diff --git a/cmd/tailscale/cli/ffcomplete/internal/complete_test.go b/cmd/tailscale/cli/ffcomplete/internal/complete_test.go
index 7e36b1bcd..c216bdeec 100644
--- a/cmd/tailscale/cli/ffcomplete/internal/complete_test.go
+++ b/cmd/tailscale/cli/ffcomplete/internal/complete_test.go
@@ -196,7 +196,6 @@ func TestComplete(t *testing.T) {
 
 	// Run the tests.
 	for _, test := range tests {
-		test := test
 		name := strings.Join(test.args, "␣")
 		if test.showFlags {
 			name += "+flags"
diff --git a/net/netcheck/netcheck.go b/net/netcheck/netcheck.go
index 169133ceb..726221675 100644
--- a/net/netcheck/netcheck.go
+++ b/net/netcheck/netcheck.go
@@ -1073,7 +1073,6 @@ func (c *Client) runHTTPOnlyChecks(ctx context.Context, last *Report, rs *report
 			continue
 		}
 		wg.Add(1)
-		rg := rg
 		go func() {
 			defer wg.Done()
 			node := rg.Nodes[0]
diff --git a/tstest/archtest/qemu_test.go b/tstest/archtest/qemu_test.go
index 8b59ae5d9..68ec38851 100644
--- a/tstest/archtest/qemu_test.go
+++ b/tstest/archtest/qemu_test.go
@@ -33,7 +33,6 @@ func TestInQemu(t *testing.T) {
 	}
 	inCI := cibuild.On()
 	for _, arch := range arches {
-		arch := arch
 		t.Run(arch.Goarch, func(t *testing.T) {
 			t.Parallel()
 			qemuUser := "qemu-" + arch.Qarch
diff --git a/tstest/clock_test.go b/tstest/clock_test.go
index d5816564a..2ebaf752a 100644
--- a/tstest/clock_test.go
+++ b/tstest/clock_test.go
@@ -56,7 +56,6 @@ func TestClockWithDefinedStartTime(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 			clock := NewClock(ClockOpts{
@@ -118,7 +117,6 @@ func TestClockWithDefaultStartTime(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 			clock := NewClock(ClockOpts{
@@ -277,7 +275,6 @@ func TestClockSetStep(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 			clock := NewClock(ClockOpts{
@@ -426,7 +423,6 @@ func TestClockAdvance(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 			clock := NewClock(ClockOpts{
@@ -876,7 +872,6 @@ func TestSingleTicker(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 			var realTimeClockForTestClock tstime.Clock
@@ -1377,7 +1372,6 @@ func TestSingleTimer(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 			var realTimeClockForTestClock tstime.Clock
@@ -1911,7 +1905,6 @@ func TestClockFollowRealTime(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 			realTimeClock := NewClock(tt.realTimeClockOpts)
@@ -2364,7 +2357,6 @@ func TestAfterFunc(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 			var realTimeClockForTestClock tstime.Clock
@@ -2468,7 +2460,6 @@ func TestSince(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 			clock := NewClock(ClockOpts{
diff --git a/tstest/integration/integration_test.go b/tstest/integration/integration_test.go
index fde4ff35a..5e9f15798 100644
--- a/tstest/integration/integration_test.go
+++ b/tstest/integration/integration_test.go
@@ -333,7 +333,6 @@ func TestOneNodeUpAuth(t *testing.T) {
 		tstest.Shard(t)
 
 		for _, useSeamlessKeyRenewal := range []bool{true, false} {
-			tt := tt // subtests are run in parallel, rebind tt
 			t.Run(fmt.Sprintf("%s-seamless-%t", tt.name, useSeamlessKeyRenewal), func(t *testing.T) {
 				tstest.Parallel(t)
 
diff --git a/wgengine/magicsock/derp.go b/wgengine/magicsock/derp.go
index b5fc36bb8..0d419841c 100644
--- a/wgengine/magicsock/derp.go
+++ b/wgengine/magicsock/derp.go
@@ -836,7 +836,6 @@ func (c *Conn) maybeCloseDERPsOnRebind(okayLocalIPs []netip.Prefix) {
 			c.closeOrReconnectDERPLocked(regionID, "rebind-default-route-change")
 			continue
 		}
-		regionID := regionID
 		dc := ad.c
 		go func() {
 			ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
diff --git a/wgengine/netstack/netstack.go b/wgengine/netstack/netstack.go
index 7381c515a..94dbb6359 100644
--- a/wgengine/netstack/netstack.go
+++ b/wgengine/netstack/netstack.go
@@ -1898,7 +1898,6 @@ func (ns *Impl) ExpVar() expvar.Var {
 		{"option_unknown_received", ipStats.OptionUnknownReceived},
 	}
 	for _, metric := range ipMetrics {
-		metric := metric
 		m.Set("counter_ip_"+metric.name, expvar.Func(func() any {
 			return readStatCounter(metric.field)
 		}))
@@ -1925,7 +1924,6 @@ func (ns *Impl) ExpVar() expvar.Var {
 		{"errors", fwdStats.Errors},
 	}
 	for _, metric := range fwdMetrics {
-		metric := metric
 		m.Set("counter_ip_forward_"+metric.name, expvar.Func(func() any {
 			return readStatCounter(metric.field)
 		}))
@@ -1969,7 +1967,6 @@ func (ns *Impl) ExpVar() expvar.Var {
 		{"forward_max_in_flight_drop", tcpStats.ForwardMaxInFlightDrop},
 	}
 	for _, metric := range tcpMetrics {
-		metric := metric
 		m.Set("counter_tcp_"+metric.name, expvar.Func(func() any {
 			return readStatCounter(metric.field)
 		}))
@@ -1996,7 +1993,6 @@ func (ns *Impl) ExpVar() expvar.Var {
 		{"checksum_errors", udpStats.ChecksumErrors},
 	}
 	for _, metric := range udpMetrics {
-		metric := metric
 		m.Set("counter_udp_"+metric.name, expvar.Func(func() any {
 			return readStatCounter(metric.field)
 		}))