diff --git a/README.md b/README.md
index 4879ad2f82..9097465150 100644
--- a/README.md
+++ b/README.md
@@ -201,7 +201,6 @@ func Test_Something_With_Docker(t *testing.T) {
     ImageTag:    "latest",
   }
   cluster := docker.NewTestDockerCluster(t, opts)
-  defer cluster.Cleanup()
   
   client := cluster.Nodes()[0].APIClient()
   _, err := client.Logical().Read("sys/storage/raft/configuration")
@@ -226,7 +225,6 @@ func Test_Something_With_Docker(t *testing.T) {
 	VaultLicense: licenseString, // not a path, the actual license bytes
   }
   cluster := docker.NewTestDockerCluster(t, opts)
-  defer cluster.Cleanup()
 }
 ```
 
@@ -245,7 +243,6 @@ build as a debugging convenience.
 func Test_Custom_Build_With_Docker(t *testing.T) {
   opts := docker.DefaultOptions(t)
   cluster := docker.NewTestDockerCluster(t, opts)
-  defer cluster.Cleanup()
 }
 ```
 
diff --git a/builtin/credential/aws/backend_e2e_test.go b/builtin/credential/aws/backend_e2e_test.go
index fa1902b771..67a1e774ad 100644
--- a/builtin/credential/aws/backend_e2e_test.go
+++ b/builtin/credential/aws/backend_e2e_test.go
@@ -20,7 +20,6 @@ func TestBackend_E2E_Initialize(t *testing.T) {
 	// Set up the cluster.  This will trigger an Initialize(); we sleep briefly
 	// awaiting its completion.
 	cluster := setupAwsTestCluster(t, ctx)
-	defer cluster.Cleanup()
 	time.Sleep(time.Second)
 	core := cluster.Cores[0]
 
@@ -112,12 +111,10 @@ func setupAwsTestCluster(t *testing.T, _ context.Context) *vault.TestCluster {
 		HandlerFunc: vaulthttp.Handler,
 	})
 
-	cluster.Start()
 	if len(cluster.Cores) != 1 {
 		t.Fatalf("expected exactly one core")
 	}
 	core := cluster.Cores[0]
-	vault.TestWaitActive(t, core.Core)
 
 	// load the auth plugin
 	if err := core.Client.Sys().EnableAuthWithOptions("aws", &api.EnableAuthOptions{
diff --git a/builtin/credential/cert/backend_test.go b/builtin/credential/cert/backend_test.go
index 6a20a84f1b..44970788b4 100644
--- a/builtin/credential/cert/backend_test.go
+++ b/builtin/credential/cert/backend_test.go
@@ -272,10 +272,7 @@ func TestBackend_PermittedDNSDomainsIntermediateCA(t *testing.T) {
 	cluster := vault.NewTestCluster(t, coreConfig, &vault.TestClusterOptions{
 		HandlerFunc: vaulthttp.Handler,
 	})
-	cluster.Start()
-	defer cluster.Cleanup()
 	cores := cluster.Cores
-	vault.TestWaitActive(t, cores[0].Core)
 	client := cores[0].Client
 
 	var err error
@@ -588,10 +585,7 @@ func TestBackend_MetadataBasedACLPolicy(t *testing.T) {
 	cluster := vault.NewTestCluster(t, coreConfig, &vault.TestClusterOptions{
 		HandlerFunc: vaulthttp.Handler,
 	})
-	cluster.Start()
-	defer cluster.Cleanup()
 	cores := cluster.Cores
-	vault.TestWaitActive(t, cores[0].Core)
 	client := cores[0].Client
 
 	// Enable the cert auth method
diff --git a/builtin/logical/aws/rotation_test.go b/builtin/logical/aws/rotation_test.go
index 71989b9cd9..d3e8ed9ea8 100644
--- a/builtin/logical/aws/rotation_test.go
+++ b/builtin/logical/aws/rotation_test.go
@@ -544,11 +544,7 @@ func Test_RotationQueueInitialized(t *testing.T) {
 		HandlerFunc: vaulthttp.Handler,
 		NumCores:    2,
 	})
-	cluster.Start()
-	defer cluster.Cleanup()
-
 	cores := cluster.Cores
-	vault.TestWaitActive(t, cores[0].Core)
 	client := cores[0].Client
 	err := client.Sys().Mount("aws", &api.MountInput{
 		Type: "aws",
diff --git a/builtin/logical/database/backend_ce_test.go b/builtin/logical/database/backend_ce_test.go
index b99e34bd7e..c006184a08 100644
--- a/builtin/logical/database/backend_ce_test.go
+++ b/builtin/logical/database/backend_ce_test.go
@@ -28,9 +28,7 @@ func TestBackend_config_connection(t *testing.T) {
 	var resp *logical.Response
 	var err error
 
-	cluster, sys := getClusterPostgresDB(t)
-	defer cluster.Cleanup()
-
+	_, sys := getClusterPostgresDB(t)
 	config := logical.TestBackendConfig()
 	config.StorageView = &logical.InmemStorage{}
 	config.System = sys
@@ -254,7 +252,6 @@ func TestBackend_connectionCrud(t *testing.T) {
 	t.Parallel()
 	dbFactory := &singletonDBFactory{}
 	cluster, sys := getClusterPostgresDBWithFactory(t, dbFactory.factory)
-	defer cluster.Cleanup()
 
 	dbFactory.sys = sys
 	client := cluster.Cores[0].Client.Logical()
diff --git a/builtin/logical/database/backend_test.go b/builtin/logical/database/backend_test.go
index 8b0bffd873..8c063b7274 100644
--- a/builtin/logical/database/backend_test.go
+++ b/builtin/logical/database/backend_test.go
@@ -69,7 +69,6 @@ func getClusterWithFactory(t *testing.T, factory logical.Factory) (*vault.TestCl
 	cluster := vault.NewTestCluster(t, coreConfig, &vault.TestClusterOptions{
 		HandlerFunc: vaulthttp.Handler,
 	})
-	cluster.Start()
 	cores := cluster.Cores
 	vault.TestWaitActive(t, cores[0].Core)
 
@@ -157,8 +156,7 @@ func TestBackend_RoleUpgrade(t *testing.T) {
 // TestBackend_BadConnectionString tests that an error response resulting from
 // a failed connection does not expose the URL. The middleware should sanitize it.
 func TestBackend_BadConnectionString(t *testing.T) {
-	cluster, sys := getClusterPostgresDB(t)
-	defer cluster.Cleanup()
+	_, sys := getClusterPostgresDB(t)
 
 	config := logical.TestBackendConfig()
 	config.StorageView = &logical.InmemStorage{}
@@ -206,8 +204,7 @@ func TestBackend_BadConnectionString(t *testing.T) {
 }
 
 func TestBackend_basic(t *testing.T) {
-	cluster, sys := getClusterPostgresDB(t)
-	defer cluster.Cleanup()
+	_, sys := getClusterPostgresDB(t)
 
 	config := logical.TestBackendConfig()
 	config.StorageView = &logical.InmemStorage{}
@@ -472,7 +469,6 @@ func TestBackend_connectionSanitizePrivateKey(t *testing.T) {
 	t.Parallel()
 	dbFactory := &singletonDBFactory{}
 	cluster, sys := getClusterPostgresDBWithFactory(t, dbFactory.factory)
-	defer cluster.Cleanup()
 
 	dbFactory.sys = sys
 	client := cluster.Cores[0].Client.Logical()
@@ -520,8 +516,7 @@ func TestBackend_connectionSanitizePrivateKey(t *testing.T) {
 }
 
 func TestBackend_roleCrud(t *testing.T) {
-	cluster, sys := getClusterPostgresDB(t)
-	defer cluster.Cleanup()
+	_, sys := getClusterPostgresDB(t)
 
 	config := logical.TestBackendConfig()
 	config.StorageView = &logical.InmemStorage{}
@@ -773,8 +768,7 @@ func TestBackend_roleCrud(t *testing.T) {
 }
 
 func TestBackend_allowedRoles(t *testing.T) {
-	cluster, sys := getClusterPostgresDB(t)
-	defer cluster.Cleanup()
+	_, sys := getClusterPostgresDB(t)
 
 	config := logical.TestBackendConfig()
 	config.StorageView = &logical.InmemStorage{}
@@ -784,7 +778,6 @@ func TestBackend_allowedRoles(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	defer b.Cleanup(context.Background())
 
 	cleanup, connURL := postgreshelper.PrepareTestContainer(t)
 	defer cleanup()
@@ -970,8 +963,7 @@ func TestBackend_allowedRoles(t *testing.T) {
 }
 
 func TestBackend_RotateRootCredentials(t *testing.T) {
-	cluster, sys := getClusterPostgresDB(t)
-	defer cluster.Cleanup()
+	_, sys := getClusterPostgresDB(t)
 
 	config := logical.TestBackendConfig()
 	config.StorageView = &logical.InmemStorage{}
@@ -1071,8 +1063,7 @@ func TestBackend_RotateRootCredentials(t *testing.T) {
 }
 
 func TestBackend_ConnectionURL_redacted(t *testing.T) {
-	cluster, sys := getClusterPostgresDB(t)
-	t.Cleanup(cluster.Cleanup)
+	_, sys := getClusterPostgresDB(t)
 
 	config := logical.TestBackendConfig()
 	config.StorageView = &logical.InmemStorage{}
@@ -1185,7 +1176,6 @@ func TestBackend_ConnectionURL_redacted(t *testing.T) {
 // for each plugin type.
 func TestBackend_GetConnectionMetrics(t *testing.T) {
 	cluster, sys := getCluster(t)
-	defer cluster.Cleanup()
 
 	vault.TestAddTestPlugin(t, cluster.Cores[0].Core, "cassandra-database-plugin", consts.PluginTypeDatabase, "", "TestBackend_PluginMain_CassandraMultiplexed",
 		[]string{fmt.Sprintf("%s=%s", pluginutil.PluginCACertPEMEnv, cluster.CACertPEMFile)})
@@ -1350,7 +1340,6 @@ func TestBackend_AsyncClose(t *testing.T) {
 	// longer than 750ms.
 	cluster, sys := getCluster(t)
 	vault.TestAddTestPlugin(t, cluster.Cores[0].Core, "hanging-plugin", consts.PluginTypeDatabase, "", "TestBackend_PluginMain_Hanging", []string{})
-	t.Cleanup(cluster.Cleanup)
 
 	config := logical.TestBackendConfig()
 	config.StorageView = &logical.InmemStorage{}
@@ -1393,8 +1382,8 @@ func TestBackend_AsyncClose(t *testing.T) {
 }
 
 func TestNewDatabaseWrapper_IgnoresBuiltinVersion(t *testing.T) {
-	cluster, sys := getCluster(t)
-	t.Cleanup(cluster.Cleanup)
+	_, sys := getCluster(t)
+
 	_, err := newDatabaseWrapper(context.Background(), "hana-database-plugin", "v1.0.0+builtin", sys, hclog.Default())
 	if err != nil {
 		t.Fatal(err)
diff --git a/builtin/logical/database/dbplugin/plugin_test.go b/builtin/logical/database/dbplugin/plugin_test.go
index f34cfc6edd..83cf149f9e 100644
--- a/builtin/logical/database/dbplugin/plugin_test.go
+++ b/builtin/logical/database/dbplugin/plugin_test.go
@@ -114,7 +114,6 @@ func getCluster(t *testing.T) (*vault.TestCluster, logical.SystemView) {
 	}, &vault.TestClusterOptions{
 		HandlerFunc: vaulthttp.Handler,
 	})
-	cluster.Start()
 	cores := cluster.Cores
 
 	sys := vault.TestDynamicSystemView(cores[0].Core, nil)
@@ -144,8 +143,7 @@ func TestPlugin_GRPC_Main(t *testing.T) {
 }
 
 func TestPlugin_Init(t *testing.T) {
-	cluster, sys := getCluster(t)
-	defer cluster.Cleanup()
+	_, sys := getCluster(t)
 
 	dbRaw, err := dbplugin.PluginFactoryVersion(namespace.RootContext(nil), "test-plugin", "", sys, log.NewNullLogger())
 	if err != nil {
@@ -168,8 +166,7 @@ func TestPlugin_Init(t *testing.T) {
 }
 
 func TestPlugin_CreateUser(t *testing.T) {
-	cluster, sys := getCluster(t)
-	defer cluster.Cleanup()
+	_, sys := getCluster(t)
 
 	db, err := dbplugin.PluginFactoryVersion(namespace.RootContext(nil), "test-plugin", "", sys, log.NewNullLogger())
 	if err != nil {
@@ -208,8 +205,7 @@ func TestPlugin_CreateUser(t *testing.T) {
 }
 
 func TestPlugin_RenewUser(t *testing.T) {
-	cluster, sys := getCluster(t)
-	defer cluster.Cleanup()
+	_, sys := getCluster(t)
 
 	db, err := dbplugin.PluginFactoryVersion(namespace.RootContext(nil), "test-plugin", "", sys, log.NewNullLogger())
 	if err != nil {
@@ -242,8 +238,7 @@ func TestPlugin_RenewUser(t *testing.T) {
 }
 
 func TestPlugin_RevokeUser(t *testing.T) {
-	cluster, sys := getCluster(t)
-	defer cluster.Cleanup()
+	_, sys := getCluster(t)
 
 	db, err := dbplugin.PluginFactoryVersion(namespace.RootContext(nil), "test-plugin", "", sys, log.NewNullLogger())
 	if err != nil {
diff --git a/builtin/logical/database/path_config_connection_test.go b/builtin/logical/database/path_config_connection_test.go
index 83a2c79bbb..07dd573bdb 100644
--- a/builtin/logical/database/path_config_connection_test.go
+++ b/builtin/logical/database/path_config_connection_test.go
@@ -15,8 +15,7 @@ import (
 )
 
 func TestWriteConfig_PluginVersionInStorage(t *testing.T) {
-	cluster, sys := getCluster(t)
-	t.Cleanup(cluster.Cleanup)
+	_, sys := getCluster(t)
 
 	config := logical.TestBackendConfig()
 	config.StorageView = &logical.InmemStorage{}
@@ -127,8 +126,7 @@ func TestWriteConfig_PluginVersionInStorage(t *testing.T) {
 }
 
 func TestWriteConfig_HelpfulErrorMessageWhenBuiltinOverridden(t *testing.T) {
-	cluster, sys := getClusterPostgresDB(t)
-	t.Cleanup(cluster.Cleanup)
+	_, sys := getClusterPostgresDB(t)
 
 	config := logical.TestBackendConfig()
 	config.StorageView = &logical.InmemStorage{}
diff --git a/builtin/logical/database/path_roles_test.go b/builtin/logical/database/path_roles_test.go
index 85cd4cd176..373a516d10 100644
--- a/builtin/logical/database/path_roles_test.go
+++ b/builtin/logical/database/path_roles_test.go
@@ -207,8 +207,7 @@ func TestBackend_Roles_CredentialTypes(t *testing.T) {
 }
 
 func TestBackend_StaticRole_Config(t *testing.T) {
-	cluster, sys := getClusterPostgresDB(t)
-	defer cluster.Cleanup()
+	_, sys := getClusterPostgresDB(t)
 
 	config := logical.TestBackendConfig()
 	config.StorageView = &logical.InmemStorage{}
@@ -472,8 +471,7 @@ func TestBackend_StaticRole_Config(t *testing.T) {
 }
 
 func TestBackend_StaticRole_ReadCreds(t *testing.T) {
-	cluster, sys := getClusterPostgresDB(t)
-	defer cluster.Cleanup()
+	_, sys := getClusterPostgresDB(t)
 
 	config := logical.TestBackendConfig()
 	config.StorageView = &logical.InmemStorage{}
@@ -652,8 +650,7 @@ func TestBackend_StaticRole_ReadCreds(t *testing.T) {
 }
 
 func TestBackend_StaticRole_Updates(t *testing.T) {
-	cluster, sys := getClusterPostgresDB(t)
-	defer cluster.Cleanup()
+	_, sys := getClusterPostgresDB(t)
 
 	config := logical.TestBackendConfig()
 	config.StorageView = &logical.InmemStorage{}
@@ -951,8 +948,7 @@ func TestBackend_StaticRole_Updates_RotationSchedule(t *testing.T) {
 }
 
 func TestBackend_StaticRole_Role_name_check(t *testing.T) {
-	cluster, sys := getClusterPostgresDB(t)
-	defer cluster.Cleanup()
+	_, sys := getClusterPostgresDB(t)
 
 	config := logical.TestBackendConfig()
 	config.StorageView = &logical.InmemStorage{}
diff --git a/builtin/logical/database/path_rotate_credentials_test.go b/builtin/logical/database/path_rotate_credentials_test.go
index 14570224fd..274508e228 100644
--- a/builtin/logical/database/path_rotate_credentials_test.go
+++ b/builtin/logical/database/path_rotate_credentials_test.go
@@ -19,8 +19,7 @@ func TestRotateRootPassword_Postgres(t *testing.T) {
 	cleanup, connURL := postgreshelper.PrepareTestContainer(t)
 	defer cleanup()
 
-	cluster, sys := getClusterWithFactory(t, Factory)
-	defer cluster.Cleanup()
+	_, sys := getClusterWithFactory(t, Factory)
 
 	connURL = strings.Replace(connURL, "postgres:secret", "{{username}}:{{password}}", 1)
 
@@ -50,8 +49,7 @@ func TestRotateRootKeypair_Snowflake_Acc(t *testing.T) {
 		t.Skip("VAULT_SNOWFLAKE_USERNAME not set, skipping test")
 	}
 
-	cluster, sys := getClusterWithFactory(t, Factory)
-	defer cluster.Cleanup()
+	_, sys := getClusterWithFactory(t, Factory)
 
 	testRotateRoot(t, sys, false, connURL, "snowflake-database-plugin", username, string(keyFile))
 }
diff --git a/builtin/logical/database/rollback_test.go b/builtin/logical/database/rollback_test.go
index a3d48c5a49..1b77c8e143 100644
--- a/builtin/logical/database/rollback_test.go
+++ b/builtin/logical/database/rollback_test.go
@@ -27,8 +27,7 @@ const (
 //   - Password has been altered on the database
 //   - Password has not been updated in storage
 func TestBackend_RotateRootCredentials_WAL_rollback(t *testing.T) {
-	cluster, sys := getClusterPostgresDB(t)
-	defer cluster.Cleanup()
+	_, sys := getClusterPostgresDB(t)
 
 	config := logical.TestBackendConfig()
 	config.StorageView = &logical.InmemStorage{}
@@ -165,8 +164,7 @@ func TestBackend_RotateRootCredentials_WAL_rollback(t *testing.T) {
 //   - Password has not been altered on the database
 //   - Password has not been updated in storage
 func TestBackend_RotateRootCredentials_WAL_no_rollback_1(t *testing.T) {
-	cluster, sys := getClusterPostgresDB(t)
-	defer cluster.Cleanup()
+	_, sys := getClusterPostgresDB(t)
 
 	config := logical.TestBackendConfig()
 	config.StorageView = &logical.InmemStorage{}
@@ -264,8 +262,7 @@ func TestBackend_RotateRootCredentials_WAL_no_rollback_1(t *testing.T) {
 //   - Password has been altered on the database
 //   - Password has been updated in storage
 func TestBackend_RotateRootCredentials_WAL_no_rollback_2(t *testing.T) {
-	cluster, sys := getClusterPostgresDB(t)
-	defer cluster.Cleanup()
+	_, sys := getClusterPostgresDB(t)
 
 	config := logical.TestBackendConfig()
 	config.StorageView = &logical.InmemStorage{}
diff --git a/builtin/logical/database/rotation_test.go b/builtin/logical/database/rotation_test.go
index e6560d784e..9e4af3d067 100644
--- a/builtin/logical/database/rotation_test.go
+++ b/builtin/logical/database/rotation_test.go
@@ -44,8 +44,7 @@ const (
 )
 
 func TestBackend_StaticRole_Rotation_basic(t *testing.T) {
-	cluster, sys := getClusterPostgresDB(t)
-	defer cluster.Cleanup()
+	_, sys := getClusterPostgresDB(t)
 
 	config := logical.TestBackendConfig()
 	config.StorageView = &logical.InmemStorage{}
@@ -253,8 +252,7 @@ func TestBackend_StaticRole_Rotation_basic(t *testing.T) {
 // rotations can successfully recover and that they do not occur outside of a
 // rotation window.
 func TestBackend_StaticRole_Rotation_Schedule_ErrorRecover(t *testing.T) {
-	cluster, sys := getClusterPostgresDB(t)
-	t.Cleanup(cluster.Cleanup)
+	_, sys := getClusterPostgresDB(t)
 
 	config := logical.TestBackendConfig()
 	config.StorageView = &logical.InmemStorage{}
@@ -441,8 +439,7 @@ func TestBackend_StaticRole_Rotation_Schedule_ErrorRecover(t *testing.T) {
 // for non-static accounts, which doesn't make sense anyway, but doesn't hurt to
 // verify we return an error
 func TestBackend_StaticRole_Rotation_NonStaticError(t *testing.T) {
-	cluster, sys := getClusterPostgresDB(t)
-	defer cluster.Cleanup()
+	_, sys := getClusterPostgresDB(t)
 
 	config := logical.TestBackendConfig()
 	config.StorageView = &logical.InmemStorage{}
@@ -545,8 +542,7 @@ func TestBackend_StaticRole_Rotation_NonStaticError(t *testing.T) {
 }
 
 func TestBackend_StaticRole_Rotation_Revoke_user(t *testing.T) {
-	cluster, sys := getClusterPostgresDB(t)
-	defer cluster.Cleanup()
+	_, sys := getClusterPostgresDB(t)
 
 	config := logical.TestBackendConfig()
 	config.StorageView = &logical.InmemStorage{}
@@ -723,8 +719,7 @@ func verifyPgConn(t *testing.T, username, password, connURL string) {
 //
 // First scenario, WAL contains a role name that does not exist.
 func TestBackend_StaticRole_Rotation_QueueWAL_discard_role_not_found(t *testing.T) {
-	cluster, sys := getClusterPostgresDB(t)
-	defer cluster.Cleanup()
+	_, sys := getClusterPostgresDB(t)
 
 	ctx := context.Background()
 
@@ -764,8 +759,7 @@ func TestBackend_StaticRole_Rotation_QueueWAL_discard_role_not_found(t *testing.
 // Second scenario, WAL contains a role name that does exist, but the role's
 // LastVaultRotation is greater than the WAL has
 func TestBackend_StaticRole_Rotation_QueueWAL_discard_role_newer_rotation_date(t *testing.T) {
-	cluster, sys := getClusterPostgresDB(t)
-	defer cluster.Cleanup()
+	_, sys := getClusterPostgresDB(t)
 
 	ctx := context.Background()
 
@@ -1029,8 +1023,7 @@ func TestBackend_StaticRole_Rotation_MongoDBAtlas(t *testing.T) {
 // does not break on invalid values.
 func TestQueueTickIntervalKeyConfig(t *testing.T) {
 	t.Parallel()
-	cluster, sys := getCluster(t)
-	defer cluster.Cleanup()
+	_, sys := getCluster(t)
 
 	values := []string{"1", "0", "-1"}
 	for _, v := range values {
@@ -1060,8 +1053,7 @@ func testBackend_StaticRole_Rotations(t *testing.T, createUser userCreator, opts
 		}
 	}()
 
-	cluster, sys := getClusterPostgresDB(t)
-	defer cluster.Cleanup()
+	_, sys := getClusterPostgresDB(t)
 
 	config := logical.TestBackendConfig()
 	config.StorageView = &logical.InmemStorage{}
@@ -1224,8 +1216,7 @@ type createUserCommand struct {
 
 // Demonstrates a bug fix for the credential rotation not releasing locks
 func TestBackend_StaticRole_Rotation_LockRegression(t *testing.T) {
-	cluster, sys := getClusterPostgresDB(t)
-	defer cluster.Cleanup()
+	_, sys := getClusterPostgresDB(t)
 
 	config := logical.TestBackendConfig()
 	config.StorageView = &logical.InmemStorage{}
@@ -1303,8 +1294,7 @@ func TestBackend_StaticRole_Rotation_LockRegression(t *testing.T) {
 }
 
 func TestBackend_StaticRole_Rotation_Invalid_Role(t *testing.T) {
-	cluster, sys := getClusterPostgresDB(t)
-	defer cluster.Cleanup()
+	_, sys := getClusterPostgresDB(t)
 
 	config := logical.TestBackendConfig()
 	config.StorageView = &logical.InmemStorage{}
diff --git a/builtin/logical/database/versioning_large_test.go b/builtin/logical/database/versioning_large_test.go
index 0251fe86bf..a191aad852 100644
--- a/builtin/logical/database/versioning_large_test.go
+++ b/builtin/logical/database/versioning_large_test.go
@@ -23,7 +23,6 @@ import (
 
 func TestPlugin_lifecycle(t *testing.T) {
 	cluster, sys := getCluster(t)
-	defer cluster.Cleanup()
 
 	env := []string{fmt.Sprintf("%s=%s", pluginutil.PluginCACertPEMEnv, cluster.CACertPEMFile)}
 	vault.TestAddTestPlugin(t, cluster.Cores[0].Core, "mock-v4-database-plugin", consts.PluginTypeDatabase, "", "TestBackend_PluginMain_MockV4", env)
@@ -224,7 +223,6 @@ func TestPlugin_lifecycle(t *testing.T) {
 
 func TestPlugin_VersionSelection(t *testing.T) {
 	cluster, sys := getCluster(t)
-	defer cluster.Cleanup()
 
 	for _, version := range []string{"v11.0.0", "v11.0.1-rc1", "v2.0.0"} {
 		vault.TestAddTestPlugin(t, cluster.Cores[0].Core, "mock-v5-database-plugin", consts.PluginTypeDatabase, version, "TestBackend_PluginMain_MockV5", []string{})
@@ -337,7 +335,6 @@ func TestPlugin_VersionSelection(t *testing.T) {
 
 func TestPlugin_VersionMustBeExplicitlyUpgraded(t *testing.T) {
 	cluster, sys := getCluster(t)
-	defer cluster.Cleanup()
 
 	config := logical.TestBackendConfig()
 	config.StorageView = &logical.InmemStorage{}
diff --git a/builtin/logical/pki/acme_billing_test.go b/builtin/logical/pki/acme_billing_test.go
index d2fbd92677..67b71ef3f7 100644
--- a/builtin/logical/pki/acme_billing_test.go
+++ b/builtin/logical/pki/acme_billing_test.go
@@ -32,7 +32,6 @@ func TestACMEBilling(t *testing.T) {
 	timeutil.SkipAtEndOfMonth(t)
 
 	cluster, client, _ := setupAcmeBackend(t)
-	defer cluster.Cleanup()
 
 	var activeCore *vault.TestClusterCore
 	{
diff --git a/builtin/logical/pki/backend_test.go b/builtin/logical/pki/backend_test.go
index 9f9668c0da..9a89eb02c9 100644
--- a/builtin/logical/pki/backend_test.go
+++ b/builtin/logical/pki/backend_test.go
@@ -3646,8 +3646,6 @@ func TestBackend_AllowedURISANsTemplate(t *testing.T) {
 	cluster := vault.NewTestCluster(t, coreConfig, &vault.TestClusterOptions{
 		HandlerFunc: vaulthttp.Handler,
 	})
-	cluster.Start()
-	defer cluster.Cleanup()
 	client := cluster.Cores[0].Client
 
 	// Write test policy for userpass auth method.
@@ -3771,8 +3769,6 @@ func TestBackend_AllowedDomainsTemplate(t *testing.T) {
 	cluster := vault.NewTestCluster(t, coreConfig, &vault.TestClusterOptions{
 		HandlerFunc: vaulthttp.Handler,
 	})
-	cluster.Start()
-	defer cluster.Cleanup()
 	client := cluster.Cores[0].Client
 
 	// Write test policy for userpass auth method.
@@ -3904,8 +3900,7 @@ func TestReadWriteDeleteRoles(t *testing.T) {
 	cluster := vault.NewTestCluster(t, coreConfig, &vault.TestClusterOptions{
 		HandlerFunc: vaulthttp.Handler,
 	})
-	cluster.Start()
-	defer cluster.Cleanup()
+
 	client := cluster.Cores[0].Client
 
 	// Mount PKI.
@@ -4152,8 +4147,7 @@ func TestBackend_RevokePlusTidy_Intermediate(t *testing.T) {
 	cluster := vault.NewTestCluster(t, coreConfig, &vault.TestClusterOptions{
 		HandlerFunc: vaulthttp.Handler,
 	})
-	cluster.Start()
-	defer cluster.Cleanup()
+
 	cores := cluster.Cores
 	vault.TestWaitActive(t, cores[0].Core)
 	client := cores[0].Client
@@ -5633,8 +5627,7 @@ func TestBackend_IfModifiedSinceHeaders(t *testing.T) {
 		HandlerFunc:             vaulthttp.Handler,
 		RequestResponseCallback: schema.ResponseValidatingCallback(t),
 	})
-	cluster.Start()
-	defer cluster.Cleanup()
+
 	client := cluster.Cores[0].Client
 
 	// Mount PKI.
@@ -6812,8 +6805,6 @@ func TestStandby_Operations(t *testing.T) {
 		},
 	}, nil, teststorage.InmemBackendSetup)
 	cluster := vault.NewTestCluster(t, conf, opts)
-	cluster.Start()
-	defer cluster.Cleanup()
 
 	testhelpers.WaitForActiveNodeAndStandbys(t, cluster)
 	standbyCores := testhelpers.DeriveStandbyCores(t, cluster)
@@ -7042,8 +7033,7 @@ func TestProperAuthing(t *testing.T) {
 	cluster := vault.NewTestCluster(t, coreConfig, &vault.TestClusterOptions{
 		HandlerFunc: vaulthttp.Handler,
 	})
-	cluster.Start()
-	defer cluster.Cleanup()
+
 	client := cluster.Cores[0].Client
 	token := client.Token()
 
diff --git a/builtin/logical/pki/ca_test.go b/builtin/logical/pki/ca_test.go
index 9cdeafca95..fe958e2157 100644
--- a/builtin/logical/pki/ca_test.go
+++ b/builtin/logical/pki/ca_test.go
@@ -48,8 +48,6 @@ func TestBackend_CA_Steps(t *testing.T) {
 	cluster := vault.NewTestCluster(t, coreConfig, &vault.TestClusterOptions{
 		HandlerFunc: vaulthttp.Handler,
 	})
-	cluster.Start()
-	defer cluster.Cleanup()
 
 	client := cluster.Cores[0].Client
 
diff --git a/builtin/logical/pki/crl_test.go b/builtin/logical/pki/crl_test.go
index 52fb182bda..bc4b1e532f 100644
--- a/builtin/logical/pki/crl_test.go
+++ b/builtin/logical/pki/crl_test.go
@@ -961,8 +961,6 @@ func TestAutoRebuild(t *testing.T) {
 	cluster := vault.NewTestCluster(t, coreConfig, &vault.TestClusterOptions{
 		HandlerFunc: vaulthttp.Handler,
 	})
-	cluster.Start()
-	defer cluster.Cleanup()
 	client := cluster.Cores[0].Client
 
 	// Mount PKI
diff --git a/builtin/logical/pki/integration_test.go b/builtin/logical/pki/integration_test.go
index ae109665fa..70457790c4 100644
--- a/builtin/logical/pki/integration_test.go
+++ b/builtin/logical/pki/integration_test.go
@@ -493,11 +493,7 @@ func TestLDAPAiaCrlUrls(t *testing.T) {
 		NumCores:    1,
 		HandlerFunc: vaulthttp.Handler,
 	})
-	cluster.Start()
-	defer cluster.Cleanup()
-	singleCore := cluster.Cores[0]
-	vault.TestWaitActive(t, singleCore.Core)
-	client := singleCore.Client
+	client := cluster.Cores[0].Client
 
 	mountPKIEndpoint(t, client, "pki")
 
@@ -572,9 +568,6 @@ func TestIntegrationOCSPClientWithPKI(t *testing.T) {
 	cluster := vault.NewTestCluster(t, coreConfig, &vault.TestClusterOptions{
 		HandlerFunc: vaulthttp.Handler,
 	})
-
-	cluster.Start()
-	defer cluster.Cleanup()
 	cores := cluster.Cores
 	vault.TestWaitActive(t, cores[0].Core)
 	client := cores[0].Client
diff --git a/builtin/logical/pki/path_acme_test.go b/builtin/logical/pki/path_acme_test.go
index 90f75ab815..047ed6d98d 100644
--- a/builtin/logical/pki/path_acme_test.go
+++ b/builtin/logical/pki/path_acme_test.go
@@ -45,7 +45,7 @@ import (
 func TestAcmeBasicWorkflow(t *testing.T) {
 	t.Parallel()
 	cluster, client, _ := setupAcmeBackend(t)
-	defer cluster.Cleanup()
+
 	cases := []struct {
 		name      string
 		prefixUrl string
@@ -358,7 +358,7 @@ func TestAcmeBasicWorkflow(t *testing.T) {
 func TestAcmeBasicWorkflowWithEab(t *testing.T) {
 	t.Parallel()
 	cluster, client, _ := setupAcmeBackend(t)
-	defer cluster.Cleanup()
+
 	testCtx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
 	defer cancel()
 
@@ -477,8 +477,7 @@ func TestAcmeBasicWorkflowWithEab(t *testing.T) {
 // based on the
 func TestAcmeNonce(t *testing.T) {
 	t.Parallel()
-	cluster, client, pathConfig := setupAcmeBackend(t)
-	defer cluster.Cleanup()
+	_, client, pathConfig := setupAcmeBackend(t)
 
 	cases := []struct {
 		name         string
@@ -535,8 +534,7 @@ func TestAcmeNonce(t *testing.T) {
 // TestAcmeClusterPathNotConfigured basic testing of the ACME error handler.
 func TestAcmeClusterPathNotConfigured(t *testing.T) {
 	t.Parallel()
-	cluster, client := setupTestPkiCluster(t)
-	defer cluster.Cleanup()
+	_, client := setupTestPkiCluster(t)
 
 	// Go sneaky, sneaky and update the acme configuration through sys/raw to bypass config/cluster path checks
 	pkiMount := findStorageMountUuid(t, client, "pki")
@@ -590,7 +588,6 @@ func TestAcmeClusterPathNotConfigured(t *testing.T) {
 func TestAcmeAccountsCrossingDirectoryPath(t *testing.T) {
 	t.Parallel()
 	cluster, _, _ := setupAcmeBackend(t)
-	defer cluster.Cleanup()
 
 	baseAcmeURL := "/v1/pki/acme/"
 	accountKey, err := cryptoutil.GenerateRSAKey(rand.Reader, 2048)
@@ -619,7 +616,6 @@ func TestAcmeAccountsCrossingDirectoryPath(t *testing.T) {
 func TestAcmeEabCrossingDirectoryPath(t *testing.T) {
 	t.Parallel()
 	cluster, client, _ := setupAcmeBackend(t)
-	defer cluster.Cleanup()
 
 	// Enable EAB
 	_, err := client.Logical().WriteWithContext(context.Background(), "pki/config/acme", map[string]interface{}{
@@ -656,7 +652,6 @@ func TestAcmeDisabledWithEnvVar(t *testing.T) {
 	// Setup a cluster with the configuration set to not-required, initially as the
 	// configuration will validate if the environment var is set
 	cluster, client, _ := setupAcmeBackend(t)
-	defer cluster.Cleanup()
 
 	// Seal setup the environment variable, and unseal which now means we have a cluster
 	// with ACME configuration saying it is enabled with a bad EAB policy.
@@ -681,8 +676,7 @@ func TestAcmeDisabledWithEnvVar(t *testing.T) {
 // TestAcmeConfigChecksPublicAcmeEnv verifies certain EAB policy values can not be set if ENV var is enabled
 func TestAcmeConfigChecksPublicAcmeEnv(t *testing.T) {
 	t.Setenv("VAULT_DISABLE_PUBLIC_ACME", "true")
-	cluster, client := setupTestPkiCluster(t)
-	defer cluster.Cleanup()
+	_, client := setupTestPkiCluster(t)
 
 	_, err := client.Logical().WriteWithContext(context.Background(), "pki/config/cluster", map[string]interface{}{
 		"path": "https://dadgarcorp.com/v1/pki",
@@ -717,7 +711,6 @@ func TestAcmeHonorsAlwaysEnforceErr(t *testing.T) {
 	t.Parallel()
 
 	cluster, client, _ := setupAcmeBackend(t)
-	defer cluster.Cleanup()
 
 	testCtx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
 	defer cancel()
@@ -797,7 +790,6 @@ func TestAcmeTruncatesToIssuerExpiry(t *testing.T) {
 	t.Parallel()
 
 	cluster, client, _ := setupAcmeBackend(t)
-	defer cluster.Cleanup()
 
 	testCtx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
 	defer cancel()
@@ -887,7 +879,6 @@ func TestAcmeRoleExtKeyUsage(t *testing.T) {
 	t.Parallel()
 
 	cluster, client, _ := setupAcmeBackend(t)
-	defer cluster.Cleanup()
 
 	testCtx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
 	defer cancel()
@@ -991,7 +982,6 @@ func TestIssuerRoleDirectoryAssociations(t *testing.T) {
 	// roles (test-role, acme) that we can use with various directory
 	// configurations.
 	cluster, client, _ := setupAcmeBackend(t)
-	defer cluster.Cleanup()
 
 	// Setup DNS for validations.
 	testCtx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
@@ -1126,7 +1116,6 @@ func TestACMESubjectFieldsAndExtensionsIgnored(t *testing.T) {
 	// roles (test-role, acme) that we can use with various directory
 	// configurations.
 	cluster, client, _ := setupAcmeBackend(t)
-	defer cluster.Cleanup()
 
 	// Setup DNS for validations.
 	testCtx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
@@ -1175,7 +1164,6 @@ func TestAcmeWithCsrIncludingBasicConstraintExtension(t *testing.T) {
 	t.Parallel()
 
 	cluster, client, _ := setupAcmeBackend(t)
-	defer cluster.Cleanup()
 
 	testCtx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
 	defer cancel()
@@ -1507,7 +1495,6 @@ func testAcmeCertSignedByCa(t *testing.T, client *api.Client, derCerts [][]byte,
 func TestAcmeValidationError(t *testing.T) {
 	t.Parallel()
 	cluster, _, _ := setupAcmeBackend(t)
-	defer cluster.Cleanup()
 
 	testCtx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
 	defer cancel()
@@ -1616,7 +1603,7 @@ func TestAcmeRevocationAcrossAccounts(t *testing.T) {
 	t.Parallel()
 
 	cluster, vaultClient, _ := setupAcmeBackend(t)
-	defer cluster.Cleanup()
+
 	testCtx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
 	defer cancel()
 
@@ -1701,7 +1688,6 @@ func TestAcmeRevocationAcrossAccounts(t *testing.T) {
 func TestAcmeMaxTTL(t *testing.T) {
 	t.Parallel()
 	cluster, client, _ := setupAcmeBackend(t)
-	defer cluster.Cleanup()
 
 	testCtx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
 	defer cancel()
@@ -1786,7 +1772,7 @@ func TestAcmeMaxTTL(t *testing.T) {
 func TestVaultOperatorACMEDisableWorkflow(t *testing.T) {
 	t.Parallel()
 	cluster, vaultClient, _ := setupAcmeBackend(t)
-	defer cluster.Cleanup()
+
 	testCtx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
 	defer cancel()
 
@@ -1927,7 +1913,6 @@ func setupTestPkiCluster(t *testing.T) (*vault.TestCluster, *api.Client) {
 	cluster := vault.NewTestCluster(t, coreConfig, &vault.TestClusterOptions{
 		HandlerFunc: vaulthttp.Handler,
 	})
-	cluster.Start()
 	client := cluster.Cores[0].Client
 	mountPKIEndpoint(t, client, "pki")
 	return cluster, client
@@ -1986,7 +1971,6 @@ func getEABKey(t *testing.T, client *api.Client, baseUrl string) (string, []byte
 
 func TestACMEClientRequestLimits(t *testing.T) {
 	cluster, client, _ := setupAcmeBackend(t)
-	defer cluster.Cleanup()
 
 	cases := []struct {
 		name           string
diff --git a/builtin/logical/pki/path_config_acme_test.go b/builtin/logical/pki/path_config_acme_test.go
index 35218201a8..cc7cc6fcec 100644
--- a/builtin/logical/pki/path_config_acme_test.go
+++ b/builtin/logical/pki/path_config_acme_test.go
@@ -18,7 +18,6 @@ func TestAcmeConfig(t *testing.T) {
 	t.Parallel()
 
 	cluster, client, _ := setupAcmeBackend(t)
-	defer cluster.Cleanup()
 
 	cases := []struct {
 		name        string
@@ -158,8 +157,7 @@ func TestAcmeExternalPolicyOss(t *testing.T) {
 func TestAcmeIPRangeConfiguration(t *testing.T) {
 	t.Parallel()
 
-	cluster, client, _ := setupAcmeBackend(t)
-	defer cluster.Cleanup()
+	_, client, _ := setupAcmeBackend(t)
 
 	testCtx := context.Background()
 
diff --git a/builtin/logical/pki/path_fetch_issuers_test.go b/builtin/logical/pki/path_fetch_issuers_test.go
index de65824cd3..34d32a804e 100644
--- a/builtin/logical/pki/path_fetch_issuers_test.go
+++ b/builtin/logical/pki/path_fetch_issuers_test.go
@@ -14,9 +14,7 @@ import (
 // to something completely incorrect (missing an intermediate issuer).  In this case, the attempt to write the manual
 // chain throws an error, and the manual chain is not updated.
 func TestManualChainValidation(t *testing.T) {
-	// Set Up a Cluster
-	cluster, client := setupTestPkiCluster(t)
-	defer cluster.Cleanup()
+	_, client := setupTestPkiCluster(t)
 
 	// Set Up Root-A
 	mount := "pki"
diff --git a/builtin/logical/pki/path_ocsp_test.go b/builtin/logical/pki/path_ocsp_test.go
index 6bdb63ae6c..587d48bdae 100644
--- a/builtin/logical/pki/path_ocsp_test.go
+++ b/builtin/logical/pki/path_ocsp_test.go
@@ -384,8 +384,6 @@ func TestOcsp_HigherLevel(t *testing.T) {
 	cluster := vault.NewTestCluster(t, coreConfig, &vault.TestClusterOptions{
 		HandlerFunc: vaulthttp.Handler,
 	})
-	cluster.Start()
-	defer cluster.Cleanup()
 	client := cluster.Cores[0].Client
 	mountPKIEndpoint(t, client, "pki")
 	resp, err := client.Logical().Write("pki/root/generate/internal", map[string]interface{}{
diff --git a/builtin/logical/pki/path_resign_crls_test.go b/builtin/logical/pki/path_resign_crls_test.go
index c44e6e942e..6a407e4ad5 100644
--- a/builtin/logical/pki/path_resign_crls_test.go
+++ b/builtin/logical/pki/path_resign_crls_test.go
@@ -237,8 +237,6 @@ func TestSignRevocationList(t *testing.T) {
 	cluster := vault.NewTestCluster(t, coreConfig, &vault.TestClusterOptions{
 		HandlerFunc: vaulthttp.Handler,
 	})
-	cluster.Start()
-	defer cluster.Cleanup()
 	client := cluster.Cores[0].Client
 
 	// Mount PKI, use this form of backend so our request is closer to reality (json parsed)
diff --git a/builtin/logical/pki/path_tidy_test.go b/builtin/logical/pki/path_tidy_test.go
index 488889d4bf..a8fe490f48 100644
--- a/builtin/logical/pki/path_tidy_test.go
+++ b/builtin/logical/pki/path_tidy_test.go
@@ -198,8 +198,6 @@ func TestAutoTidy(t *testing.T) {
 	cluster := vault.NewTestCluster(t, coreConfig, &vault.TestClusterOptions{
 		HandlerFunc: vaulthttp.Handler,
 	})
-	cluster.Start()
-	defer cluster.Cleanup()
 	client := cluster.Cores[0].Client
 
 	// Mount PKI
@@ -336,8 +334,6 @@ func TestAutoTidyPersistsAcrossRestarts(t *testing.T) {
 		NumCores:    1,
 	}
 	cluster := vault.NewTestCluster(t, coreConfig, opts)
-	cluster.Start()
-	defer cluster.Cleanup()
 
 	client := cluster.Cores[0].Client
 
@@ -643,8 +639,6 @@ func TestCertStorageMetrics(t *testing.T) {
 		HandlerFunc: vaulthttp.Handler,
 		NumCores:    1,
 	})
-	cluster.Start()
-	defer cluster.Cleanup()
 	client := cluster.Cores[0].Client
 
 	// Mount PKI
@@ -912,7 +906,6 @@ func TestTidyAcmeWithBackdate(t *testing.T) {
 	t.Parallel()
 
 	cluster, client, _ := setupAcmeBackend(t)
-	defer cluster.Cleanup()
 	testCtx := context.Background()
 
 	// Grab the mount UUID for sys/raw invocations.
@@ -1069,7 +1062,6 @@ func TestTidyAcmeWithSafetyBuffer(t *testing.T) {
 
 	// This would still be way easier if I could do both sides
 	cluster, client, _ := setupAcmeBackend(t)
-	defer cluster.Cleanup()
 	testCtx := context.Background()
 
 	// Grab the mount UUID for sys/raw invocations.
diff --git a/builtin/logical/ssh/backend_test.go b/builtin/logical/ssh/backend_test.go
index a5b89b2ab9..e30bf6ddb9 100644
--- a/builtin/logical/ssh/backend_test.go
+++ b/builtin/logical/ssh/backend_test.go
@@ -506,7 +506,7 @@ func TestBackend_DefaultUserTemplate_WithStaticPrefix(t *testing.T) {
 
 func TestBackend_DefaultUserTemplateFalse_AllowedUsersTemplateTrue(t *testing.T) {
 	cluster, userpassToken := getSshCaTestCluster(t, testUserName)
-	defer cluster.Cleanup()
+
 	client := cluster.Cores[0].Client
 
 	// set metadata "ssh_username" to userpass username
@@ -556,7 +556,7 @@ func TestBackend_DefaultUserTemplateFalse_AllowedUsersTemplateTrue(t *testing.T)
 
 func TestBackend_DefaultUserTemplateFalse_AllowedUsersTemplateFalse(t *testing.T) {
 	cluster, userpassToken := getSshCaTestCluster(t, testUserName)
-	defer cluster.Cleanup()
+
 	client := cluster.Cores[0].Client
 
 	// set metadata "ssh_username" to userpass username
@@ -1784,7 +1784,7 @@ func TestBackend_DisallowUserProvidedKeyIDs(t *testing.T) {
 
 func TestBackend_DefExtTemplatingEnabled(t *testing.T) {
 	cluster, userpassToken := getSshCaTestCluster(t, testUserName)
-	defer cluster.Cleanup()
+
 	client := cluster.Cores[0].Client
 
 	// Get auth accessor for identity template.
@@ -1880,7 +1880,7 @@ func TestBackend_DefExtTemplatingEnabled(t *testing.T) {
 
 func TestBackend_EmptyAllowedExtensionFailsClosed(t *testing.T) {
 	cluster, userpassToken := getSshCaTestCluster(t, testUserName)
-	defer cluster.Cleanup()
+
 	client := cluster.Cores[0].Client
 
 	// Get auth accessor for identity template.
@@ -1927,7 +1927,7 @@ func TestBackend_EmptyAllowedExtensionFailsClosed(t *testing.T) {
 
 func TestBackend_DefExtTemplatingDisabled(t *testing.T) {
 	cluster, userpassToken := getSshCaTestCluster(t, testUserName)
-	defer cluster.Cleanup()
+
 	client := cluster.Cores[0].Client
 
 	// Get auth accessor for identity template.
@@ -2160,7 +2160,6 @@ func getSshCaTestCluster(t *testing.T, userIdentity string) (*vault.TestCluster,
 	cluster := vault.NewTestCluster(t, coreConfig, &vault.TestClusterOptions{
 		HandlerFunc: vaulthttp.Handler,
 	})
-	cluster.Start()
 	client := cluster.Cores[0].Client
 
 	// Write test policy for userpass auth method.
@@ -2222,7 +2221,7 @@ func testDefaultUserTemplate(t *testing.T, testDefaultUserTemplate string,
 	expectedValidPrincipal string, testEntityMetadata map[string]string,
 ) {
 	cluster, userpassToken := getSshCaTestCluster(t, testUserName)
-	defer cluster.Cleanup()
+
 	client := cluster.Cores[0].Client
 
 	// set metadata "ssh_username" to userpass username
@@ -2282,7 +2281,7 @@ func testAllowedPrincipalsTemplate(t *testing.T, testAllowedDomainsTemplate stri
 	roleConfigPayload map[string]interface{}, signingPayload map[string]interface{},
 ) {
 	cluster, userpassToken := getSshCaTestCluster(t, testUserName)
-	defer cluster.Cleanup()
+
 	client := cluster.Cores[0].Client
 
 	// set metadata "ssh_username" to userpass username
@@ -3096,8 +3095,7 @@ func TestProperAuthing(t *testing.T) {
 	cluster := vault.NewTestCluster(t, coreConfig, &vault.TestClusterOptions{
 		HandlerFunc: vaulthttp.Handler,
 	})
-	cluster.Start()
-	defer cluster.Cleanup()
+
 	client := cluster.Cores[0].Client
 	token := client.Token()
 
diff --git a/builtin/logical/transit/backend_test.go b/builtin/logical/transit/backend_test.go
index 955344a21e..7489230354 100644
--- a/builtin/logical/transit/backend_test.go
+++ b/builtin/logical/transit/backend_test.go
@@ -2024,8 +2024,6 @@ func TestTransitPKICSR(t *testing.T) {
 	cluster := vault.NewTestCluster(t, coreConfig, &vault.TestClusterOptions{
 		HandlerFunc: vaulthttp.Handler,
 	})
-	cluster.Start()
-	defer cluster.Cleanup()
 
 	cores := cluster.Cores
 
diff --git a/builtin/logical/transit/path_certificates_test.go b/builtin/logical/transit/path_certificates_test.go
index c6024ba9bc..48491d2b46 100644
--- a/builtin/logical/transit/path_certificates_test.go
+++ b/builtin/logical/transit/path_certificates_test.go
@@ -128,9 +128,6 @@ func TestTransit_Certs_ImportCertChain(t *testing.T) {
 		HandlerFunc: vaulthttp.Handler,
 	})
 
-	cluster.Start()
-	defer cluster.Cleanup()
-
 	cores := cluster.Cores
 	vault.TestWaitActive(t, cores[0].Core)
 	client := cores[0].Client
@@ -272,9 +269,6 @@ func TestTransit_Certs_ImportInvalidCertChain(t *testing.T) {
 		HandlerFunc: vaulthttp.Handler,
 	})
 
-	cluster.Start()
-	defer cluster.Cleanup()
-
 	cores := cluster.Cores
 	vault.TestWaitActive(t, cores[0].Core)
 	client := cores[0].Client
diff --git a/builtin/logical/transit/path_export_test.go b/builtin/logical/transit/path_export_test.go
index 78d211eaab..f29a53f26d 100644
--- a/builtin/logical/transit/path_export_test.go
+++ b/builtin/logical/transit/path_export_test.go
@@ -526,12 +526,7 @@ func TestTransit_Export_CertificateChain(t *testing.T) {
 	cluster := vault.NewTestCluster(t, coreConfig, &vault.TestClusterOptions{
 		HandlerFunc: vaulthttp.Handler,
 	})
-
-	cluster.Start()
-	defer cluster.Cleanup()
-
 	cores := cluster.Cores
-	vault.TestWaitActive(t, cores[0].Core)
 	client := cores[0].Client
 
 	// Mount transit backend
diff --git a/builtin/logical/transit/path_hmac_test.go b/builtin/logical/transit/path_hmac_test.go
index 29fba94488..40283ef119 100644
--- a/builtin/logical/transit/path_hmac_test.go
+++ b/builtin/logical/transit/path_hmac_test.go
@@ -419,8 +419,6 @@ func TestHMACBatchResultsFields(t *testing.T) {
 	cluster := vault.NewTestCluster(t, coreConfig, &vault.TestClusterOptions{
 		HandlerFunc: vaulthttp.Handler,
 	})
-	cluster.Start()
-	defer cluster.Cleanup()
 
 	cores := cluster.Cores
 
diff --git a/builtin/logical/transit/path_keys_config_test.go b/builtin/logical/transit/path_keys_config_test.go
index 7513037659..22af13b044 100644
--- a/builtin/logical/transit/path_keys_config_test.go
+++ b/builtin/logical/transit/path_keys_config_test.go
@@ -346,8 +346,6 @@ func TestTransit_UpdateKeyConfigWithAutorotation(t *testing.T) {
 	cluster := vault.NewTestCluster(t, coreConfig, &vault.TestClusterOptions{
 		HandlerFunc: vaulthttp.Handler,
 	})
-	cluster.Start()
-	defer cluster.Cleanup()
 	cores := cluster.Cores
 	vault.TestWaitActive(t, cores[0].Core)
 	client := cores[0].Client
diff --git a/builtin/logical/transit/path_keys_test.go b/builtin/logical/transit/path_keys_test.go
index 6c6ad2f606..49ef7edd55 100644
--- a/builtin/logical/transit/path_keys_test.go
+++ b/builtin/logical/transit/path_keys_test.go
@@ -34,13 +34,7 @@ func TestTransit_Issue_2958(t *testing.T) {
 	cluster := vault.NewTestCluster(t, coreConfig, &vault.TestClusterOptions{
 		HandlerFunc: vaulthttp.Handler,
 	})
-	cluster.Start()
-	defer cluster.Cleanup()
-
 	cores := cluster.Cores
-
-	vault.TestWaitActive(t, cores[0].Core)
-
 	client := cores[0].Client
 
 	err := client.Sys().EnableAuditWithOptions("file", &api.EnableAuditOptions{
@@ -143,10 +137,7 @@ func TestTransit_CreateKeyWithAutorotation(t *testing.T) {
 	cluster := vault.NewTestCluster(t, coreConfig, &vault.TestClusterOptions{
 		HandlerFunc: vaulthttp.Handler,
 	})
-	cluster.Start()
-	defer cluster.Cleanup()
 	cores := cluster.Cores
-	vault.TestWaitActive(t, cores[0].Core)
 	client := cores[0].Client
 	err := client.Sys().Mount("transit", &api.MountInput{
 		Type: "transit",
@@ -365,10 +356,7 @@ func TestTransit_CreateKey(t *testing.T) {
 	cluster := vault.NewTestCluster(t, coreConfig, &vault.TestClusterOptions{
 		HandlerFunc: vaulthttp.Handler,
 	})
-	cluster.Start()
-	defer cluster.Cleanup()
 	cores := cluster.Cores
-	vault.TestWaitActive(t, cores[0].Core)
 	client := cores[0].Client
 	err := client.Sys().Mount("transit", &api.MountInput{
 		Type: "transit",
diff --git a/builtin/plugin/backend_test.go b/builtin/plugin/backend_test.go
index d9732e49a1..c96008a333 100644
--- a/builtin/plugin/backend_test.go
+++ b/builtin/plugin/backend_test.go
@@ -123,7 +123,6 @@ func testConfig(t *testing.T, pluginCmd string) (*logical.BackendConfig, func())
 	}, &vault.TestClusterOptions{
 		HandlerFunc: vaulthttp.Handler,
 	})
-	cluster.Start()
 	cores := cluster.Cores
 
 	core := cores[0]
@@ -144,6 +143,5 @@ func testConfig(t *testing.T, pluginCmd string) (*logical.BackendConfig, func())
 		[]string{fmt.Sprintf("%s=%s", pluginutil.PluginCACertPEMEnv, cluster.CACertPEMFile)})
 
 	return config, func() {
-		cluster.Cleanup()
 	}
 }
diff --git a/command/agent/alicloud_end_to_end_test.go b/command/agent/alicloud_end_to_end_test.go
index 6e613c5f9f..af9d45bdb6 100644
--- a/command/agent/alicloud_end_to_end_test.go
+++ b/command/agent/alicloud_end_to_end_test.go
@@ -55,10 +55,7 @@ func TestAliCloudEndToEnd(t *testing.T) {
 	cluster := vault.NewTestCluster(t, coreConfig, &vault.TestClusterOptions{
 		HandlerFunc: vaulthttp.Handler,
 	})
-	cluster.Start()
-	defer cluster.Cleanup()
 
-	vault.TestWaitActive(t, cluster.Cores[0].Core)
 	client := cluster.Cores[0].Client
 
 	// Setup Vault
diff --git a/command/agent/approle_end_to_end_test.go b/command/agent/approle_end_to_end_test.go
index 9ced7a47de..9971fc223f 100644
--- a/command/agent/approle_end_to_end_test.go
+++ b/command/agent/approle_end_to_end_test.go
@@ -80,14 +80,7 @@ func testAppRoleEndToEnd(t *testing.T, removeSecretIDFile bool, bindSecretID boo
 	cluster := vault.NewTestCluster(t, coreConfig, &vault.TestClusterOptions{
 		HandlerFunc: vaulthttp.Handler,
 	})
-
-	cluster.Start()
-	defer cluster.Cleanup()
-
 	cores := cluster.Cores
-
-	vault.TestWaitActive(t, cores[0].Core)
-
 	client := cores[0].Client
 
 	err = client.Sys().EnableAuthWithOptions("approle", &api.EnableAuthOptions{
@@ -418,14 +411,7 @@ func TestAppRoleLongRoleName(t *testing.T) {
 	cluster := vault.NewTestCluster(t, coreConfig, &vault.TestClusterOptions{
 		HandlerFunc: vaulthttp.Handler,
 	})
-
-	cluster.Start()
-	defer cluster.Cleanup()
-
 	cores := cluster.Cores
-
-	vault.TestWaitActive(t, cores[0].Core)
-
 	client := cores[0].Client
 
 	err := client.Sys().EnableAuthWithOptions("approle", &api.EnableAuthOptions{
@@ -482,9 +468,6 @@ func testAppRoleWithWrapping(t *testing.T, bindSecretID bool, secretIDLess bool,
 		HandlerFunc: vaulthttp.Handler,
 	})
 
-	cluster.Start()
-	defer cluster.Cleanup()
-
 	cores := cluster.Cores
 
 	vault.TestWaitActive(t, cores[0].Core)
diff --git a/command/agent/auto_auth_preload_token_end_to_end_test.go b/command/agent/auto_auth_preload_token_end_to_end_test.go
index bd443bedab..1d45ad75da 100644
--- a/command/agent/auto_auth_preload_token_end_to_end_test.go
+++ b/command/agent/auto_auth_preload_token_end_to_end_test.go
@@ -36,10 +36,7 @@ func TestTokenPreload_UsingAutoAuth(t *testing.T) {
 	cluster := vault.NewTestCluster(t, coreConfig, &vault.TestClusterOptions{
 		HandlerFunc: vaulthttp.Handler,
 	})
-	cluster.Start()
-	defer cluster.Cleanup()
 
-	vault.TestWaitActive(t, cluster.Cores[0].Core)
 	client := cluster.Cores[0].Client
 
 	// Setup Vault
diff --git a/command/agent/aws_end_to_end_test.go b/command/agent/aws_end_to_end_test.go
index fec55c41a7..8718f3e73b 100644
--- a/command/agent/aws_end_to_end_test.go
+++ b/command/agent/aws_end_to_end_test.go
@@ -68,10 +68,7 @@ func TestAWSEndToEnd(t *testing.T) {
 	cluster := vault.NewTestCluster(t, coreConfig, &vault.TestClusterOptions{
 		HandlerFunc: vaulthttp.Handler,
 	})
-	cluster.Start()
-	defer cluster.Cleanup()
 
-	vault.TestWaitActive(t, cluster.Cores[0].Core)
 	client := cluster.Cores[0].Client
 
 	// Setup Vault
diff --git a/command/agent/cache_end_to_end_test.go b/command/agent/cache_end_to_end_test.go
index 637c0ab4a0..0fe2ad82c6 100644
--- a/command/agent/cache_end_to_end_test.go
+++ b/command/agent/cache_end_to_end_test.go
@@ -56,9 +56,6 @@ func TestCache_UsingAutoAuthToken(t *testing.T) {
 		HandlerFunc: vaulthttp.Handler,
 	})
 
-	cluster.Start()
-	defer cluster.Cleanup()
-
 	cores := cluster.Cores
 
 	vault.TestWaitActive(t, cores[0].Core)
diff --git a/command/agent/cert_end_to_end_test.go b/command/agent/cert_end_to_end_test.go
index 9b2139e3ae..80a83bf919 100644
--- a/command/agent/cert_end_to_end_test.go
+++ b/command/agent/cert_end_to_end_test.go
@@ -73,10 +73,7 @@ func testCertEndToEnd(t *testing.T, withCertRoleName, ahWrapping bool) {
 	cluster := vault.NewTestCluster(t, coreConfig, &vault.TestClusterOptions{
 		HandlerFunc: vaulthttp.Handler,
 	})
-	cluster.Start()
-	defer cluster.Cleanup()
 
-	vault.TestWaitActive(t, cluster.Cores[0].Core)
 	client := cluster.Cores[0].Client
 
 	// Setup Vault
@@ -315,10 +312,7 @@ func TestCertEndToEnd_CertsInConfig(t *testing.T) {
 	cluster := vault.NewTestCluster(t, coreConfig, &vault.TestClusterOptions{
 		HandlerFunc: vaulthttp.Handler,
 	})
-	cluster.Start()
-	defer cluster.Cleanup()
 
-	vault.TestWaitActive(t, cluster.Cores[0].Core)
 	client := cluster.Cores[0].Client
 
 	// /////////////
diff --git a/command/agent/cf_end_to_end_test.go b/command/agent/cf_end_to_end_test.go
index bab26755e7..4363672959 100644
--- a/command/agent/cf_end_to_end_test.go
+++ b/command/agent/cf_end_to_end_test.go
@@ -38,9 +38,6 @@ func TestCFEndToEnd(t *testing.T) {
 		HandlerFunc: vaulthttp.Handler,
 	})
 
-	cluster.Start()
-	defer cluster.Cleanup()
-
 	cores := cluster.Cores
 	vault.TestWaitActive(t, cores[0].Core)
 	client := cores[0].Client
diff --git a/command/agent/jwt_end_to_end_test.go b/command/agent/jwt_end_to_end_test.go
index 1aedbeae91..4fa9439405 100644
--- a/command/agent/jwt_end_to_end_test.go
+++ b/command/agent/jwt_end_to_end_test.go
@@ -62,10 +62,7 @@ func testJWTEndToEnd(t *testing.T, ahWrapping, useSymlink, removeJWTAfterReading
 	cluster := vault.NewTestCluster(t, coreConfig, &vault.TestClusterOptions{
 		HandlerFunc: vaulthttp.Handler,
 	})
-	cluster.Start()
-	defer cluster.Cleanup()
 
-	vault.TestWaitActive(t, cluster.Cores[0].Core)
 	client := cluster.Cores[0].Client
 
 	// Setup Vault
diff --git a/command/agent/oci_end_to_end_test.go b/command/agent/oci_end_to_end_test.go
index 82e12e7cb1..ee02125011 100644
--- a/command/agent/oci_end_to_end_test.go
+++ b/command/agent/oci_end_to_end_test.go
@@ -66,10 +66,7 @@ func TestOCIEndToEnd(t *testing.T) {
 	cluster := vault.NewTestCluster(t, coreConfig, &vault.TestClusterOptions{
 		HandlerFunc: vaulthttp.Handler,
 	})
-	cluster.Start()
-	defer cluster.Cleanup()
 
-	vault.TestWaitActive(t, cluster.Cores[0].Core)
 	client := cluster.Cores[0].Client
 
 	// Setup Vault
diff --git a/command/agent/token_file_end_to_end_test.go b/command/agent/token_file_end_to_end_test.go
index 424dd3a3ba..7c32e82187 100644
--- a/command/agent/token_file_end_to_end_test.go
+++ b/command/agent/token_file_end_to_end_test.go
@@ -26,9 +26,6 @@ func TestTokenFileEndToEnd(t *testing.T) {
 		HandlerFunc: vaulthttp.Handler,
 	})
 
-	cluster.Start()
-	defer cluster.Cleanup()
-
 	cores := cluster.Cores
 
 	vault.TestWaitActive(t, cores[0].Core)
diff --git a/command/agent_test.go b/command/agent_test.go
index b39e5c927e..544ebe38d3 100644
--- a/command/agent_test.go
+++ b/command/agent_test.go
@@ -119,10 +119,7 @@ func testAgentExitAfterAuth(t *testing.T, viaFlag bool) {
 	cluster := vault.NewTestCluster(t, coreConfig, &vault.TestClusterOptions{
 		HandlerFunc: vaulthttp.Handler,
 	})
-	cluster.Start()
-	defer cluster.Cleanup()
 
-	vault.TestWaitActive(t, cluster.Cores[0].Core)
 	client := cluster.Cores[0].Client
 
 	// Setup Vault
@@ -308,9 +305,7 @@ func TestAgent_RequireRequestHeader(t *testing.T) {
 		&vault.TestClusterOptions{
 			HandlerFunc: vaulthttp.Handler,
 		})
-	cluster.Start()
-	defer cluster.Cleanup()
-	vault.TestWaitActive(t, cluster.Cores[0].Core)
+
 	serverClient := cluster.Cores[0].Client
 
 	// Enable the approle auth method
@@ -620,10 +615,7 @@ func TestAgent_Template_UserAgent(t *testing.T) {
 					return &h
 				}),
 		})
-	cluster.Start()
-	defer cluster.Cleanup()
 
-	vault.TestWaitActive(t, cluster.Cores[0].Core)
 	serverClient := cluster.Cores[0].Client
 
 	// Unset the environment variable so that agent picks up the right test
@@ -790,10 +782,7 @@ func TestAgent_Template_Basic(t *testing.T) {
 		&vault.TestClusterOptions{
 			HandlerFunc: vaulthttp.Handler,
 		})
-	cluster.Start()
-	defer cluster.Cleanup()
 
-	vault.TestWaitActive(t, cluster.Cores[0].Core)
 	serverClient := cluster.Cores[0].Client
 
 	// Unset the environment variable so that agent picks up the right test
@@ -1097,10 +1086,7 @@ func TestAgent_Template_VaultClientFromEnv(t *testing.T) {
 		&vault.TestClusterOptions{
 			HandlerFunc: vaulthttp.Handler,
 		})
-	cluster.Start()
-	defer cluster.Cleanup()
 
-	vault.TestWaitActive(t, cluster.Cores[0].Core)
 	serverClient := cluster.Cores[0].Client
 
 	roleIDPath, secretIDPath := setupAppRoleAndKVMounts(t, serverClient)
@@ -1274,10 +1260,7 @@ func TestAgent_Template_ExitCounter(t *testing.T) {
 		&vault.TestClusterOptions{
 			HandlerFunc: vaulthttp.Handler,
 		})
-	cluster.Start()
-	defer cluster.Cleanup()
 
-	vault.TestWaitActive(t, cluster.Cores[0].Core)
 	serverClient := cluster.Cores[0].Client
 
 	// Unset the environment variable so that agent picks up the right test
@@ -1572,10 +1555,7 @@ func TestAgent_Template_Retry(t *testing.T) {
 					return &h
 				}),
 		})
-	cluster.Start()
-	defer cluster.Cleanup()
 
-	vault.TestWaitActive(t, cluster.Cores[0].Core)
 	serverClient := cluster.Cores[0].Client
 
 	// Unset the environment variable so that agent picks up the right test
@@ -1852,8 +1832,6 @@ func TestAgent_AutoAuth_UserAgent(t *testing.T) {
 				return &h
 			}),
 	})
-	cluster.Start()
-	defer cluster.Cleanup()
 
 	serverClient := cluster.Cores[0].Client
 
@@ -1968,8 +1946,6 @@ func TestAgent_APIProxyWithoutCache_UserAgent(t *testing.T) {
 				return &h
 			}),
 	})
-	cluster.Start()
-	defer cluster.Cleanup()
 
 	serverClient := cluster.Cores[0].Client
 
@@ -2054,8 +2030,6 @@ func TestAgent_APIProxyWithCache_UserAgent(t *testing.T) {
 				return &h
 			}),
 	})
-	cluster.Start()
-	defer cluster.Cleanup()
 
 	serverClient := cluster.Cores[0].Client
 
@@ -2129,8 +2103,6 @@ func TestAgent_Cache_DynamicSecret(t *testing.T) {
 	cluster := vault.NewTestCluster(t, nil, &vault.TestClusterOptions{
 		HandlerFunc: vaulthttp.Handler,
 	})
-	cluster.Start()
-	defer cluster.Cleanup()
 
 	serverClient := cluster.Cores[0].Client
 
@@ -2251,10 +2223,7 @@ func TestAgent_ApiProxy_Retry(t *testing.T) {
 				return &h
 			}),
 		})
-	cluster.Start()
-	defer cluster.Cleanup()
 
-	vault.TestWaitActive(t, cluster.Cores[0].Core)
 	serverClient := cluster.Cores[0].Client
 
 	// Unset the environment variable so that agent picks up the right test
@@ -2397,10 +2366,7 @@ func TestAgent_TemplateConfig_ExitOnRetryFailure(t *testing.T) {
 			NumCores:    1,
 			HandlerFunc: vaulthttp.Handler,
 		})
-	cluster.Start()
-	defer cluster.Cleanup()
 
-	vault.TestWaitActive(t, cluster.Cores[0].Core)
 	serverClient := cluster.Cores[0].Client
 
 	// Unset the environment variable so that agent picks up the right test
@@ -2690,9 +2656,7 @@ func TestAgent_Metrics(t *testing.T) {
 		&vault.TestClusterOptions{
 			HandlerFunc: vaulthttp.Handler,
 		})
-	cluster.Start()
-	defer cluster.Cleanup()
-	vault.TestWaitActive(t, cluster.Cores[0].Core)
+
 	serverClient := cluster.Cores[0].Client
 
 	// Create a config file
@@ -3164,8 +3128,6 @@ func TestAgent_NonTLSListener_SIGHUP(t *testing.T) {
 	cluster := vault.NewTestCluster(t, nil, &vault.TestClusterOptions{
 		HandlerFunc: vaulthttp.Handler,
 	})
-	cluster.Start()
-	defer cluster.Cleanup()
 
 	serverClient := cluster.Cores[0].Client
 
@@ -3238,8 +3200,6 @@ func TestAgent_TokenRenewal(t *testing.T) {
 	cluster := vault.NewTestCluster(t, nil, &vault.TestClusterOptions{
 		HandlerFunc: vaulthttp.Handler,
 	})
-	cluster.Start()
-	defer cluster.Cleanup()
 
 	serverClient := cluster.Cores[0].Client
 
@@ -3479,10 +3439,7 @@ func TestAgent_DeleteAfterVersion_Rendering(t *testing.T) {
 			NumCores:    1,
 			HandlerFunc: vaulthttp.Handler,
 		})
-	cluster.Start()
-	defer cluster.Cleanup()
 
-	vault.TestWaitActive(t, cluster.Cores[0].Core)
 	serverClient := cluster.Cores[0].Client
 
 	// Set up KVv2
diff --git a/command/agentproxyshared/auth/auth_test.go b/command/agentproxyshared/auth/auth_test.go
index 0c08d2c511..3b7349171e 100644
--- a/command/agentproxyshared/auth/auth_test.go
+++ b/command/agentproxyshared/auth/auth_test.go
@@ -73,10 +73,7 @@ func TestAuthHandler(t *testing.T) {
 	cluster := vault.NewTestCluster(t, coreConfig, &vault.TestClusterOptions{
 		HandlerFunc: vaulthttp.Handler,
 	})
-	cluster.Start()
-	defer cluster.Cleanup()
 
-	vault.TestWaitActive(t, cluster.Cores[0].Core)
 	client := cluster.Cores[0].Client
 
 	ctx, cancelFunc := context.WithCancel(context.Background())
diff --git a/command/agentproxyshared/cache/api_proxy_test.go b/command/agentproxyshared/cache/api_proxy_test.go
index 1145075183..c7206e0399 100644
--- a/command/agentproxyshared/cache/api_proxy_test.go
+++ b/command/agentproxyshared/cache/api_proxy_test.go
@@ -201,11 +201,7 @@ func setupClusterAndAgentCommon(ctx context.Context, t *testing.T, coreConfig *v
 	cluster := vault.NewTestCluster(t, coreConfig, &vault.TestClusterOptions{
 		HandlerFunc: vaulthttp.Handler,
 	})
-	cluster.Start()
-
 	cores := cluster.Cores
-	vault.TestWaitActive(t, cores[0].Core)
-
 	activeClient := cores[0].Client
 	standbyClient := cores[1].Client
 
@@ -322,8 +318,6 @@ func setupClusterAndAgentCommon(ctx context.Context, t *testing.T, coreConfig *v
 	cleanup := func() {
 		// We wait for a tiny bit for things such as agent renewal to exit properly
 		time.Sleep(50 * time.Millisecond)
-
-		cluster.Cleanup()
 		os.Setenv(api.EnvVaultAddress, origEnvVaultAddress)
 		os.Setenv(api.EnvVaultCACert, origEnvVaultCACert)
 		listener.Close()
diff --git a/command/agentproxyshared/cache/cache_test.go b/command/agentproxyshared/cache/cache_test.go
index 25318a923e..d37c30a40d 100644
--- a/command/agentproxyshared/cache/cache_test.go
+++ b/command/agentproxyshared/cache/cache_test.go
@@ -62,8 +62,6 @@ func TestCache_AutoAuthTokenStripping(t *testing.T) {
 	cluster := vault.NewTestCluster(t, nil, &vault.TestClusterOptions{
 		HandlerFunc: vaulthttp.Handler,
 	})
-	cluster.Start()
-	defer cluster.Cleanup()
 
 	cores := cluster.Cores
 	vault.TestWaitActive(t, cores[0].Core)
@@ -151,12 +149,7 @@ func TestCache_AutoAuthClientTokenProxyStripping(t *testing.T) {
 	cluster := vault.NewTestCluster(t, nil, &vault.TestClusterOptions{
 		HandlerFunc: vaulthttp.Handler,
 	})
-	cluster.Start()
-	defer cluster.Cleanup()
-
-	cores := cluster.Cores
-	vault.TestWaitActive(t, cores[0].Core)
-	client := cores[0].Client
+	client := cluster.Cores[0].Client
 
 	cacheLogger := logging.NewVaultLogger(hclog.Trace).Named("cache")
 	listener, err := net.Listen("tcp", "127.0.0.1:0")
diff --git a/command/approle_concurrency_integ_test.go b/command/approle_concurrency_integ_test.go
index cd993f26ff..a658b19868 100644
--- a/command/approle_concurrency_integ_test.go
+++ b/command/approle_concurrency_integ_test.go
@@ -27,14 +27,7 @@ func TestAppRole_Integ_ConcurrentLogins(t *testing.T) {
 	cluster := vault.NewTestCluster(t, coreConfig, &vault.TestClusterOptions{
 		HandlerFunc: vaulthttp.Handler,
 	})
-
-	cluster.Start()
-	defer cluster.Cleanup()
-
 	cores := cluster.Cores
-
-	vault.TestWaitActive(t, cores[0].Core)
-
 	client := cores[0].Client
 
 	err = client.Sys().EnableAuthWithOptions("approle", &api.EnableAuthOptions{
diff --git a/command/command_test.go b/command/command_test.go
index 7a4be03fda..b4e4af2ba8 100644
--- a/command/command_test.go
+++ b/command/command_test.go
@@ -209,7 +209,6 @@ func testVaultServerCoreConfigWithOpts(tb testing.TB, coreConfig *vault.CoreConf
 	tb.Helper()
 
 	cluster := vault.NewTestCluster(tb, coreConfig, opts)
-	cluster.Start()
 
 	// Make it easy to get access to the active
 	core := cluster.Cores[0].Core
@@ -226,7 +225,7 @@ func testVaultServerCoreConfigWithOpts(tb testing.TB, coreConfig *vault.CoreConf
 		keys = cluster.BarrierKeys
 	}
 
-	return client, encodeKeys(keys), cluster.Cleanup
+	return client, encodeKeys(keys), func() {}
 }
 
 // Convert the unseal keys to base64 encoded, since these are how the user
diff --git a/command/command_testonly/operator_usage_testonly_oss_test.go b/command/command_testonly/operator_usage_testonly_oss_test.go
index 44919f619a..ce3dd86aa9 100644
--- a/command/command_testonly/operator_usage_testonly_oss_test.go
+++ b/command/command_testonly/operator_usage_testonly_oss_test.go
@@ -43,10 +43,6 @@ func TestOperatorUsageCommandRun(t *testing.T) {
 		HandlerFunc: vaulthttp.Handler,
 		NumCores:    1,
 	})
-	defer cluster.Cleanup()
-	core := cluster.Cores[0].Core
-	vault.TestWaitActive(t, core)
-
 	client := cluster.Cores[0].Client
 	_, err := client.Logical().Write("sys/internal/counters/config", map[string]interface{}{"enabled": "enable"})
 	require.NoError(t, err)
diff --git a/command/proxy_test.go b/command/proxy_test.go
index 3de79bbfef..1469396f84 100644
--- a/command/proxy_test.go
+++ b/command/proxy_test.go
@@ -74,10 +74,7 @@ func testProxyExitAfterAuth(t *testing.T, viaFlag bool) {
 	cluster := vault.NewTestCluster(t, coreConfig, &vault.TestClusterOptions{
 		HandlerFunc: vaulthttp.Handler,
 	})
-	cluster.Start()
-	defer cluster.Cleanup()
 
-	vault.TestWaitActive(t, cluster.Cores[0].Core)
 	client := cluster.Cores[0].Client
 
 	// Setup Vault
@@ -237,8 +234,6 @@ func TestProxy_NoTriggerAutoAuth_BadPolicy(t *testing.T) {
 		HandlerFunc: vaulthttp.Handler,
 		Logger:      vaultLogger,
 	})
-	cluster.Start()
-	defer cluster.Cleanup()
 
 	serverClient := cluster.Cores[0].Client
 
@@ -550,8 +545,6 @@ func TestProxy_ReTriggerAutoAuth_ForceAutoAuthToken(t *testing.T) {
 		HandlerFunc: vaulthttp.Handler,
 		Logger:      vaultLogger,
 	})
-	cluster.Start()
-	defer cluster.Cleanup()
 
 	serverClient := cluster.Cores[0].Client
 
@@ -709,8 +702,6 @@ func TestProxy_ReTriggerAutoAuth_ProxyIsAutoAuthToken(t *testing.T) {
 		HandlerFunc: vaulthttp.Handler,
 		Logger:      vaultLogger,
 	})
-	cluster.Start()
-	defer cluster.Cleanup()
 
 	serverClient := cluster.Cores[0].Client
 
@@ -899,8 +890,6 @@ func TestProxy_ReTriggerAutoAuth_RevokedToken(t *testing.T) {
 		HandlerFunc: vaulthttp.Handler,
 		Logger:      vaultLogger,
 	})
-	cluster.Start()
-	defer cluster.Cleanup()
 
 	serverClient := cluster.Cores[0].Client
 
@@ -1093,8 +1082,6 @@ func TestProxy_AutoAuth_UserAgent(t *testing.T) {
 				return &h
 			}),
 	})
-	cluster.Start()
-	defer cluster.Cleanup()
 
 	serverClient := cluster.Cores[0].Client
 
@@ -1240,8 +1227,6 @@ func TestProxy_APIProxyWithoutCache_UserAgent(t *testing.T) {
 				return &h
 			}),
 	})
-	cluster.Start()
-	defer cluster.Cleanup()
 
 	serverClient := cluster.Cores[0].Client
 
@@ -1326,8 +1311,6 @@ func TestProxy_APIProxyWithCache_UserAgent(t *testing.T) {
 				return &h
 			}),
 	})
-	cluster.Start()
-	defer cluster.Cleanup()
 
 	serverClient := cluster.Cores[0].Client
 
@@ -1403,8 +1386,6 @@ func TestProxy_Cache_DynamicSecret(t *testing.T) {
 	cluster := vault.NewTestCluster(t, nil, &vault.TestClusterOptions{
 		HandlerFunc: vaulthttp.Handler,
 	})
-	cluster.Start()
-	defer cluster.Cleanup()
 
 	serverClient := cluster.Cores[0].Client
 
@@ -1509,8 +1490,6 @@ func TestProxy_NoAutoAuthTokenIfNotConfigured(t *testing.T) {
 	cluster := vault.NewTestCluster(t, nil, &vault.TestClusterOptions{
 		HandlerFunc: vaulthttp.Handler,
 	})
-	cluster.Start()
-	defer cluster.Cleanup()
 
 	serverClient := cluster.Cores[0].Client
 
@@ -1636,10 +1615,7 @@ func TestProxy_ApiProxy_Retry(t *testing.T) {
 				return &h
 			}),
 		})
-	cluster.Start()
-	defer cluster.Cleanup()
 
-	vault.TestWaitActive(t, cluster.Cores[0].Core)
 	serverClient := cluster.Cores[0].Client
 
 	// Unset the environment variable so that proxy picks up the right test
@@ -1772,9 +1748,7 @@ func TestProxy_Metrics(t *testing.T) {
 		&vault.TestClusterOptions{
 			HandlerFunc: vaulthttp.Handler,
 		})
-	cluster.Start()
-	defer cluster.Cleanup()
-	vault.TestWaitActive(t, cluster.Cores[0].Core)
+
 	serverClient := cluster.Cores[0].Client
 
 	// Create a config file
diff --git a/command/status_test.go b/command/status_test.go
index 0d8a44729c..e4cb5a2add 100644
--- a/command/status_test.go
+++ b/command/status_test.go
@@ -33,7 +33,6 @@ func testStatusCommand(tb testing.TB) (*cli.MockUi, *StatusCommand) {
 func TestStatusCommand_RaftCluster(t *testing.T) {
 	t.Parallel()
 	cluster := testVaultRaftCluster(t)
-	defer cluster.Cleanup()
 
 	toRemove := cluster.Cores[1]
 	expectRemovedFromCluster := func(expectCode int, removed bool) {
diff --git a/helper/builtinplugins/builtinplugins_test.go b/helper/builtinplugins/builtinplugins_test.go
index 500663014b..e55bb8005c 100644
--- a/helper/builtinplugins/builtinplugins_test.go
+++ b/helper/builtinplugins/builtinplugins_test.go
@@ -50,9 +50,6 @@ func TestBuiltinPluginsWork(t *testing.T) {
 		},
 	)
 
-	cluster.Start()
-	defer cluster.Cleanup()
-
 	cores := cluster.Cores
 	vault.TestWaitActive(t, cores[0].Core)
 	client := cores[0].Client
diff --git a/helper/testhelpers/minimal/minimal.go b/helper/testhelpers/minimal/minimal.go
index a468b9bb7b..ba19423762 100644
--- a/helper/testhelpers/minimal/minimal.go
+++ b/helper/testhelpers/minimal/minimal.go
@@ -22,7 +22,7 @@ import (
 // NewTestSoloCluster is a simpler version of NewTestCluster that only creates
 // single-node clusters.  It is intentionally minimalist, if you need something
 // from vault.TestClusterOptions, use NewTestCluster instead.  It should work fine
-// with a nil config argument.  There is no need to call Start or Cleanup or
+// with a nil config argument. There is no need to call Cleanup or
 // TestWaitActive on the resulting cluster.
 func NewTestSoloCluster(t testing.TB, config *vault.CoreConfig) *vault.TestCluster {
 	logger := corehelpers.NewTestLogger(t)
diff --git a/helper/testhelpers/seal/sealhelper.go b/helper/testhelpers/seal/sealhelper.go
index 5c5b7e48c5..612daa549f 100644
--- a/helper/testhelpers/seal/sealhelper.go
+++ b/helper/testhelpers/seal/sealhelper.go
@@ -36,7 +36,6 @@ func NewTransitSealServer(t testing.TB, idx int) *TransitSealServer {
 	}
 	teststorage.InmemBackendSetup(conf, opts)
 	cluster := vault.NewTestCluster(t, conf, opts)
-	cluster.Start()
 
 	if err := cluster.Cores[0].Client.Sys().Mount("transit", &api.MountInput{
 		Type: "transit",
diff --git a/http/auth_token_test.go b/http/auth_token_test.go
index e0867cd098..f5b3898597 100644
--- a/http/auth_token_test.go
+++ b/http/auth_token_test.go
@@ -253,9 +253,6 @@ func TestToken_InvalidTokenError(t *testing.T) {
 		HandlerFunc: Handler,
 	})
 
-	cluster.Start()
-	defer cluster.Cleanup()
-
 	cores := cluster.Cores
 	vault.TestWaitActive(t, cores[0].Core)
 
diff --git a/http/forwarded_for_test.go b/http/forwarded_for_test.go
index e463b15699..0fc5eb7086 100644
--- a/http/forwarded_for_test.go
+++ b/http/forwarded_for_test.go
@@ -54,8 +54,6 @@ func TestHandler_XForwardedFor(t *testing.T) {
 		cluster := vault.NewTestCluster(t, nil, &vault.TestClusterOptions{
 			HandlerFunc: HandlerFunc(testHandler),
 		})
-		cluster.Start()
-		defer cluster.Cleanup()
 		client := cluster.Cores[0].Client
 
 		req := client.NewRequest("GET", "/")
@@ -97,8 +95,6 @@ func TestHandler_XForwardedFor(t *testing.T) {
 		cluster := vault.NewTestCluster(t, nil, &vault.TestClusterOptions{
 			HandlerFunc: HandlerFunc(testHandler),
 		})
-		cluster.Start()
-		defer cluster.Cleanup()
 		client := cluster.Cores[0].Client
 
 		req := client.NewRequest("GET", "/")
@@ -133,8 +129,6 @@ func TestHandler_XForwardedFor(t *testing.T) {
 		cluster := vault.NewTestCluster(t, nil, &vault.TestClusterOptions{
 			HandlerFunc: HandlerFunc(testHandler),
 		})
-		cluster.Start()
-		defer cluster.Cleanup()
 		client := cluster.Cores[0].Client
 
 		req := client.NewRequest("GET", "/")
@@ -167,8 +161,6 @@ func TestHandler_XForwardedFor(t *testing.T) {
 		cluster := vault.NewTestCluster(t, nil, &vault.TestClusterOptions{
 			HandlerFunc: HandlerFunc(testHandler),
 		})
-		cluster.Start()
-		defer cluster.Cleanup()
 		client := cluster.Cores[0].Client
 
 		req := client.NewRequest("GET", "/")
@@ -201,8 +193,6 @@ func TestHandler_XForwardedFor(t *testing.T) {
 		cluster := vault.NewTestCluster(t, nil, &vault.TestClusterOptions{
 			HandlerFunc: HandlerFunc(testHandler),
 		})
-		cluster.Start()
-		defer cluster.Cleanup()
 		client := cluster.Cores[0].Client
 
 		req := client.NewRequest("GET", "/")
@@ -238,8 +228,6 @@ func TestHandler_XForwardedFor(t *testing.T) {
 		cluster := vault.NewTestCluster(t, nil, &vault.TestClusterOptions{
 			HandlerFunc: HandlerFunc(testHandler),
 		})
-		cluster.Start()
-		defer cluster.Cleanup()
 		client := cluster.Cores[0].Client
 
 		req := client.NewRequest("GET", "/")
@@ -276,8 +264,6 @@ func TestHandler_XForwardedFor(t *testing.T) {
 		cluster := vault.NewTestCluster(t, nil, &vault.TestClusterOptions{
 			HandlerFunc: HandlerFunc(testHandler),
 		})
-		cluster.Start()
-		defer cluster.Cleanup()
 		client := cluster.Cores[0].Client
 
 		req := client.NewRequest("GET", "/")
@@ -313,8 +299,6 @@ func TestHandler_XForwardedFor(t *testing.T) {
 		cluster := vault.NewTestCluster(t, nil, &vault.TestClusterOptions{
 			HandlerFunc: HandlerFunc(testHandler),
 		})
-		cluster.Start()
-		defer cluster.Cleanup()
 		client := cluster.Cores[0].Client
 
 		req := client.NewRequest("GET", "/")
@@ -352,8 +336,6 @@ func TestHandler_XForwardedFor(t *testing.T) {
 		cluster := vault.NewTestCluster(t, nil, &vault.TestClusterOptions{
 			HandlerFunc: HandlerFunc(testHandler),
 		})
-		cluster.Start()
-		defer cluster.Cleanup()
 		client := cluster.Cores[0].Client
 
 		req := client.NewRequest("GET", "/")
@@ -393,8 +375,6 @@ func TestHandler_XForwardedFor(t *testing.T) {
 		cluster := vault.NewTestCluster(t, nil, &vault.TestClusterOptions{
 			HandlerFunc: HandlerFunc(testHandler),
 		})
-		cluster.Start()
-		defer cluster.Cleanup()
 		client := cluster.Cores[0].Client
 
 		req := client.NewRequest("GET", "/")
@@ -431,8 +411,6 @@ func TestHandler_XForwardedFor(t *testing.T) {
 		cluster := vault.NewTestCluster(t, nil, &vault.TestClusterOptions{
 			HandlerFunc: HandlerFunc(testHandler),
 		})
-		cluster.Start()
-		defer cluster.Cleanup()
 		client := cluster.Cores[0].Client
 
 		req := client.NewRequest("GET", "/")
@@ -459,8 +437,6 @@ func TestHandler_XForwardedFor(t *testing.T) {
 		cluster := vault.NewTestCluster(t, nil, &vault.TestClusterOptions{
 			HandlerFunc: HandlerFunc(testHandler),
 		})
-		cluster.Start()
-		defer cluster.Cleanup()
 		client := cluster.Cores[0].Client
 
 		req := client.NewRequest("GET", "/")
diff --git a/http/forwarding_bench_test.go b/http/forwarding_bench_test.go
index 1849791188..8392c6185d 100644
--- a/http/forwarding_bench_test.go
+++ b/http/forwarding_bench_test.go
@@ -35,8 +35,6 @@ func BenchmarkHTTP_Forwarding_Stress(b *testing.B) {
 		HandlerFunc: Handler,
 		Logger:      logging.NewVaultLoggerWithWriter(ioutil.Discard, log.Error),
 	})
-	cluster.Start()
-	defer cluster.Cleanup()
 	cores := cluster.Cores
 
 	// make it easy to get access to the active
diff --git a/http/forwarding_test.go b/http/forwarding_test.go
index 1e54a6b5c9..a8e9bb15ea 100644
--- a/http/forwarding_test.go
+++ b/http/forwarding_test.go
@@ -39,14 +39,8 @@ func TestHTTP_Fallback_Bad_Address(t *testing.T) {
 	cluster := vault.NewTestCluster(t, coreConfig, &vault.TestClusterOptions{
 		HandlerFunc: Handler,
 	})
-	cluster.Start()
-	defer cluster.Cleanup()
 	cores := cluster.Cores
 
-	// make it easy to get access to the active
-	core := cores[0].Core
-	vault.TestWaitActive(t, core)
-
 	addrs := []string{
 		fmt.Sprintf("https://127.0.0.1:%d", cores[1].Listeners[0].Address.Port),
 		fmt.Sprintf("https://127.0.0.1:%d", cores[2].Listeners[0].Address.Port),
@@ -87,14 +81,8 @@ func TestHTTP_Fallback_Disabled(t *testing.T) {
 	cluster := vault.NewTestCluster(t, coreConfig, &vault.TestClusterOptions{
 		HandlerFunc: Handler,
 	})
-	cluster.Start()
-	defer cluster.Cleanup()
 	cores := cluster.Cores
 
-	// make it easy to get access to the active
-	core := cores[0].Core
-	vault.TestWaitActive(t, core)
-
 	addrs := []string{
 		fmt.Sprintf("https://127.0.0.1:%d", cores[1].Listeners[0].Address.Port),
 		fmt.Sprintf("https://127.0.0.1:%d", cores[2].Listeners[0].Address.Port),
@@ -144,13 +132,8 @@ func testHTTP_Forwarding_Stress_Common(t *testing.T, parallel bool, num uint32)
 	cluster := vault.NewTestCluster(t, coreConfig, &vault.TestClusterOptions{
 		HandlerFunc: Handler,
 	})
-	cluster.Start()
-	defer cluster.Cleanup()
 	cores := cluster.Cores
-
-	// make it easy to get access to the active
 	core := cores[0].Core
-	vault.TestWaitActive(t, core)
 
 	wg := sync.WaitGroup{}
 
@@ -452,14 +435,8 @@ func TestHTTP_Forwarding_ClientTLS(t *testing.T) {
 	cluster := vault.NewTestCluster(t, coreConfig, &vault.TestClusterOptions{
 		HandlerFunc: Handler,
 	})
-	cluster.Start()
-	defer cluster.Cleanup()
 	cores := cluster.Cores
 
-	// make it easy to get access to the active
-	core := cores[0].Core
-	vault.TestWaitActive(t, core)
-
 	transport := cleanhttp.DefaultTransport()
 	transport.TLSClientConfig = cores[0].TLSConfig()
 	if err := http2.ConfigureTransport(transport); err != nil {
@@ -565,12 +542,8 @@ func TestHTTP_Forwarding_HelpOperation(t *testing.T) {
 	cluster := vault.NewTestCluster(t, &vault.CoreConfig{}, &vault.TestClusterOptions{
 		HandlerFunc: Handler,
 	})
-	cluster.Start()
-	defer cluster.Cleanup()
 	cores := cluster.Cores
 
-	vault.TestWaitActive(t, cores[0].Core)
-
 	testHelp := func(client *api.Client) {
 		help, err := client.Help("auth/token")
 		if err != nil {
@@ -589,12 +562,8 @@ func TestHTTP_Forwarding_LocalOnly(t *testing.T) {
 	cluster := vault.NewTestCluster(t, nil, &vault.TestClusterOptions{
 		HandlerFunc: Handler,
 	})
-	cluster.Start()
-	defer cluster.Cleanup()
 	cores := cluster.Cores
 
-	vault.TestWaitActive(t, cores[0].Core)
-
 	testLocalOnly := func(client *api.Client) {
 		_, err := client.Logical().Read("sys/config/state/sanitized")
 		if err == nil {
diff --git a/http/handler_test.go b/http/handler_test.go
index 0a8d6426a8..fb48fd9543 100644
--- a/http/handler_test.go
+++ b/http/handler_test.go
@@ -897,14 +897,8 @@ func TestHandler_Parse_Form(t *testing.T) {
 	cluster := vault.NewTestCluster(t, &vault.CoreConfig{}, &vault.TestClusterOptions{
 		HandlerFunc: Handler,
 	})
-	cluster.Start()
-	defer cluster.Cleanup()
-
 	cores := cluster.Cores
 
-	core := cores[0].Core
-	vault.TestWaitActive(t, core)
-
 	c := cleanhttp.DefaultClient()
 	c.Transport = &http.Transport{
 		TLSClientConfig: &tls.Config{
@@ -967,8 +961,6 @@ func TestHandler_MaxRequestSize(t *testing.T) {
 		HandlerFunc: Handler,
 		NumCores:    1,
 	})
-	cluster.Start()
-	defer cluster.Cleanup()
 
 	client := cluster.Cores[0].Client
 	_, err := client.KVv2("secret").Put(context.Background(), "foo", map[string]interface{}{
@@ -1203,8 +1195,6 @@ func TestHandler_JSONLimitQuotaWrappers(t *testing.T) {
 					},
 				},
 			})
-			cluster.Start()
-			defer cluster.Cleanup()
 
 			client := cluster.Cores[0].Client
 			client.SetToken(cluster.RootToken)
@@ -1253,9 +1243,6 @@ func TestAutoSnapshotLoadForwarded(t *testing.T) {
 		HandlerFunc: Handler,
 	})
 
-	cluster.Start()
-	defer cluster.Cleanup()
-
 	client := cluster.Cores[1].Client
 	client.SetToken(cluster.RootToken)
 
diff --git a/http/http_test.go b/http/http_test.go
index 654d269d19..1fead416c6 100644
--- a/http/http_test.go
+++ b/http/http_test.go
@@ -20,11 +20,6 @@ import (
 )
 
 func testHttpGet(t *testing.T, token string, addr string) *http.Response {
-	loggedToken := token
-	if len(token) == 0 {
-		loggedToken = "<empty>"
-	}
-	t.Logf("Token is %s", loggedToken)
 	return testHttpData(t, "GET", token, addr, "", nil, false, 0, false)
 }
 
diff --git a/http/logical_test.go b/http/logical_test.go
index ad22616e69..6e5ca3de0d 100644
--- a/http/logical_test.go
+++ b/http/logical_test.go
@@ -708,15 +708,7 @@ func TestLogical_AuditPort(t *testing.T) {
 	cluster := vault.NewTestCluster(t, coreConfig, &vault.TestClusterOptions{
 		HandlerFunc: Handler,
 	})
-
-	cluster.Start()
-	defer cluster.Cleanup()
-
-	cores := cluster.Cores
-
-	core := cores[0].Core
 	c := cluster.Cores[0].Client
-	vault.TestWaitActive(t, core)
 
 	if err := c.Sys().Mount("kv/", &api.MountInput{
 		Type: "kv-v2",
@@ -812,15 +804,7 @@ func TestLogical_ErrRelativePath(t *testing.T) {
 	cluster := vault.NewTestCluster(t, coreConfig, &vault.TestClusterOptions{
 		HandlerFunc: Handler,
 	})
-
-	cluster.Start()
-	defer cluster.Cleanup()
-
-	cores := cluster.Cores
-
-	core := cores[0].Core
 	c := cluster.Cores[0].Client
-	vault.TestWaitActive(t, core)
 
 	err := c.Sys().EnableAuthWithOptions("userpass", &api.EnableAuthOptions{
 		Type: "userpass",
@@ -917,15 +901,7 @@ func TestLogical_AuditEnabled_ShouldLogPluginMetadata_Auth(t *testing.T) {
 	cluster := vault.NewTestCluster(t, coreConfig, &vault.TestClusterOptions{
 		HandlerFunc: Handler,
 	})
-
-	cluster.Start()
-	defer cluster.Cleanup()
-
-	cores := cluster.Cores
-
-	core := cores[0].Core
 	c := cluster.Cores[0].Client
-	vault.TestWaitActive(t, core)
 
 	// Enable the audit backend
 	tempDir := t.TempDir()
@@ -997,15 +973,7 @@ func TestLogical_AuditEnabled_ShouldLogPluginMetadata_Secret(t *testing.T) {
 	cluster := vault.NewTestCluster(t, coreConfig, &vault.TestClusterOptions{
 		HandlerFunc: Handler,
 	})
-
-	cluster.Start()
-	defer cluster.Cleanup()
-
-	cores := cluster.Cores
-
-	core := cores[0].Core
 	c := cluster.Cores[0].Client
-	vault.TestWaitActive(t, core)
 
 	if err := c.Sys().Mount("kv/", &api.MountInput{
 		Type: "kv-v2",
diff --git a/http/plugin_test.go b/http/plugin_test.go
index 29a4e6b1a1..c1700b09cf 100644
--- a/http/plugin_test.go
+++ b/http/plugin_test.go
@@ -50,12 +50,10 @@ func getPluginClusterAndCore(t *testing.T, logger log.Logger) (*vault.TestCluste
 	cluster := vault.NewTestCluster(t, coreConfig, &vault.TestClusterOptions{
 		HandlerFunc: Handler,
 	})
-	cluster.Start()
 
 	cores := cluster.Cores
 	core := cores[0]
 
-	vault.TestWaitActive(t, core.Core)
 	vault.TestAddTestPlugin(t, core.Core, "mock-plugin", consts.PluginTypeSecrets, "", "TestPlugin_PluginMain",
 		[]string{fmt.Sprintf("%s=%s", pluginutil.PluginCACertPEMEnv, cluster.CACertPEMFile)})
 
@@ -101,8 +99,7 @@ func TestPlugin_MockList(t *testing.T) {
 	logger := log.New(&log.LoggerOptions{
 		Mutex: &sync.Mutex{},
 	})
-	cluster, core := getPluginClusterAndCore(t, logger)
-	defer cluster.Cleanup()
+	_, core := getPluginClusterAndCore(t, logger)
 
 	_, err := core.Client.Logical().Write("mock/kv/foo", map[string]interface{}{
 		"value": "baz",
@@ -139,8 +136,7 @@ func TestPlugin_MockRawResponse(t *testing.T) {
 	logger := log.New(&log.LoggerOptions{
 		Mutex: &sync.Mutex{},
 	})
-	cluster, core := getPluginClusterAndCore(t, logger)
-	defer cluster.Cleanup()
+	_, core := getPluginClusterAndCore(t, logger)
 
 	resp, err := core.Client.RawRequest(core.Client.NewRequest("GET", "/v1/mock/raw"))
 	if err != nil {
@@ -164,8 +160,7 @@ func TestPlugin_GetParams(t *testing.T) {
 	logger := log.New(&log.LoggerOptions{
 		Mutex: &sync.Mutex{},
 	})
-	cluster, core := getPluginClusterAndCore(t, logger)
-	defer cluster.Cleanup()
+	_, core := getPluginClusterAndCore(t, logger)
 
 	_, err := core.Client.Logical().Write("mock/kv/foo", map[string]interface{}{
 		"value": "baz",
diff --git a/http/sys_hostinfo_test.go b/http/sys_hostinfo_test.go
index 670f225413..fb79a1d95d 100644
--- a/http/sys_hostinfo_test.go
+++ b/http/sys_hostinfo_test.go
@@ -15,12 +15,8 @@ func TestSysHostInfo(t *testing.T) {
 	cluster := vault.NewTestCluster(t, &vault.CoreConfig{}, &vault.TestClusterOptions{
 		HandlerFunc: Handler,
 	})
-	cluster.Start()
-	defer cluster.Cleanup()
 	cores := cluster.Cores
 
-	vault.TestWaitActive(t, cores[0].Core)
-
 	// Query against the active node, should get host information back
 	secret, err := cores[0].Client.Logical().Read("sys/host-info")
 	if err != nil {
diff --git a/http/sys_init_test.go b/http/sys_init_test.go
index 72d9da4926..42c0d97567 100644
--- a/http/sys_init_test.go
+++ b/http/sys_init_test.go
@@ -168,8 +168,6 @@ func TestSysInit_Put_ValidateParams_AutoUnseal(t *testing.T) {
 		Logger:      corehelpers.NewTestLogger(t).Named("transit-seal" + strconv.Itoa(0)),
 	}
 	cluster := vault.NewTestCluster(t, conf, opts)
-	cluster.Start()
-	defer cluster.Cleanup()
 
 	cores := cluster.Cores
 	core := cores[0].Core
diff --git a/http/sys_monitor_test.go b/http/sys_monitor_test.go
index 91f39052b8..a079f020e3 100644
--- a/http/sys_monitor_test.go
+++ b/http/sys_monitor_test.go
@@ -20,7 +20,6 @@ func TestSysMonitorUnknownLogLevel(t *testing.T) {
 		HandlerFunc: Handler,
 		NumCores:    1,
 	})
-	defer cluster.Cleanup()
 
 	client := cluster.Cores[0].Client
 	request := client.NewRequest("GET", "/v1/sys/monitor")
@@ -46,7 +45,6 @@ func TestSysMonitorUnknownLogFormat(t *testing.T) {
 		HandlerFunc: Handler,
 		NumCores:    1,
 	})
-	defer cluster.Cleanup()
 
 	client := cluster.Cores[0].Client
 	request := client.NewRequest("GET", "/v1/sys/monitor")
@@ -72,7 +70,6 @@ func TestSysMonitorStreamingLogs(t *testing.T) {
 		HandlerFunc: Handler,
 		NumCores:    1,
 	})
-	defer cluster.Cleanup()
 
 	client := cluster.Cores[0].Client
 	stopCh := testhelpers.GenerateDebugLogs(t, client)
diff --git a/http/sys_rekey_test.go b/http/sys_rekey_test.go
index d5d8d06ce6..860e3300aa 100644
--- a/http/sys_rekey_test.go
+++ b/http/sys_rekey_test.go
@@ -23,8 +23,6 @@ func TestSysRekey_Init_pgpKeysEntriesForRekey(t *testing.T) {
 		HandlerFunc: Handler,
 		NumCores:    1,
 	})
-	cluster.Start()
-	defer cluster.Cleanup()
 	cl := cluster.Cores[0].Client
 
 	_, err := cl.Logical().Write("sys/rekey/init", map[string]interface{}{
@@ -42,7 +40,6 @@ func TestSysRekey_Init_Status(t *testing.T) {
 		HandlerFunc: Handler,
 		NumCores:    1,
 	})
-	defer cluster.Cleanup()
 	cl := cluster.Cores[0].Client
 
 	testCases := []struct {
@@ -126,8 +123,6 @@ func TestSysRekey_Init_Setup(t *testing.T) {
 			HandlerFunc: Handler,
 			NumCores:    1,
 		})
-		cluster.Start()
-		defer cluster.Cleanup()
 		cl := cluster.Cores[0].Client
 
 		// Start rekey
@@ -195,7 +190,6 @@ func TestSysRekey_Init_Cancel(t *testing.T) {
 			HandlerFunc: Handler,
 			NumCores:    1,
 		})
-		defer cluster.Cleanup()
 		cl := cluster.Cores[0].Client
 
 		initResp, err := cl.Logical().Write("sys/rekey/init", map[string]interface{}{
@@ -295,7 +289,6 @@ func TestSysRekey_Update(t *testing.T) {
 				HandlerFunc: Handler,
 				NumCores:    1,
 			})
-			defer cluster.Cleanup()
 			cl := cluster.Cores[0].Client
 
 			reqToken := ""
diff --git a/http/sys_wrapping_test.go b/http/sys_wrapping_test.go
index 9d97741dbe..60d18ccefa 100644
--- a/http/sys_wrapping_test.go
+++ b/http/sys_wrapping_test.go
@@ -20,15 +20,7 @@ func TestHTTP_Wrapping(t *testing.T) {
 	cluster := vault.NewTestCluster(t, &vault.CoreConfig{}, &vault.TestClusterOptions{
 		HandlerFunc: Handler,
 	})
-	cluster.Start()
-	defer cluster.Cleanup()
-
 	cores := cluster.Cores
-
-	// make it easy to get access to the active
-	core := cores[0].Core
-	vault.TestWaitActive(t, core)
-
 	client := cores[0].Client
 	client.SetToken(cluster.RootToken)
 
diff --git a/http/token_header_size_test.go b/http/token_header_size_test.go
index 40fa39b2b8..07be855943 100644
--- a/http/token_header_size_test.go
+++ b/http/token_header_size_test.go
@@ -44,7 +44,6 @@ func newTestClusterForTokenHeader(t *testing.T, opts *vault.TestClusterOptions)
 	}
 	opts.HandlerFunc = Handler
 	cluster := vault.NewTestCluster(t, nil, opts)
-	cluster.Start()
 
 	core := cluster.Cores[0]
 	transport := cleanhttp.DefaultPooledTransport()
diff --git a/http/unwrapping_raw_body_test.go b/http/unwrapping_raw_body_test.go
index e4b12c8894..50cce834c4 100644
--- a/http/unwrapping_raw_body_test.go
+++ b/http/unwrapping_raw_body_test.go
@@ -21,11 +21,6 @@ func TestUnwrapping_Raw_Body(t *testing.T) {
 	cluster := vault.NewTestCluster(t, coreConfig, &vault.TestClusterOptions{
 		HandlerFunc: Handler,
 	})
-	cluster.Start()
-	defer cluster.Cleanup()
-
-	core := cluster.Cores[0].Core
-	vault.TestWaitActive(t, core)
 	client := cluster.Cores[0].Client
 
 	// Mount a k/v backend, version 2
diff --git a/vault/audit_test.go b/vault/audit_test.go
index 76b34b2db8..24df2633dd 100644
--- a/vault/audit_test.go
+++ b/vault/audit_test.go
@@ -681,7 +681,6 @@ func TestAuditBroker_AuditHeaders(t *testing.T) {
 // only options on a non-Enterprise version of Vault.
 func TestAudit_enableAudit(t *testing.T) {
 	cluster := NewTestCluster(t, nil, &TestClusterOptions{NumCores: 1})
-	defer cluster.Cleanup()
 
 	c := cluster.Cores[0]
 
@@ -707,7 +706,6 @@ func TestAudit_enableAudit(t *testing.T) {
 // with Enterprise only options on a non-Enterprise version of Vault.
 func TestAudit_newAuditBackend(t *testing.T) {
 	cluster := NewTestCluster(t, nil, &TestClusterOptions{NumCores: 1})
-	defer cluster.Cleanup()
 
 	c := cluster.Cores[0]
 
diff --git a/vault/bench/smoke_bench_test.go b/vault/bench/smoke_bench_test.go
index 4b6acc07b4..aa090e3dcd 100644
--- a/vault/bench/smoke_bench_test.go
+++ b/vault/bench/smoke_bench_test.go
@@ -74,10 +74,9 @@ func BenchmarkSmoke_ClusterCreation(b *testing.B) {
 	bench := func(b *testing.B) {
 		b.ResetTimer()
 		for i := 0; i < b.N; i++ {
-			cluster := vault.NewTestCluster(b, &vault.CoreConfig{}, &vault.TestClusterOptions{
+			_ = vault.NewTestCluster(b, &vault.CoreConfig{}, &vault.TestClusterOptions{
 				HandlerFunc: vaulthttp.Handler,
 			})
-			cluster.Cleanup()
 		}
 	}
 
diff --git a/vault/cluster_test.go b/vault/cluster_test.go
index 4f0d9d9652..195e392314 100644
--- a/vault/cluster_test.go
+++ b/vault/cluster_test.go
@@ -98,8 +98,6 @@ func TestCluster_ListenForRequests(t *testing.T) {
 	cluster := NewTestCluster(t, nil, &TestClusterOptions{
 		KeepStandbysSealed: true,
 	})
-	cluster.Start()
-	defer cluster.Cleanup()
 	cores := cluster.Cores
 
 	// Wait for core to become active
@@ -216,8 +214,6 @@ func testCluster_ForwardRequestsCommon(t *testing.T, clusterOpts *TestClusterOpt
 		w.WriteHeader(203)
 		w.Write([]byte("core3"))
 	})
-	cluster.Start()
-	defer cluster.Cleanup()
 
 	root := cluster.RootToken
 
diff --git a/vault/dynamic_system_view_test.go b/vault/dynamic_system_view_test.go
index 8c029a63f3..e2df352bb4 100644
--- a/vault/dynamic_system_view_test.go
+++ b/vault/dynamic_system_view_test.go
@@ -47,9 +47,6 @@ func TestIdentity_BackendTemplating(t *testing.T) {
 
 	cluster := NewTestCluster(t, coreConfig, &TestClusterOptions{})
 
-	cluster.Start()
-	defer cluster.Cleanup()
-
 	core := cluster.Cores[0].Core
 
 	TestWaitActive(t, core)
@@ -181,9 +178,6 @@ func TestDynamicSystemView_GeneratePasswordFromPolicy_successful(t *testing.T) {
 
 	cluster := NewTestCluster(t, coreConfig, &TestClusterOptions{})
 
-	cluster.Start()
-	defer cluster.Cleanup()
-
 	core := cluster.Cores[0].Core
 	TestWaitActive(t, core)
 
@@ -296,9 +290,6 @@ func TestDynamicSystemView_PluginEnv_successful(t *testing.T) {
 
 	cluster := NewTestCluster(t, coreConfig, &TestClusterOptions{})
 
-	cluster.Start()
-	defer cluster.Cleanup()
-
 	core := cluster.Cores[0].Core
 	TestWaitActive(t, core)
 
diff --git a/vault/external_plugin_container_test.go b/vault/external_plugin_container_test.go
index 3aa429c8ad..230dccb9a8 100644
--- a/vault/external_plugin_container_test.go
+++ b/vault/external_plugin_container_test.go
@@ -43,9 +43,6 @@ func testClusterWithContainerPlugins(t *testing.T, types []consts.PluginType) (*
 		Plugins: plugins,
 	})
 
-	cluster.Start()
-	t.Cleanup(cluster.Cleanup)
-
 	core := cluster.Cores[0]
 	TestWaitActive(t, core.Core)
 
diff --git a/vault/external_plugin_test.go b/vault/external_plugin_test.go
index ca13d7464a..25f51be4d8 100644
--- a/vault/external_plugin_test.go
+++ b/vault/external_plugin_test.go
@@ -75,9 +75,6 @@ func TestCore_EnableExternalPlugin(t *testing.T) {
 				},
 			})
 
-			cluster.Start()
-			defer cluster.Cleanup()
-
 			c := cluster.Cores[0].Core
 			TestWaitActive(t, c)
 
diff --git a/vault/external_tests/activity_testonly/activity_testonly_oss_test.go b/vault/external_tests/activity_testonly/activity_testonly_oss_test.go
index 70018c3122..3e51c03317 100644
--- a/vault/external_tests/activity_testonly/activity_testonly_oss_test.go
+++ b/vault/external_tests/activity_testonly/activity_testonly_oss_test.go
@@ -79,8 +79,6 @@ func Test_ActivityLog_LoseLeadership(t *testing.T) {
 		HandlerFunc: vaulthttp.Handler,
 		NumCores:    2,
 	})
-	cluster.Start()
-	defer cluster.Cleanup()
 
 	active := testhelpers.DeriveStableActiveCore(t, cluster)
 	client := active.Client
diff --git a/vault/external_tests/api/api_integration_test.go b/vault/external_tests/api/api_integration_test.go
index c1f6c54681..94f604cc86 100644
--- a/vault/external_tests/api/api_integration_test.go
+++ b/vault/external_tests/api/api_integration_test.go
@@ -59,7 +59,6 @@ func testVaultServerCoreConfig(t testing.TB, coreConfig *vault.CoreConfig) (*api
 		HandlerFunc: http.Handler,
 		NumCores:    1,
 	})
-	cluster.Start()
 
 	// Make it easy to get access to the active
 	core := cluster.Cores[0].Core
@@ -76,5 +75,5 @@ func testVaultServerCoreConfig(t testing.TB, coreConfig *vault.CoreConfig) (*api
 		unsealKeys[i] = base64.StdEncoding.EncodeToString(cluster.BarrierKeys[i])
 	}
 
-	return client, unsealKeys, func() { defer cluster.Cleanup() }
+	return client, unsealKeys, func() {}
 }
diff --git a/vault/external_tests/api/feature_flag_ext_test.go b/vault/external_tests/api/feature_flag_ext_test.go
index 3c7f0216ba..765ac17c70 100644
--- a/vault/external_tests/api/feature_flag_ext_test.go
+++ b/vault/external_tests/api/feature_flag_ext_test.go
@@ -22,12 +22,6 @@ func TestFeatureFlags(t *testing.T) {
 		HandlerFunc:             vaulthttp.Handler,
 		RequestResponseCallback: schema.ResponseValidatingCallback(t),
 	})
-	cluster.Start()
-	defer cluster.Cleanup()
-
-	// Wait for core to start
-	core := cluster.Cores[0].Core
-	vault.TestWaitActive(t, core)
 	client := cluster.Cores[0].Client
 
 	// Create a raw http connection copying the configuration
diff --git a/vault/external_tests/api/kv_helpers_test.go b/vault/external_tests/api/kv_helpers_test.go
index f0f1714291..7388450865 100644
--- a/vault/external_tests/api/kv_helpers_test.go
+++ b/vault/external_tests/api/kv_helpers_test.go
@@ -63,9 +63,6 @@ func TestKVHelpers(t *testing.T) {
 		HandlerFunc: vaulthttp.Handler,
 	})
 
-	cluster.Start()
-	defer cluster.Cleanup()
-
 	cores := cluster.Cores
 	core := cores[0].Core
 	client := cluster.Cores[0].Client
diff --git a/vault/external_tests/api/sys_rekey_ext_test.go b/vault/external_tests/api/sys_rekey_ext_test.go
index 960a206f10..de323151c8 100644
--- a/vault/external_tests/api/sys_rekey_ext_test.go
+++ b/vault/external_tests/api/sys_rekey_ext_test.go
@@ -67,10 +67,7 @@ func testSysRekey_Verification(t *testing.T, recovery bool, legacyShamir bool) {
 		Physical: inm,
 	}
 	cluster := vault.NewTestCluster(t, &conf, opts)
-	cluster.Start()
-	defer cluster.Cleanup()
 
-	vault.TestWaitActive(t, cluster.Cores[0].Core)
 	client := cluster.Cores[0].Client
 	client.SetMaxRetries(0)
 
@@ -221,7 +218,6 @@ func testSysRekey_Verification(t *testing.T, recovery bool, legacyShamir bool) {
 		// still be the old keys (which are still currently set)
 		cluster.EnsureCoresSealed(t)
 		cluster.UnsealCores(t)
-		vault.TestWaitActive(t, cluster.Cores[0].Core)
 
 		// Should be able to init again and get back to where we were
 		doRekeyInitialSteps()
@@ -257,8 +253,6 @@ func testSysRekey_Verification(t *testing.T, recovery bool, legacyShamir bool) {
 		opts.SealFunc = nil // post rekey we should use the barrier config on disk
 		cluster = vault.NewTestCluster(t, &conf, opts)
 		cluster.BarrierKeys = oldKeys
-		cluster.Start()
-		defer cluster.Cleanup()
 
 		if err := cluster.UnsealCoresWithError(t, false); err == nil {
 			t.Fatal("expected error")
diff --git a/vault/external_tests/audit/audit_test.go b/vault/external_tests/audit/audit_test.go
index f06aa6a4b4..2cde861e31 100644
--- a/vault/external_tests/audit/audit_test.go
+++ b/vault/external_tests/audit/audit_test.go
@@ -356,7 +356,6 @@ func TestAudit_BeforePostUnseal(t *testing.T) {
 		HandlerFunc: vaulthttp.Handler,
 		NumCores:    1,
 	})
-	defer cluster.Cleanup()
 
 	testhelpers.WaitForActiveNode(t, cluster)
 	err := cluster.Cores[0].Client.Sys().Mount("test", &api.MountInput{
diff --git a/vault/external_tests/delegated_auth/delegated_auth_test.go b/vault/external_tests/delegated_auth/delegated_auth_test.go
index c33914997f..407ee1f811 100644
--- a/vault/external_tests/delegated_auth/delegated_auth_test.go
+++ b/vault/external_tests/delegated_auth/delegated_auth_test.go
@@ -139,8 +139,6 @@ func TestDelegatedAuth(t *testing.T) {
 	}
 
 	cluster := minimal.NewTestSoloCluster(t, coreConfig)
-	cluster.Start()
-	defer cluster.Cleanup()
 
 	client := testhelpers.WaitForActiveNode(t, cluster).Client
 
diff --git a/vault/external_tests/hcp_link/hcp_link_test.go b/vault/external_tests/hcp_link/hcp_link_test.go
index 66632eb61b..43e188a2d2 100644
--- a/vault/external_tests/hcp_link/hcp_link_test.go
+++ b/vault/external_tests/hcp_link/hcp_link_test.go
@@ -12,7 +12,6 @@ import (
 
 func TestHCPLinkConnected(t *testing.T) {
 	cluster := getTestCluster(t, 2)
-	defer cluster.Cleanup()
 
 	vaultHCPLink, _ := TestClusterWithHCPLinkEnabled(t, cluster, false, false)
 	defer vaultHCPLink.Cleanup()
@@ -25,9 +24,7 @@ func TestHCPLinkConnected(t *testing.T) {
 func TestHCPLinkNotConfigured(t *testing.T) {
 	t.Parallel()
 	cluster := getTestCluster(t, 2)
-	defer cluster.Cleanup()
 
-	cluster.Start()
 	core := cluster.Cores[0].Core
 	vault.TestWaitActive(t, core)
 
diff --git a/vault/external_tests/hcp_link/test_helpers.go b/vault/external_tests/hcp_link/test_helpers.go
index 3befd86d4e..14111e7bb8 100644
--- a/vault/external_tests/hcp_link/test_helpers.go
+++ b/vault/external_tests/hcp_link/test_helpers.go
@@ -103,8 +103,6 @@ func TestClusterWithHCPLinkEnabled(t *testing.T, cluster *vault.TestCluster, ena
 	}
 	hcpLinkIns := NewVaultHCPLinkInstances()
 
-	cluster.Start()
-
 	core := cluster.Cores[0].Core
 	vault.TestWaitActive(t, core)
 
diff --git a/vault/external_tests/identity/login_mfa_totp_test.go b/vault/external_tests/identity/login_mfa_totp_test.go
index 2fe798fbc1..4616609444 100644
--- a/vault/external_tests/identity/login_mfa_totp_test.go
+++ b/vault/external_tests/identity/login_mfa_totp_test.go
@@ -70,9 +70,6 @@ func TestLoginMfaGenerateTOTPTestAuditIncluded(t *testing.T) {
 			HandlerFunc: vaulthttp.Handler,
 		})
 
-	cluster.Start()
-	defer cluster.Cleanup()
-
 	client := cluster.Cores[0].Client
 
 	// Enable the audit backend
diff --git a/vault/external_tests/identity/oidc_provider_test.go b/vault/external_tests/identity/oidc_provider_test.go
index 7880ea6ba8..78d2814a3c 100644
--- a/vault/external_tests/identity/oidc_provider_test.go
+++ b/vault/external_tests/identity/oidc_provider_test.go
@@ -48,7 +48,6 @@ const (
 // an initial setup of Vault.
 func TestOIDC_Auth_Code_Flow_Default_Resources(t *testing.T) {
 	cluster := setupOIDCTestCluster(t, 2)
-	defer cluster.Cleanup()
 	active := cluster.Cores[0].Client
 	standby := cluster.Cores[1].Client
 
@@ -271,7 +270,6 @@ func TestOIDC_Auth_Code_Flow_Default_Resources(t *testing.T) {
 // a client secret and authenticates to the token endpoint.
 func TestOIDC_Auth_Code_Flow_Confidential_CAP_Client(t *testing.T) {
 	cluster := setupOIDCTestCluster(t, 2)
-	defer cluster.Cleanup()
 	active := cluster.Cores[0].Client
 	standby := cluster.Cores[1].Client
 
@@ -621,7 +619,6 @@ func TestOIDC_Auth_Code_Flow_Confidential_CAP_Client(t *testing.T) {
 // and always uses proof key for code exchange (PKCE).
 func TestOIDC_Auth_Code_Flow_Public_CAP_Client(t *testing.T) {
 	cluster := setupOIDCTestCluster(t, 2)
-	defer cluster.Cleanup()
 	active := cluster.Cores[0].Client
 	standby := cluster.Cores[1].Client
 
@@ -963,8 +960,6 @@ func setupOIDCTestCluster(t *testing.T, numCores int) *vault.TestCluster {
 		HandlerFunc: vaulthttp.Handler,
 	}
 	cluster := vault.NewTestCluster(t, coreConfig, clusterOptions)
-	cluster.Start()
-	vault.TestWaitActive(t, cluster.Cores[0].Core)
 
 	return cluster
 }
diff --git a/vault/external_tests/identity/userlockouts_test.go b/vault/external_tests/identity/userlockouts_test.go
index 091e03068d..4d9df9af7c 100644
--- a/vault/external_tests/identity/userlockouts_test.go
+++ b/vault/external_tests/identity/userlockouts_test.go
@@ -38,8 +38,6 @@ func TestIdentityStore_DisableUserLockoutTest(t *testing.T) {
 	cluster := vault.NewTestCluster(t, coreConfig, &vault.TestClusterOptions{
 		HandlerFunc: vaulthttp.Handler,
 	})
-	cluster.Start()
-	defer cluster.Cleanup()
 
 	// standby client
 	client := cluster.Cores[1].Client
diff --git a/vault/external_tests/kv/kvv2_upgrade_test.go b/vault/external_tests/kv/kvv2_upgrade_test.go
index 04a4e7f7e5..d96d381077 100644
--- a/vault/external_tests/kv/kvv2_upgrade_test.go
+++ b/vault/external_tests/kv/kvv2_upgrade_test.go
@@ -42,11 +42,8 @@ func TestKVv2_UpgradePaths(t *testing.T) {
 	cluster := vault.NewTestCluster(t, coreConfig, &vault.TestClusterOptions{
 		HandlerFunc: vaulthttp.Handler,
 	})
-	cluster.Start()
-	defer cluster.Cleanup()
 
 	core := cluster.Cores[0]
-	vault.TestWaitActive(t, core.Core)
 	client := core.Client
 
 	// Enable KVv2
diff --git a/vault/external_tests/metrics/core_metrics_int_test.go b/vault/external_tests/metrics/core_metrics_int_test.go
index 5153405b98..efcf1cc5cb 100644
--- a/vault/external_tests/metrics/core_metrics_int_test.go
+++ b/vault/external_tests/metrics/core_metrics_int_test.go
@@ -30,13 +30,7 @@ func TestMountTableMetrics(t *testing.T) {
 		NumCores:               2,
 		CoreMetricSinkProvider: testhelpers.TestMetricSinkProvider(time.Minute),
 	})
-
-	cluster.Start()
-	defer cluster.Cleanup()
-
-	// Wait for core to become active
 	cores := cluster.Cores
-	vault.TestWaitActive(t, cores[0].Core)
 
 	client := cores[0].Client
 
@@ -120,13 +114,7 @@ func TestLeaderReElectionMetrics(t *testing.T) {
 		NumCores:               2,
 		CoreMetricSinkProvider: testhelpers.TestMetricSinkProvider(time.Minute),
 	})
-
-	cluster.Start()
-	defer cluster.Cleanup()
-
-	// Wait for core to become active
 	cores := cluster.Cores
-	vault.TestWaitActive(t, cores[0].Core)
 
 	client := cores[0].Client
 	standbyClient := cores[1].Client
diff --git a/vault/external_tests/mfa/login_mfa_test.go b/vault/external_tests/mfa/login_mfa_test.go
index 97e9c9c631..3dc26b205b 100644
--- a/vault/external_tests/mfa/login_mfa_test.go
+++ b/vault/external_tests/mfa/login_mfa_test.go
@@ -327,11 +327,6 @@ func TestLoginMFA_ListAllMFAConfigsGlobally(t *testing.T) {
 	}, &vault.TestClusterOptions{
 		HandlerFunc: vaulthttp.Handler,
 	})
-	cluster.Start()
-	defer cluster.Cleanup()
-
-	core := cluster.Cores[0].Core
-	vault.TestWaitActive(t, core)
 	client := cluster.Cores[0].Client
 
 	// Enable userpass authentication
diff --git a/vault/external_tests/misc/recover_from_panic_test.go b/vault/external_tests/misc/recover_from_panic_test.go
index c0f0277016..64f6a91146 100644
--- a/vault/external_tests/misc/recover_from_panic_test.go
+++ b/vault/external_tests/misc/recover_from_panic_test.go
@@ -25,11 +25,8 @@ func TestRecoverFromPanic(t *testing.T) {
 	cluster := vault.NewTestCluster(t, coreConfig, &vault.TestClusterOptions{
 		HandlerFunc: vaulthttp.Handler,
 	})
-	cluster.Start()
-	defer cluster.Cleanup()
 
 	core := cluster.Cores[0]
-	vault.TestWaitActive(t, core.Core)
 	client := core.Client
 
 	err := client.Sys().Mount("noop", &api.MountInput{
diff --git a/vault/external_tests/misc/recovery_test.go b/vault/external_tests/misc/recovery_test.go
index 8904c90a15..dfcf29033c 100644
--- a/vault/external_tests/misc/recovery_test.go
+++ b/vault/external_tests/misc/recovery_test.go
@@ -36,8 +36,6 @@ func TestRecovery(t *testing.T) {
 		}
 
 		cluster := vault.NewTestCluster(t, &conf, &opts)
-		cluster.Start()
-		defer cluster.Cleanup()
 
 		client := cluster.Cores[0].Client
 		rootToken = client.Token()
@@ -84,8 +82,6 @@ func TestRecovery(t *testing.T) {
 		}
 		cluster := vault.NewTestCluster(t, &conf, &opts)
 		cluster.BarrierKeys = keys
-		cluster.Start()
-		defer cluster.Cleanup()
 
 		client := cluster.Cores[0].Client
 		recoveryToken := testhelpers.GenerateRoot(t, cluster, testhelpers.GenerateRecovery)
@@ -122,8 +118,6 @@ func TestRecovery(t *testing.T) {
 		}
 		cluster := vault.NewTestCluster(t, &conf, &opts)
 		cluster.BarrierKeys = keys
-		cluster.Start()
-		defer cluster.Cleanup()
 
 		testhelpers.EnsureCoresUnsealed(t, cluster)
 		vault.TestWaitActive(t, cluster.Cores[0].Core)
diff --git a/vault/external_tests/plugin/external_plugin_test.go b/vault/external_tests/plugin/external_plugin_test.go
index dfb9faa870..9f9009aca9 100644
--- a/vault/external_tests/plugin/external_plugin_test.go
+++ b/vault/external_tests/plugin/external_plugin_test.go
@@ -59,9 +59,6 @@ func getCluster(t *testing.T, numCores int, types ...consts.PluginType) *vault.T
 		HandlerFunc: vaulthttp.Handler,
 	})
 
-	cluster.Start()
-	vault.TestWaitActive(t, cluster.Cores[0].Core)
-
 	return cluster
 }
 
@@ -88,9 +85,6 @@ func TestExternalPlugin_RollbackAndReload(t *testing.T) {
 		HandlerFunc: vaulthttp.Handler,
 	})
 
-	cluster.Start()
-	vault.TestWaitActive(t, cluster.Cores[0].Core)
-
 	core := cluster.Cores[0]
 	plugin := cluster.Plugins[0]
 	client := core.Client
@@ -183,7 +177,6 @@ func TestExternalPlugin_ContinueOnError(t *testing.T) {
 
 func testExternalPlugin_ContinueOnError(t *testing.T, mismatch bool, pluginType consts.PluginType) {
 	cluster := getCluster(t, 1, pluginType)
-	t.Cleanup(cluster.Cleanup)
 
 	core := cluster.Cores[0]
 	plugin := cluster.Plugins[0]
@@ -293,7 +286,6 @@ func TestExternalPlugin_AuthMethod(t *testing.T) {
 	// getCluster calls pluginhelper.CompilePlugin which builds the approle
 	// auth method as a stand-in for the PluginTypeCredential
 	cluster := getCluster(t, 5, consts.PluginTypeCredential)
-	t.Cleanup(cluster.Cleanup)
 
 	plugin := cluster.Plugins[0]
 	client := cluster.Cores[0].Client
@@ -412,7 +404,6 @@ func TestExternalPlugin_AuthMethod(t *testing.T) {
 // method after reload
 func TestExternalPlugin_AuthMethodReload(t *testing.T) {
 	cluster := getCluster(t, 1, consts.PluginTypeCredential)
-	t.Cleanup(cluster.Cleanup)
 
 	plugin := cluster.Plugins[0]
 	client := cluster.Cores[0].Client
@@ -494,7 +485,6 @@ func TestExternalPlugin_SecretsEngine(t *testing.T) {
 	// getCluster calls pluginhelper.CompilePlugin which builds the consul
 	// secrets engine as a stand-in for the PluginTypeSecrets
 	cluster := getCluster(t, 1, consts.PluginTypeSecrets)
-	t.Cleanup(cluster.Cleanup)
 
 	plugin := cluster.Plugins[0]
 	client := cluster.Cores[0].Client
@@ -598,7 +588,6 @@ func TestExternalPlugin_SecretsEngine(t *testing.T) {
 func TestExternalPlugin_SecretsEngineReload(t *testing.T) {
 	t.Parallel()
 	cluster := getCluster(t, 1, consts.PluginTypeSecrets)
-	t.Cleanup(cluster.Cleanup)
 
 	plugin := cluster.Plugins[0]
 	client := cluster.Cores[0].Client
@@ -671,7 +660,6 @@ func TestExternalPlugin_Database(t *testing.T) {
 	// getCluster calls pluginhelper.CompilePlugin which builds the postgres
 	// database engine as a stand-in for the PluginTypeSecrets
 	cluster := getCluster(t, 1, consts.PluginTypeDatabase)
-	t.Cleanup(cluster.Cleanup)
 
 	plugin := cluster.Plugins[0]
 	client := cluster.Cores[0].Client
@@ -805,7 +793,6 @@ func TestExternalPlugin_Database(t *testing.T) {
 func TestExternalPlugin_DatabaseReload(t *testing.T) {
 	t.Parallel()
 	cluster := getCluster(t, 1, consts.PluginTypeDatabase)
-	t.Cleanup(cluster.Cleanup)
 
 	plugin := cluster.Plugins[0]
 	client := cluster.Cores[0].Client
@@ -940,7 +927,6 @@ func testExternalPluginMetadataAuditLog(t *testing.T, log map[string]interface{}
 // in audit log when it is enabled
 func TestExternalPlugin_AuditEnabled_ShouldLogPluginMetadata_Auth(t *testing.T) {
 	cluster := getCluster(t, 1, consts.PluginTypeCredential)
-	t.Cleanup(cluster.Cleanup)
 
 	plugin := cluster.Plugins[0]
 	client := cluster.Cores[0].Client
@@ -1018,7 +1004,6 @@ func TestExternalPlugin_AuditEnabled_ShouldLogPluginMetadata_Auth(t *testing.T)
 // in audit log when it is enabled
 func TestExternalPlugin_AuditEnabled_ShouldLogPluginMetadata_Secret(t *testing.T) {
 	cluster := getCluster(t, 1, consts.PluginTypeSecrets)
-	t.Cleanup(cluster.Cleanup)
 
 	plugin := cluster.Plugins[0]
 	client := cluster.Cores[0].Client
@@ -1174,7 +1159,6 @@ func expectRunningVersion(t *testing.T, client *api.Client, plugin pluginhelpers
 // of upgrading an external plugin gated by pinned versions.
 func TestCore_UpgradePluginUsingPinnedVersion_AuthAndSecret(t *testing.T) {
 	cluster := getCluster(t, 1, consts.PluginTypeCredential, consts.PluginTypeSecrets)
-	t.Cleanup(cluster.Cleanup)
 
 	client := cluster.Cores[0].Client
 
@@ -1226,7 +1210,6 @@ func TestCore_UpgradePluginUsingPinnedVersion_AuthAndSecret(t *testing.T) {
 // of upgrading an external database plugin gated by pinned versions.
 func TestCore_UpgradePluginUsingPinnedVersion_Database(t *testing.T) {
 	cluster := getCluster(t, 3, consts.PluginTypeDatabase)
-	t.Cleanup(cluster.Cleanup)
 
 	client := cluster.Cores[0].Client
 	plugin := cluster.Plugins[0]
diff --git a/vault/external_tests/plugin/plugin_test.go b/vault/external_tests/plugin/plugin_test.go
index c343a5140a..1049ee6515 100644
--- a/vault/external_tests/plugin/plugin_test.go
+++ b/vault/external_tests/plugin/plugin_test.go
@@ -62,7 +62,6 @@ func TestSystemBackend_Plugin_secret(t *testing.T) {
 		t.Run(tc.pluginVersion, func(t *testing.T) {
 			t.Parallel()
 			cluster := testSystemBackendMock(t, 1, 1, logical.TypeLogical, tc.pluginVersion)
-			defer cluster.Cleanup()
 
 			core := cluster.Cores[0]
 
@@ -132,7 +131,6 @@ func TestSystemBackend_Plugin_auth(t *testing.T) {
 		t.Run(tc.pluginVersion, func(t *testing.T) {
 			t.Parallel()
 			cluster := testSystemBackendMock(t, 1, 1, logical.TypeCredential, tc.pluginVersion)
-			defer cluster.Cleanup()
 
 			core := cluster.Cores[0]
 
@@ -162,9 +160,6 @@ func TestSystemBackend_Plugin_auth(t *testing.T) {
 				if core.Sealed() {
 					t.Fatal("should not be sealed")
 				}
-				// Wait for active so post-unseal takes place
-				// If it fails, it means unseal process failed
-				vault.TestWaitActive(t, core.Core)
 			}
 		})
 	}
@@ -190,7 +185,6 @@ func TestSystemBackend_Plugin_MissingBinary(t *testing.T) {
 		t.Run(tc.pluginVersion, func(t *testing.T) {
 			t.Parallel()
 			cluster := testSystemBackendMock(t, 1, 1, logical.TypeLogical, tc.pluginVersion)
-			defer cluster.Cleanup()
 
 			core := cluster.Cores[0]
 
@@ -250,7 +244,6 @@ func TestSystemBackend_Plugin_MismatchType(t *testing.T) {
 	for _, tc := range testCases {
 		t.Run(tc.pluginVersion, func(t *testing.T) {
 			cluster := testSystemBackendMock(t, 1, 1, logical.TypeLogical, tc.pluginVersion)
-			defer cluster.Cleanup()
 
 			core := cluster.Cores[0]
 
@@ -310,7 +303,6 @@ func testPlugin_CatalogRemoved(t *testing.T, btype logical.BackendType, testMoun
 		t.Run(tc.pluginVersion, func(t *testing.T) {
 			t.Parallel()
 			cluster := testSystemBackendMock(t, 1, 1, logical.TypeLogical, tc.pluginVersion)
-			defer cluster.Cleanup()
 
 			core := cluster.Cores[0]
 
@@ -389,7 +381,6 @@ func TestSystemBackend_Plugin_autoReload(t *testing.T) {
 		t.Run(tc.pluginVersion, func(t *testing.T) {
 			t.Parallel()
 			cluster := testSystemBackendMock(t, 1, 1, logical.TypeLogical, tc.pluginVersion)
-			defer cluster.Cleanup()
 
 			core := cluster.Cores[0]
 
@@ -449,7 +440,6 @@ func TestSystemBackend_Plugin_SealUnseal(t *testing.T) {
 		t.Run(tc.pluginVersion, func(t *testing.T) {
 			t.Parallel()
 			cluster := testSystemBackendMock(t, 1, 1, logical.TypeLogical, tc.pluginVersion)
-			defer cluster.Cleanup()
 
 			// Seal the cluster
 			cluster.EnsureCoresSealed(t)
@@ -563,7 +553,6 @@ func testSystemBackend_PluginReload(t *testing.T, path string, reqData map[strin
 	for _, tc := range testCases {
 		t.Run(tc.pluginVersion, func(t *testing.T) {
 			cluster := testSystemBackendMock(t, 1, 2, backendType, tc.pluginVersion)
-			defer cluster.Cleanup()
 
 			core := cluster.Cores[0]
 			client := core.Client
@@ -610,7 +599,6 @@ func testSystemBackend_PluginReload(t *testing.T, path string, reqData map[strin
 
 func TestSystemBackend_PluginReload_WarningIfNoneReloaded(t *testing.T) {
 	cluster := testSystemBackendMock(t, 1, 2, logical.TypeLogical, "v5")
-	defer cluster.Cleanup()
 
 	core := cluster.Cores[0]
 	client := core.Client
@@ -662,7 +650,6 @@ func testSystemBackendMock(t *testing.T, numCores, numMounts int, backendType lo
 	cluster := vault.NewTestCluster(t, conf, opts)
 
 	core := cluster.Cores[0]
-	vault.TestWaitActive(t, core.Core)
 	client := core.Client
 
 	env := []string{pluginutil.PluginCACertPEMEnv + "=" + cluster.CACertPEMFile}
@@ -720,11 +707,8 @@ func TestSystemBackend_Plugin_Env(t *testing.T) {
 		NumCores:    1,
 		TempDir:     pluginDir,
 	})
-	cluster.Start()
-	t.Cleanup(cluster.Cleanup)
 
 	core := cluster.Cores[0]
-	vault.TestWaitActive(t, core.Core)
 	client := core.Client
 
 	key := t.Name() + "_FOO"
diff --git a/vault/external_tests/policy/policy_test.go b/vault/external_tests/policy/policy_test.go
index e87b32f063..a50ed6c588 100644
--- a/vault/external_tests/policy/policy_test.go
+++ b/vault/external_tests/policy/policy_test.go
@@ -31,9 +31,6 @@ func TestPolicy_NoDefaultPolicy(t *testing.T) {
 		HandlerFunc: vaulthttp.Handler,
 	})
 
-	cluster.Start()
-	defer cluster.Cleanup()
-
 	cores := cluster.Cores
 
 	vault.TestWaitActive(t, cores[0].Core)
@@ -203,8 +200,6 @@ func TestPolicy_TokenRenewal(t *testing.T) {
 			cluster := vault.NewTestCluster(t, coreConfig, &vault.TestClusterOptions{
 				HandlerFunc: vaulthttp.Handler,
 			})
-			cluster.Start()
-			defer cluster.Cleanup()
 
 			core := cluster.Cores[0].Core
 			vault.TestWaitActive(t, core)
diff --git a/vault/external_tests/pprof/pprof_binary/pprof_test.go b/vault/external_tests/pprof/pprof_binary/pprof_test.go
index 2dd48004e7..d89bda1a90 100644
--- a/vault/external_tests/pprof/pprof_binary/pprof_test.go
+++ b/vault/external_tests/pprof/pprof_binary/pprof_test.go
@@ -28,7 +28,6 @@ func TestSysPprof_Exec(t *testing.T) {
 		BinaryPath:        binary,
 		BaseListenAddress: "127.0.0.1:8208",
 	})
-	defer cluster.Cleanup()
 
 	pprof.SysPprof_Test(t, cluster)
 }
diff --git a/vault/external_tests/pprof/pprof_test.go b/vault/external_tests/pprof/pprof_test.go
index afcad849f2..95414ed369 100644
--- a/vault/external_tests/pprof/pprof_test.go
+++ b/vault/external_tests/pprof/pprof_test.go
@@ -37,8 +37,6 @@ func TestSysPprof(t *testing.T) {
 		HandlerFunc:             vaulthttp.Handler,
 		RequestResponseCallback: schema.ResponseValidatingCallback(t),
 	})
-	cluster.Start()
-	defer cluster.Cleanup()
 
 	core := cluster.Cores[0].Core
 	vault.TestWaitActive(t, core)
@@ -58,8 +56,6 @@ func TestSysPprof_MaxRequestDuration(t *testing.T) {
 	cluster := vault.NewTestCluster(t, nil, &vault.TestClusterOptions{
 		HandlerFunc: vaulthttp.Handler,
 	})
-	cluster.Start()
-	defer cluster.Cleanup()
 	client := cluster.Cores[0].Client
 
 	transport := cleanhttp.DefaultPooledTransport()
diff --git a/vault/external_tests/quotas/quotas_test.go b/vault/external_tests/quotas/quotas_test.go
index 40fbbff45f..f4e7331556 100644
--- a/vault/external_tests/quotas/quotas_test.go
+++ b/vault/external_tests/quotas/quotas_test.go
@@ -161,11 +161,7 @@ func TestQuotas_RateLimit_DupName(t *testing.T) {
 	opts.NoDefaultQuotas = true
 	opts.RequestResponseCallback = schema.ResponseValidatingCallback(t)
 	cluster := vault.NewTestCluster(t, conf, opts)
-	cluster.Start()
-	defer cluster.Cleanup()
-	core := cluster.Cores[0].Core
 	client := cluster.Cores[0].Client
-	vault.TestWaitActive(t, core)
 
 	// create a rate limit quota w/ 'secret' path
 	_, err := client.Logical().Write("sys/quotas/rate-limit/secret-rlq", map[string]interface{}{
@@ -197,12 +193,8 @@ func TestQuotas_RateLimit_DupPath(t *testing.T) {
 	opts.NoDefaultQuotas = true
 	opts.RequestResponseCallback = schema.ResponseValidatingCallback(t)
 	cluster := vault.NewTestCluster(t, conf, opts)
-	cluster.Start()
-	defer cluster.Cleanup()
-
-	core := cluster.Cores[0].Core
 	client := cluster.Cores[0].Client
-	vault.TestWaitActive(t, core)
+
 	// create a global rate limit quota
 	_, err := client.Logical().Write("sys/quotas/rate-limit/global-rlq", map[string]interface{}{
 		"rate": 10,
@@ -237,12 +229,7 @@ func TestQuotas_RateLimitQuota_ExemptPaths(t *testing.T) {
 	opts.NoDefaultQuotas = true
 	opts.RequestResponseCallback = schema.ResponseValidatingCallback(t)
 	cluster := vault.NewTestCluster(t, conf, opts)
-	cluster.Start()
-	defer cluster.Cleanup()
-
-	core := cluster.Cores[0].Core
 	client := cluster.Cores[0].Client
-	vault.TestWaitActive(t, core)
 
 	_, err := client.Logical().Write("sys/quotas/rate-limit/rlq", map[string]interface{}{
 		"rate": 7.7,
@@ -289,12 +276,7 @@ func TestQuotas_RateLimitQuota_DefaultExemptPaths(t *testing.T) {
 	opts.NoDefaultQuotas = true
 	opts.RequestResponseCallback = schema.ResponseValidatingCallback(t)
 	cluster := vault.NewTestCluster(t, conf, opts)
-	cluster.Start()
-	defer cluster.Cleanup()
-
-	core := cluster.Cores[0].Core
 	client := cluster.Cores[0].Client
-	vault.TestWaitActive(t, core)
 
 	_, err := client.Logical().Write("sys/quotas/rate-limit/rlq", map[string]interface{}{
 		"rate": 1,
@@ -318,12 +300,7 @@ func TestQuotas_RateLimitQuota_DefaultExemptPaths(t *testing.T) {
 func TestQuotas_RateLimitQuota_Mount(t *testing.T) {
 	conf, opts := teststorage.ClusterSetup(coreConfig, nil, nil)
 	cluster := vault.NewTestCluster(t, conf, opts)
-	cluster.Start()
-	defer cluster.Cleanup()
-
-	core := cluster.Cores[0].Core
 	client := cluster.Cores[0].Client
-	vault.TestWaitActive(t, core)
 
 	err := client.Sys().Mount("pki", &api.MountInput{
 		Type: "pki",
@@ -407,14 +384,8 @@ func TestQuotas_RateLimitQuota_MountPrecedence(t *testing.T) {
 	conf, opts := teststorage.ClusterSetup(coreConfig, nil, nil)
 	opts.NoDefaultQuotas = true
 	cluster := vault.NewTestCluster(t, conf, opts)
-	cluster.Start()
-	defer cluster.Cleanup()
-
-	core := cluster.Cores[0].Core
 	client := cluster.Cores[0].Client
 
-	vault.TestWaitActive(t, core)
-
 	// create PKI mount
 	err := client.Sys().Mount("pki", &api.MountInput{
 		Type: "pki",
@@ -494,14 +465,8 @@ func TestQuotas_RateLimitQuota(t *testing.T) {
 	conf, opts := teststorage.ClusterSetup(coreConfig, nil, nil)
 	opts.NoDefaultQuotas = true
 	cluster := vault.NewTestCluster(t, conf, opts)
-	cluster.Start()
-	defer cluster.Cleanup()
-
-	core := cluster.Cores[0].Core
 	client := cluster.Cores[0].Client
 
-	vault.TestWaitActive(t, core)
-
 	err := client.Sys().EnableAuthWithOptions("userpass", &api.EnableAuthOptions{
 		Type: "userpass",
 	})
@@ -573,14 +538,8 @@ func TestQuotas_RateLimitQuota_GroupByConfig(t *testing.T) {
 	conf, opts := teststorage.ClusterSetup(coreConfig, nil, nil)
 	opts.NoDefaultQuotas = true
 	cluster := vault.NewTestCluster(t, conf, opts)
-	cluster.Start()
-	t.Cleanup(cluster.Cleanup)
-
-	core := cluster.Cores[0].Core
 	client := cluster.Cores[0].Client
 
-	vault.TestWaitActive(t, core)
-
 	testCases := map[string]struct {
 		reqData              map[string]interface{}
 		expectedErr          string
@@ -757,8 +716,6 @@ func TestQuotas_RateLimitQuota_GroupByConfig(t *testing.T) {
 func TestQuotas_RateLimit_ZeroRetryRegression(t *testing.T) {
 	conf, opts := teststorage.ClusterSetup(coreConfig, nil, nil)
 	cluster := vault.NewTestCluster(t, conf, opts)
-	cluster.Start()
-	defer cluster.Cleanup()
 
 	testhelpers.WaitForActiveNode(t, cluster)
 	client := cluster.Cores[0].Client
@@ -799,7 +756,6 @@ func TestQuotas_RateLimit_NilStorage_ResolveRole(t *testing.T) {
 		NumCores:    1,
 	}, nil)
 	cluster := vault.NewTestCluster(t, conf, opts)
-	defer cluster.Cleanup()
 	client := cluster.Cores[0].Client
 
 	// Enable our custom panic auth method which will panic on nil storage
diff --git a/vault/external_tests/raft/raft_autopilot_test.go b/vault/external_tests/raft/raft_autopilot_test.go
index 01ae5111c2..27672b8384 100644
--- a/vault/external_tests/raft/raft_autopilot_test.go
+++ b/vault/external_tests/raft/raft_autopilot_test.go
@@ -33,7 +33,6 @@ func TestRaft_Autopilot_Disable(t *testing.T) {
 		InmemCluster:         true,
 		// Not setting EnableAutopilot here.
 	})
-	defer cluster.Cleanup()
 
 	cli := cluster.Cores[0].Client
 	state, err := cli.Sys().RaftAutopilotState()
@@ -62,7 +61,6 @@ func TestRaft_Autopilot_BinaryVersionPlumbing(t *testing.T) {
 	require.Empty(t, coreCfg.EffectiveSDKVersion)
 
 	c := vault.NewTestCluster(t, coreCfg, &clusterOpts)
-	defer c.Cleanup()
 
 	// Wait for follower to be perf standby (in Ent, in CE it will only wait for
 	// active). In either Enterprise or CE case, this should pass if we've plumbed
@@ -89,7 +87,6 @@ func TestRaft_Autopilot_Stabilization_And_State(t *testing.T) {
 			"performance_multiplier": "5",
 		},
 	})
-	defer cluster.Cleanup()
 
 	// Check that autopilot execution state is running
 	client := cluster.Cores[0].Client
@@ -160,7 +157,6 @@ func TestRaft_Autopilot_Configuration(t *testing.T) {
 		InmemCluster:         true,
 		EnableAutopilot:      true,
 	})
-	defer cluster.Cleanup()
 
 	client := cluster.Cores[0].Client
 	configCheckFunc := func(config *api.AutopilotConfig) {
@@ -267,7 +263,6 @@ func TestRaft_Autopilot_Stabilization_Delay(t *testing.T) {
 	})
 
 	cluster := vault.NewTestCluster(t, conf, &opts)
-	defer cluster.Cleanup()
 	testhelpers.WaitForActiveNode(t, cluster)
 
 	// Check that autopilot execution state is running
@@ -363,7 +358,6 @@ func TestRaft_AutoPilot_Peersets_Equivalent(t *testing.T) {
 		EnableAutopilot:      true,
 		DisableFollowerJoins: true,
 	})
-	defer cluster.Cleanup()
 	testhelpers.WaitForActiveNode(t, cluster)
 
 	// Create a very large stabilization time so we can test the state between
@@ -423,7 +417,6 @@ func TestRaft_VotersStayVoters(t *testing.T) {
 			2: version.Version,
 		},
 	})
-	defer cluster.Cleanup()
 	testhelpers.WaitForActiveNode(t, cluster)
 
 	client := cluster.Cores[0].Client
@@ -472,7 +465,6 @@ func TestRaft_Autopilot_DeadServerCleanup(t *testing.T) {
 		EnableAutopilot:      true,
 		NumCores:             4,
 	})
-	defer cluster.Cleanup()
 	testhelpers.WaitForActiveNode(t, cluster)
 
 	// Join 2 extra nodes manually, store the 3rd for later
diff --git a/vault/external_tests/raft/raft_binary/raft_test.go b/vault/external_tests/raft/raft_binary/raft_test.go
index 8c1f516ac3..d3ca8d904a 100644
--- a/vault/external_tests/raft/raft_binary/raft_test.go
+++ b/vault/external_tests/raft/raft_binary/raft_test.go
@@ -53,7 +53,7 @@ func TestRaft_Configuration_Docker(t *testing.T) {
 	defer cluster.Cleanup()
 	rafttest.Raft_Configuration_Test(t, cluster)
 
-	if err := cluster.AddNode(context.TODO(), opts); err != nil {
+	if err := cluster.AddNode(context.Background(), opts); err != nil {
 		t.Fatal(err)
 	}
 	rafttest.Raft_Configuration_Test(t, cluster)
diff --git a/vault/external_tests/raft/raft_test.go b/vault/external_tests/raft/raft_test.go
index 2764f3f9f0..170cc02f8e 100644
--- a/vault/external_tests/raft/raft_test.go
+++ b/vault/external_tests/raft/raft_test.go
@@ -113,7 +113,6 @@ func raftClusterBuilder(t testing.TB, ropts *RaftClusterOpts) (*vault.CoreConfig
 func raftCluster(t testing.TB, ropts *RaftClusterOpts) (*vault.TestCluster, *vault.TestClusterOptions) {
 	conf, opts := raftClusterBuilder(t, ropts)
 	cluster := vault.NewTestCluster(t, conf, &opts)
-	vault.TestWaitActive(t, cluster.Cores[0].Core)
 	return cluster, &opts
 }
 
@@ -132,9 +131,6 @@ func TestRaft_BoltDBMetrics(t *testing.T) {
 		},
 	}
 	cluster := vault.NewTestCluster(t, conf, &opts)
-	defer cluster.Cleanup()
-
-	vault.TestWaitActive(t, cluster.Cores[0].Core)
 	leaderClient := cluster.Cores[0].Client
 
 	// Write a few keys
@@ -176,7 +172,6 @@ func TestRaft_RetryAutoJoin(t *testing.T) {
 		InmemCluster:         true,
 		DisableFollowerJoins: true,
 	})
-	defer cluster.Cleanup()
 
 	leaderCore := cluster.Cores[0]
 
@@ -210,7 +205,6 @@ func TestRaft_Retry_Join(t *testing.T) {
 		InmemCluster:         true,
 		DisableFollowerJoins: true,
 	})
-	defer cluster.Cleanup()
 
 	leaderCore := cluster.Cores[0]
 	leaderAPI := leaderCore.Client.Address()
@@ -244,7 +238,6 @@ func TestRaft_Retry_Join(t *testing.T) {
 	// Unseal the leader and wait for the other cores to unseal
 	cluster.UnsealCore(t, leaderCore)
 	wg.Wait()
-
 	vault.TestWaitActive(t, leaderCore.Core)
 
 	corehelpers.RetryUntil(t, 10*time.Second, func() error {
@@ -266,7 +259,6 @@ func TestRaftChallenge_sameAnswerSameID_concurrent(t *testing.T) {
 		DisableFollowerJoins: true,
 		NumCores:             1,
 	})
-	defer cluster.Cleanup()
 	client := cluster.Cores[0].Client
 
 	challenges := make(chan string, 15)
@@ -303,7 +295,6 @@ func TestRaftChallenge_sameAnswerSameID(t *testing.T) {
 		DisableFollowerJoins: true,
 		NumCores:             1,
 	})
-	defer cluster.Cleanup()
 	client := cluster.Cores[0].Client
 	res, err := client.Logical().Write("sys/storage/raft/bootstrap/challenge", map[string]interface{}{
 		"server_id": "node1",
@@ -335,7 +326,6 @@ func TestRaftChallenge_evicted(t *testing.T) {
 		DisableFollowerJoins: true,
 		NumCores:             1,
 	})
-	defer cluster.Cleanup()
 	firstResponse := map[string]interface{}{}
 	client := cluster.Cores[0].Client
 	for i := 0; i < vault.RaftInitialChallengeLimit+1; i++ {
@@ -391,7 +381,6 @@ func TestRaft_ChallengeSpam(t *testing.T) {
 	cluster, _ := raftCluster(t, &RaftClusterOpts{
 		DisableFollowerJoins: true,
 	})
-	defer cluster.Cleanup()
 
 	// Execute 2 * MaxInFlightRequests, over a period that should allow some to proceed as the token bucket
 	// refills.
@@ -424,7 +413,6 @@ func TestRaft_Join(t *testing.T) {
 	cluster, _ := raftCluster(t, &RaftClusterOpts{
 		DisableFollowerJoins: true,
 	})
-	defer cluster.Cleanup()
 
 	leaderCore := cluster.Cores[0]
 	leaderAPI := leaderCore.Client.Address()
@@ -471,7 +459,6 @@ func TestRaft_Join(t *testing.T) {
 func TestRaft_RemovePeer(t *testing.T) {
 	t.Parallel()
 	cluster, _ := raftCluster(t, nil)
-	defer cluster.Cleanup()
 
 	for i, c := range cluster.Cores {
 		if c.Core.Sealed() {
@@ -545,7 +532,6 @@ func TestRaft_NodeIDHeader(t *testing.T) {
 	for _, tc := range testCases {
 		t.Run(tc.description, func(t *testing.T) {
 			cluster, _ := raftCluster(t, tc.ropts)
-			defer cluster.Cleanup()
 
 			for i, c := range cluster.Cores {
 				if c.Core.Sealed() {
@@ -582,14 +568,12 @@ func TestRaft_NodeIDHeader(t *testing.T) {
 func TestRaft_Configuration(t *testing.T) {
 	t.Parallel()
 	cluster, _ := raftCluster(t, nil)
-	defer cluster.Cleanup()
 	Raft_Configuration_Test(t, cluster)
 }
 
 func TestRaft_ShamirUnseal(t *testing.T) {
 	t.Parallel()
 	cluster, _ := raftCluster(t, nil)
-	defer cluster.Cleanup()
 
 	for i, c := range cluster.Cores {
 		if c.Core.Sealed() {
@@ -601,7 +585,6 @@ func TestRaft_ShamirUnseal(t *testing.T) {
 func TestRaft_SnapshotAPI(t *testing.T) {
 	t.Parallel()
 	cluster, _ := raftCluster(t, nil)
-	defer cluster.Cleanup()
 
 	leaderClient := cluster.Cores[0].Client
 
@@ -665,7 +648,6 @@ func TestRaft_SnapshotAPI_MidstreamFailure(t *testing.T) {
 		NumCores: 1,
 		Seal:     autoSeal,
 	})
-	defer cluster.Cleanup()
 
 	leaderClient := cluster.Cores[0].Client
 
@@ -770,7 +752,6 @@ func TestRaft_SnapshotAPI_RekeyRotate_Backward(t *testing.T) {
 			cluster, _ := raftCluster(t, &RaftClusterOpts{
 				DisablePerfStandby: tCaseLocal.DisablePerfStandby,
 			})
-			defer cluster.Cleanup()
 
 			leaderClient := cluster.Cores[0].Client
 
@@ -974,7 +955,6 @@ func TestRaft_SnapshotAPI_RekeyRotate_Forward(t *testing.T) {
 			cluster, _ := raftCluster(t, &RaftClusterOpts{
 				DisablePerfStandby: tCaseLocal.DisablePerfStandby,
 			})
-			defer cluster.Cleanup()
 
 			leaderClient := cluster.Cores[0].Client
 
@@ -1161,7 +1141,6 @@ func TestRaft_SnapshotAPI_RekeyRotate_Forward(t *testing.T) {
 func TestRaft_SnapshotAPI_DifferentCluster(t *testing.T) {
 	t.Parallel()
 	cluster, _ := raftCluster(t, nil)
-	defer cluster.Cleanup()
 
 	leaderClient := cluster.Cores[0].Client
 
@@ -1207,7 +1186,6 @@ func TestRaft_SnapshotAPI_DifferentCluster(t *testing.T) {
 	// Cluster 2
 	{
 		cluster2, _ := raftCluster(t, nil)
-		defer cluster2.Cleanup()
 
 		leaderClient := cluster2.Cores[0].Client
 
@@ -1254,7 +1232,6 @@ func TestRaft_SnapshotAPI_DifferentCluster(t *testing.T) {
 
 func BenchmarkRaft_SingleNode(b *testing.B) {
 	cluster, _ := raftCluster(b, nil)
-	defer cluster.Cleanup()
 
 	leaderClient := cluster.Cores[0].Client
 
@@ -1288,7 +1265,6 @@ func TestRaft_Join_InitStatus(t *testing.T) {
 		InmemCluster:         true,
 		DisableFollowerJoins: true,
 	})
-	defer cluster.Cleanup()
 
 	leaderCore := cluster.Cores[0]
 	leaderAPI := leaderCore.Client.Address()
@@ -1372,7 +1348,6 @@ func TestRaft_Join_InitStatus(t *testing.T) {
 func TestRaftCluster_Removed(t *testing.T) {
 	t.Parallel()
 	cluster, _ := raftCluster(t, nil)
-	defer cluster.Cleanup()
 
 	follower := cluster.Cores[2]
 	followerClient := follower.Client
@@ -1417,7 +1392,6 @@ func TestRaftCluster_Removed_RaftConfig(t *testing.T) {
 	conf, opts := raftClusterBuilder(t, nil)
 	conf.ClusterHeartbeatInterval = 5 * time.Minute
 	cluster := vault.NewTestCluster(t, conf, &opts)
-	vault.TestWaitActive(t, cluster.Cores[0].Core)
 
 	follower := cluster.Cores[2]
 	followerClient := follower.Client
@@ -1458,7 +1432,6 @@ func TestSysHealth_Raft(t *testing.T) {
 		ClusterHeartbeatInterval: heartbeat,
 	}
 	vaultCluster := vault.NewTestCluster(t, conf, opts)
-	defer vaultCluster.Cleanup()
 	testhelpers.WaitForActiveNodeAndStandbys(t, vaultCluster)
 	followerClient := vaultCluster.Cores[1].Client
 
@@ -1565,7 +1538,6 @@ func TestSysHealth_Raft(t *testing.T) {
 func TestRaftCluster_Removed_ReAdd(t *testing.T) {
 	t.Parallel()
 	cluster, _ := raftCluster(t, nil)
-	defer cluster.Cleanup()
 
 	leader := cluster.Cores[0]
 	follower := cluster.Cores[2]
@@ -1589,7 +1561,6 @@ func TestCore_RaftDataDirPath(t *testing.T) {
 	t.Run("raft", func(t *testing.T) {
 		t.Parallel()
 		cluster, _ := raftCluster(t, nil)
-		defer cluster.Cleanup()
 		path, ok := cluster.Cores[0].RaftDataDirPath()
 		require.True(t, ok)
 		require.NotEmpty(t, path)
@@ -1608,7 +1579,6 @@ func TestCore_RaftDataDirPath(t *testing.T) {
 		opts := vault.TestClusterOptions{HandlerFunc: vaulthttp.Handler}
 		teststorage.RaftHASetup(&conf, &opts, teststorage.MakeFileBackend)
 		cluster := vault.NewTestCluster(t, &conf, &opts)
-		defer cluster.Cleanup()
 		path, ok := cluster.Cores[0].RaftDataDirPath()
 		require.False(t, ok)
 		require.Empty(t, path)
@@ -1631,9 +1601,6 @@ func TestRaft_SnapshotLargerMaxRequestSize(t *testing.T) {
 	}
 
 	cluster := vault.NewTestCluster(t, conf, &opts)
-	vault.TestWaitActive(t, cluster.Cores[0].Core)
-	defer cluster.Cleanup()
-
 	client := cluster.Cores[0].Client
 	for i := 0; i < 4096; i++ {
 		path, err := uuid.GenerateUUID()
diff --git a/vault/external_tests/raftha/raft_ha_test.go b/vault/external_tests/raftha/raft_ha_test.go
index d52b01b87f..3f836586cf 100644
--- a/vault/external_tests/raftha/raft_ha_test.go
+++ b/vault/external_tests/raftha/raft_ha_test.go
@@ -78,7 +78,6 @@ func testRaftHANewCluster(t *testing.T, bundler teststorage.PhysicalBackendBundl
 
 	teststorage.RaftHASetup(&conf, &opts, bundler)
 	cluster := vault.NewTestCluster(t, &conf, &opts)
-	defer cluster.Cleanup()
 
 	joinFunc := func(client *api.Client, addClientCerts bool) {
 		req := &api.RaftJoinRequest{
@@ -223,7 +222,6 @@ func testRaftHARecoverCluster(t *testing.T, physBundle *vault.PhysicalBackendBun
 	// Ensure no writes are happening before we try to clean it up, to prevent
 	// issues deleting the files.
 	clusterRestored.EnsureCoresSealed(t)
-	clusterRestored.Cleanup()
 }
 
 func TestRaft_HA_ExistingCluster(t *testing.T) {
@@ -249,8 +247,6 @@ func TestRaft_HA_ExistingCluster(t *testing.T) {
 		clusterRootToken   string
 	)
 	createCluster := func(t *testing.T) {
-		t.Log("simulating cluster creation without raft as HABackend")
-
 		storage.Setup(&conf, &opts)
 
 		cluster := vault.NewTestCluster(t, &conf, &opts)
@@ -269,8 +265,6 @@ func TestRaft_HA_ExistingCluster(t *testing.T) {
 	defer haCleanup()
 
 	updateCluster := func(t *testing.T) {
-		t.Log("simulating cluster update with raft as HABackend")
-
 		opts.SkipInit = true
 		haStorage.Setup(&conf, &opts)
 
@@ -342,8 +336,6 @@ func TestRaftHACluster_Removed_ReAdd(t *testing.T) {
 	opts := vault.TestClusterOptions{HandlerFunc: vaulthttp.Handler}
 	teststorage.RaftHASetup(&conf, &opts, teststorage.MakeFileBackend)
 	cluster := vault.NewTestCluster(t, &conf, &opts)
-	defer cluster.Cleanup()
-	vault.TestWaitActive(t, cluster.Cores[0].Core)
 
 	leader := cluster.Cores[0]
 	follower := cluster.Cores[2]
diff --git a/vault/external_tests/response/allowed_response_headers_test.go b/vault/external_tests/response/allowed_response_headers_test.go
index 4225ad1b2a..624dacb673 100644
--- a/vault/external_tests/response/allowed_response_headers_test.go
+++ b/vault/external_tests/response/allowed_response_headers_test.go
@@ -67,11 +67,6 @@ func TestIdentityStore_EntityDisabled(t *testing.T) {
 	cluster := vault.NewTestCluster(t, coreConfig, &vault.TestClusterOptions{
 		HandlerFunc: vaulthttp.Handler,
 	})
-	cluster.Start()
-	defer cluster.Cleanup()
-
-	core := cluster.Cores[0].Core
-	vault.TestWaitActive(t, core)
 	client := cluster.Cores[0].Client
 
 	// Mount the auth backend
diff --git a/vault/external_tests/sealmigration/testshared.go b/vault/external_tests/sealmigration/testshared.go
index eb91379bec..eff73cf9b1 100644
--- a/vault/external_tests/sealmigration/testshared.go
+++ b/vault/external_tests/sealmigration/testshared.go
@@ -109,7 +109,6 @@ func ParamTestSealMigrationTransitToShamir_Post14(t *testing.T, logger hclog.Log
 	opts.SealFunc = func() vault.Seal { return nil }
 	leaderIdx := migratePost14(t, storage, cluster, opts, cluster.RecoveryKeys)
 	validateMigration(t, storage, cluster, leaderIdx, verifySealConfigShamir)
-
 	cluster.Cleanup()
 	storage.Cleanup(t, cluster)
 
@@ -218,7 +217,6 @@ func migrateFromTransitToShamir_Pre14(t *testing.T, logger hclog.Logger, storage
 	storage.Setup(&conf, &opts)
 	conf.DisableAutopilot = true
 	cluster := vault.NewTestCluster(t, &conf, &opts)
-	cluster.Start()
 	defer func() {
 		cluster.Cleanup()
 		storage.Cleanup(t, cluster)
@@ -299,7 +297,6 @@ func migrateFromShamirToTransit_Pre14(t *testing.T, logger hclog.Logger, storage
 	}
 	storage.Setup(&conf, &opts)
 	cluster := vault.NewTestCluster(t, &conf, &opts)
-	cluster.Start()
 	defer func() {
 		cluster.Cleanup()
 		storage.Cleanup(t, cluster)
@@ -591,7 +588,6 @@ func initializeShamir(t *testing.T, logger hclog.Logger, storage teststorage.Reu
 	}
 	storage.Setup(&conf, &opts)
 	cluster := vault.NewTestCluster(t, &conf, &opts)
-	cluster.Start()
 
 	leader := cluster.Cores[0]
 	client := leader.Client
@@ -645,7 +641,6 @@ func runShamir(t *testing.T, logger hclog.Logger, storage teststorage.ReusableSt
 	}
 	storage.Setup(&conf, &opts)
 	cluster := vault.NewTestCluster(t, &conf, &opts)
-	cluster.Start()
 	defer func() {
 		cluster.Cleanup()
 		storage.Cleanup(t, cluster)
@@ -723,7 +718,6 @@ func InitializeTransit(t *testing.T, logger hclog.Logger, storage teststorage.Re
 	}
 	storage.Setup(&conf, &opts)
 	cluster := vault.NewTestCluster(t, &conf, &opts)
-	cluster.Start()
 
 	leader := cluster.Cores[0]
 	client := leader.Client
@@ -777,7 +771,6 @@ func runAutoseal(t *testing.T, logger hclog.Logger, storage teststorage.Reusable
 	}
 	storage.Setup(&conf, &opts)
 	cluster := vault.NewTestCluster(t, &conf, &opts)
-	cluster.Start()
 	defer func() {
 		cluster.Cleanup()
 		storage.Cleanup(t, cluster)
diff --git a/vault/external_tests/standby/standby_test.go b/vault/external_tests/standby/standby_test.go
index 6fb4f832ca..26f6695550 100644
--- a/vault/external_tests/standby/standby_test.go
+++ b/vault/external_tests/standby/standby_test.go
@@ -47,7 +47,6 @@ func Test_Echo_Duration_Skew(t *testing.T) {
 			opts.Logger = logger
 			conf.DisablePerformanceStandby = !perfstandby
 			cluster := vault.NewTestCluster(t, conf, opts)
-			defer cluster.Cleanup()
 
 			ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
 			defer cancel()
diff --git a/vault/logical_system_integ_test.go b/vault/logical_system_integ_test.go
index 42253cca28..428f9a3632 100644
--- a/vault/logical_system_integ_test.go
+++ b/vault/logical_system_integ_test.go
@@ -170,8 +170,6 @@ func TestSystemBackend_HAStatus(t *testing.T) {
 		HandlerFunc: vaulthttp.Handler,
 	}
 	cluster := vault.NewTestCluster(t, conf, opts)
-	cluster.Start()
-	defer cluster.Cleanup()
 
 	corehelpers.RetryUntil(t, 15*time.Second, func() error {
 		// Use standby deliberately to make sure it forwards
diff --git a/vault/logical_system_test.go b/vault/logical_system_test.go
index 27f4bfeece..aabb5dc26d 100644
--- a/vault/logical_system_test.go
+++ b/vault/logical_system_test.go
@@ -7383,9 +7383,6 @@ func TestPathInternalUICustomMessagesCommon(t *testing.T) {
 func TestGetLeaderStatus_RedactionSettings(t *testing.T) {
 	testCluster := NewTestCluster(t, nil, nil)
 
-	testCluster.Start()
-	defer testCluster.Cleanup()
-
 	testCore := testCluster.Cores[0]
 
 	// Check with no redaction settings
@@ -7422,9 +7419,6 @@ func TestGetSealStatus_RedactionSettings(t *testing.T) {
 		ClusterName: "secret-cluster-name",
 	}, nil)
 
-	testCluster.Start()
-	defer testCluster.Cleanup()
-
 	testCore := testCluster.Cores[0]
 
 	// Check with no redaction settings
diff --git a/vault/sealunwrapper_test.go b/vault/sealunwrapper_test.go
index c505ee2589..ce26bba893 100644
--- a/vault/sealunwrapper_test.go
+++ b/vault/sealunwrapper_test.go
@@ -48,8 +48,6 @@ func performTestSealUnwrapper(t *testing.T, phys physical.Backend, logger log.Lo
 	cluster := NewTestCluster(t, base, &TestClusterOptions{
 		Logger: logger,
 	})
-	cluster.Start()
-	defer cluster.Cleanup()
 
 	physImem := phys.(interface{ Underlying() *inmem.InmemBackend }).Underlying()
 
diff --git a/vault/testing.go b/vault/testing.go
index 26c0c77137..f2665df23d 100644
--- a/vault/testing.go
+++ b/vault/testing.go
@@ -700,6 +700,8 @@ func TestWaitPerfStandby(t testing.TB, core *Core) {
 	}
 }
 
+// TestWaitActive waits for a given core to become the active node.
+// This function is NOT required on a new cluster returned by NewTestCluster.
 func TestWaitActive(t testing.TB, core *Core) {
 	t.Helper()
 	if err := TestWaitActiveWithError(core); err != nil {
@@ -774,9 +776,6 @@ func (c *TestCluster) SetRootToken(token string) {
 	}
 }
 
-func (c *TestCluster) Start() {
-}
-
 func (c *TestCluster) start(t testing.TB) {
 	t.Helper()
 	for i, core := range c.Cores {
@@ -1017,6 +1016,12 @@ func (c *TestClusterCore) NetworkLayer() cluster.NetworkLayer {
 	return c.Core.clusterNetworkLayer
 }
 
+// Cleanup cleans up the Vault cluster. It's called automatically and tied to t.Cleanup().
+// This remains for now to satisfy the VaultCluster interface. Changing that could be breaking
+// for users of the SDK.
+//
+// Deprecated: This should almost never be called directly for clusters resulting from
+// NewTestCluster.
 func (c *TestCluster) Cleanup() {
 	c.cleanupOnce.Do(func() {
 		c.Logger.Info("cleaning up vault cluster")