diff --git a/app-policy/cmd/dikastes/dikastes.go b/app-policy/cmd/dikastes/dikastes.go
index 6d84aac043b..72d8e2e4b49 100644
--- a/app-policy/cmd/dikastes/dikastes.go
+++ b/app-policy/cmd/dikastes/dikastes.go
@@ -223,7 +223,7 @@ func (h *httpTerminationHandler) RunHTTPServer(addr string, port string) (*http.
 		}
 	}
 
-	httpServerSockAddr := fmt.Sprintf("%s:%s", addr, port)
+	httpServerSockAddr := net.JoinHostPort(addr, port)
 	httpServerMux := http.NewServeMux()
 	httpServerMux.Handle("/terminate", h)
 	httpServer := &http.Server{Addr: httpServerSockAddr, Handler: httpServerMux}
diff --git a/felix/fv/infrastructure/felix.go b/felix/fv/infrastructure/felix.go
index f8725d8b192..bb1ff7054d4 100644
--- a/felix/fv/infrastructure/felix.go
+++ b/felix/fv/infrastructure/felix.go
@@ -20,6 +20,7 @@ import (
 	"fmt"
 	"io"
 	"maps"
+	"net"
 	"net/http"
 	"os"
 	"path"
@@ -420,7 +421,7 @@ func (f *Felix) Ready() (bool, error) {
 		healthAddr = f.TopologyOptions.ExtraEnvVars["FELIX_HEALTHHOST"]
 	}
 
-	url := "http://" + healthAddr + ":9099/readiness"
+	url := "http://" + net.JoinHostPort(healthAddr, "9099") + "/readiness"
 	ctx, cancel := context.WithTimeout(context.Background(), time.Second*2)
 	defer cancel()
 	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
diff --git a/felix/fv/metrics/metrics.go b/felix/fv/metrics/metrics.go
index 2c2cd149bb7..d0290c7764f 100644
--- a/felix/fv/metrics/metrics.go
+++ b/felix/fv/metrics/metrics.go
@@ -106,7 +106,7 @@ func GetRawMetrics(ip string, port int, caFile, certFile, keyFile string) (out s
 		httpClient.Transport = &http.Transport{}
 	}
 	var resp *http.Response
-	resp, err = httpClient.Get(fmt.Sprintf("%v://%v:%v/metrics", method, ip, port))
+	resp, err = httpClient.Get(fmt.Sprintf("%s://%s/metrics", method, net.JoinHostPort(ip, strconv.Itoa(port))))
 	if err != nil {
 		return
 	}
diff --git a/guardian/pkg/server/server.go b/guardian/pkg/server/server.go
index b7d70c62813..4b8c784d4c6 100644
--- a/guardian/pkg/server/server.go
+++ b/guardian/pkg/server/server.go
@@ -132,7 +132,7 @@ func (srv *server) ListenAndServeCluster() error {
 		return fmt.Errorf("failed to connect to tunnel: %w", err)
 	}
 
-	listener, err := net.Listen("tcp", fmt.Sprintf("%s:%s", srv.listenHost, srv.listenPort))
+	listener, err := net.Listen("tcp", net.JoinHostPort(srv.listenHost, srv.listenPort))
 	if err != nil {
 		return fmt.Errorf("failed to listen on %s:%s: %w", srv.listenHost, srv.listenPort, err)
 	}
diff --git a/node/pkg/health/health.go b/node/pkg/health/health.go
index ec575230a59..2baad4745a6 100644
--- a/node/pkg/health/health.go
+++ b/node/pkg/health/health.go
@@ -17,6 +17,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"net"
 	"net/http"
 	"os"
 	"os/exec"
@@ -50,8 +51,8 @@ func init() {
 		felixHost = "localhost"
 	}
 
-	felixReadinessEp = "http://" + felixHost + ":" + felixPort + "/readiness"
-	felixLivenessEp = "http://" + felixHost + ":" + felixPort + "/liveness"
+	felixReadinessEp = "http://" + net.JoinHostPort(felixHost, felixPort) + "/readiness"
+	felixLivenessEp = "http://" + net.JoinHostPort(felixHost, felixPort) + "/liveness"
 }
 
 func Run(bird, bird6, felixReady, felixLive, birdLive, bird6Live bool, thresholdTime time.Duration) {
diff --git a/whisker-backend/pkg/config/api.go b/whisker-backend/pkg/config/api.go
index 4caf59ae390..ecc6e94e450 100644
--- a/whisker-backend/pkg/config/api.go
+++ b/whisker-backend/pkg/config/api.go
@@ -16,7 +16,7 @@ package config
 
 import (
 	"encoding/json"
-	"fmt"
+	"net"
 	"os"
 
 	"github.com/kelseyhightower/envconfig"
@@ -56,7 +56,7 @@ func (cfg *Config) String() string {
 }
 
 func (cfg *Config) HostAddr() string {
-	return fmt.Sprintf("%s:%s", cfg.Host, cfg.Port)
+	return net.JoinHostPort(cfg.Host, cfg.Port)
 }
 
 func (cfg *Config) ConfigureLogging() {