diff --git a/cmd/firewall/allow_test.go b/cmd/firewall/allow_test.go
index 4ea4b24..4989ea2 100644
--- a/cmd/firewall/allow_test.go
+++ b/cmd/firewall/allow_test.go
@@ -130,7 +130,7 @@ func TestEmitAllowRevoke_CarriesNonDefaultNamespace(t *testing.T) {
 	rootCmdFor(inner)
 
 	err := emitAllowRevoke(context.Background(), inner, parent, local, fr, false)
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	var post string
 	for _, c := range fr.calls {
 		if strings.Contains(c, "-X POST") {
@@ -214,7 +214,7 @@ func TestEmitAllowRevoke_FetchesTokenPerHostWhenOverrideAbsent(t *testing.T) {
 	rootCmdFor(inner)
 
 	err := emitAllowRevoke(context.Background(), inner, parent, local, fr, false)
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	var post string
 	for _, c := range fr.calls {
 		if strings.Contains(c, "-X POST") && strings.Contains(c, "/api/v1/firewall/allow") {
diff --git a/cmd/firewall/containers_test.go b/cmd/firewall/containers_test.go
index 2352798..bf255bd 100644
--- a/cmd/firewall/containers_test.go
+++ b/cmd/firewall/containers_test.go
@@ -25,7 +25,7 @@ func TestEmitContainers_RunsAndFormatsTable(t *testing.T) {
 	rootCmdFor(inner)
 
 	err := emitContainers(context.Background(), inner, parent, fr)
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	// Discovery command was issued, targeting the default-namespace bridge.
 	assert.Len(t, fr.calls, 1)
 	assert.Contains(t, fr.calls[0], "podman ps")
@@ -44,7 +44,7 @@ func TestEmitContainers_EmptyOutput(t *testing.T) {
 	rootCmdFor(inner)
 
 	err := emitContainers(context.Background(), inner, parent, fr)
-	assert.NoError(t, err)
+	require.NoError(t, err)
 }
 
 // TestEmitContainers_AllNamespaces_FansOutAcrossNetworks verifies that with
diff --git a/cmd/firewall/list_test.go b/cmd/firewall/list_test.go
index df18fde..e9ed0fa 100644
--- a/cmd/firewall/list_test.go
+++ b/cmd/firewall/list_test.go
@@ -7,6 +7,7 @@ import (
 
 	"github.com/spf13/cobra"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 func TestEmitList_CallsCooldGet(t *testing.T) {
@@ -18,7 +19,7 @@ func TestEmitList_CallsCooldGet(t *testing.T) {
 	rootCmdFor(inner)
 
 	err := emitList(context.Background(), inner, parent, fr)
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	assert.Len(t, fr.calls, 1)
 	assert.Contains(t, fr.calls[0], "curl")
 	assert.Contains(t, fr.calls[0], "/api/v1/firewall/allow")
@@ -32,7 +33,7 @@ func TestEmitList_EmptyCoold(t *testing.T) {
 	rootCmdFor(inner)
 
 	err := emitList(context.Background(), inner, parent, fr)
-	assert.NoError(t, err)
+	require.NoError(t, err)
 }
 
 func TestEmitList_FetchesPerHostTokenWhenOverrideAbsent(t *testing.T) {
@@ -49,7 +50,7 @@ func TestEmitList_FetchesPerHostTokenWhenOverrideAbsent(t *testing.T) {
 	rootCmdFor(inner)
 
 	err := emitList(context.Background(), inner, parent, fr)
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	var ranTokenFetch, ranGet bool
 	for _, c := range fr.calls {
 		if strings.Contains(c, "cat /etc/coolify/api-token") {
diff --git a/cmd/firewall/resolve_test.go b/cmd/firewall/resolve_test.go
index a7465ac..be9cd56 100644
--- a/cmd/firewall/resolve_test.go
+++ b/cmd/firewall/resolve_test.go
@@ -52,7 +52,7 @@ func TestResolveEndpoint_ByRawIP(t *testing.T) {
 
 func TestResolveEndpoint_UnknownRawIP_Synthetic(t *testing.T) {
 	c, err := resolveEndpoint("10.99.99.99", cs())
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	assert.Empty(t, c.Host)
 	assert.Equal(t, "10.99.99.99", c.IP.String())
 }
diff --git a/cmd/init/plan_test.go b/cmd/init/plan_test.go
index e55ad24..e1fdf24 100644
--- a/cmd/init/plan_test.go
+++ b/cmd/init/plan_test.go
@@ -4,6 +4,7 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 
 	"github.com/coollabsio/coolify-cli/cmd/common"
 )
@@ -36,7 +37,7 @@ func TestValidatePlanFlags(t *testing.T) {
 				Namespaces: []string{common.DefaultNamespace},
 			},
 		})
-		assert.NoError(t, err)
+		require.NoError(t, err)
 	})
 
 	t.Run("invalid namespace", func(t *testing.T) {
diff --git a/internal/firewall/coold_client_test.go b/internal/firewall/coold_client_test.go
index a64bb0b..7bafd16 100644
--- a/internal/firewall/coold_client_test.go
+++ b/internal/firewall/coold_client_test.go
@@ -8,6 +8,7 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 
 	"github.com/coollabsio/coolify-cli/internal/ssh"
 )
@@ -84,7 +85,7 @@ func TestCooldApply_SendsJSONPayload(t *testing.T) {
 		Proto: "tcp", Port: 80,
 	}
 	err := CooldApply(context.Background(), fr, "h1", "root", 22, 8443, "wg0", "t", r)
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	assert.Len(t, fr.calls, 1)
 	assert.Contains(t, fr.calls[0], `"src":"10.0.0.1"`)
 	assert.Contains(t, fr.calls[0], `"dst":"10.0.0.2"`)
@@ -98,7 +99,7 @@ func TestCooldApply_OmitsProtoWhenEmpty(t *testing.T) {
 		Src: net.ParseIP("10.0.0.1"), Dst: net.ParseIP("10.0.0.2"),
 	}
 	err := CooldApply(context.Background(), fr, "h1", "root", 22, 8443, "wg0", "t", r)
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	// omitempty drops zero port and empty proto — avoids tripping coold's
 	// "port requires proto" validation.
 	assert.NotContains(t, fr.calls[0], `"proto"`)
@@ -120,7 +121,7 @@ func TestCooldList_ParsesJSON(t *testing.T) {
 		]`,
 	}}
 	rules, err := CooldList(context.Background(), fr, "h1", "root", 22, 8443, "wg0", "t", "")
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	assert.Len(t, rules, 2)
 	assert.Equal(t, "h1", rules[0].Host)
 	assert.Equal(t, "cid:abc123def456", rules[0].Comment)
@@ -135,7 +136,7 @@ func TestCooldList_ParsesJSON(t *testing.T) {
 func TestCooldList_EmptyBody(t *testing.T) {
 	fr := &fakeCooldRunner{}
 	rules, err := CooldList(context.Background(), fr, "h1", "root", 22, 8443, "wg0", "t", "")
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	assert.Empty(t, rules)
 }
 
@@ -159,7 +160,7 @@ func TestFetchCooldToken_ReadsFile(t *testing.T) {
 		"/etc/coolify/api-token": "deadbeefcafe\n",
 	}}
 	tok, err := FetchCooldToken(context.Background(), fr, "h1", "root", 22)
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	assert.Equal(t, "deadbeefcafe", tok)
 }
 
diff --git a/internal/firewall/discover_test.go b/internal/firewall/discover_test.go
index a80ff9e..f6591f6 100644
--- a/internal/firewall/discover_test.go
+++ b/internal/firewall/discover_test.go
@@ -7,6 +7,7 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 func TestParseDiscoverLine(t *testing.T) {
@@ -66,7 +67,7 @@ func TestDiscoverContainers(t *testing.T) {
 	}}
 	got, err := DiscoverContainers(context.Background(), r, "h1", "root", 22,
 		"default", "coolify-default-mesh")
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	assert.Len(t, got, 2)
 	assert.Equal(t, "api", got[0].Name) // sorted by name
 	assert.Equal(t, "web", got[1].Name)
@@ -79,7 +80,7 @@ func TestDiscoverContainers_EmptyOutput(t *testing.T) {
 	r := &fakeRunner{responses: map[string]string{}}
 	got, err := DiscoverContainers(context.Background(), r, "h1", "root", 22,
 		"default", "coolify-default-mesh")
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	assert.Empty(t, got)
 }
 
@@ -89,7 +90,7 @@ func TestDiscoverContainers_BadLinesSkipped(t *testing.T) {
 	}}
 	got, err := DiscoverContainers(context.Background(), r, "h1", "root", 22,
 		"default", "coolify-default-mesh")
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	assert.Len(t, got, 1)
 	assert.Equal(t, "web", got[0].Name)
 }