diff --git a/src/libstore/unix/build/linux-derivation-builder.cc b/src/libstore/unix/build/linux-derivation-builder.cc
index c81390fb709..795cac24dc8 100644
--- a/src/libstore/unix/build/linux-derivation-builder.cc
+++ b/src/libstore/unix/build/linux-derivation-builder.cc
@@ -226,18 +226,18 @@ struct ChrootLinuxDerivationBuilder : ChrootDerivationBuilder, LinuxDerivationBu
             /* If we're running from the daemon, then this will return the
                root cgroup of the service. Otherwise, it will return the
                current cgroup. */
-            auto rootCgroup = getRootCgroup();
             auto cgroupFS = getCgroupFS();
             if (!cgroupFS)
                 throw Error("cannot determine the cgroups file system");
-            auto rootCgroupPath = canonPath((*cgroupFS / rootCgroup).native());
+            auto rootCgroupPath = *cgroupFS / getRootCgroup().rel();
             if (!pathExists(rootCgroupPath))
                 throw Error("expected cgroup directory '%s'", rootCgroupPath);
 
             static std::atomic<unsigned int> counter{0};
 
-            cgroup = buildUser ? fmt("%s/nix-build-uid-%d", rootCgroupPath, buildUser->getUID())
-                               : fmt("%s/nix-build-pid-%d-%d", rootCgroupPath, getpid(), counter++);
+            cgroup = rootCgroupPath
+                     / (buildUser ? fmt("nix-build-uid-%d", buildUser->getUID())
+                                  : fmt("nix-build-pid-%d-%d", getpid(), counter++));
 
             debug("using cgroup %s", *cgroup);
 
@@ -248,7 +248,7 @@ struct ChrootLinuxDerivationBuilder : ChrootDerivationBuilder, LinuxDerivationBu
                 auto cgroupsDir = std::filesystem::path{settings.nixStateDir} / "cgroups";
                 createDirs(cgroupsDir);
 
-                auto cgroupFile = fmt("%s/%d", cgroupsDir, buildUser->getUID());
+                auto cgroupFile = cgroupsDir / std::to_string(buildUser->getUID());
 
                 if (pathExists(cgroupFile)) {
                     auto prevCgroup = readFile(cgroupFile);
diff --git a/src/libutil/current-process.cc b/src/libutil/current-process.cc
index 5c48a4f7770..8af54f8bfca 100644
--- a/src/libutil/current-process.cc
+++ b/src/libutil/current-process.cc
@@ -35,7 +35,7 @@ unsigned int getMaxCPU()
         if (!cgroupFS)
             return 0;
 
-        auto cpuFile = *cgroupFS + "/" + getCurrentCgroup() + "/cpu.max";
+        auto cpuFile = *cgroupFS / getCurrentCgroup().rel() / "cpu.max";
 
         auto cpuMax = readFile(cpuFile);
         auto cpuMaxParts = tokenizeString<std::vector<std::string>>(cpuMax, " \n");
diff --git a/src/libutil/linux/cgroup.cc b/src/libutil/linux/cgroup.cc
index b0d5fa9c614..e9fc5646e95 100644
--- a/src/libutil/linux/cgroup.cc
+++ b/src/libutil/linux/cgroup.cc
@@ -155,7 +155,7 @@ CgroupStats destroyCgroup(const std::filesystem::path & cgroup)
     return destroyCgroup(cgroup, true);
 }
 
-std::string getCurrentCgroup()
+CanonPath getCurrentCgroup()
 {
     auto cgroupFS = getCgroupFS();
     if (!cgroupFS)
@@ -165,12 +165,12 @@ std::string getCurrentCgroup()
     auto ourCgroup = ourCgroups[""];
     if (ourCgroup == "")
         throw Error("cannot determine cgroup name from /proc/self/cgroup");
-    return ourCgroup;
+    return CanonPath{ourCgroup};
 }
 
-std::string getRootCgroup()
+CanonPath getRootCgroup()
 {
-    static std::string rootCgroup = getCurrentCgroup();
+    static auto rootCgroup = getCurrentCgroup();
     return rootCgroup;
 }
 
diff --git a/src/libutil/linux/include/nix/util/cgroup.hh b/src/libutil/linux/include/nix/util/cgroup.hh
index 1872f745044..6eab98ae7d8 100644
--- a/src/libutil/linux/include/nix/util/cgroup.hh
+++ b/src/libutil/linux/include/nix/util/cgroup.hh
@@ -6,6 +6,7 @@
 #include <filesystem>
 
 #include "nix/util/types.hh"
+#include "nix/util/canon-path.hh"
 
 namespace nix {
 
@@ -31,13 +32,13 @@ CgroupStats getCgroupStats(const std::filesystem::path & cgroup);
  */
 CgroupStats destroyCgroup(const std::filesystem::path & cgroup);
 
-std::string getCurrentCgroup();
+CanonPath getCurrentCgroup();
 
 /**
  * Get the cgroup that should be used as the parent when creating new
  * sub-cgroups. The first time this is called, the current cgroup will be
  * returned, and then all subsequent calls will return the original cgroup.
  */
-std::string getRootCgroup();
+CanonPath getRootCgroup();
 
 } // namespace nix
diff --git a/src/nix/unix/daemon.cc b/src/nix/unix/daemon.cc
index 661488c56ef..67918537db0 100644
--- a/src/nix/unix/daemon.cc
+++ b/src/nix/unix/daemon.cc
@@ -333,7 +333,7 @@ static void daemonLoop(std::optional<TrustedFlag> forceTrustClientOpt)
         auto cgroupFS = getCgroupFS();
         if (!cgroupFS)
             throw Error("cannot determine the cgroups file system");
-        auto rootCgroupPath = canonPath(*cgroupFS + "/" + rootCgroup);
+        auto rootCgroupPath = *cgroupFS / rootCgroup.rel();
         if (!pathExists(rootCgroupPath))
             throw Error("expected cgroup directory '%s'", rootCgroupPath);
         auto daemonCgroupPath = rootCgroupPath + "/nix-daemon";