diff --git a/ipn/localapi/localapi.go b/ipn/localapi/localapi.go
index 1bf1e6a68..11723989d 100644
--- a/ipn/localapi/localapi.go
+++ b/ipn/localapi/localapi.go
@@ -448,12 +448,12 @@ func (h *Handler) serveFilePut(w http.ResponseWriter, r *http.Request) {
 	}
 
 	upath := strings.TrimPrefix(r.URL.EscapedPath(), "/localapi/v0/file-put/")
-	slash := strings.Index(upath, "/")
-	if slash == -1 {
+	stableIDStr, filenameEscaped, ok := strings.Cut(upath, "/")
+	if !ok {
 		http.Error(w, "bogus URL", 400)
 		return
 	}
-	stableID, filenameEscaped := tailcfg.StableNodeID(upath[:slash]), upath[slash+1:]
+	stableID := tailcfg.StableNodeID(stableIDStr)
 
 	var ft *apitype.FileTarget
 	for _, x := range fts {
diff --git a/net/dns/resolver/tsdns.go b/net/dns/resolver/tsdns.go
index a9c46c9d1..9fd92fcfd 100644
--- a/net/dns/resolver/tsdns.go
+++ b/net/dns/resolver/tsdns.go
@@ -976,17 +976,17 @@ const (
 //  lb._dns-sd._udp.<domain>.
 func hasRDNSBonjourPrefix(name dnsname.FQDN) bool {
 	s := name.WithTrailingDot()
-	dot := strings.IndexByte(s, '.')
-	if dot == -1 {
+	base, rest, ok := strings.Cut(s, ".")
+	if !ok {
 		return false // shouldn't happen
 	}
-	switch s[:dot] {
+	switch base {
 	case "b", "db", "r", "dr", "lb":
 	default:
 		return false
 	}
 
-	return strings.HasPrefix(s[dot:], "._dns-sd._udp.")
+	return strings.HasPrefix(rest, "_dns-sd._udp.")
 }
 
 // rawNameToLower converts a raw DNS name to a string, lowercasing it.
diff --git a/tsweb/jsonhandler.go b/tsweb/jsonhandler.go
index 766570b7f..fb4c88136 100644
--- a/tsweb/jsonhandler.go
+++ b/tsweb/jsonhandler.go
@@ -145,19 +145,10 @@ func AcceptsEncoding(r *http.Request, enc string) bool {
 	}
 	remain := h
 	for len(remain) > 0 {
-		comma := strings.Index(remain, ",")
 		var part string
-		if comma == -1 {
-			part = remain
-			remain = ""
-		} else {
-			part = remain[:comma]
-			remain = remain[comma+1:]
-		}
+		part, remain, _ = strings.Cut(remain, ",")
 		part = strings.TrimSpace(part)
-		if i := strings.Index(part, ";"); i != -1 {
-			part = part[:i]
-		}
+		part, _, _ = strings.Cut(part, ";")
 		if part == enc {
 			return true
 		}
diff --git a/tsweb/tsweb.go b/tsweb/tsweb.go
index 09658ca41..bd46cc90b 100644
--- a/tsweb/tsweb.go
+++ b/tsweb/tsweb.go
@@ -370,8 +370,8 @@ func writePromExpVar(w io.Writer, prefix string, kv expvar.KeyValue) {
 	}
 	if strings.HasPrefix(key, "labelmap_") {
 		key = strings.TrimPrefix(key, "labelmap_")
-		if i := strings.Index(key, "_"); i != -1 {
-			label, key = key[:i], key[i+1:]
+		if a, b, ok := strings.Cut(key, "_"); ok {
+			label, key = a, b
 		}
 	}
 	name := prefix + key
@@ -541,9 +541,7 @@ func foreachExportedStructField(rv reflect.Value, f func(fieldOrJSONName, metric
 		sf := t.Field(i)
 		name := sf.Name
 		if v := sf.Tag.Get("json"); v != "" {
-			if i := strings.Index(v, ","); i != -1 {
-				v = v[:i]
-			}
+			v, _, _ = strings.Cut(v, ",")
 			if v == "-" {
 				// Skip it, regardless of its metrictype.
 				continue
diff --git a/types/netmap/netmap.go b/types/netmap/netmap.go
index 315c62ca7..ae8bec99f 100644
--- a/types/netmap/netmap.go
+++ b/types/netmap/netmap.go
@@ -78,8 +78,8 @@ type NetworkMap struct {
 // It will neither start nor end with a period.
 func (nm *NetworkMap) MagicDNSSuffix() string {
 	name := strings.Trim(nm.Name, ".")
-	if i := strings.Index(name, "."); i != -1 {
-		name = name[i+1:]
+	if _, rest, ok := strings.Cut(name, "."); ok {
+		return rest
 	}
 	return name
 }
diff --git a/util/dnsname/dnsname.go b/util/dnsname/dnsname.go
index 667abfe0e..259b49de2 100644
--- a/util/dnsname/dnsname.go
+++ b/util/dnsname/dnsname.go
@@ -185,10 +185,8 @@ func NumLabels(hostname string) int {
 
 // FirstLabel returns the first DNS label of hostname.
 func FirstLabel(hostname string) string {
-	if i := strings.IndexByte(hostname, '.'); i != -1 {
-		return hostname[:i]
-	}
-	return hostname
+	first, _, _ := strings.Cut(hostname, ".")
+	return first
 }
 
 var separators = map[byte]bool{
diff --git a/wgengine/filter/tailcfg.go b/wgengine/filter/tailcfg.go
index 84e5328ad..8f52ff1fa 100644
--- a/wgengine/filter/tailcfg.go
+++ b/wgengine/filter/tailcfg.go
@@ -114,8 +114,7 @@ func parseIPSet(arg string, bits *int) ([]netaddr.IPPrefix, error) {
 		return []netaddr.IPPrefix{pfx}, nil
 	}
 	if strings.Count(arg, "-") == 1 {
-		i := strings.Index(arg, "-")
-		ip1s, ip2s := arg[:i], arg[i+1:]
+		ip1s, ip2s, _ := strings.Cut(arg, "-")
 		ip1, err := netaddr.ParseIP(ip1s)
 		if err != nil {
 			return nil, err