diff --git a/pkg/imgutil/dockerconfigresolver/credentialsstore_test.go b/pkg/imgutil/dockerconfigresolver/credentialsstore_test.go
index 38bf4a29e35..2172554addf 100644
--- a/pkg/imgutil/dockerconfigresolver/credentialsstore_test.go
+++ b/pkg/imgutil/dockerconfigresolver/credentialsstore_test.go
@@ -169,6 +169,7 @@ func TestBrokenCredentialsStore(t *testing.T) {
 	}
 
 	t.Run("Broken Docker Config testing", func(t *testing.T) {
+		// Do NOT parallelize this test, as it relies on Chdir, which would have side effects for other tests.
 		registryURL, err := Parse("registry")
 		if err != nil {
 			t.Fatal(err)
@@ -177,6 +178,12 @@ func TestBrokenCredentialsStore(t *testing.T) {
 		for _, tc := range testCases {
 			t.Run(tc.description, func(t *testing.T) {
 				directory := tc.setup()
+				// See https://github.com/containerd/nerdctl/issues/3413
+				oldpwd, err := os.Getwd()
+				assert.NilError(t, err)
+				// Ignore the error, as the destination may not be a directory
+				_ = os.Chdir(directory)
+
 				cs, err := NewCredentialsStore(directory)
 				assert.ErrorIs(t, err, tc.errorNew)
 				if err != nil {
@@ -189,6 +196,9 @@ func TestBrokenCredentialsStore(t *testing.T) {
 
 				err = cs.Store(registryURL, af)
 				assert.ErrorIs(t, err, tc.errorWrite)
+
+				err = os.Chdir(oldpwd)
+				assert.NilError(t, err)
 			})
 		}
 	})