diff --git a/src/internal/runtime/syscall/defs_linux.go b/src/internal/runtime/syscall/defs_linux.go
index b2e36a244f8201..ff3d835c2e48b0 100644
--- a/src/internal/runtime/syscall/defs_linux.go
+++ b/src/internal/runtime/syscall/defs_linux.go
@@ -16,4 +16,7 @@ const (
 	EPOLL_CTL_DEL = 0x2
 	EPOLL_CTL_MOD = 0x3
 	EFD_CLOEXEC   = 0x80000
+	GRND_NONBLOCK = 0x01
+	GRND_RANDOM   = 0x02
+	GRND_INSECURE = 0x04
 )
diff --git a/src/internal/runtime/syscall/defs_linux_386.go b/src/internal/runtime/syscall/defs_linux_386.go
index 68e687fb14b71b..3570b6c9dc3b7a 100644
--- a/src/internal/runtime/syscall/defs_linux_386.go
+++ b/src/internal/runtime/syscall/defs_linux_386.go
@@ -12,6 +12,7 @@ const (
 	SYS_EPOLL_CREATE1 = 329
 	SYS_EPOLL_PWAIT2  = 441
 	SYS_EVENTFD2      = 328
+	SYS_GETRANDOM     = 355
 
 	EFD_NONBLOCK = 0x800
 )
diff --git a/src/internal/runtime/syscall/defs_linux_amd64.go b/src/internal/runtime/syscall/defs_linux_amd64.go
index ec480f5817e031..f81b319e7ef872 100644
--- a/src/internal/runtime/syscall/defs_linux_amd64.go
+++ b/src/internal/runtime/syscall/defs_linux_amd64.go
@@ -12,6 +12,7 @@ const (
 	SYS_EPOLL_CREATE1 = 291
 	SYS_EPOLL_PWAIT2  = 441
 	SYS_EVENTFD2      = 290
+	SYS_GETRANDOM     = 318
 
 	EFD_NONBLOCK = 0x800
 )
diff --git a/src/internal/runtime/syscall/defs_linux_arm.go b/src/internal/runtime/syscall/defs_linux_arm.go
index c5d1503012304c..da113cda751f43 100644
--- a/src/internal/runtime/syscall/defs_linux_arm.go
+++ b/src/internal/runtime/syscall/defs_linux_arm.go
@@ -12,6 +12,7 @@ const (
 	SYS_EPOLL_CREATE1 = 357
 	SYS_EPOLL_PWAIT2  = 441
 	SYS_EVENTFD2      = 356
+	SYS_GETRANDOM     = 384
 
 	EFD_NONBLOCK = 0x800
 )
diff --git a/src/internal/runtime/syscall/defs_linux_arm64.go b/src/internal/runtime/syscall/defs_linux_arm64.go
index f743fe31a58d1a..77f24034e91732 100644
--- a/src/internal/runtime/syscall/defs_linux_arm64.go
+++ b/src/internal/runtime/syscall/defs_linux_arm64.go
@@ -12,6 +12,7 @@ const (
 	SYS_MPROTECT      = 226
 	SYS_EPOLL_PWAIT2  = 441
 	SYS_EVENTFD2      = 19
+	SYS_GETRANDOM     = 278
 
 	EFD_NONBLOCK = 0x800
 )
diff --git a/src/internal/runtime/syscall/defs_linux_loong64.go b/src/internal/runtime/syscall/defs_linux_loong64.go
index 82218d15099aa5..1792a545b8ad6f 100644
--- a/src/internal/runtime/syscall/defs_linux_loong64.go
+++ b/src/internal/runtime/syscall/defs_linux_loong64.go
@@ -12,6 +12,7 @@ const (
 	SYS_MPROTECT      = 226
 	SYS_EPOLL_PWAIT2  = 441
 	SYS_EVENTFD2      = 19
+	SYS_GETRANDOM     = 278
 
 	EFD_NONBLOCK = 0x800
 )
diff --git a/src/internal/runtime/syscall/defs_linux_mips64x.go b/src/internal/runtime/syscall/defs_linux_mips64x.go
index 4e0fd1f5d1b10a..c4c969d7f0007c 100644
--- a/src/internal/runtime/syscall/defs_linux_mips64x.go
+++ b/src/internal/runtime/syscall/defs_linux_mips64x.go
@@ -14,6 +14,7 @@ const (
 	SYS_EPOLL_CREATE1 = 5285
 	SYS_EPOLL_PWAIT2  = 5441
 	SYS_EVENTFD2      = 5284
+	SYS_GETRANDOM     = 5313
 
 	EFD_NONBLOCK = 0x80
 )
diff --git a/src/internal/runtime/syscall/defs_linux_mipsx.go b/src/internal/runtime/syscall/defs_linux_mipsx.go
index b87a355093e489..b8c7853f1bfc91 100644
--- a/src/internal/runtime/syscall/defs_linux_mipsx.go
+++ b/src/internal/runtime/syscall/defs_linux_mipsx.go
@@ -14,6 +14,7 @@ const (
 	SYS_EPOLL_CREATE1 = 4326
 	SYS_EPOLL_PWAIT2  = 4441
 	SYS_EVENTFD2      = 4325
+	SYS_GETRANDOM     = 4353
 
 	EFD_NONBLOCK = 0x80
 )
diff --git a/src/internal/runtime/syscall/defs_linux_ppc64x.go b/src/internal/runtime/syscall/defs_linux_ppc64x.go
index 8235edd795fa85..5548ee4268ebfb 100644
--- a/src/internal/runtime/syscall/defs_linux_ppc64x.go
+++ b/src/internal/runtime/syscall/defs_linux_ppc64x.go
@@ -14,6 +14,7 @@ const (
 	SYS_EPOLL_CREATE1 = 315
 	SYS_EPOLL_PWAIT2  = 441
 	SYS_EVENTFD2      = 314
+	SYS_GETRANDOM     = 359
 
 	EFD_NONBLOCK = 0x800
 )
diff --git a/src/internal/runtime/syscall/defs_linux_riscv64.go b/src/internal/runtime/syscall/defs_linux_riscv64.go
index 82218d15099aa5..1792a545b8ad6f 100644
--- a/src/internal/runtime/syscall/defs_linux_riscv64.go
+++ b/src/internal/runtime/syscall/defs_linux_riscv64.go
@@ -12,6 +12,7 @@ const (
 	SYS_MPROTECT      = 226
 	SYS_EPOLL_PWAIT2  = 441
 	SYS_EVENTFD2      = 19
+	SYS_GETRANDOM     = 278
 
 	EFD_NONBLOCK = 0x800
 )
diff --git a/src/internal/runtime/syscall/defs_linux_s390x.go b/src/internal/runtime/syscall/defs_linux_s390x.go
index 08073c01f091b4..6f5b463e02c1c2 100644
--- a/src/internal/runtime/syscall/defs_linux_s390x.go
+++ b/src/internal/runtime/syscall/defs_linux_s390x.go
@@ -12,6 +12,7 @@ const (
 	SYS_EPOLL_CREATE1 = 327
 	SYS_EPOLL_PWAIT2  = 441
 	SYS_EVENTFD2      = 323
+	SYS_GETRANDOM     = 349
 
 	EFD_NONBLOCK = 0x800
 )
diff --git a/src/internal/runtime/syscall/syscall_linux.go b/src/internal/runtime/syscall/syscall_linux.go
index 83df825169b907..a0564214087aca 100644
--- a/src/internal/runtime/syscall/syscall_linux.go
+++ b/src/internal/runtime/syscall/syscall_linux.go
@@ -42,3 +42,14 @@ func Eventfd(initval, flags int32) (fd int32, errno uintptr) {
 	r1, _, e := Syscall6(SYS_EVENTFD2, uintptr(initval), uintptr(flags), 0, 0, 0, 0)
 	return int32(r1), e
 }
+
+func Getrandom(buf []byte, flags int32) (ret int32, errno uintptr) {
+	var p unsafe.Pointer
+	if len(buf) > 0 {
+		p = unsafe.Pointer(&buf[0])
+	} else {
+		p = unsafe.Pointer(&_zero)
+	}
+	r, _, e := Syscall6(SYS_GETRANDOM, uintptr(p), uintptr(len(buf)), uintptr(flags), 0, 0, 0)
+	return int32(r), e
+}
diff --git a/src/runtime/os_linux.go b/src/runtime/os_linux.go
index 3911276cf2c7f4..24a25c6ea84dd1 100644
--- a/src/runtime/os_linux.go
+++ b/src/runtime/os_linux.go
@@ -346,12 +346,8 @@ func osinit() {
 	osArchInit()
 }
 
-var urandom_dev = []byte("/dev/urandom\x00")
-
 func readRandom(r []byte) int {
-	fd := open(&urandom_dev[0], 0 /* O_RDONLY */, 0)
-	n := read(fd, unsafe.Pointer(&r[0]), int32(len(r)))
-	closefd(fd)
+	n, _ := syscall.Getrandom(r, 0)
 	return int(n)
 }