diff --git a/cmd/spinifex/cmd/admin.go b/cmd/spinifex/cmd/admin.go
index d37fbb1e8..62c21092f 100644
--- a/cmd/spinifex/cmd/admin.go
+++ b/cmd/spinifex/cmd/admin.go
@@ -3499,11 +3499,11 @@ func resolvePublicPoolFlags(source, poolRange, bindBridge, gateway, defaultBindB
 		if gateway == "" {
 			return "", "", "", "", fmt.Errorf("--external-gateway is required with --external-source=static")
 		}
-		parts := strings.SplitN(poolRange, "-", 2)
-		if len(parts) != 2 || net.ParseIP(parts[0]) == nil || net.ParseIP(parts[1]) == nil {
+		var ok bool
+		start, end, ok = strings.Cut(poolRange, "-")
+		if !ok || net.ParseIP(start) == nil || net.ParseIP(end) == nil {
 			return "", "", "", "", fmt.Errorf("--external-pool must be start-end IPs (e.g., 192.168.1.150-192.168.1.250), got: %s", poolRange)
 		}
-		start, end = parts[0], parts[1]
 	default:
 		return "", "", "", "", fmt.Errorf("--external-source must be 'static' or 'dhcp', got: %s", source)
 	}
diff --git a/cmd/spinifex/cmd/admin_ochre.go b/cmd/spinifex/cmd/admin_ochre.go
index 131c18681..1c466ea43 100644
--- a/cmd/spinifex/cmd/admin_ochre.go
+++ b/cmd/spinifex/cmd/admin_ochre.go
@@ -438,14 +438,10 @@ func parseWeightsS3URI(uri string) (bucket, prefix string, err error) {
 	if trimmed == uri {
 		return "", "", fmt.Errorf("invalid --s3-uri %q: expected s3://bucket/prefix", uri)
 	}
-	parts := strings.SplitN(trimmed, "/", 2)
-	bucket = parts[0]
+	bucket, prefix, _ = strings.Cut(trimmed, "/")
 	if bucket == "" {
 		return "", "", fmt.Errorf("invalid --s3-uri %q: missing bucket", uri)
 	}
-	if len(parts) == 2 {
-		prefix = parts[1]
-	}
 	if prefix != "" && !strings.HasSuffix(prefix, "/") {
 		prefix += "/"
 	}
diff --git a/internal/awsmodel/error.go b/internal/awsmodel/error.go
index 1f975b78d..16f974467 100644
--- a/internal/awsmodel/error.go
+++ b/internal/awsmodel/error.go
@@ -114,9 +114,7 @@ func (m *Model) decodeErrorCode(body []byte) (string, error) {
 		if separator := strings.LastIndex(code, "#"); separator >= 0 {
 			code = code[separator+1:]
 		}
-		if separator := strings.Index(code, ":"); separator >= 0 {
-			code = code[:separator]
-		}
+		code, _, _ = strings.Cut(code, ":")
 		if code == "" {
 			return "", fmt.Errorf("JSON error envelope has no code")
 		}
diff --git a/internal/awsmodel/verdict.go b/internal/awsmodel/verdict.go
index 7a7b593cb..35ac214a2 100644
--- a/internal/awsmodel/verdict.go
+++ b/internal/awsmodel/verdict.go
@@ -135,9 +135,7 @@ func DecodeRequestResult(service Service, status int, header http.Header, body [
 }
 
 func trimErrorCode(code string) string {
-	if separator := strings.Index(code, ":"); separator >= 0 {
-		code = code[:separator]
-	}
+	code, _, _ = strings.Cut(code, ":")
 	if separator := strings.LastIndex(code, "#"); separator >= 0 {
 		code = code[separator+1:]
 	}
diff --git a/internal/ecrauth/ecrauth.go b/internal/ecrauth/ecrauth.go
index bfd58fc79..e0828890d 100644
--- a/internal/ecrauth/ecrauth.go
+++ b/internal/ecrauth/ecrauth.go
@@ -109,11 +109,9 @@ func GatewayHTTPClient(caPath string) (*http.Client, error) {
 // HostFromImage returns the host[:port] portion of an image ref or URL. It strips
 // any scheme and trims at the first path separator.
 func HostFromImage(image string) string {
-	if i := strings.Index(image, "://"); i >= 0 {
-		image = image[i+3:]
+	if _, rest, ok := strings.Cut(image, "://"); ok {
+		image = rest
 	}
-	if i := strings.IndexByte(image, '/'); i >= 0 {
-		image = image[:i]
-	}
-	return image
+	host, _, _ := strings.Cut(image, "/")
+	return host
 }
diff --git a/spinifex/migrate/version_readers.go b/spinifex/migrate/version_readers.go
index 1dc388144..748b6ad4e 100644
--- a/spinifex/migrate/version_readers.go
+++ b/spinifex/migrate/version_readers.go
@@ -42,9 +42,7 @@ func (r *TOMLVersionReader) ReadVersion(path string) (int, error) {
 	}
 
 	// Handle "1.0" style — take the integer part before the dot.
-	if idx := strings.Index(raw, "."); idx >= 0 {
-		raw = raw[:idx]
-	}
+	raw, _, _ = strings.Cut(raw, ".")
 
 	v, err := strconv.Atoi(raw)
 	if err != nil {
diff --git a/tests/e2e/harness/discover.go b/tests/e2e/harness/discover.go
index 02c7b5bde..f5d8f5250 100644
--- a/tests/e2e/harness/discover.go
+++ b/tests/e2e/harness/discover.go
@@ -65,11 +65,11 @@ func DiscoverNanoInstanceType(t *testing.T, fx *Fixture) (instanceType, arch str
 	if err != nil {
 		t.Fatalf("DiscoverNanoInstanceType: %v", err)
 	}
-	parts := strings.SplitN(combined, "|", 2)
-	if len(parts) != 2 {
+	instanceType, arch, ok := strings.Cut(combined, "|")
+	if !ok {
 		t.Fatalf("DiscoverNanoInstanceType: malformed memo value %q", combined)
 	}
-	return parts[0], parts[1]
+	return instanceType, arch
 }
 
 // DiscoverUbuntuAMI returns the AMI ID for the architecture-appropriate Ubuntu