diff --git a/exec.go b/exec.go
index ff8e8ee15..cd5a9d171 100644
--- a/exec.go
+++ b/exec.go
@@ -132,7 +132,7 @@ func getSubCgroupPaths(args []string) (map[string]string, error) {
 		// Split into controller:path.
 		if ctr, path, ok := strings.Cut(c, ":"); ok {
 			// There may be a few comma-separated controllers.
-			for _, ctrl := range strings.Split(ctr, ",") {
+			for ctrl := range strings.SplitSeq(ctr, ",") {
 				if ctrl == "" {
 					return nil, fmt.Errorf("invalid --cgroup argument: %s (empty <controller> prefix)", c)
 				}
diff --git a/libcontainer/configs/config.go b/libcontainer/configs/config.go
index 07216cb81..a0cdaec6a 100644
--- a/libcontainer/configs/config.go
+++ b/libcontainer/configs/config.go
@@ -325,7 +325,7 @@ func toCPUSet(str string) (*unix.CPUSet, error) {
 		return int(ret), nil
 	}
 
-	for _, r := range strings.Split(str, ",") {
+	for r := range strings.SplitSeq(str, ",") {
 		// Allow extra spaces around.
 		r = strings.TrimSpace(r)
 		// Allow empty elements (extra commas).
diff --git a/libcontainer/configs/config_test.go b/libcontainer/configs/config_test.go
index 644129941..70dcb7995 100644
--- a/libcontainer/configs/config_test.go
+++ b/libcontainer/configs/config_test.go
@@ -30,7 +30,7 @@ func TestUnmarshalHooks(t *testing.T) {
 
 	for _, hookName := range configs.HookNameList {
 		hooks := configs.Hooks{}
-		err = hooks.UnmarshalJSON([]byte(fmt.Sprintf(`{"%s" :[%s]}`, hookName, hookJson)))
+		err = hooks.UnmarshalJSON(fmt.Appendf(nil, `{"%s" :[%s]}`, hookName, hookJson))
 		if err != nil {
 			t.Fatal(err)
 		}
diff --git a/libcontainer/configs/tocpuset_test.go b/libcontainer/configs/tocpuset_test.go
index 43fb11bf8..8af2ab577 100644
--- a/libcontainer/configs/tocpuset_test.go
+++ b/libcontainer/configs/tocpuset_test.go
@@ -57,7 +57,6 @@ func TestToCPUSet(t *testing.T) {
 	}
 
 	for _, tc := range testCases {
-		tc := tc
 		t.Run(tc.in, func(t *testing.T) {
 			out, err := toCPUSet(tc.in)
 			t.Logf("toCPUSet(%q) = %v (error: %v)", tc.in, out, err)
diff --git a/libcontainer/configs/validate/rootless.go b/libcontainer/configs/validate/rootless.go
index 88cf1cd60..ef9c8e6f9 100644
--- a/libcontainer/configs/validate/rootless.go
+++ b/libcontainer/configs/validate/rootless.go
@@ -60,7 +60,7 @@ func rootlessEUIDMount(config *configs.Config) error {
 		if !strings.Contains(mount.Data, "id=") {
 			continue
 		}
-		for _, opt := range strings.Split(mount.Data, ",") {
+		for opt := range strings.SplitSeq(mount.Data, ",") {
 			if str, ok := strings.CutPrefix(opt, "uid="); ok {
 				uid, err := strconv.Atoi(str)
 				if err != nil {
diff --git a/libcontainer/configs/validate/rootless_test.go b/libcontainer/configs/validate/rootless_test.go
index 7b0887399..f725b541f 100644
--- a/libcontainer/configs/validate/rootless_test.go
+++ b/libcontainer/configs/validate/rootless_test.go
@@ -154,8 +154,7 @@ func BenchmarkRootlessEUIDMount(b *testing.B) {
 		},
 	}
 
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
+	for b.Loop() {
 		err := rootlessEUIDMount(config)
 		if err != nil {
 			b.Fatal(err)
diff --git a/libcontainer/configs/validate/validator_test.go b/libcontainer/configs/validate/validator_test.go
index 99e189c65..2dd47a198 100644
--- a/libcontainer/configs/validate/validator_test.go
+++ b/libcontainer/configs/validate/validator_test.go
@@ -774,7 +774,6 @@ func TestValidateIDMapMounts(t *testing.T) {
 	}
 
 	for _, tc := range testCases {
-		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			config := tc.config
 			config.Rootfs = "/var"
diff --git a/libcontainer/integration/bench_test.go b/libcontainer/integration/bench_test.go
index c10c57fda..0375ee7f7 100644
--- a/libcontainer/integration/bench_test.go
+++ b/libcontainer/integration/bench_test.go
@@ -34,8 +34,7 @@ func BenchmarkExecTrue(b *testing.B) {
 	}()
 	ok(b, err)
 
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
+	for b.Loop() {
 		exec := &libcontainer.Process{
 			Cwd:      "/",
 			Args:     []string{"/bin/true"},
@@ -101,8 +100,7 @@ func BenchmarkExecInBigEnv(b *testing.B) {
 		wantOut.WriteString(e + "\n")
 	}
 
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
+	for b.Loop() {
 		buffers := newStdBuffers()
 		exec := &libcontainer.Process{
 			Cwd:    "/",
diff --git a/libcontainer/integration/exec_test.go b/libcontainer/integration/exec_test.go
index 17312563b..f5a24777e 100644
--- a/libcontainer/integration/exec_test.go
+++ b/libcontainer/integration/exec_test.go
@@ -850,8 +850,8 @@ func TestMountCgroupRO(t *testing.T) {
 	buffers := runContainerOk(t, config, "mount")
 
 	mountInfo := buffers.Stdout.String()
-	lines := strings.Split(mountInfo, "\n")
-	for _, l := range lines {
+	lines := strings.SplitSeq(mountInfo, "\n")
+	for l := range lines {
 		if strings.HasPrefix(l, "tmpfs on /sys/fs/cgroup") {
 			if !strings.Contains(l, "ro") ||
 				!strings.Contains(l, "nosuid") ||
@@ -892,8 +892,8 @@ func TestMountCgroupRW(t *testing.T) {
 	buffers := runContainerOk(t, config, "mount")
 
 	mountInfo := buffers.Stdout.String()
-	lines := strings.Split(mountInfo, "\n")
-	for _, l := range lines {
+	lines := strings.SplitSeq(mountInfo, "\n")
+	for l := range lines {
 		if strings.HasPrefix(l, "tmpfs on /sys/fs/cgroup") {
 			if !strings.Contains(l, "rw") ||
 				!strings.Contains(l, "nosuid") ||
@@ -1206,8 +1206,8 @@ func TestRootfsPropagationSlaveMount(t *testing.T) {
 	dir2cont = filepath.Join(dir1cont, filepath.Base(dir2host))
 
 	propagationInfo := stdout2.String()
-	lines := strings.Split(propagationInfo, "\n")
-	for _, l := range lines {
+	lines := strings.SplitSeq(propagationInfo, "\n")
+	for l := range lines {
 		linefields := strings.Split(l, " ")
 		if len(linefields) < 5 {
 			continue
diff --git a/libcontainer/internal/userns/usernsfd_linux_test.go b/libcontainer/internal/userns/usernsfd_linux_test.go
index 23a3419fc..0065b7f83 100644
--- a/libcontainer/internal/userns/usernsfd_linux_test.go
+++ b/libcontainer/internal/userns/usernsfd_linux_test.go
@@ -42,7 +42,7 @@ func BenchmarkSpawnProc(b *testing.B) {
 		}
 	})
 
-	for i := 0; i < b.N; i++ {
+	for b.Loop() {
 		proc, err := spawnProc(mapping)
 		if err != nil {
 			b.Error(err)
diff --git a/libcontainer/rootfs_linux.go b/libcontainer/rootfs_linux.go
index fd9fdddcd..a7a72b8bb 100644
--- a/libcontainer/rootfs_linux.go
+++ b/libcontainer/rootfs_linux.go
@@ -354,7 +354,7 @@ func mountCgroupV1(m *configs.Mount, c *mountConfig) error {
 		}
 	}
 	for _, mc := range merged {
-		for _, ss := range strings.Split(mc, ",") {
+		for ss := range strings.SplitSeq(mc, ",") {
 			// symlink(2) is very dumb, it will just shove the path into
 			// the link and doesn't do any checks or relative path
 			// conversion. Also, don't error out if the cgroup already exists.
diff --git a/libcontainer/specconv/spec_linux_test.go b/libcontainer/specconv/spec_linux_test.go
index 772194962..4c3c47693 100644
--- a/libcontainer/specconv/spec_linux_test.go
+++ b/libcontainer/specconv/spec_linux_test.go
@@ -777,7 +777,6 @@ func TestInitSystemdProps(t *testing.T) {
 	spec := &specs.Spec{}
 
 	for _, tc := range testCases {
-		tc := tc
 		spec.Annotations = map[string]string{tc.in.name: tc.in.value}
 
 		outMap, err := initSystemdProps(spec)
@@ -834,7 +833,7 @@ func TestCheckPropertyName(t *testing.T) {
 }
 
 func BenchmarkCheckPropertyName(b *testing.B) {
-	for i := 0; i < b.N; i++ {
+	for b.Loop() {
 		for _, s := range []string{"", "xx", "xxx", "someValidName", "A name", "Кир", "მადლობა", "合い言葉"} {
 			_ = checkPropertyName(s)
 		}
diff --git a/libcontainer/system/kernelversion/kernel_linux_test.go b/libcontainer/system/kernelversion/kernel_linux_test.go
index a18f1f222..7a5df8421 100644
--- a/libcontainer/system/kernelversion/kernel_linux_test.go
+++ b/libcontainer/system/kernelversion/kernel_linux_test.go
@@ -67,7 +67,6 @@ func TestParseRelease(t *testing.T) {
 		{in: "3.-8", expectedErr: fmt.Errorf(`failed to parse kernel version "3.-8": expected integer`)},
 	}
 	for _, tc := range tests {
-		tc := tc
 		t.Run(tc.in, func(t *testing.T) {
 			version, err := parseRelease(tc.in)
 			if tc.expectedErr != nil {
@@ -126,7 +125,6 @@ func TestGreaterEqualThan(t *testing.T) {
 		},
 	}
 	for _, tc := range tests {
-		tc := tc
 		t.Run(tc.doc+": "+tc.in.String(), func(t *testing.T) {
 			ok, err := GreaterEqualThan(tc.in)
 			if err != nil {
diff --git a/notify_socket.go b/notify_socket.go
index a3aa8d2b2..afebf4e77 100644
--- a/notify_socket.go
+++ b/notify_socket.go
@@ -128,7 +128,7 @@ func (s *notifySocket) run(pid1 int) error {
 			got := buf[0:r]
 			// systemd-ready sends a single datagram with the state string as payload,
 			// so we don't need to worry about partial messages.
-			for _, line := range bytes.Split(got, []byte{'\n'}) {
+			for line := range bytes.SplitSeq(got, []byte{'\n'}) {
 				if bytes.HasPrefix(got, []byte("READY=")) {
 					fileChan <- line
 					return