diff --git a/pkg/util/iptables/iptables_test.go b/pkg/util/iptables/iptables_test.go
index c2ff33773ec..efd85e0176a 100644
--- a/pkg/util/iptables/iptables_test.go
+++ b/pkg/util/iptables/iptables_test.go
@@ -1025,6 +1025,9 @@ func TestRestoreAllWaitOldIptablesRestore(t *testing.T) {
 		},
 	}
 	lockPath14x, lockPath16x := getLockPaths()
+	// the lockPath14x is a UNIX socket which is cleaned up automatically on close, but the
+	// lockPath16x is a plain file which is not cleaned up.
+	defer os.Remove(lockPath16x)
 	runner := newInternal(&fexec, ProtocolIPv4, lockPath14x, lockPath16x)
 
 	err := runner.RestoreAll([]byte{}, NoFlushTables, RestoreCounters)
@@ -1077,7 +1080,10 @@ func TestRestoreAllGrabNewLock(t *testing.T) {
 	if err != nil {
 		t.Fatalf("expected to open %s, got %v", lockPath16x, err)
 	}
-	defer runLock.Close()
+	defer func() {
+		runLock.Close()
+		os.Remove(lockPath16x)
+	}()
 
 	if err := grabIptablesFileLock(runLock); err != nil {
 		t.Errorf("expected to lock %s, got %v", lockPath16x, err)
@@ -1111,6 +1117,9 @@ func TestRestoreAllGrabOldLock(t *testing.T) {
 		},
 	}
 	lockPath14x, lockPath16x := getLockPaths()
+	// the lockPath14x is a UNIX socket which is cleaned up automatically on close, but the
+	// lockPath16x is a plain file which is not cleaned up.
+	defer os.Remove(lockPath16x)
 	runner := newInternal(&fexec, ProtocolIPv4, lockPath14x, lockPath16x)
 
 	var runLock *net.UnixListener