diff --git a/controllers/git_test.go b/controllers/git_test.go
index a435bbf3..a4ed1bda 100644
--- a/controllers/git_test.go
+++ b/controllers/git_test.go
@@ -2,7 +2,6 @@ package controllers
 
 import (
 	"context"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"testing"
@@ -41,7 +40,7 @@ func populateRepoFromFixture(repo *gogit.Repository, fixture string) error {
 			return fs.Symlink(target, path[len(fixture):])
 		}
 
-		fileBytes, err := ioutil.ReadFile(path)
+		fileBytes, err := os.ReadFile(path)
 		if err != nil {
 			return err
 		}
@@ -90,7 +89,7 @@ func TestRepoForFixture(t *testing.T) {
 
 func TestIgnoreBrokenSymlink(t *testing.T) {
 	// init a git repo in the filesystem so we can operate on files there
-	tmp, err := ioutil.TempDir("", "flux-test")
+	tmp, err := os.MkdirTemp("", "flux-test")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -145,7 +144,7 @@ func TestPushRejected(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	tmp, err := ioutil.TempDir("", "gotest-imageauto-git")
+	tmp, err := os.MkdirTemp("", "gotest-imageauto-git")
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/controllers/imageupdateautomation_controller.go b/controllers/imageupdateautomation_controller.go
index 50327789..5f3bc178 100644
--- a/controllers/imageupdateautomation_controller.go
+++ b/controllers/imageupdateautomation_controller.go
@@ -21,7 +21,6 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"io/ioutil"
 	"math"
 	"os"
 	"path/filepath"
@@ -212,7 +211,7 @@ func (r *ImageUpdateAutomationReconciler) Reconcile(ctx context.Context, req ctr
 		tracelog.Info("using push branch from $ref.branch", "branch", pushBranch)
 	}
 
-	tmp, err := ioutil.TempDir("", fmt.Sprintf("%s-%s", originName.Namespace, originName.Name))
+	tmp, err := os.MkdirTemp("", fmt.Sprintf("%s-%s", originName.Namespace, originName.Name))
 	if err != nil {
 		return failWithError(err)
 	}
diff --git a/controllers/update_test.go b/controllers/update_test.go
index 12caf863..b56b6253 100644
--- a/controllers/update_test.go
+++ b/controllers/update_test.go
@@ -20,7 +20,6 @@ import (
 	"bytes"
 	"context"
 	"fmt"
-	"io/ioutil"
 	"math/rand"
 	"net/url"
 	"os"
@@ -1014,12 +1013,12 @@ func expectCommittedAndPushed(conditions []metav1.Condition) {
 func replaceMarker(path string, policyKey types.NamespacedName) error {
 	// NB this requires knowledge of what's in the git repo, so a little brittle
 	deployment := filepath.Join(path, "deploy.yaml")
-	filebytes, err := ioutil.ReadFile(deployment)
+	filebytes, err := os.ReadFile(deployment)
 	if err != nil {
 		return err
 	}
 	newfilebytes := bytes.ReplaceAll(filebytes, []byte("SETTER_SITE"), []byte(setterRef(policyKey)))
-	if err = ioutil.WriteFile(deployment, newfilebytes, os.FileMode(0666)); err != nil {
+	if err = os.WriteFile(deployment, newfilebytes, os.FileMode(0666)); err != nil {
 		return err
 	}
 	return nil
@@ -1076,13 +1075,13 @@ func waitForNewHead(repo *git.Repository, branch string) {
 }
 
 func compareRepoWithExpected(repoURL, branch, fixture string, changeFixture func(tmp string)) {
-	expected, err := ioutil.TempDir("", "gotest-imageauto-expected")
+	expected, err := os.MkdirTemp("", "gotest-imageauto-expected")
 	Expect(err).ToNot(HaveOccurred())
 	defer os.RemoveAll(expected)
 	copy.Copy(fixture, expected)
 	changeFixture(expected)
 
-	tmp, err := ioutil.TempDir("", "gotest-imageauto")
+	tmp, err := os.MkdirTemp("", "gotest-imageauto")
 	Expect(err).ToNot(HaveOccurred())
 	defer os.RemoveAll(tmp)
 	_, err = git.PlainClone(tmp, false, &git.CloneOptions{
@@ -1094,7 +1093,7 @@ func compareRepoWithExpected(repoURL, branch, fixture string, changeFixture func
 }
 
 func commitInRepo(repoURL, branch, msg string, changeFiles func(path string)) {
-	tmp, err := ioutil.TempDir("", "gotest-imageauto")
+	tmp, err := os.MkdirTemp("", "gotest-imageauto")
 	Expect(err).ToNot(HaveOccurred())
 	defer os.RemoveAll(tmp)
 	repo, err := git.PlainClone(tmp, false, &git.CloneOptions{
diff --git a/pkg/test/files.go b/pkg/test/files.go
index e6117588..152604e1 100644
--- a/pkg/test/files.go
+++ b/pkg/test/files.go
@@ -17,7 +17,6 @@ limitations under the License.
 package test
 
 import (
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"strings"
@@ -124,11 +123,11 @@ func DiffDirectories(actual, expected string) (actualonly []string, expectedonly
 
 		// both regular files
 
-		actualBytes, err := ioutil.ReadFile(actualPath)
+		actualBytes, err := os.ReadFile(actualPath)
 		if err != nil {
 			panic(err)
 		}
-		expectedBytes, err := ioutil.ReadFile(expectedPath)
+		expectedBytes, err := os.ReadFile(expectedPath)
 		if err != nil {
 			panic(err)
 		}
diff --git a/pkg/update/filereader.go b/pkg/update/filereader.go
index 68867140..0f627885 100644
--- a/pkg/update/filereader.go
+++ b/pkg/update/filereader.go
@@ -19,7 +19,6 @@ package update
 import (
 	"bytes"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 
@@ -101,7 +100,7 @@ func (r *ScreeningLocalReader) Read() ([]*yaml.RNode, error) {
 
 		// To check for the token, I need the file contents. This
 		// assumes the file is encoded as UTF8.
-		filebytes, err := ioutil.ReadFile(p)
+		filebytes, err := os.ReadFile(p)
 		if err != nil {
 			return fmt.Errorf("reading YAML file: %w", err)
 		}
diff --git a/pkg/update/update_test.go b/pkg/update/update_test.go
index 03efe317..5be39f3c 100644
--- a/pkg/update/update_test.go
+++ b/pkg/update/update_test.go
@@ -17,7 +17,6 @@ limitations under the License.
 package update
 
 import (
-	"io/ioutil"
 	"os"
 	"testing"
 
@@ -64,7 +63,7 @@ var _ = Describe("Update image via kyaml setters2", func() {
 	)
 
 	It("updates the image marked with the image policy (setter) ref", func() {
-		tmp, err := ioutil.TempDir("", "gotest")
+		tmp, err := os.MkdirTemp("", "gotest")
 		Expect(err).ToNot(HaveOccurred())
 		defer os.RemoveAll(tmp)
 
@@ -95,7 +94,7 @@ var _ = Describe("Update image via kyaml setters2", func() {
 	})
 
 	It("gives the result of the updates", func() {
-		tmp, err := ioutil.TempDir("", "gotest")
+		tmp, err := os.MkdirTemp("", "gotest")
 		Expect(err).ToNot(HaveOccurred())
 		defer os.RemoveAll(tmp)