diff --git a/.golangci.yaml b/.golangci.yaml
index 95c66cc69f73..c59325f29c92 100644
--- a/.golangci.yaml
+++ b/.golangci.yaml
@@ -102,6 +102,7 @@ linters:
     - revive
     - tenv
     - testifylint
+    - thelper
     - typecheck
     - unconvert
     - unused
diff --git a/internal/dbtest/db.go b/internal/dbtest/db.go
index 7976a54e8b5f..2189b14ad3c7 100644
--- a/internal/dbtest/db.go
+++ b/internal/dbtest/db.go
@@ -16,6 +16,7 @@ import (
 
 // InitDB initializes testing database.
 func InitDB(t *testing.T, fixtureFiles []string) string {
+	t.Helper()
 	// Create a temp dir
 	cacheDir := t.TempDir()
 
@@ -41,6 +42,7 @@ func Close() error {
 }
 
 func InitJavaDB(t *testing.T, cacheDir string) {
+	t.Helper()
 	dbDir := filepath.Join(cacheDir, "java-db")
 	javaDB, err := jdb.New(dbDir)
 	require.NoError(t, err)
diff --git a/internal/dbtest/fake.go b/internal/dbtest/fake.go
index 528c549bda7f..52036e2e542f 100644
--- a/internal/dbtest/fake.go
+++ b/internal/dbtest/fake.go
@@ -28,6 +28,7 @@ func (f fakeLayer) MediaType() (types.MediaType, error) {
 }
 
 func NewFakeLayer(t *testing.T, input string, mediaType types.MediaType) v1.Layer {
+	t.Helper()
 	layer, err := tarball.LayerFromFile(input, tarball.WithMediaType(mediaType))
 	require.NoError(t, err)
 
@@ -39,6 +40,7 @@ type FakeDBOptions struct {
 }
 
 func NewFakeDB(t *testing.T, dbPath string, opts FakeDBOptions) *oci.Artifact {
+	t.Helper()
 	mediaType := lo.Ternary(opts.MediaType != "", opts.MediaType, defaultMediaType)
 	img := new(fakei.FakeImage)
 	img.LayersReturns([]v1.Layer{NewFakeLayer(t, dbPath, mediaType)}, nil)
@@ -66,6 +68,7 @@ func NewFakeDB(t *testing.T, dbPath string, opts FakeDBOptions) *oci.Artifact {
 }
 
 func ArchiveDir(t *testing.T, dir string) string {
+	t.Helper()
 	tmpDBPath := filepath.Join(t.TempDir(), "db.tar")
 	f, err := os.Create(tmpDBPath)
 	require.NoError(t, err)
diff --git a/internal/gittest/server.go b/internal/gittest/server.go
index 277d645de241..11c2fc674569 100644
--- a/internal/gittest/server.go
+++ b/internal/gittest/server.go
@@ -26,6 +26,7 @@ var signature = &object.Signature{
 }
 
 func NewServer(t *testing.T, repo, dir string) *httptest.Server {
+	t.Helper()
 	wtDir := t.TempDir()
 
 	// git init
@@ -60,6 +61,7 @@ func NewServer(t *testing.T, repo, dir string) *httptest.Server {
 }
 
 func Clone(t *testing.T, ts *httptest.Server, repo, worktree string) *git.Repository {
+	t.Helper()
 	cloneOptions := git.CloneOptions{
 		URL: ts.URL + "/" + repo + ".git",
 	}
@@ -71,6 +73,7 @@ func Clone(t *testing.T, ts *httptest.Server, repo, worktree string) *git.Reposi
 }
 
 func CommitAll(t *testing.T, r *git.Repository, msg string) {
+	t.Helper()
 	w, err := r.Worktree()
 	require.NoError(t, err)
 
@@ -84,6 +87,7 @@ func CommitAll(t *testing.T, r *git.Repository, msg string) {
 }
 
 func SetTag(t *testing.T, r *git.Repository, tag string) {
+	t.Helper()
 	h, err := r.Head()
 	require.NoError(t, err)
 
@@ -96,6 +100,7 @@ func SetTag(t *testing.T, r *git.Repository, tag string) {
 }
 
 func PushTags(t *testing.T, r *git.Repository) {
+	t.Helper()
 	t.Log("git push --tags")
 	err := r.Push(&git.PushOptions{
 		RemoteName: "origin",
@@ -111,6 +116,7 @@ func PushTags(t *testing.T, r *git.Repository) {
 }
 
 func CreateRemoteBranch(t *testing.T, r *git.Repository, branchName string) {
+	t.Helper()
 	wt, err := r.Worktree()
 	require.NoError(t, err)
 
diff --git a/internal/testutil/docker.go b/internal/testutil/docker.go
index 60e1bb3ab668..45a2fdd1a79e 100644
--- a/internal/testutil/docker.go
+++ b/internal/testutil/docker.go
@@ -17,6 +17,7 @@ type DockerClient struct {
 }
 
 func NewDockerClient(t *testing.T) *DockerClient {
+	t.Helper()
 	cli, err := client.NewClientWithOpts(client.FromEnv, client.WithAPIVersionNegotiation())
 	require.NoError(t, err)
 	return &DockerClient{Client: cli}
diff --git a/internal/testutil/fs.go b/internal/testutil/fs.go
index 842cf7042c55..c3b11fca2211 100644
--- a/internal/testutil/fs.go
+++ b/internal/testutil/fs.go
@@ -13,6 +13,7 @@ import (
 )
 
 func CopyFile(t *testing.T, src, dst string) {
+	t.Helper()
 	MustMkdirAll(t, filepath.Dir(dst))
 
 	_, err := fsutils.CopyFile(src, dst)
@@ -22,6 +23,7 @@ func CopyFile(t *testing.T, src, dst string) {
 // CopyDir copies the directory content from src to dst.
 // It supports only simple cases for testing.
 func CopyDir(t *testing.T, src, dst string) {
+	t.Helper()
 	srcInfo, err := os.Stat(src)
 	require.NoError(t, err)
 
@@ -65,11 +67,13 @@ func MustReadYAML(t *testing.T, path string, out any) {
 }
 
 func MustMkdirAll(t *testing.T, dir string) {
+	t.Helper()
 	err := os.MkdirAll(dir, 0750)
 	require.NoError(t, err)
 }
 
 func MustReadJSON(t *testing.T, filePath string, v any) {
+	t.Helper()
 	b, err := os.ReadFile(filePath)
 	require.NoError(t, err)
 	err = json.Unmarshal(b, v)
@@ -77,6 +81,7 @@ func MustReadJSON(t *testing.T, filePath string, v any) {
 }
 
 func MustWriteJSON(t *testing.T, filePath string, v any) {
+	t.Helper()
 	data, err := json.Marshal(v)
 	require.NoError(t, err)
 
@@ -84,6 +89,7 @@ func MustWriteJSON(t *testing.T, filePath string, v any) {
 }
 
 func MustWriteFile(t *testing.T, filePath string, content []byte) {
+	t.Helper()
 	dir := filepath.Dir(filePath)
 	MustMkdirAll(t, dir)
 
diff --git a/internal/testutil/gzip.go b/internal/testutil/gzip.go
index 68e97395cb3a..bca73cb1a12c 100644
--- a/internal/testutil/gzip.go
+++ b/internal/testutil/gzip.go
@@ -16,6 +16,7 @@ const (
 )
 
 func DecompressGzip(t *testing.T, src, dst string) {
+	t.Helper()
 	w, err := os.Create(dst)
 	require.NoError(t, err)
 	defer w.Close()
@@ -33,6 +34,7 @@ func DecompressGzip(t *testing.T, src, dst string) {
 
 // DecompressSparseGzip decompresses a sparse gzip file for virtual machine image.
 func DecompressSparseGzip(t *testing.T, src, dst string) {
+	t.Helper()
 	w, err := os.Create(dst)
 	require.NoError(t, err)
 	defer w.Close()
diff --git a/internal/testutil/util.go b/internal/testutil/util.go
index 50286f9880a2..4a18e4a8048f 100644
--- a/internal/testutil/util.go
+++ b/internal/testutil/util.go
@@ -15,6 +15,7 @@ import (
 )
 
 func AssertRuleFound(t *testing.T, ruleID string, results scan.Results, message string, args ...any) {
+	t.Helper()
 	found := ruleIDInResults(ruleID, results.GetFailed())
 	assert.True(t, found, append([]any{message}, args...)...)
 	for _, result := range results.GetFailed() {
@@ -32,6 +33,7 @@ func AssertRuleFound(t *testing.T, ruleID string, results scan.Results, message
 }
 
 func AssertRuleNotFound(t *testing.T, ruleID string, results scan.Results, message string, args ...any) {
+	t.Helper()
 	found := ruleIDInResults(ruleID, results.GetFailed())
 	assert.False(t, found, append([]any{message}, args...)...)
 }
@@ -46,6 +48,7 @@ func ruleIDInResults(ruleID string, results scan.Results) bool {
 }
 
 func CreateFS(t *testing.T, files map[string]string) fs.FS {
+	t.Helper()
 	memfs := memoryfs.New()
 	for name, content := range files {
 		name := strings.TrimPrefix(name, "/")
@@ -58,6 +61,7 @@ func CreateFS(t *testing.T, files map[string]string) fs.FS {
 }
 
 func AssertDefsecEqual(t *testing.T, expected, actual any) {
+	t.Helper()
 	expectedJson, err := json.MarshalIndent(expected, "", "\t")
 	require.NoError(t, err)
 	actualJson, err := json.MarshalIndent(actual, "", "\t")
diff --git a/pkg/cache/fs_test.go b/pkg/cache/fs_test.go
index 9323391a3af4..9c2e0af97072 100644
--- a/pkg/cache/fs_test.go
+++ b/pkg/cache/fs_test.go
@@ -17,6 +17,7 @@ import (
 )
 
 func newTempDB(t *testing.T, dbPath string) (string, error) {
+	t.Helper()
 	dir := t.TempDir()
 	if dbPath != "" {
 		d := filepath.Join(dir, "fanal")
diff --git a/pkg/commands/clean/run_test.go b/pkg/commands/clean/run_test.go
index 32e4110aba97..ea403eabe9ae 100644
--- a/pkg/commands/clean/run_test.go
+++ b/pkg/commands/clean/run_test.go
@@ -28,6 +28,7 @@ func TestRun(t *testing.T) {
 			},
 			wantErr: false,
 			checkFunc: func(t *testing.T, dir string) {
+				t.Helper()
 				assert.NoDirExists(t, filepath.Join(dir, "fanal"))
 				assert.NoDirExists(t, filepath.Join(dir, "db"))
 				assert.NoDirExists(t, filepath.Join(dir, "java-db"))
@@ -43,6 +44,7 @@ func TestRun(t *testing.T) {
 			},
 			wantErr: false,
 			checkFunc: func(t *testing.T, dir string) {
+				t.Helper()
 				assert.NoDirExists(t, filepath.Join(dir, "fanal"))
 				assert.DirExists(t, filepath.Join(dir, "db"))
 				assert.DirExists(t, filepath.Join(dir, "java-db"))
@@ -57,6 +59,7 @@ func TestRun(t *testing.T) {
 			},
 			wantErr: false,
 			checkFunc: func(t *testing.T, dir string) {
+				t.Helper()
 				assert.NoDirExists(t, filepath.Join(dir, "db"))
 				assert.DirExists(t, filepath.Join(dir, "fanal"))
 				assert.DirExists(t, filepath.Join(dir, "java-db"))
@@ -71,6 +74,7 @@ func TestRun(t *testing.T) {
 			},
 			wantErr: false,
 			checkFunc: func(t *testing.T, dir string) {
+				t.Helper()
 				assert.NoDirExists(t, filepath.Join(dir, "java-db"))
 				assert.DirExists(t, filepath.Join(dir, "fanal"))
 				assert.DirExists(t, filepath.Join(dir, "db"))
@@ -85,6 +89,7 @@ func TestRun(t *testing.T) {
 			},
 			wantErr: false,
 			checkFunc: func(t *testing.T, dir string) {
+				t.Helper()
 				assert.NoDirExists(t, filepath.Join(dir, "policy"))
 				assert.DirExists(t, filepath.Join(dir, "fanal"))
 				assert.DirExists(t, filepath.Join(dir, "db"))
@@ -99,6 +104,7 @@ func TestRun(t *testing.T) {
 			},
 			wantErr: false,
 			checkFunc: func(t *testing.T, dir string) {
+				t.Helper()
 				assert.DirExists(t, filepath.Join(dir, "policy"))
 				assert.DirExists(t, filepath.Join(dir, "fanal"))
 				assert.DirExists(t, filepath.Join(dir, "db"))
@@ -145,6 +151,7 @@ func TestRun(t *testing.T) {
 }
 
 func createTestFiles(t *testing.T, dir string) {
+	t.Helper()
 	subdirs := []string{
 		"fanal",
 		"db",
diff --git a/pkg/fanal/artifact/repo/git_test.go b/pkg/fanal/artifact/repo/git_test.go
index fbfbe39ff85f..47f9164bccf3 100644
--- a/pkg/fanal/artifact/repo/git_test.go
+++ b/pkg/fanal/artifact/repo/git_test.go
@@ -21,6 +21,7 @@ import (
 )
 
 func setupGitRepository(t *testing.T, repo, dir string) (*httptest.Server, *git.Repository) {
+	t.Helper()
 	gs := gittest.NewServer(t, repo, dir)
 
 	worktree := t.TempDir()
diff --git a/pkg/fanal/image/image_test.go b/pkg/fanal/image/image_test.go
index 2728ddc45184..2c716436e722 100644
--- a/pkg/fanal/image/image_test.go
+++ b/pkg/fanal/image/image_test.go
@@ -20,6 +20,7 @@ import (
 )
 
 func setupEngineAndRegistry(t *testing.T) (*httptest.Server, *httptest.Server) {
+	t.Helper()
 	imagePaths := map[string]string{
 		"alpine:3.10":  "../test/testdata/alpine-310.tar.gz",
 		"alpine:3.11":  "../test/testdata/alpine-311.tar.gz",
@@ -302,6 +303,7 @@ func TestNewDockerImage(t *testing.T) {
 }
 
 func setupPrivateRegistry(t *testing.T) *httptest.Server {
+	t.Helper()
 	images := map[string]v1.Image{
 		"v2/library/alpine:3.10": localImage(t),
 	}
@@ -557,6 +559,7 @@ func TestDockerPlatformArguments(t *testing.T) {
 }
 
 func localImage(t *testing.T) v1.Image {
+	t.Helper()
 	img, err := tarfile.ImageFromPath("../test/testdata/alpine-310.tar.gz")
 	require.NoError(t, err)
 	return img
diff --git a/pkg/iac/adapters/cloudformation/testutil/testutil.go b/pkg/iac/adapters/cloudformation/testutil/testutil.go
index f908519d4106..cba4d31ec426 100644
--- a/pkg/iac/adapters/cloudformation/testutil/testutil.go
+++ b/pkg/iac/adapters/cloudformation/testutil/testutil.go
@@ -13,6 +13,7 @@ import (
 type adaptFn[T any] func(fctx parser.FileContext) T
 
 func AdaptAndCompare[T any](t *testing.T, source string, expected any, fn adaptFn[T]) {
+	t.Helper()
 	fsys := testutil.CreateFS(t, map[string]string{
 		"main.yaml": source,
 	})
diff --git a/pkg/iac/adapters/terraform/tftestutil/testutil.go b/pkg/iac/adapters/terraform/tftestutil/testutil.go
index 57535cf151c5..4059a101c64f 100644
--- a/pkg/iac/adapters/terraform/tftestutil/testutil.go
+++ b/pkg/iac/adapters/terraform/tftestutil/testutil.go
@@ -10,6 +10,7 @@ import (
 )
 
 func CreateModulesFromSource(t *testing.T, source, ext string) terraform.Modules {
+	t.Helper()
 	fs := testutil.CreateFS(t, map[string]string{
 		"source" + ext: source,
 	})
diff --git a/pkg/iac/rego/scanner_test.go b/pkg/iac/rego/scanner_test.go
index 1310e56d2ec4..407a903cf988 100644
--- a/pkg/iac/rego/scanner_test.go
+++ b/pkg/iac/rego/scanner_test.go
@@ -20,6 +20,7 @@ import (
 )
 
 func CreateFS(t *testing.T, files map[string]string) fs.FS {
+	t.Helper()
 	memfs := memoryfs.New()
 	for name, content := range files {
 		name := strings.TrimPrefix(name, "/")
diff --git a/pkg/iac/scanners/cloudformation/parser/parser_test.go b/pkg/iac/scanners/cloudformation/parser/parser_test.go
index aa058c4df855..ce2bfcc1ffaa 100644
--- a/pkg/iac/scanners/cloudformation/parser/parser_test.go
+++ b/pkg/iac/scanners/cloudformation/parser/parser_test.go
@@ -14,6 +14,7 @@ import (
 )
 
 func parseFile(t *testing.T, source, name string) (FileContexts, error) {
+	t.Helper()
 	tmp, err := os.MkdirTemp(os.TempDir(), "defsec")
 	require.NoError(t, err)
 	defer func() { _ = os.RemoveAll(tmp) }()
@@ -174,6 +175,7 @@ Resources:
 }
 
 func createTestFileContext(t *testing.T, source string) *FileContext {
+	t.Helper()
 	contexts, err := parseFile(t, source, "main.yaml")
 	require.NoError(t, err)
 	require.Len(t, contexts, 1)
diff --git a/pkg/iac/scanners/kubernetes/scanner_test.go b/pkg/iac/scanners/kubernetes/scanner_test.go
index c9186a7f9c40..956a04e562bf 100644
--- a/pkg/iac/scanners/kubernetes/scanner_test.go
+++ b/pkg/iac/scanners/kubernetes/scanner_test.go
@@ -288,6 +288,7 @@ spec:
 }
 
 func assertLines(t *testing.T, content string, results scan.Results) {
+	t.Helper()
 	lines := strings.Split(content, "\n")
 	for _, res := range results {
 		actualCode, err := res.GetCode()
diff --git a/pkg/iac/scanners/terraform/parser/parser_test.go b/pkg/iac/scanners/terraform/parser/parser_test.go
index e3bd817748f6..621faad7223b 100644
--- a/pkg/iac/scanners/terraform/parser/parser_test.go
+++ b/pkg/iac/scanners/terraform/parser/parser_test.go
@@ -1503,6 +1503,7 @@ resource "test_block" "this" {
 }
 
 func parse(t *testing.T, files map[string]string) terraform.Modules {
+	t.Helper()
 	fs := testutil.CreateFS(t, files)
 	parser := New(fs, "", OptionStopOnHCLError(true))
 	require.NoError(t, parser.ParseFS(context.TODO(), "."))
diff --git a/pkg/iac/scanners/terraform/setup_test.go b/pkg/iac/scanners/terraform/setup_test.go
index 5b98c438f9c1..670b227ebfa0 100644
--- a/pkg/iac/scanners/terraform/setup_test.go
+++ b/pkg/iac/scanners/terraform/setup_test.go
@@ -15,6 +15,7 @@ import (
 )
 
 func createModulesFromSource(t *testing.T, source, ext string) terraform.Modules {
+	t.Helper()
 	fs := testutil.CreateFS(t, map[string]string{
 		"source" + ext: source,
 	})
@@ -31,10 +32,12 @@ func createModulesFromSource(t *testing.T, source, ext string) terraform.Modules
 }
 
 func scanHCLWithWorkspace(t *testing.T, source, workspace string) scan.Results {
+	t.Helper()
 	return scanHCL(t, source, ScannerWithWorkspaceName(workspace))
 }
 
 func scanHCL(t *testing.T, source string, opts ...options.ScannerOption) scan.Results {
+	t.Helper()
 
 	fs := testutil.CreateFS(t, map[string]string{
 		"main.tf": source,
@@ -47,6 +50,7 @@ func scanHCL(t *testing.T, source string, opts ...options.ScannerOption) scan.Re
 }
 
 func scanJSON(t *testing.T, source string) scan.Results {
+	t.Helper()
 
 	fs := testutil.CreateFS(t, map[string]string{
 		"main.tf.json": source,
diff --git a/pkg/log/handler_test.go b/pkg/log/handler_test.go
index 587c6243c1ec..73efe139db76 100644
--- a/pkg/log/handler_test.go
+++ b/pkg/log/handler_test.go
@@ -148,6 +148,7 @@ func TestContext(t *testing.T) {
 }
 
 func compareLines(t *testing.T, got string, wantLines []string) {
+	t.Helper()
 	// Strip color codes from the output.
 	got = stripColorCodes(got)
 
diff --git a/pkg/mapfs/fs_test.go b/pkg/mapfs/fs_test.go
index d00d5626a9a9..a1d72899b122 100644
--- a/pkg/mapfs/fs_test.go
+++ b/pkg/mapfs/fs_test.go
@@ -49,6 +49,7 @@ var (
 )
 
 func initFS(t *testing.T) *mapfs.FS {
+	t.Helper()
 	fsys := mapfs.New()
 	require.NoError(t, fsys.MkdirAll("a/b/c", 0700))
 	require.NoError(t, fsys.MkdirAll("a/b/empty", 0700))
@@ -61,6 +62,7 @@ func initFS(t *testing.T) *mapfs.FS {
 }
 
 func assertFileInfo(t *testing.T, want fileInfo, got fs.FileInfo) {
+	t.Helper()
 	if got == nil {
 		return
 	}
diff --git a/pkg/plugin/manager_test.go b/pkg/plugin/manager_test.go
index ce86fde40088..63f6f0cb0884 100644
--- a/pkg/plugin/manager_test.go
+++ b/pkg/plugin/manager_test.go
@@ -24,6 +24,7 @@ import (
 )
 
 func setupInstalledPlugin(t *testing.T, homeDir string, p plugin.Plugin) {
+	t.Helper()
 	pluginDir := filepath.Join(homeDir, ".trivy", "plugins", p.Name)
 
 	// Create the test plugin directory
@@ -372,6 +373,7 @@ func TestManager_Upgrade(t *testing.T) {
 }
 
 func verifyVersion(t *testing.T, ctx context.Context, m *plugin.Manager, pluginName, expectedVersion string) {
+	t.Helper()
 	plugins, err := m.LoadAll(ctx)
 	require.NoError(t, err)
 	for _, p := range plugins {
diff --git a/pkg/plugin/manager_unix_test.go b/pkg/plugin/manager_unix_test.go
index f0b55f0eeda6..5548af65e360 100644
--- a/pkg/plugin/manager_unix_test.go
+++ b/pkg/plugin/manager_unix_test.go
@@ -28,6 +28,7 @@ import (
 )
 
 func setupGitRepository(t *testing.T, repo, dir string) *httptest.Server {
+	t.Helper()
 	gs := gittest.NewServer(t, repo, dir)
 
 	worktree := t.TempDir()
@@ -53,6 +54,7 @@ func setupGitRepository(t *testing.T, repo, dir string) *httptest.Server {
 }
 
 func modifyManifest(t *testing.T, worktree, version string) {
+	t.Helper()
 	manifestPath := filepath.Join(worktree, "plugin.yaml")
 	b, err := os.ReadFile(manifestPath)
 	require.NoError(t, err)
diff --git a/pkg/policy/policy_test.go b/pkg/policy/policy_test.go
index 4752fa4ce7fc..926ff9fd7ce7 100644
--- a/pkg/policy/policy_test.go
+++ b/pkg/policy/policy_test.go
@@ -33,6 +33,7 @@ func (f fakeLayer) MediaType() (types.MediaType, error) {
 }
 
 func newFakeLayer(t *testing.T) v1.Layer {
+	t.Helper()
 	layer, err := tarball.LayerFromFile("testdata/bundle.tar.gz")
 	require.NoError(t, err)
 	require.NotNil(t, layer)
@@ -53,6 +54,7 @@ func (b brokenLayer) Compressed() (io.ReadCloser, error) {
 }
 
 func newBrokenLayer(t *testing.T) v1.Layer {
+	t.Helper()
 	layer, err := tarball.LayerFromFile("testdata/bundle.tar.gz")
 	require.NoError(t, err)
 
diff --git a/pkg/rekortest/server.go b/pkg/rekortest/server.go
index 965ca82bfa38..aba7f95d7fca 100644
--- a/pkg/rekortest/server.go
+++ b/pkg/rekortest/server.go
@@ -311,6 +311,7 @@ type Server struct {
 }
 
 func NewServer(t *testing.T) *Server {
+	t.Helper()
 	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		switch r.URL.Path {
 		case "/api/v1/index/retrieve":
diff --git a/pkg/remote/remote_test.go b/pkg/remote/remote_test.go
index fb64deb5d4c4..05c850a6902b 100644
--- a/pkg/remote/remote_test.go
+++ b/pkg/remote/remote_test.go
@@ -24,6 +24,7 @@ import (
 )
 
 func setupPrivateRegistry(t *testing.T) *httptest.Server {
+	t.Helper()
 	images := map[string]v1.Image{
 		"v2/library/alpine:3.10": localImage(t),
 	}
@@ -42,12 +43,14 @@ func setupPrivateRegistry(t *testing.T) *httptest.Server {
 
 // setupConfigDir sets up an isolated configDir() for this test.
 func setupConfigDir(t *testing.T) string {
+	t.Helper()
 	p := t.TempDir()
 	t.Setenv("DOCKER_CONFIG", p)
 	return p
 }
 
 func setupDockerConfig(t *testing.T, content string) {
+	t.Helper()
 	cd := setupConfigDir(t)
 	p := filepath.Join(cd, "config.json")
 
@@ -237,6 +240,7 @@ func (uh *userAgentsTrackingHandler) ServeHTTP(rw http.ResponseWriter, r *http.R
 }
 
 func setupAgentTrackingRegistry(t *testing.T) (*httptest.Server, *userAgentsTrackingHandler) {
+	t.Helper()
 	images := map[string]v1.Image{
 		"v2/library/alpine:3.10": localImage(t),
 	}
@@ -276,6 +280,7 @@ func TestUserAgents(t *testing.T) {
 }
 
 func localImage(t *testing.T) v1.Image {
+	t.Helper()
 	img, err := tarfile.ImageFromPath("../fanal/test/testdata/alpine-310.tar.gz")
 	require.NoError(t, err)
 	return img
diff --git a/pkg/sbom/io/encode_test.go b/pkg/sbom/io/encode_test.go
index 52fbed415933..b6adefa2e3c7 100644
--- a/pkg/sbom/io/encode_test.go
+++ b/pkg/sbom/io/encode_test.go
@@ -914,6 +914,7 @@ var (
 )
 
 func newTestBOM(t *testing.T) *core.BOM {
+	t.Helper()
 	uuid.SetFakeUUID(t, "2ff14136-e09f-4df9-80ea-%012d")
 	bom := core.NewBOM(core.Options{})
 	bom.AddComponent(appComponent)
@@ -922,6 +923,7 @@ func newTestBOM(t *testing.T) *core.BOM {
 
 // BOM without root component
 func newTestBOM2(t *testing.T) *core.BOM {
+	t.Helper()
 	uuid.SetFakeUUID(t, "2ff14136-e09f-4df9-80ea-%012d")
 	bom := core.NewBOM(core.Options{})
 	bom.AddComponent(libComponent)
diff --git a/pkg/uuid/uuid.go b/pkg/uuid/uuid.go
index 3e3ad456a805..31fb1aa2d464 100644
--- a/pkg/uuid/uuid.go
+++ b/pkg/uuid/uuid.go
@@ -21,6 +21,7 @@ var (
 // The 'format' is used to generate a fake UUID and
 // must contain a single '%d' which will be replaced with a counter.
 func SetFakeUUID(t *testing.T, format string) {
+	t.Helper()
 	var count int
 	newUUID = func() uuid.UUID {
 		count++
diff --git a/pkg/vex/oci_test.go b/pkg/vex/oci_test.go
index e803d6ab20aa..1f5a688974cc 100644
--- a/pkg/vex/oci_test.go
+++ b/pkg/vex/oci_test.go
@@ -28,6 +28,7 @@ import (
 )
 
 func setUpRegistry(t *testing.T) (*httptest.Server, v1.Hash) {
+	t.Helper()
 	imgWithVEX := setUpImage(t)
 	d, err := imgWithVEX.Digest()
 	require.NoError(t, err)
@@ -48,6 +49,7 @@ func setUpRegistry(t *testing.T) (*httptest.Server, v1.Hash) {
 }
 
 func setUpImage(t *testing.T) v1.Image {
+	t.Helper()
 	img, err := random.Image(100, 1, random.WithSource(rand.NewSource(0)))
 	require.NoError(t, err)
 
@@ -55,6 +57,7 @@ func setUpImage(t *testing.T) v1.Image {
 }
 
 func setUpVEXAttestation(t *testing.T) v1.Image {
+	t.Helper()
 	envelope := createVEXAttestation(t)
 	b, err := json.Marshal(envelope)
 	require.NoError(t, err)
@@ -67,6 +70,7 @@ func setUpVEXAttestation(t *testing.T) v1.Image {
 }
 
 func createVEXAttestation(t *testing.T) dsse.Envelope {
+	t.Helper()
 	var v openvex.VEX
 	testutil.MustReadJSON(t, "testdata/openvex-oci.json", &v)
 
diff --git a/pkg/vex/repo/manager_test.go b/pkg/vex/repo/manager_test.go
index 362137bd1804..0db3c38b34ee 100644
--- a/pkg/vex/repo/manager_test.go
+++ b/pkg/vex/repo/manager_test.go
@@ -25,6 +25,7 @@ func TestManager_Config(t *testing.T) {
 		{
 			name: "config file exists",
 			setup: func(t *testing.T, dir string) {
+				t.Helper()
 				config := repo.Config{
 					Repositories: []repo.Repository{
 						{
@@ -48,8 +49,10 @@ func TestManager_Config(t *testing.T) {
 			},
 		},
 		{
-			name:  "config file does not exist",
-			setup: func(t *testing.T, dir string) {},
+			name: "config file does not exist",
+			setup: func(t *testing.T, dir string) {
+				t.Helper()
+			},
 			want: repo.Config{
 				Repositories: []repo.Repository{
 					{
@@ -89,8 +92,10 @@ func TestManager_Init(t *testing.T) {
 		wantErr string
 	}{
 		{
-			name:  "successful init",
-			setup: func(t *testing.T, dir string) {},
+			name: "successful init",
+			setup: func(t *testing.T, dir string) {
+				t.Helper()
+			},
 			want: repo.Config{
 				Repositories: []repo.Repository{
 					{
@@ -104,6 +109,7 @@ func TestManager_Init(t *testing.T) {
 		{
 			name: "config already exists",
 			setup: func(t *testing.T, dir string) {
+				t.Helper()
 				configPath := filepath.Join(dir, ".trivy", "vex", "repository.yaml")
 				testutil.MustWriteYAML(t, configPath, repo.Config{})
 			},
diff --git a/pkg/vex/repo/repo_test.go b/pkg/vex/repo/repo_test.go
index 0118b7391523..e52bb4d962a8 100644
--- a/pkg/vex/repo/repo_test.go
+++ b/pkg/vex/repo/repo_test.go
@@ -54,6 +54,7 @@ func TestRepository_Manifest(t *testing.T) {
 		{
 			name: "local manifest exists",
 			setup: func(t *testing.T, dir string, _ *repo.Repository) {
+				t.Helper()
 				manifestFile := filepath.Join(dir, "vex", "repositories", "test-repo", "vex-repository.json")
 				testutil.MustWriteJSON(t, manifestFile, manifest)
 			},
@@ -62,6 +63,7 @@ func TestRepository_Manifest(t *testing.T) {
 		{
 			name: "fetch from remote",
 			setup: func(t *testing.T, dir string, r *repo.Repository) {
+				t.Helper()
 				r.URL = ts.URL
 			},
 			want: manifest,
@@ -69,6 +71,7 @@ func TestRepository_Manifest(t *testing.T) {
 		{
 			name: "http error",
 			setup: func(t *testing.T, dir string, r *repo.Repository) {
+				t.Helper()
 				r.URL = ts.URL + "/error"
 			},
 			wantErr: "failed to download the repository metadata",
@@ -105,6 +108,7 @@ func TestRepository_Index(t *testing.T) {
 		{
 			name: "local index exists",
 			setup: func(t *testing.T, cacheDir string, r *repo.Repository) {
+				t.Helper()
 				indexData := repo.RawIndex{
 					UpdatedAt: time.Date(2023, 1, 1, 0, 0, 0, 0, time.UTC),
 					Packages: []repo.PackageEntry{
@@ -148,6 +152,7 @@ func TestRepository_Index(t *testing.T) {
 		{
 			name: "invalid JSON in index file",
 			setup: func(t *testing.T, cacheDir string, r *repo.Repository) {
+				t.Helper()
 				indexPath := filepath.Join(cacheDir, "vex", "repositories", r.Name, "0.1", "index.json")
 				testutil.MustWriteFile(t, indexPath, []byte("invalid JSON"))
 			},
@@ -190,6 +195,7 @@ func TestRepository_Update(t *testing.T) {
 		{
 			name: "successful update",
 			setup: func(t *testing.T, cacheDir string, r *repo.Repository) {
+				t.Helper()
 				setUpManifest(t, cacheDir, ts.URL+"/archive.zip")
 			},
 			clockTime: time.Date(2023, 1, 1, 0, 0, 0, 0, time.UTC),
@@ -201,6 +207,7 @@ func TestRepository_Update(t *testing.T) {
 		{
 			name: "no update needed (within update interval)",
 			setup: func(t *testing.T, cacheDir string, r *repo.Repository) {
+				t.Helper()
 				setUpManifest(t, cacheDir, "") // No location as the test server is not used
 
 				repoDir := filepath.Join(cacheDir, "vex", "repositories", r.Name)
@@ -221,6 +228,7 @@ func TestRepository_Update(t *testing.T) {
 		{
 			name: "update needed (update interval passed)",
 			setup: func(t *testing.T, cacheDir string, r *repo.Repository) {
+				t.Helper()
 				setUpManifest(t, cacheDir, ts.URL+"/archive.zip")
 
 				repoDir := filepath.Join(cacheDir, "vex", "repositories", r.Name)
@@ -241,6 +249,7 @@ func TestRepository_Update(t *testing.T) {
 		{
 			name: "no update needed (304 Not Modified)",
 			setup: func(t *testing.T, cacheDir string, r *repo.Repository) {
+				t.Helper()
 				setUpManifest(t, cacheDir, ts.URL+"/archive.zip")
 
 				repoDir := filepath.Join(cacheDir, "vex", "repositories", r.Name)
@@ -261,6 +270,7 @@ func TestRepository_Update(t *testing.T) {
 		{
 			name: "update with no existing cache.json",
 			setup: func(t *testing.T, cacheDir string, r *repo.Repository) {
+				t.Helper()
 				setUpManifest(t, cacheDir, ts.URL+"/archive.zip")
 
 				repoDir := filepath.Join(cacheDir, "vex", "repositories", r.Name)
@@ -281,6 +291,7 @@ func TestRepository_Update(t *testing.T) {
 		{
 			name: "download error",
 			setup: func(t *testing.T, cacheDir string, r *repo.Repository) {
+				t.Helper()
 				setUpManifest(t, cacheDir, ts.URL+"/error")
 
 				repoDir := filepath.Join(cacheDir, "vex", "repositories", r.Name)
@@ -319,12 +330,14 @@ func TestRepository_Update(t *testing.T) {
 }
 
 func setupManager(t *testing.T) (string, *repo.Manager) {
+	t.Helper()
 	tempDir := t.TempDir()
 	t.Setenv("XDG_DATA_HOME", "testdata")
 	return tempDir, repo.NewManager(tempDir)
 }
 
 func setUpManifest(t *testing.T, dir, url string) {
+	t.Helper()
 	manifest := repo.Manifest{
 		Name:        "test-repo",
 		Description: "test repository",
@@ -345,6 +358,7 @@ func setUpManifest(t *testing.T, dir, url string) {
 }
 
 func setUpRepository(t *testing.T) *httptest.Server {
+	t.Helper()
 	return httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		switch r.URL.Path {
 		case "/archive.zip":
diff --git a/pkg/vex/vex_test.go b/pkg/vex/vex_test.go
index 4a9686972a5e..6b3b66e30577 100644
--- a/pkg/vex/vex_test.go
+++ b/pkg/vex/vex_test.go
@@ -9,7 +9,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/google/go-containerregistry/pkg/v1"
+	v1 "github.com/google/go-containerregistry/pkg/v1"
 	"github.com/package-url/packageurl-go"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -481,6 +481,7 @@ func TestFilter(t *testing.T) {
 		{
 			name: "VEX Repository",
 			setup: func(t *testing.T, tmpDir string) {
+				t.Helper()
 				// Create repository.yaml
 				vexDir := filepath.Join(tmpDir, ".trivy", "vex")
 				require.NoError(t, os.MkdirAll(vexDir, 0755))