diff --git a/cmd/pinniped/cmd/exchange_credential.go b/cmd/pinniped/cmd/exchange_credential.go
index 20c1d5e0..2440864c 100644
--- a/cmd/pinniped/cmd/exchange_credential.go
+++ b/cmd/pinniped/cmd/exchange_credential.go
@@ -20,6 +20,7 @@ import (
 	"go.pinniped.dev/internal/client"
 	"go.pinniped.dev/internal/constable"
 	"go.pinniped.dev/internal/here"
+	"go.pinniped.dev/internal/plog"
 )
 
 //nolint: gochecknoinits
@@ -80,6 +81,8 @@ func newExchangeCredentialCmd(args []string, stdout, stderr io.Writer) *exchange
 	c.cmd.SetOut(stdout)
 	c.cmd.SetErr(stderr)
 
+	plog.RemoveKlogGlobalFlags()
+
 	return c
 }
 
diff --git a/cmd/pinniped/cmd/exchange_credential_test.go b/cmd/pinniped/cmd/exchange_credential_test.go
index 9c9e1c3f..2b1367c2 100644
--- a/cmd/pinniped/cmd/exchange_credential_test.go
+++ b/cmd/pinniped/cmd/exchange_credential_test.go
@@ -120,7 +120,7 @@ func TestNewCredentialExchangeCmd(t *testing.T) {
 			r.Equal(knownGoodHelpForExchangeCredential, stdout.String())
 			r.Empty(stderr.String())
 		})
-	}, spec.Parallel(), spec.Report(report.Terminal{}))
+	}, spec.Sequential(), spec.Report(report.Terminal{}))
 }
 
 func TestExchangeCredential(t *testing.T) {
diff --git a/cmd/pinniped/cmd/get_kubeconfig.go b/cmd/pinniped/cmd/get_kubeconfig.go
index f3a37dac..b7299c67 100644
--- a/cmd/pinniped/cmd/get_kubeconfig.go
+++ b/cmd/pinniped/cmd/get_kubeconfig.go
@@ -25,6 +25,7 @@ import (
 	pinnipedclientset "go.pinniped.dev/generated/1.19/client/concierge/clientset/versioned"
 	"go.pinniped.dev/internal/constable"
 	"go.pinniped.dev/internal/here"
+	"go.pinniped.dev/internal/plog"
 )
 
 //nolint: gochecknoinits
@@ -91,6 +92,7 @@ func (c *getKubeConfigCommand) Command() *cobra.Command {
 	cmd.Flags().StringVar(&c.flags.authenticatorType, "authenticator-type", c.flags.authenticatorType, "Authenticator type (e.g., 'webhook')")
 	cmd.Flags().StringVar(&c.flags.authenticatorName, "authenticator-name", c.flags.authenticatorType, "Authenticator name")
 	mustMarkRequired(cmd, "token")
+	plog.RemoveKlogGlobalFlags()
 	return cmd
 }
 
diff --git a/cmd/pinniped/cmd/get_kubeconfig_test.go b/cmd/pinniped/cmd/get_kubeconfig_test.go
index 4784f1dd..099ab753 100644
--- a/cmd/pinniped/cmd/get_kubeconfig_test.go
+++ b/cmd/pinniped/cmd/get_kubeconfig_test.go
@@ -72,7 +72,6 @@ var (
 )
 
 func TestNewGetKubeConfigCmd(t *testing.T) {
-	t.Parallel()
 	tests := []struct {
 		name       string
 		args       []string
@@ -95,7 +94,6 @@ func TestNewGetKubeConfigCmd(t *testing.T) {
 	for _, tt := range tests {
 		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
 			cmd := newGetKubeConfigCommand().Command()
 			require.NotNil(t, cmd)
 
diff --git a/cmd/pinniped/cmd/login_oidc_test.go b/cmd/pinniped/cmd/login_oidc_test.go
index af288e3e..637a7af4 100644
--- a/cmd/pinniped/cmd/login_oidc_test.go
+++ b/cmd/pinniped/cmd/login_oidc_test.go
@@ -16,8 +16,6 @@ import (
 )
 
 func TestLoginOIDCCommand(t *testing.T) {
-	t.Parallel()
-
 	cfgDir := mustGetConfigDir()
 
 	time1 := time.Date(3020, 10, 12, 13, 14, 15, 16, time.UTC)
@@ -88,7 +86,6 @@ func TestLoginOIDCCommand(t *testing.T) {
 	for _, tt := range tests {
 		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
 			var (
 				gotIssuer   string
 				gotClientID string
diff --git a/cmd/pinniped/cmd/version_test.go b/cmd/pinniped/cmd/version_test.go
index 4bf318c0..f5f9b565 100644
--- a/cmd/pinniped/cmd/version_test.go
+++ b/cmd/pinniped/cmd/version_test.go
@@ -36,7 +36,6 @@ var (
 )
 
 func TestNewVersionCmd(t *testing.T) {
-	t.Parallel()
 	tests := []struct {
 		name             string
 		args             []string
@@ -64,7 +63,6 @@ func TestNewVersionCmd(t *testing.T) {
 	for _, tt := range tests {
 		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
 			cmd := newVersionCommand()
 			require.NotNil(t, cmd)
 
diff --git a/internal/plog/klog.go b/internal/plog/klog.go
index 50f0cfd6..aac73503 100644
--- a/internal/plog/klog.go
+++ b/internal/plog/klog.go
@@ -3,10 +3,21 @@
 
 package plog
 
-import "github.com/spf13/pflag"
+import (
+	"sync"
+
+	"github.com/spf13/pflag"
+)
+
+//nolint: gochecknoglobals
+var removeKlogGlobalFlagsLock sync.Mutex
 
 // RemoveKlogGlobalFlags attempts to "remove" flags that get unconditionally added by importing klog.
 func RemoveKlogGlobalFlags() {
+	// since we mess with global state, we need a lock to synchronize us when called in parallel during tests
+	removeKlogGlobalFlagsLock.Lock()
+	defer removeKlogGlobalFlagsLock.Unlock()
+
 	// if this function starts to panic, it likely means that klog stopped mucking with global flags
 	const globalLogFlushFlag = "log-flush-frequency"
 	if err := pflag.CommandLine.MarkHidden(globalLogFlushFlag); err != nil {