diff --git a/logtail/logtail_test.go b/logtail/logtail_test.go
index e243ab6ff..7ed193838 100644
--- a/logtail/logtail_test.go
+++ b/logtail/logtail_test.go
@@ -14,6 +14,8 @@ import (
 	"strings"
 	"testing"
 	"time"
+
+	"tailscale.com/tstest"
 )
 
 func TestFastShutdown(t *testing.T) {
@@ -213,11 +215,11 @@ var sink []byte
 func TestLoggerEncodeTextAllocs(t *testing.T) {
 	lg := &Logger{timeNow: time.Now}
 	inBuf := []byte("some text to encode")
-	n := testing.AllocsPerRun(1000, func() {
+	err := tstest.MinAllocsPerRun(t, 1, func() {
 		sink = lg.encodeText(inBuf, false)
 	})
-	if int(n) != 1 {
-		t.Logf("allocs = %d; want 1", int(n))
+	if err != nil {
+		t.Fatal(err)
 	}
 }
 
@@ -298,15 +300,14 @@ func TestPublicIDUnmarshalText(t *testing.T) {
 	if id.String() != hexStr {
 		t.Errorf("String = %q; want %q", id.String(), hexStr)
 	}
-
-	n := int(testing.AllocsPerRun(1000, func() {
+	err := tstest.MinAllocsPerRun(t, 0, func() {
 		var id PublicID
 		if err := id.UnmarshalText(x); err != nil {
 			t.Fatal(err)
 		}
-	}))
-	if n != 0 {
-		t.Errorf("allocs = %v; want 0", n)
+	})
+	if err != nil {
+		t.Fatal(err)
 	}
 }
 
diff --git a/metrics/metrics_test.go b/metrics/metrics_test.go
index d004d5fac..6b9aa4366 100644
--- a/metrics/metrics_test.go
+++ b/metrics/metrics_test.go
@@ -8,6 +8,8 @@ import (
 	"os"
 	"runtime"
 	"testing"
+
+	"tailscale.com/tstest"
 )
 
 func TestCurrentFileDescriptors(t *testing.T) {
@@ -19,11 +21,11 @@ func TestCurrentFileDescriptors(t *testing.T) {
 		t.Fatalf("got %v; want >= 3", n)
 	}
 
-	allocs := int(testing.AllocsPerRun(100, func() {
+	err := tstest.MinAllocsPerRun(t, 0, func() {
 		n = CurrentFDs()
-	}))
-	if allocs != 0 {
-		t.Errorf("allocs = %v; want 0", allocs)
+	})
+	if err != nil {
+		t.Fatal(err)
 	}
 
 	// Open some FDs.
diff --git a/net/dns/resolver/tsdns_test.go b/net/dns/resolver/tsdns_test.go
index 5809ce798..06e51cacd 100644
--- a/net/dns/resolver/tsdns_test.go
+++ b/net/dns/resolver/tsdns_test.go
@@ -952,7 +952,7 @@ func TestAllocs(t *testing.T) {
 	tests := []struct {
 		name  string
 		query []byte
-		want  int
+		want  uint64
 	}{
 		// Name lowercasing, response slice created by dns.NewBuilder,
 		// and closure allocation from go call.
@@ -964,11 +964,11 @@ func TestAllocs(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		allocs := testing.AllocsPerRun(100, func() {
+		err := tstest.MinAllocsPerRun(t, tt.want, func() {
 			syncRespond(r, tt.query)
 		})
-		if int(allocs) > tt.want {
-			t.Errorf("%s: allocs = %v; want %v", tt.name, allocs, tt.want)
+		if err != nil {
+			t.Errorf("%s: %v", tt.name, err)
 		}
 	}
 }
diff --git a/net/flowtrack/flowtrack_test.go b/net/flowtrack/flowtrack_test.go
index 4c473c717..80288f334 100644
--- a/net/flowtrack/flowtrack_test.go
+++ b/net/flowtrack/flowtrack_test.go
@@ -8,6 +8,7 @@ import (
 	"testing"
 
 	"inet.af/netaddr"
+	"tailscale.com/tstest"
 )
 
 func TestCache(t *testing.T) {
@@ -67,7 +68,7 @@ func TestCache(t *testing.T) {
 	wantVal(k3, 30)
 	wantLen(1)
 
-	allocs := int(testing.AllocsPerRun(1000, func() {
+	err := tstest.MinAllocsPerRun(t, 0, func() {
 		got, ok := c.Get(k3)
 		if !ok {
 			t.Fatal("missing k3")
@@ -75,8 +76,8 @@ func TestCache(t *testing.T) {
 		if got != 30 {
 			t.Fatalf("got = %d; want 30", got)
 		}
-	}))
-	if allocs != 0 {
-		t.Errorf("allocs = %v; want 0", allocs)
+	})
+	if err != nil {
+		t.Error(err)
 	}
 }
diff --git a/net/packet/packet_test.go b/net/packet/packet_test.go
index a88ab9675..c39abc3fb 100644
--- a/net/packet/packet_test.go
+++ b/net/packet/packet_test.go
@@ -10,6 +10,7 @@ import (
 	"testing"
 
 	"inet.af/netaddr"
+	"tailscale.com/tstest"
 	"tailscale.com/types/ipproto"
 )
 
@@ -378,11 +379,11 @@ func TestParsedString(t *testing.T) {
 		})
 	}
 
-	allocs := testing.AllocsPerRun(1000, func() {
+	err := tstest.MinAllocsPerRun(t, 1, func() {
 		sinkString = tests[0].qdecode.String()
 	})
-	if allocs != 1 {
-		t.Errorf("allocs = %v; want 1", allocs)
+	if err != nil {
+		t.Error(err)
 	}
 }
 
@@ -415,12 +416,12 @@ func TestDecode(t *testing.T) {
 		})
 	}
 
-	allocs := testing.AllocsPerRun(1000, func() {
+	err := tstest.MinAllocsPerRun(t, 0, func() {
 		var got Parsed
 		got.Decode(tests[0].buf)
 	})
-	if allocs != 0 {
-		t.Errorf("allocs = %v; want 0", allocs)
+	if err != nil {
+		t.Error(err)
 	}
 }
 
diff --git a/net/tstun/wrap_test.go b/net/tstun/wrap_test.go
index 37a1eb175..3d13567e8 100644
--- a/net/tstun/wrap_test.go
+++ b/net/tstun/wrap_test.go
@@ -370,7 +370,7 @@ func TestAllocs(t *testing.T) {
 	defer tun.Close()
 
 	buf := []byte{0x00}
-	allocs := testing.AllocsPerRun(100, func() {
+	err := tstest.MinAllocsPerRun(t, 0, func() {
 		_, err := ftun.Write(buf, 0)
 		if err != nil {
 			t.Errorf("write: error: %v", err)
@@ -378,8 +378,8 @@ func TestAllocs(t *testing.T) {
 		}
 	})
 
-	if allocs > 0 {
-		t.Errorf("read allocs = %v; want 0", allocs)
+	if err != nil {
+		t.Error(err)
 	}
 }
 
diff --git a/tailcfg/tailcfg_test.go b/tailcfg/tailcfg_test.go
index 9a1f4bdb1..c7a12472f 100644
--- a/tailcfg/tailcfg_test.go
+++ b/tailcfg/tailcfg_test.go
@@ -13,6 +13,7 @@ import (
 	"time"
 
 	"inet.af/netaddr"
+	"tailscale.com/tstest"
 	"tailscale.com/types/key"
 	"tailscale.com/version"
 )
@@ -541,11 +542,11 @@ func TestAppendKeyAllocs(t *testing.T) {
 		t.Skip("skipping in race detector") // append(b, make([]byte, N)...) not optimized in compiler with race
 	}
 	var k [32]byte
-	n := int(testing.AllocsPerRun(1000, func() {
+	err := tstest.MinAllocsPerRun(t, 1, func() {
 		sinkBytes = keyMarshalText("prefix", k)
-	}))
-	if n != 1 {
-		t.Fatalf("allocs = %v; want 1", n)
+	})
+	if err != nil {
+		t.Fatal(err)
 	}
 }
 
diff --git a/types/wgkey/key_test.go b/types/wgkey/key_test.go
index c4bfa93da..0859471eb 100644
--- a/types/wgkey/key_test.go
+++ b/types/wgkey/key_test.go
@@ -8,6 +8,8 @@ import (
 	"bytes"
 	"encoding/json"
 	"testing"
+
+	"tailscale.com/tstest"
 )
 
 func TestKeyBasics(t *testing.T) {
@@ -134,12 +136,11 @@ func TestPrivateKeyBasics(t *testing.T) {
 
 func TestMarshalJSONAllocs(t *testing.T) {
 	var k Key
-	f := testing.AllocsPerRun(100, func() {
+	err := tstest.MinAllocsPerRun(t, 1, func() {
 		k.MarshalJSON()
 	})
-	n := int(f)
-	if n != 1 {
-		t.Fatalf("max one alloc per Key.MarshalJSON, got %d", n)
+	if err != nil {
+		t.Fatal(err)
 	}
 }
 
diff --git a/version/cmp_test.go b/version/cmp_test.go
index a611fcf77..e9abf55ab 100644
--- a/version/cmp_test.go
+++ b/version/cmp_test.go
@@ -8,6 +8,7 @@ import (
 	"testing"
 
 	"github.com/google/go-cmp/cmp"
+	"tailscale.com/tstest"
 )
 
 func TestParse(t *testing.T) {
@@ -39,11 +40,11 @@ func TestParse(t *testing.T) {
 		if diff := cmp.Diff(gotParsed, test.parsed); diff != "" {
 			t.Errorf("parse(%q) diff (-got+want):\n%s", test.version, diff)
 		}
-		n := int(testing.AllocsPerRun(1000, func() {
+		err := tstest.MinAllocsPerRun(t, 0, func() {
 			gotParsed, got = parse(test.version)
-		}))
-		if n != 0 {
-			t.Errorf("parse(%q) allocs = %d; want 0", test.version, n)
+		})
+		if err != nil {
+			t.Errorf("parse(%q): %v", test.version, err)
 		}
 	}
 }
diff --git a/wgengine/filter/filter_test.go b/wgengine/filter/filter_test.go
index e2a077d25..00e319940 100644
--- a/wgengine/filter/filter_test.go
+++ b/wgengine/filter/filter_test.go
@@ -17,6 +17,7 @@ import (
 	"tailscale.com/net/packet"
 	"tailscale.com/net/tsaddr"
 	"tailscale.com/tailcfg"
+	"tailscale.com/tstest"
 	"tailscale.com/tstime/rate"
 	"tailscale.com/types/ipproto"
 	"tailscale.com/types/logger"
@@ -189,23 +190,21 @@ func TestNoAllocs(t *testing.T) {
 	tests := []struct {
 		name   string
 		dir    direction
-		want   int
 		packet []byte
 	}{
-		{"tcp4_in", in, 0, tcp4Packet},
-		{"tcp6_in", in, 0, tcp6Packet},
-		{"tcp4_out", out, 0, tcp4Packet},
-		{"tcp6_out", out, 0, tcp6Packet},
-		{"udp4_in", in, 0, udp4Packet},
-		{"udp6_in", in, 0, udp6Packet},
-		// One alloc is inevitable (an lru cache update)
-		{"udp4_out", out, 1, udp4Packet},
-		{"udp6_out", out, 1, udp6Packet},
+		{"tcp4_in", in, tcp4Packet},
+		{"tcp6_in", in, tcp6Packet},
+		{"tcp4_out", out, tcp4Packet},
+		{"tcp6_out", out, tcp6Packet},
+		{"udp4_in", in, udp4Packet},
+		{"udp6_in", in, udp6Packet},
+		{"udp4_out", out, udp4Packet},
+		{"udp6_out", out, udp6Packet},
 	}
 
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			got := int(testing.AllocsPerRun(1000, func() {
+			err := tstest.MinAllocsPerRun(t, 0, func() {
 				q := &packet.Parsed{}
 				q.Decode(test.packet)
 				switch test.dir {
@@ -214,10 +213,9 @@ func TestNoAllocs(t *testing.T) {
 				case out:
 					acl.RunOut(q, 0)
 				}
-			}))
-
-			if got > test.want {
-				t.Errorf("got %d allocs per run; want at most %d", got, test.want)
+			})
+			if err != nil {
+				t.Error(err)
 			}
 		})
 	}
diff --git a/wgengine/magicsock/magicsock_test.go b/wgengine/magicsock/magicsock_test.go
index 00d93477f..8dffbd6fd 100644
--- a/wgengine/magicsock/magicsock_test.go
+++ b/wgengine/magicsock/magicsock_test.go
@@ -44,7 +44,6 @@ import (
 	"tailscale.com/types/wgkey"
 	"tailscale.com/util/cibuild"
 	"tailscale.com/util/racebuild"
-	"tailscale.com/util/testingutil"
 	"tailscale.com/wgengine/filter"
 	"tailscale.com/wgengine/wgcfg"
 	"tailscale.com/wgengine/wgcfg/nmcfg"
@@ -1353,7 +1352,7 @@ func TestReceiveFromAllocs(t *testing.T) {
 	}
 	t.Logf("allowing %d allocs for Go version %q", maxAllocs, runtime.Version())
 	roundTrip := setUpReceiveFrom(t)
-	err := testingutil.MinAllocsPerRun(t, uint64(maxAllocs), roundTrip)
+	err := tstest.MinAllocsPerRun(t, uint64(maxAllocs), roundTrip)
 	if err != nil {
 		t.Fatal(err)
 	}