diff --git a/client/tailscale/tailscale.go b/client/tailscale/tailscale.go
index 778c32655..52c75ea7a 100644
--- a/client/tailscale/tailscale.go
+++ b/client/tailscale/tailscale.go
@@ -116,10 +116,7 @@ func doLocalRequestNiceError(req *http.Request) (*http.Response, error) {
 	if ue, ok := err.(*url.Error); ok {
 		if oe, ok := ue.Err.(*net.OpError); ok && oe.Op == "dial" {
 			path := req.URL.Path
-			pathPrefix := path
-			if i := strings.Index(path, "?"); i != -1 {
-				pathPrefix = path[:i]
-			}
+			pathPrefix, _, _ := strings.Cut(path, "?")
 			return nil, fmt.Errorf("Failed to connect to local Tailscale daemon for %s; %s Error: %w", pathPrefix, tailscaledConnectHint(), oe)
 		}
 	}
@@ -520,8 +517,8 @@ func tailscaledConnectHint() string {
 	// SubState=dead
 	st := map[string]string{}
 	for _, line := range strings.Split(string(out), "\n") {
-		if i := strings.Index(line, "="); i != -1 {
-			st[line[:i]] = strings.TrimSpace(line[i+1:])
+		if k, v, ok := strings.Cut(line, "="); ok {
+			st[k] = strings.TrimSpace(v)
 		}
 	}
 	if st["LoadState"] == "loaded" &&
diff --git a/cmd/hello/hello.go b/cmd/hello/hello.go
index ef863e24a..a0e596f2d 100644
--- a/cmd/hello/hello.go
+++ b/cmd/hello/hello.go
@@ -206,8 +206,6 @@ func root(w http.ResponseWriter, r *http.Request) {
 
 // firstLabel s up until the first period, if any.
 func firstLabel(s string) string {
-	if i := strings.Index(s, "."); i != -1 {
-		return s[:i]
-	}
+	s, _, _ = strings.Cut(s, ".")
 	return s
 }
diff --git a/net/dns/resolvconffile/resolvconffile.go b/net/dns/resolvconffile/resolvconffile.go
index 9ba1be36d..2b2bc3617 100644
--- a/net/dns/resolvconffile/resolvconffile.go
+++ b/net/dns/resolvconffile/resolvconffile.go
@@ -65,10 +65,7 @@ func Parse(r io.Reader) (*Config, error) {
 	scanner := bufio.NewScanner(r)
 	for scanner.Scan() {
 		line := scanner.Text()
-		i := strings.IndexByte(line, '#')
-		if i >= 0 {
-			line = line[:i]
-		}
+		line, _, _ = strings.Cut(line, "#") // remove any comments
 		line = strings.TrimSpace(line)
 
 		if strings.HasPrefix(line, "nameserver") {
diff --git a/net/dns/resolver/forwarder.go b/net/dns/resolver/forwarder.go
index 6a630c033..f874d3786 100644
--- a/net/dns/resolver/forwarder.go
+++ b/net/dns/resolver/forwarder.go
@@ -196,12 +196,11 @@ func maxDoHInFlight(goos string) int {
 		// Unknown iOS version, be cautious.
 		return 10
 	}
-	idx := strings.Index(ver, ".")
-	if idx == -1 {
+	major, _, ok := strings.Cut(ver, ".")
+	if !ok {
 		// Unknown iOS version, be cautious.
 		return 10
 	}
-	major := ver[:idx]
 	if m, err := strconv.Atoi(major); err != nil || m < 15 {
 		return 10
 	}
diff --git a/net/dns/resolver/forwarder_test.go b/net/dns/resolver/forwarder_test.go
index 6008f44dc..fb19ea8e6 100644
--- a/net/dns/resolver/forwarder_test.go
+++ b/net/dns/resolver/forwarder_test.go
@@ -37,13 +37,13 @@ func TestResolversWithDelays(t *testing.T) {
 	o := func(ss ...string) (rr []resolverAndDelay) {
 		for _, s := range ss {
 			var d time.Duration
-			if i := strings.Index(s, "+"); i != -1 {
+			s, durStr, hasPlus := strings.Cut(s, "+")
+			if hasPlus {
 				var err error
-				d, err = time.ParseDuration(s[i+1:])
+				d, err = time.ParseDuration(durStr)
 				if err != nil {
 					panic(fmt.Sprintf("parsing duration in %q: %v", s, err))
 				}
-				s = s[:i]
 			}
 			host, _, err := net.SplitHostPort(s)
 			if err != nil {
diff --git a/wgengine/filter/filter_test.go b/wgengine/filter/filter_test.go
index 7f7e29116..180b1de2e 100644
--- a/wgengine/filter/filter_test.go
+++ b/wgengine/filter/filter_test.go
@@ -676,7 +676,7 @@ func pfx(strs ...string) (ret []netaddr.IPPrefix) {
 
 func nets(nets ...string) (ret []netaddr.IPPrefix) {
 	for _, s := range nets {
-		if i := strings.IndexByte(s, '/'); i == -1 {
+		if !strings.Contains(s, "/") {
 			ip, err := netaddr.ParseIP(s)
 			if err != nil {
 				panic(err)
diff --git a/wgengine/magicsock/debughttp.go b/wgengine/magicsock/debughttp.go
index 672616271..4ec974ab2 100644
--- a/wgengine/magicsock/debughttp.go
+++ b/wgengine/magicsock/debughttp.go
@@ -188,8 +188,8 @@ func peerDebugName(p *tailcfg.Node) string {
 		return ""
 	}
 	n := p.Name
-	if i := strings.Index(n, "."); i != -1 {
-		return n[:i]
+	if base, _, ok := strings.Cut(n, "."); ok {
+		return base
 	}
 	return p.Hostinfo.Hostname()
 }
diff --git a/wgengine/magicsock/magicsock.go b/wgengine/magicsock/magicsock.go
index b15148169..5236268a9 100644
--- a/wgengine/magicsock/magicsock.go
+++ b/wgengine/magicsock/magicsock.go
@@ -905,9 +905,7 @@ func (c *Conn) Ping(peer *tailcfg.Node, res *ipnstate.PingResult, cb func(*ipnst
 	if res.NodeName == "" {
 		res.NodeName = peer.Hostinfo.Hostname() // else hostname
 	} else {
-		if i := strings.Index(res.NodeName, "."); i != -1 {
-			res.NodeName = res.NodeName[:i]
-		}
+		res.NodeName, _, _ = strings.Cut(res.NodeName, ".")
 	}
 
 	ep, ok := c.peerMap.endpointForNodeKey(peer.Key)