diff --git a/api/v1alpha1/envoygateway_helpers.go b/api/v1alpha1/envoygateway_helpers.go
index c61b43c82e1..68c451e68df 100644
--- a/api/v1alpha1/envoygateway_helpers.go
+++ b/api/v1alpha1/envoygateway_helpers.go
@@ -6,7 +6,8 @@
 package v1alpha1
 
 import (
-	"fmt"
+	"net"
+	"strconv"
 
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/utils/ptr"
@@ -80,7 +81,7 @@ func (e *EnvoyGateway) GetEnvoyGatewayAdmin() *EnvoyGatewayAdmin {
 func (e *EnvoyGateway) GetEnvoyGatewayAdminAddress() string {
 	address := e.GetEnvoyGatewayAdmin().Address
 	if address != nil {
-		return fmt.Sprintf("%s:%d", address.Host, address.Port)
+		return net.JoinHostPort(address.Host, strconv.Itoa(address.Port))
 	}
 
 	return ""
diff --git a/examples/extension-server/cmd/extension-server/main.go b/examples/extension-server/cmd/extension-server/main.go
index 4a6b0474621..41a9018adc0 100644
--- a/examples/extension-server/cmd/extension-server/main.go
+++ b/examples/extension-server/cmd/extension-server/main.go
@@ -6,7 +6,6 @@
 package main
 
 import (
-	"fmt"
 	"log/slog"
 	"net"
 	"os"
@@ -82,7 +81,7 @@ func startExtensionServer(cCtx *cli.Context) error {
 	logger := slog.New(slog.NewTextHandler(os.Stderr, &slog.HandlerOptions{
 		Level: level,
 	}))
-	address := fmt.Sprintf("%s:%d", cCtx.String("host"), cCtx.Int("port"))
+	address := net.JoinHostPort(cCtx.String("host"), cCtx.String("port"))
 	logger.Info("Starting the extension server", slog.String("host", address))
 	lis, err := net.Listen("tcp", address)
 	if err != nil {
diff --git a/internal/extension/registry/extension_manager.go b/internal/extension/registry/extension_manager.go
index 918c9a7c018..cf4b86d3d08 100644
--- a/internal/extension/registry/extension_manager.go
+++ b/internal/extension/registry/extension_manager.go
@@ -11,6 +11,7 @@ import (
 	"errors"
 	"fmt"
 	"net"
+	"strconv"
 
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials"
@@ -123,13 +124,13 @@ func getExtensionServerAddress(service *egv1a1.ExtensionService) string {
 	var serverAddr string
 	switch {
 	case service.FQDN != nil:
-		serverAddr = fmt.Sprintf("%s:%d", service.FQDN.Hostname, service.FQDN.Port)
+		serverAddr = net.JoinHostPort(service.FQDN.Hostname, strconv.Itoa(int(service.FQDN.Port)))
 	case service.IP != nil:
-		serverAddr = fmt.Sprintf("%s:%d", service.IP.Address, service.IP.Port)
+		serverAddr = net.JoinHostPort(service.IP.Address, strconv.Itoa(int(service.IP.Port)))
 	case service.Unix != nil:
 		serverAddr = fmt.Sprintf("unix://%s", service.Unix.Path)
 	case service.Host != "":
-		serverAddr = fmt.Sprintf("%s:%d", service.Host, service.Port)
+		serverAddr = net.JoinHostPort(service.Host, strconv.Itoa(int(service.Port)))
 	}
 	return serverAddr
 }
diff --git a/internal/gatewayapi/securitypolicy.go b/internal/gatewayapi/securitypolicy.go
index 302d5054507..3c2d2af31ed 100644
--- a/internal/gatewayapi/securitypolicy.go
+++ b/internal/gatewayapi/securitypolicy.go
@@ -9,6 +9,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"net"
 	"net/http"
 	"net/netip"
 	"net/url"
@@ -921,16 +922,16 @@ func backendRefAuthority(resources *resource.Resources, backendRef *gwapiv1.Back
 			// TODO: exists multi FQDN endpoints?
 			for _, ep := range backend.Spec.Endpoints {
 				if ep.FQDN != nil {
-					return fmt.Sprintf("%s:%d", ep.FQDN.Hostname, ep.FQDN.Port)
+					return net.JoinHostPort(ep.FQDN.Hostname, strconv.Itoa(int(ep.FQDN.Port)))
 				}
 			}
 		}
 	}
 
-	return fmt.Sprintf("%s.%s:%d",
-		backendRef.Name,
-		backendNamespace,
-		*backendRef.Port)
+	return net.JoinHostPort(
+		fmt.Sprintf("%s.%s", backendRef.Name, backendNamespace),
+		strconv.Itoa(int(*backendRef.Port)),
+	)
 }
 
 func (t *Translator) buildAuthorization(policy *egv1a1.SecurityPolicy) (*ir.Authorization, error) {
diff --git a/internal/kubernetes/port_forwarder.go b/internal/kubernetes/port_forwarder.go
index 176610dab3e..8e88b9c0212 100644
--- a/internal/kubernetes/port_forwarder.go
+++ b/internal/kubernetes/port_forwarder.go
@@ -8,8 +8,10 @@ package kubernetes
 import (
 	"fmt"
 	"io"
+	"net"
 	"net/http"
 	"os"
+	"strconv"
 
 	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/client-go/rest"
@@ -134,5 +136,5 @@ func (f *localForwarder) WaitForStop() {
 }
 
 func (f *localForwarder) Address() string {
-	return fmt.Sprintf("%s:%d", netutil.DefaultLocalAddress, f.localPort)
+	return net.JoinHostPort(netutil.DefaultLocalAddress, strconv.Itoa(f.localPort))
 }
diff --git a/internal/xds/bootstrap/bootstrap.go b/internal/xds/bootstrap/bootstrap.go
index 0efad8c314f..e8aab4d836a 100644
--- a/internal/xds/bootstrap/bootstrap.go
+++ b/internal/xds/bootstrap/bootstrap.go
@@ -9,13 +9,15 @@ import (
 	// Register embed
 	_ "embed"
 	"fmt"
+	"net"
+	"strconv"
 	"strings"
 	"text/template"
 
 	"k8s.io/apimachinery/pkg/util/sets"
 
 	egv1a1 "github.com/envoyproxy/gateway/api/v1alpha1"
-	"github.com/envoyproxy/gateway/internal/utils/net"
+	netutils "github.com/envoyproxy/gateway/internal/utils/net"
 	"github.com/envoyproxy/gateway/internal/utils/regex"
 )
 
@@ -199,9 +201,9 @@ func GetRenderedBootstrapConfig(opts *RenderBootstrapConfigOptions) (string, err
 				host, port = *sink.OpenTelemetry.Host, uint32(sink.OpenTelemetry.Port)
 			}
 			if len(sink.OpenTelemetry.BackendRefs) > 0 {
-				host, port = net.BackendHostAndPort(sink.OpenTelemetry.BackendRefs[0].BackendObjectReference, "")
+				host, port = netutils.BackendHostAndPort(sink.OpenTelemetry.BackendRefs[0].BackendObjectReference, "")
 			}
-			addr := fmt.Sprintf("%s:%d", host, port)
+			addr := net.JoinHostPort(host, strconv.Itoa(int(port)))
 			if addresses.Has(addr) {
 				continue
 			}
diff --git a/test/e2e/tests/ratelimit.go b/test/e2e/tests/ratelimit.go
index d1e18f74b92..17ce6d245cf 100644
--- a/test/e2e/tests/ratelimit.go
+++ b/test/e2e/tests/ratelimit.go
@@ -9,7 +9,6 @@ package tests
 
 import (
 	"context"
-	"fmt"
 	"net"
 	"testing"
 	"time"
@@ -495,7 +494,7 @@ var RateLimitMultipleListenersTest = suite.ConformanceTest{
 
 			gwPorts := []string{"80", "8080"}
 			for _, port := range gwPorts {
-				gwAddr = fmt.Sprintf("%s:%s", gwIP, port)
+				gwAddr = net.JoinHostPort(gwIP, port)
 
 				ratelimitHeader := make(map[string]string)
 				expectOkResp := http.ExpectedResponse{