diff --git a/google/auth/pluggable.py b/google/auth/pluggable.py
index 53b4eac5b..749b11531 100644
--- a/google/auth/pluggable.py
+++ b/google/auth/pluggable.py
@@ -229,9 +229,10 @@ def retrieve_subject_token(self, request):
         # Handle executable output.
         response = json.loads(result.stdout.decode("utf-8")) if result.stdout else None
         if not response and self._credential_source_executable_output_file is not None:
-            response = json.load(
-                open(self._credential_source_executable_output_file, encoding="utf-8")
-            )
+            with open(
+                self._credential_source_executable_output_file, encoding="utf-8"
+            ) as file:
+                response = json.load(file)
 
         subject_token = self._parse_subject_token(response)
         return subject_token
diff --git a/pytest.ini b/pytest.ini
new file mode 100644
index 000000000..9ca928b14
--- /dev/null
+++ b/pytest.ini
@@ -0,0 +1,13 @@
+[pytest]
+filterwarnings =
+    # treat all warnings as errors
+    error
+    # Remove once https://github.com/googleapis/google-auth-library-python/issues/1422 is fixed
+    ignore:Inheritance class AuthorizedSession from ClientSession is discouraged:DeprecationWarning
+    # Remove once support for Python 3.7 is dropped
+    ignore:After January 1, 2024, new releases of this library will drop support for Python 3.7:DeprecationWarning
+    # Remove once https://github.com/googleapis/google-auth-library-python/issues/1431 is fixed
+    ignore:coroutine 'AsyncMockMixin._execute_mock_call' was never awaited:RuntimeWarning
+    # Remove once release PR https://github.com/googleapis/python-api-common-protos/pull/191 is merged
+    ignore:.*pkg_resources.declare_namespace:DeprecationWarning
+    ignore:.*pkg_resources is deprecated as an API:DeprecationWarning
diff --git a/tests_async/oauth2/test_credentials_async.py b/tests_async/oauth2/test_credentials_async.py
index f6c640ad6..998a0e7cc 100644
--- a/tests_async/oauth2/test_credentials_async.py
+++ b/tests_async/oauth2/test_credentials_async.py
@@ -489,25 +489,34 @@ async def test_before_request_no_refresh(self, refresh, apply):
 
 class TestUserAccessTokenCredentials(object):
     def test_instance(self):
-        cred = _credentials_async.UserAccessTokenCredentials()
-        assert cred._account is None
+        with pytest.warns(
+            UserWarning, match="UserAccessTokenCredentials is deprecated"
+        ):
+            cred = _credentials_async.UserAccessTokenCredentials()
+            assert cred._account is None
 
-        cred = cred.with_account("account")
-        assert cred._account == "account"
+            cred = cred.with_account("account")
+            assert cred._account == "account"
 
     @mock.patch("google.auth._cloud_sdk.get_auth_access_token", autospec=True)
     def test_refresh(self, get_auth_access_token):
-        get_auth_access_token.return_value = "access_token"
-        cred = _credentials_async.UserAccessTokenCredentials()
-        cred.refresh(None)
-        assert cred.token == "access_token"
+        with pytest.warns(
+            UserWarning, match="UserAccessTokenCredentials is deprecated"
+        ):
+            get_auth_access_token.return_value = "access_token"
+            cred = _credentials_async.UserAccessTokenCredentials()
+            cred.refresh(None)
+            assert cred.token == "access_token"
 
     def test_with_quota_project(self):
-        cred = _credentials_async.UserAccessTokenCredentials()
-        quota_project_cred = cred.with_quota_project("project-foo")
+        with pytest.warns(
+            UserWarning, match="UserAccessTokenCredentials is deprecated"
+        ):
+            cred = _credentials_async.UserAccessTokenCredentials()
+            quota_project_cred = cred.with_quota_project("project-foo")
 
-        assert quota_project_cred._quota_project_id == "project-foo"
-        assert quota_project_cred._account == cred._account
+            assert quota_project_cred._quota_project_id == "project-foo"
+            assert quota_project_cred._account == cred._account
 
     @mock.patch(
         "google.oauth2._credentials_async.UserAccessTokenCredentials.apply",
@@ -518,7 +527,10 @@ def test_with_quota_project(self):
         autospec=True,
     )
     def test_before_request(self, refresh, apply):
-        cred = _credentials_async.UserAccessTokenCredentials()
-        cred.before_request(mock.Mock(), "GET", "https://example.com", {})
-        refresh.assert_called()
-        apply.assert_called()
+        with pytest.warns(
+            UserWarning, match="UserAccessTokenCredentials is deprecated"
+        ):
+            cred = _credentials_async.UserAccessTokenCredentials()
+            cred.before_request(mock.Mock(), "GET", "https://example.com", {})
+            refresh.assert_called()
+            apply.assert_called()
diff --git a/tests_async/test_credentials_async.py b/tests_async/test_credentials_async.py
index 7d82758c3..f67137c77 100644
--- a/tests_async/test_credentials_async.py
+++ b/tests_async/test_credentials_async.py
@@ -76,7 +76,7 @@ async def test_before_request():
     headers = {}
 
     # Second call shouldn't call refresh.
-    credentials.before_request(request, "http://example.com", "GET", headers)
+    await credentials.before_request(request, "http://example.com", "GET", headers)
 
     assert credentials.valid
     assert credentials.token == "token"