diff --git a/metropolis/cli/metroctl/BUILD.bazel b/metropolis/cli/metroctl/BUILD.bazel
index b280aea..826a90b 100644
--- a/metropolis/cli/metroctl/BUILD.bazel
+++ b/metropolis/cli/metroctl/BUILD.bazel
@@ -82,6 +82,7 @@
         "//metropolis/cli/flagdefs",
         "//metropolis/cli/metroctl/core",
         "//metropolis/node",
+        "//metropolis/node/allocs",
         "//metropolis/node/core/rpc",
         "//metropolis/node/core/rpc/resolver",
         "//metropolis/proto/api",
diff --git a/metropolis/cli/metroctl/cmd_node_metrics.go b/metropolis/cli/metroctl/cmd_node_metrics.go
index 648fe60..8e2e51f 100644
--- a/metropolis/cli/metroctl/cmd_node_metrics.go
+++ b/metropolis/cli/metroctl/cmd_node_metrics.go
@@ -13,7 +13,7 @@
 	"github.com/spf13/cobra"
 
 	"source.monogon.dev/metropolis/cli/metroctl/core"
-	common "source.monogon.dev/metropolis/node"
+	"source.monogon.dev/metropolis/node/allocs"
 	"source.monogon.dev/metropolis/proto/api"
 )
 
@@ -76,7 +76,7 @@
 		client := http.Client{
 			Transport: transport,
 		}
-		res, err := client.Get(fmt.Sprintf("https://%s/metrics/%s", net.JoinHostPort(n.Status.ExternalAddress, common.MetricsPort.PortString()), args[1]))
+		res, err := client.Get(fmt.Sprintf("https://%s/metrics/%s", net.JoinHostPort(n.Status.ExternalAddress, allocs.PortMetrics.PortString()), args[1]))
 		if err != nil {
 			return fmt.Errorf("metrics HTTP request failed: %w", err)
 		}
diff --git a/metropolis/cli/metroctl/core/BUILD.bazel b/metropolis/cli/metroctl/core/BUILD.bazel
index e9c2117..46520c2 100644
--- a/metropolis/cli/metroctl/core/BUILD.bazel
+++ b/metropolis/cli/metroctl/core/BUILD.bazel
@@ -14,7 +14,7 @@
     deps = [
         "//go/logging",
         "//metropolis/installer/install",
-        "//metropolis/node",
+        "//metropolis/node/allocs",
         "//metropolis/node/core/curator/proto/api",
         "//metropolis/node/core/rpc",
         "//metropolis/node/core/rpc/resolver",
diff --git a/metropolis/cli/metroctl/core/config.go b/metropolis/cli/metroctl/core/config.go
index 38862af..71283b0 100644
--- a/metropolis/cli/metroctl/core/config.go
+++ b/metropolis/cli/metroctl/core/config.go
@@ -24,7 +24,7 @@
 	clientapi "k8s.io/client-go/tools/clientcmd/api"
 
 	"source.monogon.dev/go/logging"
-	"source.monogon.dev/metropolis/node"
+	"source.monogon.dev/metropolis/node/allocs"
 )
 
 const (
@@ -233,7 +233,7 @@
 
 	var u url.URL
 	u.Scheme = "https"
-	u.Host = net.JoinHostPort(server, node.KubernetesAPIWrappedPort.PortString())
+	u.Host = net.JoinHostPort(server, allocs.PortKubernetesAPIWrapped.PortString())
 
 	// HACK: the Metropolis node certificates only contain the node ID as a SAN. This
 	// means that we can't use some 'global' identifier as the TLSServerName below
diff --git a/metropolis/cli/metroctl/core/rpc.go b/metropolis/cli/metroctl/core/rpc.go
index a8f933c..cd5678d 100644
--- a/metropolis/cli/metroctl/core/rpc.go
+++ b/metropolis/cli/metroctl/core/rpc.go
@@ -15,7 +15,7 @@
 	"golang.org/x/net/proxy"
 	"google.golang.org/grpc"
 
-	"source.monogon.dev/metropolis/node"
+	"source.monogon.dev/metropolis/node/allocs"
 	"source.monogon.dev/metropolis/node/core/rpc"
 	"source.monogon.dev/metropolis/node/core/rpc/resolver"
 	"source.monogon.dev/metropolis/proto/api"
@@ -45,7 +45,7 @@
 		return nil, fmt.Errorf("no cluster endpoints specified")
 	}
 	for _, eps := range c.Endpoints {
-		ep := resolver.NodeByHostPort(eps, uint16(node.CuratorServicePort))
+		ep := resolver.NodeByHostPort(eps, uint16(allocs.PortCuratorService))
 		r.AddEndpoint(ep)
 	}
 	opts = append(opts, grpc.WithResolvers(r))
@@ -76,7 +76,7 @@
 	creds := rpc.NewAuthenticatedCredentials(tlsc, rpc.WantRemoteCluster(ca), rpc.WantRemoteNode(nodeId))
 	dialOpts = append(dialOpts, grpc.WithTransportCredentials(creds))
 
-	endpoint := net.JoinHostPort(nodeAddr, node.NodeManagementPort.PortString())
+	endpoint := net.JoinHostPort(nodeAddr, allocs.PortNodeManagement.PortString())
 	return grpc.NewClient(endpoint, dialOpts...)
 }