diff --git a/test/integration/cli_test.go b/test/integration/cli_test.go
index 26ba36bd1..4e1c95f4f 100644
--- a/test/integration/cli_test.go
+++ b/test/integration/cli_test.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2021 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 package integration
 
@@ -292,7 +292,7 @@ func runPinnipedLoginOIDC(
 	})
 
 	// Start a background goroutine to read stderr from the CLI and parse out the login URL.
-	loginURLChan := make(chan string)
+	loginURLChan := make(chan string, 1)
 	spawnTestGoroutine(t, func() (err error) {
 		t.Helper()
 		defer func() {
@@ -311,7 +311,7 @@ func runPinnipedLoginOIDC(
 		for scanner.Scan() {
 			loginURL, err := url.Parse(strings.TrimSpace(scanner.Text()))
 			if err == nil && loginURL.Scheme == "https" {
-				loginURLChan <- loginURL.String()
+				loginURLChan <- loginURL.String() // this channel is buffered so this will not block
 				return nil
 			}
 		}
@@ -320,7 +320,7 @@ func runPinnipedLoginOIDC(
 	})
 
 	// Start a background goroutine to read stdout from the CLI and parse out an ExecCredential.
-	credOutputChan := make(chan clientauthenticationv1beta1.ExecCredential)
+	credOutputChan := make(chan clientauthenticationv1beta1.ExecCredential, 1)
 	spawnTestGoroutine(t, func() (err error) {
 		defer func() {
 			closeErr := stdout.Close()
@@ -336,7 +336,7 @@ func runPinnipedLoginOIDC(
 		if err := json.NewDecoder(reader).Decode(&out); err != nil {
 			return fmt.Errorf("could not read ExecCredential from stdout: %w", err)
 		}
-		credOutputChan <- out
+		credOutputChan <- out // this channel is buffered so this will not block
 		return readAndExpectEmpty(reader)
 	})
 
@@ -391,6 +391,7 @@ func readAndExpectEmpty(r io.Reader) (err error) {
 	return nil
 }
 
+// Note: Callers should ensure that f eventually returns, otherwise this helper will hang forever in t.Cleanup.
 func spawnTestGoroutine(t *testing.T, f func() error) {
 	t.Helper()
 	var eg errgroup.Group
diff --git a/test/integration/e2e_test.go b/test/integration/e2e_test.go
index f152b54a7..73683ddb0 100644
--- a/test/integration/e2e_test.go
+++ b/test/integration/e2e_test.go
@@ -182,7 +182,7 @@ func TestE2EFullIntegration(t *testing.T) { // nolint:gocyclo
 		})
 
 		// Start a background goroutine to read stderr from the CLI and parse out the login URL.
-		loginURLChan := make(chan string)
+		loginURLChan := make(chan string, 1)
 		spawnTestGoroutine(t, func() (err error) {
 			defer func() {
 				closeErr := stderrPipe.Close()
@@ -199,7 +199,7 @@ func TestE2EFullIntegration(t *testing.T) { // nolint:gocyclo
 			for scanner.Scan() {
 				loginURL, err := url.Parse(strings.TrimSpace(scanner.Text()))
 				if err == nil && loginURL.Scheme == "https" {
-					loginURLChan <- loginURL.String()
+					loginURLChan <- loginURL.String() // this channel is buffered so this will not block
 					return nil
 				}
 			}
@@ -207,7 +207,7 @@ func TestE2EFullIntegration(t *testing.T) { // nolint:gocyclo
 		})
 
 		// Start a background goroutine to read stdout from kubectl and return the result as a string.
-		kubectlOutputChan := make(chan string)
+		kubectlOutputChan := make(chan string, 1)
 		spawnTestGoroutine(t, func() (err error) {
 			defer func() {
 				closeErr := stdoutPipe.Close()
@@ -223,7 +223,7 @@ func TestE2EFullIntegration(t *testing.T) { // nolint:gocyclo
 				return err
 			}
 			t.Logf("kubectl output:\n%s\n", output)
-			kubectlOutputChan <- string(output)
+			kubectlOutputChan <- string(output) // this channel is buffered so this will not block
 			return nil
 		})