diff --git a/cmd/letsdane/gen.go b/cmd/letsdane/gen.go
index ea2ee57..6ad4b99 100644
--- a/cmd/letsdane/gen.go
+++ b/cmd/letsdane/gen.go
@@ -7,9 +7,9 @@ import (
 	"bufio"
 	"bytes"
 	"fmt"
-	"io/ioutil"
 	"log"
 	"net/http"
+	"os"
 	"strings"
 )
 
@@ -47,7 +47,7 @@ var nameConstraints = map[string]struct{} {
 	}
 	sb.WriteString("}\n")
 
-	if err := ioutil.WriteFile("tld.go", sb.Bytes(), 0600); err != nil {
+	if err := os.WriteFile("tld.go", sb.Bytes(), 0600); err != nil {
 		log.Fatal(err)
 	}
 
diff --git a/cmd/letsdane/main.go b/cmd/letsdane/main.go
index 7b68d8a..c0e98a3 100644
--- a/cmd/letsdane/main.go
+++ b/cmd/letsdane/main.go
@@ -8,11 +8,6 @@ import (
 	"errors"
 	"flag"
 	"fmt"
-	"github.com/buffrr/hsig0"
-	"github.com/buffrr/letsdane"
-	rs "github.com/buffrr/letsdane/resolver"
-	"github.com/miekg/dns"
-	"io/ioutil"
 	"log"
 	"net"
 	"net/url"
@@ -20,6 +15,11 @@ import (
 	"path"
 	"strings"
 	"time"
+
+	"github.com/buffrr/hsig0"
+	"github.com/buffrr/letsdane"
+	rs "github.com/buffrr/letsdane/resolver"
+	"github.com/miekg/dns"
 )
 
 const KSK2017 = `. IN DS 20326 8 2 E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D`
@@ -108,12 +108,12 @@ func getOrCreateCA() (string, string) {
 }
 
 func loadX509KeyPair(certFile, keyFile string) (tls.Certificate, error) {
-	certPEMBlock, err := ioutil.ReadFile(certFile)
+	certPEMBlock, err := os.ReadFile(certFile)
 	if err != nil {
 		return tls.Certificate{}, err
 	}
 
-	keyPEMBlock, err := ioutil.ReadFile(keyFile)
+	keyPEMBlock, err := os.ReadFile(keyFile)
 	if err != nil {
 		return tls.Certificate{}, err
 	}
@@ -174,12 +174,12 @@ func isLoopback(r string) bool {
 }
 
 func exportCA() {
-	b, err := ioutil.ReadFile(*certPath)
+	b, err := os.ReadFile(*certPath)
 	if err != nil {
 		log.Fatal(err)
 	}
 
-	if err := ioutil.WriteFile(*output, b, 0600); err != nil {
+	if err := os.WriteFile(*output, b, 0600); err != nil {
 		log.Fatal(err)
 	}
 }
diff --git a/dialer_test.go b/dialer_test.go
index 9f0bb3d..802de9c 100644
--- a/dialer_test.go
+++ b/dialer_test.go
@@ -3,7 +3,7 @@ package letsdane
 import (
 	"bufio"
 	"context"
-	"io/ioutil"
+	"io"
 	"net"
 	"net/http"
 	"net/http/httptest"
@@ -42,7 +42,7 @@ func TestDialTLS(t *testing.T) {
 	}
 	defer resp.Body.Close()
 
-	body, err := ioutil.ReadAll(resp.Body)
+	body, err := io.ReadAll(resp.Body)
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/proxy/proxy_test.go b/proxy/proxy_test.go
index 11572f5..a52d6ac 100644
--- a/proxy/proxy_test.go
+++ b/proxy/proxy_test.go
@@ -4,7 +4,7 @@ import (
 	"context"
 	"crypto/tls"
 	"crypto/x509"
-	"io/ioutil"
+	"io"
 	"net"
 	"net/http"
 	"net/http/httptest"
@@ -57,7 +57,7 @@ func TestHijacker(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	body, err := ioutil.ReadAll(resp.Body)
+	body, err := io.ReadAll(resp.Body)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -84,7 +84,7 @@ func TestHandler_ServeHTTPTunnelerAddr(t *testing.T) {
 	proxy.ServeHTTP(w, req)
 
 	resp := w.Result()
-	body, err := ioutil.ReadAll(resp.Body)
+	body, err := io.ReadAll(resp.Body)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -120,7 +120,7 @@ func TestHandler_ServeHTTPNonConnect(t *testing.T) {
 		t.Errorf("status = %d, wanted %d", resp.StatusCode, http.StatusTeapot)
 	}
 
-	b, err := ioutil.ReadAll(resp.Body)
+	b, err := io.ReadAll(resp.Body)
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/resolver/stub.go b/resolver/stub.go
index 94e3669..6ec28c6 100644
--- a/resolver/stub.go
+++ b/resolver/stub.go
@@ -5,12 +5,13 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"github.com/miekg/dns"
-	"io/ioutil"
+	"io"
 	"net"
 	"net/http"
 	"net/url"
 	"time"
+
+	"github.com/miekg/dns"
 )
 
 // Stub is an AD-bit aware stub resolver
@@ -157,7 +158,7 @@ func exchangeDOH(ctx context.Context, m *dns.Msg, doh string) (r *dns.Msg, rtt t
 	}
 
 	defer resp.Body.Close()
-	b, err := ioutil.ReadAll(resp.Body)
+	b, err := io.ReadAll(resp.Body)
 	if err != nil {
 		return nil, 0, err
 	}
diff --git a/tunnel_test.go b/tunnel_test.go
index 75b3247..3d04d0a 100644
--- a/tunnel_test.go
+++ b/tunnel_test.go
@@ -7,8 +7,7 @@ import (
 	"crypto/x509"
 	"errors"
 	"fmt"
-	"github.com/miekg/dns"
-	"io/ioutil"
+	"io"
 	"net"
 	"net/http"
 	"net/http/httptest"
@@ -16,6 +15,8 @@ import (
 	"strings"
 	"testing"
 	"time"
+
+	"github.com/miekg/dns"
 )
 
 func newProxyTestConfig(t *testing.T) (*x509.Certificate, *Config) {
@@ -111,7 +112,7 @@ func TestNonConnectHandler(t *testing.T) {
 			}
 
 			if resp.StatusCode == http.StatusOK {
-				b, err := ioutil.ReadAll(resp.Body)
+				b, err := io.ReadAll(resp.Body)
 				if err != nil {
 					t.Fatal(err)
 				}
@@ -369,7 +370,7 @@ func TestHandlerTLS(t *testing.T) {
 				t.Fatal(err)
 			}
 
-			body, err := ioutil.ReadAll(resp.Body)
+			body, err := io.ReadAll(resp.Body)
 			resp.Body.Close()
 			content := string(body)
 			if content != "foo" {
@@ -418,7 +419,7 @@ func TestHandlerTLS(t *testing.T) {
 		}
 		defer resp.Body.Close()
 
-		body, _ := ioutil.ReadAll(resp.Body)
+		body, _ := io.ReadAll(resp.Body)
 		c := string(body)
 		if c != "ALPN TEST" {
 			t.Fatalf("body = %s, wanted 'ALPN TEST'", c)