diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 736ec66bd8..05db6b6de9 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -40,7 +40,7 @@ jobs:
         uses: golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9 # v8.0.0
         with:
           working-directory: ${{ matrix.directory }}
-          version: v2.2.2 # renovate: datasource=github-tags depName=golangci/golangci-lint
+          version: v2.3.0 # renovate: datasource=github-tags depName=golangci/golangci-lint
 
   njs-lint:
     name: NJS Lint
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index d0b95cd170..158db46325 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -39,7 +39,7 @@ repos:
           - javascript
 
   - repo: https://github.com/golangci/golangci-lint
-    rev: v2.2.2
+    rev: v2.3.0
     hooks:
       - id: golangci-lint-full
         name: golangci-lint-root
diff --git a/Makefile b/Makefile
index 5005d48880..e9493b075d 100644
--- a/Makefile
+++ b/Makefile
@@ -23,7 +23,7 @@ GO_LINKER_FLAGS = $(GO_LINKER_FLAGS_OPTIMIZATIONS) $(GO_LINKER_FlAGS_VARS)
 
 # tools versions
 # renovate: datasource=github-tags depName=golangci/golangci-lint
-GOLANGCI_LINT_VERSION = v2.2.2
+GOLANGCI_LINT_VERSION = v2.3.0
 # renovate: datasource=docker depName=kindest/node
 KIND_K8S_VERSION = v1.33.2
 # renovate: datasource=github-tags depName=norwoodj/helm-docs
diff --git a/internal/controller/nginx/agent/grpc/grpc.go b/internal/controller/nginx/agent/grpc/grpc.go
index 73db59334e..ccc070dd22 100644
--- a/internal/controller/nginx/agent/grpc/grpc.go
+++ b/internal/controller/nginx/agent/grpc/grpc.go
@@ -75,7 +75,8 @@ func NewServer(
 
 // Start is a runnable that starts the gRPC server for communicating with the nginx agent.
 func (g *Server) Start(ctx context.Context) error {
-	listener, err := net.Listen("tcp", fmt.Sprintf(":%d", g.port))
+	var lc net.ListenConfig
+	listener, err := lc.Listen(ctx, "tcp", fmt.Sprintf(":%d", g.port))
 	if err != nil {
 		return err
 	}
diff --git a/tests/framework/collector.go b/tests/framework/collector.go
index 38b6b83033..b03f99f964 100644
--- a/tests/framework/collector.go
+++ b/tests/framework/collector.go
@@ -1,6 +1,7 @@
 package framework
 
 import (
+	"context"
 	"fmt"
 	"os/exec"
 
@@ -17,6 +18,7 @@ const (
 
 // InstallCollector installs the otel-collector.
 func InstallCollector() ([]byte, error) {
+	ctx := context.Background()
 	repoAddArgs := []string{
 		"repo",
 		"add",
@@ -24,11 +26,12 @@ func InstallCollector() ([]byte, error) {
 		"https://open-telemetry.github.io/opentelemetry-helm-charts",
 	}
 
-	if output, err := exec.Command("helm", repoAddArgs...).CombinedOutput(); err != nil {
+	if output, err := exec.CommandContext(ctx, "helm", repoAddArgs...).CombinedOutput(); err != nil {
 		return output, err
 	}
 
-	if output, err := exec.Command(
+	if output, err := exec.CommandContext(
+		ctx,
 		"helm",
 		"repo",
 		"update",
@@ -47,7 +50,7 @@ func InstallCollector() ([]byte, error) {
 		"--wait",
 	}
 
-	return exec.Command("helm", args...).CombinedOutput()
+	return exec.CommandContext(ctx, "helm", args...).CombinedOutput()
 }
 
 // UninstallCollector uninstalls the otel-collector.
@@ -57,7 +60,7 @@ func UninstallCollector(resourceManager ResourceManager) ([]byte, error) {
 		"--namespace", CollectorNamespace,
 	}
 
-	output, err := exec.Command("helm", args...).CombinedOutput()
+	output, err := exec.CommandContext(context.Background(), "helm", args...).CombinedOutput()
 	if err != nil {
 		return output, err
 	}
diff --git a/tests/framework/ngf.go b/tests/framework/ngf.go
index 0cca34fc3a..3ddb7d0d85 100644
--- a/tests/framework/ngf.go
+++ b/tests/framework/ngf.go
@@ -42,7 +42,12 @@ type InstallationConfig struct {
 func InstallGatewayAPI(apiVersion string) ([]byte, error) {
 	apiPath := fmt.Sprintf("%s/v%s/standard-install.yaml", gwInstallBasePath, apiVersion)
 
-	if output, err := exec.Command("kubectl", "apply", "-f", apiPath).CombinedOutput(); err != nil {
+	cmd := exec.CommandContext(
+		context.Background(),
+		"kubectl", "apply", "-f", apiPath,
+	)
+	output, err := cmd.CombinedOutput()
+	if err != nil {
 		return output, err
 	}
 
@@ -53,7 +58,7 @@ func InstallGatewayAPI(apiVersion string) ([]byte, error) {
 func UninstallGatewayAPI(apiVersion string) ([]byte, error) {
 	apiPath := fmt.Sprintf("%s/v%s/standard-install.yaml", gwInstallBasePath, apiVersion)
 
-	output, err := exec.Command("kubectl", "delete", "-f", apiPath).CombinedOutput()
+	output, err := exec.CommandContext(context.Background(), "kubectl", "delete", "-f", apiPath).CombinedOutput()
 	if err != nil && !strings.Contains(string(output), "not found") {
 		return output, err
 	}
@@ -84,7 +89,7 @@ func InstallNGF(cfg InstallationConfig, extraArgs ...string) ([]byte, error) {
 
 	GinkgoWriter.Printf("Installing NGF with command: helm %v\n", strings.Join(fullArgs, " "))
 
-	return exec.Command("helm", fullArgs...).CombinedOutput()
+	return exec.CommandContext(context.Background(), "helm", fullArgs...).CombinedOutput()
 }
 
 // CreateLicenseSecret creates the NGINX Plus JWT secret.
@@ -127,7 +132,12 @@ func CreateLicenseSecret(k8sClient client.Client, namespace, filename string) er
 // UpgradeNGF upgrades NGF. CRD upgrades assume the chart is local.
 func UpgradeNGF(cfg InstallationConfig, extraArgs ...string) ([]byte, error) {
 	crdPath := filepath.Join(cfg.ChartPath, "crds") + "/"
-	if output, err := exec.Command("kubectl", "apply", "-f", crdPath).CombinedOutput(); err != nil {
+	cmd := exec.CommandContext(
+		context.Background(),
+		"kubectl", "apply", "-f", crdPath,
+	)
+	output, err := cmd.CombinedOutput()
+	if err != nil {
 		return output, err
 	}
 
@@ -152,7 +162,7 @@ func UpgradeNGF(cfg InstallationConfig, extraArgs ...string) ([]byte, error) {
 
 	GinkgoWriter.Printf("Upgrading NGF with command: helm %v\n", strings.Join(fullArgs, " "))
 
-	return exec.Command("helm", fullArgs...).CombinedOutput()
+	return exec.CommandContext(context.Background(), "helm", fullArgs...).CombinedOutput()
 }
 
 // UninstallNGF uninstalls NGF.
@@ -161,7 +171,7 @@ func UninstallNGF(cfg InstallationConfig, k8sClient client.Client) ([]byte, erro
 		"uninstall", cfg.ReleaseName, "--namespace", cfg.Namespace,
 	}
 
-	output, err := exec.Command("helm", args...).CombinedOutput()
+	output, err := exec.CommandContext(context.Background(), "helm", args...).CombinedOutput()
 	if err != nil && !strings.Contains(string(output), "release: not found") {
 		return output, err
 	}
diff --git a/tests/framework/portforward.go b/tests/framework/portforward.go
index 4295434074..9465c330d6 100644
--- a/tests/framework/portforward.go
+++ b/tests/framework/portforward.go
@@ -2,6 +2,7 @@ package framework
 
 import (
 	"bytes"
+	"context"
 	"fmt"
 	"log/slog"
 	"net/http"
@@ -49,9 +50,10 @@ func PortForward(config *rest.Config, namespace, podName string, ports []string,
 
 	go func() {
 		for {
+			ctx := context.Background()
 			if err := forward(); err != nil {
-				slog.Error("error forwarding ports", "error", err)
-				slog.Info("retrying port forward in 1s...")
+				slog.ErrorContext(ctx, "error forwarding ports", "error", err)
+				slog.InfoContext(ctx, "retrying port forward in 1s...")
 			}
 
 			select {
diff --git a/tests/framework/prometheus.go b/tests/framework/prometheus.go
index 3c3094712b..24c594ddf2 100644
--- a/tests/framework/prometheus.go
+++ b/tests/framework/prometheus.go
@@ -39,7 +39,9 @@ func InstallPrometheus(
 	rm ResourceManager,
 	cfg PrometheusConfig,
 ) (PrometheusInstance, error) {
-	output, err := exec.Command(
+	ctx := context.Background()
+	output, err := exec.CommandContext(
+		ctx,
 		"helm",
 		"repo",
 		"add",
@@ -50,7 +52,8 @@ func InstallPrometheus(
 		return PrometheusInstance{}, fmt.Errorf("failed to add Prometheus helm repo: %w; output: %s", err, string(output))
 	}
 
-	output, err = exec.Command(
+	output, err = exec.CommandContext(
+		ctx,
 		"helm",
 		"repo",
 		"update",
@@ -62,7 +65,8 @@ func InstallPrometheus(
 	scrapeInterval := fmt.Sprintf("%ds", int(cfg.ScrapeInterval.Seconds()))
 
 	//nolint:gosec
-	output, err = exec.Command(
+	output, err = exec.CommandContext(
+		ctx,
 		"helm",
 		"install",
 		prometheusReleaseName,
@@ -110,7 +114,8 @@ func InstallPrometheus(
 
 // UninstallPrometheus uninstalls Prometheus from the cluster.
 func UninstallPrometheus(rm ResourceManager) error {
-	output, err := exec.Command(
+	output, err := exec.CommandContext(
+		context.Background(),
 		"helm",
 		"uninstall",
 		prometheusReleaseName,
@@ -208,7 +213,7 @@ func (ins *PrometheusInstance) QueryWithCtx(ctx context.Context, query string) (
 	}
 
 	if len(warnings) > 0 {
-		slog.Info(
+		slog.InfoContext(context.Background(),
 			"Prometheus query returned warnings",
 			"query", query,
 			"warnings", warnings,
@@ -240,7 +245,7 @@ func (ins *PrometheusInstance) QueryRangeWithCtx(ctx context.Context,
 	}
 
 	if len(warnings) > 0 {
-		slog.Info(
+		slog.InfoContext(context.Background(),
 			"Prometheus range query returned warnings",
 			"query", query,
 			"range", promRange,
diff --git a/tests/framework/results.go b/tests/framework/results.go
index 79bc594c10..97a4c5d57a 100644
--- a/tests/framework/results.go
+++ b/tests/framework/results.go
@@ -1,6 +1,7 @@
 package framework
 
 import (
+	"context"
 	"encoding/csv"
 	"fmt"
 	"io"
@@ -77,7 +78,7 @@ func generatePNG(resultsDir, inputFilename, outputFilename, configFilename strin
 	gnuplotCfg := filepath.Join(filepath.Dir(pwd), "scripts", configFilename)
 
 	files := fmt.Sprintf("inputfile='%s';outputfile='%s'", inputFilename, outputFilename)
-	cmd := exec.Command("gnuplot", "-e", files, "-c", gnuplotCfg)
+	cmd := exec.CommandContext(context.Background(), "gnuplot", "-e", files, "-c", gnuplotCfg)
 	cmd.Dir = resultsDir
 
 	output, err := cmd.CombinedOutput()