diff --git a/derp/derp_test.go b/derp/derp_test.go
index ac2521f8e..20a6432b8 100644
--- a/derp/derp_test.go
+++ b/derp/derp_test.go
@@ -126,7 +126,7 @@ func TestSendRecv(t *testing.T) {
 					if m.Source.IsZero() {
 						t.Errorf("zero Source address in ReceivedPacket")
 					}
-					recvChs[i] <- append([]byte(nil), m.Data...)
+					recvChs[i] <- bytes.Clone(m.Data)
 				}
 			}
 		}(i)
diff --git a/derp/derphttp/derphttp_test.go b/derp/derphttp/derphttp_test.go
index 5feca649b..b121c097c 100644
--- a/derp/derphttp/derphttp_test.go
+++ b/derp/derphttp/derphttp_test.go
@@ -4,6 +4,7 @@
 package derphttp
 
 import (
+	"bytes"
 	"context"
 	"crypto/tls"
 	"net"
@@ -102,7 +103,7 @@ func TestSendRecv(t *testing.T) {
 				case derp.PeerGoneMessage:
 					// Ignore.
 				case derp.ReceivedPacket:
-					recvChs[i] <- append([]byte(nil), m.Data...)
+					recvChs[i] <- bytes.Clone(m.Data)
 				}
 			}
 		}(i)
diff --git a/ipn/store/mem/store_mem.go b/ipn/store/mem/store_mem.go
index a826d29a4..8835374b0 100644
--- a/ipn/store/mem/store_mem.go
+++ b/ipn/store/mem/store_mem.go
@@ -5,6 +5,7 @@
 package mem
 
 import (
+	"bytes"
 	"encoding/json"
 	"sync"
 
@@ -43,7 +44,7 @@ func (s *Store) WriteState(id ipn.StateKey, bs []byte) error {
 	if s.cache == nil {
 		s.cache = map[ipn.StateKey][]byte{}
 	}
-	s.cache[id] = append([]byte(nil), bs...)
+	s.cache[id] = bytes.Clone(bs)
 	return nil
 }
 
diff --git a/ipn/store/stores.go b/ipn/store/stores.go
index efaf65a00..8bf3a24b0 100644
--- a/ipn/store/stores.go
+++ b/ipn/store/stores.go
@@ -179,7 +179,7 @@ func (s *FileStore) WriteState(id ipn.StateKey, bs []byte) error {
 	if bytes.Equal(s.cache[id], bs) {
 		return nil
 	}
-	s.cache[id] = append([]byte(nil), bs...)
+	s.cache[id] = bytes.Clone(bs)
 	bs, err := json.MarshalIndent(s.cache, "", "  ")
 	if err != nil {
 		return err
diff --git a/net/stun/stun.go b/net/stun/stun.go
index 06f25c8bf..eeac23cbb 100644
--- a/net/stun/stun.go
+++ b/net/stun/stun.go
@@ -5,6 +5,7 @@
 package stun
 
 import (
+	"bytes"
 	crand "crypto/rand"
 	"encoding/binary"
 	"errors"
@@ -300,7 +301,7 @@ func mappedAddress(b []byte) (addr []byte, port uint16, err error) {
 	if len(addrField) < addrLen {
 		return nil, 0, ErrMalformedAttrs
 	}
-	return append([]byte(nil), addrField[:addrLen]...), port, nil
+	return bytes.Clone(addrField[:addrLen]), port, nil
 }
 
 // Is reports whether b is a STUN message.
diff --git a/tstest/natlab/natlab.go b/tstest/natlab/natlab.go
index 9d625f7fe..136f4a4bc 100644
--- a/tstest/natlab/natlab.go
+++ b/tstest/natlab/natlab.go
@@ -49,7 +49,7 @@ func (p *Packet) Clone() *Packet {
 	return &Packet{
 		Src:     p.Src,
 		Dst:     p.Dst,
-		Payload: append([]byte(nil), p.Payload...),
+		Payload: bytes.Clone(p.Payload),
 		locator: p.locator,
 	}
 }
@@ -863,7 +863,7 @@ func (c *conn) WriteToUDPAddrPort(p []byte, ipp netip.AddrPort) (n int, err erro
 	pkt := &Packet{
 		Src:     c.ipp,
 		Dst:     ipp,
-		Payload: append([]byte(nil), p...),
+		Payload: bytes.Clone(p),
 	}
 	pkt.setLocator("mach=%s", c.m.Name)
 	pkt.Trace("PacketConn.WriteTo")
diff --git a/types/key/machine.go b/types/key/machine.go
index 2f78aebdf..0a81e63a7 100644
--- a/types/key/machine.go
+++ b/types/key/machine.go
@@ -4,6 +4,7 @@
 package key
 
 import (
+	"bytes"
 	"crypto/subtle"
 	"encoding/hex"
 
@@ -86,7 +87,7 @@ func (k *MachinePrivate) UnmarshalText(b []byte) error {
 // specific raw byte serialization, please use
 // MarshalText/UnmarshalText.
 func (k MachinePrivate) UntypedBytes() []byte {
-	return append([]byte(nil), k.k[:]...)
+	return bytes.Clone(k.k[:])
 }
 
 // SealTo wraps cleartext into a NaCl box (see
@@ -230,7 +231,7 @@ func (k MachinePublic) UntypedHexString() string {
 // specific raw byte serialization, please use
 // MarshalText/UnmarshalText.
 func (k MachinePublic) UntypedBytes() []byte {
-	return append([]byte(nil), k.k[:]...)
+	return bytes.Clone(k.k[:])
 }
 
 // String returns the output of MarshalText as a string.
diff --git a/wgengine/netstack/netstack.go b/wgengine/netstack/netstack.go
index c7878b14e..e2fc5e0c1 100644
--- a/wgengine/netstack/netstack.go
+++ b/wgengine/netstack/netstack.go
@@ -5,6 +5,7 @@
 package netstack
 
 import (
+	"bytes"
 	"context"
 	"errors"
 	"fmt"
@@ -401,7 +402,7 @@ func (ns *Impl) handleLocalPackets(p *packet.Parsed, t *tstun.Wrapper) filter.Re
 	}
 
 	packetBuf := stack.NewPacketBuffer(stack.PacketBufferOptions{
-		Payload: bufferv2.MakeWithData(append([]byte(nil), p.Buffer()...)),
+		Payload: bufferv2.MakeWithData(bytes.Clone(p.Buffer())),
 	})
 	ns.linkEP.InjectInbound(pn, packetBuf)
 	packetBuf.DecRef()
@@ -683,7 +684,7 @@ func (ns *Impl) injectInbound(p *packet.Parsed, t *tstun.Wrapper) filter.Respons
 		ns.logf("[v2] packet in (from %v): % x", p.Src, p.Buffer())
 	}
 	packetBuf := stack.NewPacketBuffer(stack.PacketBufferOptions{
-		Payload: bufferv2.MakeWithData(append([]byte(nil), p.Buffer()...)),
+		Payload: bufferv2.MakeWithData(bytes.Clone(p.Buffer())),
 	})
 	ns.linkEP.InjectInbound(pn, packetBuf)
 	packetBuf.DecRef()