diff --git a/pkgs/sops-import-keys-hook/hook_test.go b/pkgs/sops-import-keys-hook/hook_test.go
index 0cfdce0..90c2f0c 100644
--- a/pkgs/sops-import-keys-hook/hook_test.go
+++ b/pkgs/sops-import-keys-hook/hook_test.go
@@ -3,7 +3,6 @@ package main
 import (
 	"bytes"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"os/exec"
 	"path"
@@ -28,7 +27,7 @@ func TestShellHook(t *testing.T) {
 		_, filename, _, _ := runtime.Caller(0)
 		assets = path.Join(path.Dir(filename), "test-assets")
 	}
-	tempdir, err := ioutil.TempDir("", "testdir")
+	tempdir, err := os.MkdirTemp("", "testdir")
 	ok(t, err)
 	cmd := exec.Command("cp", "-vra", assets+"/.", tempdir)
 	fmt.Printf("$ %s\n", strings.Join(cmd.Args, " "))
diff --git a/pkgs/sops-install-secrets/main.go b/pkgs/sops-install-secrets/main.go
index 015c1ea..fc32f69 100644
--- a/pkgs/sops-install-secrets/main.go
+++ b/pkgs/sops-install-secrets/main.go
@@ -6,7 +6,6 @@ import (
 	"encoding/json"
 	"flag"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"os/user"
 	"path"
@@ -356,7 +355,7 @@ func writeSecrets(secretDir string, secrets []secret, keysGid int, userMode bool
 			}
 		}
 
-		if err := ioutil.WriteFile(fp, []byte(secret.value), secret.mode); err != nil {
+		if err := os.WriteFile(fp, []byte(secret.value), secret.mode); err != nil {
 			return fmt.Errorf("Cannot write %s: %w", fp, err)
 		}
 		if !userMode {
@@ -397,7 +396,7 @@ func (app *appContext) loadSopsFile(s *secret) (*secretFile, error) {
 		return &secretFile{firstSecret: s}, nil
 	}
 
-	cipherText, err := ioutil.ReadFile(s.SopsFile)
+	cipherText, err := os.ReadFile(s.SopsFile)
 	if err != nil {
 		return nil, fmt.Errorf("Failed reading %s: %w", s.SopsFile, err)
 	}
@@ -536,7 +535,7 @@ func atomicSymlink(oldname, newname string) error {
 
 	// We need to use ioutil.TempDir, as we cannot overwrite a ioutil.TempFile,
 	// and removing+symlinking creates a TOCTOU race.
-	d, err := ioutil.TempDir(filepath.Dir(newname), "."+filepath.Base(newname))
+	d, err := os.MkdirTemp(filepath.Dir(newname), "."+filepath.Base(newname))
 	if err != nil {
 		return err
 	}
@@ -609,7 +608,7 @@ func importSSHKeys(logcfg loggingConfig, keyPaths []string, gpgHome string) erro
 		return fmt.Errorf("Cannot create %s: %w", secringPath, err)
 	}
 	for _, p := range keyPaths {
-		sshKey, err := ioutil.ReadFile(p)
+		sshKey, err := os.ReadFile(p)
 		if err != nil {
 			return fmt.Errorf("Cannot read ssh key '%s': %w", p, err)
 		}
@@ -633,7 +632,7 @@ func importSSHKeys(logcfg loggingConfig, keyPaths []string, gpgHome string) erro
 func importAgeSSHKeys(logcfg loggingConfig, keyPaths []string, ageFile os.File) error {
 	for _, p := range keyPaths {
 		// Read the key
-		sshKey, err := ioutil.ReadFile(p)
+		sshKey, err := os.ReadFile(p)
 		if err != nil {
 			return fmt.Errorf("Cannot read ssh key '%s': %w", p, err)
 		}
@@ -707,7 +706,7 @@ func handleModifications(isDry bool, logcfg loggingConfig, symlinkPath string, s
 		newPath := filepath.Join(secretDir, secret.Name)
 
 		// Read the old file
-		oldData, err := ioutil.ReadFile(oldPath)
+		oldData, err := os.ReadFile(oldPath)
 		if err != nil {
 			if os.IsNotExist(err) {
 				// File did not exist before
@@ -720,7 +719,7 @@ func handleModifications(isDry bool, logcfg loggingConfig, symlinkPath string, s
 		}
 
 		// Read the new file
-		newData, err := ioutil.ReadFile(newPath)
+		newData, err := os.ReadFile(newPath)
 		if err != nil {
 			return err
 		}
@@ -823,7 +822,7 @@ func (k *keyring) Remove() {
 }
 
 func setupGPGKeyring(logcfg loggingConfig, sshKeys []string, parentDir string) (*keyring, error) {
-	dir, err := ioutil.TempDir(parentDir, "gpg")
+	dir, err := os.MkdirTemp(parentDir, "gpg")
 	if err != nil {
 		return nil, fmt.Errorf("Cannot create gpg home in '%s': %s", parentDir, err)
 	}
@@ -969,7 +968,7 @@ func installSecrets(args []string) error {
 		// Import the keyfile
 		if manifest.AgeKeyFile != "" {
 			// Read the keyfile
-			contents, err := ioutil.ReadFile(manifest.AgeKeyFile)
+			contents, err := os.ReadFile(manifest.AgeKeyFile)
 			if err != nil {
 				return fmt.Errorf("Cannot read keyfile '%s': %w", manifest.AgeKeyFile, err)
 			}
diff --git a/pkgs/sops-install-secrets/main_test.go b/pkgs/sops-install-secrets/main_test.go
index e9fcc92..51be915 100644
--- a/pkgs/sops-install-secrets/main_test.go
+++ b/pkgs/sops-install-secrets/main_test.go
@@ -6,7 +6,6 @@ package main
 import (
 	"encoding/json"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"os/exec"
 	"os/user"
@@ -65,7 +64,7 @@ func (dir testDir) Remove() {
 }
 
 func newTestDir(t *testing.T) testDir {
-	tempdir, err := ioutil.TempDir("", "symlinkDir")
+	tempdir, err := os.MkdirTemp("", "symlinkDir")
 	ok(t, err)
 	return testDir{tempdir, path.Join(tempdir, "secrets.d"), path.Join(tempdir, "secrets")}
 }
@@ -173,7 +172,7 @@ func testGPG(t *testing.T) {
 	equals(t, 0400, int(yamlStat.Mode().Perm()))
 	stat, success := yamlStat.Sys().(*syscall.Stat_t)
 	equals(t, true, success)
-	content, err := ioutil.ReadFile(yamlSecret.Path)
+	content, err := os.ReadFile(yamlSecret.Path)
 	ok(t, err)
 	equals(t, "test_value", string(content))
 
@@ -194,7 +193,7 @@ func testGPG(t *testing.T) {
 		equals(t, 0, int(stat.Gid))
 	}
 
-	content, err = ioutil.ReadFile(binarySecret.Path)
+	content, err = os.ReadFile(binarySecret.Path)
 	ok(t, err)
 	equals(t, 13, len(content))
 
diff --git a/pkgs/sops-pgp-hook/hook_test.go b/pkgs/sops-pgp-hook/hook_test.go
index caa30a4..10ad7f4 100644
--- a/pkgs/sops-pgp-hook/hook_test.go
+++ b/pkgs/sops-pgp-hook/hook_test.go
@@ -3,7 +3,6 @@ package main
 import (
 	"bytes"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"os/exec"
 	"path"
@@ -28,7 +27,7 @@ func TestShellHook(t *testing.T) {
 		_, filename, _, _ := runtime.Caller(0)
 		assets = path.Join(path.Dir(filename), "test-assets")
 	}
-	tempdir, err := ioutil.TempDir("", "testdir")
+	tempdir, err := os.MkdirTemp("", "testdir")
 	ok(t, err)
 	defer os.RemoveAll(tempdir)