diff --git a/replacer.go b/replacer.go
index 2ab02b602..2fa8ef137 100644
--- a/replacer.go
+++ b/replacer.go
@@ -427,14 +427,10 @@ func readFileIntoBuffer(filename string, size int) ([]byte, error) {
 	}
 	defer file.Close()
 
-	buffer := make([]byte, size)
-	n, err := file.Read(buffer)
-	if err != nil && err != io.EOF {
-		return nil, err
-	}
-
-	// slice the buffer to the actual size
-	return buffer[:n], nil
+	// io.LimitReader ensures we never read more than 'size' bytes.
+	// io.ReadAll starts with a small buffer and grows it as needed,
+	// preventing a massive 1MB allocation for small files.
+	return io.ReadAll(io.LimitReader(file, int64(size)))
 }
 
 // ReplacementFunc is a function that is called when a