diff --git a/Cargo.toml b/Cargo.toml
index 795d67088..2cbad8afd 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -57,7 +57,8 @@ hyper-openssl = "0.10.2"
 hyper-rustls = { version = "0.27.0", default-features = false }
 hyper-socks2 = { version = "0.9.0", default-features = false }
 hyper-timeout = "0.5.1"
-json-patch = "1.0.0"
+json-patch = "2.0.0"
+jsonptr = "0.4.7"
 jsonpath-rust = "0.5.0"
 k8s-openapi = { version = "0.22.0", default-features = false }
 openssl = "0.10.36"
diff --git a/examples/Cargo.toml b/examples/Cargo.toml
index cce3dccf8..e735a1f3d 100644
--- a/examples/Cargo.toml
+++ b/examples/Cargo.toml
@@ -28,6 +28,7 @@ garde = { version = "0.18.0", default-features = false, features = ["derive"] }
 anyhow.workspace = true
 futures = { workspace = true, features = ["async-await"] }
 jsonpath-rust.workspace = true
+jsonptr.workspace = true
 kube = { path = "../kube", version = "^0.91.0", default-features = false, features = ["admission"] }
 kube-derive = { path = "../kube-derive", version = "^0.91.0", default-features = false } # only needed to opt out of schema
 k8s-openapi.workspace = true
diff --git a/examples/admission_controller.rs b/examples/admission_controller.rs
index 50cc87d69..e4dbe2f3c 100644
--- a/examples/admission_controller.rs
+++ b/examples/admission_controller.rs
@@ -2,7 +2,8 @@ use kube::core::{
     admission::{AdmissionRequest, AdmissionResponse, AdmissionReview},
     DynamicObject, Resource, ResourceExt,
 };
-use std::{convert::Infallible, error::Error};
+use jsonptr::Pointer;
+use std::{convert::Infallible, error::Error, str::FromStr};
 use tracing::*;
 use warp::{reply, Filter, Reply};
 
@@ -75,13 +76,13 @@ fn mutate(res: AdmissionResponse, obj: &DynamicObject) -> Result<AdmissionRespon
         // Ensure labels exist before adding a key to it
         if obj.meta().labels.is_none() {
             patches.push(json_patch::PatchOperation::Add(json_patch::AddOperation {
-                path: "/metadata/labels".into(),
+               path: Pointer::from_str("/metadata/labels").map_err(|_err|Error::InvalidFinalizer)?,
                 value: serde_json::json!({}),
             }));
         }
         // Add our label
         patches.push(json_patch::PatchOperation::Add(json_patch::AddOperation {
-            path: "/metadata/labels/admission".into(),
+            path: Pointer::from_str("/metadata/labels/admission").map_err(|_err|Error::InvalidFinalizer)?,
             value: serde_json::Value::String("modified-by-admission-controller".into()),
         }));
         Ok(res.with_patch(json_patch::Patch(patches))?)
diff --git a/kube-runtime/Cargo.toml b/kube-runtime/Cargo.toml
index 6c1710ad7..7b8b2988b 100644
--- a/kube-runtime/Cargo.toml
+++ b/kube-runtime/Cargo.toml
@@ -42,6 +42,7 @@ tokio = { workspace = true, features = ["time"] }
 tokio-util = { workspace = true, features = ["time"] }
 tracing.workspace = true
 json-patch.workspace = true
+jsonptr.workspace = true
 serde_json.workspace = true
 thiserror.workspace = true
 backoff.workspace = true
diff --git a/kube-runtime/src/finalizer.rs b/kube-runtime/src/finalizer.rs
index 4800e3a84..0522bf9c7 100644
--- a/kube-runtime/src/finalizer.rs
+++ b/kube-runtime/src/finalizer.rs
@@ -2,12 +2,14 @@
 use crate::controller::Action;
 use futures::{TryFuture, TryFutureExt};
 use json_patch::{AddOperation, PatchOperation, RemoveOperation, TestOperation};
+use jsonptr::Pointer;
 use kube_client::{
     api::{Patch, PatchParams},
     Api, Resource, ResourceExt,
 };
+
 use serde::{de::DeserializeOwned, Serialize};
-use std::{error::Error as StdError, fmt::Debug, sync::Arc};
+use std::{error::Error as StdError, fmt::Debug, str::FromStr, sync::Arc};
 use thiserror::Error;
 
 #[derive(Debug, Error)]
@@ -25,6 +27,9 @@ where
     RemoveFinalizer(#[source] kube_client::Error),
     #[error("object has no name")]
     UnnamedObject,
+    #[error("invalid finalizer")]
+    InvalidFinalizer,
+
 }
 
 struct FinalizerState {
@@ -89,6 +94,12 @@ impl FinalizerState {
 ///
 /// `reconcile` should take the object that the [`Event`] contains, rather than trying to reuse `obj`, since it may have been updated.
 ///
+/// # Panics
+///
+/// This function will panic if `Pointer::from_str(finalizer_path).unwrap()`
+/// returns an `Err`. This can happen if the `finalizer_path` is not a valid
+/// string for creating a `Pointer`.
+///
 /// # Errors
 ///
 /// [`Event::Apply`] and [`Event::Cleanup`] are both fallible, their errors are passed through as [`Error::ApplyFailed`]
@@ -129,7 +140,7 @@ where
                 // Short-circuit, so that we keep the finalizer if cleanup fails
                 .map_err(Error::CleanupFailed)?;
             // Cleanup was successful, remove the finalizer so that deletion can continue
-            let finalizer_path = format!("/metadata/finalizers/{finalizer_i}");
+            let finalizer_path: &str = "/metadata/finalizers/{finalizer_i}";
             api.patch::<K>(
                 &name,
                 &PatchParams::default(),
@@ -138,10 +149,12 @@ where
                     // `Test` ensures that we fail instead of deleting someone else's finalizer
                     // (in which case a new `Cleanup` event will be sent)
                     PatchOperation::Test(TestOperation {
-                        path: finalizer_path.clone(),
+                        path: Pointer::from_str(finalizer_path).map_err(|_err|Error::InvalidFinalizer)?,
                         value: finalizer_name.into(),
                     }),
-                    PatchOperation::Remove(RemoveOperation { path: finalizer_path }),
+                    PatchOperation::Remove(RemoveOperation {
+                        path: Pointer::from_str(finalizer_path).map_err(|_err|Error::InvalidFinalizer)?,
+                    }),
                 ])),
             )
             .await
@@ -156,11 +169,11 @@ where
             let patch = json_patch::Patch(if obj.finalizers().is_empty() {
                 vec![
                     PatchOperation::Test(TestOperation {
-                        path: "/metadata/finalizers".to_string(),
+                        path: Pointer::from_str("/metadata/finalizers").map_err(|_err|Error::InvalidFinalizer)?,
                         value: serde_json::Value::Null,
                     }),
                     PatchOperation::Add(AddOperation {
-                        path: "/metadata/finalizers".to_string(),
+                        path: Pointer::from_str("/metadata/finalizers").map_err(|_err|Error::InvalidFinalizer)?,
                         value: vec![finalizer_name].into(),
                     }),
                 ]
@@ -170,11 +183,11 @@ where
                     // https://github.com/kube-rs/kube/issues/964#issuecomment-1197311254),
                     // so we need to fail and retry if anyone else has added the finalizer in the meantime
                     PatchOperation::Test(TestOperation {
-                        path: "/metadata/finalizers".to_string(),
+                        path: Pointer::from_str("/metadata/finalizers").map_err(|_err|Error::InvalidFinalizer)?,
                         value: obj.finalizers().into(),
                     }),
                     PatchOperation::Add(AddOperation {
-                        path: "/metadata/finalizers/-".to_string(),
+                        path: Pointer::from_str("/metadata/finalizers/-").map_err(|_err|Error::InvalidFinalizer)?,
                         value: finalizer_name.into(),
                     }),
                 ]