let secrets = config
-                    .get_secrets("TEST_PRIMARY", &["TEST_SECONDARY"])
-                    .unwrap();
+        let secrets = config
+            .get_secrets("TEST_PRIMARY", &["TEST_SECONDARY"])
+            .unwrap();
 
-                assert_eq!(secrets["TEST_PRIMARY"], "primary_secret");
-                assert_eq!(secrets["TEST_SECONDARY"], "secondary_secret");
-            },
-        );
+        assert_eq!(secrets["TEST_PRIMARY"], "primary_secret");
+        assert_eq!(secrets["TEST_SECONDARY"], "secondary_secret");
     }
 
     #[test]
     fn get_secrets_primary_missing_returns_error() {
-        temp_env::with_vars([("TEST_PRIMARY", None::<&str>)], || {
-            let config = new_test_config();
+        let _guard = env_lock::lock_env([("TEST_PRIMARY", None::<&str>)]);
+        let config = new_test_config();
 
-            let result = config.get_secrets("TEST_PRIMARY", &[]);
+        let result = config.get_secrets("TEST_PRIMARY", &[]);
 
-            assert!(matches!(result, Err(ConfigError::NotFound(_))));
-        });
+        assert!(matches!(result, Err(ConfigError::NotFound(_))));
     }
 
     fn new_test_config() -> Config {