diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4dd17a4..388b425 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -2,9 +2,7 @@ name: CI
 
 on:
   push:
-    branches: [main]
   pull_request:
-    branches: [main]
 
 jobs:
   test:
diff --git a/cors.go b/cors.go
index e403109..af44b55 100644
--- a/cors.go
+++ b/cors.go
@@ -151,11 +151,11 @@ func extractHost(origin string) string {
 	}
 
 	// Find end of host (port separator or end of string)
-	if colonIdx := strings.IndexByte(rest, ':'); colonIdx != -1 {
-		return rest[:colonIdx]
+	if host, _, ok := strings.Cut(rest, ":"); ok {
+		return host
 	}
-	if slashIdx := strings.IndexByte(rest, '/'); slashIdx != -1 {
-		return rest[:slashIdx]
+	if host, _, ok := strings.Cut(rest, "/"); ok {
+		return host
 	}
 	return rest
 }
diff --git a/rules.go b/rules.go
index 5e29e7c..a7cb688 100644
--- a/rules.go
+++ b/rules.go
@@ -65,15 +65,9 @@ func Origins(origins ...string) Rule {
 // Matching requires a dot boundary, preventing "evilexample.com" from matching "example.com".
 func OriginSuffix(suffix string) Rule {
 	// Check for port wildcard
-	portWildcard := strings.HasSuffix(suffix, ":*")
-	if portWildcard {
-		suffix = suffix[:len(suffix)-2] // remove ":*"
-	}
+	suffix, portWildcard := strings.CutSuffix(suffix, ":*")
 
-	suffixOnly := strings.HasPrefix(suffix, ".")
-	if suffixOnly {
-		suffix = suffix[1:] // remove leading dot for storage
-	}
+	suffix, suffixOnly := strings.CutPrefix(suffix, ".")
 	return Rule{c: config{
 		matchType:    matchSuffix,
 		suffix:       suffix,