diff --git a/pkg/fsutil/fsutil.go b/pkg/fsutil/fsutil.go
index 47f77513b9..ca26cab7c9 100644
--- a/pkg/fsutil/fsutil.go
+++ b/pkg/fsutil/fsutil.go
@@ -10,7 +10,6 @@ import (
 	"path/filepath"
 	"regexp"
 	"strings"
-	"time"
 
 	"github.com/gopasspw/gopass/pkg/appdir"
 	"github.com/gopasspw/gopass/pkg/debug"
@@ -138,8 +137,6 @@ func IsEmptyDir(path string) (bool, error) {
 
 // Shred overwrite the given file any number of times.
 func Shred(path string, runs int) error {
-	rand.Seed(time.Now().UnixNano())
-
 	fh, err := os.OpenFile(path, os.O_WRONLY, 0o600)
 	if err != nil {
 		return fmt.Errorf("failed to open file %q: %w", path, err)
diff --git a/pkg/gitconfig/config_test.go b/pkg/gitconfig/config_test.go
index 82624debb4..724cbd44f2 100644
--- a/pkg/gitconfig/config_test.go
+++ b/pkg/gitconfig/config_test.go
@@ -9,7 +9,6 @@ import (
 	"strconv"
 	"strings"
 	"testing"
-	"time"
 
 	"github.com/gopasspw/gopass/internal/set"
 	"github.com/stretchr/testify/assert"
@@ -274,7 +273,6 @@ func TestLoadFromEnv(t *testing.T) {
 		"core.timeout": "10",
 	}
 
-	rand.Seed(time.Now().Unix())
 	prefix := fmt.Sprintf("GPTEST%d", rand.Int31n(8192))
 
 	i := 0
diff --git a/pkg/pwgen/pwgen_test.go b/pkg/pwgen/pwgen_test.go
index c94fd5c7ac..6e5e0e7377 100644
--- a/pkg/pwgen/pwgen_test.go
+++ b/pkg/pwgen/pwgen_test.go
@@ -2,10 +2,10 @@ package pwgen
 
 import (
 	"bytes"
-	"crypto/rand"
+	crand "crypto/rand"
 	"fmt"
 	"io"
-	mrand "math/rand"
+	"math/rand"
 	"os"
 	"strings"
 	"testing"
@@ -40,12 +40,14 @@ func TestPwgenCharset(t *testing.T) {
 	assert.Equal(t, "", GeneratePasswordCharsetCheck(4, "a"))
 }
 
-func TestPwgenNoCrand(t *testing.T) {
-	old := rand.Reader
-	rand.Reader = strings.NewReader("")
+func TestPwgenNoCrandFallback(t *testing.T) {
+	oldFallback := randFallback
+	oldReader := crand.Reader
+	crand.Reader = strings.NewReader("")
 
 	defer func() {
-		rand.Reader = old
+		crand.Reader = oldReader
+		randFallback = oldFallback
 	}()
 
 	oldOut := os.Stdout
@@ -61,7 +63,7 @@ func TestPwgenNoCrand(t *testing.T) {
 	}()
 
 	// if we seed math/rand with 1789, the first "random number" will be 42
-	mrand.Seed(1789)
+	randFallback = rand.New(rand.NewSource(1789))
 
 	n := randomInteger(1024)
 
diff --git a/pkg/pwgen/rand.go b/pkg/pwgen/rand.go
index 76d9cb9859..7bff1ecab7 100644
--- a/pkg/pwgen/rand.go
+++ b/pkg/pwgen/rand.go
@@ -11,9 +11,11 @@ import (
 
 func init() {
 	// seed math/rand in case we have to fall back to using it
-	rand.Seed(time.Now().Unix() + int64(os.Getpid()+os.Getppid()))
+	randFallback = rand.New(rand.NewSource(time.Now().Unix() + int64(os.Getpid()+os.Getppid())))
 }
 
+var randFallback *rand.Rand
+
 func randomInteger(max int) int {
 	i, err := crand.Int(crand.Reader, big.NewInt(int64(max)))
 	if err == nil {
@@ -22,5 +24,5 @@ func randomInteger(max int) int {
 
 	fmt.Fprintln(os.Stderr, "WARNING: No crypto/rand available. Falling back to PRNG")
 
-	return rand.Intn(max)
+	return randFallback.Intn(max)
 }