diff --git a/.golangci.yml b/.golangci.yml
index ecc5e7c8e253f..db7bea7523724 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -128,6 +128,123 @@ linters-settings:
             desc: 'use "log/slog" instead'
           - pkg: golang.org/x/exp/slog
             desc: 'use "log/slog" instead'
+      # Prevent importing testify in production code.
+      testify:
+        files:
+          # Tests can import testify
+          - '!$test'
+          # Exceptions
+          # Remove these once they are complaint.
+          - '!**/api/testhelpers/**'
+          - '!**/e/lib/auth/ssotestlib.go'
+          - '!**/e/lib/aws/identitycenter/test/**'
+          - '!**/e/lib/idp/saml/testenv/**'
+          - '!**/e/lib/operatortest/**'
+          - '!**/e/tests/**'
+          - '!**/lib/automaticupgrades/basichttp/servermock.go'
+          - '!**/lib/auth/helpers.go'
+          - '!**/lib/auth/keystore/testhelpers.go'
+          - '!**/lib/auth/test/**'
+          - '!**/lib/backend/test/**'
+          - '!**/lib/events/athena/test.go'
+          - '!**/lib/events/test/**'
+          - '!**/lib/kube/proxy/utils_testing.go'
+          - '!**/lib/services/suite/**'
+          - '!**/lib/srv/mock.go'
+          - '!**/lib/srv/db/redis/test.go'
+          - '!**/lib/teleterm/gatewaytest/**'
+          - '!**/lib/utils/testhelpers.go'
+          - '!**/lib/utils/testutils/**'
+          - '!**/integration/appaccess/fixtures.go'
+          - '!**/integration/appaccess/jwt.go'
+          - '!**/integration/appaccess/pack.go'
+          - '!**/integration/db/fixture.go'
+          - '!**/integration/hsm/helpers.go'
+          - '!**/integration/helpers/**'
+          - '!**/integration/proxy/proxy_helpers.go'
+          - '!**/integrations/access/email/testlib/**'
+          - '!**/integrations/access/datadog/testlib/**'
+          - '!**/integrations/access/discord/testlib/**'
+          - '!**/integrations/access/jira/testlib/**'
+          - '!**/integrations/access/mattermost/testlib/**'
+          - '!**/integrations/access/msteams/testlib/**'
+          - '!**/integrations/access/opsgenie/testlib/**'
+          - '!**/integrations/access/pagerduty/testlib/**'
+          - '!**/integrations/access/servicenow/testlib/**'
+          - '!**/integrations/access/slack/testlib/**'
+          - '!**/integrations/lib/testing/integration/accessrequestsuite.go'
+          - '!**/integrations/lib/testing/integration/app.go'
+          - '!**/integrations/lib/testing/integration/authhelper.go'
+          - '!**/integrations/lib/testing/integration/suite.go'
+          - '!**/integrations/operator/controllers/resources/testlib/**'
+          - '!**/tool/teleport/testenv/**'
+        deny:
+          - pkg: github.com/stretchr/testify
+            desc: 'testify should not be imported outside of test code'
+      # Prevent importing integration test helpers in production code.
+      integration:
+        files:
+          # Tests can do anything
+          - '!$test'
+          - '!**/integration/**'
+          - '!**/e/tests/**'
+          - '!**/integrations/operator/controllers/resources/testlib/**'
+        deny:
+          - pkg: github.com/gravitational/teleport/integration
+            desc: 'integration test should not be imported outside of intergation tests'
+        allow:
+          # integrations is explicitly allowed becuase the deny rule above
+          # will match both integration and integrations, however only
+          # integration should be denied.
+          - github.com/gravitational/teleport/integrations
+        list-mode: lax
+      # Prevent importing testing in production code.
+      testing:
+        files:
+          # Tests can do anything
+          - '!$test'
+          # Exceptions
+          # Remove these once they are complaint.
+          - '!**/api/testhelpers/**'
+          - '!**/e/lib/auth/ssotestlib.go'
+          - '!**/e/lib/aws/identitycenter/test/**'
+          - '!**/e/lib/devicetrust/testenv/**'
+          - '!**/e/lib/devicetrust/storage/storage.go'
+          - '!**/e/lib/idp/saml/testenv/**'
+          - '!**/e/lib/jamf/testenv/**'
+          - '!**/e/lib/okta/api/oktaapitest/**'
+          - '!**/e/lib/operatortest/**'
+          - '!**/e/tests/**'
+          - '!**/integration/**'
+          - '!**/integrations/access/email/testlib/**'
+          - '!**/integrations/access/msteams/testlib/**'
+          - '!**/integrations/access/slack/testlib/**'
+          - '!**/integrations/operator/controllers/resources/testlib/**'
+          - '!**/lib/auth/helpers.go'
+          - '!**/lib/auth/keystore/testhelpers.go'
+          - '!**/lib/auth/test/**'
+          - '!**/lib/automaticupgrades/basichttp/servermock.go'
+          - '!**/lib/backend/test/**'
+          - '!**/lib/cryptosuites/precompute.go'
+          - '!**/lib/cryptosuites/internal/rsa/rsa.go'
+          - '!**/lib/events/test/**'
+          - '!**/lib/events/athena/test.go'
+          - '!**/lib/fixtures/**'
+          - '!**/lib/kube/proxy/utils_testing.go'
+          - '!**/lib/modules/test.go'
+          - '!**/lib/service/service.go'
+          - '!**/lib/services/local/users.go'
+          - '!**/lib/services/suite/**'
+          - '!**/lib/srv/mock.go'
+          - '!**/lib/srv/db/redis/test.go'
+          - '!**/lib/teleterm/gatewaytest/**'
+          - '!**/lib/utils/cli.go'
+          - '!**/lib/utils/testhelpers.go'
+          - '!**/lib/utils/testutils/**'
+          - '!**/tool/teleport/testenv/**'
+        deny:
+          - pkg: testing
+            desc: 'testing should not be imported outside of tests'
       # Prevent importing internal packages in client tools or packages containing
       # common interfaces consumed by them that are known to bloat binaries or break builds
       # because they only support a single platform.