diff --git a/pkg/config/tlscfg/cert_watcher.go b/pkg/config/tlscfg/cert_watcher.go
index a7195d8f8b2..50b7107f394 100644
--- a/pkg/config/tlscfg/cert_watcher.go
+++ b/pkg/config/tlscfg/cert_watcher.go
@@ -55,6 +55,7 @@ func newCertWatcher(opts Options, logger *zap.Logger) (*certWatcher, error) {
 		return nil, err
 	}
 	if err := addCertsToWatch(watcher, opts); err != nil {
+		watcher.Close()
 		return nil, err
 	}
 	return &certWatcher{
diff --git a/pkg/config/tlscfg/cert_watcher_test.go b/pkg/config/tlscfg/cert_watcher_test.go
index 92f251bad3f..5e2362405b2 100644
--- a/pkg/config/tlscfg/cert_watcher_test.go
+++ b/pkg/config/tlscfg/cert_watcher_test.go
@@ -227,6 +227,7 @@ func TestReload_err_watch(t *testing.T) {
 func TestAddCertsToWatch_err(t *testing.T) {
 	watcher, err := fsnotify.NewWatcher()
 	require.NoError(t, err)
+	defer watcher.Close()
 
 	tests := []struct {
 		opts Options
@@ -323,6 +324,7 @@ func syncWrite(filename string, data []byte, perm os.FileMode) error {
 	if err != nil {
 		return err
 	}
+	defer f.Close()
 	if _, err = f.Write(data); err != nil {
 		return err
 	}