diff --git a/go.mod b/go.mod
index f59de9eec..8ca701ffa 100644
--- a/go.mod
+++ b/go.mod
@@ -26,7 +26,6 @@ require (
 	github.com/pkg/errors v0.9.1
 	github.com/prometheus/client_golang v1.23.2
 	github.com/rs/xid v1.6.0
-	github.com/sirupsen/logrus v1.9.3
 	github.com/slackhq/nebula v1.9.7
 	github.com/smallstep/assert v0.0.0-20200723003110-82e2b9b3b262
 	github.com/smallstep/cli-utils v0.12.2
diff --git a/go.sum b/go.sum
index 12f10214c..1fa53c2a6 100644
--- a/go.sum
+++ b/go.sum
@@ -475,7 +475,6 @@ golang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220310020820-b874c991c1a5/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220503163025-988cb79eb6c6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
diff --git a/logging/clf.go b/logging/clf.go
index 0e4d9ae9b..d2e53109d 100644
--- a/logging/clf.go
+++ b/logging/clf.go
@@ -2,31 +2,47 @@ package logging
 
 import (
 	"bytes"
+	"context"
 	"fmt"
+	"io"
+	"log/slog"
 	"strconv"
 	"time"
-
-	"github.com/sirupsen/logrus"
 )
 
 var clfFields = [...]string{
 	"request-id", "remote-address", "name", "user-id", "time", "duration", "method", "path", "protocol", "status", "size",
 }
 
-// CommonLogFormat implements the logrus.Formatter interface it writes logrus
+// CommonLogFormat implements the slog.Handler interface it writes slog
 // entries using a CLF format prepended by the request-id.
-type CommonLogFormat struct{}
+type CommonLogFormat struct {
+	output io.Writer
+}
+
+// Enabled implements the slog.Handler interface.
+func (f *CommonLogFormat) Enabled(ctx context.Context, level slog.Level) bool {
+	return true
+}
 
-// Format implements the logrus.Formatter interface. It returns the given
-// logrus entry as a CLF line with the following format:
+// Handle implements the slog.Handler interface. It returns the given
+// slog record as a CLF line with the following format:
 //
 //	<request-id> <remote-address> <name> <user-id> <time> <duration> "<method> <path> <protocol>" <status> <size>
 //
 // If a field is not known, the hyphen symbol (-) will be used.
-func (f *CommonLogFormat) Format(entry *logrus.Entry) ([]byte, error) {
+func (f *CommonLogFormat) Handle(ctx context.Context, record slog.Record) error {
 	data := make([]string, len(clfFields))
+
+	// Extract fields from the record
+	fields := make(map[string]interface{})
+	record.Attrs(func(attr slog.Attr) bool {
+		fields[attr.Key] = attr.Value.Any()
+		return true
+	})
+
 	for i, name := range clfFields {
-		if v, ok := entry.Data[name]; ok {
+		if v, ok := fields[name]; ok {
 			switch v := v.(type) {
 			case error:
 				data[i] = v.Error()
@@ -75,5 +91,21 @@ func (f *CommonLogFormat) Format(entry *logrus.Entry) ([]byte, error) {
 	buf.WriteByte(' ')
 	buf.WriteString(data[10])
 	buf.WriteByte('\n')
-	return buf.Bytes(), nil
+
+	_, err := f.output.Write(buf.Bytes())
+	return err
+}
+
+// WithAttrs implements the slog.Handler interface.
+func (f *CommonLogFormat) WithAttrs(attrs []slog.Attr) slog.Handler {
+	// For simplicity, return the same handler since CLF format
+	// doesn't support additional attributes
+	return f
+}
+
+// WithGroup implements the slog.Handler interface.
+func (f *CommonLogFormat) WithGroup(name string) slog.Handler {
+	// For simplicity, return the same handler since CLF format
+	// doesn't support groups
+	return f
 }
diff --git a/logging/handler.go b/logging/handler.go
index e9823c671..9e75e5aa0 100644
--- a/logging/handler.go
+++ b/logging/handler.go
@@ -1,6 +1,7 @@
 package logging
 
 import (
+	"log/slog"
 	"net"
 	"net/http"
 	"os"
@@ -8,8 +9,6 @@ import (
 	"strings"
 	"time"
 
-	"github.com/sirupsen/logrus"
-
 	"github.com/smallstep/certificates/internal/userid"
 	"github.com/smallstep/certificates/middleware/requestid"
 )
@@ -25,7 +24,7 @@ var (
 // LoggerHandler creates a logger handler
 type LoggerHandler struct {
 	name    string
-	logger  *logrus.Logger
+	logger  *slog.Logger
 	options options
 	next    http.Handler
 }
@@ -104,38 +103,39 @@ func (l *LoggerHandler) writeEntry(w ResponseLogger, r *http.Request, t time.Tim
 
 	status := w.StatusCode()
 
-	fields := logrus.Fields{
-		"request-id":     requestID,
-		"remote-address": addr,
-		"name":           l.name,
-		"user-id":        userID,
-		"time":           t.Format(time.RFC3339),
-		"duration-ns":    d.Nanoseconds(),
-		"duration":       d.String(),
-		"method":         r.Method,
-		"path":           uri,
-		"protocol":       r.Proto,
-		"status":         status,
-		"size":           w.Size(),
-		"referer":        sanitizeLogEntry(r.Referer()),
-		"user-agent":     sanitizeLogEntry(r.UserAgent()),
+	attrs := []slog.Attr{
+		slog.String("request-id", requestID),
+		slog.String("remote-address", addr),
+		slog.String("name", l.name),
+		slog.String("user-id", userID),
+		slog.String("time", t.Format(time.RFC3339)),
+		slog.Int64("duration-ns", d.Nanoseconds()),
+		slog.String("duration", d.String()),
+		slog.String("method", r.Method),
+		slog.String("path", uri),
+		slog.String("protocol", r.Proto),
+		slog.Int("status", status),
+		slog.Int("size", w.Size()),
+		slog.String("referer", sanitizeLogEntry(r.Referer())),
+		slog.String("user-agent", sanitizeLogEntry(r.UserAgent())),
 	}
 
+	// Add additional fields from ResponseLogger
 	for k, v := range w.Fields() {
-		fields[k] = v
+		attrs = append(attrs, slog.Any(k, v))
 	}
 
 	switch {
 	case status < http.StatusBadRequest:
 		if l.options.onlyTraceHealthEndpoint && uri == "/health" {
-			l.logger.WithFields(fields).Trace()
+			l.logger.LogAttrs(r.Context(), slog.LevelDebug-1, "", attrs...) // Use Debug-1 as trace level
 		} else {
-			l.logger.WithFields(fields).Info()
+			l.logger.LogAttrs(r.Context(), slog.LevelInfo, "", attrs...)
 		}
 	case status < http.StatusInternalServerError:
-		l.logger.WithFields(fields).Warn()
+		l.logger.LogAttrs(r.Context(), slog.LevelWarn, "", attrs...)
 	default:
-		l.logger.WithFields(fields).Error()
+		l.logger.LogAttrs(r.Context(), slog.LevelError, "", attrs...)
 	}
 }
 
diff --git a/logging/handler_test.go b/logging/handler_test.go
index ceae62ccc..e43070192 100644
--- a/logging/handler_test.go
+++ b/logging/handler_test.go
@@ -1,17 +1,79 @@
 package logging
 
 import (
+	"context"
 	"fmt"
+	"log/slog"
 	"net/http"
 	"net/http/httptest"
+	"sync"
 	"testing"
 
 	"github.com/smallstep/assert"
-
-	"github.com/sirupsen/logrus"
-	"github.com/sirupsen/logrus/hooks/test"
 )
 
+// testHandler is a custom slog handler for testing that records log entries
+type testHandler struct {
+	mu      sync.Mutex
+	entries []testEntry
+}
+
+type testEntry struct {
+	level   slog.Level
+	message string
+	attrs   map[string]interface{}
+}
+
+func newTestHandler() *testHandler {
+	return &testHandler{
+		entries: make([]testEntry, 0),
+	}
+}
+
+func (h *testHandler) Enabled(_ context.Context, level slog.Level) bool {
+	return true
+}
+
+func (h *testHandler) Handle(_ context.Context, record slog.Record) error {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+
+	attrs := make(map[string]interface{})
+	record.Attrs(func(attr slog.Attr) bool {
+		attrs[attr.Key] = attr.Value.Any()
+		return true
+	})
+
+	h.entries = append(h.entries, testEntry{
+		level:   record.Level,
+		message: record.Message,
+		attrs:   attrs,
+	})
+	return nil
+}
+
+func (h *testHandler) WithAttrs(attrs []slog.Attr) slog.Handler {
+	return h
+}
+
+func (h *testHandler) WithGroup(name string) slog.Handler {
+	return h
+}
+
+func (h *testHandler) getEntries() []testEntry {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+	return append([]testEntry(nil), h.entries...)
+}
+
+func (h *testHandler) lastEntry() *testEntry {
+	entries := h.getEntries()
+	if len(entries) == 0 {
+		return nil
+	}
+	return &entries[len(entries)-1]
+}
+
 // TestHealthOKHandling ensures that http requests from the Kubernetes
 // liveness/readiness probes are only logged at Trace level if they are HTTP
 // 200 (which is normal operation) and the user has opted-in. If the user has
@@ -29,13 +91,13 @@ func TestHealthOKHandling(t *testing.T) {
 		path    string
 		options options
 		handler http.HandlerFunc
-		want    logrus.Level
+		want    slog.Level
 	}{
 		{
 			name:    "200 should be logged at Info level for /health request without explicit opt-in",
 			path:    "/health",
 			handler: statusHandler(http.StatusOK),
-			want:    logrus.InfoLevel,
+			want:    slog.LevelInfo,
 		},
 		{
 			name: "200 should be logged only at Trace level for /health request if opt-in",
@@ -44,14 +106,15 @@ func TestHealthOKHandling(t *testing.T) {
 				onlyTraceHealthEndpoint: true,
 			},
 			handler: statusHandler(http.StatusOK),
-			want:    logrus.TraceLevel,
+			want:    slog.LevelDebug - 1, // Trace level
 		},
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			logger, hook := test.NewNullLogger()
-			logger.SetLevel(logrus.TraceLevel)
+			testHandler := newTestHandler()
+			logger := slog.New(testHandler)
+
 			l := &LoggerHandler{
 				logger:  logger,
 				options: tt.options,
@@ -62,8 +125,9 @@ func TestHealthOKHandling(t *testing.T) {
 			w := httptest.NewRecorder()
 			l.ServeHTTP(w, r)
 
-			if assert.Equals(t, 1, len(hook.AllEntries())) {
-				assert.Equals(t, tt.want, hook.LastEntry().Level)
+			entries := testHandler.getEntries()
+			if assert.Equals(t, 1, len(entries)) {
+				assert.Equals(t, tt.want, entries[0].level)
 			}
 		})
 	}
@@ -85,45 +149,46 @@ func TestHandlingRegardlessOfOptions(t *testing.T) {
 		name    string
 		path    string
 		handler http.HandlerFunc
-		want    logrus.Level
+		want    slog.Level
 	}{
 		{
 			name:    "200 should be logged at Info level for non-health requests",
 			path:    "/info",
 			handler: statusHandler(http.StatusOK),
-			want:    logrus.InfoLevel,
+			want:    slog.LevelInfo,
 		},
 		{
 			name:    "400 should be logged at Warn level for non-health requests",
 			path:    "/info",
 			handler: statusHandler(http.StatusBadRequest),
-			want:    logrus.WarnLevel,
+			want:    slog.LevelWarn,
 		},
 		{
 			name:    "500 should be logged at Error level for non-health requests",
 			path:    "/info",
 			handler: statusHandler(http.StatusInternalServerError),
-			want:    logrus.ErrorLevel,
+			want:    slog.LevelError,
 		},
 		{
 			name:    "400 should be logged at Warn level even for /health requests",
 			path:    "/health",
 			handler: statusHandler(http.StatusBadRequest),
-			want:    logrus.WarnLevel,
+			want:    slog.LevelWarn,
 		},
 		{
 			name:    "500 should be logged at Error level even for /health requests",
 			path:    "/health",
 			handler: statusHandler(http.StatusInternalServerError),
-			want:    logrus.ErrorLevel,
+			want:    slog.LevelError,
 		},
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			for _, b := range []bool{true, false} {
-				logger, hook := test.NewNullLogger()
-				logger.SetLevel(logrus.TraceLevel)
+				testHandler := newTestHandler()
+				logger := slog.New(testHandler)
+
 				l := &LoggerHandler{
 					logger: logger,
 					options: options{
@@ -136,8 +201,9 @@ func TestHandlingRegardlessOfOptions(t *testing.T) {
 				w := httptest.NewRecorder()
 				l.ServeHTTP(w, r)
 
-				if assert.Equals(t, 1, len(hook.AllEntries())) {
-					assert.Equals(t, tt.want, hook.LastEntry().Level)
+				entries := testHandler.getEntries()
+				if assert.Equals(t, 1, len(entries)) {
+					assert.Equals(t, tt.want, entries[0].level)
 				}
 			}
 		})
@@ -239,9 +305,9 @@ func TestLogRealIP(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			t.Setenv("STEP_LOGGER_LOG_REAL_IP", tt.logRealIP)
 
-			baseLogger, hook := test.NewNullLogger()
+			testHandler := newTestHandler()
 			logger := &Logger{
-				Logger: baseLogger,
+				Logger: slog.New(testHandler),
 			}
 			l := NewLoggerHandler("test", logger, statusHandler(http.StatusOK))
 
@@ -253,10 +319,11 @@ func TestLogRealIP(t *testing.T) {
 			w := httptest.NewRecorder()
 			l.ServeHTTP(w, r)
 
-			if assert.Equals(t, 1, len(hook.AllEntries())) {
-				entry := hook.LastEntry()
-				assert.Equals(t, tt.expected, entry.Data["remote-address"])
+			entries := testHandler.getEntries()
+			if assert.Equals(t, 1, len(entries)) {
+				entry := entries[0]
+				assert.Equals(t, tt.expected, entry.attrs["remote-address"])
 			}
 		})
 	}
-}
+}
\ No newline at end of file
diff --git a/logging/logger.go b/logging/logger.go
index 1716a7f4c..c9d0f3bbd 100644
--- a/logging/logger.go
+++ b/logging/logger.go
@@ -2,25 +2,27 @@ package logging
 
 import (
 	"encoding/json"
+	"io"
+	"log/slog"
 	"net/http"
 	"os"
 	"strings"
 
 	"github.com/pkg/errors"
-	"github.com/sirupsen/logrus"
 )
 
 // defaultTraceIdHeader is the default header used as a trace id.
 const defaultTraceIDHeader = "X-Smallstep-Id"
 
 // ErrorKey defines the key used to log errors.
-var ErrorKey = logrus.ErrorKey
+const ErrorKey = "error"
 
-// Logger is an alias of logrus.Logger.
+// Logger wraps slog.Logger with additional functionality.
 type Logger struct {
-	*logrus.Logger
+	*slog.Logger
 	name        string
 	traceHeader string
+	handler     slog.Handler
 }
 
 // loggerConfig represents the configuration options for the logger.
@@ -36,37 +38,42 @@ func New(name string, raw json.RawMessage) (*Logger, error) {
 		return nil, errors.Wrap(err, "error unmarshalling logging attribute")
 	}
 
-	var formatter logrus.Formatter
+	var output io.Writer = os.Stderr
+	var handler slog.Handler
+
 	switch strings.ToLower(config.Format) {
 	case "", "text":
 		_, noColor := os.LookupEnv("NO_COLOR")
-		// With EnvironmentOverrideColors set, logrus looks at CLICOLOR and
-		// CLICOLOR_FORCE
-		formatter = &logrus.TextFormatter{
-			DisableColors:             noColor,
-			EnvironmentOverrideColors: true,
+		opts := &slog.HandlerOptions{
+			Level: slog.LevelDebug,
+		}
+		if noColor {
+			handler = slog.NewTextHandler(output, opts)
+		} else {
+			handler = slog.NewTextHandler(output, opts)
 		}
 	case "json":
-		formatter = new(logrus.JSONFormatter)
+		opts := &slog.HandlerOptions{
+			Level: slog.LevelDebug,
+		}
+		handler = slog.NewJSONHandler(output, opts)
 	case "common":
-		formatter = new(CommonLogFormat)
+		handler = &CommonLogFormat{output: output}
 	default:
 		return nil, errors.Errorf("unsupported logger.format '%s'", config.Format)
 	}
 
 	logger := &Logger{
-		Logger:      logrus.New(),
+		Logger:      slog.New(handler),
 		name:        name,
 		traceHeader: config.TraceHeader,
-	}
-	if formatter != nil {
-		logger.Formatter = formatter
+		handler:     handler,
 	}
 	return logger, nil
 }
 
 // GetImpl returns the real implementation of the logger.
-func (l *Logger) GetImpl() *logrus.Logger {
+func (l *Logger) GetImpl() *slog.Logger {
 	return l.Logger
 }