diff --git a/cmd/imageproxy-sign/main.go b/cmd/imageproxy-sign/main.go
index 3233418..db1c2d1 100644
--- a/cmd/imageproxy-sign/main.go
+++ b/cmd/imageproxy-sign/main.go
@@ -12,7 +12,6 @@ import (
 	"errors"
 	"flag"
 	"fmt"
-	"io/ioutil"
 	"net/http"
 	"net/url"
 	"os"
@@ -65,7 +64,7 @@ func sign(key string, s string, urlOnly bool) ([]byte, error) {
 
 func parseKey(s string) ([]byte, error) {
 	if strings.HasPrefix(s, "@") {
-		return ioutil.ReadFile(s[1:])
+		return os.ReadFile(s[1:])
 	}
 	return []byte(s), nil
 }
diff --git a/cmd/imageproxy-sign/main_test.go b/cmd/imageproxy-sign/main_test.go
index 5c9fbe1..3108ee3 100644
--- a/cmd/imageproxy-sign/main_test.go
+++ b/cmd/imageproxy-sign/main_test.go
@@ -4,7 +4,7 @@
 package main
 
 import (
-	"io/ioutil"
+	"io"
 	"net/url"
 	"os"
 	"reflect"
@@ -25,7 +25,7 @@ func TestMainFunc(t *testing.T) {
 	main()
 	w.Close()
 
-	output, err := ioutil.ReadAll(r)
+	output, err := io.ReadAll(r)
 	got := string(output)
 	if err != nil {
 		t.Errorf("error reading from pipe: %v", err)
@@ -94,7 +94,7 @@ func TestParseKey(t *testing.T) {
 }
 
 func TestParseKey_FilePath(t *testing.T) {
-	f, err := ioutil.TempFile("", "key")
+	f, err := os.CreateTemp("", "key")
 	if err != nil {
 		t.Errorf("error creating temp file: %v", err)
 	}
diff --git a/cmd/imageproxy/main.go b/cmd/imageproxy/main.go
index 546b6ff..37a1235 100644
--- a/cmd/imageproxy/main.go
+++ b/cmd/imageproxy/main.go
@@ -7,7 +7,6 @@ package main
 import (
 	"flag"
 	"fmt"
-	"io/ioutil"
 	"log"
 	"net/http"
 	"net/url"
@@ -118,7 +117,7 @@ func (skl *signatureKeyList) Set(value string) error {
 		if strings.HasPrefix(v, "@") {
 			file := strings.TrimPrefix(v, "@")
 			var err error
-			key, err = ioutil.ReadFile(file)
+			key, err = os.ReadFile(file)
 			if err != nil {
 				log.Fatalf("error reading signature file: %v", err)
 			}
diff --git a/imageproxy.go b/imageproxy.go
index 37a779f..cb4724b 100644
--- a/imageproxy.go
+++ b/imageproxy.go
@@ -14,7 +14,6 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"log"
 	"mime"
 	"net"
@@ -242,7 +241,7 @@ func (p *Proxy) serveImage(w http.ResponseWriter, r *http.Request) {
 	if contentType == "" || contentType == "application/octet-stream" || contentType == "binary/octet-stream" {
 		// try to detect content type
 		b := bufio.NewReader(resp.Body)
-		resp.Body = ioutil.NopCloser(b)
+		resp.Body = io.NopCloser(b)
 		contentType = peekContentType(b)
 	}
 	if resp.ContentLength != 0 && !contentTypeMatches(p.ContentTypes, contentType) {
@@ -497,7 +496,7 @@ func (t *TransformingTransport) RoundTrip(req *http.Request) (*http.Response, er
 		return &http.Response{StatusCode: http.StatusNotModified}, nil
 	}
 
-	b, err := ioutil.ReadAll(resp.Body)
+	b, err := io.ReadAll(resp.Body)
 	if err != nil {
 		return nil, err
 	}
diff --git a/internal/gcscache/gcscache.go b/internal/gcscache/gcscache.go
index 951b334..0de848b 100644
--- a/internal/gcscache/gcscache.go
+++ b/internal/gcscache/gcscache.go
@@ -11,7 +11,6 @@ import (
 	"encoding/hex"
 	"errors"
 	"io"
-	"io/ioutil"
 	"log"
 	"path"
 
@@ -35,7 +34,7 @@ func (c *cache) Get(key string) ([]byte, bool) {
 	}
 	defer r.Close()
 
-	value, err := ioutil.ReadAll(r)
+	value, err := io.ReadAll(r)
 	if err != nil {
 		log.Printf("error reading from gcs: %v", err)
 		return nil, false
diff --git a/internal/s3cache/s3cache.go b/internal/s3cache/s3cache.go
index cdf38d0..4ec77f4 100644
--- a/internal/s3cache/s3cache.go
+++ b/internal/s3cache/s3cache.go
@@ -11,7 +11,6 @@ import (
 	"encoding/hex"
 	"errors"
 	"io"
-	"io/ioutil"
 	"log"
 	"net/url"
 	"path"
@@ -44,7 +43,7 @@ func (c *cache) Get(key string) ([]byte, bool) {
 		return nil, false
 	}
 
-	value, err := ioutil.ReadAll(resp.Body)
+	value, err := io.ReadAll(resp.Body)
 	if err != nil {
 		log.Printf("error reading s3 response body: %v", err)
 		return nil, false