diff --git a/pkg/imgutil/dockerconfigresolver/credentialsstore_test.go b/pkg/imgutil/dockerconfigresolver/credentialsstore_test.go
index 38bf4a29e35..5833190da66 100644
--- a/pkg/imgutil/dockerconfigresolver/credentialsstore_test.go
+++ b/pkg/imgutil/dockerconfigresolver/credentialsstore_test.go
@@ -168,7 +168,8 @@ func TestBrokenCredentialsStore(t *testing.T) {
 		},
 	}
 
-	t.Run("Broken Docker Config testing", func(t *testing.T) {
+	t.Run("Docker Config testing with a variety of filesystem situations", func(t *testing.T) {
+		// Do NOT parallelize this test, as it relies on Chdir, which would have side effects for other tests.
 		registryURL, err := Parse("registry")
 		if err != nil {
 			t.Fatal(err)
@@ -177,6 +178,16 @@ func TestBrokenCredentialsStore(t *testing.T) {
 		for _, tc := range testCases {
 			t.Run(tc.description, func(t *testing.T) {
 				directory := tc.setup()
+				// See https://github.com/containerd/nerdctl/issues/3413
+				oldpwd, err := os.Getwd()
+				assert.NilError(t, err)
+				// Ignore the error, as the destination may not be a directory
+				_ = os.Chdir(directory)
+				t.Cleanup(func() {
+					err = os.Chdir(oldpwd)
+					assert.NilError(t, err)
+				})
+
 				cs, err := NewCredentialsStore(directory)
 				assert.ErrorIs(t, err, tc.errorNew)
 				if err != nil {
@@ -189,6 +200,7 @@ func TestBrokenCredentialsStore(t *testing.T) {
 
 				err = cs.Store(registryURL, af)
 				assert.ErrorIs(t, err, tc.errorWrite)
+
 			})
 		}
 	})