diff --git a/security/blessings_test.go b/security/blessings_test.go
index 8681623..c312335 100644
--- a/security/blessings_test.go
+++ b/security/blessings_test.go
@@ -330,7 +330,8 @@
 	if got := SigningBlessings(balice); !got.IsZero() {
 		t.Errorf("got %v, want zero blessings", got)
 	}
-	ctx, _ := context.RootContext()
+	ctx, cancel := context.RootContext()
+	defer cancel()
 	if gotname, gotrejected := SigningBlessingNames(ctx, alice, balice); len(gotname)+len(gotrejected) > 0 {
 		t.Errorf("got %v, %v, want nil, nil", gotname, gotrejected)
 	}
diff --git a/security/caveat_test.go b/security/caveat_test.go
index ce80ce6..b46777f 100644
--- a/security/caveat_test.go
+++ b/security/caveat_test.go
@@ -66,12 +66,12 @@
 
 func TestPublicKeyThirdPartyCaveat(t *testing.T) {
 	var (
-		now          = time.Now()
-		valid        = newCaveat(NewExpiryCaveat(now.Add(time.Second)))
-		expired      = newCaveat(NewExpiryCaveat(now.Add(-1 * time.Second)))
-		discharger   = newPrincipal(t)
-		randomserver = newPrincipal(t)
-		ctxAndCall   = func(method string, discharges ...Discharge) (*context.T, Call) {
+		now              = time.Now()
+		valid            = newCaveat(NewExpiryCaveat(now.Add(time.Second)))
+		expired          = newCaveat(NewExpiryCaveat(now.Add(-1 * time.Second)))
+		discharger       = newPrincipal(t)
+		randomserver     = newPrincipal(t)
+		ctxCancelAndCall = func(method string, discharges ...Discharge) (*context.T, context.CancelFunc, Call) {
 			params := &CallParams{
 				Timestamp:        now,
 				Method:           method,
@@ -80,8 +80,8 @@
 			for _, d := range discharges {
 				params.RemoteDischarges[d.ID()] = d
 			}
-			root, _ := context.RootContext()
-			return root, NewCall(params)
+			root, cancel := context.RootContext()
+			return root, cancel, NewCall(params)
 		}
 	)
 
@@ -90,7 +90,9 @@
 		t.Fatal(err)
 	}
 	// Caveat should fail validation without a discharge
-	if err := matchesError(tpc.Validate(ctxAndCall("Method1")), "missing discharge"); err != nil {
+	ctx0, cancel0, call0 := ctxCancelAndCall("Method1")
+	defer cancel0()
+	if err := matchesError(tpc.Validate(ctx0, call0), "missing discharge"); err != nil {
 		t.Fatal(err)
 	}
 	// Should validate when the discharge is present (and caveats on the discharge are met).
@@ -98,11 +100,15 @@
 	if err != nil {
 		t.Fatal(err)
 	}
-	if err := tpc.Validate(ctxAndCall("Method1", d)); err != nil {
+	ctx1, cancel1, call1 := ctxCancelAndCall("Method1", d)
+	defer cancel1()
+	if err := tpc.Validate(ctx1, call1); err != nil {
 		t.Fatal(err)
 	}
 	// Should fail validation when caveats on the discharge are not met.
-	if err := matchesError(tpc.Validate(ctxAndCall("Method2", d)), "discharge failed to validate"); err != nil {
+	ctx2, cancel2, call2 := ctxCancelAndCall("Method2", d)
+	defer cancel2()
+	if err := matchesError(tpc.Validate(ctx2, call2), "discharge failed to validate"); err != nil {
 		t.Fatal(err)
 	}
 	// Discharge can be converted to and from wire format:
@@ -112,7 +118,9 @@
 	}
 	// A discharge minted by another principal should not be respected.
 	if d, err = randomserver.MintDischarge(tpc, UnconstrainedUse()); err == nil {
-		if err := matchesError(tpc.Validate(ctxAndCall("Method1", d)), "signature verification on discharge"); err != nil {
+		ctx3, cancel3, call3 := ctxCancelAndCall("Method1", d)
+		defer cancel3()
+		if err := matchesError(tpc.Validate(ctx3, call3), "signature verification on discharge"); err != nil {
 			t.Fatal(err)
 		}
 	}