diff --git a/metropolis/node/kubernetes/networkpolicy/BUILD.bazel b/metropolis/node/kubernetes/networkpolicy/BUILD.bazel
index 287427e..15fa223 100644
--- a/metropolis/node/kubernetes/networkpolicy/BUILD.bazel
+++ b/metropolis/node/kubernetes/networkpolicy/BUILD.bazel
@@ -8,7 +8,7 @@
     visibility = ["//visibility:public"],
     deps = [
         "//go/logging",
-        "//metropolis/node",
+        "//metropolis/node/allocs",
         "//osbase/supervisor",
         "@io_k8s_api//core/v1:core",
         "@io_k8s_client_go//informers",
diff --git a/metropolis/node/kubernetes/networkpolicy/networkpolicy.go b/metropolis/node/kubernetes/networkpolicy/networkpolicy.go
index c43ef40..04a2fcd 100644
--- a/metropolis/node/kubernetes/networkpolicy/networkpolicy.go
+++ b/metropolis/node/kubernetes/networkpolicy/networkpolicy.go
@@ -19,7 +19,7 @@
 	"k8s.io/kubectl/pkg/scheme"
 
 	"source.monogon.dev/go/logging"
-	"source.monogon.dev/metropolis/node"
+	"source.monogon.dev/metropolis/node/allocs"
 	"source.monogon.dev/osbase/supervisor"
 )
 
@@ -75,7 +75,7 @@
 	eventBroadcaster.StartRecordingToSink(&typedcorev1.EventSinkImpl{Interface: c.Kubernetes.CoreV1().Events("")})
 	recorder := eventBroadcaster.NewRecorder(scheme.Scheme, v1.EventSource{Component: "npc"})
 
-	nft, err := nftctrl.New(recorder, node.LinkGroupK8sPod)
+	nft, err := nftctrl.New(recorder, allocs.LinkGroupK8sPod)
 	if err != nil {
 		return fmt.Errorf("failed to create nftables controller: %w", err)
 	}