diff --git a/router/router_download.go b/router/router_download.go
index 2ebc646..2d3f765 100644
--- a/router/router_download.go
+++ b/router/router_download.go
@@ -95,6 +95,7 @@ func getDownloadFile(c *gin.Context) {
 		middleware.CaptureAndAbort(c, err)
 		return
 	}
+	defer f.Close()
 
 	c.Header("Content-Length", strconv.Itoa(int(st.Size())))
 	c.Header("Content-Disposition", "attachment; filename="+strconv.Quote(st.Name()))
diff --git a/server/backup/backup_local.go b/server/backup/backup_local.go
index bdaeff6..a6a1d72 100644
--- a/server/backup/backup_local.go
+++ b/server/backup/backup_local.go
@@ -85,6 +85,7 @@ func (b *LocalBackup) Restore(ctx context.Context, _ io.Reader, callback Restore
 	if err != nil {
 		return err
 	}
+	defer f.Close()
 
 	var reader io.Reader = f
 	// Steal the logic we use for making backups which will be applied when restoring
diff --git a/server/filesystem/compress.go b/server/filesystem/compress.go
index f7c405a..626983d 100644
--- a/server/filesystem/compress.go
+++ b/server/filesystem/compress.go
@@ -148,7 +148,7 @@ func (fs *Filesystem) DecompressFileUnsafe(ctx context.Context, dir string, file
 	if err != nil {
 		return err
 	}
-	// TODO: defer file close?
+	defer f.Close()
 
 	// Identify the type of archive we are dealing with.
 	format, input, err := archiver.Identify(filepath.Base(file), f)
diff --git a/server/filesystem/filesystem.go b/server/filesystem/filesystem.go
index cdfe506..376b7f9 100644
--- a/server/filesystem/filesystem.go
+++ b/server/filesystem/filesystem.go
@@ -92,6 +92,9 @@ func (fs *Filesystem) Touch(p string, flag int) (*os.File, error) {
 	if err == nil {
 		return f, nil
 	}
+	if f != nil {
+		_ = f.Close()
+	}
 	// If the error is not because it doesn't exist then we just need to bail at this point.
 	if !errors.Is(err, os.ErrNotExist) {
 		return nil, errors.Wrap(err, "server/filesystem: touch: failed to open file handle")
@@ -114,6 +117,7 @@ func (fs *Filesystem) Touch(p string, flag int) (*os.File, error) {
 	if err != nil {
 		return nil, errors.Wrap(err, "server/filesystem: touch: failed to open file with wait")
 	}
+	_ = f.Close()
 	_ = fs.Chown(cleaned)
 	return f, nil
 }