diff --git a/auth/basic_test.go b/auth/basic_test.go
index 396d207..d6f8c35 100644
--- a/auth/basic_test.go
+++ b/auth/basic_test.go
@@ -3,7 +3,6 @@ package auth
 import (
 	"encoding/base64"
 	"fmt"
-	"io/ioutil"
 	"net/http"
 	"os"
 	"reflect"
@@ -38,7 +37,7 @@ func (rw *responseWriter) WriteHeader(statusCode int) {
 }
 
 func createBasicAuthFile(contents string) (string, error) {
-	dir, err := ioutil.TempDir("", "basicauth")
+	dir, err := os.MkdirTemp("", "basicauth")
 
 	if err != nil {
 		return "", fmt.Errorf("could not create temp dir: %s", err)
@@ -46,7 +45,7 @@ func createBasicAuthFile(contents string) (string, error) {
 
 	filename := fmt.Sprintf("%s/%s", dir, uuid.NewUUID())
 
-	err = ioutil.WriteFile(filename, []byte(contents), 0666)
+	err = os.WriteFile(filename, []byte(contents), 0666)
 
 	if err != nil {
 		return "", fmt.Errorf("could not write password file: %s", err)
diff --git a/cert/file_source.go b/cert/file_source.go
index 9880b5a..fd4c96b 100644
--- a/cert/file_source.go
+++ b/cert/file_source.go
@@ -3,7 +3,7 @@ package cert
 import (
 	"crypto/tls"
 	"crypto/x509"
-	"io/ioutil"
+	"os"
 
 	"github.com/fabiolb/fabio/exit"
 )
@@ -26,7 +26,7 @@ func (s FileSource) LoadClientCAs() (*x509.CertPool, error) {
 		if s.ClientAuthFile == "" {
 			return nil, nil
 		}
-		pemBlock, err := ioutil.ReadFile(path)
+		pemBlock, err := os.ReadFile(path)
 		return map[string][]byte{path: pemBlock}, err
 	})
 }
diff --git a/cert/load.go b/cert/load.go
index 9b09518..9f3013f 100644
--- a/cert/load.go
+++ b/cert/load.go
@@ -5,7 +5,7 @@ import (
 	"crypto/x509"
 	"encoding/pem"
 	"fmt"
-	"io/ioutil"
+	"io"
 	"log"
 	"net/http"
 	"net/url"
@@ -34,7 +34,7 @@ func loadURL(listURL string) (pemBlocks map[string][]byte, err error) {
 			return nil, err
 		}
 		defer resp.Body.Close()
-		return ioutil.ReadAll(resp.Body)
+		return io.ReadAll(resp.Body)
 	}
 
 	// fetch the file with the list of filenames
@@ -88,7 +88,7 @@ func loadPath(root string) (pemBlocks map[string][]byte, err error) {
 			return nil
 		}
 
-		buf, err := ioutil.ReadFile(path)
+		buf, err := os.ReadFile(path)
 		if err != nil {
 			return fmt.Errorf("cert: %s", err)
 		}
diff --git a/cert/source_test.go b/cert/source_test.go
index 32c2744..8706775 100644
--- a/cert/source_test.go
+++ b/cert/source_test.go
@@ -10,7 +10,6 @@ import (
 	"encoding/pem"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"log"
 	"math/big"
 	"net/http"
@@ -261,7 +260,7 @@ func TestConsulSource(t *testing.T) {
 				return false
 			}
 
-			n, err := io.Copy(ioutil.Discard, resp.Body)
+			n, err := io.Copy(io.Discard, resp.Body)
 			return err == nil && n > 10
 		}
 
@@ -582,7 +581,7 @@ func testSource(t *testing.T, source Source, rootCAs *x509.CertPool, sleep time.
 	// disable log output for the next call to prevent
 	// confusing log messages since they are expected
 	// http: TLS handshake error from 127.0.0.1:55044: remote error: bad certificate
-	log.SetOutput(ioutil.Discard)
+	log.SetOutput(io.Discard)
 	defer log.SetOutput(os.Stderr)
 
 	// fail calls https://localhost.org/ for which certificate validation
@@ -642,7 +641,7 @@ func roundtrip(serverName string, srvConfig *tls.Config, client *http.Client) (c
 	}
 	defer resp.Body.Close()
 
-	data, err := ioutil.ReadAll(resp.Body)
+	data, err := io.ReadAll(resp.Body)
 	if err != nil {
 		return 0, "", err
 	}
@@ -676,7 +675,7 @@ func http20Client(rootCAs *x509.CertPool) (*http.Client, error) {
 }
 
 func tempDir() string {
-	dir, err := ioutil.TempDir("", "fabio")
+	dir, err := os.MkdirTemp("", "fabio")
 	if err != nil {
 		panic(err.Error())
 	}
@@ -684,7 +683,7 @@ func tempDir() string {
 }
 
 func writeFile(filename string, data []byte) {
-	if err := ioutil.WriteFile(filename, data, 0644); err != nil {
+	if err := os.WriteFile(filename, data, 0644); err != nil {
 		panic(err.Error())
 	}
 }
diff --git a/cert/vault_client.go b/cert/vault_client.go
index 55836e6..c1d37d0 100644
--- a/cert/vault_client.go
+++ b/cert/vault_client.go
@@ -3,7 +3,6 @@ package cert
 import (
 	"encoding/json"
 	"errors"
-	"io/ioutil"
 	"log"
 	"os"
 	"strings"
@@ -186,7 +185,7 @@ func getVaultToken(c string) string {
 		return token
 	}
 	if cArray[0] == "file" {
-		b, err := ioutil.ReadFile(cArray[1]) // just pass the file name
+		b, err := os.ReadFile(cArray[1]) // just pass the file name
 		if err != nil {
 			log.Printf("[WARN] vault: Failed to fetch token from  %s", c)
 		} else {
diff --git a/config/load_test.go b/config/load_test.go
index 0dadd8a..49a8d36 100644
--- a/config/load_test.go
+++ b/config/load_test.go
@@ -4,7 +4,6 @@ import (
 	"crypto/tls"
 	"errors"
 	"fmt"
-	"io/ioutil"
 	"net/http"
 	"net/http/httptest"
 	"os"
@@ -1165,7 +1164,7 @@ func TestLoad(t *testing.T) {
 				}
 
 			case tt.path != "":
-				if err := ioutil.WriteFile(tt.path, []byte(tt.data), 0600); err != nil {
+				if err := os.WriteFile(tt.path, []byte(tt.data), 0600); err != nil {
 					t.Fatalf("error writing file: %s", err)
 				}
 				defer os.Remove(tt.path)
diff --git a/registry/file/backend.go b/registry/file/backend.go
index 9c81d43..e584f4b 100644
--- a/registry/file/backend.go
+++ b/registry/file/backend.go
@@ -3,8 +3,8 @@
 package file
 
 import (
-	"io/ioutil"
 	"log"
+	"os"
 
 	"github.com/fabiolb/fabio/config"
 	"github.com/fabiolb/fabio/registry"
@@ -12,12 +12,12 @@ import (
 )
 
 func NewBackend(cfg *config.File) (registry.Backend, error) {
-	routes, err := ioutil.ReadFile(cfg.RoutesPath)
+	routes, err := os.ReadFile(cfg.RoutesPath)
 	if err != nil {
 		log.Println("[ERROR] Cannot read routes from ", cfg.RoutesPath)
 		return nil, err
 	}
-	noroutehtml, err := ioutil.ReadFile(cfg.NoRouteHTMLPath)
+	noroutehtml, err := os.ReadFile(cfg.NoRouteHTMLPath)
 	if err != nil {
 		log.Println("[ERROR] Cannot read no route HTML from ", cfg.NoRouteHTMLPath)
 		return nil, err