diff --git a/Gopkg.lock b/Gopkg.lock
index b45aed0bd1..83b849cbfa 100644
--- a/Gopkg.lock
+++ b/Gopkg.lock
@@ -165,6 +165,14 @@
   revision = "a41e3c4b706f6ae8dfbff342b06e40fa4d2d0506"
   version = "v1.2.1"
 
+[[projects]]
+  digest = "1:c594a691090b434d55c67f6cc8e326ef5ba49452abc059821bd5d4fd4cdef08c"
+  name = "github.com/gofrs/uuid"
+  packages = ["."]
+  pruneopts = "UT"
+  revision = "7077aa61129615a0d7f45c49101cd011ab221c27"
+  version = "v3.1.2"
+
 [[projects]]
   branch = "master"
   digest = "1:1ba1d79f2810270045c328ae5d674321db34e3aae468eb4233883b473c5c0467"
@@ -419,14 +427,6 @@
   revision = "dcda3199365ca2a5f24aea4c42aa56f6a197d117"
   version = "v1.1.2"
 
-[[projects]]
-  digest = "1:274f67cb6fed9588ea2521ecdac05a6d62a8c51c074c1fccc6a49a40ba80e925"
-  name = "github.com/satori/go.uuid"
-  packages = ["."]
-  pruneopts = "UT"
-  revision = "f58768cc1a7a7e77a3bd49e98cdd21419399b6a3"
-  version = "v1.2.0"
-
 [[projects]]
   digest = "1:7395b855a6078ad2e6c40311402a057a91125fb9f32cf228e1b32cdc57c33538"
   name = "github.com/shirou/gopsutil"
@@ -660,12 +660,15 @@
     "github.com/aws/aws-sdk-go/service/ec2",
     "github.com/aws/aws-sdk-go/service/iam",
     "github.com/dgrijalva/jwt-go",
+    "github.com/gofrs/uuid",
     "github.com/golang/mock/gomock",
+    "github.com/golang/protobuf/jsonpb",
     "github.com/golang/protobuf/proto",
     "github.com/golang/protobuf/protoc-gen-go",
     "github.com/golang/protobuf/protoc-gen-go/descriptor",
     "github.com/golang/protobuf/protoc-gen-go/plugin",
     "github.com/golang/protobuf/ptypes/empty",
+    "github.com/golang/protobuf/ptypes/struct",
     "github.com/golang/protobuf/ptypes/wrappers",
     "github.com/grpc-ecosystem/grpc-gateway/protoc-gen-grpc-gateway",
     "github.com/grpc-ecosystem/grpc-gateway/protoc-gen-swagger",
@@ -682,7 +685,6 @@
     "github.com/jinzhu/gorm/dialects/sqlite",
     "github.com/jteeuwen/go-bindata/go-bindata",
     "github.com/mitchellh/cli",
-    "github.com/satori/go.uuid",
     "github.com/shirou/gopsutil/process",
     "github.com/sirupsen/logrus",
     "github.com/sirupsen/logrus/hooks/test",
diff --git a/Gopkg.toml b/Gopkg.toml
index 057e572e97..246068a894 100644
--- a/Gopkg.toml
+++ b/Gopkg.toml
@@ -25,7 +25,7 @@
 #   unused-packages = true
 
 required = ["github.com/hashicorp/go-plugin",
-  "github.com/satori/go.uuid",
+  "github.com/gofrs/uuid",
   "github.com/golang/protobuf/protoc-gen-go",
   "github.com/grpc-ecosystem/grpc-gateway/protoc-gen-grpc-gateway",
   "github.com/grpc-ecosystem/grpc-gateway/protoc-gen-swagger",
@@ -88,8 +88,8 @@ required = ["github.com/hashicorp/go-plugin",
   version = "1.0.0"
 
 [[constraint]]
-  name = "github.com/satori/go.uuid"
-  version = "1.2.0"
+  name = "github.com/gofrs/uuid"
+  version = "3.1.2"
 
 [[constraint]]
   name = "github.com/shirou/gopsutil"
diff --git a/pkg/agent/manager/cache/subscriber.go b/pkg/agent/manager/cache/subscriber.go
index 8228917634..ec0fa3c00d 100644
--- a/pkg/agent/manager/cache/subscriber.go
+++ b/pkg/agent/manager/cache/subscriber.go
@@ -3,7 +3,7 @@ package cache
 import (
 	"sync"
 
-	"github.com/satori/go.uuid"
+	"github.com/gofrs/uuid"
 	"github.com/spiffe/spire/pkg/common/selector"
 )
 
@@ -33,10 +33,14 @@ type subscribers struct {
 }
 
 func NewSubscriber(selectors Selectors) (*subscriber, error) {
+	u, err := uuid.NewV4()
+	if err != nil {
+		return nil, err
+	}
 	return &subscriber{
 		c:      make(chan *WorkloadUpdate, 1),
 		sel:    selectors,
-		sid:    uuid.NewV4(),
+		sid:    u,
 		active: true,
 	}, nil
 }
diff --git a/pkg/agent/plugin/nodeattestor/k8s/sat.go b/pkg/agent/plugin/nodeattestor/k8s/sat.go
index 2a9cee8c73..91247c80e4 100644
--- a/pkg/agent/plugin/nodeattestor/k8s/sat.go
+++ b/pkg/agent/plugin/nodeattestor/k8s/sat.go
@@ -6,8 +6,8 @@ import (
 	"io/ioutil"
 	"sync"
 
+	"github.com/gofrs/uuid"
 	"github.com/hashicorp/hcl"
-	uuid "github.com/satori/go.uuid"
 	"github.com/spiffe/spire/pkg/common/plugin/k8s"
 	"github.com/spiffe/spire/proto/agent/nodeattestor"
 	"github.com/spiffe/spire/proto/common"
@@ -41,7 +41,7 @@ type SATAttestorPlugin struct {
 	config *satAttestorConfig
 
 	hooks struct {
-		newUUID func() string
+		newUUID func() (string, error)
 	}
 }
 
@@ -49,8 +49,12 @@ var _ nodeattestor.Plugin = (*SATAttestorPlugin)(nil)
 
 func NewSATAttestorPlugin() *SATAttestorPlugin {
 	p := &SATAttestorPlugin{}
-	p.hooks.newUUID = func() string {
-		return uuid.NewV4().String()
+	p.hooks.newUUID = func() (string, error) {
+		u, err := uuid.NewV4()
+		if err != nil {
+			return "", err
+		}
+		return u.String(), nil
 	}
 	return p
 }
@@ -61,7 +65,10 @@ func (p *SATAttestorPlugin) FetchAttestationData(stream nodeattestor.FetchAttest
 		return err
 	}
 
-	uuid := p.hooks.newUUID()
+	uuid, err := p.hooks.newUUID()
+	if err != nil {
+		return err
+	}
 
 	token, err := loadTokenFromFile(config.tokenPath)
 	if err != nil {
diff --git a/pkg/agent/plugin/nodeattestor/k8s/sat_test.go b/pkg/agent/plugin/nodeattestor/k8s/sat_test.go
index 30485d3617..47d1ca417c 100644
--- a/pkg/agent/plugin/nodeattestor/k8s/sat_test.go
+++ b/pkg/agent/plugin/nodeattestor/k8s/sat_test.go
@@ -116,8 +116,8 @@ func (s *SATAttestorSuite) TestGetPluginInfo() {
 
 func (s *SATAttestorSuite) newAttestor() {
 	attestor := NewSATAttestorPlugin()
-	attestor.hooks.newUUID = func() string {
-		return "UUID"
+	attestor.hooks.newUUID = func() (string, error) {
+		return "UUID", nil
 	}
 	s.attestor = nodeattestor.NewBuiltIn(attestor)
 }
diff --git a/pkg/server/endpoints/registration/handler.go b/pkg/server/endpoints/registration/handler.go
index da95429d52..960a3e4948 100644
--- a/pkg/server/endpoints/registration/handler.go
+++ b/pkg/server/endpoints/registration/handler.go
@@ -6,9 +6,9 @@ import (
 	"net/url"
 	"time"
 
+	"github.com/gofrs/uuid"
 	"github.com/golang/protobuf/proto"
 	"github.com/golang/protobuf/ptypes/wrappers"
-	"github.com/satori/go.uuid"
 	"github.com/sirupsen/logrus"
 	"github.com/spiffe/spire/pkg/common/bundleutil"
 	"github.com/spiffe/spire/pkg/common/idutil"
@@ -425,7 +425,11 @@ func (h *Handler) CreateJoinToken(
 
 	// Generate a token if one wasn't specified
 	if request.Token == "" {
-		request.Token = uuid.NewV4().String()
+		u, err := uuid.NewV4()
+		if err != nil {
+			return nil, errors.New("Error generating uuid token: %v")
+		}
+		request.Token = u.String()
 	}
 
 	ds := h.getDataStore()
diff --git a/pkg/server/plugin/datastore/sql/sql.go b/pkg/server/plugin/datastore/sql/sql.go
index e8fa21700c..55992871bd 100644
--- a/pkg/server/plugin/datastore/sql/sql.go
+++ b/pkg/server/plugin/datastore/sql/sql.go
@@ -10,11 +10,11 @@ import (
 	"sync"
 	"time"
 
+	"github.com/gofrs/uuid"
 	"github.com/golang/protobuf/proto"
 	"github.com/hashicorp/hcl"
 	"github.com/jinzhu/gorm"
 	_ "github.com/jinzhu/gorm/dialects/sqlite"
-	uuid "github.com/satori/go.uuid"
 	"github.com/spiffe/spire/pkg/common/bundleutil"
 	"github.com/spiffe/spire/pkg/common/idutil"
 	"github.com/spiffe/spire/pkg/common/selector"
@@ -772,7 +772,10 @@ func createRegistrationEntry(tx *gorm.DB,
 		return nil, err
 	}
 
-	entryID := newRegistrationEntryID()
+	entryID, err := newRegistrationEntryID()
+	if err != nil {
+		return nil, err
+	}
 
 	newRegisteredEntry := RegisteredEntry{
 		EntryID:  entryID,
@@ -1235,8 +1238,12 @@ func modelToEntry(tx *gorm.DB, model RegisteredEntry) (*common.RegistrationEntry
 	}, nil
 }
 
-func newRegistrationEntryID() string {
-	return uuid.NewV4().String()
+func newRegistrationEntryID() (string, error) {
+	u, err := uuid.NewV4()
+	if err != nil {
+		return "", err
+	}
+	return u.String(), nil
 }
 
 func modelToAttestedNode(model AttestedNode) *datastore.AttestedNode {
diff --git a/test/fakes/fakedatastore/fakedatastore.go b/test/fakes/fakedatastore/fakedatastore.go
index 4dcb233ed6..9628d71dda 100644
--- a/test/fakes/fakedatastore/fakedatastore.go
+++ b/test/fakes/fakedatastore/fakedatastore.go
@@ -7,9 +7,9 @@ import (
 	"sort"
 	"sync"
 
+	"github.com/gofrs/uuid"
 	"github.com/golang/protobuf/proto"
 	_ "github.com/jinzhu/gorm/dialects/sqlite"
-	uuid "github.com/satori/go.uuid"
 	"github.com/spiffe/spire/pkg/common/bundleutil"
 	"github.com/spiffe/spire/pkg/common/selector"
 	"github.com/spiffe/spire/pkg/common/util"
@@ -310,7 +310,10 @@ func (s *DataStore) CreateRegistrationEntry(ctx context.Context,
 	s.mu.Lock()
 	defer s.mu.Unlock()
 
-	entryID := newRegistrationEntryID()
+	entryID, err := newRegistrationEntryID()
+	if err != nil {
+		return nil, err
+	}
 
 	entry := cloneRegistrationEntry(req.Entry)
 	entry.EntryId = entryID
@@ -603,8 +606,12 @@ func cloneJoinToken(token *datastore.JoinToken) *datastore.JoinToken {
 	return proto.Clone(token).(*datastore.JoinToken)
 }
 
-func newRegistrationEntryID() string {
-	return uuid.NewV4().String()
+func newRegistrationEntryID() (string, error) {
+	u, err := uuid.NewV4()
+	if err != nil {
+		return "", err
+	}
+	return u.String(), nil
 }
 
 func containsSelectors(selectors, subset []*common.Selector) bool {