diff --git a/config/configuration.go b/config/configuration.go
index cb0b0adeda5..32a48e71717 100644
--- a/config/configuration.go
+++ b/config/configuration.go
@@ -411,6 +411,7 @@ func ReadConfigFile(c *cli.Context, log *zerolog.Logger) (settings *configFileSe
 
 	// Parse it again, with strict mode, to find warnings.
 	if file, err := os.Open(configFile); err == nil {
+		defer func() { _ = file.Close() }()
 		decoder := yaml.NewDecoder(file)
 		decoder.KnownFields(true)
 		var unusedConfig configFileSettings
diff --git a/token/encrypt.go b/token/encrypt.go
index ce1a55c6ae5..30298a0219a 100644
--- a/token/encrypt.go
+++ b/token/encrypt.go
@@ -151,6 +151,7 @@ func (e *Encrypter) fetchKey(filename string) (*[32]byte, error) {
 	if err != nil {
 		return nil, err
 	}
+	defer func() { _ = f.Close() }()
 	buf := new(bytes.Buffer)
 	io.Copy(buf, f)