diff --git a/command/agent/agent_endpoint_test.go b/command/agent/agent_endpoint_test.go
index f0fbac2ac4..2cf4e6d8d2 100644
--- a/command/agent/agent_endpoint_test.go
+++ b/command/agent/agent_endpoint_test.go
@@ -73,8 +73,7 @@ func TestAgent_Services_ACLFilter(t *testing.T) {
 	defer srv.Shutdown()
 	defer srv.agent.Shutdown()
 
-	// Try no token.
-	{
+	t.Run("no token", func(t *testing.T) {
 		req, _ := http.NewRequest("GET", "/v1/agent/services", nil)
 		obj, err := srv.AgentServices(nil, req)
 		if err != nil {
@@ -84,10 +83,9 @@ func TestAgent_Services_ACLFilter(t *testing.T) {
 		if len(val) != 0 {
 			t.Fatalf("bad: %v", obj)
 		}
-	}
+	})
 
-	// Try the root token (we will get the implicit "consul" service).
-	{
+	t.Run("root token", func(t *testing.T) {
 		req, _ := http.NewRequest("GET", "/v1/agent/services?token=root", nil)
 		obj, err := srv.AgentServices(nil, req)
 		if err != nil {
@@ -97,7 +95,7 @@ func TestAgent_Services_ACLFilter(t *testing.T) {
 		if len(val) != 1 {
 			t.Fatalf("bad: %v", obj)
 		}
-	}
+	})
 }
 
 func TestAgent_Checks(t *testing.T) {
@@ -142,8 +140,7 @@ func TestAgent_Checks_ACLFilter(t *testing.T) {
 	}
 	srv.agent.state.AddCheck(chk1, "")
 
-	// Try no token.
-	{
+	t.Run("no token", func(t *testing.T) {
 		req, _ := http.NewRequest("GET", "/v1/agent/checks", nil)
 		obj, err := srv.AgentChecks(nil, req)
 		if err != nil {
@@ -153,10 +150,9 @@ func TestAgent_Checks_ACLFilter(t *testing.T) {
 		if len(val) != 0 {
 			t.Fatalf("bad checks: %v", obj)
 		}
-	}
+	})
 
-	// Try the root token.
-	{
+	t.Run("root token", func(t *testing.T) {
 		req, _ := http.NewRequest("GET", "/v1/agent/checks?token=root", nil)
 		obj, err := srv.AgentChecks(nil, req)
 		if err != nil {
@@ -166,7 +162,7 @@ func TestAgent_Checks_ACLFilter(t *testing.T) {
 		if len(val) != 1 {
 			t.Fatalf("bad checks: %v", obj)
 		}
-	}
+	})
 }
 
 func TestAgent_Self(t *testing.T) {
@@ -222,24 +218,27 @@ func TestAgent_Self_ACLDeny(t *testing.T) {
 	defer srv.Shutdown()
 	defer srv.agent.Shutdown()
 
-	// Try without a token.
-	req, _ := http.NewRequest("GET", "/v1/agent/self", nil)
-	if _, err := srv.AgentSelf(nil, req); !isPermissionDenied(err) {
-		t.Fatalf("err: %v", err)
-	}
+	t.Run("no token", func(t *testing.T) {
+		req, _ := http.NewRequest("GET", "/v1/agent/self", nil)
+		if _, err := srv.AgentSelf(nil, req); !isPermissionDenied(err) {
+			t.Fatalf("err: %v", err)
+		}
+	})
 
-	// Try the agent master token (resolved on the agent).
-	req, _ = http.NewRequest("GET", "/v1/agent/self?token=towel", nil)
-	if _, err := srv.AgentSelf(nil, req); err != nil {
-		t.Fatalf("err: %v", err)
-	}
+	t.Run("agent master token", func(t *testing.T) {
+		req, _ := http.NewRequest("GET", "/v1/agent/self?token=towel", nil)
+		if _, err := srv.AgentSelf(nil, req); err != nil {
+			t.Fatalf("err: %v", err)
+		}
+	})
 
-	// Try a read only token (resolved on the servers).
-	ro := makeReadOnlyAgentACL(t, srv)
-	req, _ = http.NewRequest("GET", fmt.Sprintf("/v1/agent/self?token=%s", ro), nil)
-	if _, err := srv.AgentSelf(nil, req); err != nil {
-		t.Fatalf("err: %v", err)
-	}
+	t.Run("read-only token", func(t *testing.T) {
+		ro := makeReadOnlyAgentACL(t, srv)
+		req, _ := http.NewRequest("GET", fmt.Sprintf("/v1/agent/self?token=%s", ro), nil)
+		if _, err := srv.AgentSelf(nil, req); err != nil {
+			t.Fatalf("err: %v", err)
+		}
+	})
 }
 
 func TestAgent_Reload(t *testing.T) {
@@ -322,18 +321,20 @@ func TestAgent_Reload_ACLDeny(t *testing.T) {
 	defer srv.Shutdown()
 	defer srv.agent.Shutdown()
 
-	// Try without a token.
-	req, _ := http.NewRequest("PUT", "/v1/agent/reload", nil)
-	if _, err := srv.AgentReload(nil, req); !isPermissionDenied(err) {
-		t.Fatalf("err: %v", err)
-	}
+	t.Run("no token", func(t *testing.T) {
+		req, _ := http.NewRequest("PUT", "/v1/agent/reload", nil)
+		if _, err := srv.AgentReload(nil, req); !isPermissionDenied(err) {
+			t.Fatalf("err: %v", err)
+		}
+	})
 
-	// Try with a read only token (resolved on the servers).
-	ro := makeReadOnlyAgentACL(t, srv)
-	req, _ = http.NewRequest("PUT", fmt.Sprintf("/v1/agent/reload?token=%s", ro), nil)
-	if _, err := srv.AgentReload(nil, req); !isPermissionDenied(err) {
-		t.Fatalf("err: %v", err)
-	}
+	t.Run("read-only token", func(t *testing.T) {
+		ro := makeReadOnlyAgentACL(t, srv)
+		req, _ := http.NewRequest("PUT", fmt.Sprintf("/v1/agent/reload?token=%s", ro), nil)
+		if _, err := srv.AgentReload(nil, req); !isPermissionDenied(err) {
+			t.Fatalf("err: %v", err)
+		}
+	})
 
 	// This proves we call the ACL function, and we've got the other reload
 	// test to prove we do the reload, which should be sufficient.
@@ -389,8 +390,7 @@ func TestAgent_Members_ACLFilter(t *testing.T) {
 	defer srv.Shutdown()
 	defer srv.agent.Shutdown()
 
-	// Try no token.
-	{
+	t.Run("no token", func(t *testing.T) {
 		req, _ := http.NewRequest("GET", "/v1/agent/members", nil)
 		obj, err := srv.AgentMembers(nil, req)
 		if err != nil {
@@ -400,10 +400,9 @@ func TestAgent_Members_ACLFilter(t *testing.T) {
 		if len(val) != 0 {
 			t.Fatalf("bad members: %v", obj)
 		}
-	}
+	})
 
-	// Try the root token.
-	{
+	t.Run("root token", func(t *testing.T) {
 		req, _ := http.NewRequest("GET", "/v1/agent/members?token=root", nil)
 		obj, err := srv.AgentMembers(nil, req)
 		if err != nil {
@@ -413,7 +412,7 @@ func TestAgent_Members_ACLFilter(t *testing.T) {
 		if len(val) != 1 {
 			t.Fatalf("bad members: %v", obj)
 		}
-	}
+	})
 }
 
 func TestAgent_Join(t *testing.T) {
@@ -489,31 +488,28 @@ func TestAgent_Join_ACLDeny(t *testing.T) {
 	defer a2.Shutdown()
 	addr := fmt.Sprintf("127.0.0.1:%d", a2.config.Ports.SerfLan)
 
-	// Try without a token.
-	{
+	t.Run("no token", func(t *testing.T) {
 		req, _ := http.NewRequest("GET", fmt.Sprintf("/v1/agent/join/%s", addr), nil)
 		if _, err := srv.AgentJoin(nil, req); !isPermissionDenied(err) {
 			t.Fatalf("err: %v", err)
 		}
-	}
+	})
 
-	// Try the agent master token (resolved on the agent).
-	{
+	t.Run("agent master token", func(t *testing.T) {
 		req, _ := http.NewRequest("GET", fmt.Sprintf("/v1/agent/join/%s?token=towel", addr), nil)
 		_, err := srv.AgentJoin(nil, req)
 		if err != nil {
 			t.Fatalf("err: %v", err)
 		}
-	}
+	})
 
-	// Try with a read only token (resolved on the servers).
-	ro := makeReadOnlyAgentACL(t, srv)
-	{
+	t.Run("read-only token", func(t *testing.T) {
+		ro := makeReadOnlyAgentACL(t, srv)
 		req, _ := http.NewRequest("GET", fmt.Sprintf("/v1/agent/join/%s?token=%s", addr, ro), nil)
 		if _, err := srv.AgentJoin(nil, req); !isPermissionDenied(err) {
 			t.Fatalf("err: %v", err)
 		}
-	}
+	})
 }
 
 func TestAgent_Leave(t *testing.T) {
@@ -554,8 +550,7 @@ func TestAgent_Leave(t *testing.T) {
 }
 
 func TestAgent_Leave_ACLDeny(t *testing.T) {
-	// Try without a token.
-	func() {
+	t.Run("no token", func(t *testing.T) {
 		dir, srv := makeHTTPServerWithACLs(t)
 		defer os.RemoveAll(dir)
 		defer srv.Shutdown()
@@ -565,24 +560,22 @@ func TestAgent_Leave_ACLDeny(t *testing.T) {
 		if _, err := srv.AgentLeave(nil, req); !isPermissionDenied(err) {
 			t.Fatalf("err: %v", err)
 		}
-	}()
+	})
 
-	// Try the agent master token (resolved on the agent).
-	func() {
+	t.Run("agent master token", func(t *testing.T) {
 		dir, srv := makeHTTPServerWithACLs(t)
 		defer os.RemoveAll(dir)
 		defer srv.Shutdown()
 		defer srv.agent.Shutdown()
 
 		req, _ := http.NewRequest("PUT", "/v1/agent/leave?token=towel", nil)
-		_, err := srv.AgentLeave(nil, req)
-		if err != nil {
+		if _, err := srv.AgentLeave(nil, req); err != nil {
 			t.Fatalf("err: %v", err)
 		}
-	}()
+	})
 
-	// Try with a read only token (resolved on the servers).
-	func() {
+	// this test fails when all subtests share the same server.
+	t.Run("read-only token", func(t *testing.T) {
 		dir, srv := makeHTTPServerWithACLs(t)
 		defer os.RemoveAll(dir)
 		defer srv.Shutdown()
@@ -593,7 +586,7 @@ func TestAgent_Leave_ACLDeny(t *testing.T) {
 		if _, err := srv.AgentLeave(nil, req); !isPermissionDenied(err) {
 			t.Fatalf("err: %v", err)
 		}
-	}()
+	})
 }
 
 func TestAgent_ForceLeave(t *testing.T) {
@@ -639,31 +632,27 @@ func TestAgent_ForceLeave_ACLDeny(t *testing.T) {
 	defer srv.Shutdown()
 	defer srv.agent.Shutdown()
 
-	// Try without a token.
-	{
+	t.Run("no token", func(t *testing.T) {
 		req, _ := http.NewRequest("GET", "/v1/agent/force-leave/nope", nil)
 		if _, err := srv.AgentForceLeave(nil, req); !isPermissionDenied(err) {
 			t.Fatalf("err: %v", err)
 		}
-	}
+	})
 
-	// Try the agent master token (resolved on the agent).
-	{
+	t.Run("agent master token", func(t *testing.T) {
 		req, _ := http.NewRequest("GET", "/v1/agent/force-leave/nope?token=towel", nil)
-		_, err := srv.AgentForceLeave(nil, req)
-		if err != nil {
+		if _, err := srv.AgentForceLeave(nil, req); err != nil {
 			t.Fatalf("err: %v", err)
 		}
-	}
+	})
 
-	// Try a read only token (resolved on the servers).
-	ro := makeReadOnlyAgentACL(t, srv)
-	{
+	t.Run("read-only token", func(t *testing.T) {
+		ro := makeReadOnlyAgentACL(t, srv)
 		req, _ := http.NewRequest("GET", fmt.Sprintf("/v1/agent/force-leave/nope?token=%s", ro), nil)
 		if _, err := srv.AgentForceLeave(nil, req); !isPermissionDenied(err) {
 			t.Fatalf("err: %v", err)
 		}
-	}
+	})
 }
 
 func TestAgent_RegisterCheck(t *testing.T) {
@@ -786,17 +775,19 @@ func TestAgent_RegisterCheck_ACLDeny(t *testing.T) {
 		},
 	}
 
-	// Try with no token.
-	req, _ := http.NewRequest("GET", "/v1/agent/check/register", jsonReader(args))
-	if _, err := srv.AgentRegisterCheck(nil, req); !isPermissionDenied(err) {
-		t.Fatalf("err: %v", err)
-	}
+	t.Run("no token", func(t *testing.T) {
+		req, _ := http.NewRequest("GET", "/v1/agent/check/register", jsonReader(args))
+		if _, err := srv.AgentRegisterCheck(nil, req); !isPermissionDenied(err) {
+			t.Fatalf("err: %v", err)
+		}
+	})
 
-	// Try the root token.
-	req, _ = http.NewRequest("GET", "/v1/agent/check/register?token=root", jsonReader(args))
-	if _, err := srv.AgentRegisterCheck(nil, req); err != nil {
-		t.Fatalf("err: %v", err)
-	}
+	t.Run("root token", func(t *testing.T) {
+		req, _ := http.NewRequest("GET", "/v1/agent/check/register?token=root", jsonReader(args))
+		if _, err := srv.AgentRegisterCheck(nil, req); err != nil {
+			t.Fatalf("err: %v", err)
+		}
+	})
 }
 
 func TestAgent_DeregisterCheck(t *testing.T) {
@@ -837,17 +828,19 @@ func TestAgent_DeregisterCheckACLDeny(t *testing.T) {
 		t.Fatalf("err: %v", err)
 	}
 
-	// Try with no token.
-	req, _ := http.NewRequest("GET", "/v1/agent/check/deregister/test", nil)
-	if _, err := srv.AgentDeregisterCheck(nil, req); !isPermissionDenied(err) {
-		t.Fatalf("err: %v", err)
-	}
+	t.Run("no token", func(t *testing.T) {
+		req, _ := http.NewRequest("GET", "/v1/agent/check/deregister/test", nil)
+		if _, err := srv.AgentDeregisterCheck(nil, req); !isPermissionDenied(err) {
+			t.Fatalf("err: %v", err)
+		}
+	})
 
-	// Try with the root token.
-	req, _ = http.NewRequest("GET", "/v1/agent/check/deregister/test?token=root", nil)
-	if _, err := srv.AgentDeregisterCheck(nil, req); err != nil {
-		t.Fatalf("err: %v", err)
-	}
+	t.Run("root token", func(t *testing.T) {
+		req, _ := http.NewRequest("GET", "/v1/agent/check/deregister/test?token=root", nil)
+		if _, err := srv.AgentDeregisterCheck(nil, req); err != nil {
+			t.Fatalf("err: %v", err)
+		}
+	})
 }
 
 func TestAgent_PassCheck(t *testing.T) {
@@ -890,17 +883,19 @@ func TestAgent_PassCheck_ACLDeny(t *testing.T) {
 		t.Fatalf("err: %v", err)
 	}
 
-	// Try with no token.
-	req, _ := http.NewRequest("GET", "/v1/agent/check/pass/test", nil)
-	if _, err := srv.AgentCheckPass(nil, req); !isPermissionDenied(err) {
-		t.Fatalf("err: %v", err)
-	}
+	t.Run("no token", func(t *testing.T) {
+		req, _ := http.NewRequest("GET", "/v1/agent/check/pass/test", nil)
+		if _, err := srv.AgentCheckPass(nil, req); !isPermissionDenied(err) {
+			t.Fatalf("err: %v", err)
+		}
+	})
 
-	// Try with the root token.
-	req, _ = http.NewRequest("GET", "/v1/agent/check/pass/test?token=root", nil)
-	if _, err := srv.AgentCheckPass(nil, req); err != nil {
-		t.Fatalf("err: %v", err)
-	}
+	t.Run("root token", func(t *testing.T) {
+		req, _ := http.NewRequest("GET", "/v1/agent/check/pass/test?token=root", nil)
+		if _, err := srv.AgentCheckPass(nil, req); err != nil {
+			t.Fatalf("err: %v", err)
+		}
+	})
 }
 
 func TestAgent_WarnCheck(t *testing.T) {
@@ -943,17 +938,19 @@ func TestAgent_WarnCheck_ACLDeny(t *testing.T) {
 		t.Fatalf("err: %v", err)
 	}
 
-	// Try with no token.
-	req, _ := http.NewRequest("GET", "/v1/agent/check/warn/test", nil)
-	if _, err := srv.AgentCheckWarn(nil, req); !isPermissionDenied(err) {
-		t.Fatalf("err: %v", err)
-	}
+	t.Run("no token", func(t *testing.T) {
+		req, _ := http.NewRequest("GET", "/v1/agent/check/warn/test", nil)
+		if _, err := srv.AgentCheckWarn(nil, req); !isPermissionDenied(err) {
+			t.Fatalf("err: %v", err)
+		}
+	})
 
-	// Try with the root token.
-	req, _ = http.NewRequest("GET", "/v1/agent/check/warn/test?token=root", nil)
-	if _, err := srv.AgentCheckWarn(nil, req); err != nil {
-		t.Fatalf("err: %v", err)
-	}
+	t.Run("root token", func(t *testing.T) {
+		req, _ := http.NewRequest("GET", "/v1/agent/check/warn/test?token=root", nil)
+		if _, err := srv.AgentCheckWarn(nil, req); err != nil {
+			t.Fatalf("err: %v", err)
+		}
+	})
 }
 
 func TestAgent_FailCheck(t *testing.T) {
@@ -996,17 +993,19 @@ func TestAgent_FailCheck_ACLDeny(t *testing.T) {
 		t.Fatalf("err: %v", err)
 	}
 
-	// Try with no token.
-	req, _ := http.NewRequest("GET", "/v1/agent/check/fail/test", nil)
-	if _, err := srv.AgentCheckFail(nil, req); !isPermissionDenied(err) {
-		t.Fatalf("err: %v", err)
-	}
+	t.Run("no token", func(t *testing.T) {
+		req, _ := http.NewRequest("GET", "/v1/agent/check/fail/test", nil)
+		if _, err := srv.AgentCheckFail(nil, req); !isPermissionDenied(err) {
+			t.Fatalf("err: %v", err)
+		}
+	})
 
-	// Try with the root token.
-	req, _ = http.NewRequest("GET", "/v1/agent/check/fail/test?token=root", nil)
-	if _, err := srv.AgentCheckFail(nil, req); err != nil {
-		t.Fatalf("err: %v", err)
-	}
+	t.Run("root token", func(t *testing.T) {
+		req, _ := http.NewRequest("GET", "/v1/agent/check/fail/test?token=root", nil)
+		if _, err := srv.AgentCheckFail(nil, req); err != nil {
+			t.Fatalf("err: %v", err)
+		}
+	})
 }
 
 func TestAgent_UpdateCheck(t *testing.T) {
@@ -1028,27 +1027,28 @@ func TestAgent_UpdateCheck(t *testing.T) {
 	}
 
 	for _, c := range cases {
-		req, _ := http.NewRequest("PUT", "/v1/agent/check/update/test", jsonReader(c))
-		resp := httptest.NewRecorder()
-		obj, err := srv.AgentCheckUpdate(resp, req)
-		if err != nil {
-			t.Fatalf("err: %v", err)
-		}
-		if obj != nil {
-			t.Fatalf("bad: %v", obj)
-		}
-		if resp.Code != 200 {
-			t.Fatalf("expected 200, got %d", resp.Code)
-		}
+		t.Run(c.Status, func(t *testing.T) {
+			req, _ := http.NewRequest("PUT", "/v1/agent/check/update/test", jsonReader(c))
+			resp := httptest.NewRecorder()
+			obj, err := srv.AgentCheckUpdate(resp, req)
+			if err != nil {
+				t.Fatalf("err: %v", err)
+			}
+			if obj != nil {
+				t.Fatalf("bad: %v", obj)
+			}
+			if resp.Code != 200 {
+				t.Fatalf("expected 200, got %d", resp.Code)
+			}
 
-		state := srv.agent.state.Checks()["test"]
-		if state.Status != c.Status || state.Output != c.Output {
-			t.Fatalf("bad: %v", state)
-		}
+			state := srv.agent.state.Checks()["test"]
+			if state.Status != c.Status || state.Output != c.Output {
+				t.Fatalf("bad: %v", state)
+			}
+		})
 	}
 
-	// Make sure abusive levels of output are capped.
-	{
+	t.Run("log output limit", func(t *testing.T) {
 		args := checkUpdate{
 			Status: api.HealthPassing,
 			Output: strings.Repeat("-= bad -=", 5*CheckBufSize),
@@ -1073,10 +1073,9 @@ func TestAgent_UpdateCheck(t *testing.T) {
 		if state.Status != api.HealthPassing || len(state.Output) > 2*CheckBufSize {
 			t.Fatalf("bad: %v", state)
 		}
-	}
+	})
 
-	// Check a bogus status.
-	{
+	t.Run("bogus status", func(t *testing.T) {
 		args := checkUpdate{Status: "itscomplicated"}
 		req, _ := http.NewRequest("PUT", "/v1/agent/check/update/test", jsonReader(args))
 		resp := httptest.NewRecorder()
@@ -1090,10 +1089,9 @@ func TestAgent_UpdateCheck(t *testing.T) {
 		if resp.Code != 400 {
 			t.Fatalf("expected 400, got %d", resp.Code)
 		}
-	}
+	})
 
-	// Check a bogus verb.
-	{
+	t.Run("bogus verb", func(t *testing.T) {
 		args := checkUpdate{Status: api.HealthPassing}
 		req, _ := http.NewRequest("POST", "/v1/agent/check/update/test", jsonReader(args))
 		resp := httptest.NewRecorder()
@@ -1107,7 +1105,7 @@ func TestAgent_UpdateCheck(t *testing.T) {
 		if resp.Code != 405 {
 			t.Fatalf("expected 405, got %d", resp.Code)
 		}
-	}
+	})
 }
 
 func TestAgent_UpdateCheck_ACLDeny(t *testing.T) {
@@ -1122,19 +1120,21 @@ func TestAgent_UpdateCheck_ACLDeny(t *testing.T) {
 		t.Fatalf("err: %v", err)
 	}
 
-	// Try with no token.
-	args := checkUpdate{api.HealthPassing, "hello-passing"}
-	req, _ := http.NewRequest("PUT", "/v1/agent/check/update/test", jsonReader(args))
-	if _, err := srv.AgentCheckUpdate(nil, req); !isPermissionDenied(err) {
-		t.Fatalf("err: %v", err)
-	}
+	t.Run("no token", func(t *testing.T) {
+		args := checkUpdate{api.HealthPassing, "hello-passing"}
+		req, _ := http.NewRequest("PUT", "/v1/agent/check/update/test", jsonReader(args))
+		if _, err := srv.AgentCheckUpdate(nil, req); !isPermissionDenied(err) {
+			t.Fatalf("err: %v", err)
+		}
+	})
 
-	// Try with the root token.
-	args = checkUpdate{api.HealthPassing, "hello-passing"}
-	req, _ = http.NewRequest("PUT", "/v1/agent/check/update/test?token=root", jsonReader(args))
-	if _, err := srv.AgentCheckUpdate(nil, req); err != nil {
-		t.Fatalf("err: %v", err)
-	}
+	t.Run("root token", func(t *testing.T) {
+		args := checkUpdate{api.HealthPassing, "hello-passing"}
+		req, _ := http.NewRequest("PUT", "/v1/agent/check/update/test?token=root", jsonReader(args))
+		if _, err := srv.AgentCheckUpdate(nil, req); err != nil {
+			t.Fatalf("err: %v", err)
+		}
+	})
 }
 
 func TestAgent_RegisterService(t *testing.T) {
@@ -1213,17 +1213,19 @@ func TestAgent_RegisterService_ACLDeny(t *testing.T) {
 		},
 	}
 
-	// Try with no token.
-	req, _ := http.NewRequest("GET", "/v1/agent/service/register", jsonReader(args))
-	if _, err := srv.AgentRegisterService(nil, req); !isPermissionDenied(err) {
-		t.Fatalf("err: %v", err)
-	}
+	t.Run("no token", func(t *testing.T) {
+		req, _ := http.NewRequest("GET", "/v1/agent/service/register", jsonReader(args))
+		if _, err := srv.AgentRegisterService(nil, req); !isPermissionDenied(err) {
+			t.Fatalf("err: %v", err)
+		}
+	})
 
-	// Try with the root token.
-	req, _ = http.NewRequest("GET", "/v1/agent/service/register?token=root", jsonReader(args))
-	if _, err := srv.AgentRegisterService(nil, req); err != nil {
-		t.Fatalf("err: %v", err)
-	}
+	t.Run("root token", func(t *testing.T) {
+		req, _ := http.NewRequest("GET", "/v1/agent/service/register?token=root", jsonReader(args))
+		if _, err := srv.AgentRegisterService(nil, req); err != nil {
+			t.Fatalf("err: %v", err)
+		}
+	})
 }
 
 func TestAgent_RegisterService_InvalidAddress(t *testing.T) {
@@ -1302,17 +1304,19 @@ func TestAgent_DeregisterService_ACLDeny(t *testing.T) {
 		t.Fatalf("err: %v", err)
 	}
 
-	// Try without a token.
-	req, _ := http.NewRequest("GET", "/v1/agent/service/deregister/test", nil)
-	if _, err := srv.AgentDeregisterService(nil, req); !isPermissionDenied(err) {
-		t.Fatalf("err: %v", err)
-	}
+	t.Run("no token", func(t *testing.T) {
+		req, _ := http.NewRequest("GET", "/v1/agent/service/deregister/test", nil)
+		if _, err := srv.AgentDeregisterService(nil, req); !isPermissionDenied(err) {
+			t.Fatalf("err: %v", err)
+		}
+	})
 
-	// Try with the root.
-	req, _ = http.NewRequest("GET", "/v1/agent/service/deregister/test?token=root", nil)
-	if _, err := srv.AgentDeregisterService(nil, req); err != nil {
-		t.Fatalf("err: %v", err)
-	}
+	t.Run("root token", func(t *testing.T) {
+		req, _ := http.NewRequest("GET", "/v1/agent/service/deregister/test?token=root", nil)
+		if _, err := srv.AgentDeregisterService(nil, req); err != nil {
+			t.Fatalf("err: %v", err)
+		}
+	})
 }
 
 func TestAgent_ServiceMaintenance_BadRequest(t *testing.T) {
@@ -1321,45 +1325,49 @@ func TestAgent_ServiceMaintenance_BadRequest(t *testing.T) {
 	defer srv.Shutdown()
 	defer srv.agent.Shutdown()
 
-	// Fails on non-PUT
-	req, _ := http.NewRequest("GET", "/v1/agent/service/maintenance/test?enable=true", nil)
-	resp := httptest.NewRecorder()
-	if _, err := srv.AgentServiceMaintenance(resp, req); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-	if resp.Code != 405 {
-		t.Fatalf("expected 405, got %d", resp.Code)
-	}
+	t.Run("not PUT", func(t *testing.T) {
+		req, _ := http.NewRequest("GET", "/v1/agent/service/maintenance/test?enable=true", nil)
+		resp := httptest.NewRecorder()
+		if _, err := srv.AgentServiceMaintenance(resp, req); err != nil {
+			t.Fatalf("err: %s", err)
+		}
+		if resp.Code != 405 {
+			t.Fatalf("expected 405, got %d", resp.Code)
+		}
+	})
 
-	// Fails when no enable flag provided
-	req, _ = http.NewRequest("PUT", "/v1/agent/service/maintenance/test", nil)
-	resp = httptest.NewRecorder()
-	if _, err := srv.AgentServiceMaintenance(resp, req); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-	if resp.Code != 400 {
-		t.Fatalf("expected 400, got %d", resp.Code)
-	}
+	t.Run("not enabled", func(t *testing.T) {
+		req, _ := http.NewRequest("PUT", "/v1/agent/service/maintenance/test", nil)
+		resp := httptest.NewRecorder()
+		if _, err := srv.AgentServiceMaintenance(resp, req); err != nil {
+			t.Fatalf("err: %s", err)
+		}
+		if resp.Code != 400 {
+			t.Fatalf("expected 400, got %d", resp.Code)
+		}
+	})
 
-	// Fails when no service ID provided
-	req, _ = http.NewRequest("PUT", "/v1/agent/service/maintenance/?enable=true", nil)
-	resp = httptest.NewRecorder()
-	if _, err := srv.AgentServiceMaintenance(resp, req); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-	if resp.Code != 400 {
-		t.Fatalf("expected 400, got %d", resp.Code)
-	}
+	t.Run("no service id", func(t *testing.T) {
+		req, _ := http.NewRequest("PUT", "/v1/agent/service/maintenance/?enable=true", nil)
+		resp := httptest.NewRecorder()
+		if _, err := srv.AgentServiceMaintenance(resp, req); err != nil {
+			t.Fatalf("err: %s", err)
+		}
+		if resp.Code != 400 {
+			t.Fatalf("expected 400, got %d", resp.Code)
+		}
+	})
 
-	// Fails when bad service ID provided
-	req, _ = http.NewRequest("PUT", "/v1/agent/service/maintenance/_nope_?enable=true", nil)
-	resp = httptest.NewRecorder()
-	if _, err := srv.AgentServiceMaintenance(resp, req); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-	if resp.Code != 404 {
-		t.Fatalf("expected 404, got %d", resp.Code)
-	}
+	t.Run("bad service id", func(t *testing.T) {
+		req, _ := http.NewRequest("PUT", "/v1/agent/service/maintenance/_nope_?enable=true", nil)
+		resp := httptest.NewRecorder()
+		if _, err := srv.AgentServiceMaintenance(resp, req); err != nil {
+			t.Fatalf("err: %s", err)
+		}
+		if resp.Code != 404 {
+			t.Fatalf("expected 404, got %d", resp.Code)
+		}
+	})
 }
 
 func TestAgent_ServiceMaintenance_Enable(t *testing.T) {
@@ -1457,17 +1465,19 @@ func TestAgent_ServiceMaintenance_ACLDeny(t *testing.T) {
 		t.Fatalf("err: %v", err)
 	}
 
-	// Try with no token.
-	req, _ := http.NewRequest("PUT", "/v1/agent/service/maintenance/test?enable=true&reason=broken", nil)
-	if _, err := srv.AgentServiceMaintenance(nil, req); !isPermissionDenied(err) {
-		t.Fatalf("err: %v", err)
-	}
+	t.Run("no token", func(t *testing.T) {
+		req, _ := http.NewRequest("PUT", "/v1/agent/service/maintenance/test?enable=true&reason=broken", nil)
+		if _, err := srv.AgentServiceMaintenance(nil, req); !isPermissionDenied(err) {
+			t.Fatalf("err: %v", err)
+		}
+	})
 
-	// Try with the root token.
-	req, _ = http.NewRequest("PUT", "/v1/agent/service/maintenance/test?enable=true&reason=broken&token=root", nil)
-	if _, err := srv.AgentServiceMaintenance(nil, req); err != nil {
-		t.Fatalf("err: %v", err)
-	}
+	t.Run("root token", func(t *testing.T) {
+		req, _ := http.NewRequest("PUT", "/v1/agent/service/maintenance/test?enable=true&reason=broken&token=root", nil)
+		if _, err := srv.AgentServiceMaintenance(nil, req); err != nil {
+			t.Fatalf("err: %v", err)
+		}
+	})
 }
 
 func TestAgent_NodeMaintenance_BadRequest(t *testing.T) {
@@ -1561,17 +1571,19 @@ func TestAgent_NodeMaintenance_ACLDeny(t *testing.T) {
 	defer srv.Shutdown()
 	defer srv.agent.Shutdown()
 
-	// Try with no token.
-	req, _ := http.NewRequest("PUT", "/v1/agent/self/maintenance?enable=true&reason=broken", nil)
-	if _, err := srv.AgentNodeMaintenance(nil, req); !isPermissionDenied(err) {
-		t.Fatalf("err: %v", err)
-	}
+	t.Run("no token", func(t *testing.T) {
+		req, _ := http.NewRequest("PUT", "/v1/agent/self/maintenance?enable=true&reason=broken", nil)
+		if _, err := srv.AgentNodeMaintenance(nil, req); !isPermissionDenied(err) {
+			t.Fatalf("err: %v", err)
+		}
+	})
 
-	// Try with the root token.
-	req, _ = http.NewRequest("PUT", "/v1/agent/self/maintenance?enable=true&reason=broken&token=root", nil)
-	if _, err := srv.AgentNodeMaintenance(nil, req); err != nil {
-		t.Fatalf("err: %v", err)
-	}
+	t.Run("root token", func(t *testing.T) {
+		req, _ := http.NewRequest("PUT", "/v1/agent/self/maintenance?enable=true&reason=broken&token=root", nil)
+		if _, err := srv.AgentNodeMaintenance(nil, req); err != nil {
+			t.Fatalf("err: %v", err)
+		}
+	})
 }
 
 func TestAgent_RegisterCheck_Service(t *testing.T) {
diff --git a/command/agent/event_endpoint_test.go b/command/agent/event_endpoint_test.go
index ef2da56ee6..ee8a7484db 100644
--- a/command/agent/event_endpoint_test.go
+++ b/command/agent/event_endpoint_test.go
@@ -187,8 +187,7 @@ func TestEventList_ACLFilter(t *testing.T) {
 		t.Fatalf("err: %v", err)
 	}
 
-	// Try no token.
-	{
+	t.Run("no token", func(t *testing.T) {
 		retry.Run(t, func(r *retry.R) {
 			req, _ := http.NewRequest("GET", "/v1/event/list", nil)
 			resp := httptest.NewRecorder()
@@ -205,10 +204,9 @@ func TestEventList_ACLFilter(t *testing.T) {
 				r.Fatalf("bad: %#v", list)
 			}
 		})
-	}
+	})
 
-	// Try root token.
-	{
+	t.Run("root token", func(t *testing.T) {
 		retry.Run(t, func(r *retry.R) {
 			req, _ := http.NewRequest("GET", "/v1/event/list?token=root", nil)
 			resp := httptest.NewRecorder()
@@ -225,7 +223,7 @@ func TestEventList_ACLFilter(t *testing.T) {
 				r.Fatalf("bad: %#v", list)
 			}
 		})
-	}
+	})
 }
 
 func TestEventList_Blocking(t *testing.T) {