diff --git a/Makefile b/Makefile
index eb8a2757188..10548364dbd 100644
--- a/Makefile
+++ b/Makefile
@@ -49,9 +49,27 @@ endif
 # for your distribution (look for libre2.a). See the Dockerfile for an example of how to build it.
 BUILD_STATIC ?= 0
 
+# Enable this to run the data race detector in staging builds or bats tests.
+# Mutually exclusive with BUILD_STATIC, slows down the execution (tests take 4x as long)
+RACE_DETECT ?= 1
+
 # List of notification plugins to build
 PLUGINS ?= $(patsubst ./cmd/notification-%,%,$(wildcard ./cmd/notification-*))
 
+# Configure race detector.
+
+GORACE_OPTS :=
+GORACE :=
+
+ifeq ($(RACE_DETECT),1)
+  GORACE_OPTS := -race
+  export GORACE := halt_on_error=0 exitcode=66 strip_path_prefix=$(shell pwd)/ log_path=/tmp/race
+  export CGO_ENABLED := 1
+endif
+
+export GORACE_OPTS
+export GORACE
+
 #--------------------------------------
 
 GO = go
diff --git a/cmd/crowdsec-cli/Makefile b/cmd/crowdsec-cli/Makefile
index 6d6e4da8dbd..f2c083b8b47 100644
--- a/cmd/crowdsec-cli/Makefile
+++ b/cmd/crowdsec-cli/Makefile
@@ -5,7 +5,7 @@ ifeq ($(OS), Windows_NT)
 endif
 
 GO = go
-GOBUILD = $(GO) build
+GOBUILD = $(GO) build $(GORACE_OPTS)
 
 BINARY_NAME = cscli$(EXT)
 
diff --git a/cmd/crowdsec/Makefile b/cmd/crowdsec/Makefile
index 39f807cab88..bc54d4f1141 100644
--- a/cmd/crowdsec/Makefile
+++ b/cmd/crowdsec/Makefile
@@ -5,7 +5,7 @@ ifeq ($(OS), Windows_NT)
 endif
 
 GO = go
-GOBUILD = $(GO) build
+GOBUILD = $(GO) build $(GORACE_OPTS)
 GOTEST = $(GO) test
 
 CROWDSEC_BIN = crowdsec$(EXT)
diff --git a/cmd/crowdsec/api.go b/cmd/crowdsec/api.go
index 25f5ff03988..a1b59839c3c 100644
--- a/cmd/crowdsec/api.go
+++ b/cmd/crowdsec/api.go
@@ -57,7 +57,7 @@ func serveAPIServer(ctx context.Context, apiServer *apiserver.APIServer) {
 		}()
 
 		pluginTomb.Go(func() error {
-			pluginBroker.Run(&pluginTomb)
+			pluginBroker.Run(pluginTomb)
 			return nil
 		})
 
diff --git a/cmd/crowdsec/crowdsec.go b/cmd/crowdsec/crowdsec.go
index 968d8dd556c..dc747217342 100644
--- a/cmd/crowdsec/crowdsec.go
+++ b/cmd/crowdsec/crowdsec.go
@@ -167,7 +167,7 @@ func runCrowdsec(
 
 	log.Info("Starting processing data")
 
-	if err := acquisition.StartAcquisition(ctx, datasources, logLines, &acquisTomb); err != nil {
+	if err := acquisition.StartAcquisition(ctx, datasources, logLines, acquisTomb); err != nil {
 		return fmt.Errorf("starting acquisition error: %w", err)
 	}
 
diff --git a/cmd/crowdsec/main.go b/cmd/crowdsec/main.go
index 9480e6dd08e..da8010e446e 100644
--- a/cmd/crowdsec/main.go
+++ b/cmd/crowdsec/main.go
@@ -31,11 +31,11 @@ import (
 
 var (
 	// tombs for the parser, buckets and outputs.
-	acquisTomb   tomb.Tomb
-	outputsTomb  tomb.Tomb
-	apiTomb      tomb.Tomb
-	crowdsecTomb tomb.Tomb
-	pluginTomb   tomb.Tomb
+	acquisTomb   *tomb.Tomb
+	outputsTomb  *tomb.Tomb
+	apiTomb      *tomb.Tomb
+	crowdsecTomb *tomb.Tomb
+	pluginTomb   *tomb.Tomb
 
 	flags Flags
 
@@ -48,6 +48,14 @@ var (
 	pluginBroker csplugin.PluginBroker
 )
 
+func initTombs() {
+	acquisTomb = &tomb.Tomb{}
+	outputsTomb = &tomb.Tomb{}
+	apiTomb = &tomb.Tomb{}
+	crowdsecTomb = &tomb.Tomb{}
+	pluginTomb = &tomb.Tomb{}
+}
+
 func LoadBuckets(cConfig *csconfig.Config, hub *cwhub.Hub) error {
 	var err error
 
diff --git a/cmd/crowdsec/serve.go b/cmd/crowdsec/serve.go
index e916daed4dd..663dd5a8360 100644
--- a/cmd/crowdsec/serve.go
+++ b/cmd/crowdsec/serve.go
@@ -11,7 +11,6 @@ import (
 
 	log "github.com/sirupsen/logrus"
 	"golang.org/x/sync/errgroup"
-	"gopkg.in/tomb.v2"
 
 	"github.com/crowdsecurity/go-cs-lib/csdaemon"
 	"github.com/crowdsecurity/go-cs-lib/trace"
@@ -27,12 +26,7 @@ import (
 )
 
 func reloadHandler(ctx context.Context, _ os.Signal) (*csconfig.Config, error) {
-	// re-initialize tombs
-	acquisTomb = tomb.Tomb{}
-	outputsTomb = tomb.Tomb{}
-	apiTomb = tomb.Tomb{}
-	crowdsecTomb = tomb.Tomb{}
-	pluginTomb = tomb.Tomb{}
+	initTombs()
 
 	sd := NewStateDumper(flags.DumpDir)
 
@@ -161,27 +155,39 @@ func ShutdownCrowdsecRoutines(cancel context.CancelFunc, g *errgroup.Group, data
 }
 
 func shutdownAPI() error {
-	log.Debugf("shutting down api via Tomb")
+	if apiTomb == nil {
+		log.Debug("apiTomb is nil")
+		return nil
+	}
+
+	log.Debug("shutting down api via Tomb")
+
 	apiTomb.Kill(nil)
 
 	if err := apiTomb.Wait(); err != nil {
 		return err
 	}
 
-	log.Debugf("done")
+	log.Debug("done")
 
 	return nil
 }
 
 func shutdownCrowdsec() error {
-	log.Debugf("shutting down crowdsec via Tomb")
+	if crowdsecTomb == nil {
+		log.Debug("crowdsecTomb is nil")
+		return nil
+	}
+
+	log.Debug("shutting down crowdsec via Tomb")
+
 	crowdsecTomb.Kill(nil)
 
 	if err := crowdsecTomb.Wait(); err != nil {
 		return err
 	}
 
-	log.Debugf("done")
+	log.Debug("done")
 
 	return nil
 }
@@ -310,11 +316,7 @@ func Serve(
 	agentReady chan bool,
 	sd *StateDumper,
 ) error {
-	acquisTomb = tomb.Tomb{}
-	outputsTomb = tomb.Tomb{}
-	apiTomb = tomb.Tomb{}
-	crowdsecTomb = tomb.Tomb{}
-	pluginTomb = tomb.Tomb{}
+	initTombs()
 
 	if cConfig.API.Server != nil && cConfig.API.Server.DbConfig != nil {
 		dbCfg := cConfig.API.Server.DbConfig
diff --git a/cmd/notification-dummy/Makefile b/cmd/notification-dummy/Makefile
index 251abe19df0..03f4c98459e 100644
--- a/cmd/notification-dummy/Makefile
+++ b/cmd/notification-dummy/Makefile
@@ -5,7 +5,7 @@ ifeq ($(OS), Windows_NT)
 endif
 
 GO = go
-GOBUILD = $(GO) build
+GOBUILD = $(GO) build $(GORACE_OPTS)
 
 BINARY_NAME = notification-dummy$(EXT)
 
diff --git a/cmd/notification-email/Makefile b/cmd/notification-email/Makefile
index 7a782cc9db1..7fe715f2451 100644
--- a/cmd/notification-email/Makefile
+++ b/cmd/notification-email/Makefile
@@ -5,7 +5,7 @@ ifeq ($(OS), Windows_NT)
 endif
 
 GO = go
-GOBUILD = $(GO) build
+GOBUILD = $(GO) build $(GORACE_OPTS)
 
 BINARY_NAME = notification-email$(EXT)
 
diff --git a/cmd/notification-file/Makefile b/cmd/notification-file/Makefile
index 4504328c49a..cf216ed89b3 100644
--- a/cmd/notification-file/Makefile
+++ b/cmd/notification-file/Makefile
@@ -5,7 +5,7 @@ ifeq ($(OS), Windows_NT)
 endif
 
 GO = go
-GOBUILD = $(GO) build
+GOBUILD = $(GO) build $(GORACE_OPTS)
 
 BINARY_NAME = notification-file$(EXT)
 
diff --git a/cmd/notification-http/Makefile b/cmd/notification-http/Makefile
index 30ed43a694c..28253396854 100644
--- a/cmd/notification-http/Makefile
+++ b/cmd/notification-http/Makefile
@@ -5,7 +5,7 @@ ifeq ($(OS), Windows_NT)
 endif
 
 GO = go
-GOBUILD = $(GO) build
+GOBUILD = $(GO) build $(GORACE_OPTS)
 
 BINARY_NAME = notification-http$(EXT)
 
diff --git a/cmd/notification-sentinel/Makefile b/cmd/notification-sentinel/Makefile
index 21d176a9039..05a70a22cab 100644
--- a/cmd/notification-sentinel/Makefile
+++ b/cmd/notification-sentinel/Makefile
@@ -5,7 +5,7 @@ ifeq ($(OS), Windows_NT)
 endif
 
 GO = go
-GOBUILD = $(GO) build
+GOBUILD = $(GO) build $(GORACE_OPTS)
 
 BINARY_NAME = notification-sentinel$(EXT)
 
diff --git a/cmd/notification-slack/Makefile b/cmd/notification-slack/Makefile
index 06c9ccc3fd4..e7357135cc4 100644
--- a/cmd/notification-slack/Makefile
+++ b/cmd/notification-slack/Makefile
@@ -5,7 +5,7 @@ ifeq ($(OS), Windows_NT)
 endif
 
 GO = go
-GOBUILD = $(GO) build
+GOBUILD = $(GO) build $(GORACE_OPTS)
 
 BINARY_NAME = notification-slack$(EXT)
 
diff --git a/cmd/notification-splunk/Makefile b/cmd/notification-splunk/Makefile
index aa15ecac918..073d1ff83d6 100644
--- a/cmd/notification-splunk/Makefile
+++ b/cmd/notification-splunk/Makefile
@@ -5,7 +5,7 @@ ifeq ($(OS), Windows_NT)
 endif
 
 GO = go
-GOBUILD = $(GO) build
+GOBUILD = $(GO) build $(GORACE_OPTS)
 
 BINARY_NAME = notification-splunk$(EXT)