diff --git a/lib/modules/datasource/crate/index.ts b/lib/modules/datasource/crate/index.ts
index 6e62d59f7654700a75de64fb0d907e3279a6ce57..86704b1817278c9649f4f217e85c12b9114822d9 100644
--- a/lib/modules/datasource/crate/index.ts
+++ b/lib/modules/datasource/crate/index.ts
@@ -5,7 +5,7 @@ import { GlobalConfig } from '../../../config/global';
 import { logger } from '../../../logger';
 import * as memCache from '../../../util/cache/memory';
 import { cache } from '../../../util/cache/package/decorator';
-import { privateCacheDir, readFile } from '../../../util/fs';
+import { privateCacheDir, readCacheFile } from '../../../util/fs';
 import { simpleGitConfig } from '../../../util/git/config';
 import { newlineRegex, regEx } from '../../../util/regex';
 import { parseUrl } from '../../../util/url';
@@ -160,7 +160,7 @@ export class CrateDatasource extends Datasource {
         info.clonePath,
         ...CrateDatasource.getIndexSuffix(packageName)
       );
-      return readFile(path, 'utf8');
+      return readCacheFile(path, 'utf8');
     }
 
     if (info.flavor === RegistryFlavor.CratesIo) {
diff --git a/lib/modules/manager/cargo/artifacts.spec.ts b/lib/modules/manager/cargo/artifacts.spec.ts
index 93c52216107ae91e1d9b83eb867f6fb723764240..25951f2010376dddd78193362c0d3fd72bac1ac1 100644
--- a/lib/modules/manager/cargo/artifacts.spec.ts
+++ b/lib/modules/manager/cargo/artifacts.spec.ts
@@ -35,7 +35,7 @@ describe('modules/manager/cargo/artifacts', () => {
   });
 
   it('returns null if no Cargo.lock found', async () => {
-    fs.stat.mockRejectedValue(new Error('not found!'));
+    fs.statLocalFile.mockRejectedValue(new Error('not found!'));
     const updatedDeps = [
       {
         depName: 'dep1',
@@ -63,7 +63,7 @@ describe('modules/manager/cargo/artifacts', () => {
   });
 
   it('returns null if unchanged', async () => {
-    fs.stat.mockResolvedValueOnce({ name: 'Cargo.lock' } as any);
+    fs.statLocalFile.mockResolvedValueOnce({ name: 'Cargo.lock' } as any);
     fs.findLocalSiblingOrParent.mockResolvedValueOnce('Cargo.lock');
     fs.readLocalFile.mockResolvedValueOnce('Current Cargo.lock');
     const execSnapshots = mockExecAll(exec);
@@ -87,7 +87,7 @@ describe('modules/manager/cargo/artifacts', () => {
   });
 
   it('returns updated Cargo.lock', async () => {
-    fs.stat.mockResolvedValueOnce({ name: 'Cargo.lock' } as any);
+    fs.statLocalFile.mockResolvedValueOnce({ name: 'Cargo.lock' } as any);
     fs.findLocalSiblingOrParent.mockResolvedValueOnce('Cargo.lock');
     git.getFile.mockResolvedValueOnce('Old Cargo.lock');
     const execSnapshots = mockExecAll(exec);
@@ -110,7 +110,7 @@ describe('modules/manager/cargo/artifacts', () => {
   });
 
   it('updates Cargo.lock based on the packageName, when given', async () => {
-    fs.stat.mockResolvedValueOnce({ name: 'Cargo.lock' } as any);
+    fs.statLocalFile.mockResolvedValueOnce({ name: 'Cargo.lock' } as any);
     git.getFile.mockResolvedValueOnce('Old Cargo.lock');
     const execSnapshots = mockExecAll(exec);
     fs.findLocalSiblingOrParent.mockResolvedValueOnce('Cargo.lock');
@@ -133,9 +133,13 @@ describe('modules/manager/cargo/artifacts', () => {
   });
 
   it('returns updated workspace Cargo.lock', async () => {
-    fs.stat.mockRejectedValueOnce(new Error('crates/one/Cargo.lock not found'));
-    fs.stat.mockRejectedValueOnce(new Error('crates/Cargo.lock not found'));
-    fs.stat.mockResolvedValueOnce({ name: 'Cargo.lock' } as any);
+    fs.statLocalFile.mockRejectedValueOnce(
+      new Error('crates/one/Cargo.lock not found')
+    );
+    fs.statLocalFile.mockRejectedValueOnce(
+      new Error('crates/Cargo.lock not found')
+    );
+    fs.statLocalFile.mockResolvedValueOnce({ name: 'Cargo.lock' } as any);
 
     git.getFile.mockResolvedValueOnce('Old Cargo.lock');
     const execSnapshots = mockExecAll(exec);
@@ -158,7 +162,7 @@ describe('modules/manager/cargo/artifacts', () => {
   });
 
   it('returns updated Cargo.lock for lockfile maintenance', async () => {
-    fs.stat.mockResolvedValueOnce({ name: 'Cargo.lock' } as any);
+    fs.statLocalFile.mockResolvedValueOnce({ name: 'Cargo.lock' } as any);
     git.getFile.mockResolvedValueOnce('Old Cargo.lock');
     const execSnapshots = mockExecAll(exec);
     fs.findLocalSiblingOrParent.mockResolvedValueOnce('Cargo.lock');
@@ -175,7 +179,7 @@ describe('modules/manager/cargo/artifacts', () => {
   });
 
   it('returns updated Cargo.lock with docker', async () => {
-    fs.stat.mockResolvedValueOnce({ name: 'Cargo.lock' } as any);
+    fs.statLocalFile.mockResolvedValueOnce({ name: 'Cargo.lock' } as any);
     GlobalConfig.set({ ...adminConfig, binarySource: 'docker' });
     git.getFile.mockResolvedValueOnce('Old Cargo.lock');
     const execSnapshots = mockExecAll(exec);
@@ -198,7 +202,7 @@ describe('modules/manager/cargo/artifacts', () => {
   });
 
   it('catches errors', async () => {
-    fs.stat.mockResolvedValueOnce({ name: 'Cargo.lock' } as any);
+    fs.statLocalFile.mockResolvedValueOnce({ name: 'Cargo.lock' } as any);
     fs.findLocalSiblingOrParent.mockResolvedValueOnce('Cargo.lock');
     fs.readLocalFile.mockResolvedValueOnce('Current Cargo.lock');
     fs.writeLocalFile.mockImplementationOnce(() => {
diff --git a/lib/modules/manager/cocoapods/artifacts.spec.ts b/lib/modules/manager/cocoapods/artifacts.spec.ts
index 66c3a640e23940370ebc5075e1e34d37a45ff814..022128cf15074319bea32eb786b413f6cb6e7f0d 100644
--- a/lib/modules/manager/cocoapods/artifacts.spec.ts
+++ b/lib/modules/manager/cocoapods/artifacts.spec.ts
@@ -205,7 +205,7 @@ describe('modules/manager/cocoapods/artifacts', () => {
     fs.getSiblingFileName.mockReturnValueOnce('Podfile.lock');
     fs.findLocalSiblingOrParent.mockResolvedValueOnce('Podfile.lock');
     fs.readLocalFile.mockResolvedValueOnce('Old Podfile.lock');
-    fs.outputFile.mockResolvedValueOnce(null as never);
+    fs.outputCacheFile.mockResolvedValueOnce();
     fs.findLocalSiblingOrParent.mockResolvedValueOnce('Podfile.lock');
     fs.readLocalFile.mockResolvedValueOnce('Old Podfile.lock');
     expect(
diff --git a/lib/modules/manager/npm/detect.spec.ts b/lib/modules/manager/npm/detect.spec.ts
index c38cbcb4f5e9d1d166ee3a7af474ca1fa4296c48..deccd3d37dd52363376c4c9dcbbc6cc6e95e10f2 100644
--- a/lib/modules/manager/npm/detect.spec.ts
+++ b/lib/modules/manager/npm/detect.spec.ts
@@ -6,7 +6,7 @@ jest.mock('../../../util/fs');
 describe('modules/manager/npm/detect', () => {
   describe('.detectGlobalConfig()', () => {
     it('detects .npmrc in home directory', async () => {
-      fs.readFile.mockResolvedValueOnce(
+      fs.readSystemFile.mockResolvedValueOnce(
         'registry=https://registry.npmjs.org\n'
       );
       const res = await detectGlobalConfig();
@@ -22,7 +22,7 @@ Object {
     });
 
     it('handles no .npmrc', async () => {
-      fs.readFile.mockImplementationOnce(() => Promise.reject());
+      fs.readSystemFile.mockRejectedValueOnce('error');
       const res = await detectGlobalConfig();
       expect(res).toEqual({});
     });
diff --git a/lib/modules/manager/npm/detect.ts b/lib/modules/manager/npm/detect.ts
index 92a90674e83cc8c84192f62d8157d4925a8f95e5..e1e15096d58eb217d7e07caea5855843957ac8b7 100644
--- a/lib/modules/manager/npm/detect.ts
+++ b/lib/modules/manager/npm/detect.ts
@@ -2,7 +2,7 @@ import os from 'os';
 import is from '@sindresorhus/is';
 import upath from 'upath';
 import { logger } from '../../../logger';
-import { readFile } from '../../../util/fs';
+import { readSystemFile } from '../../../util/fs';
 import type { GlobalManagerConfig } from '../types';
 
 export async function detectGlobalConfig(): Promise<GlobalManagerConfig> {
@@ -10,7 +10,7 @@ export async function detectGlobalConfig(): Promise<GlobalManagerConfig> {
   const homedir = os.homedir();
   const npmrcFileName = upath.join(homedir, '.npmrc');
   try {
-    const npmrc = await readFile(npmrcFileName, 'utf8');
+    const npmrc = await readSystemFile(npmrcFileName, 'utf8');
     if (is.nonEmptyString(npmrc)) {
       res.npmrc = npmrc;
       res.npmrcMerge = true;
diff --git a/lib/modules/manager/nuget/artifacts.ts b/lib/modules/manager/nuget/artifacts.ts
index f5c89bc99b87898e417b9189f06845b2727b5693..f1651d860d7c343e59501ce26d33e0a4855862d0 100644
--- a/lib/modules/manager/nuget/artifacts.ts
+++ b/lib/modules/manager/nuget/artifacts.ts
@@ -7,7 +7,7 @@ import type { ExecOptions } from '../../../util/exec/types';
 import {
   ensureDir,
   getSiblingFileName,
-  outputFile,
+  outputCacheFile,
   privateCacheDir,
   readLocalFile,
   writeLocalFile,
@@ -79,7 +79,7 @@ async function runDotnetRestore(
 
   await ensureDir(nugetCacheDir);
 
-  await outputFile(
+  await outputCacheFile(
     nugetConfigFile,
     `<?xml version="1.0" encoding="utf-8"?>\n<configuration>\n</configuration>\n`
   );
diff --git a/lib/modules/manager/terraform/lockfile/hash.ts b/lib/modules/manager/terraform/lockfile/hash.ts
index d86e12b9149263b424b2b77c013a3600ffcfc583..6d8934838486e98d3b42fecda27c8b39495a12d4 100644
--- a/lib/modules/manager/terraform/lockfile/hash.ts
+++ b/lib/modules/manager/terraform/lockfile/hash.ts
@@ -26,7 +26,7 @@ export class TerraformProviderHash {
       const hash = crypto.createHash('sha256');
 
       // a sha256sum displayed as lowercase hex string to root hash
-      const fileBuffer = await fs.readFile(file);
+      const fileBuffer = await fs.readCacheFile(file);
       hash.update(fileBuffer);
       rootHash.update(hash.digest('hex'));
 
@@ -45,7 +45,7 @@ export class TerraformProviderHash {
     extractPath: string
   ): Promise<string> {
     await extract(zipFilePath, { dir: extractPath });
-    const files = await fs.readdir(extractPath);
+    const files = await fs.listCacheDir(extractPath);
     // the h1 hashing algorithms requires that the files are sorted by filename
     const sortedFiles = files.sort((a, b) => a.localeCompare(b));
     const filesWithPath = sortedFiles.map((file) => `${extractPath}/${file}`);
@@ -53,7 +53,7 @@ export class TerraformProviderHash {
     const result = await TerraformProviderHash.hashFiles(filesWithPath);
 
     // delete extracted files
-    await fs.rm(extractPath, { recursive: true });
+    await fs.rmCache(extractPath);
 
     return result;
   }
@@ -86,7 +86,7 @@ export class TerraformProviderHash {
       return hash;
     } finally {
       // delete zip file
-      await fs.unlink(downloadFileName);
+      await fs.rmCache(downloadFileName);
     }
   }
 
diff --git a/lib/util/cache/repository/impl/local.spec.ts b/lib/util/cache/repository/impl/local.spec.ts
index 0d1ad4e4dd5ac316c6d956553c74f222ea03a3d3..38ec21c00a1eacab7f223b5cee344dfdaeb4e894 100644
--- a/lib/util/cache/repository/impl/local.spec.ts
+++ b/lib/util/cache/repository/impl/local.spec.ts
@@ -37,7 +37,7 @@ describe('util/cache/repository/impl/local', () => {
   it('loads previously stored cache from disk', async () => {
     const data: RepoCacheData = { semanticCommits: 'enabled' };
     const cacheRecord = await createCacheRecord(data);
-    fs.readFile.mockResolvedValue(JSON.stringify(cacheRecord));
+    fs.readCacheFile.mockResolvedValue(JSON.stringify(cacheRecord));
     const localRepoCache = new LocalRepoCache('github', 'some/repo');
 
     await localRepoCache.load();
@@ -46,7 +46,7 @@ describe('util/cache/repository/impl/local', () => {
   });
 
   it('migrates revision from 10 to 12', async () => {
-    fs.readFile.mockResolvedValue(
+    fs.readCacheFile.mockResolvedValue(
       JSON.stringify({
         revision: 10,
         repository: 'some/repo',
@@ -59,14 +59,14 @@ describe('util/cache/repository/impl/local', () => {
     await localRepoCache.save();
 
     const cacheRecord = await createCacheRecord({ semanticCommits: 'enabled' });
-    expect(fs.outputFile).toHaveBeenCalledWith(
+    expect(fs.outputCacheFile).toHaveBeenCalledWith(
       '/tmp/cache/renovate/repository/github/some/repo.json',
       JSON.stringify(cacheRecord)
     );
   });
 
   it('migrates revision from 11 to 12', async () => {
-    fs.readFile.mockResolvedValue(
+    fs.readCacheFile.mockResolvedValue(
       JSON.stringify({
         revision: 11,
         repository: 'some/repo',
@@ -79,14 +79,14 @@ describe('util/cache/repository/impl/local', () => {
     await localRepoCache.save();
 
     const cacheRecord = await createCacheRecord({ semanticCommits: 'enabled' });
-    expect(fs.outputFile).toHaveBeenCalledWith(
+    expect(fs.outputCacheFile).toHaveBeenCalledWith(
       '/tmp/cache/renovate/repository/github/some/repo.json',
       JSON.stringify(cacheRecord)
     );
   });
 
   it('does not migrate from older revisions to 11', async () => {
-    fs.readFile.mockResolvedValueOnce(
+    fs.readCacheFile.mockResolvedValueOnce(
       JSON.stringify({
         revision: 9,
         repository: 'some/repo',
@@ -101,7 +101,7 @@ describe('util/cache/repository/impl/local', () => {
   });
 
   it('handles invalid data', async () => {
-    fs.readFile.mockResolvedValue(JSON.stringify({ foo: 'bar' }));
+    fs.readCacheFile.mockResolvedValue(JSON.stringify({ foo: 'bar' }));
     const localRepoCache = new LocalRepoCache('github', 'some/repo');
 
     await localRepoCache.load();
@@ -110,7 +110,7 @@ describe('util/cache/repository/impl/local', () => {
   });
 
   it('handles file read error', async () => {
-    fs.readFile.mockRejectedValue(new Error('unknown error'));
+    fs.readCacheFile.mockRejectedValue(new Error('unknown error'));
     const localRepoCache = new LocalRepoCache('github', 'some/repo');
 
     await localRepoCache.load();
@@ -121,7 +121,7 @@ describe('util/cache/repository/impl/local', () => {
 
   it('resets if repository does not match', async () => {
     const cacheRecord = createCacheRecord({ semanticCommits: 'enabled' });
-    fs.readFile.mockResolvedValueOnce(JSON.stringify(cacheRecord) as never);
+    fs.readCacheFile.mockResolvedValueOnce(JSON.stringify(cacheRecord));
 
     const localRepoCache = new LocalRepoCache('github', 'some/repo');
     await localRepoCache.load();
@@ -131,7 +131,7 @@ describe('util/cache/repository/impl/local', () => {
 
   it('saves modified cache data to file', async () => {
     const oldCacheRecord = createCacheRecord({ semanticCommits: 'enabled' });
-    fs.readFile.mockResolvedValueOnce(JSON.stringify(oldCacheRecord));
+    fs.readCacheFile.mockResolvedValueOnce(JSON.stringify(oldCacheRecord));
     const localRepoCache = new LocalRepoCache('github', 'some/repo');
 
     await localRepoCache.load();
@@ -142,7 +142,7 @@ describe('util/cache/repository/impl/local', () => {
     const newCacheRecord = await createCacheRecord({
       semanticCommits: 'disabled',
     });
-    expect(fs.outputFile).toHaveBeenCalledWith(
+    expect(fs.outputCacheFile).toHaveBeenCalledWith(
       '/tmp/cache/renovate/repository/github/some/repo.json',
       JSON.stringify(newCacheRecord)
     );
diff --git a/lib/util/cache/repository/impl/local.ts b/lib/util/cache/repository/impl/local.ts
index ce9a546515d56bce26366bd0c7581eaa1dd659dc..c3edec3e5638aa5d9d3871b2dafd0b2bde9ad991 100644
--- a/lib/util/cache/repository/impl/local.ts
+++ b/lib/util/cache/repository/impl/local.ts
@@ -4,7 +4,7 @@ import hasha from 'hasha';
 import upath from 'upath';
 import { GlobalConfig } from '../../../../config/global';
 import { logger } from '../../../../logger';
-import { outputFile, readFile } from '../../../fs';
+import { outputCacheFile, readCacheFile } from '../../../fs';
 import {
   CACHE_REVISION,
   isValidRev10,
@@ -36,7 +36,7 @@ export class LocalRepoCache extends RepoCacheBase {
     const cacheFileName = this.getCacheFileName();
     try {
       const cacheFileName = this.getCacheFileName();
-      const rawCache = await readFile(cacheFileName, 'utf8');
+      const rawCache = await readCacheFile(cacheFileName, 'utf8');
       const oldCache = JSON.parse(rawCache);
 
       if (isValidRev12(oldCache, this.repository)) {
@@ -80,7 +80,7 @@ export class LocalRepoCache extends RepoCacheBase {
       const compressed = await compress(jsonStr);
       const payload = compressed.toString('base64');
       const record: RepoCacheRecord = { revision, repository, payload, hash };
-      await outputFile(cacheFileName, JSON.stringify(record));
+      await outputCacheFile(cacheFileName, JSON.stringify(record));
     }
   }
 }
diff --git a/lib/util/cache/repository/index.spec.ts b/lib/util/cache/repository/index.spec.ts
index 0c85021e8a972f348eb74be8646346fc41e9308e..51a6b8674126eb2a8f1810f7c907c1ce2f4ec521 100644
--- a/lib/util/cache/repository/index.spec.ts
+++ b/lib/util/cache/repository/index.spec.ts
@@ -24,20 +24,20 @@ describe('util/cache/repository/index', () => {
 
   it('returns if cache not enabled', async () => {
     await initRepoCache({ ...config, repositoryCache: 'disabled' });
-    expect(fs.readFile).not.toHaveBeenCalled();
+    expect(fs.readCacheFile).not.toHaveBeenCalled();
     expect(getCache()).toBeEmpty();
   });
 
   it('saves cache', async () => {
     await initRepoCache({ ...config, repositoryCache: 'enabled' });
     await saveCache();
-    expect(fs.outputFile).toHaveBeenCalled();
+    expect(fs.outputCacheFile).toHaveBeenCalled();
   });
 
   it('resets cache', async () => {
     await initRepoCache({ ...config, repositoryCache: 'reset' });
-    expect(fs.readFile).not.toHaveBeenCalled();
-    expect(fs.outputFile).toHaveBeenCalled();
+    expect(fs.readCacheFile).not.toHaveBeenCalled();
+    expect(fs.outputCacheFile).toHaveBeenCalled();
     expect(getCache()).toBeEmpty();
   });
 });
diff --git a/lib/util/fs/index.spec.ts b/lib/util/fs/index.spec.ts
index 1829545a736ca4a424891858b62b89a157f57901..1afaa44e0f39ae9281c5e37ea32e19a6da8a5892 100644
--- a/lib/util/fs/index.spec.ts
+++ b/lib/util/fs/index.spec.ts
@@ -14,6 +14,7 @@ import {
   getSubDirectory,
   localPathExists,
   localPathIsFile,
+  outputCacheFile,
   readLocalDirectory,
   readLocalFile,
   statLocalFile,
@@ -283,4 +284,20 @@ describe('util/fs/index', () => {
       );
     });
   });
+
+  describe('outputCacheFile', () => {
+    it('works', async () => {
+      await withDir(
+        async ({ path }) => {
+          const fsOutputFile = jest.spyOn(fs, 'outputFile');
+          const file = join(path, 'some-file');
+          await outputCacheFile(file, 'foobar');
+          const res = await fs.readFile(file, 'utf8');
+          expect(res).toBe('foobar');
+          expect(fsOutputFile).toHaveBeenCalledWith(file, 'foobar', {});
+        },
+        { unsafeCleanup: true }
+      );
+    });
+  });
 });
diff --git a/lib/util/fs/index.ts b/lib/util/fs/index.ts
index 2b1f5a3bc5a068ab668b8458c50f23edde9bf17a..0010e2a646af109c1df57b5cd1c9c96e370ee2ef 100644
--- a/lib/util/fs/index.ts
+++ b/lib/util/fs/index.ts
@@ -3,12 +3,11 @@ import util from 'util';
 import is from '@sindresorhus/is';
 import findUp from 'find-up';
 import fs from 'fs-extra';
+import type { WriteFileOptions } from 'fs-extra';
 import upath from 'upath';
 import { GlobalConfig } from '../../config/global';
 import { logger } from '../../logger';
 
-export * from './proxies';
-
 export const pipeline = util.promisify(stream.pipeline);
 
 export function getSubDirectory(fileName: string): string {
@@ -216,3 +215,45 @@ export async function statLocalFile(
     return null;
   }
 }
+
+// istanbul ignore next
+export function listCacheDir(path: string): Promise<string[]> {
+  return fs.readdir(path);
+}
+
+// istanbul ignore next
+export async function rmCache(path: string): Promise<void> {
+  await fs.rm(path, { recursive: true });
+}
+
+export async function readCacheFile(fileName: string): Promise<Buffer>;
+export async function readCacheFile(
+  fileName: string,
+  encoding: 'utf8'
+): Promise<string>;
+export function readCacheFile(
+  fileName: string,
+  encoding?: string
+): Promise<string | Buffer> {
+  return encoding ? fs.readFile(fileName, encoding) : fs.readFile(fileName);
+}
+
+export function outputCacheFile(
+  file: string,
+  data: unknown,
+  options?: WriteFileOptions | string
+): Promise<void> {
+  return fs.outputFile(file, data, options ?? {});
+}
+
+export async function readSystemFile(fileName: string): Promise<Buffer>;
+export async function readSystemFile(
+  fileName: string,
+  encoding: 'utf8'
+): Promise<string>;
+export function readSystemFile(
+  fileName: string,
+  encoding?: string
+): Promise<string | Buffer> {
+  return encoding ? fs.readFile(fileName, encoding) : fs.readFile(fileName);
+}
diff --git a/lib/util/fs/proxies.ts b/lib/util/fs/proxies.ts
deleted file mode 100644
index 96cdbf822f2f02ae9f742893c3227ac052798086..0000000000000000000000000000000000000000
--- a/lib/util/fs/proxies.ts
+++ /dev/null
@@ -1,51 +0,0 @@
-import fs from 'fs-extra';
-import type { WriteFileOptions } from 'fs-extra';
-
-// istanbul ignore next
-export function stat(path: string | Buffer): Promise<fs.Stats> {
-  return fs.stat(path);
-}
-
-export async function readFile(fileName: string): Promise<Buffer>;
-export async function readFile(
-  fileName: string,
-  encoding: 'utf8'
-): Promise<string>;
-export function readFile(
-  fileName: string,
-  encoding?: string
-): Promise<string | Buffer> {
-  return encoding ? fs.readFile(fileName, encoding) : fs.readFile(fileName);
-}
-
-// istanbul ignore next
-export function outputFile(
-  file: string,
-  data: unknown,
-  options?: WriteFileOptions | string
-): Promise<void> {
-  return fs.outputFile(file, data, options ?? {});
-}
-
-// istanbul ignore next
-export function unlink(path: string | Buffer): Promise<void> {
-  return fs.unlink(path);
-}
-
-// istanbul ignore next
-export function readdir(path: string): Promise<string[]> {
-  return fs.readdir(path);
-}
-
-// istanbul ignore next
-export function rm(
-  path: string,
-  options?: {
-    force?: boolean;
-    maxRetries?: number;
-    recursive?: boolean;
-    retryDelay?: number;
-  }
-): Promise<void> {
-  return fs.rm(path, options);
-}
diff --git a/lib/workers/global/config/parse/file.ts b/lib/workers/global/config/parse/file.ts
index 4c8bdffabf14a33e2b16dab23f7252dbe1269f51..1b221381a439852f97cebd7749da7668ec893378 100644
--- a/lib/workers/global/config/parse/file.ts
+++ b/lib/workers/global/config/parse/file.ts
@@ -6,18 +6,18 @@ import upath from 'upath';
 import { migrateConfig } from '../../../../config/migration';
 import type { AllConfig, RenovateConfig } from '../../../../config/types';
 import { logger } from '../../../../logger';
-import { readFile } from '../../../../util/fs';
+import { readSystemFile } from '../../../../util/fs';
 
 export async function getParsedContent(file: string): Promise<RenovateConfig> {
   switch (upath.extname(file)) {
     case '.yaml':
     case '.yml':
-      return load(await readFile(file, 'utf8'), {
+      return load(await readSystemFile(file, 'utf8'), {
         json: true,
       }) as RenovateConfig;
     case '.json5':
     case '.json':
-      return JSON5.parse(await readFile(file, 'utf8'));
+      return JSON5.parse(await readSystemFile(file, 'utf8'));
     case '.js': {
       const tmpConfig = await import(file);
       let config = tmpConfig.default ? tmpConfig.default : tmpConfig;
diff --git a/lib/workers/global/config/parse/index.spec.ts b/lib/workers/global/config/parse/index.spec.ts
index bcc6e0a3100eddef8952d7648f9314c79103b874..053051bba780ce9f475b2ef4e809f181c0747be3 100644
--- a/lib/workers/global/config/parse/index.spec.ts
+++ b/lib/workers/global/config/parse/index.spec.ts
@@ -1,6 +1,6 @@
 import upath from 'upath';
 import { mocked } from '../../../../../test/util';
-import { readFile } from '../../../../util/fs';
+import { readSystemFile } from '../../../../util/fs';
 import getArgv from './__fixtures__/argv';
 import * as _hostRulesFromEnv from './host-rules-from-env';
 
@@ -99,7 +99,7 @@ describe('workers/global/config/parse/index', () => {
         RENOVATE_PRIVATE_KEY_PATH: privateKeyPath,
         RENOVATE_PRIVATE_KEY_PATH_OLD: privateKeyPathOld,
       };
-      const expected = await readFile(privateKeyPath, 'utf8');
+      const expected = await readSystemFile(privateKeyPath, 'utf8');
       const parsedConfig = await configParser.parseConfigs(env, defaultArgv);
 
       expect(parsedConfig).toContainEntries([['privateKey', expected]]);
diff --git a/lib/workers/global/config/parse/index.ts b/lib/workers/global/config/parse/index.ts
index 3b2947d4c6b845c82ce7b23d14fb01541d7d1346..db63c35c9837a3724c740af7ae114336bd1e9c9c 100644
--- a/lib/workers/global/config/parse/index.ts
+++ b/lib/workers/global/config/parse/index.ts
@@ -3,7 +3,11 @@ import type { AllConfig } from '../../../../config/types';
 import { mergeChildConfig } from '../../../../config/utils';
 import { addStream, logger, setContext } from '../../../../logger';
 import { detectAllGlobalConfig } from '../../../../modules/manager';
-import { ensureDir, getSubDirectory, readFile } from '../../../../util/fs';
+import {
+  ensureDir,
+  getSubDirectory,
+  readSystemFile,
+} from '../../../../util/fs';
 import { ensureTrailingSlash } from '../../../../util/url';
 import * as cliParser from './cli';
 import * as envParser from './env';
@@ -41,12 +45,12 @@ export async function parseConfigs(
   }
 
   if (!config.privateKey && config.privateKeyPath) {
-    config.privateKey = await readFile(config.privateKeyPath, 'utf8');
+    config.privateKey = await readSystemFile(config.privateKeyPath, 'utf8');
     delete config.privateKeyPath;
   }
 
   if (!config.privateKeyOld && config.privateKeyPathOld) {
-    config.privateKey = await readFile(config.privateKeyPathOld, 'utf8');
+    config.privateKey = await readSystemFile(config.privateKeyPathOld, 'utf8');
     delete config.privateKeyPathOld;
   }