diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 08458dd61..f241824b2 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -137,7 +137,7 @@ jobs:
           severity: "CRITICAL,HIGH"
 
       - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@f6e388ebf0efc915c6c5b165b019ee61a6746a38 # v2
+        uses: github/codeql-action/upload-sarif@004c5de30b6423267685b897a3d595e944f7fed5 # v2
         with:
           sarif_file: "trivy-results.sarif"
 
diff --git a/.golangci.yml b/.golangci.yml
index 05e86ad3d..d1abfe4f4 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -40,6 +40,7 @@ linters:
     - whitespace
     - wrapcheck
     - gofumpt
+    - tenv
 linters-settings:
   funlen:
     statements: 50
diff --git a/core/go.mod b/core/go.mod
index 6b15aab34..ae8369be9 100644
--- a/core/go.mod
+++ b/core/go.mod
@@ -31,7 +31,7 @@ require (
 	go.opentelemetry.io/otel/trace v1.16.0
 	go.uber.org/zap v1.24.0
 	golang.org/x/crypto v0.10.0
-	golang.org/x/mod v0.11.0
+	golang.org/x/mod v0.12.0
 	golang.org/x/net v0.11.0
 	golang.org/x/sync v0.3.0
 	google.golang.org/grpc v1.56.1
diff --git a/core/go.sum b/core/go.sum
index faf80e2a3..091e99450 100644
--- a/core/go.sum
+++ b/core/go.sum
@@ -825,6 +825,8 @@ golang.org/x/mod v0.10.0 h1:lFO9qtOdlre5W1jxS3r/4szv2/6iXxScdzjoBMXNhYk=
 golang.org/x/mod v0.10.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.11.0 h1:bUO06HqtnRcc/7l71XBe4WcqTZ+3AH1J59zWDDwLKgU=
 golang.org/x/mod v0.11.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.12.0 h1:rmsUpXtvNzj340zd98LZ4KntptpfRHwpFOHG188oHXc=
+golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
diff --git a/flagd/cmd/start_test.go b/flagd/cmd/start_test.go
index f5eae6b46..2cf19d142 100644
--- a/flagd/cmd/start_test.go
+++ b/flagd/cmd/start_test.go
@@ -2,7 +2,6 @@ package cmd
 
 import (
 	"log"
-	"os"
 	"testing"
 
 	"github.com/open-feature/flagd/core/pkg/logger"
@@ -46,7 +45,7 @@ func Test_getPort(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			os.Setenv("FLAGD_PORT", tt.envVarValue)
+			t.Setenv("FLAGD_PORT", tt.envVarValue)
 			if got := getPortValueOrDefault(tt.args.flagName, tt.args.value, tt.args.defaultValue, logger); got != tt.want {
 				t.Errorf("getPort() = %v, want %v", got, tt.want)
 			}