diff --git a/metropolis/pkg/efivarfs/efivarfs.go b/metropolis/pkg/efivarfs/efivarfs.go
index fc6100e..e731069 100644
--- a/metropolis/pkg/efivarfs/efivarfs.go
+++ b/metropolis/pkg/efivarfs/efivarfs.go
@@ -22,7 +22,6 @@
 import (
 	"bytes"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"strings"
@@ -64,7 +63,7 @@
 func ReadLoaderDevicePartUUID() (string, error) {
 	// Read the EFI variable file containing the ESP UUID.
 	espUuidPath := filepath.Join(Path, "LoaderDevicePartUUID-4a67b082-0a4c-41cf-b6c7-440b29bb8c4f")
-	efiVar, err := ioutil.ReadFile(espUuidPath)
+	efiVar, err := os.ReadFile(espUuidPath)
 	if err != nil {
 		return "", fmt.Errorf("couldn't read the LoaderDevicePartUUID file at %q: %w", espUuidPath, err)
 	}
@@ -98,7 +97,7 @@
 	if err != nil {
 		return -1, fmt.Errorf("while marshaling the EFI boot entry: %w", err)
 	}
-	if err := ioutil.WriteFile(ep, bem, 0644); err != nil {
+	if err := os.WriteFile(ep, bem, 0644); err != nil {
 		return -1, fmt.Errorf("while creating a boot entry variable: %w", err)
 	}
 	return n, nil
@@ -108,7 +107,7 @@
 // specified in ord. It may return an io error.
 func SetBootOrder(ord *BootOrder) error {
 	op := filepath.Join(Path, fmt.Sprintf("BootOrder-%s", GlobalGuid))
-	if err := ioutil.WriteFile(op, ord.Marshal(), 0644); err != nil {
+	if err := os.WriteFile(op, ord.Marshal(), 0644); err != nil {
 		return fmt.Errorf("while creating a boot order variable: %w", err)
 	}
 	return nil
diff --git a/metropolis/pkg/erofs/erofs_test.go b/metropolis/pkg/erofs/erofs_test.go
index d02c2dd..fbd1af1 100644
--- a/metropolis/pkg/erofs/erofs_test.go
+++ b/metropolis/pkg/erofs/erofs_test.go
@@ -18,7 +18,6 @@
 
 import (
 	"io"
-	"io/ioutil"
 	"log"
 	"math/rand"
 	"os"
@@ -78,14 +77,14 @@
 				return nil
 			},
 			validate: func(t *testing.T) error {
-				dirInfo, err := ioutil.ReadDir("/test")
+				dirInfo, err := os.ReadDir("/test")
 				if err != nil {
 					t.Fatalf("Failed to read top-level directory: %v", err)
 				}
 				require.Len(t, dirInfo, 1, "more subdirs than expected")
 				require.Equal(t, "subdir", dirInfo[0].Name(), "unexpected subdir")
 				require.True(t, dirInfo[0].IsDir(), "subdir not a directory")
-				subdirInfo, err := ioutil.ReadDir("/test/subdir")
+				subdirInfo, err := os.ReadDir("/test/subdir")
 				assert.NoError(t, err, "cannot read empty subdir")
 				require.Len(t, subdirInfo, 0, "unexpected subdirs in empty directory")
 				return nil
@@ -123,8 +122,8 @@
 				assert.NoError(t, err, "failed to open test file")
 				defer file.Close()
 				r := io.LimitReader(rand.New(rand.NewSource(0)), 128) // Random but deterministic data
-				expected, _ := ioutil.ReadAll(r)
-				actual, err := ioutil.ReadAll(file)
+				expected, _ := io.ReadAll(r)
+				actual, err := io.ReadAll(file)
 				assert.NoError(t, err, "failed to read test file")
 				assert.Equal(t, expected, actual, "content not identical")
 				return nil
@@ -153,7 +152,7 @@
 			},
 			validate: func(t *testing.T) error {
 				var stat unix.Stat_t
-				rawContents, err := ioutil.ReadFile("/dev/ram0")
+				rawContents, err := os.ReadFile("/dev/ram0")
 				assert.NoError(t, err, "failed to read test data")
 				log.Printf("%x", rawContents)
 				err = unix.Stat("/test/test.bin", &stat)
@@ -166,8 +165,8 @@
 				assert.NoError(t, err, "failed to open test file")
 				defer file.Close()
 				r := io.LimitReader(rand.New(rand.NewSource(1)), 6500) // Random but deterministic data
-				expected, _ := ioutil.ReadAll(r)
-				actual, err := ioutil.ReadAll(file)
+				expected, _ := io.ReadAll(r)
+				actual, err := io.ReadAll(file)
 				assert.NoError(t, err, "failed to read test file")
 				assert.Equal(t, expected, actual, "content not identical")
 				return nil
@@ -204,8 +203,8 @@
 					assert.NoError(t, err, "failed to open test file")
 					defer file.Close()
 					r := io.LimitReader(rand.New(rand.NewSource(int64(i))), 2053) // Random but deterministic data
-					expected, _ := ioutil.ReadAll(r)
-					actual, err := ioutil.ReadAll(file)
+					expected, _ := io.ReadAll(r)
+					actual, err := io.ReadAll(file)
 					assert.NoError(t, err, "failed to read test file")
 					require.Equal(t, expected, actual, "content not identical")
 				}
diff --git a/metropolis/pkg/fileargs/fileargs.go b/metropolis/pkg/fileargs/fileargs.go
index bec8fca..88863da 100644
--- a/metropolis/pkg/fileargs/fileargs.go
+++ b/metropolis/pkg/fileargs/fileargs.go
@@ -21,7 +21,6 @@
 	"encoding/hex"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 
@@ -78,7 +77,7 @@
 
 	path := filepath.Join(f.path, name)
 
-	if err := ioutil.WriteFile(path, content, 0600); err != nil {
+	if err := os.WriteFile(path, content, 0600); err != nil {
 		f.lastError = err
 		return ""
 	}
diff --git a/metropolis/pkg/fsquota/fsquota_test.go b/metropolis/pkg/fsquota/fsquota_test.go
index 392a0e9..c842b63 100644
--- a/metropolis/pkg/fsquota/fsquota_test.go
+++ b/metropolis/pkg/fsquota/fsquota_test.go
@@ -18,7 +18,6 @@
 
 import (
 	"fmt"
-	"io/ioutil"
 	"math"
 	"os"
 	"os/exec"
@@ -120,7 +119,7 @@
 			t.Fatal(err)
 		}
 		sizeFileData := make([]byte, 512*1024)
-		if err := ioutil.WriteFile("/test/readback/512kfile", sizeFileData, 0644); err != nil {
+		if err := os.WriteFile("/test/readback/512kfile", sizeFileData, 0644); err != nil {
 			t.Fatal(err)
 		}
 
@@ -138,7 +137,7 @@
 
 		// Write 50 inodes for a total of 51 (with the 512K file)
 		for i := 0; i < 50; i++ {
-			if err := ioutil.WriteFile(fmt.Sprintf("/test/readback/ifile%v", i), []byte("test"), 0644); err != nil {
+			if err := os.WriteFile(fmt.Sprintf("/test/readback/ifile%v", i), []byte("test"), 0644); err != nil {
 				t.Fatal(err)
 			}
 		}
diff --git a/metropolis/pkg/logtree/unraw/unraw_test.go b/metropolis/pkg/logtree/unraw/unraw_test.go
index afd1da9..5526feb 100644
--- a/metropolis/pkg/logtree/unraw/unraw_test.go
+++ b/metropolis/pkg/logtree/unraw/unraw_test.go
@@ -4,7 +4,6 @@
 	"context"
 	"errors"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"syscall"
 	"testing"
@@ -21,7 +20,7 @@
 }
 
 func TestNamedPipeReader(t *testing.T) {
-	dir, err := ioutil.TempDir("/tmp", "metropolis-test-named-pipe-reader")
+	dir, err := os.MkdirTemp("/tmp", "metropolis-test-named-pipe-reader")
 	if err != nil {
 		t.Fatalf("could not create tempdir: %v", err)
 	}
diff --git a/metropolis/pkg/loop/loop.go b/metropolis/pkg/loop/loop.go
index c338f04..a4974a8 100644
--- a/metropolis/pkg/loop/loop.go
+++ b/metropolis/pkg/loop/loop.go
@@ -28,7 +28,6 @@
 import (
 	"errors"
 	"fmt"
-	"io/ioutil"
 	"math/bits"
 	"os"
 	"sync"
@@ -223,7 +222,7 @@
 
 // BackingFilePath returns the path of the backing file
 func (d *Device) BackingFilePath() (string, error) {
-	backingFile, err := ioutil.ReadFile(fmt.Sprintf("/sys/block/loop%d/loop/backing_file", d.num))
+	backingFile, err := os.ReadFile(fmt.Sprintf("/sys/block/loop%d/loop/backing_file", d.num))
 	if err != nil {
 		return "", fmt.Errorf("failed to get backing file path: %w", err)
 	}
diff --git a/metropolis/pkg/loop/loop_test.go b/metropolis/pkg/loop/loop_test.go
index 16ead64..7f23f3e 100644
--- a/metropolis/pkg/loop/loop_test.go
+++ b/metropolis/pkg/loop/loop_test.go
@@ -19,7 +19,6 @@
 import (
 	"encoding/binary"
 	"io"
-	"io/ioutil"
 	"math"
 	"os"
 	"runtime"
@@ -36,7 +35,7 @@
 // bit unsigned integers) to detect offset correctness. File is always 128KiB
 // large (2^16 * 2 bytes).
 func makeTestFile() *os.File {
-	f, err := ioutil.TempFile("/tmp", "")
+	f, err := os.CreateTemp("/tmp", "")
 	if err != nil {
 		panic(err)
 	}
@@ -183,7 +182,7 @@
 	if os.Getenv("IN_KTEST") != "true" {
 		t.Skip("Not in ktest")
 	}
-	f, err := ioutil.TempFile("/tmp", "")
+	f, err := os.CreateTemp("/tmp", "")
 	assert.NoError(t, err)
 	empty1K := make([]byte, 1024)
 	for i := 0; i < 64; i++ {
diff --git a/metropolis/pkg/tpm/tpm.go b/metropolis/pkg/tpm/tpm.go
index ab02dd3..f84aac6 100644
--- a/metropolis/pkg/tpm/tpm.go
+++ b/metropolis/pkg/tpm/tpm.go
@@ -24,7 +24,6 @@
 	"crypto/x509"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"strconv"
@@ -584,5 +583,5 @@
 // result can be parsed by eventlog.  As this library currently doesn't support
 // extending PCRs it just returns the log as supplied by the EFI interface.
 func GetMeasurementLog() ([]byte, error) {
-	return ioutil.ReadFile("/sys/kernel/security/tpm0/binary_bios_measurements")
+	return os.ReadFile("/sys/kernel/security/tpm0/binary_bios_measurements")
 }