diff --git a/.golangci.yml b/.golangci.yml
index 9617da8602f01..073fdb95ed445 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -27,7 +27,7 @@ linters-settings:
       - codegenComment
       # - commentedOutCode
       - commentedOutImport
-      # - commentFormatting
+      - commentFormatting
       - defaultCaseOrder
       - deferUnlambda
       # - deprecatedComment
@@ -54,7 +54,7 @@ linters-settings:
       # - importShadow
       - indexAlloc
       - initClause
-      # - ioutilDeprecated
+      - ioutilDeprecated
       - mapKey
       - methodExprCall
       # - nestingReduce
diff --git a/cli/config/file.go b/cli/config/file.go
index 45f70e580c0ac..1bf3ce5bd35be 100644
--- a/cli/config/file.go
+++ b/cli/config/file.go
@@ -1,7 +1,7 @@
 package config
 
 import (
-	"io/ioutil"
+	"io"
 	"os"
 	"path/filepath"
 )
@@ -67,5 +67,5 @@ func read(path string) ([]byte, error) {
 		return nil, err
 	}
 	defer fi.Close()
-	return ioutil.ReadAll(fi)
+	return io.ReadAll(fi)
 }
diff --git a/cli/login.go b/cli/login.go
index 65db0be5c0d14..b941ba894b41b 100644
--- a/cli/login.go
+++ b/cli/login.go
@@ -3,8 +3,9 @@ package cli
 import (
 	"errors"
 	"fmt"
-	"io/ioutil"
+	"io"
 	"net/url"
+	"os"
 	"os/exec"
 	"os/user"
 	"runtime"
@@ -30,8 +31,8 @@ func init() {
 	// when in SSH or another type of headless session
 	// NOTE: This needs to be in `init` to prevent data races
 	// (multiple threads trying to set the global browser.Std* variables)
-	browser.Stderr = ioutil.Discard
-	browser.Stdout = ioutil.Discard
+	browser.Stderr = io.Discard
+	browser.Stdout = io.Discard
 }
 
 func login() *cobra.Command {
@@ -205,7 +206,7 @@ func isWSL() (bool, error) {
 	if runtime.GOOS == goosDarwin || runtime.GOOS == goosWindows {
 		return false, nil
 	}
-	data, err := ioutil.ReadFile("/proc/version")
+	data, err := os.ReadFile("/proc/version")
 	if err != nil {
 		return false, xerrors.Errorf("read /proc/version: %w", err)
 	}
diff --git a/cli/start.go b/cli/start.go
index ded57ae300da4..1c89bf8e20b7a 100644
--- a/cli/start.go
+++ b/cli/start.go
@@ -7,7 +7,6 @@ import (
 	"database/sql"
 	"encoding/pem"
 	"fmt"
-	"io/ioutil"
 	"net"
 	"net/http"
 	"net/url"
@@ -383,10 +382,12 @@ func newProvisionerDaemon(ctx context.Context, client *codersdk.Client, logger s
 			panic(err)
 		}
 	}()
-	tempDir, err := ioutil.TempDir("", "provisionerd")
+
+	tempDir, err := os.MkdirTemp("", "provisionerd")
 	if err != nil {
 		return nil, err
 	}
+
 	return provisionerd.New(client.ListenProvisionerDaemon, &provisionerd.Options{
 		Logger:         logger,
 		PollInterval:   50 * time.Millisecond,
@@ -473,7 +474,7 @@ func configureTLS(listener net.Listener, tlsMinVersion, tlsClientAuth, tlsCertFi
 
 	if tlsClientCAFile != "" {
 		caPool := x509.NewCertPool()
-		data, err := ioutil.ReadFile(tlsClientCAFile)
+		data, err := os.ReadFile(tlsClientCAFile)
 		if err != nil {
 			return nil, xerrors.Errorf("read %q: %w", tlsClientCAFile, err)
 		}
diff --git a/cmd/templater/main.go b/cmd/templater/main.go
index aedb9a5d20681..013ac9e931661 100644
--- a/cmd/templater/main.go
+++ b/cmd/templater/main.go
@@ -4,7 +4,6 @@ import (
 	"context"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"net"
 	"net/http/httptest"
 	"net/url"
@@ -263,10 +262,12 @@ func newProvisionerDaemon(ctx context.Context, client *codersdk.Client, logger s
 			panic(err)
 		}
 	}()
-	tempDir, err := ioutil.TempDir("", "provisionerd")
+
+	tempDir, err := os.MkdirTemp("", "provisionerd")
 	if err != nil {
-		return nil, err
+		return nil, xerrors.Errorf("mkdir temp: %w", err)
 	}
+
 	return provisionerd.New(client.ListenProvisionerDaemon, &provisionerd.Options{
 		Logger:         logger,
 		PollInterval:   50 * time.Millisecond,
diff --git a/coderd/coderdtest/coderdtest.go b/coderd/coderdtest/coderdtest.go
index e512e8a7f3b03..958c37ef8d744 100644
--- a/coderd/coderdtest/coderdtest.go
+++ b/coderd/coderdtest/coderdtest.go
@@ -13,7 +13,6 @@ import (
 	"encoding/json"
 	"encoding/pem"
 	"io"
-	"io/ioutil"
 	"math/big"
 	"net"
 	"net/http"
@@ -323,7 +322,7 @@ func NewGoogleInstanceIdentity(t *testing.T, instanceID string, expired bool) (*
 			require.NoError(t, err)
 			return &http.Response{
 				StatusCode: http.StatusOK,
-				Body:       ioutil.NopCloser(bytes.NewReader(data)),
+				Body:       io.NopCloser(bytes.NewReader(data)),
 				Header:     make(http.Header),
 			}, nil
 		}),
@@ -334,7 +333,7 @@ func NewGoogleInstanceIdentity(t *testing.T, instanceID string, expired bool) (*
 		Transport: roundTripper(func(r *http.Request) (*http.Response, error) {
 			return &http.Response{
 				StatusCode: http.StatusOK,
-				Body:       ioutil.NopCloser(bytes.NewReader([]byte(signedKey))),
+				Body:       io.NopCloser(bytes.NewReader([]byte(signedKey))),
 				Header:     make(http.Header),
 			}, nil
 		}),
@@ -379,19 +378,19 @@ func NewAWSInstanceIdentity(t *testing.T, instanceID string) (awsidentity.Certif
 				case "/latest/api/token":
 					return &http.Response{
 						StatusCode: http.StatusOK,
-						Body:       ioutil.NopCloser(bytes.NewReader([]byte("faketoken"))),
+						Body:       io.NopCloser(bytes.NewReader([]byte("faketoken"))),
 						Header:     make(http.Header),
 					}, nil
 				case "/latest/dynamic/instance-identity/signature":
 					return &http.Response{
 						StatusCode: http.StatusOK,
-						Body:       ioutil.NopCloser(bytes.NewReader(signature)),
+						Body:       io.NopCloser(bytes.NewReader(signature)),
 						Header:     make(http.Header),
 					}, nil
 				case "/latest/dynamic/instance-identity/document":
 					return &http.Response{
 						StatusCode: http.StatusOK,
-						Body:       ioutil.NopCloser(bytes.NewReader(document)),
+						Body:       io.NopCloser(bytes.NewReader(document)),
 						Header:     make(http.Header),
 					}, nil
 				default:
diff --git a/coderd/database/dump/main.go b/coderd/database/dump/main.go
index c6a84576353ca..b5b35f736109a 100644
--- a/coderd/database/dump/main.go
+++ b/coderd/database/dump/main.go
@@ -4,7 +4,6 @@ import (
 	"bytes"
 	"database/sql"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -81,7 +80,7 @@ func main() {
 	if !ok {
 		panic("couldn't get caller path")
 	}
-	err = ioutil.WriteFile(filepath.Join(mainPath, "..", "..", "dump.sql"), []byte(dump), 0600)
+	err = os.WriteFile(filepath.Join(mainPath, "..", "..", "dump.sql"), []byte(dump), 0600)
 	if err != nil {
 		panic(err)
 	}
diff --git a/coderd/database/postgres/postgres.go b/coderd/database/postgres/postgres.go
index e1a8e7da55a98..9b3345bd1c71e 100644
--- a/coderd/database/postgres/postgres.go
+++ b/coderd/database/postgres/postgres.go
@@ -3,7 +3,6 @@ package postgres
 import (
 	"database/sql"
 	"fmt"
-	"io/ioutil"
 	"net"
 	"os"
 	"sync"
@@ -48,10 +47,12 @@ func Open() (string, func(), error) {
 	if err != nil {
 		return "", nil, xerrors.Errorf("create pool: %w", err)
 	}
-	tempDir, err := ioutil.TempDir(os.TempDir(), "postgres")
+
+	tempDir, err := os.MkdirTemp(os.TempDir(), "postgres")
 	if err != nil {
 		return "", nil, xerrors.Errorf("create tempdir: %w", err)
 	}
+
 	openPortMutex.Lock()
 	// Pick an explicit port on the host to connect to 5432.
 	// This is necessary so we can configure the port to only use ipv4.
diff --git a/provisionersdk/archive_test.go b/provisionersdk/archive_test.go
index fa4e1963b6876..102b2513e57f4 100644
--- a/provisionersdk/archive_test.go
+++ b/provisionersdk/archive_test.go
@@ -1,7 +1,6 @@
 package provisionersdk_test
 
 import (
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"testing"
@@ -14,7 +13,7 @@ import (
 func TestTar(t *testing.T) {
 	t.Parallel()
 	dir := t.TempDir()
-	file, err := ioutil.TempFile(dir, "")
+	file, err := os.CreateTemp(dir, "")
 	require.NoError(t, err)
 	_ = file.Close()
 	_, err = provisionersdk.Tar(dir)
@@ -24,7 +23,7 @@ func TestTar(t *testing.T) {
 func TestUntar(t *testing.T) {
 	t.Parallel()
 	dir := t.TempDir()
-	file, err := ioutil.TempFile(dir, "")
+	file, err := os.CreateTemp(dir, "")
 	require.NoError(t, err)
 	_ = file.Close()
 	archive, err := provisionersdk.Tar(dir)