diff --git a/cspell.json b/cspell.json
index d4bbb9d..e52f6db 100644
--- a/cspell.json
+++ b/cspell.json
@@ -152,6 +152,7 @@
     "certstore",
     "CFPREFERENCES",
     "cfprefsd",
+    "cgroupv",
     "chaput",
     "chardev",
     "chatops",
@@ -333,6 +334,7 @@
     "dscacheutil",
     "dscresource",
     "dslocal",
+    "ducktype",
     "DUPEUX",
     "DWORDLONG",
     "DYNALINK",
@@ -358,6 +360,7 @@
     "encap",
     "Encryptor",
     "encryptor",
+    "endgrent",
     "endlocal",
     "entriesread",
     "envdata",
@@ -451,6 +454,7 @@
     "GETFD",
     "GETFL",
     "getgr",
+    "getgrent",
     "getgrgid",
     "getgrnam",
     "gethostbyname",
@@ -704,6 +708,7 @@
     "loginclass",
     "loginwindow",
     "LOGLOCATION",
+    "LOGNAME",
     "logopts",
     "logstring",
     "LONGLONG",
@@ -1017,6 +1022,7 @@
     "PFILETIME",
     "PFLOAT",
     "PGENERICMAPPING",
+    "pgid",
     "phabricator",
     "PHALF",
     "PHANDLE",
@@ -1245,6 +1251,8 @@
     "Scriptable",
     "SCROLLBAR",
     "SCROLLBARS",
+    "secondarygroups",
+    "seconderies",
     "secontext",
     "secoption",
     "secopts",
@@ -1291,6 +1299,7 @@
     "SETTINGCHANGE",
     "setuid",
     "SETX",
+    "sgids",
     "SHARENAME",
     "SHAs",
     "shas",
@@ -1626,6 +1635,7 @@
     "WINVER",
     "WKSTA",
     "WMIGUID",
+    "WNOHANG",
     "woot",
     "workdir",
     "WPARAM",
diff --git a/lib/mixlib/shellout.rb b/lib/mixlib/shellout.rb
index 9676302..a731a4c 100644
--- a/lib/mixlib/shellout.rb
+++ b/lib/mixlib/shellout.rb
@@ -18,7 +18,6 @@
 #
 
 require "etc" unless defined?(Etc)
-require "tmpdir" unless defined?(Dir.mktmpdir)
 require "fcntl"
 require_relative "shellout/exceptions"
 
diff --git a/lib/mixlib/shellout/unix.rb b/lib/mixlib/shellout/unix.rb
index a2b918b..3010da2 100644
--- a/lib/mixlib/shellout/unix.rb
+++ b/lib/mixlib/shellout/unix.rb
@@ -17,8 +17,6 @@
 # limitations under the License.
 #
 
-require "fileutils" unless defined?(FileUtils)
-
 module Mixlib
   class ShellOut
     module Unix
@@ -112,7 +110,7 @@ def run_command
           unless ready_buffers
             @execution_time += READ_WAIT_TIME
             if @execution_time >= timeout && !@result
-              # kill the bad proccess
+              # kill the bad process
               reap_errant_child
               # read anything it wrote when we killed it
               attempt_buffer_read
@@ -324,6 +322,10 @@ def cgroupv2_available?
       def fork_subprocess
         initialize_ipc
 
+        # FileUtils is only used by #set_cgroup. Load it here, in the parent, rather
+        # than post-fork where acquiring the require lock is not guaranteed safe.
+        require "fileutils" if cgroup && !defined?(FileUtils)
+
         fork do
           # Child processes may themselves fork off children. A common case
           # is when the command is given as a single string (instead of