diff --git a/cert_test.go b/cert_test.go
index 3800387..f387e6a 100644
--- a/cert_test.go
+++ b/cert_test.go
@@ -6,8 +6,9 @@ import (
 	"crypto/tls"
 	"crypto/x509"
 	"crypto/x509/pkix"
-	"log"
+	"log/slog"
 	"math/big"
+	"os"
 	"time"
 
 	"github.com/quic-go/quic-go/http3"
@@ -71,11 +72,13 @@ func generateLeafCert(ca *x509.Certificate, caPrivateKey *rsa.PrivateKey) (*x509
 func init() {
 	ca, caPrivateKey, err := generateCA()
 	if err != nil {
-		log.Fatal("failed to generate CA certificate:", err)
+		slog.Error("failed to generate CA certificate:", "err", err)
+		os.Exit(1)
 	}
 	leafCert, leafPrivateKey, err := generateLeafCert(ca, caPrivateKey)
 	if err != nil {
-		log.Fatal("failed to generate leaf certificate:", err)
+		slog.Error("failed to generate leaf certificate:", "err", err)
+		os.Exit(1)
 	}
 	certPool = x509.NewCertPool()
 	certPool.AddCert(ca)
diff --git a/cmd/client/main.go b/cmd/client/main.go
index 7a44a08..3ef9c2b 100644
--- a/cmd/client/main.go
+++ b/cmd/client/main.go
@@ -6,7 +6,7 @@ import (
 	"flag"
 	"fmt"
 	"io"
-	"log"
+	"log/slog"
 	"net"
 	"net/http"
 	"net/url"
@@ -30,7 +30,8 @@ func main() {
 	}
 	urls := flag.Args()
 	if len(urls) != 1 {
-		log.Fatal("usage: client -t <template> <url>")
+		slog.Error("usage: client -t <template> <url>")
+		os.Exit(1)
 	}
 
 	cl := masque.Client{
@@ -41,7 +42,8 @@ func main() {
 	}
 	host, port, err := extractHostAndPort(urls[0])
 	if err != nil {
-		log.Fatalf("failed to parse url: %v", err)
+		slog.Error("failed to parse url", "err", err)
+		os.Exit(1)
 	}
 
 	hcl := &http.Client{
@@ -53,9 +55,11 @@ func main() {
 				}
 				pconn, _, err := cl.Dial(context.Background(), uritemplate.MustNew(proxyURITemplate), raddr)
 				if err != nil {
-					log.Fatal("dialing MASQUE failed:", err)
+					slog.Error("dialing MASQUE failed", "err", err)
+					os.Exit(1)
 				}
-				log.Printf("dialed connection: %s <-> %s", pconn.LocalAddr(), raddr)
+				slog.Info(fmt.Sprintf("dialed connection: %s <-> %s", pconn.LocalAddr(), raddr))
+
 				quicConf = quicConf.Clone()
 				quicConf.DisablePathMTUDiscovery = true
 				return quic.DialEarly(ctx, pconn, raddr, tlsConf, quicConf)
@@ -64,14 +68,16 @@ func main() {
 	}
 	rsp, err := hcl.Get(urls[0])
 	if err != nil {
-		log.Fatalf("request failed: %v", err)
+		slog.Error("request failed", "err", err)
+		os.Exit(1)
 	}
-	log.Printf("HTTP status: %d", rsp.StatusCode)
+	slog.Info("HTTP status", "status", rsp.StatusCode)
 	data, err := io.ReadAll(rsp.Body)
 	if err != nil {
-		log.Fatalf("reading response body failed: %v", err)
+		slog.Error("reading response body failed", "err", err)
+		os.Exit(1)
 	}
-	log.Println(string(data))
+	slog.Info(string(data))
 }
 
 func extractHostAndPort(template string) (string, uint16, error) {
diff --git a/cmd/proxy/main.go b/cmd/proxy/main.go
index ff0dc5b..cbd94cb 100644
--- a/cmd/proxy/main.go
+++ b/cmd/proxy/main.go
@@ -4,7 +4,6 @@ import (
 	"crypto/tls"
 	"errors"
 	"flag"
-	"log"
 	"log/slog"
 	"net/http"
 	"net/url"
@@ -31,11 +30,13 @@ func main() {
 
 	template, err := uritemplate.New(templateStr)
 	if err != nil {
-		log.Fatalf("invalid template: %v", err)
+		slog.Error("invalid template", "err", err)
+		os.Exit(1)
 	}
 	cert, err := tls.LoadX509KeyPair(certFile, keyFile)
 	if err != nil {
-		log.Fatalf("failed to load certificate: %v", err)
+		slog.Error("failed to load certificate", "err", err)
+		os.Exit(1)
 	}
 	tlsConf := http3.ConfigureTLSConfig(&tls.Config{
 		Certificates: []tls.Certificate{cert},
@@ -51,7 +52,8 @@ func main() {
 	// parse the template to extract the path for the HTTP handler
 	u, err := url.Parse(templateStr)
 	if err != nil {
-		log.Fatalf("failed to parse URI template: %v", err)
+		slog.Error("failed to parse URI template", "err", err)
+		os.Exit(1)
 	}
 	http.HandleFunc(u.Path, func(w http.ResponseWriter, r *http.Request) {
 		req, err := masque.ParseRequest(r, template)
@@ -67,6 +69,7 @@ func main() {
 		proxy.Proxy(w, req)
 	})
 	if err := server.ListenAndServe(); err != nil {
-		log.Fatalf("failed to run proxy: %v", err)
+		slog.Error("failed to run proxy", "err", err)
+		os.Exit(1)
 	}
 }
diff --git a/conn.go b/conn.go
index 539c304..38525c8 100644
--- a/conn.go
+++ b/conn.go
@@ -5,7 +5,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"log"
+	"log/slog"
 	"net"
 	"os"
 	"sync"
@@ -51,7 +51,7 @@ func newProxiedConn(str http3.Stream, local net.Addr) *proxiedConn {
 	go func() {
 		defer close(c.readDone)
 		if err := skipCapsules(quicvarint.NewReader(str)); err != io.EOF && !c.closed.Load() {
-			log.Printf("reading from request stream failed: %v", err)
+			slog.Error("reading from request stream failed", "err", err)
 		}
 		str.Close()
 	}()
@@ -175,7 +175,7 @@ func skipCapsules(str quicvarint.Reader) error {
 		if err != nil {
 			return err
 		}
-		log.Printf("skipping capsule of type %d", ct)
+		slog.Info("skipping capsule", "type", ct)
 		if _, err := io.Copy(io.Discard, r); err != nil {
 			return err
 		}
diff --git a/conn_test.go b/conn_test.go
index 8365350..c197463 100644
--- a/conn_test.go
+++ b/conn_test.go
@@ -4,21 +4,23 @@ import (
 	"bytes"
 	"context"
 	"errors"
-	"golang.org/x/exp/rand"
 	"io"
-	"log"
+	"log/slog"
 	"os"
 	"testing"
 	"time"
 
+	"golang.org/x/exp/rand"
+
 	"github.com/quic-go/quic-go/http3"
 	"github.com/stretchr/testify/require"
 	"go.uber.org/mock/gomock"
 )
 
 func TestCapsuleSkipping(t *testing.T) {
-	log.SetOutput(io.Discard)
-	defer log.SetOutput(os.Stderr)
+	oldLogger := slog.Default()
+	slog.SetDefault(slog.New(slog.NewTextHandler(io.Discard, nil)))
+	defer slog.SetDefault(oldLogger)
 
 	var buf bytes.Buffer
 	require.NoError(t, http3.WriteCapsule(&buf, 1337, []byte("foo")))
diff --git a/proxy.go b/proxy.go
index e1b754d..ed8d8ab 100644
--- a/proxy.go
+++ b/proxy.go
@@ -3,7 +3,7 @@ package masque
 import (
 	"context"
 	"io"
-	"log"
+	"log/slog"
 	"net"
 	"net/http"
 	"sync"
@@ -92,14 +92,14 @@ func (s *Proxy) ProxyConnectedSocket(w http.ResponseWriter, _ *Request, conn *ne
 	go func() {
 		defer wg.Done()
 		if err := s.proxyConnSend(conn, str); err != nil {
-			log.Printf("proxying send side to %s failed: %v", conn.RemoteAddr(), err)
+			slog.Error("proxying send side failed", "remoteAddr", conn.RemoteAddr(), "err", err)
 		}
 		str.Close()
 	}()
 	go func() {
 		defer wg.Done()
 		if err := s.proxyConnReceive(conn, str); err != nil && !s.closed.Load() {
-			log.Printf("proxying receive side to %s failed: %v", conn.RemoteAddr(), err)
+			slog.Error("proxying receive side failed", "remoteAddr", conn.RemoteAddr(), "err", err)
 		}
 		str.Close()
 	}()
@@ -107,7 +107,7 @@ func (s *Proxy) ProxyConnectedSocket(w http.ResponseWriter, _ *Request, conn *ne
 		defer wg.Done()
 		// discard all capsules sent on the request stream
 		if err := skipCapsules(quicvarint.NewReader(str)); err == io.EOF {
-			log.Printf("reading from request stream failed: %v", err)
+			slog.Error("reading from request stream failed", "err", err)
 		}
 		str.Close()
 		conn.Close()