diff --git a/agent/agent_test.go b/agent/agent_test.go
index d6dd2cc5fc..bcc57cf41e 100644
--- a/agent/agent_test.go
+++ b/agent/agent_test.go
@@ -4,12 +4,13 @@ import (
 	"bytes"
 	"context"
 	"crypto/md5"
+	"crypto/rand"
 	"crypto/tls"
 	"crypto/x509"
 	"encoding/base64"
 	"encoding/json"
 	"fmt"
-	"math/rand"
+	mathrand "math/rand"
 	"net"
 	"net/http"
 	"net/http/httptest"
@@ -752,7 +753,7 @@ func testAgent_AddServices_AliasUpdateCheckNotReverted(t *testing.T, extraHCL st
 
 func test_createAlias(t *testing.T, agent *TestAgent, chk *structs.CheckType, expectedResult string) func(r *retry.R) {
 	t.Helper()
-	serviceNum := rand.Int()
+	serviceNum := mathrand.Int()
 	srv := &structs.NodeService{
 		Service: fmt.Sprintf("serviceAlias-%d", serviceNum),
 		Tags:    []string{"tag1"},
diff --git a/agent/consul/auto_config_endpoint_test.go b/agent/consul/auto_config_endpoint_test.go
index ac9ea4128d..1f0f8e18a1 100644
--- a/agent/consul/auto_config_endpoint_test.go
+++ b/agent/consul/auto_config_endpoint_test.go
@@ -3,12 +3,11 @@ package consul
 import (
 	"bytes"
 	"crypto"
-	crand "crypto/rand"
+	"crypto/rand"
 	"crypto/x509"
 	"encoding/base64"
 	"encoding/pem"
 	"fmt"
-	"math/rand"
 	"net"
 	"net/url"
 	"os"
@@ -884,7 +883,7 @@ func TestAutoConfig_parseAutoConfigCSR(t *testing.T) {
 	// customizations to allow for better unit testing.
 	createCSR := func(tmpl *x509.CertificateRequest, privateKey crypto.Signer) (string, error) {
 		connect.HackSANExtensionForCSR(tmpl)
-		bs, err := x509.CreateCertificateRequest(crand.Reader, tmpl, privateKey)
+		bs, err := x509.CreateCertificateRequest(rand.Reader, tmpl, privateKey)
 		require.NoError(t, err)
 		var csrBuf bytes.Buffer
 		err = pem.Encode(&csrBuf, &pem.Block{Type: "CERTIFICATE REQUEST", Bytes: bs})
diff --git a/agent/consul/internal_endpoint_test.go b/agent/consul/internal_endpoint_test.go
index e0aa941b90..181de4ed82 100644
--- a/agent/consul/internal_endpoint_test.go
+++ b/agent/consul/internal_endpoint_test.go
@@ -1,9 +1,9 @@
 package consul
 
 import (
+	"crypto/rand"
 	"encoding/base64"
 	"fmt"
-	"math/rand"
 	"os"
 	"strings"
 	"testing"
diff --git a/agent/consul/state/acl_test.go b/agent/consul/state/acl_test.go
index 5e01514730..fc00728282 100644
--- a/agent/consul/state/acl_test.go
+++ b/agent/consul/state/acl_test.go
@@ -13,7 +13,6 @@ import (
 
 	"github.com/hashicorp/consul/acl"
 	"github.com/hashicorp/consul/agent/structs"
-	"github.com/hashicorp/consul/lib"
 	"github.com/hashicorp/consul/proto/pbacl"
 )
 
@@ -3570,7 +3569,6 @@ func TestStateStore_ACLPolicies_Snapshot_Restore(t *testing.T) {
 }
 
 func TestTokenPoliciesIndex(t *testing.T) {
-	lib.SeedMathRand()
 
 	idIndex := &memdb.IndexSchema{
 		Name:         "id",
diff --git a/agent/coordinate_endpoint_test.go b/agent/coordinate_endpoint_test.go
index 4782ae72d0..71492d909c 100644
--- a/agent/coordinate_endpoint_test.go
+++ b/agent/coordinate_endpoint_test.go
@@ -40,9 +40,9 @@ func TestCoordinate_Disabled_Response(t *testing.T) {
 			req, _ := http.NewRequest("PUT", "/should/not/care", nil)
 			resp := httptest.NewRecorder()
 			obj, err := tt(resp, req)
-			if err, ok := err.(HTTPError); ok {
-				if err.StatusCode != 401 {
-					t.Fatalf("expected status 401 but got %d", err.StatusCode)
+			if httpErr, ok := err.(HTTPError); ok {
+				if httpErr.StatusCode != 401 {
+					t.Fatalf("expected status 401 but got %d", httpErr.StatusCode)
 				}
 			} else {
 				t.Fatalf("expected HTTP error but got %v", err)
diff --git a/agent/grpc-external/limiter/limiter_test.go b/agent/grpc-external/limiter/limiter_test.go
index cef6a4d417..7f5b9654a0 100644
--- a/agent/grpc-external/limiter/limiter_test.go
+++ b/agent/grpc-external/limiter/limiter_test.go
@@ -8,12 +8,8 @@ import (
 	"time"
 
 	"github.com/stretchr/testify/require"
-
-	"github.com/hashicorp/consul/lib"
 )
 
-func init() { lib.SeedMathRand() }
-
 func TestSessionLimiter(t *testing.T) {
 	lim := NewSessionLimiter()
 
diff --git a/agent/prepared_query_endpoint_test.go b/agent/prepared_query_endpoint_test.go
index 33240fd77a..09012bc2a0 100644
--- a/agent/prepared_query_endpoint_test.go
+++ b/agent/prepared_query_endpoint_test.go
@@ -13,9 +13,10 @@ import (
 
 	"github.com/hashicorp/consul/testrpc"
 
+	"github.com/stretchr/testify/require"
+
 	"github.com/hashicorp/consul/agent/structs"
 	"github.com/hashicorp/consul/types"
-	"github.com/stretchr/testify/require"
 )
 
 // MockPreparedQuery is a fake endpoint that we inject into the Consul server
@@ -628,9 +629,9 @@ func TestPreparedQuery_Execute(t *testing.T) {
 		req, _ := http.NewRequest("GET", "/v1/query/not-there/execute", body)
 		resp := httptest.NewRecorder()
 		_, err := a.srv.PreparedQuerySpecific(resp, req)
-		if err, ok := err.(HTTPError); ok {
-			if err.StatusCode != 404 {
-				t.Fatalf("expected status 404 but got %d", err.StatusCode)
+		if httpErr, ok := err.(HTTPError); ok {
+			if httpErr.StatusCode != 404 {
+				t.Fatalf("expected status 404 but got %d", httpErr.StatusCode)
 			}
 		} else {
 			t.Fatalf("expected HTTP error but got %v", err)
@@ -768,9 +769,9 @@ func TestPreparedQuery_Explain(t *testing.T) {
 		req, _ := http.NewRequest("GET", "/v1/query/not-there/explain", body)
 		resp := httptest.NewRecorder()
 		_, err := a.srv.PreparedQuerySpecific(resp, req)
-		if err, ok := err.(HTTPError); ok {
-			if err.StatusCode != 404 {
-				t.Fatalf("expected status 404 but got %d", err.StatusCode)
+		if httpErr, ok := err.(HTTPError); ok {
+			if httpErr.StatusCode != 404 {
+				t.Fatalf("expected status 404 but got %d", httpErr.StatusCode)
 			}
 		} else {
 			t.Fatalf("expected HTTP error but got %v", err)
@@ -862,9 +863,9 @@ func TestPreparedQuery_Get(t *testing.T) {
 		req, _ := http.NewRequest("GET", "/v1/query/f004177f-2c28-83b7-4229-eacc25fe55d1", body)
 		resp := httptest.NewRecorder()
 		_, err := a.srv.PreparedQuerySpecific(resp, req)
-		if err, ok := err.(HTTPError); ok {
-			if err.StatusCode != 404 {
-				t.Fatalf("expected status 404 but got %d", err.StatusCode)
+		if httpErr, ok := err.(HTTPError); ok {
+			if httpErr.StatusCode != 404 {
+				t.Fatalf("expected status 404 but got %d", httpErr.StatusCode)
 			}
 		} else {
 			t.Fatalf("expected HTTP error but got %v", err)
diff --git a/agent/testagent.go b/agent/testagent.go
index db08be40a4..54db5c72ba 100644
--- a/agent/testagent.go
+++ b/agent/testagent.go
@@ -6,7 +6,6 @@ import (
 	"crypto/x509"
 	"fmt"
 	"io"
-	"math/rand"
 	"net"
 	"net/http/httptest"
 	"path/filepath"
@@ -32,10 +31,6 @@ import (
 	"github.com/hashicorp/consul/tlsutil"
 )
 
-func init() {
-	rand.Seed(time.Now().UnixNano()) // seed random number generator
-}
-
 // TestAgent encapsulates an Agent with a default configuration and
 // startup procedure suitable for testing. It panics if there are errors
 // during creation or startup instead of returning errors. It manages a
diff --git a/agent/txn_endpoint_test.go b/agent/txn_endpoint_test.go
index 90e5359955..ce94b5c3e6 100644
--- a/agent/txn_endpoint_test.go
+++ b/agent/txn_endpoint_test.go
@@ -67,9 +67,9 @@ func TestTxnEndpoint_Bad_Size_Item(t *testing.T) {
 				t.Fatalf("err: %v", err)
 			}
 		} else {
-			if err, ok := err.(HTTPError); ok {
-				if err.StatusCode != 413 {
-					t.Fatalf("expected 413 but got %d", err.StatusCode)
+			if httpErr, ok := err.(HTTPError); ok {
+				if httpErr.StatusCode != 413 {
+					t.Fatalf("expected 413 but got %d", httpErr.StatusCode)
 				}
 			} else {
 				t.Fatalf("excected HTTP error but got %v", err)
@@ -150,9 +150,9 @@ func TestTxnEndpoint_Bad_Size_Net(t *testing.T) {
 				t.Fatalf("err: %v", err)
 			}
 		} else {
-			if err, ok := err.(HTTPError); ok {
-				if err.StatusCode != 413 {
-					t.Fatalf("expected 413 but got %d", err.StatusCode)
+			if httpErr, ok := err.(HTTPError); ok {
+				if httpErr.StatusCode != 413 {
+					t.Fatalf("expected 413 but got %d", httpErr.StatusCode)
 				}
 			} else {
 				t.Fatalf("excected HTTP error but got %v", err)
@@ -220,9 +220,9 @@ func TestTxnEndpoint_Bad_Size_Ops(t *testing.T) {
 	resp := httptest.NewRecorder()
 	_, err := a.srv.Txn(resp, req)
 
-	if err, ok := err.(HTTPError); ok {
-		if err.StatusCode != 413 {
-			t.Fatalf("expected 413 but got %d", err.StatusCode)
+	if httpErr, ok := err.(HTTPError); ok {
+		if httpErr.StatusCode != 413 {
+			t.Fatalf("expected 413 but got %d", httpErr.StatusCode)
 		}
 	} else {
 		t.Fatalf("expected HTTP error but got %v", err)
diff --git a/command/members/members_test.go b/command/members/members_test.go
index cc4a21742a..c9a2d42b77 100644
--- a/command/members/members_test.go
+++ b/command/members/members_test.go
@@ -13,7 +13,6 @@ import (
 
 	"github.com/hashicorp/consul/agent"
 	consulapi "github.com/hashicorp/consul/api"
-	"github.com/hashicorp/consul/lib"
 )
 
 // TODO(partitions): split these tests
@@ -206,8 +205,6 @@ func zip(t *testing.T, k, v []string) map[string]string {
 }
 
 func TestSortByMemberNamePartitionAndSegment(t *testing.T) {
-	lib.SeedMathRand()
-
 	// For the test data we'll give them names that would sort them backwards
 	// if we only sorted by name.
 	newData := func() []*consulapi.AgentMember {
diff --git a/lib/rand.go b/lib/rand.go
deleted file mode 100644
index 22aa4f3544..0000000000
--- a/lib/rand.go
+++ /dev/null
@@ -1,34 +0,0 @@
-package lib
-
-import (
-	crand "crypto/rand"
-	"math"
-	"math/big"
-	"math/rand"
-	"sync"
-	"time"
-)
-
-var (
-	once sync.Once
-
-	// SeededSecurely is set to true if a cryptographically secure seed
-	// was used to initialize rand.  When false, the start time is used
-	// as a seed.
-	SeededSecurely bool
-)
-
-// SeedMathRand provides weak, but guaranteed seeding, which is better than
-// running with Go's default seed of 1.  A call to SeedMathRand() is expected
-// to be called via init(), but never a second time.
-func SeedMathRand() {
-	once.Do(func() {
-		n, err := crand.Int(crand.Reader, big.NewInt(math.MaxInt64))
-		if err != nil {
-			rand.Seed(time.Now().UTC().UnixNano())
-			return
-		}
-		rand.Seed(n.Int64())
-		SeededSecurely = true
-	})
-}
diff --git a/main.go b/main.go
index 5138f8c221..804635060a 100644
--- a/main.go
+++ b/main.go
@@ -11,14 +11,9 @@ import (
 	"github.com/hashicorp/consul/command"
 	"github.com/hashicorp/consul/command/cli"
 	"github.com/hashicorp/consul/command/version"
-	"github.com/hashicorp/consul/lib"
 	_ "github.com/hashicorp/consul/service_os"
 )
 
-func init() {
-	lib.SeedMathRand()
-}
-
 func main() {
 	os.Exit(realMain())
 }
diff --git a/sdk/freeport/freeport.go b/sdk/freeport/freeport.go
index 6eda1d4279..6c275fe866 100644
--- a/sdk/freeport/freeport.go
+++ b/sdk/freeport/freeport.go
@@ -114,7 +114,6 @@ func initialize() {
 		panic("freeport: block size too big or too many blocks requested")
 	}
 
-	rand.Seed(time.Now().UnixNano())
 	firstPort, lockLn = alloc()
 
 	condNotEmpty = sync.NewCond(&mu)