diff --git a/metropolis/cli/dbg/main.go b/metropolis/cli/dbg/main.go
index 84df60d..99aff6c 100644
--- a/metropolis/cli/dbg/main.go
+++ b/metropolis/cli/dbg/main.go
@@ -21,7 +21,6 @@
 	"flag"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"math/rand"
 	"os"
 	"strings"
@@ -142,7 +141,7 @@
 	case "kubectl":
 		// Always get a kubeconfig with cluster-admin (group system:masters),
 		// kubectl itself can impersonate
-		kubeconfigFile, err := ioutil.TempFile("", "dbg_kubeconfig")
+		kubeconfigFile, err := os.CreateTemp("", "dbg_kubeconfig")
 		if err != nil {
 			fmt.Fprintf(os.Stderr, "Failed to create kubeconfig temp file: %v\n", err)
 			os.Exit(1)
diff --git a/metropolis/cli/metroctl/install.go b/metropolis/cli/metroctl/install.go
index ab31610..3970e78 100644
--- a/metropolis/cli/metroctl/install.go
+++ b/metropolis/cli/metroctl/install.go
@@ -4,7 +4,6 @@
 	"crypto/ed25519"
 	"crypto/rand"
 	"encoding/pem"
-	"io/ioutil"
 	"log"
 	"os"
 	"path/filepath"
@@ -63,14 +62,14 @@
 		log.Fatalf("Failed to create config directory: %v", err)
 	}
 	var ownerPublicKey ed25519.PublicKey
-	ownerPrivateKeyPEM, err := ioutil.ReadFile(filepath.Join(xdg.ConfigHome, "metroctl/owner-key.pem"))
+	ownerPrivateKeyPEM, err := os.ReadFile(filepath.Join(xdg.ConfigHome, "metroctl/owner-key.pem"))
 	if os.IsNotExist(err) {
 		pub, priv, err := ed25519.GenerateKey(rand.Reader)
 		if err != nil {
 			log.Fatalf("Failed to generate owner private key: %v", err)
 		}
 		pemPriv := pem.EncodeToMemory(&pem.Block{Type: ownerKeyType, Bytes: priv})
-		if err := ioutil.WriteFile(filepath.Join(xdg.ConfigHome, "metroctl/owner-key.pem"), pemPriv, 0600); err != nil {
+		if err := os.WriteFile(filepath.Join(xdg.ConfigHome, "metroctl/owner-key.pem"), pemPriv, 0600); err != nil {
 			log.Fatalf("Failed to store owner private key: %v", err)
 		}
 		ownerPublicKey = pub