diff --git a/metropolis/node/kubernetes/authproxy/BUILD.bazel b/metropolis/node/kubernetes/authproxy/BUILD.bazel
index 263e846..57d950e 100644
--- a/metropolis/node/kubernetes/authproxy/BUILD.bazel
+++ b/metropolis/node/kubernetes/authproxy/BUILD.bazel
@@ -6,7 +6,7 @@
     importpath = "source.monogon.dev/metropolis/node/kubernetes/authproxy",
     visibility = ["//visibility:public"],
     deps = [
-        "//metropolis/node",
+        "//metropolis/node/allocs",
         "//metropolis/node/core/identity",
         "//metropolis/node/kubernetes/pki",
         "//osbase/supervisor",
diff --git a/metropolis/node/kubernetes/authproxy/authproxy.go b/metropolis/node/kubernetes/authproxy/authproxy.go
index 7fdef76..93737ec 100644
--- a/metropolis/node/kubernetes/authproxy/authproxy.go
+++ b/metropolis/node/kubernetes/authproxy/authproxy.go
@@ -20,7 +20,7 @@
 
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
-	"source.monogon.dev/metropolis/node"
+	"source.monogon.dev/metropolis/node/allocs"
 	"source.monogon.dev/metropolis/node/core/identity"
 	"source.monogon.dev/metropolis/node/kubernetes/pki"
 	"source.monogon.dev/osbase/supervisor"
@@ -73,7 +73,7 @@
 		return err
 	}
 
-	internalAPIServer := net.JoinHostPort("localhost", node.KubernetesAPIPort.PortString())
+	internalAPIServer := net.JoinHostPort("localhost", allocs.PortKubernetesAPI.PortString())
 	standardProxy := httputil.NewSingleHostReverseProxy(&url.URL{
 		Scheme: "https",
 		Host:   internalAPIServer,
@@ -119,7 +119,7 @@
 	clientCAs := x509.NewCertPool()
 	clientCAs.AddCert(s.Node.ClusterCA())
 	server := &http.Server{
-		Addr: ":" + node.KubernetesAPIWrappedPort.PortString(),
+		Addr: ":" + allocs.PortKubernetesAPIWrapped.PortString(),
 		TLSConfig: &tls.Config{
 			MinVersion:   tls.VersionTLS12,
 			NextProtos:   []string{"h2", "http/1.1"},