diff --git a/CHANGELOG.md b/CHANGELOG.md
index 57ba2fad..b341d184 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,7 @@ Most recent version is listed first.
 # v0.0.91
 - Upgrade to Go v1.22: https://github.com/komuw/ong/pull/408
                        https://github.com/komuw/ong/pull/409
+- Replace math/rand with math/rand/v2: https://github.com/komuw/ong/pull/411
 
 # v0.0.90
 - ong/middleware: a http subdomain should be redirected to the same subdomain at https: https://github.com/komuw/ong/pull/406
diff --git a/internal/acme/acme_test.go b/internal/acme/acme_test.go
index 526f6cb3..a19ebdef 100644
--- a/internal/acme/acme_test.go
+++ b/internal/acme/acme_test.go
@@ -13,7 +13,7 @@ import (
 	"io"
 	"log/slog"
 	"math/big"
-	mathRand "math/rand"
+	mathRand "math/rand/v2"
 	"net/http"
 	"net/http/httptest"
 	"net/url"
@@ -27,7 +27,7 @@ import (
 
 // getDomain returns a valid unique domain.
 func getDomain() string {
-	r := mathRand.Intn(100_000) + 1
+	r := mathRand.IntN(100_000) + 1
 	return fmt.Sprintf("some-sample-%d-domain.com", r)
 }
 
diff --git a/internal/tst/tst.go b/internal/tst/tst.go
index 878d877b..6ed9ff5f 100644
--- a/internal/tst/tst.go
+++ b/internal/tst/tst.go
@@ -4,7 +4,7 @@ package tst
 import (
 	"fmt"
 	"math"
-	"math/rand"
+	"math/rand/v2"
 	"net"
 	"net/http"
 	"net/http/httptest"
@@ -65,7 +65,7 @@ func GetPort() uint16 {
 
 fallback:
 	{
-		r := rand.Intn(10_000) + 1
+		r := rand.IntN(10_000) + 1
 		p := math.MaxUint16 - uint16(r)
 		return p
 	}
diff --git a/log/log_benchmarks_test.go b/log/log_benchmarks_test.go
index e0177033..824d42ec 100644
--- a/log/log_benchmarks_test.go
+++ b/log/log_benchmarks_test.go
@@ -6,7 +6,7 @@ import (
 	"fmt"
 	"io"
 	"log/slog"
-	"math/rand"
+	"math/rand/v2"
 	"testing"
 	"time"
 
@@ -179,7 +179,7 @@ func BenchmarkAverageCase(b *testing.B) {
 		b.ResetTimer()
 		for range b.N {
 			l.Info(str)
-			if rand.Intn(100) >= 99 {
+			if rand.IntN(100) >= 99 {
 				l.Error(logErr.Error())
 			}
 		}
@@ -191,7 +191,7 @@ func BenchmarkAverageCase(b *testing.B) {
 		b.ResetTimer()
 		for range b.N {
 			l.Info(str)
-			if rand.Intn(100) >= 99 {
+			if rand.IntN(100) >= 99 {
 				l.Error(logErr.Error())
 			}
 		}
@@ -203,7 +203,7 @@ func BenchmarkAverageCase(b *testing.B) {
 		b.ResetTimer()
 		for range b.N {
 			l.Info().Msg(str)
-			if rand.Intn(100) >= 99 {
+			if rand.IntN(100) >= 99 {
 				l.Error().Msg(logErr.Error())
 			}
 		}
@@ -215,7 +215,7 @@ func BenchmarkAverageCase(b *testing.B) {
 		b.ResetTimer()
 		for range b.N {
 			l.Info(sl[0], slAny...)
-			if rand.Intn(100) >= 99 {
+			if rand.IntN(100) >= 99 {
 				l.Error("some-error", logErr)
 			}
 		}
@@ -227,7 +227,7 @@ func BenchmarkAverageCase(b *testing.B) {
 		b.ResetTimer()
 		for range b.N {
 			l.Info(sl[0], slAny...)
-			if rand.Intn(100) >= 99 {
+			if rand.IntN(100) >= 99 {
 				l.Error("some-error", logErr)
 			}
 		}
diff --git a/log/log_test.go b/log/log_test.go
index 7e56baac..fc73222f 100644
--- a/log/log_test.go
+++ b/log/log_test.go
@@ -7,7 +7,7 @@ import (
 	"errors"
 	"fmt"
 	"log/slog"
-	mathRand "math/rand"
+	mathRand "math/rand/v2"
 	"strings"
 	"sync"
 	"testing"
@@ -532,7 +532,7 @@ func TestLogger(t *testing.T) {
 				l.Info("four" + t)
 				xl.Info("okay-" + t)
 
-				if mathRand.Intn(100) > 75 { // log errors 25% of the time.
+				if mathRand.IntN(100) > 75 { // log errors 25% of the time.
 					l.Error("hey", "err", errors.New("some-err-"+t))
 					xl.Error("some-xl-error", "err", errors.New("other-err-"+t))
 				}
diff --git a/middleware/loadshed.go b/middleware/loadshed.go
index fa55e250..4671203e 100644
--- a/middleware/loadshed.go
+++ b/middleware/loadshed.go
@@ -2,7 +2,7 @@ package middleware
 
 import (
 	"fmt"
-	mathRand "math/rand"
+	mathRand "math/rand/v2"
 	"net/http"
 	"slices"
 	"strings"
@@ -79,7 +79,7 @@ func loadShedder(
 			// Even if the server is overloaded, we want to send a percentage of the requests through.
 			// These requests act as a probe. If the server eventually recovers,
 			// these requests will re-populate latencyQueue(`lq`) with lower latencies and thus end the load-shed.
-			sendProbe = mathRand.Intn(100) == 1 // let 1% of requests through. NB: Intn(100) is `0-99` ie, 100 is not included.
+			sendProbe = mathRand.IntN(100) == 1 // let 1% of requests through. NB: Intn(100) is `0-99` ie, 100 is not included.
 		}
 
 		p99 := lq.getP99(loadShedMinSampleSize)
diff --git a/middleware/loadshed_test.go b/middleware/loadshed_test.go
index 91885e92..52aff58c 100644
--- a/middleware/loadshed_test.go
+++ b/middleware/loadshed_test.go
@@ -3,7 +3,7 @@ package middleware
 import (
 	"fmt"
 	"io"
-	"math/rand"
+	"math/rand/v2"
 	"net/http"
 	"net/http/httptest"
 	"strconv"
@@ -253,7 +253,7 @@ func TestLatencyQueue(t *testing.T) {
 
 func loadShedderBenchmarkHandler() http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		latency := time.Duration(rand.Intn(100)+1) * time.Millisecond
+		latency := time.Duration(rand.IntN(100)+1) * time.Millisecond
 		time.Sleep(latency)
 		fmt.Fprint(w, "hey")
 	}
diff --git a/middleware/log.go b/middleware/log.go
index 77d902dd..ccc311ff 100644
--- a/middleware/log.go
+++ b/middleware/log.go
@@ -5,7 +5,7 @@ import (
 	"fmt"
 	"io"
 	"log/slog"
-	mathRand "math/rand"
+	mathRand "math/rand/v2"
 	"net"
 	"net/http"
 	"time"
@@ -67,7 +67,7 @@ func logger(
 			if (lrw.code == http.StatusServiceUnavailable || lrw.code == http.StatusTooManyRequests) && w.Header().Get(retryAfterHeader) != "" {
 				// We are either in load shedding or rate-limiting.
 				// Only log (rateShedSamplePercent)% of the errors.
-				shouldLog := mathRand.Intn(100) <= rateShedSamplePercent
+				shouldLog := mathRand.IntN(100) <= rateShedSamplePercent
 				if shouldLog {
 					reqL.Error(msg, flds...)
 				}