diff --git a/auth/trustedheaders_test.go b/auth/trustedheaders_test.go
index ebb31cf..30df8b4 100644
--- a/auth/trustedheaders_test.go
+++ b/auth/trustedheaders_test.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"net/http"
 	"net/http/httptest"
+	"slices"
 	"testing"
 
 	"github.com/google/uuid"
@@ -97,10 +98,8 @@ func TestCaptchaVerifiedReadsTrustedHeader(t *testing.T) {
 }
 
 func TestAllTrustedHeadersIncludesCaptcha(t *testing.T) {
-	for _, h := range AllTrustedHeaders() {
-		if h == HeaderVerifiedCaptcha {
-			return
-		}
+	if slices.Contains(AllTrustedHeaders(), HeaderVerifiedCaptcha) {
+		return
 	}
 	t.Fatalf("AllTrustedHeaders() missing %s — hosts strip-then-stamp from this list, so omitting it makes the header client-forgeable", HeaderVerifiedCaptcha)
 }
diff --git a/egress/egress.go b/egress/egress.go
index abf2c4a..d1fcbb7 100644
--- a/egress/egress.go
+++ b/egress/egress.go
@@ -166,12 +166,12 @@ func validHostname(h string) bool {
 	if len(h) > 253 {
 		return false
 	}
-	for _, label := range strings.Split(h, ".") {
+	for label := range strings.SplitSeq(h, ".") {
 		if label == "" || len(label) > 63 {
 			return false
 		}
 		for _, r := range label {
-			if !(r >= 'a' && r <= 'z') && !(r >= '0' && r <= '9') && r != '-' {
+			if (r < 'a' || r > 'z') && (r < '0' || r > '9') && r != '-' {
 				return false
 			}
 		}
diff --git a/plugin/public_routes.go b/plugin/public_routes.go
index 7218241..21b90d5 100644
--- a/plugin/public_routes.go
+++ b/plugin/public_routes.go
@@ -68,7 +68,7 @@ func checkRoutePath(r ModPublicRoute) string {
 	if strings.HasSuffix(p, "/") {
 		return "no trailing slash; set prefix = true to claim the subtree"
 	}
-	for _, seg := range strings.Split(p[1:], "/") {
+	for seg := range strings.SplitSeq(p[1:], "/") {
 		switch {
 		case seg == "":
 			return "empty path segment"
diff --git a/plugin/wasmguest/mcp.go b/plugin/wasmguest/mcp.go
index f37445a..8af88dc 100644
--- a/plugin/wasmguest/mcp.go
+++ b/plugin/wasmguest/mcp.go
@@ -74,8 +74,8 @@ func methodDocumentation(method protoreflect.MethodDescriptor) (description, doc
 	}
 	paragraph = strings.TrimSpace(strings.ReplaceAll(paragraph, "\n", " "))
 	methodName := string(method.Name())
-	if strings.HasPrefix(paragraph, methodName+" ") {
-		paragraph = strings.TrimSpace(strings.TrimPrefix(paragraph, methodName+" "))
+	if after, ok := strings.CutPrefix(paragraph, methodName+" "); ok {
+		paragraph = strings.TrimSpace(after)
 		if paragraph != "" {
 			runes := []rune(paragraph)
 			runes[0] = unicode.ToUpper(runes[0])
diff --git a/plugin/wasmguest/mcp_test.go b/plugin/wasmguest/mcp_test.go
index 02da35c..0f52bf3 100644
--- a/plugin/wasmguest/mcp_test.go
+++ b/plugin/wasmguest/mcp_test.go
@@ -65,30 +65,30 @@ func registerMCPFixture(t *testing.T) {
 		return
 	}
 	file, err := protodesc.NewFile(&descriptorpb.FileDescriptorProto{
-		Name:       proto.String("test/mcpfixture.proto"),
-		Package:    proto.String("mcpfixture.v1"),
-		Syntax:     proto.String("proto3"),
+		Name:       new("test/mcpfixture.proto"),
+		Package:    new("mcpfixture.v1"),
+		Syntax:     new("proto3"),
 		Dependency: []string{"google/protobuf/timestamp.proto"},
 		MessageType: []*descriptorpb.DescriptorProto{{
-			Name: proto.String("ListArticlesRequest"),
+			Name: new("ListArticlesRequest"),
 			Field: []*descriptorpb.FieldDescriptorProto{
-				{Name: proto.String("search"), Number: proto.Int32(1), Label: descriptorpb.FieldDescriptorProto_LABEL_OPTIONAL.Enum(), Type: descriptorpb.FieldDescriptorProto_TYPE_STRING.Enum()},
-				{Name: proto.String("page"), Number: proto.Int32(2), Label: descriptorpb.FieldDescriptorProto_LABEL_OPTIONAL.Enum(), Type: descriptorpb.FieldDescriptorProto_TYPE_INT32.Enum()},
-				{Name: proto.String("published_after"), Number: proto.Int32(3), Label: descriptorpb.FieldDescriptorProto_LABEL_OPTIONAL.Enum(), Type: descriptorpb.FieldDescriptorProto_TYPE_MESSAGE.Enum(), TypeName: proto.String(".google.protobuf.Timestamp")},
+				{Name: new("search"), Number: proto.Int32(1), Label: descriptorpb.FieldDescriptorProto_LABEL_OPTIONAL.Enum(), Type: descriptorpb.FieldDescriptorProto_TYPE_STRING.Enum()},
+				{Name: new("page"), Number: proto.Int32(2), Label: descriptorpb.FieldDescriptorProto_LABEL_OPTIONAL.Enum(), Type: descriptorpb.FieldDescriptorProto_TYPE_INT32.Enum()},
+				{Name: new("published_after"), Number: proto.Int32(3), Label: descriptorpb.FieldDescriptorProto_LABEL_OPTIONAL.Enum(), Type: descriptorpb.FieldDescriptorProto_TYPE_MESSAGE.Enum(), TypeName: new(".google.protobuf.Timestamp")},
 			},
 		}, {
-			Name: proto.String("ListArticlesResponse"),
+			Name: new("ListArticlesResponse"),
 		}},
 		Service: []*descriptorpb.ServiceDescriptorProto{{
-			Name: proto.String("WikiService"),
+			Name: new("WikiService"),
 			Method: []*descriptorpb.MethodDescriptorProto{{
-				Name: proto.String("ListArticles"), InputType: proto.String(".mcpfixture.v1.ListArticlesRequest"), OutputType: proto.String(".mcpfixture.v1.ListArticlesResponse"),
+				Name: new("ListArticles"), InputType: new(".mcpfixture.v1.ListArticlesRequest"), OutputType: new(".mcpfixture.v1.ListArticlesResponse"),
 			}, {
-				Name: proto.String("StreamArticles"), InputType: proto.String(".mcpfixture.v1.ListArticlesRequest"), OutputType: proto.String(".mcpfixture.v1.ListArticlesResponse"), ServerStreaming: proto.Bool(true),
+				Name: new("StreamArticles"), InputType: new(".mcpfixture.v1.ListArticlesRequest"), OutputType: new(".mcpfixture.v1.ListArticlesResponse"), ServerStreaming: new(true),
 			}},
 		}},
 		SourceCodeInfo: &descriptorpb.SourceCodeInfo{Location: []*descriptorpb.SourceCodeInfo_Location{{
-			Path: []int32{6, 0, 2, 0}, Span: []int32{1, 0, 1, 1}, LeadingComments: proto.String("ListArticles lists Wiki articles.\n\nSupports pagination."),
+			Path: []int32{6, 0, 2, 0}, Span: []int32{1, 0, 1, 1}, LeadingComments: new("ListArticles lists Wiki articles.\n\nSupports pagination."),
 		}}},
 	}, protoregistry.GlobalFiles)
 	if err != nil {