diff --git a/.golangci.yml b/.golangci.yml
index b3a544936..d3f0595a1 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -30,6 +30,7 @@ linters:
     - ineffassign # detects assignments to existing variables that are not used
     - makezero # finds slice declarations with non-zero initial length followed by append
     - mirror # catches wrong mirror patterns in bytes/strings usage
+    - misspell # finds commonly misspelled English words
     - musttag # checks structs passed to marshal/unmarshal have proper tags
     - modernize # modernizes code to use newer Go idioms (go fix analyzers)
     - nakedret # finds naked returns in functions
@@ -43,6 +44,7 @@ linters:
     - recvcheck # checks for receiver type consistency (pointer vs value)
     - sloglint # enforces consistent log/slog usage (key-value pairs, no globals)
     - staticcheck # extensive static analysis checks
+    - tparallel # detects inappropriate usage of t.Parallel()
     - unconvert # removes unnecessary type conversions
     - usestdlibvars # detects hardcoded values that should use stdlib constants
     - usetesting # catches os.TempDir() etc. in tests — should use t.TempDir()
diff --git a/spinifex/admin/admin_test.go b/spinifex/admin/admin_test.go
index 6fc86daab..08ad08edc 100644
--- a/spinifex/admin/admin_test.go
+++ b/spinifex/admin/admin_test.go
@@ -640,6 +640,8 @@ func TestGenerateSignedCert_IncludesHostname(t *testing.T) {
 // --- Certificate orchestrator ---
 
 // TestGenerateCertificatesIfNeeded uses subtests to share the initial generation.
+//
+//nolint:tparallel // subtests mutate the shared dir in order: SkipsWhenAllExist pins the CA modtime that ForcePreservesCARegeneratesServerCert then regenerates against
 func TestGenerateCertificatesIfNeeded(t *testing.T) {
 	t.Parallel()
 	dir := t.TempDir()
@@ -710,6 +712,7 @@ func TestGenerateServerCertOnly(t *testing.T) {
 	require.NoError(t, GenerateCACert(filepath.Join(caDir, "ca.pem"), filepath.Join(caDir, "ca.key")))
 
 	t.Run("Success", func(t *testing.T) {
+		t.Parallel()
 		dir := t.TempDir()
 		// Copy CA files into test dir
 		caCert, _ := os.ReadFile(filepath.Join(caDir, "ca.pem"))
@@ -744,6 +747,7 @@ func TestGenerateServerCertOnly(t *testing.T) {
 	})
 
 	t.Run("MissingCA", func(t *testing.T) {
+		t.Parallel()
 		dir := t.TempDir()
 		err := GenerateServerCertOnly(dir, "10.0.0.5", "us-east-1", "spinifex.internal")
 		assert.Error(t, err)
diff --git a/spinifex/admin/ipsec_test.go b/spinifex/admin/ipsec_test.go
index c0684ead2..d0fbbd6f8 100644
--- a/spinifex/admin/ipsec_test.go
+++ b/spinifex/admin/ipsec_test.go
@@ -14,6 +14,8 @@ import (
 
 // TestGenerateIPSecPeerCert shares a CA across subtests so the 4096-bit
 // CA-key generation runs once (~0.7s).
+//
+//nolint:tparallel // the parent cannot be parallel: it overrides the charonCATrustDir/charonRereadCAs package vars for the duration of the test
 func TestGenerateIPSecPeerCert(t *testing.T) {
 	// Redirect the charon trust-store symlink at a temp dir so the test
 	// doesn't try to write to /etc/ipsec.d/cacerts on the host. Restored
diff --git a/spinifex/handlers/ec2/placementgroup/service_impl_test.go b/spinifex/handlers/ec2/placementgroup/service_impl_test.go
index c5e40831b..083071809 100644
--- a/spinifex/handlers/ec2/placementgroup/service_impl_test.go
+++ b/spinifex/handlers/ec2/placementgroup/service_impl_test.go
@@ -102,7 +102,7 @@ func TestCreatePlacementGroup_MissingName(t *testing.T) {
 func TestCreatePlacementGroup_MissingStrategyDefaultsToCluster(t *testing.T) {
 	svc := setupTestService(t)
 	out, err := svc.CreatePlacementGroup(context.Background(), &ec2.CreatePlacementGroupInput{
-		GroupName: aws.String("no-strat"),
+		GroupName: aws.String("no-strategy"),
 	}, testAccountID)
 	require.NoError(t, err)
 	assert.Equal(t, "cluster", *out.PlacementGroup.Strategy)
@@ -111,7 +111,7 @@ func TestCreatePlacementGroup_MissingStrategyDefaultsToCluster(t *testing.T) {
 func TestCreatePlacementGroup_EmptyStrategyDefaultsToCluster(t *testing.T) {
 	svc := setupTestService(t)
 	out, err := svc.CreatePlacementGroup(context.Background(), &ec2.CreatePlacementGroupInput{
-		GroupName: aws.String("empty-strat"),
+		GroupName: aws.String("empty-strategy"),
 		Strategy:  aws.String(""),
 	}, testAccountID)
 	require.NoError(t, err)
diff --git a/spinifex/handlers/ec2/tags/service_impl_test.go b/spinifex/handlers/ec2/tags/service_impl_test.go
index c030229f0..5c1ed22a7 100644
--- a/spinifex/handlers/ec2/tags/service_impl_test.go
+++ b/spinifex/handlers/ec2/tags/service_impl_test.go
@@ -288,6 +288,7 @@ func TestDescribeTags_InvalidFilterName(t *testing.T) {
 
 	_, err := svc.DescribeTags(context.Background(), &ec2.DescribeTagsInput{
 		Filters: []*ec2.Filter{
+			//nolint:misspell // the typo is the point: "resouce-id" must not match the valid "resource-id" filter
 			{Name: aws.String("resouce-id"), Values: []*string{aws.String("i-test1")}},
 		},
 	}, testAccountID)