all: apply consistent imports of "json" packagesdsnet/jsonimports-ci

This runs:

        go run ./cmd/jsonimports -update -ignore=tempfork/

which applies the following rules:

  * Until the Go standard library formally accepts "encoding/json/v2"
    and "encoding/json/jsontext" into the standard library
    (i.e., they are no longer considered experimental),
    we forbid any code from directly importing those packages.
    Go code should instead import "github.com/go-json-experiment/json"
    and "github.com/go-json-experiment/json/jsontext".
    The latter packages contain aliases to the standard library
    if built on Go 1.25 with the goexperiment.jsonv2 tag specified.

  * Imports of "encoding/json" or "github.com/go-json-experiment/json/v1"
    must be explicitly imported under the package name "jsonv1".
    If both packages need to be imported, then
    the former should be imported under the package name "jsonv1std".

  * Imports of "github.com/go-json-experiment/json"
    must be explicitly imported under the package name "jsonv2".

The latter two rules exist to provide clarity when reading code.
Without them, it is unclear whether "json.Marshal" refers to v1 or v2.
With them, however, it is clear that "jsonv1.Marshal" is calling v1 and
that "jsonv2.Marshal" is calling v2.

Updates tailscale/corp#791

Signed-off-by: Joe Tsai <joetsai@digital-static.net>

71 files changed, 316 insertions, 288 deletions

diff --git a/cmd/connector-gen/aws.go b/cmd/connector-gen/aws.go
index bd2632ae2..eb71f22b5 100644
--- a/cmd/connector-gen/aws.go
+++ b/cmd/connector-gen/aws.go
@@ -4,7 +4,7 @@
 package main
 
 import (
-	"encoding/json"
+	jsonv1 "encoding/json"
 	"fmt"
 	"log"
 	"net/http"
@@ -40,7 +40,7 @@ func aws() {
 	defer r.Body.Close()
 
 	var aws AWSMeta
-	if err := json.NewDecoder(r.Body).Decode(&aws); err != nil {
+	if err := jsonv1.NewDecoder(r.Body).Decode(&aws); err != nil {
 		log.Fatal(err)
 	}
 
diff --git a/cmd/connector-gen/github.go b/cmd/connector-gen/github.go
index def40872d..50064d637 100644
--- a/cmd/connector-gen/github.go
+++ b/cmd/connector-gen/github.go
@@ -4,7 +4,7 @@
 package main
 
 import (
-	"encoding/json"
+	jsonv1 "encoding/json"
 	"fmt"
 	"log"
 	"net/http"
@@ -51,7 +51,7 @@ func github() {
 
 	var ghm GithubMeta
 
-	if err := json.NewDecoder(r.Body).Decode(&ghm); err != nil {
+	if err := jsonv1.NewDecoder(r.Body).Decode(&ghm); err != nil {
 		log.Fatal(err)
 	}
 	r.Body.Close()
diff --git a/cmd/containerboot/egressservices.go b/cmd/containerboot/egressservices.go
index fe835a69e..2af4f629d 100644
--- a/cmd/containerboot/egressservices.go
+++ b/cmd/containerboot/egressservices.go
@@ -7,7 +7,7 @@ package main
 
 import (
 	"context"
-	"encoding/json"
+	jsonv1 "encoding/json"
 	"errors"
 	"fmt"
 	"log"
@@ -393,7 +393,7 @@ func (ep *egressProxy) getConfigs() (*egressservices.Configs, error) {
 		return nil, nil
 	}
 	cfg := &egressservices.Configs{}
-	if err := json.Unmarshal(j, &cfg); err != nil {
+	if err := jsonv1.Unmarshal(j, &cfg); err != nil {
 		return nil, err
 	}
 	return cfg, nil
@@ -413,7 +413,7 @@ func (ep *egressProxy) getStatus(ctx context.Context) (*egressservices.Status, e
 	if !ok {
 		return nil, nil
 	}
-	if err := json.Unmarshal([]byte(raw), status); err != nil {
+	if err := jsonv1.Unmarshal([]byte(raw), status); err != nil {
 		return nil, fmt.Errorf("error unmarshalling previous config: %w", err)
 	}
 	if reflect.DeepEqual(status.PodIPv4, ep.podIPv4) {
@@ -434,7 +434,7 @@ func (ep *egressProxy) setStatus(ctx context.Context, status *egressservices.Sta
 	if err != nil {
 		return fmt.Errorf("error retrieving state Secret: %w", err)
 	}
-	bs, err := json.Marshal(status)
+	bs, err := jsonv1.Marshal(status)
 	if err != nil {
 		return fmt.Errorf("error marshalling service config: %w", err)
 	}
diff --git a/cmd/containerboot/ingressservices.go b/cmd/containerboot/ingressservices.go
index 1a2da9567..7c9801fd1 100644
--- a/cmd/containerboot/ingressservices.go
+++ b/cmd/containerboot/ingressservices.go
@@ -7,7 +7,7 @@ package main
 
 import (
 	"context"
-	"encoding/json"
+	jsonv1 "encoding/json"
 	"fmt"
 	"log"
 	"net/netip"
@@ -131,7 +131,7 @@ func (p *ingressProxy) getConfigs() (*ingressservices.Configs, error) {
 		return nil, nil
 	}
 	cfg := &ingressservices.Configs{}
-	if err := json.Unmarshal(j, &cfg); err != nil {
+	if err := jsonv1.Unmarshal(j, &cfg); err != nil {
 		return nil, err
 	}
 	return cfg, nil
@@ -152,7 +152,7 @@ func (p *ingressProxy) getStatus(ctx context.Context) (*ingressservices.Status,
 	if !ok {
 		return nil, nil
 	}
-	if err := json.Unmarshal([]byte(raw), status); err != nil {
+	if err := jsonv1.Unmarshal([]byte(raw), status); err != nil {
 		return nil, fmt.Errorf("error unmarshalling previous config: %w", err)
 	}
 	return status, nil
@@ -189,7 +189,7 @@ func (p *ingressProxy) recordStatus(ctx context.Context, newCfg *ingressservices
 	if err != nil {
 		return fmt.Errorf("error retrieving state Secret: %w", err)
 	}
-	bs, err := json.Marshal(status)
+	bs, err := jsonv1.Marshal(status)
 	if err != nil {
 		return fmt.Errorf("error marshalling status: %w", err)
 	}
diff --git a/cmd/containerboot/kube.go b/cmd/containerboot/kube.go
index e566fa483..20e14a28d 100644
--- a/cmd/containerboot/kube.go
+++ b/cmd/containerboot/kube.go
@@ -7,7 +7,7 @@ package main
 
 import (
 	"context"
-	"encoding/json"
+	jsonv1 "encoding/json"
 	"errors"
 	"fmt"
 	"log"
@@ -73,7 +73,7 @@ func (kc *kubeClient) storeDeviceEndpoints(ctx context.Context, fqdn string, add
 	for _, addr := range addresses {
 		ips = append(ips, addr.Addr().String())
 	}
-	deviceIPs, err := json.Marshal(ips)
+	deviceIPs, err := jsonv1.Marshal(ips)
 	if err != nil {
 		return err
 	}
diff --git a/cmd/containerboot/main_test.go b/cmd/containerboot/main_test.go
index 96feef682..9beac7da9 100644
--- a/cmd/containerboot/main_test.go
+++ b/cmd/containerboot/main_test.go
@@ -9,7 +9,7 @@ import (
 	"bytes"
 	_ "embed"
 	"encoding/base64"
-	"encoding/json"
+	jsonv1 "encoding/json"
 	"encoding/pem"
 	"errors"
 	"fmt"
@@ -1347,7 +1347,7 @@ func (l *localAPI) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	if f, ok := w.(http.Flusher); ok {
 		f.Flush()
 	}
-	enc := json.NewEncoder(w)
+	enc := jsonv1.NewEncoder(w)
 	l.Lock()
 	defer l.Unlock()
 	for {
@@ -1456,7 +1456,7 @@ func (k *kubeServer) serveSSAR(w http.ResponseWriter, r *http.Request) {
 			} `json:"resourceAttributes"`
 		} `json:"spec"`
 	}
-	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+	if err := jsonv1.NewDecoder(r.Body).Decode(&req); err != nil {
 		panic(fmt.Sprintf("decoding SSAR request: %v", err))
 	}
 	ok := true
@@ -1490,7 +1490,7 @@ func (k *kubeServer) serveSecret(w http.ResponseWriter, r *http.Request) {
 			v := base64.StdEncoding.EncodeToString([]byte(v))
 			ret["data"][k] = v
 		}
-		if err := json.NewEncoder(w).Encode(ret); err != nil {
+		if err := jsonv1.NewEncoder(w).Encode(ret); err != nil {
 			panic("encode failed")
 		}
 	case "PATCH":
@@ -1502,7 +1502,7 @@ func (k *kubeServer) serveSecret(w http.ResponseWriter, r *http.Request) {
 		switch r.Header.Get("Content-Type") {
 		case "application/json-patch+json":
 			req := []kubeclient.JSONPatch{}
-			if err := json.Unmarshal(bs, &req); err != nil {
+			if err := jsonv1.Unmarshal(bs, &req); err != nil {
 				panic(fmt.Sprintf("json decode failed: %v. Body:\n\n%s", err, string(bs)))
 			}
 			for _, op := range req {
@@ -1534,7 +1534,7 @@ func (k *kubeServer) serveSecret(w http.ResponseWriter, r *http.Request) {
 			req := struct {
 				Data map[string][]byte `json:"data"`
 			}{}
-			if err := json.Unmarshal(bs, &req); err != nil {
+			if err := jsonv1.Unmarshal(bs, &req); err != nil {
 				panic(fmt.Sprintf("json decode failed: %v. Body:\n\n%s", err, string(bs)))
 			}
 			for key, val := range req.Data {
@@ -1555,7 +1555,7 @@ func mustBase64(t *testing.T, v any) string {
 }
 
 func mustJSON(t *testing.T, v any) []byte {
-	b, err := json.Marshal(v)
+	b, err := jsonv1.Marshal(v)
 	if err != nil {
 		t.Fatalf("error converting %v to json: %v", v, err)
 	}
diff --git a/cmd/containerboot/serve.go b/cmd/containerboot/serve.go
index 5fa8e580d..0d94fd56c 100644
--- a/cmd/containerboot/serve.go
+++ b/cmd/containerboot/serve.go
@@ -8,7 +8,7 @@ package main
 import (
 	"bytes"
 	"context"
-	"encoding/json"
+	jsonv1 "encoding/json"
 	"log"
 	"os"
 	"path/filepath"
@@ -164,7 +164,7 @@ func readServeConfig(path, certDomain string) (*ipn.ServeConfig, error) {
 	}
 	j = bytes.ReplaceAll(j, []byte("${TS_CERT_DOMAIN}"), []byte(certDomain))
 	var sc ipn.ServeConfig
-	if err := json.Unmarshal(j, &sc); err != nil {
+	if err := jsonv1.Unmarshal(j, &sc); err != nil {
 		return nil, err
 	}
 	return &sc, nil
diff --git a/cmd/derper/bootstrap_dns.go b/cmd/derper/bootstrap_dns.go
index a58f040ba..db7af42b4 100644
--- a/cmd/derper/bootstrap_dns.go
+++ b/cmd/derper/bootstrap_dns.go
@@ -6,7 +6,7 @@ package main
 import (
 	"context"
 	"encoding/binary"
-	"encoding/json"
+	jsonv1 "encoding/json"
 	"expvar"
 	"log"
 	"math/rand/v2"
@@ -75,7 +75,7 @@ func refreshBootstrapDNS() {
 	for _, vv := range dnsEntries.IPs {
 		slicesx.Shuffle(vv)
 	}
-	j, err := json.MarshalIndent(dnsEntries.IPs, "", "\t")
+	j, err := jsonv1.MarshalIndent(dnsEntries.IPs, "", "\t")
 	if err != nil {
 		// leave the old values in place
 		return
@@ -156,7 +156,7 @@ func handleBootstrapDNS(w http.ResponseWriter, r *http.Request) {
 			if remoteAddrMatchesPercent(r.RemoteAddr, percent) {
 				// Only return the specific query, not everything.
 				m := map[string][]net.IP{q: m.IPs[q]}
-				j, err := json.MarshalIndent(m, "", "\t")
+				j, err := jsonv1.MarshalIndent(m, "", "\t")
 				if err == nil {
 					w.Write(j)
 					return
diff --git a/cmd/derper/bootstrap_dns_test.go b/cmd/derper/bootstrap_dns_test.go
index 9b99103ab..ae70c2298 100644
--- a/cmd/derper/bootstrap_dns_test.go
+++ b/cmd/derper/bootstrap_dns_test.go
@@ -5,7 +5,7 @@ package main
 
 import (
 	"bytes"
-	"encoding/json"
+	jsonv1 "encoding/json"
 	"io"
 	"net"
 	"net/http"
@@ -53,7 +53,7 @@ func getBootstrapDNS(t *testing.T, q string) map[string][]net.IP {
 	}
 	var m map[string][]net.IP
 	var buf bytes.Buffer
-	if err := json.NewDecoder(io.TeeReader(res.Body, &buf)).Decode(&m); err != nil {
+	if err := jsonv1.NewDecoder(io.TeeReader(res.Body, &buf)).Decode(&m); err != nil {
 		t.Fatalf("error decoding response body %q: %v", buf.Bytes(), err)
 	}
 	return m
diff --git a/cmd/derper/cert.go b/cmd/derper/cert.go
index b95755c64..b0e583adb 100644
--- a/cmd/derper/cert.go
+++ b/cmd/derper/cert.go
@@ -11,7 +11,7 @@ import (
 	"crypto/tls"
 	"crypto/x509"
 	"crypto/x509/pkix"
-	"encoding/json"
+	jsonv1 "encoding/json"
 	"encoding/pem"
 	"errors"
 	"fmt"
@@ -107,7 +107,7 @@ func NewManualCertManager(certdir, hostname string) (certProvider, error) {
 			HostName: hostname,
 			CertName: fmt.Sprintf("sha256-raw:%-02x", sha256.Sum256(x509Cert.Raw)),
 		}
-		dnJSON, _ := json.Marshal(dn)
+		dnJSON, _ := jsonv1.Marshal(dn)
 		log.Printf("Using self-signed certificate for IP address %q. Configure it in DERPMap using: (https://tailscale.com/s/custom-derp)\n  %s", hostname, dnJSON)
 	}
 	return &manualCertManager{
diff --git a/cmd/derper/derper.go b/cmd/derper/derper.go
index 857d7def3..3582c2584 100644
--- a/cmd/derper/derper.go
+++ b/cmd/derper/derper.go
@@ -14,7 +14,7 @@ import (
 	"cmp"
 	"context"
 	"crypto/tls"
-	"encoding/json"
+	jsonv1 "encoding/json"
 	"errors"
 	"expvar"
 	"flag"
@@ -133,7 +133,7 @@ func loadConfig() config {
 		panic("unreachable")
 	default:
 		var cfg config
-		if err := json.Unmarshal(b, &cfg); err != nil {
+		if err := jsonv1.Unmarshal(b, &cfg); err != nil {
 			log.Fatalf("derper: config: %v", err)
 		}
 		return cfg
@@ -148,7 +148,7 @@ func writeNewConfig() config {
 	cfg := config{
 		PrivateKey: k,
 	}
-	b, err := json.MarshalIndent(cfg, "", "\t")
+	b, err := jsonv1.MarshalIndent(cfg, "", "\t")
 	if err != nil {
 		log.Fatal(err)
 	}
diff --git a/cmd/gitops-pusher/cache.go b/cmd/gitops-pusher/cache.go
index 6792e5e63..681541738 100644
--- a/cmd/gitops-pusher/cache.go
+++ b/cmd/gitops-pusher/cache.go
@@ -4,7 +4,7 @@
 package main
 
 import (
-	"encoding/json"
+	jsonv1 "encoding/json"
 	"os"
 )
 
@@ -38,7 +38,7 @@ func (c *Cache) Save(fname string) error {
 	}
 	defer fout.Close()
 
-	return json.NewEncoder(fout).Encode(c)
+	return jsonv1.NewEncoder(fout).Encode(c)
 }
 
 // LoadCache loads the cache from a given file.
@@ -51,7 +51,7 @@ func LoadCache(fname string) (*Cache, error) {
 	}
 	defer fin.Close()
 
-	err = json.NewDecoder(fin).Decode(&result)
+	err = jsonv1.NewDecoder(fin).Decode(&result)
 	if err != nil {
 		return nil, err
 	}
diff --git a/cmd/gitops-pusher/gitops-pusher.go b/cmd/gitops-pusher/gitops-pusher.go
index 690ca2870..8a6059626 100644
--- a/cmd/gitops-pusher/gitops-pusher.go
+++ b/cmd/gitops-pusher/gitops-pusher.go
@@ -10,7 +10,7 @@ import (
 	"bytes"
 	"context"
 	"crypto/sha256"
-	"encoding/json"
+	jsonv1 "encoding/json"
 	"flag"
 	"fmt"
 	"io"
@@ -288,7 +288,7 @@ func applyNewACL(ctx context.Context, client *http.Client, tailnet, apiKey, poli
 	want := http.StatusOK
 	if got != want {
 		var ate ACLGitopsTestError
-		err := json.NewDecoder(resp.Body).Decode(&ate)
+		err := jsonv1.NewDecoder(resp.Body).Decode(&ate)
 		if err != nil {
 			return err
 		}
@@ -324,7 +324,7 @@ func testNewACLs(ctx context.Context, client *http.Client, tailnet, apiKey, poli
 	defer resp.Body.Close()
 
 	var ate ACLGitopsTestError
-	err = json.NewDecoder(resp.Body).Decode(&ate)
+	err = jsonv1.NewDecoder(resp.Body).Decode(&ate)
 	if err != nil {
 		return err
 	}
diff --git a/cmd/gitops-pusher/gitops-pusher_test.go b/cmd/gitops-pusher/gitops-pusher_test.go
index e08b06c9c..72453ee05 100644
--- a/cmd/gitops-pusher/gitops-pusher_test.go
+++ b/cmd/gitops-pusher/gitops-pusher_test.go
@@ -4,7 +4,7 @@
 package main
 
 import (
-	"encoding/json"
+	jsonv1 "encoding/json"
 	"strings"
 	"testing"
 
@@ -31,9 +31,9 @@ func TestEmbeddedTypeUnmarshal(t *testing.T) {
 	}
 
 	t.Run("unmarshal gitops type from acl type", func(t *testing.T) {
-		b, _ := json.Marshal(aclTestErr)
+		b, _ := jsonv1.Marshal(aclTestErr)
 		var e ACLGitopsTestError
-		err := json.Unmarshal(b, &e)
+		err := jsonv1.Unmarshal(b, &e)
 		if err != nil {
 			t.Fatal(err)
 		}
@@ -42,9 +42,9 @@ func TestEmbeddedTypeUnmarshal(t *testing.T) {
 		}
 	})
 	t.Run("unmarshal acl type from gitops type", func(t *testing.T) {
-		b, _ := json.Marshal(gitopsErr)
+		b, _ := jsonv1.Marshal(gitopsErr)
 		var e tailscale.ACLTestError
-		err := json.Unmarshal(b, &e)
+		err := jsonv1.Unmarshal(b, &e)
 		if err != nil {
 			t.Fatal(err)
 		}
diff --git a/cmd/hello/hello.go b/cmd/hello/hello.go
index fa116b28b..4256c9786 100644
--- a/cmd/hello/hello.go
+++ b/cmd/hello/hello.go
@@ -8,7 +8,7 @@ import (
 	"context"
 	"crypto/tls"
 	_ "embed"
-	"encoding/json"
+	jsonv1 "encoding/json"
 	"errors"
 	"flag"
 	"html/template"
@@ -41,7 +41,7 @@ func main() {
 		if err != nil {
 			log.Fatal(err)
 		}
-		e := json.NewEncoder(os.Stdout)
+		e := jsonv1.NewEncoder(os.Stdout)
 		e.SetIndent("", "\t")
 		e.Encode(res)
 		return
diff --git a/cmd/jsonimports/format.go b/cmd/jsonimports/format.go
index 6dbd17558..b29859fcf 100644
--- a/cmd/jsonimports/format.go
+++ b/cmd/jsonimports/format.go
@@ -43,7 +43,9 @@ func mustFormatFile(in []byte) (out []byte) {
 			"github.com/go-json-experiment/json",
 			"github.com/go-json-experiment/json/v1",
 			"github.com/go-json-experiment/json/jsontext":
-			jsonImports[pkgPath] = append(jsonImports[pkgPath], imp)
+			if imp.Name.String() != "_" {
+				jsonImports[pkgPath] = append(jsonImports[pkgPath], imp)
+			}
 		}
 	}
 	if len(jsonImports) == 0 {
diff --git a/cmd/jsonimports/jsonimports.go b/cmd/jsonimports/jsonimports.go
index 4be2e10cb..8307ba195 100644
--- a/cmd/jsonimports/jsonimports.go
+++ b/cmd/jsonimports/jsonimports.go
@@ -60,8 +60,23 @@ import (
 	"tailscale.com/util/safediff"
 )
 
+type ignoreList []string
+
+func (s *ignoreList) String() string {
+	return strings.Join(*s, ",")
+}
+
+func (s *ignoreList) Set(value string) error {
+	for v := range strings.SplitSeq(value, ",") {
+		*s = append(*s, strings.TrimSpace(v))
+	}
+	return nil
+}
+
 func main() {
+	var ignore ignoreList
 	update := flag.Bool("update", false, "update all Go source files")
+	flag.Var(&ignore, "ignore", "files and directories to ignore (may be repeated)")
 	flag.Parse()
 
 	// Change working directory to Git repository root.
@@ -87,6 +102,13 @@ func main() {
 				return
 			}
 
+			// Ignore files that match the ignore prefixes.
+			for _, prefix := range ignore {
+				if strings.HasPrefix(file, prefix) {
+					return
+				}
+			}
+
 			// Format all "json" imports in the Go source file.
 			srcIn := must.Get(os.ReadFile(file))
 			srcOut := mustFormatFile(srcIn)
@@ -118,7 +140,11 @@ func main() {
 	if numDiffs > 0 && !*update {
 		fmt.Printf(`%d files with "json" imports that need formatting`+"\n", numDiffs)
 		fmt.Println("Please run:")
-		fmt.Println("\t./tool/go run tailscale.com/cmd/jsonimports -update")
+		var ignoreFlags string
+		for _, path := range ignore {
+			ignoreFlags += " -ignore=" + path
+		}
+		fmt.Println("\t./tool/go run tailscale.com/cmd/jsonimports -update" + ignoreFlags)
 		os.Exit(1)
 	}
 }
diff --git a/cmd/k8s-nameserver/main.go b/cmd/k8s-nameserver/main.go
index 84e65452d..1d886dd77 100644
--- a/cmd/k8s-nameserver/main.go
+++ b/cmd/k8s-nameserver/main.go
@@ -10,7 +10,7 @@ package main
 
 import (
 	"context"
-	"encoding/json"
+	jsonv1 "encoding/json"
 	"fmt"
 	"log"
 	"net"
@@ -240,7 +240,7 @@ func (n *nameserver) resetRecords() error {
 		return nil
 	}
 	dnsCfg := &operatorutils.Records{}
-	err = json.Unmarshal(dnsCfgBytes, dnsCfg)
+	err = jsonv1.Unmarshal(dnsCfgBytes, dnsCfg)
 	if err != nil {
 		return fmt.Errorf("error unmarshalling nameserver configuration: %v\n", err)
 	}
diff --git a/cmd/k8s-operator/api-server-proxy-pg.go b/cmd/k8s-operator/api-server-proxy-pg.go
index 252859eb3..52abedf5b 100644
--- a/cmd/k8s-operator/api-server-proxy-pg.go
+++ b/cmd/k8s-operator/api-server-proxy-pg.go
@@ -7,7 +7,7 @@ package main
 
 import (
 	"context"
-	"encoding/json"
+	jsonv1 "encoding/json"
 	"errors"
 	"fmt"
 	"maps"
@@ -392,7 +392,7 @@ func (r *KubeAPIServerTSServiceReconciler) maybeAdvertiseServices(ctx context.Co
 		}
 
 		// Update the config Secret.
-		cfgB, err := json.Marshal(conf.VersionedConfig{
+		cfgB, err := jsonv1.Marshal(conf.VersionedConfig{
 			Version:        "v1alpha1",
 			ConfigV1Alpha1: &cfg.Parsed,
 		})
@@ -437,7 +437,7 @@ func exclusiveOwnerAnnotations(pg *tsapi.ProxyGroup, operatorID string, svc *tai
 	}
 	if svc == nil {
 		c := ownerAnnotationValue{OwnerRefs: []OwnerRef{ref}}
-		json, err := json.Marshal(c)
+		json, err := jsonv1.Marshal(c)
 		if err != nil {
 			return nil, fmt.Errorf("[unexpected] unable to marshal Tailscale Service's owner annotation contents: %w, please report this", err)
 		}
@@ -466,7 +466,7 @@ func exclusiveOwnerAnnotations(pg *tsapi.ProxyGroup, operatorID string, svc *tai
 		o.OwnerRefs[0].Resource.Name = pg.Name
 	}
 
-	oBytes, err := json.Marshal(o)
+	oBytes, err := jsonv1.Marshal(o)
 	if err != nil {
 		return nil, err
 	}
diff --git a/cmd/k8s-operator/api-server-proxy-pg_test.go b/cmd/k8s-operator/api-server-proxy-pg_test.go
index dfef63f22..0912e858d 100644
--- a/cmd/k8s-operator/api-server-proxy-pg_test.go
+++ b/cmd/k8s-operator/api-server-proxy-pg_test.go
@@ -4,7 +4,7 @@
 package main
 
 import (
-	"encoding/json"
+	jsonv1 "encoding/json"
 	"reflect"
 	"strings"
 	"testing"
@@ -64,7 +64,7 @@ func TestAPIServerProxyReconciler(t *testing.T) {
 		},
 	}
 	expectedCfg := *initialCfg
-	initialCfgB, err := json.Marshal(initialCfg)
+	initialCfgB, err := jsonv1.Marshal(initialCfg)
 	if err != nil {
 		t.Fatalf("marshaling initial config: %v", err)
 	}
@@ -86,7 +86,7 @@ func TestAPIServerProxyReconciler(t *testing.T) {
 		Build()
 	expectCfg := func(c *conf.VersionedConfig) {
 		t.Helper()
-		cBytes, err := json.Marshal(c)
+		cBytes, err := jsonv1.Marshal(c)
 		if err != nil {
 			t.Fatalf("marshaling expected config: %v", err)
 		}
diff --git a/cmd/k8s-operator/dnsrecords.go b/cmd/k8s-operator/dnsrecords.go
index 1a9395aa0..213481cf2 100644
--- a/cmd/k8s-operator/dnsrecords.go
+++ b/cmd/k8s-operator/dnsrecords.go
@@ -7,7 +7,7 @@ package main
 
 import (
 	"context"
-	"encoding/json"
+	jsonv1 "encoding/json"
 	"fmt"
 	"slices"
 	"strings"
@@ -314,12 +314,12 @@ func (dnsRR *dnsRecordsReconciler) updateDNSConfig(ctx context.Context, update f
 	}
 	dnsRecords := operatorutils.Records{Version: operatorutils.Alpha1Version, IP4: map[string][]string{}}
 	if cm.Data != nil && cm.Data[operatorutils.DNSRecordsCMKey] != "" {
-		if err := json.Unmarshal([]byte(cm.Data[operatorutils.DNSRecordsCMKey]), &dnsRecords); err != nil {
+		if err := jsonv1.Unmarshal([]byte(cm.Data[operatorutils.DNSRecordsCMKey]), &dnsRecords); err != nil {
 			return err
 		}
 	}
 	update(&dnsRecords)
-	dnsRecordsBs, err := json.Marshal(dnsRecords)
+	dnsRecordsBs, err := jsonv1.Marshal(dnsRecords)
 	if err != nil {
 		return fmt.Errorf("error marshalling DNS records: %w", err)
 	}
diff --git a/cmd/k8s-operator/dnsrecords_test.go b/cmd/k8s-operator/dnsrecords_test.go
index 13898078f..f1bea541a 100644
--- a/cmd/k8s-operator/dnsrecords_test.go
+++ b/cmd/k8s-operator/dnsrecords_test.go
@@ -7,7 +7,7 @@ package main
 
 import (
 	"context"
-	"encoding/json"
+	jsonv1 "encoding/json"
 	"fmt"
 	"testing"
 
@@ -469,7 +469,7 @@ func expectHostsRecords(t *testing.T, cl client.Client, wantsHosts map[string][]
 		t.Fatal("dnsconfig ConfigMap does not contain dnsconfig")
 	}
 	dnsConfig := &operatorutils.Records{}
-	if err := json.Unmarshal([]byte(dnsConfigString), dnsConfig); err != nil {
+	if err := jsonv1.Unmarshal([]byte(dnsConfigString), dnsConfig); err != nil {
 		t.Fatalf("unmarshaling dnsconfig: %v", err)
 	}
 	if diff := cmp.Diff(dnsConfig.IP4, wantsHosts); diff != "" {
@@ -491,7 +491,7 @@ func expectHostsRecordsWithIPv6(t *testing.T, cl client.Client, wantsHostsIPv4,
 		t.Fatal("dnsconfig ConfigMap does not contain dnsconfig")
 	}
 	dnsConfig := &operatorutils.Records{}
-	if err := json.Unmarshal([]byte(dnsConfigString), dnsConfig); err != nil {
+	if err := jsonv1.Unmarshal([]byte(dnsConfigString), dnsConfig); err != nil {
 		t.Fatalf("unmarshaling dnsconfig: %v", err)
 	}
 	if diff := cmp.Diff(dnsConfig.IP4, wantsHostsIPv4); diff != "" {
diff --git a/cmd/k8s-operator/e2e/proxy_test.go b/cmd/k8s-operator/e2e/proxy_test.go
index b3010f97e..ab733d233 100644
--- a/cmd/k8s-operator/e2e/proxy_test.go
+++ b/cmd/k8s-operator/e2e/proxy_test.go
@@ -4,7 +4,7 @@
 package e2e
 
 import (
-	"encoding/json"
+	jsonv1 "encoding/json"
 	"fmt"
 	"testing"
 	"time"
@@ -99,7 +99,7 @@ func hostNameFromOperatorSecret(t *testing.T, s corev1.Secret) string {
 	}
 
 	prefs := ipn.Prefs{}
-	if err := json.Unmarshal(prefsBytes, &prefs); err != nil {
+	if err := jsonv1.Unmarshal(prefsBytes, &prefs); err != nil {
 		t.Fatal(err)
 	}
 
diff --git a/cmd/k8s-operator/egress-eps.go b/cmd/k8s-operator/egress-eps.go
index 3441e12ba..f99ce2dfb 100644
--- a/cmd/k8s-operator/egress-eps.go
+++ b/cmd/k8s-operator/egress-eps.go
@@ -7,7 +7,7 @@ package main
 
 import (
 	"context"
-	"encoding/json"
+	jsonv1 "encoding/json"
 	"fmt"
 	"net/netip"
 	"reflect"
@@ -189,7 +189,7 @@ func (er *egressEpsReconciler) podIsReadyToRouteTraffic(ctx context.Context, pod
 		return false, nil
 	}
 	svcStatus := &egressservices.Status{}
-	if err := json.Unmarshal(svcStatusBS, svcStatus); err != nil {
+	if err := jsonv1.Unmarshal(svcStatusBS, svcStatus); err != nil {
 		return false, fmt.Errorf("error unmarshalling egress service status: %w", err)
 	}
 	if !strings.EqualFold(podIP, svcStatus.PodIPv4) {
diff --git a/cmd/k8s-operator/egress-eps_test.go b/cmd/k8s-operator/egress-eps_test.go
index bd80112ae..dabf57af6 100644
--- a/cmd/k8s-operator/egress-eps_test.go
+++ b/cmd/k8s-operator/egress-eps_test.go
@@ -6,7 +6,7 @@
 package main
 
 import (
-	"encoding/json"
+	jsonv1 "encoding/json"
 	"fmt"
 	"math/rand/v2"
 	"testing"
@@ -144,7 +144,7 @@ func configMapForSvc(t *testing.T, svc *corev1.Service, p uint16) *corev1.Config
 	}
 	name := tailnetSvcName(svc)
 	cfgs := egressservices.Configs{name: cfg}
-	bs, err := json.Marshal(&cfgs)
+	bs, err := jsonv1.Marshal(&cfgs)
 	if err != nil {
 		t.Fatalf("error marshalling config: %v", err)
 	}
@@ -176,7 +176,7 @@ func serviceStatusForPodIP(t *testing.T, svc *corev1.Service, ip string, p uint1
 		PodIPv4:  ip,
 		Services: map[string]*egressservices.ServiceStatus{svcName: &svcSt},
 	}
-	bs, err := json.Marshal(st)
+	bs, err := jsonv1.Marshal(st)
 	if err != nil {
 		t.Fatalf("error marshalling service status: %v", err)
 	}
diff --git a/cmd/k8s-operator/egress-services.go b/cmd/k8s-operator/egress-services.go
index ca6562071..0bf267f12 100644
--- a/cmd/k8s-operator/egress-services.go
+++ b/cmd/k8s-operator/egress-services.go
@@ -8,7 +8,7 @@ package main
 import (
 	"context"
 	"crypto/sha256"
-	"encoding/json"
+	jsonv1 "encoding/json"
 	"errors"
 	"fmt"
 	"math/rand/v2"
@@ -352,7 +352,7 @@ func (esr *egressSvcsReconciler) provision(ctx context.Context, proxyGroupName s
 	if !reflect.DeepEqual(gotCfg, wantsCfg) {
 		l.Debugf("updating egress services ConfigMap %s", cm.Name)
 		mak.Set(cfgs, tailnetSvc, wantsCfg)
-		bs, err := json.Marshal(cfgs)
+		bs, err := jsonv1.Marshal(cfgs)
 		if err != nil {
 			return nil, false, fmt.Errorf("error marshalling egress services configs: %w", err)
 		}
@@ -485,7 +485,7 @@ func (esr *egressSvcsReconciler) ensureEgressSvcCfgDeleted(ctx context.Context,
 		return nil
 	}
 	cfgs := &egressservices.Configs{}
-	if err := json.Unmarshal(bs, cfgs); err != nil {
+	if err := jsonv1.Unmarshal(bs, cfgs); err != nil {
 		return fmt.Errorf("error unmarshalling egress services configs")
 	}
 	tailnetSvc := tailnetSvcName(svc)
@@ -497,7 +497,7 @@ func (esr *egressSvcsReconciler) ensureEgressSvcCfgDeleted(ctx context.Context,
 	l.Infof("before deleting config %+#v", *cfgs)
 	delete(*cfgs, tailnetSvc)
 	l.Infof("after deleting config %+#v", *cfgs)
-	bs, err := json.Marshal(cfgs)
+	bs, err := jsonv1.Marshal(cfgs)
 	if err != nil {
 		return fmt.Errorf("error marshalling egress services configs: %w", err)
 	}
@@ -665,7 +665,7 @@ func egressSvcsConfigs(ctx context.Context, cl client.Client, proxyGroupName, ts
 	}
 	cfgs = &egressservices.Configs{}
 	if len(cm.BinaryData[egressservices.KeyEgressServices]) != 0 {
-		if err := json.Unmarshal(cm.BinaryData[egressservices.KeyEgressServices], cfgs); err != nil {
+		if err := jsonv1.Unmarshal(cm.BinaryData[egressservices.KeyEgressServices], cfgs); err != nil {
 			return nil, nil, fmt.Errorf("error unmarshaling egress services config %v: %w", cm.BinaryData[egressservices.KeyEgressServices], err)
 		}
 	}
@@ -715,7 +715,7 @@ func svcConfigurationUpToDate(svc *corev1.Service, l *zap.SugaredLogger) bool {
 }
 
 func cfgHash(c cfg, l *zap.SugaredLogger) string {
-	bs, err := json.Marshal(c)
+	bs, err := jsonv1.Marshal(c)
 	if err != nil {
 		// Don't use l.Error as that messes up component logs with, in this case, unnecessary stack trace.
 		l.Infof("error marhsalling Config: %v", err)
diff --git a/cmd/k8s-operator/egress-services_test.go b/cmd/k8s-operator/egress-services_test.go
index d8a5dfd32..74395ca03 100644
--- a/cmd/k8s-operator/egress-services_test.go
+++ b/cmd/k8s-operator/egress-services_test.go
@@ -7,7 +7,7 @@ package main
 
 import (
 	"context"
-	"encoding/json"
+	jsonv1 "encoding/json"
 	"fmt"
 	"testing"
 
@@ -284,7 +284,7 @@ func configFromCM(t *testing.T, cm *corev1.ConfigMap, svcName string) *egressser
 		return nil
 	}
 	cfgs := &egressservices.Configs{}
-	if err := json.Unmarshal(cfgBs, cfgs); err != nil {
+	if err := jsonv1.Unmarshal(cfgBs, cfgs); err != nil {
 		t.Fatalf("error unmarshalling config: %v", err)
 	}
 	cfg, ok := (*cfgs)[svcName]
diff --git a/cmd/k8s-operator/ingress-for-pg.go b/cmd/k8s-operator/ingress-for-pg.go
index 3afeb528f..a23acec0a 100644
--- a/cmd/k8s-operator/ingress-for-pg.go
+++ b/cmd/k8s-operator/ingress-for-pg.go
@@ -7,7 +7,7 @@ package main
 
 import (
 	"context"
-	"encoding/json"
+	jsonv1 "encoding/json"
 	"errors"
 	"fmt"
 	"math/rand/v2"
@@ -303,7 +303,7 @@ func (r *HAIngressReconciler) maybeProvision(ctx context.Context, hostname strin
 	if !reflect.DeepEqual(gotCfg, ingCfg) {
 		logger.Infof("Updating serve config")
 		mak.Set(&cfg.Services, serviceName, ingCfg)
-		cfgBytes, err := json.Marshal(cfg)
+		cfgBytes, err := jsonv1.Marshal(cfg)
 		if err != nil {
 			return false, fmt.Errorf("error marshaling serve config: %w", err)
 		}
@@ -488,7 +488,7 @@ func (r *HAIngressReconciler) maybeCleanupProxyGroup(ctx context.Context, proxyG
 	}
 
 	if serveConfigChanged {
-		cfgBytes, err := json.Marshal(cfg)
+		cfgBytes, err := jsonv1.Marshal(cfg)
 		if err != nil {
 			return false, fmt.Errorf("marshaling serve config: %w", err)
 		}
@@ -573,7 +573,7 @@ func (r *HAIngressReconciler) maybeCleanup(ctx context.Context, hostname string,
 	// 5. Remove the Tailscale Service from the serve config for the ProxyGroup.
 	logger.Infof("Removing TailscaleService %q from serve config for ProxyGroup %q", hostname, pg)
 	delete(cfg.Services, serviceName)
-	cfgBytes, err := json.Marshal(cfg)
+	cfgBytes, err := jsonv1.Marshal(cfg)
 	if err != nil {
 		return false, fmt.Errorf("error marshaling serve config: %w", err)
 	}
@@ -622,7 +622,7 @@ func (r *HAIngressReconciler) proxyGroupServeConfig(ctx context.Context, pg stri
 	}
 	cfg = &ipn.ServeConfig{}
 	if len(cm.BinaryData[serveConfigKey]) != 0 {
-		if err := json.Unmarshal(cm.BinaryData[serveConfigKey], cfg); err != nil {
+		if err := jsonv1.Unmarshal(cm.BinaryData[serveConfigKey], cfg); err != nil {
 			return nil, nil, fmt.Errorf("error unmarshaling ingress serve config %v: %w", cm.BinaryData[serveConfigKey], err)
 		}
 	}
@@ -733,7 +733,7 @@ func (r *HAIngressReconciler) cleanupTailscaleService(ctx context.Context, svc *
 	}
 	o.OwnerRefs = slices.Delete(o.OwnerRefs, ix, ix+1)
 	logger.Infof("Deleting Tailscale Service %q", svc.Name)
-	json, err := json.Marshal(o)
+	json, err := jsonv1.Marshal(o)
 	if err != nil {
 		return false, fmt.Errorf("error marshalling updated Tailscale Service owner reference: %w", err)
 	}
@@ -784,7 +784,7 @@ func (a *HAIngressReconciler) maybeUpdateAdvertiseServicesConfig(ctx context.Con
 		var updated bool
 		for fileName, confB := range secret.Data {
 			var conf ipn.ConfigVAlpha
-			if err := json.Unmarshal(confB, &conf); err != nil {
+			if err := jsonv1.Unmarshal(confB, &conf); err != nil {
 				return fmt.Errorf("error unmarshalling ProxyGroup config: %w", err)
 			}
 
@@ -804,7 +804,7 @@ func (a *HAIngressReconciler) maybeUpdateAdvertiseServicesConfig(ctx context.Con
 			}
 
 			// Update the Secret.
-			confB, err := json.Marshal(conf)
+			confB, err := jsonv1.Marshal(conf)
 			if err != nil {
 				return fmt.Errorf("error marshalling ProxyGroup config: %w", err)
 			}
@@ -880,7 +880,7 @@ func ownerAnnotations(operatorID string, svc *tailscale.VIPService) (map[string]
 	}
 	if svc == nil {
 		c := ownerAnnotationValue{OwnerRefs: []OwnerRef{ref}}
-		json, err := json.Marshal(c)
+		json, err := jsonv1.Marshal(c)
 		if err != nil {
 			return nil, fmt.Errorf("[unexpected] unable to marshal Tailscale Service's owner annotation contents: %w, please report this", err)
 		}
@@ -902,7 +902,7 @@ func ownerAnnotations(operatorID string, svc *tailscale.VIPService) (map[string]
 		return nil, fmt.Errorf("Tailscale Service %s is owned by another resource: %#v; cannot be reused for an Ingress", svc.Name, o.OwnerRefs[0].Resource)
 	}
 	o.OwnerRefs = append(o.OwnerRefs, ref)
-	json, err := json.Marshal(o)
+	json, err := jsonv1.Marshal(o)
 	if err != nil {
 		return nil, fmt.Errorf("error marshalling updated owner references: %w", err)
 	}
@@ -921,7 +921,7 @@ func parseOwnerAnnotation(tsSvc *tailscale.VIPService) (*ownerAnnotationValue, e
 		return nil, nil
 	}
 	o := &ownerAnnotationValue{}
-	if err := json.Unmarshal([]byte(tsSvc.Annotations[ownerAnnotation]), o); err != nil {
+	if err := jsonv1.Unmarshal([]byte(tsSvc.Annotations[ownerAnnotation]), o); err != nil {
 		return nil, fmt.Errorf("error parsing Tailscale Service's %s annotation %q: %w", ownerAnnotation, tsSvc.Annotations[ownerAnnotation], err)
 	}
 	return o, nil
diff --git a/cmd/k8s-operator/ingress-for-pg_test.go b/cmd/k8s-operator/ingress-for-pg_test.go
index 77e5ecb37..e7eb1b3e6 100644
--- a/cmd/k8s-operator/ingress-for-pg_test.go
+++ b/cmd/k8s-operator/ingress-for-pg_test.go
@@ -7,7 +7,7 @@ package main
 
 import (
 	"context"
-	"encoding/json"
+	jsonv1 "encoding/json"
 	"fmt"
 	"maps"
 	"reflect"
@@ -166,7 +166,7 @@ func TestIngressPGReconciler(t *testing.T) {
 	}
 
 	cfg := &ipn.ServeConfig{}
-	if err := json.Unmarshal(cm.BinaryData[serveConfigKey], cfg); err != nil {
+	if err := jsonv1.Unmarshal(cm.BinaryData[serveConfigKey], cfg); err != nil {
 		t.Fatalf("unmarshaling serve config: %v", err)
 	}
 
@@ -215,7 +215,7 @@ func TestIngressPGReconciler(t *testing.T) {
 	}
 
 	cfg = &ipn.ServeConfig{}
-	if err := json.Unmarshal(cm.BinaryData[serveConfigKey], cfg); err != nil {
+	if err := jsonv1.Unmarshal(cm.BinaryData[serveConfigKey], cfg); err != nil {
 		t.Fatalf("unmarshaling serve config: %v", err)
 	}
 
@@ -771,7 +771,7 @@ func verifyServeConfig(t *testing.T, fc client.Client, serviceName string, wantH
 	}
 
 	cfg := &ipn.ServeConfig{}
-	if err := json.Unmarshal(cm.BinaryData["serve-config.json"], cfg); err != nil {
+	if err := jsonv1.Unmarshal(cm.BinaryData["serve-config.json"], cfg); err != nil {
 		t.Fatalf("unmarshaling serve config: %v", err)
 	}
 
@@ -814,7 +814,7 @@ func verifyTailscaledConfig(t *testing.T, fc client.Client, pgName string, expec
 	t.Helper()
 	var expected string
 	if expectedServices != nil && len(expectedServices) > 0 {
-		expectedServicesJSON, err := json.Marshal(expectedServices)
+		expectedServicesJSON, err := jsonv1.Marshal(expectedServices)
 		if err != nil {
 			t.Fatalf("marshaling expected services: %v", err)
 		}
diff --git a/cmd/k8s-operator/nameserver_test.go b/cmd/k8s-operator/nameserver_test.go
index 6da52d8a2..77e20f3f1 100644
--- a/cmd/k8s-operator/nameserver_test.go
+++ b/cmd/k8s-operator/nameserver_test.go
@@ -9,7 +9,7 @@
 package main
 
 import (
-	"encoding/json"
+	jsonv1 "encoding/json"
 	"testing"
 	"time"
 
@@ -150,7 +150,7 @@ func TestNameserverReconciler(t *testing.T) {
 		// Verify that when another actor sets ConfigMap data, it does not get
 		// overwritten by nameserver reconciler.
 		dnsRecords := &operatorutils.Records{Version: "v1alpha1", IP4: map[string][]string{"foo.ts.net": {"1.2.3.4"}}}
-		bs, err := json.Marshal(dnsRecords)
+		bs, err := jsonv1.Marshal(dnsRecords)
 		if err != nil {
 			t.Fatalf("error marshalling ConfigMap contents: %v", err)
 		}
diff --git a/cmd/k8s-operator/operator_test.go b/cmd/k8s-operator/operator_test.go
index 5af237342..4e4b6b9db 100644
--- a/cmd/k8s-operator/operator_test.go
+++ b/cmd/k8s-operator/operator_test.go
@@ -7,7 +7,7 @@ package main
 
 import (
 	"context"
-	"encoding/json"
+	jsonv1 "encoding/json"
 	"fmt"
 	"testing"
 	"time"
@@ -1282,7 +1282,7 @@ func TestServiceProxyClassAnnotation(t *testing.T) {
 			slist := &corev1.SecretList{}
 			fc.List(context.Background(), slist, client.InNamespace("operator-ns"))
 			for _, i := range slist.Items {
-				l, _ := json.Marshal(i.Labels)
+				l, _ := jsonv1.Marshal(i.Labels)
 				t.Logf("found secret %q with labels %q ", i.Name, string(l))
 			}
 
diff --git a/cmd/k8s-operator/proxygroup.go b/cmd/k8s-operator/proxygroup.go
index 946e017a2..a65d40a4b 100644
--- a/cmd/k8s-operator/proxygroup.go
+++ b/cmd/k8s-operator/proxygroup.go
@@ -7,7 +7,7 @@ package main
 
 import (
 	"context"
-	"encoding/json"
+	jsonv1 "encoding/json"
 	"errors"
 	"fmt"
 	"net/http"
@@ -796,7 +796,7 @@ func (r *ProxyGroupReconciler) ensureConfigSecretsCreated(ctx context.Context, p
 				}
 				if !deviceAuthed {
 					existingCfg := conf.ConfigV1Alpha1{}
-					if err := json.Unmarshal(existingCfgSecret.Data[kubetypes.KubeAPIServerConfigFile], &existingCfg); err != nil {
+					if err := jsonv1.Unmarshal(existingCfgSecret.Data[kubetypes.KubeAPIServerConfigFile], &existingCfg); err != nil {
 						return nil, fmt.Errorf("error unmarshalling existing config: %w", err)
 					}
 					if existingCfg.AuthKey != nil {
@@ -835,7 +835,7 @@ func (r *ProxyGroupReconciler) ensureConfigSecretsCreated(ctx context.Context, p
 			if existingCfgSecret != nil {
 				if k8sProxyCfg, ok := cfgSecret.Data[kubetypes.KubeAPIServerConfigFile]; ok {
 					k8sCfg := &conf.ConfigV1Alpha1{}
-					if err := json.Unmarshal(k8sProxyCfg, k8sCfg); err != nil {
+					if err := jsonv1.Unmarshal(k8sProxyCfg, k8sCfg); err != nil {
 						return nil, fmt.Errorf("failed to unmarshal kube-apiserver config: %w", err)
 					}
 
@@ -862,7 +862,7 @@ func (r *ProxyGroupReconciler) ensureConfigSecretsCreated(ctx context.Context, p
 				cfg.StaticEndpoints = endpoints[nodePortSvcName]
 			}
 
-			cfgB, err := json.Marshal(cfg)
+			cfgB, err := jsonv1.Marshal(cfg)
 			if err != nil {
 				return nil, fmt.Errorf("error marshalling k8s-proxy config: %w", err)
 			}
@@ -881,7 +881,7 @@ func (r *ProxyGroupReconciler) ensureConfigSecretsCreated(ctx context.Context, p
 			}
 
 			for cap, cfg := range configs {
-				cfgJSON, err := json.Marshal(cfg)
+				cfgJSON, err := jsonv1.Marshal(cfg)
 				if err != nil {
 					return nil, fmt.Errorf("error marshalling tailscaled config: %w", err)
 				}
@@ -923,7 +923,7 @@ func (r *ProxyGroupReconciler) findStaticEndpoints(ctx context.Context, existing
 		oldConfB := existingCfgSecret.Data[tsoperator.TailscaledConfigFileName(106)]
 		if len(oldConfB) > 0 {
 			var oldConf ipn.ConfigVAlpha
-			if err := json.Unmarshal(oldConfB, &oldConf); err == nil {
+			if err := jsonv1.Unmarshal(oldConfB, &oldConf); err == nil {
 				currAddrs = oldConf.StaticEndpoints
 			} else {
 				logger.Debugf("failed to unmarshal tailscaled config from secret %q: %v", existingCfgSecret.Name, err)
@@ -1150,7 +1150,7 @@ func (r *ProxyGroupReconciler) getRunningProxies(ctx context.Context, pg *tsapi.
 
 		if ipsB := m.stateSecret.Data[kubetypes.KeyDeviceIPs]; len(ipsB) > 0 {
 			ips := []string{}
-			if err := json.Unmarshal(ipsB, &ips); err != nil {
+			if err := jsonv1.Unmarshal(ipsB, &ips); err != nil {
 				return nil, fmt.Errorf("failed to extract device IPs from state Secret %q: %w", m.stateSecret.Name, err)
 			}
 			device.TailnetIPs = ips
diff --git a/cmd/k8s-operator/proxygroup_test.go b/cmd/k8s-operator/proxygroup_test.go
index 2bcc9fb7a..835d23264 100644
--- a/cmd/k8s-operator/proxygroup_test.go
+++ b/cmd/k8s-operator/proxygroup_test.go
@@ -6,7 +6,7 @@
 package main
 
 import (
-	"encoding/json"
+	jsonv1 "encoding/json"
 	"fmt"
 	"net/netip"
 	"slices"
@@ -705,7 +705,7 @@ func TestProxyGroupWithStaticEndpoints(t *testing.T) {
 							config := &ipn.ConfigVAlpha{}
 							foundConfig := false
 							for _, d := range sec.Data {
-								if err := json.Unmarshal(d, config); err == nil {
+								if err := jsonv1.Unmarshal(d, config); err == nil {
 									foundConfig = true
 									break
 								}
@@ -1383,7 +1383,7 @@ func TestKubeAPIServerType_DoesNotOverwriteServicesConfig(t *testing.T) {
 			HealthCheckEnabled: opt.NewBool(true),
 		},
 	}
-	cfgB, err := json.Marshal(cfg)
+	cfgB, err := jsonv1.Marshal(cfg)
 	if err != nil {
 		t.Fatalf("failed to marshal config: %v", err)
 	}
@@ -1405,7 +1405,7 @@ func TestKubeAPIServerType_DoesNotOverwriteServicesConfig(t *testing.T) {
 	// then check the proxygroup reconciler doesn't overwrite it.
 	cfg.APIServerProxy.ServiceName = ptr.To(tailcfg.ServiceName("svc:some-svc-name"))
 	cfg.AdvertiseServices = []string{"svc:should-not-be-overwritten"}
-	cfgB, err = json.Marshal(cfg)
+	cfgB, err = jsonv1.Marshal(cfg)
 	if err != nil {
 		t.Fatalf("failed to marshal config: %v", err)
 	}
@@ -1433,7 +1433,7 @@ func TestIngressAdvertiseServicesConfigPreserved(t *testing.T) {
 	}
 
 	existingServices := []string{"svc1", "svc2"}
-	existingConfigBytes, err := json.Marshal(ipn.ConfigVAlpha{
+	existingConfigBytes, err := jsonv1.Marshal(ipn.ConfigVAlpha{
 		AdvertiseServices: existingServices,
 		Version:           "should-get-overwritten",
 	})
@@ -1464,7 +1464,7 @@ func TestIngressAdvertiseServicesConfigPreserved(t *testing.T) {
 	})
 	expectReconciled(t, reconciler, "", pgName)
 
-	expectedConfigBytes, err := json.Marshal(ipn.ConfigVAlpha{
+	expectedConfigBytes, err := jsonv1.Marshal(ipn.ConfigVAlpha{
 		// Preserved.
 		AdvertiseServices: existingServices,
 
@@ -1802,7 +1802,7 @@ func addNodeIDToStateSecrets(t *testing.T, fc client.WithWatch, pg *tsapi.ProxyG
 	t.Helper()
 	const key = "profile-abc"
 	for i := range pgReplicas(pg) {
-		bytes, err := json.Marshal(map[string]any{
+		bytes, err := jsonv1.Marshal(map[string]any{
 			"Config": map[string]any{
 				"NodeID": fmt.Sprintf("nodeid-%d", i),
 			},
diff --git a/cmd/k8s-operator/sts.go b/cmd/k8s-operator/sts.go
index c52ffce85..bf6bbbd91 100644
--- a/cmd/k8s-operator/sts.go
+++ b/cmd/k8s-operator/sts.go
@@ -8,7 +8,7 @@ package main
 import (
 	"context"
 	_ "embed"
-	"encoding/json"
+	jsonv1 "encoding/json"
 	"errors"
 	"fmt"
 	"net/http"
@@ -417,7 +417,7 @@ func (a *tailscaleSTSReconciler) provisionSecrets(ctx context.Context, logger *z
 		var latestConfig ipn.ConfigVAlpha
 		for key, val := range configs {
 			fn := tsoperator.TailscaledConfigFileName(key)
-			b, err := json.Marshal(val)
+			b, err := jsonv1.Marshal(val)
 			if err != nil {
 				return nil, fmt.Errorf("error marshalling tailscaled config: %w", err)
 			}
@@ -430,7 +430,7 @@ func (a *tailscaleSTSReconciler) provisionSecrets(ctx context.Context, logger *z
 		}
 
 		if stsC.ServeConfig != nil {
-			j, err := json.Marshal(stsC.ServeConfig)
+			j, err := jsonv1.Marshal(stsC.ServeConfig)
 			if err != nil {
 				return nil, err
 			}
@@ -585,7 +585,7 @@ func deviceInfo(sec *corev1.Secret, podUID string, log *zap.SugaredLogger) (dev
 	}
 	if rawDeviceIPs, ok := sec.Data[kubetypes.KeyDeviceIPs]; ok {
 		ips := make([]string, 0)
-		if err := json.Unmarshal(rawDeviceIPs, &ips); err != nil {
+		if err := jsonv1.Unmarshal(rawDeviceIPs, &ips); err != nil {
 			return nil, err
 		}
 		dev.ips = ips
@@ -1091,7 +1091,7 @@ func latestConfigFromSecret(s *corev1.Secret) (*ipn.ConfigVAlpha, error) {
 	var conf *ipn.ConfigVAlpha
 	if latestStr != "" {
 		conf = &ipn.ConfigVAlpha{}
-		if err := json.Unmarshal([]byte(s.Data[latestStr]), conf); err != nil {
+		if err := jsonv1.Unmarshal([]byte(s.Data[latestStr]), conf); err != nil {
 			return nil, fmt.Errorf("error unmarshaling tailscaled config from Secret %q in field %q: %w", s.Name, latestStr, err)
 		}
 	}
diff --git a/cmd/k8s-operator/svc-for-pg.go b/cmd/k8s-operator/svc-for-pg.go
index 62cc36bd4..acc6b0078 100644
--- a/cmd/k8s-operator/svc-for-pg.go
+++ b/cmd/k8s-operator/svc-for-pg.go
@@ -7,7 +7,7 @@ package main
 
 import (
 	"context"
-	"encoding/json"
+	jsonv1 "encoding/json"
 	"errors"
 	"fmt"
 	"net/http"
@@ -317,7 +317,7 @@ func (r *HAServiceReconciler) maybeProvision(ctx context.Context, hostname strin
 	existingCfg := cfgs[serviceName.String()]
 	if !reflect.DeepEqual(existingCfg, cfg) {
 		mak.Set(&cfgs, serviceName.String(), cfg)
-		cfgBytes, err := json.Marshal(cfgs)
+		cfgBytes, err := jsonv1.Marshal(cfgs)
 		if err != nil {
 			return false, fmt.Errorf("error marshaling ingress config: %w", err)
 		}
@@ -417,7 +417,7 @@ func (r *HAServiceReconciler) maybeCleanup(ctx context.Context, hostname string,
 	}
 	logger.Infof("Removing Tailscale Service %q from ingress config for ProxyGroup %q", hostname, pgName)
 	delete(cfgs, serviceName.String())
-	cfgBytes, err := json.Marshal(cfgs)
+	cfgBytes, err := jsonv1.Marshal(cfgs)
 	if err != nil {
 		return false, fmt.Errorf("error marshaling ingress config: %w", err)
 	}
@@ -470,7 +470,7 @@ func (r *HAServiceReconciler) maybeCleanupProxyGroup(ctx context.Context, proxyG
 	}
 
 	if ingressConfigChanged {
-		configBytes, err := json.Marshal(config)
+		configBytes, err := jsonv1.Marshal(config)
 		if err != nil {
 			return false, fmt.Errorf("marshaling serve config: %w", err)
 		}
@@ -573,7 +573,7 @@ func cleanupTailscaleService(ctx context.Context, tsClient tsClient, name tailcf
 	}
 	o.OwnerRefs = slices.Delete(o.OwnerRefs, ix, ix+1)
 	logger.Infof("Updating Tailscale Service %q", name)
-	json, err := json.Marshal(o)
+	json, err := jsonv1.Marshal(o)
 	if err != nil {
 		return false, fmt.Errorf("error marshalling updated Tailscale Service owner reference: %w", err)
 	}
@@ -606,7 +606,7 @@ func (a *HAServiceReconciler) backendRoutesSetup(ctx context.Context, serviceNam
 	}
 	gotCfgB := secret.Data[ingressservices.IngressConfigKey]
 	var gotCfgs ingressservices.Status
-	if err := json.Unmarshal(gotCfgB, &gotCfgs); err != nil {
+	if err := jsonv1.Unmarshal(gotCfgB, &gotCfgs); err != nil {
 		return false, fmt.Errorf("error unmarshalling ingress config: %w", err)
 	}
 	statusUpToDate, err := isCurrentStatus(gotCfgs, pod, logger)
@@ -668,7 +668,7 @@ func (a *HAServiceReconciler) maybeUpdateAdvertiseServicesConfig(ctx context.Con
 		var updated bool
 		for fileName, confB := range secret.Data {
 			var conf ipn.ConfigVAlpha
-			if err := json.Unmarshal(confB, &conf); err != nil {
+			if err := jsonv1.Unmarshal(confB, &conf); err != nil {
 				return fmt.Errorf("error unmarshalling ProxyGroup config: %w", err)
 			}
 
@@ -701,7 +701,7 @@ func (a *HAServiceReconciler) maybeUpdateAdvertiseServicesConfig(ctx context.Con
 
 				conf.AdvertiseServices = append(conf.AdvertiseServices, serviceName.String())
 			}
-			confB, err := json.Marshal(conf)
+			confB, err := jsonv1.Marshal(conf)
 			if err != nil {
 				return fmt.Errorf("error marshalling ProxyGroup config: %w", err)
 			}
@@ -770,7 +770,7 @@ func ingressSvcsConfigs(ctx context.Context, cl client.Client, proxyGroupName, t
 	}
 	cfgs = ingressservices.Configs{}
 	if len(cm.BinaryData[ingressservices.IngressConfigKey]) != 0 {
-		if err := json.Unmarshal(cm.BinaryData[ingressservices.IngressConfigKey], &cfgs); err != nil {
+		if err := jsonv1.Unmarshal(cm.BinaryData[ingressservices.IngressConfigKey], &cfgs); err != nil {
 			return nil, nil, fmt.Errorf("error unmarshaling ingress services config %v: %w", cm.BinaryData[ingressservices.IngressConfigKey], err)
 		}
 	}
diff --git a/cmd/k8s-operator/svc-for-pg_test.go b/cmd/k8s-operator/svc-for-pg_test.go
index baaa07727..03130147d 100644
--- a/cmd/k8s-operator/svc-for-pg_test.go
+++ b/cmd/k8s-operator/svc-for-pg_test.go
@@ -7,7 +7,7 @@ package main
 
 import (
 	"context"
-	"encoding/json"
+	jsonv1 "encoding/json"
 	"fmt"
 	"math/rand/v2"
 	"net/netip"
@@ -67,7 +67,7 @@ func TestServicePGReconciler(t *testing.T) {
 		}
 
 		cfgs := ingressservices.Configs{}
-		if err := json.Unmarshal(cm.BinaryData[ingressservices.IngressConfigKey], &cfgs); err != nil {
+		if err := jsonv1.Unmarshal(cm.BinaryData[ingressservices.IngressConfigKey], &cfgs); err != nil {
 			t.Fatalf("unmarshaling serve config: %v", err)
 		}
 
@@ -368,7 +368,7 @@ func updateIngressConfigSecret(t *testing.T, fc client.Client, stateSecret *core
 		PodIPv4: "4.3.2.1",
 	}
 
-	icJson, err := json.Marshal(ingressStatus)
+	icJson, err := jsonv1.Marshal(ingressStatus)
 	if err != nil {
 		t.Fatalf("failed to json marshal ingress config: %s", err.Error())
 	}
diff --git a/cmd/k8s-operator/testutils_test.go b/cmd/k8s-operator/testutils_test.go
index b4c468c8e..92e4f9d7d 100644
--- a/cmd/k8s-operator/testutils_test.go
+++ b/cmd/k8s-operator/testutils_test.go
@@ -7,7 +7,7 @@ package main
 
 import (
 	"context"
-	"encoding/json"
+	jsonv1 "encoding/json"
 	"fmt"
 	"net/http"
 	"net/netip"
@@ -501,7 +501,7 @@ func expectedSecret(t *testing.T, cl client.Client, opts configOpts) *corev1.Sec
 		},
 	}
 	if opts.serveConfig != nil {
-		serveConfigBs, err := json.Marshal(opts.serveConfig)
+		serveConfigBs, err := jsonv1.Marshal(opts.serveConfig)
 		if err != nil {
 			t.Fatalf("error marshalling serve config: %v", err)
 		}
@@ -548,12 +548,12 @@ func expectedSecret(t *testing.T, cl client.Client, opts configOpts) *corev1.Sec
 		}
 	}
 	conf.AdvertiseRoutes = routes
-	bnn, err := json.Marshal(conf)
+	bnn, err := jsonv1.Marshal(conf)
 	if err != nil {
 		t.Fatalf("error marshalling tailscaled config")
 	}
 	conf.AppConnector = nil
-	bn, err := json.Marshal(conf)
+	bn, err := jsonv1.Marshal(conf)
 	if err != nil {
 		t.Fatalf("error marshalling tailscaled config")
 	}
@@ -897,11 +897,11 @@ func removeAuthKeyIfExistsModifier(t *testing.T) func(s *corev1.Secret) {
 		t.Helper()
 		if len(secret.StringData["cap-95.hujson"]) != 0 {
 			conf := &ipn.ConfigVAlpha{}
-			if err := json.Unmarshal([]byte(secret.StringData["cap-95.hujson"]), conf); err != nil {
+			if err := jsonv1.Unmarshal([]byte(secret.StringData["cap-95.hujson"]), conf); err != nil {
 				t.Fatalf("error umarshalling 'cap-95.hujson' contents: %v", err)
 			}
 			conf.AuthKey = nil
-			b, err := json.Marshal(conf)
+			b, err := jsonv1.Marshal(conf)
 			if err != nil {
 				t.Fatalf("error marshalling 'cap-95.huson' contents: %v", err)
 			}
@@ -909,11 +909,11 @@ func removeAuthKeyIfExistsModifier(t *testing.T) func(s *corev1.Secret) {
 		}
 		if len(secret.StringData["cap-107.hujson"]) != 0 {
 			conf := &ipn.ConfigVAlpha{}
-			if err := json.Unmarshal([]byte(secret.StringData["cap-107.hujson"]), conf); err != nil {
+			if err := jsonv1.Unmarshal([]byte(secret.StringData["cap-107.hujson"]), conf); err != nil {
 				t.Fatalf("error umarshalling 'cap-107.hujson' contents: %v", err)
 			}
 			conf.AuthKey = nil
-			b, err := json.Marshal(conf)
+			b, err := jsonv1.Marshal(conf)
 			if err != nil {
 				t.Fatalf("error marshalling 'cap-107.huson' contents: %v", err)
 			}
diff --git a/cmd/k8s-operator/tsrecorder.go b/cmd/k8s-operator/tsrecorder.go
index c922f78fe..dcc6b24d9 100644
--- a/cmd/k8s-operator/tsrecorder.go
+++ b/cmd/k8s-operator/tsrecorder.go
@@ -7,7 +7,7 @@ package main
 
 import (
 	"context"
-	"encoding/json"
+	jsonv1 "encoding/json"
 	"errors"
 	"fmt"
 	"net/http"
@@ -433,7 +433,7 @@ func getDevicePrefs(secret *corev1.Secret) (prefs prefs, ok bool, err error) {
 	if !ok {
 		return prefs, false, nil
 	}
-	if err := json.Unmarshal(profileBytes, &prefs); err != nil {
+	if err := jsonv1.Unmarshal(profileBytes, &prefs); err != nil {
 		return prefs, false, fmt.Errorf("failed to extract node profile info from state Secret %s: %w", secret.Name, err)
 	}
 
diff --git a/cmd/k8s-operator/tsrecorder_test.go b/cmd/k8s-operator/tsrecorder_test.go
index 184af2344..76d255ec5 100644
--- a/cmd/k8s-operator/tsrecorder_test.go
+++ b/cmd/k8s-operator/tsrecorder_test.go
@@ -7,7 +7,7 @@ package main
 
 import (
 	"context"
-	"encoding/json"
+	jsonv1 "encoding/json"
 	"strings"
 	"testing"
 
@@ -180,7 +180,7 @@ func TestRecorder(t *testing.T) {
 	})
 
 	t.Run("populate_node_info_in_state_secret_and_see_it_appear_in_status", func(t *testing.T) {
-		bytes, err := json.Marshal(map[string]any{
+		bytes, err := jsonv1.Marshal(map[string]any{
 			"Config": map[string]any{
 				"NodeID": "nodeid-123",
 				"UserProfile": map[string]any{
diff --git a/cmd/natc/ippool/consensusippool.go b/cmd/natc/ippool/consensusippool.go
index 64807b6c2..5fb77ffa8 100644
--- a/cmd/natc/ippool/consensusippool.go
+++ b/cmd/natc/ippool/consensusippool.go
@@ -5,7 +5,7 @@ package ippool
 
 import (
 	"context"
-	"encoding/json"
+	jsonv1 "encoding/json"
 	"errors"
 	"fmt"
 	"log"
@@ -68,7 +68,7 @@ func (ipp *ConsensusIPPool) IPForDomain(nid tailcfg.NodeID, domain string) (neti
 		ReuseDeadline: now.Add(-1 * ipp.unusedAddressLifetime),
 		UpdatedAt:     now,
 	}
-	bs, err := json.Marshal(args)
+	bs, err := jsonv1.Marshal(args)
 	if err != nil {
 		return netip.Addr{}, err
 	}
@@ -86,7 +86,7 @@ func (ipp *ConsensusIPPool) IPForDomain(nid tailcfg.NodeID, domain string) (neti
 		return netip.Addr{}, result.Err
 	}
 	var addr netip.Addr
-	err = json.Unmarshal(result.Result, &addr)
+	err = jsonv1.Unmarshal(result.Result, &addr)
 	return addr, err
 }
 
@@ -230,7 +230,7 @@ type readDomainForIPArgs struct {
 // executeReadDomainForIP parses a readDomainForIP log entry and applies it.
 func (ipp *ConsensusIPPool) executeReadDomainForIP(bs []byte) tsconsensus.CommandResult {
 	var args readDomainForIPArgs
-	err := json.Unmarshal(bs, &args)
+	err := jsonv1.Unmarshal(bs, &args)
 	if err != nil {
 		return tsconsensus.CommandResult{Err: err}
 	}
@@ -249,7 +249,7 @@ func (ipp *ConsensusIPPool) applyReadDomainForIP(from tailcfg.NodeID, addr netip
 		}
 		return ww.Domain
 	}()
-	resultBs, err := json.Marshal(domain)
+	resultBs, err := jsonv1.Marshal(domain)
 	return tsconsensus.CommandResult{Result: resultBs, Err: err}
 }
 
@@ -259,7 +259,7 @@ func (ipp *ConsensusIPPool) readDomainForIP(nid tailcfg.NodeID, addr netip.Addr)
 		NodeID: nid,
 		Addr:   addr,
 	}
-	bs, err := json.Marshal(args)
+	bs, err := jsonv1.Marshal(args)
 	if err != nil {
 		return "", err
 	}
@@ -277,7 +277,7 @@ func (ipp *ConsensusIPPool) readDomainForIP(nid tailcfg.NodeID, addr netip.Addr)
 		return "", result.Err
 	}
 	var domain string
-	err = json.Unmarshal(result.Result, &domain)
+	err = jsonv1.Unmarshal(result.Result, &domain)
 	return domain, err
 }
 
@@ -291,7 +291,7 @@ type markLastUsedArgs struct {
 // executeMarkLastUsed parses a markLastUsed log entry and applies it.
 func (ipp *ConsensusIPPool) executeMarkLastUsed(bs []byte) tsconsensus.CommandResult {
 	var args markLastUsedArgs
-	err := json.Unmarshal(bs, &args)
+	err := jsonv1.Unmarshal(bs, &args)
 	if err != nil {
 		return tsconsensus.CommandResult{Err: err}
 	}
@@ -339,7 +339,7 @@ func (ipp *ConsensusIPPool) markLastUsed(nid tailcfg.NodeID, addr netip.Addr, do
 		Domain:    domain,
 		UpdatedAt: lastUsed,
 	}
-	bs, err := json.Marshal(args)
+	bs, err := jsonv1.Marshal(args)
 	if err != nil {
 		return err
 	}
@@ -369,7 +369,7 @@ type checkoutAddrArgs struct {
 // executeCheckoutAddr parses a checkoutAddr raft log entry and applies it.
 func (ipp *ConsensusIPPool) executeCheckoutAddr(bs []byte) tsconsensus.CommandResult {
 	var args checkoutAddrArgs
-	err := json.Unmarshal(bs, &args)
+	err := jsonv1.Unmarshal(bs, &args)
 	if err != nil {
 		return tsconsensus.CommandResult{Err: err}
 	}
@@ -377,7 +377,7 @@ func (ipp *ConsensusIPPool) executeCheckoutAddr(bs []byte) tsconsensus.CommandRe
 	if err != nil {
 		return tsconsensus.CommandResult{Err: err}
 	}
-	resultBs, err := json.Marshal(addr)
+	resultBs, err := jsonv1.Marshal(addr)
 	if err != nil {
 		return tsconsensus.CommandResult{Err: err}
 	}
@@ -424,7 +424,7 @@ func (ipp *ConsensusIPPool) applyCheckoutAddr(nid tailcfg.NodeID, domain string,
 // Apply is part of the raft.FSM interface. It takes an incoming log entry and applies it to the state.
 func (ipp *ConsensusIPPool) Apply(l *raft.Log) any {
 	var c tsconsensus.Command
-	if err := json.Unmarshal(l.Data, &c); err != nil {
+	if err := jsonv1.Unmarshal(l.Data, &c); err != nil {
 		panic(fmt.Sprintf("failed to unmarshal command: %s", err.Error()))
 	}
 	switch c.Name {
diff --git a/cmd/natc/ippool/consensusippool_test.go b/cmd/natc/ippool/consensusippool_test.go
index 242cdffaf..4d24c195e 100644
--- a/cmd/natc/ippool/consensusippool_test.go
+++ b/cmd/natc/ippool/consensusippool_test.go
@@ -5,7 +5,7 @@ package ippool
 
 import (
 	"bytes"
-	"encoding/json"
+	jsonv1 "encoding/json"
 	"fmt"
 	"io"
 	"net/netip"
@@ -30,7 +30,7 @@ type FakeConsensus struct {
 }
 
 func (c *FakeConsensus) ExecuteCommand(cmd tsconsensus.Command) (tsconsensus.CommandResult, error) {
-	b, err := json.Marshal(cmd)
+	b, err := jsonv1.Marshal(cmd)
 	if err != nil {
 		return tsconsensus.CommandResult{}, err
 	}
@@ -345,7 +345,7 @@ func TestConsensusRestore(t *testing.T) {
 	}
 
 	// restore the snapshot
-	bs, err := json.Marshal(snap)
+	bs, err := jsonv1.Marshal(snap)
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/cmd/natc/ippool/consensusippoolserialize.go b/cmd/natc/ippool/consensusippoolserialize.go
index 97dc02f2c..5f2b82471 100644
--- a/cmd/natc/ippool/consensusippoolserialize.go
+++ b/cmd/natc/ippool/consensusippoolserialize.go
@@ -4,7 +4,7 @@
 package ippool
 
 import (
-	"encoding/json"
+	jsonv1 "encoding/json"
 	"io"
 	"log"
 	"maps"
@@ -73,7 +73,7 @@ func (mipr *persistableIPRange) toIPRange() netipx.IPRange {
 //   - the FSM must discard all previous state before restoring
 func (ipp *ConsensusIPPool) Restore(rc io.ReadCloser) error {
 	var snap fsmSnapshot
-	if err := json.NewDecoder(rc).Decode(&snap); err != nil {
+	if err := jsonv1.NewDecoder(rc).Decode(&snap); err != nil {
 		return err
 	}
 	ipset, ppm, err := snap.getData()
@@ -93,7 +93,7 @@ type fsmSnapshot struct {
 // Persist is part of the raft.FSMSnapshot interface
 // According to the docs Persist may be called concurrently with Apply
 func (f fsmSnapshot) Persist(sink raft.SnapshotSink) error {
-	if err := json.NewEncoder(sink).Encode(f); err != nil {
+	if err := jsonv1.NewEncoder(sink).Encode(f); err != nil {
 		log.Printf("Error encoding snapshot as JSON: %v", err)
 		return sink.Cancel()
 	}
diff --git a/cmd/natc/natc.go b/cmd/natc/natc.go
index a4f53d657..93258c365 100644
--- a/cmd/natc/natc.go
+++ b/cmd/natc/natc.go
@@ -8,7 +8,7 @@ package main
 
 import (
 	"context"
-	"encoding/json"
+	jsonv1 "encoding/json"
 	"errors"
 	"expvar"
 	"flag"
@@ -652,7 +652,7 @@ func httpClusterAdmin(ipp *ippool.ConsensusIPPool) http.Handler {
 			http.Error(w, "", http.StatusInternalServerError)
 			return
 		}
-		if err := json.NewEncoder(w).Encode(c); err != nil {
+		if err := jsonv1.NewEncoder(w).Encode(c); err != nil {
 			log.Printf("cluster admin http: error encoding raft configuration: %v", err)
 		}
 	})
@@ -664,7 +664,7 @@ func httpClusterAdmin(ipp *ippool.ConsensusIPPool) http.Handler {
 			http.Error(w, err.Error(), http.StatusInternalServerError)
 			return
 		}
-		if err := json.NewEncoder(w).Encode(idx); err != nil {
+		if err := jsonv1.NewEncoder(w).Encode(idx); err != nil {
 			log.Printf("cluster admin http: error encoding delete index: %v", err)
 			return
 		}
diff --git a/cmd/netlogfmt/main.go b/cmd/netlogfmt/main.go
index 65e87098f..f948d00d7 100644
--- a/cmd/netlogfmt/main.go
+++ b/cmd/netlogfmt/main.go
@@ -27,7 +27,7 @@ package main
 import (
 	"cmp"
 	"encoding/base64"
-	"encoding/json"
+	jsonv1 "encoding/json"
 	"flag"
 	"fmt"
 	"io"
@@ -305,7 +305,7 @@ func mustMakeNamesByAddr() map[netip.Addr]string {
 			Addrs []netip.Addr `json:"addresses"`
 		} `json:"devices"`
 	}
-	must.Do(json.Unmarshal(b, &m))
+	must.Do(jsonv1.Unmarshal(b, &m))
 
 	// Construct a unique mapping of Tailscale IP addresses to hostnames.
 	// For brevity, we start with the first segment of the name and
diff --git a/cmd/sniproxy/sniproxy_test.go b/cmd/sniproxy/sniproxy_test.go
index cd2e070bd..2efe040e3 100644
--- a/cmd/sniproxy/sniproxy_test.go
+++ b/cmd/sniproxy/sniproxy_test.go
@@ -5,7 +5,7 @@ package main
 
 import (
 	"context"
-	"encoding/json"
+	jsonv1 "encoding/json"
 	"flag"
 	"fmt"
 	"log"
@@ -144,7 +144,7 @@ func TestSNIProxyWithNetmapConfig(t *testing.T) {
 			},
 		},
 	}
-	b, err := json.Marshal(config)
+	b, err := jsonv1.Marshal(config)
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/cmd/stunstamp/stunstamp.go b/cmd/stunstamp/stunstamp.go
index 71ed50569..91ec81797 100644
--- a/cmd/stunstamp/stunstamp.go
+++ b/cmd/stunstamp/stunstamp.go
@@ -9,7 +9,7 @@ import (
 	"cmp"
 	"context"
 	"crypto/tls"
-	"encoding/json"
+	jsonv1 "encoding/json"
 	"errors"
 	"flag"
 	"fmt"
@@ -80,7 +80,7 @@ func getDERPMap(ctx context.Context, url string) (*tailcfg.DERPMap, error) {
 		return nil, fmt.Errorf("non-200 derp map resp: %d", resp.StatusCode)
 	}
 	dm := tailcfg.DERPMap{}
-	err = json.NewDecoder(resp.Body).Decode(&dm)
+	err = jsonv1.NewDecoder(resp.Body).Decode(&dm)
 	if err != nil {
 		return nil, fmt.Errorf("failed to decode derp map resp: %v", err)
 	}
diff --git a/cmd/tailscale/cli/appcroutes.go b/cmd/tailscale/cli/appcroutes.go
index 4a1ba87e3..2317415ba 100644
--- a/cmd/tailscale/cli/appcroutes.go
+++ b/cmd/tailscale/cli/appcroutes.go
@@ -5,7 +5,7 @@ package cli
 
 import (
 	"context"
-	"encoding/json"
+	jsonv1 "encoding/json"
 	"flag"
 	"fmt"
 	"slices"
@@ -52,11 +52,11 @@ https://tailscale.com/kb/1281/app-connectors
 }
 
 func getAllOutput(ri *appctype.RouteInfo) (string, error) {
-	domains, err := json.MarshalIndent(ri.Domains, " ", "  ")
+	domains, err := jsonv1.MarshalIndent(ri.Domains, " ", "  ")
 	if err != nil {
 		return "", err
 	}
-	control, err := json.MarshalIndent(ri.Control, " ", "  ")
+	control, err := jsonv1.MarshalIndent(ri.Control, " ", "  ")
 	if err != nil {
 		return "", err
 	}
@@ -131,7 +131,7 @@ func runAppcRoutesInfo(ctx context.Context, args []string) error {
 	}
 
 	if appcRoutesArgs.domainMap {
-		domains, err := json.Marshal(routeInfo.Domains)
+		domains, err := jsonv1.Marshal(routeInfo.Domains)
 		if err != nil {
 			return err
 		}
diff --git a/cmd/tailscale/cli/cli.go b/cmd/tailscale/cli/cli.go
index 5ebc23a5b..591eefa57 100644
--- a/cmd/tailscale/cli/cli.go
+++ b/cmd/tailscale/cli/cli.go
@@ -7,7 +7,7 @@ package cli
 
 import (
 	"context"
-	"encoding/json"
+	jsonv1 "encoding/json"
 	"errors"
 	"flag"
 	"fmt"
@@ -505,7 +505,7 @@ type flagDoc struct {
 
 func printJSONDocs(root *ffcli.Command) error {
 	docs := jsonDocsWalk(root)
-	return json.NewEncoder(os.Stdout).Encode(docs)
+	return jsonv1.NewEncoder(os.Stdout).Encode(docs)
 }
 
 func jsonDocsWalk(cmd *ffcli.Command) *commandDoc {
diff --git a/cmd/tailscale/cli/cli_test.go b/cmd/tailscale/cli/cli_test.go
index 2e1bec8c9..efdc395a1 100644
--- a/cmd/tailscale/cli/cli_test.go
+++ b/cmd/tailscale/cli/cli_test.go
@@ -6,7 +6,7 @@ package cli
 import (
 	"bytes"
 	stdcmp "cmp"
-	"encoding/json"
+	jsonv1 "encoding/json"
 	"flag"
 	"fmt"
 	"io"
@@ -905,8 +905,8 @@ func TestPrefsFromUpArgs(t *testing.T) {
 				t.Fatal("tt.want is nil")
 			}
 			if !got.Equals(tt.want) {
-				jgot, _ := json.MarshalIndent(got, "", "\t")
-				jwant, _ := json.MarshalIndent(tt.want, "", "\t")
+				jgot, _ := jsonv1.MarshalIndent(got, "", "\t")
+				jwant, _ := jsonv1.MarshalIndent(tt.want, "", "\t")
 				if bytes.Equal(jgot, jwant) {
 					t.Logf("prefs differ only in non-JSON-visible ways (nil/non-nil zero-length arrays)")
 				}
diff --git a/cmd/tailscale/cli/configure-synology-cert.go b/cmd/tailscale/cli/configure-synology-cert.go
index b5168ef92..b3ca8caec 100644
--- a/cmd/tailscale/cli/configure-synology-cert.go
+++ b/cmd/tailscale/cli/configure-synology-cert.go
@@ -7,7 +7,7 @@ package cli
 
 import (
 	"context"
-	"encoding/json"
+	jsonv1 "encoding/json"
 	"errors"
 	"flag"
 	"fmt"
@@ -153,7 +153,7 @@ func listCerts(ctx context.Context, c synoAPICaller) ([]certificateInfo, error)
 	var payload struct {
 		Certificates []certificateInfo `json:"certificates"`
 	}
-	if err := json.Unmarshal(rawData, &payload); err != nil {
+	if err := jsonv1.Unmarshal(rawData, &payload); err != nil {
 		return nil, fmt.Errorf("decoding certificate list response payload: %w", err)
 	}
 
@@ -179,7 +179,7 @@ func uploadCert(ctx context.Context, c synoAPICaller, certFile, keyFile string,
 	var payload struct {
 		NewID string `json:"id"`
 	}
-	if err := json.Unmarshal(rawData, &payload); err != nil {
+	if err := jsonv1.Unmarshal(rawData, &payload); err != nil {
 		return fmt.Errorf("decoding certificate upload response payload: %w", err)
 	}
 	log.Printf("Tailnet Certificate uploaded with ID %q.", payload.NewID)
@@ -189,13 +189,13 @@ func uploadCert(ctx context.Context, c synoAPICaller, certFile, keyFile string,
 }
 
 type synoAPICaller interface {
-	Call(context.Context, string, string, map[string]string) (json.RawMessage, error)
+	Call(context.Context, string, string, map[string]string) (jsonv1.RawMessage, error)
 }
 
 type apiResponse struct {
-	Success bool            `json:"success"`
-	Error   *apiError       `json:"error,omitempty"`
-	Data    json.RawMessage `json:"data"`
+	Success bool              `json:"success"`
+	Error   *apiError         `json:"error,omitempty"`
+	Data    jsonv1.RawMessage `json:"data"`
 }
 
 type apiError struct {
@@ -206,7 +206,7 @@ type apiError struct {
 // synowebapiCommand implements synoAPICaller using the /usr/syno/bin/synowebapi binary. Must be run as root.
 type synowebapiCommand struct{}
 
-func (s synowebapiCommand) Call(ctx context.Context, api, method string, params map[string]string) (json.RawMessage, error) {
+func (s synowebapiCommand) Call(ctx context.Context, api, method string, params map[string]string) (jsonv1.RawMessage, error) {
 	args := []string{"--exec", fmt.Sprintf("api=%s", api), fmt.Sprintf("method=%s", method)}
 
 	for k, v := range params {
@@ -219,7 +219,7 @@ func (s synowebapiCommand) Call(ctx context.Context, api, method string, params
 	}
 
 	var payload apiResponse
-	if err := json.Unmarshal(out, &payload); err != nil {
+	if err := jsonv1.Unmarshal(out, &payload); err != nil {
 		return nil, fmt.Errorf("decoding response json from %q method of %q API: %w", method, api, err)
 	}
 
diff --git a/cmd/tailscale/cli/configure-synology-cert_test.go b/cmd/tailscale/cli/configure-synology-cert_test.go
index c7da5622f..1fb3fab2a 100644
--- a/cmd/tailscale/cli/configure-synology-cert_test.go
+++ b/cmd/tailscale/cli/configure-synology-cert_test.go
@@ -7,18 +7,18 @@ package cli
 
 import (
 	"context"
-	"encoding/json"
+	jsonv1 "encoding/json"
 	"fmt"
 	"reflect"
 	"testing"
 )
 
 type fakeAPICaller struct {
-	Data  json.RawMessage
+	Data  jsonv1.RawMessage
 	Error error
 }
 
-func (c fakeAPICaller) Call(_ context.Context, _, _ string, _ map[string]string) (json.RawMessage, error) {
+func (c fakeAPICaller) Call(_ context.Context, _, _ string, _ map[string]string) (jsonv1.RawMessage, error) {
 	return c.Data, c.Error
 }
 
@@ -32,7 +32,7 @@ func Test_listCerts(t *testing.T) {
 		{
 			name: "normal response",
 			caller: fakeAPICaller{
-				Data: json.RawMessage(`{
+				Data: jsonv1.RawMessage(`{
 "certificates" : [
 	{
 		"desc" : "Tailnet Certificate",
@@ -123,7 +123,7 @@ func Test_listCerts(t *testing.T) {
 		},
 		{
 			name:    "payload decode error",
-			caller:  fakeAPICaller{json.RawMessage("This isn't JSON!"), nil},
+			caller:  fakeAPICaller{jsonv1.RawMessage("This isn't JSON!"), nil},
 			wantErr: true,
 		},
 	}
diff --git a/cmd/tailscale/cli/debug.go b/cmd/tailscale/cli/debug.go
index 2836ae298..532a2efc8 100644
--- a/cmd/tailscale/cli/debug.go
+++ b/cmd/tailscale/cli/debug.go
@@ -9,7 +9,7 @@ import (
 	"cmp"
 	"context"
 	"encoding/binary"
-	"encoding/json"
+	jsonv1 "encoding/json"
 	"errors"
 	"flag"
 	"fmt"
@@ -387,7 +387,7 @@ func runGoBuildInfo(ctx context.Context, args []string) error {
 	if !ok {
 		return errors.New("no Go build info")
 	}
-	e := json.NewEncoder(os.Stdout)
+	e := jsonv1.NewEncoder(os.Stdout)
 	e.SetIndent("", "\t")
 	return e.Encode(bi)
 }
@@ -453,7 +453,7 @@ func runDebug(ctx context.Context, args []string) error {
 			if err != nil {
 				fatalf("%v\n", err)
 			}
-			e := json.NewEncoder(Stdout)
+			e := jsonv1.NewEncoder(Stdout)
 			e.SetIndent("", "\t")
 			e.Encode(wfs)
 			return nil
@@ -607,7 +607,7 @@ func runPrefs(ctx context.Context, args []string) error {
 	if prefsArgs.pretty {
 		outln(prefs.Pretty())
 	} else {
-		j, _ := json.MarshalIndent(prefs, "", "\t")
+		j, _ := jsonv1.MarshalIndent(prefs, "", "\t")
 		outln(string(j))
 	}
 	return nil
@@ -646,7 +646,7 @@ func runWatchIPN(ctx context.Context, args []string) error {
 		if !watchIPNArgs.netmap {
 			n.NetMap = nil
 		}
-		j, _ := json.MarshalIndent(n, "", "\t")
+		j, _ := jsonv1.MarshalIndent(n, "", "\t")
 		fmt.Printf("%s\n", j)
 	}
 	return nil
@@ -674,7 +674,7 @@ func runNetmap(ctx context.Context, args []string) error {
 	if err != nil {
 		return err
 	}
-	j, _ := json.MarshalIndent(n.NetMap, "", "\t")
+	j, _ := jsonv1.MarshalIndent(n.NetMap, "", "\t")
 	fmt.Printf("%s\n", j)
 	return nil
 }
@@ -686,7 +686,7 @@ func runDERPMap(ctx context.Context, args []string) error {
 			"failed to get local derp map, instead `curl %s/derpmap/default`: %w", ipn.DefaultControlURL, err,
 		)
 	}
-	enc := json.NewEncoder(Stdout)
+	enc := jsonv1.NewEncoder(Stdout)
 	enc.SetIndent("", "\t")
 	enc.Encode(dm)
 	return nil
@@ -701,7 +701,7 @@ func forcePreferDERP(ctx context.Context, args []string) error {
 	if err != nil {
 		return fmt.Errorf("expected exactly one integer argument: %w", err)
 	}
-	b, err := json.Marshal(n)
+	b, err := jsonv1.Marshal(n)
 	if err != nil {
 		return fmt.Errorf("failed to marshal DERP region: %w", err)
 	}
@@ -765,7 +765,7 @@ func runStat(ctx context.Context, args []string) error {
 
 func runHostinfo(ctx context.Context, args []string) error {
 	hi := hostinfo.New()
-	j, _ := json.MarshalIndent(hi, "", "  ")
+	j, _ := jsonv1.MarshalIndent(hi, "", "  ")
 	Stdout.Write(j)
 	return nil
 }
@@ -789,7 +789,7 @@ func runDaemonLogs(ctx context.Context, args []string) error {
 	if err != nil {
 		return err
 	}
-	d := json.NewDecoder(logs)
+	d := jsonv1.NewDecoder(logs)
 	for {
 		var line struct {
 			Text    string `json:"text"`
@@ -837,7 +837,7 @@ func runDaemonBusGraph(ctx context.Context, args []string) error {
 	}
 	if daemonBusGraphArgs.format == "dot" {
 		var topics eventbus.DebugTopics
-		if err := json.Unmarshal(graph, &topics); err != nil {
+		if err := jsonv1.Unmarshal(graph, &topics); err != nil {
 			return fmt.Errorf("unable to parse json: %w", err)
 		}
 		fmt.Print(generateDOTGraph(topics.Topics))
@@ -1019,7 +1019,7 @@ func runTS2021(ctx context.Context, args []string) error {
 		log.Printf("Status: %v", res.Status)
 		return errors.New(res.Status)
 	}
-	if err := json.NewDecoder(res.Body).Decode(&keys); err != nil {
+	if err := jsonv1.NewDecoder(res.Body).Decode(&keys); err != nil {
 		log.Printf("JSON: %v", err)
 		return fmt.Errorf("decoding /keys JSON: %w", err)
 	}
@@ -1061,7 +1061,7 @@ func runTS2021(ctx context.Context, args []string) error {
 			return fmt.Errorf("reading dial plan JSON file: %w", err)
 		}
 		dialPlan = new(tailcfg.ControlDialPlan)
-		if err := json.Unmarshal(b, dialPlan); err != nil {
+		if err := jsonv1.Unmarshal(b, dialPlan); err != nil {
 			return fmt.Errorf("unmarshaling dial plan JSON file: %w", err)
 		}
 	} else if ts2021Args.aceHost != "" {
@@ -1203,7 +1203,7 @@ func runDebugDERP(ctx context.Context, args []string) error {
 	if err != nil {
 		return err
 	}
-	fmt.Printf("%s\n", must.Get(json.MarshalIndent(st, "", " ")))
+	fmt.Printf("%s\n", must.Get(jsonv1.MarshalIndent(st, "", " ")))
 	return nil
 }
 
@@ -1265,7 +1265,7 @@ func runPeerEndpointChanges(ctx context.Context, args []string) error {
 	}
 
 	var dst bytes.Buffer
-	if err := json.Indent(&dst, body, "", "  "); err != nil {
+	if err := jsonv1.Indent(&dst, body, "", "  "); err != nil {
 		return fmt.Errorf("indenting returned JSON: %w", err)
 	}
 
@@ -1284,7 +1284,7 @@ func debugControlKnobs(ctx context.Context, args []string) error {
 	if err != nil {
 		return err
 	}
-	e := json.NewEncoder(os.Stdout)
+	e := jsonv1.NewEncoder(os.Stdout)
 	e.SetIndent("", "  ")
 	e.Encode(v)
 	return nil
@@ -1379,7 +1379,7 @@ func runPeerRelayServers(ctx context.Context, args []string) error {
 	if err != nil {
 		return err
 	}
-	e := json.NewEncoder(os.Stdout)
+	e := jsonv1.NewEncoder(os.Stdout)
 	e.SetIndent("", "  ")
 	e.Encode(v)
 	return nil
diff --git a/cmd/tailscale/cli/netcheck.go b/cmd/tailscale/cli/netcheck.go
index 5ae8db8fa..823cbcd8c 100644
--- a/cmd/tailscale/cli/netcheck.go
+++ b/cmd/tailscale/cli/netcheck.go
@@ -5,7 +5,7 @@ package cli
 
 import (
 	"context"
-	"encoding/json"
+	jsonv1 "encoding/json"
 	"flag"
 	"fmt"
 	"io"
@@ -135,9 +135,9 @@ func printReport(dm *tailcfg.DERPMap, report *netcheck.Report) error {
 	switch netcheckArgs.format {
 	case "":
 	case "json":
-		j, err = json.MarshalIndent(report, "", "\t")
+		j, err = jsonv1.MarshalIndent(report, "", "\t")
 	case "json-line":
-		j, err = json.Marshal(report)
+		j, err = jsonv1.Marshal(report)
 	default:
 		return fmt.Errorf("unknown output format %q", netcheckArgs.format)
 	}
@@ -256,7 +256,7 @@ func prodDERPMap(ctx context.Context, httpc *http.Client) (*tailcfg.DERPMap, err
 		return nil, fmt.Errorf("fetch prodDERPMap: %v: %s", res.Status, b)
 	}
 	var derpMap tailcfg.DERPMap
-	if err = json.Unmarshal(b, &derpMap); err != nil {
+	if err = jsonv1.Unmarshal(b, &derpMap); err != nil {
 		return nil, fmt.Errorf("fetch prodDERPMap: %w", err)
 	}
 	return &derpMap, nil
diff --git a/cmd/tailscale/cli/network-lock.go b/cmd/tailscale/cli/network-lock.go
index a15d9ab88..78b823d3b 100644
--- a/cmd/tailscale/cli/network-lock.go
+++ b/cmd/tailscale/cli/network-lock.go
@@ -10,7 +10,7 @@ import (
 	"context"
 	"crypto/rand"
 	"encoding/hex"
-	"encoding/json"
+	jsonv1 "encoding/json"
 	"errors"
 	"flag"
 	"fmt"
@@ -219,7 +219,7 @@ func runNetworkLockStatus(ctx context.Context, args []string) error {
 	}
 
 	if nlStatusArgs.json {
-		enc := json.NewEncoder(os.Stdout)
+		enc := jsonv1.NewEncoder(os.Stdout)
 		enc.SetIndent("", "  ")
 		return enc.Encode(st)
 	}
@@ -678,7 +678,7 @@ func nlDescribeUpdate(update ipnstate.NetworkLockUpdate, color bool) (string, er
 
 	default:
 		// Print a JSON encoding of the AUM as a fallback.
-		e := json.NewEncoder(&stanza)
+		e := jsonv1.NewEncoder(&stanza)
 		e.SetIndent("", "\t")
 		if err := e.Encode(aum); err != nil {
 			return "", err
@@ -703,7 +703,7 @@ func runNetworkLockLog(ctx context.Context, args []string) error {
 		return fixTailscaledConnectError(err)
 	}
 	if nlLogArgs.json {
-		enc := json.NewEncoder(Stdout)
+		enc := jsonv1.NewEncoder(Stdout)
 		enc.SetIndent("", "  ")
 		return enc.Encode(updates)
 	}
diff --git a/cmd/tailscale/cli/serve_legacy.go b/cmd/tailscale/cli/serve_legacy.go
index 5c2d8eefa..f81184f95 100644
--- a/cmd/tailscale/cli/serve_legacy.go
+++ b/cmd/tailscale/cli/serve_legacy.go
@@ -7,7 +7,7 @@ package cli
 
 import (
 	"context"
-	"encoding/json"
+	jsonv1 "encoding/json"
 	"errors"
 	"flag"
 	"fmt"
@@ -238,7 +238,7 @@ func (e *serveEnv) runServe(ctx context.Context, args []string) error {
 			return err
 		}
 		sc := new(ipn.ServeConfig)
-		if err := json.Unmarshal(valb, sc); err != nil {
+		if err := jsonv1.Unmarshal(valb, sc); err != nil {
 			return fmt.Errorf("invalid JSON: %w", err)
 		}
 		return e.lc.SetServeConfig(ctx, sc)
@@ -617,7 +617,7 @@ func (e *serveEnv) runServeStatus(ctx context.Context, args []string) error {
 		return err
 	}
 	if e.json {
-		j, err := json.MarshalIndent(sc, "", "  ")
+		j, err := jsonv1.MarshalIndent(sc, "", "  ")
 		if err != nil {
 			return err
 		}
diff --git a/cmd/tailscale/cli/serve_v2.go b/cmd/tailscale/cli/serve_v2.go
index 74458a950..6970819b9 100644
--- a/cmd/tailscale/cli/serve_v2.go
+++ b/cmd/tailscale/cli/serve_v2.go
@@ -7,7 +7,7 @@ package cli
 
 import (
 	"context"
-	"encoding/json"
+	jsonv1 "encoding/json"
 	"errors"
 	"flag"
 	"fmt"
@@ -368,7 +368,7 @@ func (e *serveEnv) runServeCombined(subcmd serveMode) execFunc {
 				return err
 			}
 			sc := new(ipn.ServeConfig)
-			if err := json.Unmarshal(valb, sc); err != nil {
+			if err := jsonv1.Unmarshal(valb, sc); err != nil {
 				return fmt.Errorf("invalid JSON: %w", err)
 			}
 			return e.lc.SetServeConfig(ctx, sc)
@@ -755,7 +755,7 @@ func (e *serveEnv) runServeGetConfig(ctx context.Context, args []string) (err er
 			}
 			mak.Set(&scf.Services, svcName, sdf)
 		}
-		j, err = json.MarshalIndent(scf, "", "  ")
+		j, err = jsonv1.MarshalIndent(scf, "", "  ")
 		if err != nil {
 			return err
 		}
@@ -769,7 +769,7 @@ func (e *serveEnv) runServeGetConfig(ctx context.Context, args []string) (err er
 				return err
 			}
 			sdf.Version = "0.0.1"
-			j, err = json.MarshalIndent(sdf, "", "  ")
+			j, err = jsonv1.MarshalIndent(sdf, "", "  ")
 			if err != nil {
 				return err
 			}
diff --git a/cmd/tailscale/cli/serve_v2_test.go b/cmd/tailscale/cli/serve_v2_test.go
index 7f7f2c37c..a5a8fb4f0 100644
--- a/cmd/tailscale/cli/serve_v2_test.go
+++ b/cmd/tailscale/cli/serve_v2_test.go
@@ -6,7 +6,7 @@ package cli
 import (
 	"bytes"
 	"context"
-	"encoding/json"
+	jsonv1 "encoding/json"
 	"fmt"
 	"net/netip"
 	"os"
@@ -966,8 +966,8 @@ func TestServeDevConfigMutations(t *testing.T) {
 					got = lc.config
 				}
 				if !reflect.DeepEqual(got, st.want) {
-					gotbts, _ := json.MarshalIndent(got, "", "\t")
-					wantbts, _ := json.MarshalIndent(st.want, "", "\t")
+					gotbts, _ := jsonv1.MarshalIndent(got, "", "\t")
+					wantbts, _ := jsonv1.MarshalIndent(st.want, "", "\t")
 					t.Fatalf("step: %d, cmd: %v, diff:\n%s", i, st.command, cmp.Diff(string(gotbts), string(wantbts)))
 
 				}
@@ -1484,7 +1484,7 @@ func TestMessageForPort(t *testing.T) {
 			netip.MustParseAddr("fd7a:115c:a1e0:ab12:4843:cd96:6565:6565"),
 		},
 	}
-	svcIPMapJSON, _ := json.Marshal(svcIPMap)
+	svcIPMapJSON, _ := jsonv1.Marshal(svcIPMap)
 	svcIPMapJSONRawMSG := tailcfg.RawMessage(svcIPMapJSON)
 
 	tests := []struct {
diff --git a/cmd/tailscale/cli/status.go b/cmd/tailscale/cli/status.go
index 89b18335b..5c9f9f6e2 100644
--- a/cmd/tailscale/cli/status.go
+++ b/cmd/tailscale/cli/status.go
@@ -6,7 +6,7 @@ package cli
 import (
 	"cmp"
 	"context"
-	"encoding/json"
+	jsonv1 "encoding/json"
 	"errors"
 	"flag"
 	"fmt"
@@ -94,7 +94,7 @@ func runStatus(ctx context.Context, args []string) error {
 				}
 			}
 		}
-		j, err := json.MarshalIndent(st, "", "  ")
+		j, err := jsonv1.MarshalIndent(st, "", "  ")
 		if err != nil {
 			return err
 		}
diff --git a/cmd/tailscale/cli/syspolicy.go b/cmd/tailscale/cli/syspolicy.go
index 97f3f2122..07fb1e6ea 100644
--- a/cmd/tailscale/cli/syspolicy.go
+++ b/cmd/tailscale/cli/syspolicy.go
@@ -7,7 +7,7 @@ package cli
 
 import (
 	"context"
-	"encoding/json"
+	jsonv1 "encoding/json"
 	"flag"
 	"fmt"
 	"os"
@@ -80,7 +80,7 @@ func runSysPolicyReload(ctx context.Context, args []string) error {
 
 func printPolicySettings(policy *setting.Snapshot) {
 	if syspolicyArgs.json {
-		json, err := json.MarshalIndent(policy, "", "\t")
+		json, err := jsonv1.MarshalIndent(policy, "", "\t")
 		if err != nil {
 			errf("syspolicy marshalling error: %v", err)
 		} else {
diff --git a/cmd/tailscale/cli/up.go b/cmd/tailscale/cli/up.go
index 91a6b6087..7cfdef988 100644
--- a/cmd/tailscale/cli/up.go
+++ b/cmd/tailscale/cli/up.go
@@ -6,7 +6,7 @@ package cli
 import (
 	"context"
 	"encoding/base64"
-	"encoding/json"
+	jsonv1 "encoding/json"
 	"errors"
 	"flag"
 	"fmt"
@@ -729,7 +729,7 @@ func runUp(ctx context.Context, cmd string, args []string, upArgs upArgsT) (retE
 						}
 					}
 
-					data, err := json.MarshalIndent(js, "", "\t")
+					data, err := jsonv1.MarshalIndent(js, "", "\t")
 					if err != nil {
 						printf("upOutputJSON marshalling error: %v", err)
 					} else {
@@ -848,7 +848,7 @@ func checkUpWarnings(ctx context.Context) {
 
 func printUpDoneJSON(state ipn.State, errorString string) {
 	js := &upOutputJSON{BackendState: state.String(), Error: errorString}
-	data, err := json.MarshalIndent(js, "", "  ")
+	data, err := jsonv1.MarshalIndent(js, "", "  ")
 	if err != nil {
 		log.Printf("printUpDoneJSON marshalling error: %v", err)
 	} else {
diff --git a/cmd/tailscale/cli/version.go b/cmd/tailscale/cli/version.go
index b25502d5a..505b60c3c 100644
--- a/cmd/tailscale/cli/version.go
+++ b/cmd/tailscale/cli/version.go
@@ -5,7 +5,7 @@ package cli
 
 import (
 	"context"
-	"encoding/json"
+	jsonv1 "encoding/json"
 	"flag"
 	"fmt"
 
@@ -69,7 +69,7 @@ func runVersion(ctx context.Context, args []string) error {
 			Meta:     m,
 			Upstream: upstreamVer,
 		}
-		e := json.NewEncoder(Stdout)
+		e := jsonv1.NewEncoder(Stdout)
 		e.SetIndent("", "\t")
 		return e.Encode(out)
 	}
diff --git a/cmd/tailscale/cli/whois.go b/cmd/tailscale/cli/whois.go
index 44ff68dec..bb3c86e3d 100644
--- a/cmd/tailscale/cli/whois.go
+++ b/cmd/tailscale/cli/whois.go
@@ -5,7 +5,7 @@ package cli
 
 import (
 	"context"
-	"encoding/json"
+	jsonv1 "encoding/json"
 	"errors"
 	"flag"
 	"fmt"
@@ -47,7 +47,7 @@ func runWhoIs(ctx context.Context, args []string) error {
 		return err
 	}
 	if whoIsArgs.json {
-		ec := json.NewEncoder(Stdout)
+		ec := jsonv1.NewEncoder(Stdout)
 		ec.SetIndent("", "  ")
 		ec.Encode(who)
 		return nil
@@ -77,7 +77,7 @@ func runWhoIs(ctx context.Context, args []string) error {
 			// To make the output more readable, we have to reindent the JSON
 			// values so they line up with the cap name.
 			if len(vals) > 0 {
-				v, _ := json.MarshalIndent(vals, "      ", "  ")
+				v, _ := jsonv1.MarshalIndent(vals, "      ", "  ")
 
 				printf("  - %s:\n", cap)
 				printf("      %s\n", v)
diff --git a/cmd/tailscaled/debug.go b/cmd/tailscaled/debug.go
index b16cb28e0..06d368a56 100644
--- a/cmd/tailscaled/debug.go
+++ b/cmd/tailscaled/debug.go
@@ -8,7 +8,7 @@ package main
 import (
 	"context"
 	"crypto/tls"
-	"encoding/json"
+	jsonv1 "encoding/json"
 	"errors"
 	"flag"
 	"fmt"
@@ -103,7 +103,7 @@ func runMonitor(ctx context.Context, loop bool) error {
 	defer b.Close()
 
 	dump := func(st *netmon.State) {
-		j, _ := json.MarshalIndent(st, "", "    ")
+		j, _ := jsonv1.MarshalIndent(st, "", "    ")
 		os.Stderr.Write(j)
 	}
 	mon, err := netmon.New(b, log.Printf)
@@ -232,7 +232,7 @@ func checkDerp(ctx context.Context, derpRegion string) (err error) {
 		return fmt.Errorf("fetch derp map: %v: %s", res.Status, b)
 	}
 	var dmap tailcfg.DERPMap
-	if err = json.Unmarshal(b, &dmap); err != nil {
+	if err = jsonv1.Unmarshal(b, &dmap); err != nil {
 		return fmt.Errorf("fetch DERP map: %w", err)
 	}
 	getRegion := func() *tailcfg.DERPRegion {
diff --git a/cmd/tailscaled/tailscaled_windows.go b/cmd/tailscaled/tailscaled_windows.go
index 3019bbaf9..37c7130f3 100644
--- a/cmd/tailscaled/tailscaled_windows.go
+++ b/cmd/tailscaled/tailscaled_windows.go
@@ -21,7 +21,7 @@ package main // import "tailscale.com/cmd/tailscaled"
 import (
 	"bufio"
 	"context"
-	"encoding/json"
+	jsonv1 "encoding/json"
 	"errors"
 	"fmt"
 	"io"
@@ -380,7 +380,7 @@ func beFirewallKillswitch() bool {
 	// Note(maisem): when local lan access toggled, tailscaled needs to
 	// inform the firewall to let local routes through. The set of routes
 	// is passed in via stdin encoded in json.
-	dcd := json.NewDecoder(os.Stdin)
+	dcd := jsonv1.NewDecoder(os.Stdin)
 	for {
 		var routes []netip.Prefix
 		if err := dcd.Decode(&routes); err != nil {
diff --git a/cmd/testwrapper/testwrapper.go b/cmd/testwrapper/testwrapper.go
index 173edee73..246bcd28a 100644
--- a/cmd/testwrapper/testwrapper.go
+++ b/cmd/testwrapper/testwrapper.go
@@ -12,7 +12,7 @@ import (
 	"bytes"
 	"cmp"
 	"context"
-	"encoding/json"
+	jsonv1 "encoding/json"
 	"errors"
 	"fmt"
 	"io"
@@ -112,7 +112,7 @@ func runTests(ctx context.Context, attempt int, pt *packageTests, goTestArgs, te
 	resultMap := make(map[string]map[string]*testAttempt) // pkg -> test -> testAttempt
 	for s.Scan() {
 		var goOutput goTestOutput
-		if err := json.Unmarshal(s.Bytes(), &goOutput); err != nil {
+		if err := jsonv1.Unmarshal(s.Bytes(), &goOutput); err != nil {
 			return fmt.Errorf("failed to parse go test output %q: %w", s.Bytes(), err)
 		}
 		pkg := cmp.Or(
@@ -265,7 +265,7 @@ func main() {
 			os.Exit(1)
 		}
 		if thisRun.attempt > 1 {
-			j, _ := json.Marshal(thisRun.tests)
+			j, _ := jsonv1.Marshal(thisRun.tests)
 			fmt.Printf("\n\nAttempt #%d: Retrying flaky tests:\n\nflakytest failures JSON: %s\n\n", thisRun.attempt, j)
 		}
 
@@ -326,7 +326,7 @@ func main() {
 				if len(fatalFailures) > 0 {
 					tests := slicesx.MapKeys(fatalFailures)
 					sort.Strings(tests)
-					j, _ := json.Marshal(tests)
+					j, _ := jsonv1.Marshal(tests)
 					fmt.Printf("non-flakytest failures: %s\n", j)
 				}
 				fmt.Println()
diff --git a/cmd/tsconnect/build-pkg.go b/cmd/tsconnect/build-pkg.go
index 047504858..32a480362 100644
--- a/cmd/tsconnect/build-pkg.go
+++ b/cmd/tsconnect/build-pkg.go
@@ -6,7 +6,7 @@
 package main
 
 import (
-	"encoding/json"
+	jsonv1 "encoding/json"
 	"fmt"
 	"log"
 	"os"
@@ -77,12 +77,12 @@ func updateVersion() error {
 	if err != nil {
 		return fmt.Errorf("Could not standardize template package.json: %w", err)
 	}
-	if err := json.Unmarshal(packageJSONBytes, &packageJSON); err != nil {
+	if err := jsonv1.Unmarshal(packageJSONBytes, &packageJSON); err != nil {
 		return fmt.Errorf("Could not unmarshal package.json: %w", err)
 	}
 	packageJSON["version"] = version.Long()
 
-	packageJSONBytes, err = json.MarshalIndent(packageJSON, "", "  ")
+	packageJSONBytes, err = jsonv1.MarshalIndent(packageJSON, "", "  ")
 	if err != nil {
 		return fmt.Errorf("Could not marshal package.json: %w", err)
 	}
diff --git a/cmd/tsconnect/build.go b/cmd/tsconnect/build.go
index 364ebf536..6e12ed5f5 100644
--- a/cmd/tsconnect/build.go
+++ b/cmd/tsconnect/build.go
@@ -6,7 +6,7 @@
 package main
 
 import (
-	"encoding/json"
+	jsonv1 "encoding/json"
 	"fmt"
 	"log"
 	"os"
@@ -61,7 +61,7 @@ func runBuild() {
 // which are awkward if we're running with a different cwd at serving time).
 func fixEsbuildMetadataPaths(metadataStr string) ([]byte, error) {
 	var metadata EsbuildMetadata
-	if err := json.Unmarshal([]byte(metadataStr), &metadata); err != nil {
+	if err := jsonv1.Unmarshal([]byte(metadataStr), &metadata); err != nil {
 		return nil, fmt.Errorf("Cannot parse metadata: %w", err)
 	}
 	distAbsPath, err := filepath.Abs(*distDir)
@@ -80,7 +80,7 @@ func fixEsbuildMetadataPaths(metadataStr string) ([]byte, error) {
 		delete(metadata.Outputs, outputPath)
 		metadata.Outputs[outputRelPath] = output
 	}
-	return json.Marshal(metadata)
+	return jsonv1.Marshal(metadata)
 }
 
 func precompressDist(fastCompression bool) error {
diff --git a/cmd/tsconnect/serve.go b/cmd/tsconnect/serve.go
index d780bdd57..c2aaa90a8 100644
--- a/cmd/tsconnect/serve.go
+++ b/cmd/tsconnect/serve.go
@@ -8,7 +8,7 @@ package main
 import (
 	"bytes"
 	"embed"
-	"encoding/json"
+	jsonv1 "encoding/json"
 	"fmt"
 	"io"
 	"io/fs"
@@ -80,7 +80,7 @@ func generateServeIndex(distFS fs.FS) ([]byte, error) {
 		return nil, fmt.Errorf("Could not read esbuild-metadata.json: %w", err)
 	}
 	var esbuildMetadata EsbuildMetadata
-	if err := json.Unmarshal(esbuildMetadataBytes, &esbuildMetadata); err != nil {
+	if err := jsonv1.Unmarshal(esbuildMetadataBytes, &esbuildMetadata); err != nil {
 		return nil, fmt.Errorf("Could not parse esbuild-metadata.json: %w", err)
 	}
 	entryPointsToHashedDistPaths := make(map[string]string)
diff --git a/cmd/tsconnect/wasm/wasm_js.go b/cmd/tsconnect/wasm/wasm_js.go
index 2e81fa4a8..44e58129b 100644
--- a/cmd/tsconnect/wasm/wasm_js.go
+++ b/cmd/tsconnect/wasm/wasm_js.go
@@ -13,7 +13,7 @@ import (
 	"bytes"
 	"context"
 	"encoding/hex"
-	"encoding/json"
+	jsonv1 "encoding/json"
 	"fmt"
 	"log"
 	"math/rand/v2"
@@ -291,7 +291,7 @@ func (i *jsIPN) run(jsCallbacks js.Value) {
 				}),
 				LockedOut: nm.TKAEnabled && nm.SelfNode.KeySignature().Len() == 0,
 			}
-			if jsonNetMap, err := json.Marshal(jsNetMap); err == nil {
+			if jsonNetMap, err := jsonv1.Marshal(jsNetMap); err == nil {
 				jsCallbacks.Call("notifyNetMap", string(jsonNetMap))
 			} else {
 				log.Printf("Could not generate JSON netmap: %v", err)
diff --git a/cmd/tsidp/tsidp.go b/cmd/tsidp/tsidp.go
index c02b09745..5914a6a89 100644
--- a/cmd/tsidp/tsidp.go
+++ b/cmd/tsidp/tsidp.go
@@ -16,7 +16,7 @@ import (
 	"crypto/x509"
 	"encoding/base64"
 	"encoding/binary"
-	"encoding/json"
+	jsonv1 "encoding/json"
 	"encoding/pem"
 	"errors"
 	"flag"
@@ -223,7 +223,7 @@ func main() {
 
 	f, err := os.Open(clientsFilePath)
 	if err == nil {
-		if err := json.NewDecoder(f).Decode(&srv.funnelClients); err != nil {
+		if err := jsonv1.NewDecoder(f).Decode(&srv.funnelClients); err != nil {
 			log.Fatalf("could not parse %s: %v", clientsFilePath, err)
 		}
 		f.Close()
@@ -694,7 +694,7 @@ func (s *idpServer) serveUserInfo(w http.ResponseWriter, r *http.Request) {
 
 	// Write the final result
 	w.Header().Set("Content-Type", "application/json")
-	if err := json.NewEncoder(w).Encode(userInfo); err != nil {
+	if err := jsonv1.NewEncoder(w).Encode(userInfo); err != nil {
 		http.Error(w, err.Error(), http.StatusInternalServerError)
 	}
 }
@@ -810,14 +810,14 @@ func addClaimValue(sets map[string]map[string]struct{}, claim string, val any) {
 // Returns the merged claims map or an error if any protected claim is violated or JSON (un)marshaling fails.
 func withExtraClaims(v any, rules []capRule) (map[string]any, error) {
 	// Marshal the static struct
-	data, err := json.Marshal(v)
+	data, err := jsonv1.Marshal(v)
 	if err != nil {
 		return nil, err
 	}
 
 	// Unmarshal into a generic map
 	var claimMap map[string]any
-	if err := json.Unmarshal(data, &claimMap); err != nil {
+	if err := jsonv1.Unmarshal(data, &claimMap); err != nil {
 		return nil, err
 	}
 
@@ -993,7 +993,7 @@ func (s *idpServer) serveToken(w http.ResponseWriter, r *http.Request) {
 	s.mu.Unlock()
 
 	w.Header().Set("Content-Type", "application/json")
-	if err := json.NewEncoder(w).Encode(oidcTokenResponse{
+	if err := jsonv1.NewEncoder(w).Encode(oidcTokenResponse{
 		AccessToken: at,
 		TokenType:   "Bearer",
 		ExpiresIn:   5 * 60,
@@ -1074,7 +1074,7 @@ func (s *idpServer) serveJWKS(w http.ResponseWriter, r *http.Request) {
 	}
 	// TODO(maisem): maybe only marshal this once and reuse?
 	// TODO(maisem): implement key rotation.
-	je := json.NewEncoder(w)
+	je := jsonv1.NewEncoder(w)
 	je.SetIndent("", "  ")
 	if err := je.Encode(jose.JSONWebKeySet{
 		Keys: []jose.JSONWebKey{
@@ -1202,7 +1202,7 @@ func (s *idpServer) serveOpenIDConfig(w http.ResponseWriter, r *http.Request) {
 	}
 
 	w.Header().Set("Content-Type", "application/json")
-	je := json.NewEncoder(w)
+	je := jsonv1.NewEncoder(w)
 	je.SetIndent("", "  ")
 	if err := je.Encode(openIDProviderMetadata{
 		AuthorizationEndpoint:            authorizeEndpoint,
@@ -1261,7 +1261,7 @@ func (s *idpServer) serveClients(w http.ResponseWriter, r *http.Request) {
 	case "DELETE":
 		s.serveDeleteClient(w, r, path)
 	case "GET":
-		json.NewEncoder(w).Encode(&funnelClient{
+		jsonv1.NewEncoder(w).Encode(&funnelClient{
 			ID:          c.ID,
 			Name:        c.Name,
 			Secret:      "",
@@ -1301,7 +1301,7 @@ func (s *idpServer) serveNewClient(w http.ResponseWriter, r *http.Request) {
 		delete(s.funnelClients, clientID)
 		return
 	}
-	json.NewEncoder(w).Encode(newClient)
+	jsonv1.NewEncoder(w).Encode(newClient)
 }
 
 func (s *idpServer) serveGetClientsList(w http.ResponseWriter, r *http.Request) {
@@ -1320,7 +1320,7 @@ func (s *idpServer) serveGetClientsList(w http.ResponseWriter, r *http.Request)
 		})
 	}
 	s.mu.Unlock()
-	json.NewEncoder(w).Encode(redactedClients)
+	jsonv1.NewEncoder(w).Encode(redactedClients)
 }
 
 func (s *idpServer) serveDeleteClient(w http.ResponseWriter, r *http.Request, clientID string) {
@@ -1356,7 +1356,7 @@ func (s *idpServer) serveDeleteClient(w http.ResponseWriter, r *http.Request, cl
 // otherwise uses oidc-funnel-clients.json. s.mu must be held while calling this.
 func (s *idpServer) storeFunnelClientsLocked() error {
 	var buf bytes.Buffer
-	if err := json.NewEncoder(&buf).Encode(s.funnelClients); err != nil {
+	if err := jsonv1.NewEncoder(&buf).Encode(s.funnelClients); err != nil {
 		return err
 	}
 
@@ -1421,7 +1421,7 @@ func (sk *signingKey) MarshalJSON() ([]byte, error) {
 		Bytes: x509.MarshalPKCS1PrivateKey(sk.k),
 	}
 	bts := pem.EncodeToMemory(&b)
-	return json.Marshal(rsaPrivateKeyJSONWrapper{
+	return jsonv1.Marshal(rsaPrivateKeyJSONWrapper{
 		Key: base64.URLEncoding.EncodeToString(bts),
 		ID:  sk.kid,
 	})
@@ -1429,7 +1429,7 @@ func (sk *signingKey) MarshalJSON() ([]byte, error) {
 
 func (sk *signingKey) UnmarshalJSON(b []byte) error {
 	var wrapper rsaPrivateKeyJSONWrapper
-	if err := json.Unmarshal(b, &wrapper); err != nil {
+	if err := jsonv1.Unmarshal(b, &wrapper); err != nil {
 		return err
 	}
 	if len(wrapper.Key) == 0 {
diff --git a/cmd/tsidp/tsidp_test.go b/cmd/tsidp/tsidp_test.go
index 4f5af9e59..5b22e0b09 100644
--- a/cmd/tsidp/tsidp_test.go
+++ b/cmd/tsidp/tsidp_test.go
@@ -19,7 +19,7 @@ package main
 import (
 	"crypto/rand"
 	"crypto/rsa"
-	"encoding/json"
+	jsonv1 "encoding/json"
 	"errors"
 	"fmt"
 	"io"
@@ -79,7 +79,7 @@ func normalizeMap(t *testing.T, m map[string]any) map[string]any {
 
 func mustMarshalJSON(t *testing.T, v any) tailcfg.RawMessage {
 	t.Helper()
-	b, err := json.Marshal(v)
+	b, err := jsonv1.Marshal(v)
 	if err != nil {
 		panic(err)
 	}
@@ -461,13 +461,13 @@ func TestExtraClaims(t *testing.T) {
 			}
 
 			// Marshal to JSON then unmarshal back to map[string]any
-			gotClaims, err := json.Marshal(claims)
+			gotClaims, err := jsonv1.Marshal(claims)
 			if err != nil {
 				t.Errorf("json.Marshal(claims) error = %v", err)
 			}
 
 			var gotClaimsMap map[string]any
-			if err := json.Unmarshal(gotClaims, &gotClaimsMap); err != nil {
+			if err := jsonv1.Unmarshal(gotClaims, &gotClaimsMap); err != nil {
 				t.Fatalf("json.Unmarshal(gotClaims) error = %v", err)
 			}
 
@@ -671,7 +671,7 @@ func TestServeToken(t *testing.T) {
 			var resp struct {
 				IDToken string `json:"id_token"`
 			}
-			if err := json.Unmarshal(rr.Body.Bytes(), &resp); err != nil {
+			if err := jsonv1.Unmarshal(rr.Body.Bytes(), &resp); err != nil {
 				t.Fatalf("failed to unmarshal response: %v", err)
 			}
 
@@ -861,7 +861,7 @@ func TestExtraUserInfo(t *testing.T) {
 			}
 
 			var resp map[string]any
-			if err := json.Unmarshal(rr.Body.Bytes(), &resp); err != nil {
+			if err := jsonv1.Unmarshal(rr.Body.Bytes(), &resp); err != nil {
 				t.Fatalf("failed to parse JSON response: %v", err)
 			}
 
@@ -898,7 +898,7 @@ func TestFunnelClientsPersistence(t *testing.T) {
 		},
 	}
 
-	testData, err := json.Marshal(testClients)
+	testData, err := jsonv1.Marshal(testClients)
 	if err != nil {
 		t.Fatalf("failed to marshal test data: %v", err)
 	}
@@ -915,7 +915,7 @@ func TestFunnelClientsPersistence(t *testing.T) {
 		srv.funnelClients = make(map[string]*funnelClient)
 		f, err := os.Open(tmpFile)
 		if err == nil {
-			if err := json.NewDecoder(f).Decode(&srv.funnelClients); err != nil {
+			if err := jsonv1.NewDecoder(f).Decode(&srv.funnelClients); err != nil {
 				t.Fatalf("could not parse %s: %v", tmpFile, err)
 			}
 			f.Close()
@@ -950,7 +950,7 @@ func TestFunnelClientsPersistence(t *testing.T) {
 		srv.funnelClients = make(map[string]*funnelClient)
 		f, err := os.Open(nonExistentFile)
 		if err == nil {
-			if err := json.NewDecoder(f).Decode(&srv.funnelClients); err != nil {
+			if err := jsonv1.NewDecoder(f).Decode(&srv.funnelClients); err != nil {
 				t.Fatalf("could not parse %s: %v", nonExistentFile, err)
 			}
 			f.Close()
@@ -982,7 +982,7 @@ func TestFunnelClientsPersistence(t *testing.T) {
 		}
 
 		// Save clients to file (simulating saveFunnelClients)
-		data, err := json.Marshal(srv1.funnelClients)
+		data, err := jsonv1.Marshal(srv1.funnelClients)
 		if err != nil {
 			t.Fatalf("failed to marshal clients: %v", err)
 		}
@@ -995,7 +995,7 @@ func TestFunnelClientsPersistence(t *testing.T) {
 		srv2.funnelClients = make(map[string]*funnelClient)
 		f, err := os.Open(tmpFile2)
 		if err == nil {
-			if err := json.NewDecoder(f).Decode(&srv2.funnelClients); err != nil {
+			if err := jsonv1.NewDecoder(f).Decode(&srv2.funnelClients); err != nil {
 				t.Fatalf("could not parse %s: %v", tmpFile2, err)
 			}
 			f.Close()
@@ -1255,7 +1255,7 @@ func TestMigrateOAuthClients(t *testing.T) {
 
 			// Setup old file if needed
 			if tt.setupOldFile {
-				oldData, err := json.Marshal(tt.oldFileContent)
+				oldData, err := jsonv1.Marshal(tt.oldFileContent)
 				if err != nil {
 					t.Fatalf("failed to marshal old file content: %v", err)
 				}
@@ -1267,7 +1267,7 @@ func TestMigrateOAuthClients(t *testing.T) {
 
 			// Setup new file if needed
 			if tt.setupNewFile {
-				newData, err := json.Marshal(tt.newFileContent)
+				newData, err := jsonv1.Marshal(tt.newFileContent)
 				if err != nil {
 					t.Fatalf("failed to marshal new file content: %v", err)
 				}
@@ -1309,7 +1309,7 @@ func TestMigrateOAuthClients(t *testing.T) {
 				}
 
 				var clients map[string]*funnelClient
-				if err := json.Unmarshal(data, &clients); err != nil {
+				if err := jsonv1.Unmarshal(data, &clients); err != nil {
 					t.Fatalf("failed to unmarshal new file: %v", err)
 				}
 
@@ -1854,7 +1854,7 @@ func TestServeTokenWithClientValidation(t *testing.T) {
 					ExpiresIn   int    `json:"expires_in"`
 				}
 
-				if err := json.Unmarshal(rr.Body.Bytes(), &resp); err != nil {
+				if err := jsonv1.Unmarshal(rr.Body.Bytes(), &resp); err != nil {
 					t.Fatalf("failed to unmarshal response: %v", err)
 				}
 
@@ -2035,7 +2035,7 @@ func TestServeUserInfoWithClientValidation(t *testing.T) {
 				}
 
 				var resp map[string]any
-				if err := json.Unmarshal(rr.Body.Bytes(), &resp); err != nil {
+				if err := jsonv1.Unmarshal(rr.Body.Bytes(), &resp); err != nil {
 					t.Fatalf("failed to parse JSON response: %v", err)
 				}