diff --git a/.github/workflows/go-getter.yml b/.github/workflows/go-getter.yml
index b47cb56f2..8c79567d8 100644
--- a/.github/workflows/go-getter.yml
+++ b/.github/workflows/go-getter.yml
@@ -1,22 +1,24 @@
 name: go-getter
 
-on: [push]
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
 
 env:
   TEST_RESULTS_PATH: /tmp/test-results
 
 jobs:
 
-  linux-tests:
+  # Basic validation that runs on both PRs and pushes (safe operations)
+  basic-validation:
     runs-on: ubuntu-latest
     strategy:
       matrix:
         go-version:
-          - 1.18
-          - 1.19
-    permissions:
-      id-token: write
-      contents: read
+          - "1.24"
+          - "1.25"
     steps:
       - name: Setup go
         uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
@@ -26,23 +28,17 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493 # v4.0.0
 
-      - name: Create test directory
-        run: |
-          mkdir -p ${{ env.TEST_RESULTS_PATH }}
-
       - name: Setup cache for go modules
         uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
         with:
           path: |
             ~/.cache/go-build
             ~/go/pkg/mod
-          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
+          key: ${{ runner.os }}-go${{ matrix.go-version }}-${{ hashFiles('**/go.sum') }}
           restore-keys: |
+            ${{ runner.os }}-go${{ matrix.go-version }}-
             ${{ runner.os }}-go-
 
-      - name: Download go modules
-        run: go mod download
-
       # Check go fmt output because it does not report non-zero when there are fmt changes
       - name: Run gofmt
         run: |
@@ -54,6 +50,74 @@ jobs:
               exit 1
             fi
 
+      - name: Build all packages
+        run: go build ./...
+
+      - name: Run unit tests (without cloud integration)
+        run: go test -short -v ./...
+
+  # Linter runs on both PRs and pushes (safe operation)
+  linter:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493 # v4.0.0
+      
+      - name: Setup go
+        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
+        with:
+          go-version: "1.25" # Use latest for linting
+      
+      - name: Setup cache for go modules
+        uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
+        with:
+          path: |
+            ~/.cache/go-build
+            ~/go/pkg/mod
+            ~/.cache/golangci-lint
+          key: ${{ runner.os }}-lint-${{ hashFiles('**/go.sum') }}
+          restore-keys: |
+            ${{ runner.os }}-lint-
+      
+      - name: Lint code
+        uses: golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9 # v8.0.0
+
+  # Full integration tests with cloud resources (only on push to protected branches)
+  linux-integration-tests:
+    runs-on: ubuntu-latest
+    if: github.event_name == 'push'
+    strategy:
+      matrix:
+        go-version:
+          - "1.24"
+          - "1.25"
+    permissions:
+      id-token: write
+      contents: read
+    steps:
+      - name: Setup go
+        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
+        with:
+          go-version: ${{ matrix.go-version }}
+
+      - name: Checkout code
+        uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493 # v4.0.0
+
+      - name: Create test directory
+        run: |
+          mkdir -p ${{ env.TEST_RESULTS_PATH }}
+
+      - name: Setup cache for go modules
+        uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
+        with:
+          path: |
+            ~/.cache/go-build
+            ~/go/pkg/mod
+          key: ${{ runner.os }}-go${{ matrix.go-version }}-${{ hashFiles('**/go.sum') }}
+          restore-keys: |
+            ${{ runner.os }}-go${{ matrix.go-version }}-
+            ${{ runner.os }}-go-
+
       - name: Install gotestsum
         run: go install gotest.tools/gotestsum@v1.8.2
 
@@ -86,13 +150,14 @@ jobs:
           name: linux-test-results-${{ matrix.go-version }}
           path: linux_cov.part
 
-  windows-tests:
+  windows-integration-tests:
     runs-on: windows-latest
+    if: github.event_name == 'push'
     strategy:
       matrix:
         go-version:
-          - 1.18
-          - 1.19
+          - "1.24"
+          - "1.25"
     permissions:
       id-token: write
       contents: read
@@ -114,13 +179,11 @@ jobs:
           path: |
             ~\AppData\Local\go-build
             ~\go\pkg\mod
-          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
+          key: ${{ runner.os }}-go${{ matrix.go-version }}-${{ hashFiles('**/go.sum') }}
           restore-keys: |
+            ${{ runner.os }}-go${{ matrix.go-version }}-
             ${{ runner.os }}-go-
 
-      - name: Download go modules
-        run: go mod download
-
       - name: Install gotestsum
         shell: bash
         run: go install gotest.tools/gotestsum@v1.8.2
@@ -154,11 +217,3 @@ jobs:
         with:
           name: windows-test-results-${{ matrix.go-version }}
           path: win_cov.part
-
-  linter:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493 # v4.0.0
-      - name: Lint code
-        uses: golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9 # v8.0.0
diff --git a/client.go b/client.go
index 77cb496a3..a4b4ebd97 100644
--- a/client.go
+++ b/client.go
@@ -7,7 +7,6 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"strconv"
@@ -205,7 +204,7 @@ func (c *Client) Get() error {
 	if decompressor != nil {
 		// Create a temporary directory to store our archive. We delete
 		// this at the end of everything.
-		td, err := ioutil.TempDir("", "getter")
+		td, err := os.MkdirTemp("", "getter")
 		if err != nil {
 			return fmt.Errorf(
 				"Error creating temporary directory for archive: %s", err)
diff --git a/client_option_progress_test.go b/client_option_progress_test.go
index 598cf33b3..d33a6145e 100644
--- a/client_option_progress_test.go
+++ b/client_option_progress_test.go
@@ -7,7 +7,6 @@ import (
 	"io"
 	"net/http"
 	"net/http/httptest"
-	"os"
 	"path/filepath"
 	"sync"
 	"testing"
@@ -40,8 +39,7 @@ func TestGet_progress(t *testing.T) {
 	defer s.Close()
 
 	{ // dl without tracking
-		dst := tempTestFile(t)
-		defer func() { _ = os.RemoveAll(filepath.Dir(dst)) }()
+		dst := filepath.Join(t.TempDir(), "test-file")
 		if err := GetFile(dst, s.URL+"/file?thig=this&that"); err != nil {
 			t.Fatalf("download failed: %v", err)
 		}
@@ -49,8 +47,7 @@ func TestGet_progress(t *testing.T) {
 
 	{ // tracking
 		p := &MockProgressTracking{}
-		dst := tempTestFile(t)
-		defer func() { _ = os.RemoveAll(filepath.Dir(dst)) }()
+		dst := filepath.Join(t.TempDir(), "test-file")
 		if err := GetFile(dst, s.URL+"/file?thig=this&that", WithProgress(p)); err != nil {
 			t.Fatalf("download failed: %v", err)
 		}
diff --git a/common.go b/common.go
index 0cc5a7bf9..efb626fa1 100644
--- a/common.go
+++ b/common.go
@@ -4,11 +4,11 @@
 package getter
 
 import (
-	"io/ioutil"
+	"os"
 )
 
 func tmpFile(dir, pattern string) (string, error) {
-	f, err := ioutil.TempFile(dir, pattern)
+	f, err := os.CreateTemp(dir, pattern)
 	if err != nil {
 		return "", err
 	}
diff --git a/decompress.go b/decompress.go
index c91060c67..639a5691a 100644
--- a/decompress.go
+++ b/decompress.go
@@ -5,6 +5,7 @@ package getter
 
 import (
 	"os"
+	"slices"
 	"strings"
 )
 
@@ -72,12 +73,7 @@ func containsDotDot(v string) bool {
 	if !strings.Contains(v, "..") {
 		return false
 	}
-	for _, ent := range strings.FieldsFunc(v, isSlashRune) {
-		if ent == ".." {
-			return true
-		}
-	}
-	return false
+	return slices.Contains(strings.FieldsFunc(v, isSlashRune), "..")
 }
 
 func isSlashRune(r rune) bool { return r == '/' || r == '\\' }
diff --git a/decompress_tar_test.go b/decompress_tar_test.go
index 4708fb9e8..f7215f49c 100644
--- a/decompress_tar_test.go
+++ b/decompress_tar_test.go
@@ -6,7 +6,6 @@ package getter
 import (
 	"archive/tar"
 	"bytes"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"runtime"
@@ -82,14 +81,11 @@ func TestTarLimits(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	td, err := ioutil.TempDir("", "getter")
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
+	td := t.TempDir()
 
 	tarFilePath := filepath.Join(td, "input.tar")
 
-	err = os.WriteFile(tarFilePath, b.Bytes(), 0666)
+	err := os.WriteFile(tarFilePath, b.Bytes(), 0666)
 	if err != nil {
 		t.Fatalf("err: %s", err)
 	}
@@ -133,15 +129,12 @@ func TestTarLimits(t *testing.T) {
 
 // testDecompressPermissions decompresses a directory and checks the permissions of the expanded files
 func testDecompressorPermissions(t *testing.T, d Decompressor, input string, expected map[string]int, umask os.FileMode) {
-	td, err := ioutil.TempDir("", "getter")
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
+	td := t.TempDir()
 
 	// Destination is always joining result so that we have a new path
 	dst := filepath.Join(td, "subdir", "result")
 
-	err = d.Decompress(dst, input, true, umask)
+	err := d.Decompress(dst, input, true, umask)
 	if err != nil {
 		t.Fatalf("err: %s", err)
 	}
diff --git a/decompress_testing.go b/decompress_testing.go
index c53d4239a..923c767fa 100644
--- a/decompress_testing.go
+++ b/decompress_testing.go
@@ -7,7 +7,6 @@ import (
 	"crypto/md5"
 	"encoding/hex"
 	"io"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"reflect"
@@ -36,7 +35,7 @@ func TestDecompressor(t testing.TB, d Decompressor, cases []TestDecompressCase)
 		t.Logf("Testing: %s", tc.Input)
 
 		// Temporary dir to store stuff
-		td, err := ioutil.TempDir("", "getter")
+		td, err := os.MkdirTemp("", "getter")
 		if err != nil {
 			t.Fatalf("err: %s", err)
 		}
diff --git a/decompress_zip_test.go b/decompress_zip_test.go
index 396f12165..0f532a031 100644
--- a/decompress_zip_test.go
+++ b/decompress_zip_test.go
@@ -6,7 +6,6 @@ package getter
 import (
 	"archive/zip"
 	"bytes"
-	"io/ioutil"
 	"log"
 	"os"
 	"path/filepath"
@@ -169,14 +168,11 @@ func TestDecompressZipBomb(t *testing.T) {
 		}
 	}
 
-	td, err := ioutil.TempDir("", "go-getter-zip")
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
+	td := t.TempDir()
 
 	zipFilePath := filepath.Join(td, "input.zip")
 
-	err = os.WriteFile(zipFilePath, buf.Bytes(), 0666)
+	err := os.WriteFile(zipFilePath, buf.Bytes(), 0666)
 	if err != nil {
 		t.Fatalf("err: %s", err)
 	}
diff --git a/detect_bitbucket_test.go b/detect_bitbucket_test.go
index 4123ca1c1..fd2fff2d0 100644
--- a/detect_bitbucket_test.go
+++ b/detect_bitbucket_test.go
@@ -38,7 +38,7 @@ func TestBitBucketDetector(t *testing.T) {
 	f := new(BitBucketDetector)
 	for i, tc := range cases {
 		var err error
-		for i := 0; i < 3; i++ {
+		for i := range 3 {
 			var output string
 			var ok bool
 			output, ok, err = f.Detect(tc.Input, pwd)
diff --git a/detect_file_unix_test.go b/detect_file_unix_test.go
index f65bb147a..6795bf3bb 100644
--- a/detect_file_unix_test.go
+++ b/detect_file_unix_test.go
@@ -7,7 +7,6 @@
 package getter
 
 import (
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"testing"
@@ -16,16 +15,11 @@ import (
 // If a relative symlink is passed in as the pwd to Detect, the resulting URL
 // can have an invalid path.
 func TestFileDetector_relativeSymlink(t *testing.T) {
-	tmpDir, err := ioutil.TempDir("", "go-getter")
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	defer func() { _ = os.RemoveAll(tmpDir) }()
+	tmpDir := t.TempDir()
 
 	// We may have a symlinked tmp dir,
 	// e.g. OSX uses /var -> /private/var
-	tmpDir, err = filepath.EvalSymlinks(tmpDir)
+	tmpDir, err := filepath.EvalSymlinks(tmpDir)
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/folder_storage_test.go b/folder_storage_test.go
index e8e3c475e..0dbf57743 100644
--- a/folder_storage_test.go
+++ b/folder_storage_test.go
@@ -14,7 +14,7 @@ func TestFolderStorage_impl(t *testing.T) {
 }
 
 func TestFolderStorage(t *testing.T) {
-	s := &FolderStorage{StorageDir: tempDir(t)}
+	s := &FolderStorage{StorageDir: t.TempDir()}
 
 	module := testModule("basic")
 
diff --git a/get_file_copy_test.go b/get_file_copy_test.go
index e3b7d756d..d993920cf 100644
--- a/get_file_copy_test.go
+++ b/get_file_copy_test.go
@@ -16,7 +16,7 @@ import (
 type OneDoneContext bool
 
 func (*OneDoneContext) Deadline() (deadline time.Time, ok bool) { return }
-func (*OneDoneContext) Value(key interface{}) interface{}       { return nil }
+func (*OneDoneContext) Value(key any) any                       { return nil }
 
 func (o *OneDoneContext) Err() error {
 	if *o == false {
diff --git a/get_file_test.go b/get_file_test.go
index bab2847ed..c29b7c2a3 100644
--- a/get_file_test.go
+++ b/get_file_test.go
@@ -15,7 +15,7 @@ func TestFileGetter_impl(t *testing.T) {
 
 func TestFileGetter(t *testing.T) {
 	g := new(FileGetter)
-	dst := tempDir(t)
+	dst := filepath.Join(t.TempDir(), "target")
 
 	// With a dir that doesn't exist
 	if err := g.Get(dst, testModuleURL("basic")); err != nil {
@@ -40,7 +40,7 @@ func TestFileGetter(t *testing.T) {
 
 func TestFileGetter_sourceFile(t *testing.T) {
 	g := new(FileGetter)
-	dst := tempDir(t)
+	dst := filepath.Join(t.TempDir(), "target")
 
 	// With a source URL that is a path to a file
 	u := testModuleURL("basic")
@@ -52,7 +52,7 @@ func TestFileGetter_sourceFile(t *testing.T) {
 
 func TestFileGetter_sourceNoExist(t *testing.T) {
 	g := new(FileGetter)
-	dst := tempDir(t)
+	dst := filepath.Join(t.TempDir(), "target")
 
 	// With a source URL that doesn't exist
 	u := testModuleURL("basic")
@@ -64,7 +64,7 @@ func TestFileGetter_sourceNoExist(t *testing.T) {
 
 func TestFileGetter_dir(t *testing.T) {
 	g := new(FileGetter)
-	dst := tempDir(t)
+	dst := filepath.Join(t.TempDir(), "target")
 
 	if err := os.MkdirAll(dst, 0755); err != nil {
 		t.Fatalf("err: %s", err)
@@ -78,8 +78,9 @@ func TestFileGetter_dir(t *testing.T) {
 
 func TestFileGetter_dirSymlink(t *testing.T) {
 	g := new(FileGetter)
-	dst := tempDir(t)
-	dst2 := tempDir(t)
+	tempBase := t.TempDir()
+	dst := filepath.Join(tempBase, "dst")
+	dst2 := filepath.Join(tempBase, "dst2")
 
 	// Make parents
 	if err := os.MkdirAll(filepath.Dir(dst), 0755); err != nil {
@@ -108,8 +109,7 @@ func TestFileGetter_dirSymlink(t *testing.T) {
 
 func TestFileGetter_GetFile(t *testing.T) {
 	g := new(FileGetter)
-	dst := tempTestFile(t)
-	defer func() { _ = os.RemoveAll(filepath.Dir(dst)) }()
+	dst := filepath.Join(t.TempDir(), "test-file")
 
 	// With a dir that doesn't exist
 	if err := g.GetFile(dst, testModuleURL("basic-file/foo.txt")); err != nil {
@@ -133,8 +133,7 @@ func TestFileGetter_GetFile_Copy(t *testing.T) {
 	g := new(FileGetter)
 	g.Copy = true
 
-	dst := tempTestFile(t)
-	defer func() { _ = os.RemoveAll(filepath.Dir(dst)) }()
+	dst := filepath.Join(t.TempDir(), "test-file")
 
 	// With a dir that doesn't exist
 	if err := g.GetFile(dst, testModuleURL("basic-file/foo.txt")); err != nil {
@@ -157,7 +156,7 @@ func TestFileGetter_GetFile_Copy(t *testing.T) {
 // https://github.com/hashicorp/terraform/issues/8418
 func TestFileGetter_percent2F(t *testing.T) {
 	g := new(FileGetter)
-	dst := tempDir(t)
+	dst := filepath.Join(t.TempDir(), "target")
 
 	// With a dir that doesn't exist
 	if err := g.Get(dst, testModuleURL("basic%2Ftest")); err != nil {
diff --git a/get_gcs_test.go b/get_gcs_test.go
index efebfea64..39cbe969d 100644
--- a/get_gcs_test.go
+++ b/get_gcs_test.go
@@ -4,7 +4,6 @@
 package getter
 
 import (
-	"io/ioutil"
 	"net/url"
 	"os"
 	"path/filepath"
@@ -19,8 +18,12 @@ func TestGCSGetter_impl(t *testing.T) {
 }
 
 func TestGCSGetter(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping test that requires GCS credentials in short mode")
+	}
+
 	g := new(GCSGetter)
-	dst := tempDir(t)
+	dst := t.TempDir()
 
 	// With a dir that doesn't exist
 	err := g.Get(
@@ -37,8 +40,12 @@ func TestGCSGetter(t *testing.T) {
 }
 
 func TestGCSGetter_subdir(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping test that requires GCS credentials in short mode")
+	}
+
 	g := new(GCSGetter)
-	dst := tempDir(t)
+	dst := t.TempDir()
 
 	// With a dir that doesn't exist
 	err := g.Get(
@@ -55,9 +62,12 @@ func TestGCSGetter_subdir(t *testing.T) {
 }
 
 func TestGCSGetter_GetFile(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping test that requires GCS credentials in short mode")
+	}
+
 	g := new(GCSGetter)
-	dst := tempTestFile(t)
-	defer func() { _ = os.RemoveAll(filepath.Dir(dst)) }()
+	dst := filepath.Join(t.TempDir(), "test-file")
 
 	// Download
 	err := g.GetFile(
@@ -74,9 +84,12 @@ func TestGCSGetter_GetFile(t *testing.T) {
 }
 
 func TestGCSGetter_GetGenerationFile(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping test that requires GCS credentials in short mode")
+	}
+
 	g := new(GCSGetter)
-	dst := tempTestFile(t)
-	defer func() { _ = os.RemoveAll(filepath.Dir(dst)) }()
+	dst := filepath.Join(t.TempDir(), "test-file")
 
 	// Download Previous Version
 	err := g.GetFile(
@@ -86,7 +99,7 @@ func TestGCSGetter_GetGenerationFile(t *testing.T) {
 	}
 
 	// Verify contents are valid for this generation
-	content, err := ioutil.ReadFile(dst)
+	content, err := os.ReadFile(dst)
 	if err != nil {
 		t.Fatalf("err: %s", err)
 	}
@@ -102,7 +115,7 @@ func TestGCSGetter_GetGenerationFile(t *testing.T) {
 	}
 
 	// Verify contents are valid for this generation
-	content, err = ioutil.ReadFile(dst)
+	content, err = os.ReadFile(dst)
 	if err != nil {
 		t.Fatalf("err: %s", err)
 	}
@@ -113,9 +126,12 @@ func TestGCSGetter_GetGenerationFile(t *testing.T) {
 }
 
 func TestGCSGetter_GetFile_notfound(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping test that requires GCS credentials in short mode")
+	}
+
 	g := new(GCSGetter)
-	dst := tempTestFile(t)
-	defer func() { _ = os.RemoveAll(filepath.Dir(dst)) }()
+	dst := filepath.Join(t.TempDir(), "test-file")
 
 	// Download
 	err := g.GetFile(
@@ -126,6 +142,10 @@ func TestGCSGetter_GetFile_notfound(t *testing.T) {
 }
 
 func TestGCSGetter_ClientMode_dir(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping test that requires GCS credentials in short mode")
+	}
+
 	g := new(GCSGetter)
 
 	// Check client mode on a key prefix with only a single key.
@@ -140,6 +160,10 @@ func TestGCSGetter_ClientMode_dir(t *testing.T) {
 }
 
 func TestGCSGetter_ClientMode_file(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping test that requires GCS credentials in short mode")
+	}
+
 	g := new(GCSGetter)
 
 	// Check client mode on a key prefix which contains sub-keys.
@@ -154,6 +178,10 @@ func TestGCSGetter_ClientMode_file(t *testing.T) {
 }
 
 func TestGCSGetter_ClientMode_notfound(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping test that requires GCS credentials in short mode")
+	}
+
 	g := new(GCSGetter)
 
 	// Check the client mode when a non-existent key is looked up. This does not
@@ -213,12 +241,14 @@ func TestGCSGetter_Url(t *testing.T) {
 }
 
 func TestGCSGetter_GetFile_OAuthAccessToken(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping test that requires GCS credentials in short mode")
+	}
 	if os.Getenv("GOOGLE_OAUTH_ACCESS_TOKEN") == "" {
 		t.Skip("Skipping; set GOOGLE_OAUTH_ACCESS_TOKEN to run")
 	}
 	g := new(GCSGetter)
-	dst := tempTestFile(t)
-	defer func() { _ = os.RemoveAll(filepath.Dir(dst)) }()
+	dst := filepath.Join(t.TempDir(), "test-file")
 
 	// Download
 	err := g.GetFile(
diff --git a/get_git.go b/get_git.go
index 71d48aa59..e19d017af 100644
--- a/get_git.go
+++ b/get_git.go
@@ -8,7 +8,6 @@ import (
 	"context"
 	"encoding/base64"
 	"fmt"
-	"io/ioutil"
 	"net/url"
 	"os"
 	"os/exec"
@@ -101,7 +100,7 @@ func (g *GitGetter) Get(dst string, u *url.URL) error {
 		}
 
 		// Create a temp file for the key and ensure it is removed.
-		fh, err := ioutil.TempFile("", "go-getter")
+		fh, err := os.CreateTemp("", "go-getter")
 		if err != nil {
 			return err
 		}
diff --git a/get_git_test.go b/get_git_test.go
index 7cf31d5d5..91b6835d1 100644
--- a/get_git_test.go
+++ b/get_git_test.go
@@ -9,7 +9,6 @@ import (
 	"encoding/base64"
 	"errors"
 	"fmt"
-	"io/ioutil"
 	"net/url"
 	"os"
 	"os/exec"
@@ -39,7 +38,7 @@ func TestGitGetter(t *testing.T) {
 	}
 
 	g := new(GitGetter)
-	dst := tempDir(t)
+	dst := filepath.Join(t.TempDir(), "target")
 
 	repo := testGitRepo(t, "basic")
 	repo.commitFile("foo.txt", "hello")
@@ -62,7 +61,7 @@ func TestGitGetter_branch(t *testing.T) {
 	}
 
 	g := new(GitGetter)
-	dst := tempDir(t)
+	dst := filepath.Join(t.TempDir(), "target")
 
 	repo := testGitRepo(t, "branch")
 	repo.git("checkout", "-b", "test-branch")
@@ -100,7 +99,7 @@ func TestGitGetter_commitID(t *testing.T) {
 	}
 
 	g := new(GitGetter)
-	dst := tempDir(t)
+	dst := filepath.Join(t.TempDir(), "target")
 
 	// We're going to create different content on the main branch vs.
 	// another branch here, so that below we can recognize if we
@@ -153,7 +152,7 @@ func TestGitGetter_remoteWithoutMaster(t *testing.T) {
 	}
 
 	g := new(GitGetter)
-	dst := tempDir(t)
+	dst := filepath.Join(t.TempDir(), "target")
 
 	repo := testGitRepo(t, "branch")
 	repo.git("checkout", "-b", "test-branch")
@@ -172,7 +171,7 @@ func TestGitGetter_remoteWithoutMaster(t *testing.T) {
 		t.Fatalf("err: %s", err)
 	}
 
-	dst2 := tempDir(t)
+	dst2 := filepath.Join(t.TempDir(), "target2")
 	// Get again should work
 	if err := g.Get(dst2, repo.url); err != nil {
 		t.Fatalf("err: %s", err)
@@ -192,7 +191,7 @@ func TestGitGetter_shallowClone(t *testing.T) {
 	}
 
 	g := new(GitGetter)
-	dst := tempDir(t)
+	dst := filepath.Join(t.TempDir(), "target")
 
 	repo := testGitRepo(t, "upstream")
 	repo.commitFile("upstream.txt", "0")
@@ -228,7 +227,7 @@ func TestGitGetter_shallowCloneWithTag(t *testing.T) {
 	}
 
 	g := new(GitGetter)
-	dst := tempDir(t)
+	dst := filepath.Join(t.TempDir(), "target")
 
 	repo := testGitRepo(t, "upstream")
 	repo.commitFile("v1.0.txt", "0")
@@ -278,7 +277,7 @@ func TestGitGetter_shallowCloneWithCommitID(t *testing.T) {
 	}
 
 	g := new(GitGetter)
-	dst := tempDir(t)
+	dst := filepath.Join(t.TempDir(), "target")
 
 	repo := testGitRepo(t, "upstream")
 	repo.commitFile("v1.0.txt", "0")
@@ -315,7 +314,7 @@ func TestGitGetter_branchUpdate(t *testing.T) {
 	}
 
 	g := new(GitGetter)
-	dst := tempDir(t)
+	dst := filepath.Join(t.TempDir(), "target")
 
 	// First setup the state with a fresh branch
 	repo := testGitRepo(t, "branch-update")
@@ -357,7 +356,7 @@ func TestGitGetter_tag(t *testing.T) {
 	}
 
 	g := new(GitGetter)
-	dst := tempDir(t)
+	dst := filepath.Join(t.TempDir(), "target")
 
 	repo := testGitRepo(t, "tag")
 	repo.commitFile("tag.txt", "tag")
@@ -395,8 +394,7 @@ func TestGitGetter_GetFile(t *testing.T) {
 	}
 
 	g := new(GitGetter)
-	dst := tempTestFile(t)
-	defer func() { _ = os.RemoveAll(filepath.Dir(dst)) }()
+	dst := filepath.Join(t.TempDir(), "test-file")
 
 	repo := testGitRepo(t, "file")
 	repo.commitFile("file.txt", "hello")
@@ -421,14 +419,10 @@ func TestGitGetter_gitVersion(t *testing.T) {
 	if runtime.GOOS == "windows" {
 		t.Skip("skipping on windows since the test requires sh")
 	}
-	dir, err := ioutil.TempDir("", "go-getter")
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer func() { _ = os.RemoveAll(dir) }()
+	dir := t.TempDir()
 
 	script := filepath.Join(dir, "git")
-	err = ioutil.WriteFile(
+	err := os.WriteFile(
 		script,
 		[]byte("#!/bin/sh\necho \"git version 2.0 (Some Metadata Here)\n\""),
 		0700)
@@ -459,7 +453,7 @@ func TestGitGetter_sshKey(t *testing.T) {
 	}
 
 	g := new(GitGetter)
-	dst := tempDir(t)
+	dst := filepath.Join(t.TempDir(), "target")
 
 	encodedKey := base64.StdEncoding.EncodeToString([]byte(testGitToken))
 
@@ -489,7 +483,7 @@ func TestGitGetter_sshSCPStyle(t *testing.T) {
 	}
 
 	g := new(GitGetter)
-	dst := tempDir(t)
+	dst := filepath.Join(t.TempDir(), "target")
 
 	encodedKey := base64.StdEncoding.EncodeToString([]byte(testGitToken))
 
@@ -530,7 +524,7 @@ func TestGitGetter_sshExplicitPort(t *testing.T) {
 	}
 
 	g := new(GitGetter)
-	dst := tempDir(t)
+	dst := filepath.Join(t.TempDir(), "target")
 
 	encodedKey := base64.StdEncoding.EncodeToString([]byte(testGitToken))
 
@@ -571,7 +565,7 @@ func TestGitGetter_sshSCPStyleInvalidScheme(t *testing.T) {
 	}
 
 	g := new(GitGetter)
-	dst := tempDir(t)
+	dst := filepath.Join(t.TempDir(), "target")
 
 	encodedKey := base64.StdEncoding.EncodeToString([]byte(testGitToken))
 
@@ -614,7 +608,7 @@ func TestGitGetter_submodule(t *testing.T) {
 	}
 
 	g := new(GitGetter)
-	dst := tempDir(t)
+	dst := filepath.Join(t.TempDir(), "target")
 
 	relpath := func(basepath, targpath string) string {
 		relpath, err := filepath.Rel(basepath, targpath)
@@ -732,9 +726,9 @@ func TestGitGetter_subdirectory_symlink(t *testing.T) {
 	}
 
 	g := new(GitGetter)
-	dst := tempDir(t)
+	dst := filepath.Join(t.TempDir(), "target")
 
-	target, err := ioutil.TempFile("", "link-target")
+	target, err := os.CreateTemp("", "link-target")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -813,7 +807,7 @@ func TestGitGetter_subdirectory_malicious_symlink(t *testing.T) {
 	}
 
 	g := new(GitGetter)
-	dst := tempDir(t)
+	dst := filepath.Join(t.TempDir(), "target")
 
 	repo := testGitRepo(t, "empty-repo")
 	repo.git("config", "commit.gpgsign", "false")
@@ -868,7 +862,7 @@ func TestGitGetter_subdirectory(t *testing.T) {
 	}
 
 	g := new(GitGetter)
-	dst := tempDir(t)
+	dst := filepath.Join(t.TempDir(), "target")
 
 	repo := testGitRepo(t, "empty-repo")
 	u, err := url.Parse(fmt.Sprintf("git::%s//../../../../../../etc/passwd", repo.url.String()))
@@ -908,7 +902,7 @@ func TestGitGetter_BadRemoteUrl(t *testing.T) {
 	}
 
 	g := new(GitGetter)
-	dst := tempDir(t)
+	dst := filepath.Join(t.TempDir(), "target")
 
 	// try an option that exists
 	badUrl := "--no-refs"
@@ -938,7 +932,7 @@ func TestGitGetter_BadGitConfig(t *testing.T) {
 
 	ctx := context.Background()
 	g := new(GitGetter)
-	dst := tempDir(t)
+	dst := filepath.Join(t.TempDir(), "target")
 
 	url, err := url.Parse("https://github.com/hashicorp/go-getter")
 	if err != nil {
@@ -994,7 +988,7 @@ func TestGitGetter_BadGitDirName(t *testing.T) {
 
 	ctx := context.Background()
 	g := new(GitGetter)
-	dst := tempDir(t)
+	dst := filepath.Join(t.TempDir(), "target")
 
 	url, err := url.Parse("https://github.com/hashicorp/go-getter")
 	if err != nil {
@@ -1055,7 +1049,7 @@ func TestGitGetter_BadRef(t *testing.T) {
 
 	ctx := context.Background()
 	g := new(GitGetter)
-	dst := tempDir(t)
+	dst := filepath.Join(t.TempDir(), "target")
 
 	url, err := url.Parse("https://github.com/hashicorp/go-getter")
 	if err != nil {
@@ -1088,10 +1082,7 @@ type gitRepo struct {
 
 // testGitRepo creates a new test git repository.
 func testGitRepo(t *testing.T, name string) *gitRepo {
-	dir, err := ioutil.TempDir("", "go-getter")
-	if err != nil {
-		t.Fatal(err)
-	}
+	dir := t.TempDir()
 	dir = filepath.Join(dir, name)
 	if err := os.Mkdir(dir, 0700); err != nil {
 		t.Fatal(err)
@@ -1130,7 +1121,7 @@ func (r *gitRepo) git(args ...string) {
 // commitFile writes and commits a text file to the repo.
 func (r *gitRepo) commitFile(file, content string) {
 	path := filepath.Join(r.dir, file)
-	if err := ioutil.WriteFile(path, []byte(content), 0600); err != nil {
+	if err := os.WriteFile(path, []byte(content), 0600); err != nil {
 		r.t.Fatal(err)
 	}
 	r.git("add", file)
diff --git a/get_hg_test.go b/get_hg_test.go
index bda299ecd..d624be1a2 100644
--- a/get_hg_test.go
+++ b/get_hg_test.go
@@ -31,7 +31,7 @@ func TestHgGetter(t *testing.T) {
 	}
 
 	g := new(HgGetter)
-	dst := tempDir(t)
+	dst := filepath.Join(t.TempDir(), "dst")
 
 	// With a dir that doesn't exist
 	if err := g.Get(dst, testModuleURL("basic-hg")); err != nil {
@@ -52,7 +52,7 @@ func TestHgGetter_branch(t *testing.T) {
 	}
 
 	g := new(HgGetter)
-	dst := tempDir(t)
+	dst := filepath.Join(t.TempDir(), "dst")
 
 	url := testModuleURL("basic-hg")
 	q := url.Query()
@@ -88,8 +88,7 @@ func TestHgGetter_GetFile(t *testing.T) {
 	}
 
 	g := new(HgGetter)
-	dst := tempTestFile(t)
-	defer func() { _ = os.RemoveAll(filepath.Dir(dst)) }()
+	dst := filepath.Join(t.TempDir(), "test-file")
 
 	// Download
 	if err := g.GetFile(dst, testModuleURL("basic-hg/foo.txt")); err != nil {
@@ -111,15 +110,16 @@ func TestHgGetter_HgArgumentsNotAllowed(t *testing.T) {
 
 	g := new(HgGetter)
 
-	// If arguments are allowed in the destination, this Get call will fail
-	dst := "--config=alias.clone=!false"
-	defer func() { _ = os.RemoveAll(dst) }()
+	// Test that destination paths that look like hg arguments are treated as literal paths
+	// Create the problematic directory name inside a temp directory for cleanup
+	tempBase := t.TempDir()
+	dst := filepath.Join(tempBase, "--config=alias.clone=!false")
 	err := g.Get(dst, testModuleURL("basic-hg"))
 	if err != nil {
 		t.Fatalf("Expected no err, got: %s", err)
 	}
 
-	dst = tempDir(t)
+	dst = filepath.Join(t.TempDir(), "dst")
 	// Test arguments passed into the `rev` parameter
 	// This clone call will fail regardless, but an exit code of 1 indicates
 	// that the `false` command executed
@@ -131,7 +131,7 @@ func TestHgGetter_HgArgumentsNotAllowed(t *testing.T) {
 		}
 	}
 
-	dst = tempDir(t)
+	dst = filepath.Join(t.TempDir(), "dst")
 	// Test arguments passed in the repository URL
 	// This Get call will fail regardless, but it should fail
 	// because the repository can't be found.
diff --git a/get_http_test.go b/get_http_test.go
index aae84228c..c93cce769 100644
--- a/get_http_test.go
+++ b/get_http_test.go
@@ -9,7 +9,6 @@ import (
 	"encoding/hex"
 	"errors"
 	"fmt"
-	"io/ioutil"
 	"net"
 	"net/http"
 	"net/http/httputil"
@@ -32,7 +31,7 @@ func TestHttpGetter_header(t *testing.T) {
 	defer func() { _ = ln.Close() }()
 
 	g := new(HttpGetter)
-	dst := tempDir(t)
+	dst := filepath.Join(t.TempDir(), "target")
 	defer func() { _ = os.RemoveAll(dst) }()
 
 	var u url.URL
@@ -79,7 +78,7 @@ func TestHttpGetter_requestHeader(t *testing.T) {
 	g := new(HttpGetter)
 	g.Header = make(http.Header)
 	g.Header.Add("X-Foobar", "foobar")
-	dst := tempDir(t)
+	dst := filepath.Join(t.TempDir(), "target")
 	defer func() { _ = os.RemoveAll(dst) }()
 
 	var u url.URL
@@ -105,7 +104,7 @@ func TestHttpGetter_meta(t *testing.T) {
 	defer func() { _ = ln.Close() }()
 
 	g := new(HttpGetter)
-	dst := tempDir(t)
+	dst := filepath.Join(t.TempDir(), "target")
 	defer func() { _ = os.RemoveAll(dst) }()
 
 	var u url.URL
@@ -149,7 +148,7 @@ func TestHttpGetter_metaSubdir(t *testing.T) {
 	defer func() { _ = ln.Close() }()
 
 	g := new(HttpGetter)
-	dst := tempDir(t)
+	dst := filepath.Join(t.TempDir(), "target")
 	defer func() { _ = os.RemoveAll(dst) }()
 
 	var u url.URL
@@ -174,7 +173,7 @@ func TestHttpGetter_metaSubdirGlob(t *testing.T) {
 	defer func() { _ = ln.Close() }()
 
 	g := new(HttpGetter)
-	dst := tempDir(t)
+	dst := filepath.Join(t.TempDir(), "target")
 	defer func() { _ = os.RemoveAll(dst) }()
 
 	var u url.URL
@@ -199,7 +198,7 @@ func TestHttpGetter_none(t *testing.T) {
 	defer func() { _ = ln.Close() }()
 
 	g := new(HttpGetter)
-	dst := tempDir(t)
+	dst := filepath.Join(t.TempDir(), "target")
 	defer func() { _ = os.RemoveAll(dst) }()
 
 	var u url.URL
@@ -225,7 +224,7 @@ func TestHttpGetter_resume(t *testing.T) {
 	ln := testHttpServer(t)
 	defer func() { _ = ln.Close() }()
 
-	dst := tempDir(t)
+	dst := filepath.Join(t.TempDir(), "target")
 	defer func() { _ = os.RemoveAll(dst) }()
 
 	dst = filepath.Join(dst, "..", "range")
@@ -253,7 +252,7 @@ func TestHttpGetter_resume(t *testing.T) {
 		t.Fatalf("finishing download should not error: %v", err)
 	}
 
-	b, err := ioutil.ReadFile(dst)
+	b, err := os.ReadFile(dst)
 	if err != nil {
 		t.Fatalf("readfile failed: %v", err)
 	}
@@ -281,7 +280,7 @@ func TestHttpGetter_resumeNoRange(t *testing.T) {
 	ln := testHttpServer(t)
 	defer func() { _ = ln.Close() }()
 
-	dst := tempDir(t)
+	dst := filepath.Join(t.TempDir(), "target")
 	defer func() { _ = os.RemoveAll(dst) }()
 
 	dst = filepath.Join(dst, "..", "range")
@@ -309,7 +308,7 @@ func TestHttpGetter_resumeNoRange(t *testing.T) {
 		t.Fatalf("finishing download should not error: %v", err)
 	}
 
-	b, err := ioutil.ReadFile(dst)
+	b, err := os.ReadFile(dst)
 	if err != nil {
 		t.Fatalf("readfile failed: %v", err)
 	}
@@ -324,8 +323,7 @@ func TestHttpGetter_file(t *testing.T) {
 	defer func() { _ = ln.Close() }()
 
 	g := new(HttpGetter)
-	dst := tempTestFile(t)
-	defer func() { _ = os.RemoveAll(filepath.Dir(dst)) }()
+	dst := filepath.Join(t.TempDir(), "test-file")
 
 	var u url.URL
 	u.Scheme = "http"
@@ -353,7 +351,7 @@ func TestHttpGetter_http2server(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	dst := tempTestFile(t)
+	dst := filepath.Join(t.TempDir(), "test-file")
 
 	err = g.GetFile(dst, src)
 	if err != nil {
@@ -366,7 +364,7 @@ func TestHttpGetter_auth(t *testing.T) {
 	defer func() { _ = ln.Close() }()
 
 	g := new(HttpGetter)
-	dst := tempDir(t)
+	dst := filepath.Join(t.TempDir(), "target")
 	defer func() { _ = os.RemoveAll(dst) }()
 
 	var u url.URL
@@ -405,7 +403,7 @@ func TestHttpGetter_authNetrc(t *testing.T) {
 	defer func() { _ = ln.Close() }()
 
 	g := new(HttpGetter)
-	dst := tempDir(t)
+	dst := filepath.Join(t.TempDir(), "target")
 	defer func() { _ = os.RemoveAll(dst) }()
 
 	var u url.URL
@@ -468,7 +466,7 @@ func TestHttpGetter_cleanhttp(t *testing.T) {
 	}()
 
 	g := new(HttpGetter)
-	dst := tempDir(t)
+	dst := filepath.Join(t.TempDir(), "target")
 	defer func() { _ = os.RemoveAll(dst) }()
 
 	var u url.URL
@@ -511,7 +509,7 @@ func TestHttpGetter__RespectsContextCanceled(t *testing.T) {
 	u.Scheme = "http"
 	u.Host = ln.Addr().String()
 	u.Path = "/file"
-	dst := tempDir(t)
+	dst := filepath.Join(t.TempDir(), "target")
 
 	rt := hookableHTTPRoundTripper{
 		before: func(req *http.Request) {
@@ -547,7 +545,7 @@ func TestHttpGetter__XTerraformGetLimit(t *testing.T) {
 	u.Scheme = "http"
 	u.Host = ln.Addr().String()
 	u.Path = "/loop"
-	dst := tempDir(t)
+	dst := filepath.Join(t.TempDir(), "target")
 
 	g := new(HttpGetter)
 	g.XTerraformGetLimit = 10
@@ -572,7 +570,7 @@ func TestHttpGetter__XTerraformGetDisabled(t *testing.T) {
 	u.Scheme = "http"
 	u.Host = ln.Addr().String()
 	u.Path = "/loop"
-	dst := tempDir(t)
+	dst := filepath.Join(t.TempDir(), "target")
 
 	g := new(HttpGetter)
 	g.XTerraformGetDisabled = true
@@ -607,7 +605,7 @@ func TestHttpGetter__XTerraformGetDetected(t *testing.T) {
 	u.Scheme = "http"
 	u.Host = ln.Addr().String()
 	u.Path = "/first"
-	dst := tempDir(t)
+	dst := filepath.Join(t.TempDir(), "target")
 
 	c := &Client{
 		Ctx:  ctx,
@@ -643,7 +641,7 @@ func TestHttpGetter__XTerraformGetProxyBypass(t *testing.T) {
 	u.Scheme = "http"
 	u.Host = ln.Addr().String()
 	u.Path = "/start"
-	dst := tempDir(t)
+	dst := filepath.Join(t.TempDir(), "target")
 
 	proxy, err := url.Parse(fmt.Sprintf("http://%s/", proxyLn.Addr().String()))
 	if err != nil {
@@ -685,7 +683,7 @@ func TestHttpGetter__XTerraformGetConfiguredGettersBypass(t *testing.T) {
 	u.Scheme = "http"
 	u.Host = ln.Addr().String()
 	u.Path = "/start"
-	dst := tempDir(t)
+	dst := filepath.Join(t.TempDir(), "target")
 
 	rt := hookableHTTPRoundTripper{
 		before: func(req *http.Request) {
@@ -731,7 +729,7 @@ func TestHttpGetter__endless_body(t *testing.T) {
 	u.Scheme = "http"
 	u.Host = ln.Addr().String()
 	u.Path = "/"
-	dst := tempDir(t)
+	dst := filepath.Join(t.TempDir(), "target")
 
 	httpGetter := new(HttpGetter)
 	httpGetter.MaxBytes = 10
@@ -761,10 +759,7 @@ func TestHttpGetter_subdirLink(t *testing.T) {
 	defer func() { _ = ln.Close() }()
 
 	httpGetter := new(HttpGetter)
-	dst, err := ioutil.TempDir("", "tf")
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
+	dst := t.TempDir()
 
 	t.Logf("dst: %q", dst)
 
@@ -784,7 +779,7 @@ func TestHttpGetter_subdirLink(t *testing.T) {
 		},
 	}
 
-	err = client.Get()
+	err := client.Get()
 	if err != nil {
 		t.Fatalf("get err: %v", err)
 	}
@@ -829,7 +824,7 @@ func testHttpServerWithXTerraformGetDetected(t *testing.T) net.Listener {
 		w.Header().Set("X-Terraform-Get", first)
 	})
 	mux.HandleFunc("/archive.tar.gz", func(w http.ResponseWriter, r *http.Request) {
-		f, err := ioutil.ReadFile("testdata/archive.tar.gz")
+		f, err := os.ReadFile("testdata/archive.tar.gz")
 		if err != nil {
 			t.Fatal(err)
 		}
diff --git a/get_s3.go b/get_s3.go
index b119ff0d6..36529813c 100644
--- a/get_s3.go
+++ b/get_s3.go
@@ -230,12 +230,7 @@ func (g *S3Getter) getAWSConfig(region string, url *url.URL, staticCreds *creden
 	if creds != nil {
 		loadOptions = append(loadOptions,
 			config.WithEC2IMDSClientEnableState(imds.ClientEnabled),
-			config.WithCredentialsProvider(creds),
-			config.WithEndpointResolverWithOptions(aws.EndpointResolverWithOptionsFunc(
-				func(service, region string, options ...interface{}) (aws.Endpoint, error) {
-					return aws.Endpoint{URL: url.Host}, nil
-				},
-			)))
+			config.WithCredentialsProvider(creds))
 	}
 
 	conf.Credentials = creds
@@ -364,7 +359,22 @@ func (g *S3Getter) newS3Client(
 		return nil, err
 	}
 
-	return s3.NewFromConfig(cfg, func(opts *s3.Options) {
+	// Check if this is a custom S3-compatible endpoint (not AWS)
+	var isAWSDomain bool
+	for _, partition := range endpoints.DefaultPartitions() {
+		if strings.HasSuffix(url.Host, partition.DNSSuffix()) {
+			isAWSDomain = true
+			break
+		}
+	}
+
+	clientOptions := func(opts *s3.Options) {
 		opts.UsePathStyle = true
-	}), nil
+		// If it's not an AWS domain, set the custom endpoint
+		if !isAWSDomain {
+			opts.BaseEndpoint = aws.String("https://" + url.Host)
+		}
+	}
+
+	return s3.NewFromConfig(cfg, clientOptions), nil
 }
diff --git a/get_s3_test.go b/get_s3_test.go
index 5517b37d2..4b51fd5c2 100644
--- a/get_s3_test.go
+++ b/get_s3_test.go
@@ -22,8 +22,12 @@ func TestS3Getter_impl(t *testing.T) {
 }
 
 func TestS3Getter(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping test that requires AWS credentials in short mode")
+	}
+
 	g := new(S3Getter)
-	dst := tempDir(t)
+	dst := t.TempDir()
 
 	// With a dir that doesn't exist
 	err := g.Get(
@@ -40,8 +44,12 @@ func TestS3Getter(t *testing.T) {
 }
 
 func TestS3Getter_subdir(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping test that requires AWS credentials in short mode")
+	}
+
 	g := new(S3Getter)
-	dst := tempDir(t)
+	dst := t.TempDir()
 
 	// With a dir that doesn't exist
 	err := g.Get(
@@ -58,9 +66,12 @@ func TestS3Getter_subdir(t *testing.T) {
 }
 
 func TestS3Getter_GetFile(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping test that requires AWS credentials in short mode")
+	}
+
 	g := new(S3Getter)
-	dst := tempTestFile(t)
-	defer func() { _ = os.RemoveAll(filepath.Dir(dst)) }()
+	dst := filepath.Join(t.TempDir(), "test-file")
 
 	// Download
 	err := g.GetFile(
@@ -77,9 +88,12 @@ func TestS3Getter_GetFile(t *testing.T) {
 }
 
 func TestS3Getter_GetFile_badParams(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping test that requires AWS credentials in short mode")
+	}
+
 	g := new(S3Getter)
-	dst := tempTestFile(t)
-	defer func() { _ = os.RemoveAll(filepath.Dir(dst)) }()
+	dst := filepath.Join(t.TempDir(), "test-file")
 
 	// Download
 	err := g.GetFile(
@@ -96,9 +110,12 @@ func TestS3Getter_GetFile_badParams(t *testing.T) {
 }
 
 func TestS3Getter_GetFile_notfound(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping test that requires AWS credentials in short mode")
+	}
+
 	g := new(S3Getter)
-	dst := tempTestFile(t)
-	defer func() { _ = os.RemoveAll(filepath.Dir(dst)) }()
+	dst := filepath.Join(t.TempDir(), "test-file")
 
 	// Download
 	err := g.GetFile(
@@ -109,6 +126,10 @@ func TestS3Getter_GetFile_notfound(t *testing.T) {
 }
 
 func TestS3Getter_ClientMode_dir(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping test that requires AWS credentials in short mode")
+	}
+
 	g := new(S3Getter)
 
 	// Check client mode on a key prefix with only a single key.
@@ -123,6 +144,10 @@ func TestS3Getter_ClientMode_dir(t *testing.T) {
 }
 
 func TestS3Getter_ClientMode_file(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping test that requires AWS credentials in short mode")
+	}
+
 	g := new(S3Getter)
 
 	// Check client mode on a key prefix which contains sub-keys.
@@ -137,6 +162,10 @@ func TestS3Getter_ClientMode_file(t *testing.T) {
 }
 
 func TestS3Getter_ClientMode_notfound(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping test that requires AWS credentials in short mode")
+	}
+
 	g := new(S3Getter)
 
 	// Check the client mode when a non-existent key is looked up. This does not
@@ -155,6 +184,10 @@ func TestS3Getter_ClientMode_notfound(t *testing.T) {
 }
 
 func TestS3Getter_ClientMode_collision(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping test that requires AWS credentials in short mode")
+	}
+
 	g := new(S3Getter)
 
 	// Check that the client mode is "file" if there is both an object and a
diff --git a/get_test.go b/get_test.go
index 9e15e2486..f712154c2 100644
--- a/get_test.go
+++ b/get_test.go
@@ -11,7 +11,7 @@ import (
 )
 
 func TestGet_badSchema(t *testing.T) {
-	dst := tempDir(t)
+	dst := filepath.Join(t.TempDir(), "target")
 	u := testModule("basic")
 	u = strings.ReplaceAll(u, "file", "nope")
 
@@ -21,7 +21,7 @@ func TestGet_badSchema(t *testing.T) {
 }
 
 func TestGet_file(t *testing.T) {
-	dst := tempDir(t)
+	dst := filepath.Join(t.TempDir(), "target")
 	u := testModule("basic")
 
 	if err := Get(dst, u); err != nil {
@@ -36,7 +36,7 @@ func TestGet_file(t *testing.T) {
 
 // https://github.com/hashicorp/terraform/issues/11438
 func TestGet_fileDecompressorExt(t *testing.T) {
-	dst := tempDir(t)
+	dst := filepath.Join(t.TempDir(), "target")
 	u := testModule("basic-tgz")
 
 	if err := Get(dst, u); err != nil {
@@ -51,7 +51,7 @@ func TestGet_fileDecompressorExt(t *testing.T) {
 
 // https://github.com/hashicorp/terraform/issues/8418
 func TestGet_filePercent2F(t *testing.T) {
-	dst := tempDir(t)
+	dst := filepath.Join(t.TempDir(), "target")
 	u := testModule("basic%2Ftest")
 
 	if err := Get(dst, u); err != nil {
@@ -65,7 +65,7 @@ func TestGet_filePercent2F(t *testing.T) {
 }
 
 func TestGet_fileDetect(t *testing.T) {
-	dst := tempDir(t)
+	dst := filepath.Join(t.TempDir(), "target")
 	u := filepath.Join(".", "testdata", "basic")
 	pwd, err := os.Getwd()
 	if err != nil {
@@ -94,7 +94,7 @@ func TestGet_fileDetect(t *testing.T) {
 }
 
 func TestGet_fileForced(t *testing.T) {
-	dst := tempDir(t)
+	dst := filepath.Join(t.TempDir(), "target")
 	u := testModule("basic")
 	u = "file::" + u
 
@@ -109,7 +109,7 @@ func TestGet_fileForced(t *testing.T) {
 }
 
 func TestGet_fileSubdir(t *testing.T) {
-	dst := tempDir(t)
+	dst := filepath.Join(t.TempDir(), "target")
 	u := testModule("basic//subdir")
 
 	if err := Get(dst, u); err != nil {
@@ -123,7 +123,7 @@ func TestGet_fileSubdir(t *testing.T) {
 }
 
 func TestGet_archive(t *testing.T) {
-	dst := tempDir(t)
+	dst := filepath.Join(t.TempDir(), "target")
 	u := filepath.Join("./testdata", "archive.tar.gz")
 	u, _ = filepath.Abs(u)
 
@@ -138,7 +138,7 @@ func TestGet_archive(t *testing.T) {
 }
 
 func TestGetAny_archive(t *testing.T) {
-	dst := tempDir(t)
+	dst := filepath.Join(t.TempDir(), "target")
 	u := filepath.Join("./testdata", "archive.tar.gz")
 	u, _ = filepath.Abs(u)
 
@@ -153,7 +153,7 @@ func TestGetAny_archive(t *testing.T) {
 }
 
 func TestGet_archiveRooted(t *testing.T) {
-	dst := tempDir(t)
+	dst := filepath.Join(t.TempDir(), "target")
 	u := testModule("archive-rooted/archive.tar.gz")
 	if err := Get(dst, u); err != nil {
 		t.Fatalf("err: %s", err)
@@ -166,7 +166,7 @@ func TestGet_archiveRooted(t *testing.T) {
 }
 
 func TestGet_archiveSubdirWild(t *testing.T) {
-	dst := tempDir(t)
+	dst := filepath.Join(t.TempDir(), "target")
 	u := testModule("archive-rooted/archive.tar.gz")
 	u += "//*"
 	if err := Get(dst, u); err != nil {
@@ -180,7 +180,7 @@ func TestGet_archiveSubdirWild(t *testing.T) {
 }
 
 func TestGet_archiveSubdirWildMultiMatch(t *testing.T) {
-	dst := tempDir(t)
+	dst := filepath.Join(t.TempDir(), "target")
 	u := testModule("archive-rooted-multi/archive.tar.gz")
 	u += "//*"
 	if err := Get(dst, u); err == nil {
@@ -191,7 +191,7 @@ func TestGet_archiveSubdirWildMultiMatch(t *testing.T) {
 }
 
 func TestGetAny_file(t *testing.T) {
-	dst := tempDir(t)
+	dst := filepath.Join(t.TempDir(), "target")
 	u := testModule("basic-file/foo.txt")
 
 	if err := GetAny(dst, u); err != nil {
@@ -205,7 +205,7 @@ func TestGetAny_file(t *testing.T) {
 }
 
 func TestGetAny_dir(t *testing.T) {
-	dst := tempDir(t)
+	dst := filepath.Join(t.TempDir(), "target")
 	u := filepath.Join("./testdata", "basic")
 	u, _ = filepath.Abs(u)
 
@@ -227,8 +227,7 @@ func TestGetAny_dir(t *testing.T) {
 }
 
 func TestGetFile(t *testing.T) {
-	dst := tempTestFile(t)
-	defer func() { _ = os.RemoveAll(filepath.Dir(dst)) }()
+	dst := filepath.Join(t.TempDir(), "test-file")
 	u := testModule("basic-file/foo.txt")
 
 	if err := GetFile(dst, u); err != nil {
@@ -240,8 +239,7 @@ func TestGetFile(t *testing.T) {
 }
 
 func TestGetFile_archive(t *testing.T) {
-	dst := tempTestFile(t)
-	defer func() { _ = os.RemoveAll(filepath.Dir(dst)) }()
+	dst := filepath.Join(t.TempDir(), "test-file")
 	u := testModule("basic-file-archive/archive.tar.gz")
 
 	if err := GetFile(dst, u); err != nil {
@@ -253,8 +251,7 @@ func TestGetFile_archive(t *testing.T) {
 }
 
 func TestGetFile_archiveChecksum(t *testing.T) {
-	dst := tempTestFile(t)
-	defer func() { _ = os.RemoveAll(filepath.Dir(dst)) }()
+	dst := filepath.Join(t.TempDir(), "test-file")
 	u := testModule(
 		"basic-file-archive/archive.tar.gz?checksum=md5:fbd90037dacc4b1ab40811d610dde2f0")
 
@@ -267,8 +264,7 @@ func TestGetFile_archiveChecksum(t *testing.T) {
 }
 
 func TestGetFile_archiveNoUnarchive(t *testing.T) {
-	dst := tempTestFile(t)
-	defer func() { _ = os.RemoveAll(filepath.Dir(dst)) }()
+	dst := filepath.Join(t.TempDir(), "test-file")
 	u := testModule("basic-file-archive/archive.tar.gz")
 	u += "?archive=false"
 
@@ -355,8 +351,7 @@ func TestGetFile_checksum(t *testing.T) {
 		u := testModule("basic-file/foo.txt") + tc.Append
 
 		func() {
-			dst := tempTestFile(t)
-			defer func() { _ = os.RemoveAll(filepath.Dir(dst)) }()
+			dst := filepath.Join(t.TempDir(), "test-file")
 			if err := GetFile(dst, u); (err != nil) != tc.Err {
 				t.Fatalf("append: %s\n\nerr: %s", tc.Append, err)
 			}
@@ -441,8 +436,7 @@ func TestGetFile_checksum_from_file(t *testing.T) {
 	for _, tc := range cases {
 		u := checksums + "/content.txt" + tc.Append
 		t.Run(tc.Append, func(t *testing.T) {
-			dst := tempTestFile(t)
-			defer func() { _ = os.RemoveAll(filepath.Dir(dst)) }()
+			dst := filepath.Join(t.TempDir(), "test-file")
 			if err := GetFile(dst, u); (err != nil) != tc.WantErr {
 				t.Fatalf("append: %s\n\nerr: %s", tc.Append, err)
 			}
@@ -456,8 +450,7 @@ func TestGetFile_checksum_from_file(t *testing.T) {
 }
 
 func TestGetFile_checksumURL(t *testing.T) {
-	dst := tempTestFile(t)
-	defer func() { _ = os.RemoveAll(filepath.Dir(dst)) }()
+	dst := filepath.Join(t.TempDir(), "test-file")
 	u := testModule("basic-file/foo.txt") + "?checksum=md5:09f7e02f1290be211da707a266f153b3"
 
 	getter := &MockGetter{Proxy: new(FileGetter)}
@@ -480,7 +473,7 @@ func TestGetFile_checksumURL(t *testing.T) {
 }
 
 func TestGetFile_filename(t *testing.T) {
-	dst := tempDir(t)
+	dst := filepath.Join(t.TempDir(), "target")
 	u := testModule("basic-file/foo.txt")
 
 	u += "?filename=bar.txt"
@@ -496,7 +489,7 @@ func TestGetFile_filename(t *testing.T) {
 }
 
 func TestGetFile_filename_path_traversal(t *testing.T) {
-	dst := tempDir(t)
+	dst := filepath.Join(t.TempDir(), "target")
 	u := testModule("basic-file/foo.txt")
 
 	u += "?filename=../../../../../../../../../../../../../tmp/bar.txt"
@@ -511,8 +504,7 @@ func TestGetFile_filename_path_traversal(t *testing.T) {
 }
 
 func TestGetFile_checksumSkip(t *testing.T) {
-	dst := tempTestFile(t)
-	defer func() { _ = os.RemoveAll(filepath.Dir(dst)) }()
+	dst := filepath.Join(t.TempDir(), "test-file")
 	u := testModule("basic-file/foo.txt") + "?checksum=md5:09f7e02f1290be211da707a266f153b3"
 
 	getter := &MockGetter{Proxy: new(FileGetter)}
diff --git a/go.mod b/go.mod
index 5ee2abffa..2a9caf755 100644
--- a/go.mod
+++ b/go.mod
@@ -57,4 +57,4 @@ require (
 	gopkg.in/cheggaaa/pb.v1 v1.0.27 // indirect
 )
 
-go 1.23.6
+go 1.24
diff --git a/module_test.go b/module_test.go
index 09f185e13..c6b92d8cb 100644
--- a/module_test.go
+++ b/module_test.go
@@ -4,7 +4,6 @@
 package getter
 
 import (
-	"io/ioutil"
 	"net/http"
 	"net/http/httptest"
 	"net/url"
@@ -18,23 +17,6 @@ import (
 
 const fixtureDir = "./testdata"
 
-func tempDir(t *testing.T) string {
-	dir, err := ioutil.TempDir("", "tf")
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-	if err := os.RemoveAll(dir); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	return dir
-}
-
-func tempTestFile(t *testing.T) string {
-	dir := tempDir(t)
-	return filepath.Join(dir, "foo")
-}
-
 func testModule(n string) string {
 	p := filepath.Join(fixtureDir, n)
 	p, err := filepath.Abs(p)
@@ -77,7 +59,7 @@ func testURL(s string) *url.URL {
 }
 
 func assertContents(t *testing.T, path string, contents string) {
-	data, err := ioutil.ReadFile(path)
+	data, err := os.ReadFile(path)
 	if err != nil {
 		t.Fatalf("err: %s", err)
 	}
diff --git a/source_test.go b/source_test.go
index 0b425cdb5..1b913463c 100644
--- a/source_test.go
+++ b/source_test.go
@@ -4,7 +4,6 @@
 package getter
 
 import (
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"testing"
@@ -57,11 +56,7 @@ func TestSourceDirSubdir(t *testing.T) {
 }
 
 func TestSourceSubdirGlob(t *testing.T) {
-	td, err := ioutil.TempDir("", "subdir-glob")
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer func() { _ = os.RemoveAll(td) }()
+	td := t.TempDir()
 
 	if err := os.Mkdir(filepath.Join(td, "subdir"), 0755); err != nil {
 		t.Fatal(err)
diff --git a/util_test.go b/util_test.go
index fbd5a40ec..76d36c91a 100644
--- a/util_test.go
+++ b/util_test.go
@@ -5,7 +5,6 @@ package getter
 
 import (
 	"io"
-	"io/ioutil"
 	"os"
 	"strings"
 	"testing"
@@ -32,7 +31,7 @@ func tempEnv(t *testing.T, k, v string) func() {
 // tempFileContents writes a temporary file and returns the path and a function
 // to clean it up.
 func tempFileContents(t *testing.T, contents string) (string, func()) {
-	tf, err := ioutil.TempFile("", "getter")
+	tf, err := os.CreateTemp("", "getter")
 	if err != nil {
 		t.Fatalf("err: %s", err)
 	}