diff --git a/cli/server.go b/cli/server.go
index bc4ccad533d7f..14fd59f2b6b00 100644
--- a/cli/server.go
+++ b/cli/server.go
@@ -566,6 +566,7 @@ func Server(vip *viper.Viper, newAPI func(context.Context, *coderd.Options) (*co
 						InsecureSkipVerify: true,
 					},
 				}
+				defer client.HTTPClient.CloseIdleConnections()
 			}
 
 			// Since errCh only has one buffered slot, all routines
diff --git a/cli/server_test.go b/cli/server_test.go
index 596730237a731..e890de93b2ce8 100644
--- a/cli/server_test.go
+++ b/cli/server_test.go
@@ -425,6 +425,7 @@ func TestServer(t *testing.T) {
 				},
 			},
 		}
+		defer client.HTTPClient.CloseIdleConnections()
 
 		// Use the first certificate and hostname.
 		client.URL.Host = "alpaca.com:443"
diff --git a/coderd/coderdtest/coderdtest.go b/coderd/coderdtest/coderdtest.go
index 0fe4b5a340d2e..39bf2e52348dc 100644
--- a/coderd/coderdtest/coderdtest.go
+++ b/coderd/coderdtest/coderdtest.go
@@ -298,12 +298,14 @@ func NewWithAPI(t *testing.T, options *Options) (*codersdk.Client, io.Closer, *c
 	if options.IncludeProvisionerDaemon {
 		provisionerCloser = NewProvisionerDaemon(t, coderAPI)
 	}
+	client := codersdk.New(coderAPI.AccessURL)
 	t.Cleanup(func() {
 		cancelFunc()
 		_ = provisionerCloser.Close()
 		_ = coderAPI.Close()
+		client.HTTPClient.CloseIdleConnections()
 	})
-	return codersdk.New(coderAPI.AccessURL), provisionerCloser, coderAPI
+	return client, provisionerCloser, coderAPI
 }
 
 // NewProvisionerDaemon launches a provisionerd instance configured to work
diff --git a/coderd/workspaceapps_test.go b/coderd/workspaceapps_test.go
index 2605a740c699c..7261b29e4308e 100644
--- a/coderd/workspaceapps_test.go
+++ b/coderd/workspaceapps_test.go
@@ -135,6 +135,9 @@ func setupProxyTest(t *testing.T, customAppHost ...string) (*codersdk.Client, co
 		return (&net.Dialer{}).DialContext(ctx, network, client.URL.Host)
 	}
 	client.HTTPClient.Transport = transport
+	t.Cleanup(func() {
+		transport.CloseIdleConnections()
+	})
 
 	return client, user, workspace, uint16(tcpAddr.Port)
 }
@@ -540,6 +543,9 @@ func TestWorkspaceAppsProxySubdomainPassthrough(t *testing.T) {
 		return (&net.Dialer{}).DialContext(ctx, network, client.URL.Host)
 	}
 	client.HTTPClient.Transport = transport
+	t.Cleanup(func() {
+		transport.CloseIdleConnections()
+	})
 
 	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
 	defer cancel()
@@ -579,6 +585,9 @@ func TestWorkspaceAppsProxySubdomainBlocked(t *testing.T) {
 			return (&net.Dialer{}).DialContext(ctx, network, client.URL.Host)
 		}
 		client.HTTPClient.Transport = transport
+		t.Cleanup(func() {
+			transport.CloseIdleConnections()
+		})
 
 		return client
 	}