diff --git a/metropolis/test/e2e/suites/core/BUILD.bazel b/metropolis/test/e2e/suites/core/BUILD.bazel
index 9671f9f..35d73ec 100644
--- a/metropolis/test/e2e/suites/core/BUILD.bazel
+++ b/metropolis/test/e2e/suites/core/BUILD.bazel
@@ -16,7 +16,7 @@
         "xTestImagesManifestPath": "$(rlocationpath //metropolis/test/e2e:testimages_manifest )",
     },
     deps = [
-        "//metropolis/node",
+        "//metropolis/node/allocs",
         "//metropolis/node/core/rpc",
         "//metropolis/proto/api",
         "//metropolis/proto/common",
diff --git a/metropolis/test/e2e/suites/core/run_test.go b/metropolis/test/e2e/suites/core/run_test.go
index f6fd24c..587e173 100644
--- a/metropolis/test/e2e/suites/core/run_test.go
+++ b/metropolis/test/e2e/suites/core/run_test.go
@@ -23,7 +23,7 @@
 	apb "source.monogon.dev/metropolis/proto/api"
 	cpb "source.monogon.dev/metropolis/proto/common"
 
-	common "source.monogon.dev/metropolis/node"
+	"source.monogon.dev/metropolis/node/allocs"
 	"source.monogon.dev/metropolis/node/core/rpc"
 	mlaunch "source.monogon.dev/metropolis/test/launch"
 	"source.monogon.dev/metropolis/test/localregistry"
@@ -101,7 +101,7 @@
 
 	// Dial first node's curator.
 	creds := rpc.NewAuthenticatedCredentials(cluster.Owner, rpc.WantInsecure())
-	remote := net.JoinHostPort(cluster.Nodes[cluster.NodeIDs[0]].ManagementAddress, common.CuratorServicePort.PortString())
+	remote := net.JoinHostPort(cluster.Nodes[cluster.NodeIDs[0]].ManagementAddress, allocs.PortCuratorService.PortString())
 	cl, err := grpc.NewClient(remote, grpc.WithContextDialer(cluster.DialNode), grpc.WithTransportCredentials(creds))
 	if err != nil {
 		t.Fatalf("failed to create first node's curator client: %v", err)
@@ -163,7 +163,7 @@
 		}
 		u := url.URL{
 			Scheme: "https",
-			Host:   net.JoinHostPort(cluster.NodeIDs[0], common.MetricsPort.PortString()),
+			Host:   net.JoinHostPort(cluster.NodeIDs[0], allocs.PortMetrics.PortString()),
 			Path:   "/metrics/node",
 		}
 		res, err := cl.Get(u.String())
diff --git a/metropolis/test/e2e/suites/kubernetes/BUILD.bazel b/metropolis/test/e2e/suites/kubernetes/BUILD.bazel
index a25bbe8..8091d67 100644
--- a/metropolis/test/e2e/suites/kubernetes/BUILD.bazel
+++ b/metropolis/test/e2e/suites/kubernetes/BUILD.bazel
@@ -35,6 +35,7 @@
     },
     deps = [
         "//metropolis/node",
+        "//metropolis/node/allocs",
         "//metropolis/proto/api",
         "//metropolis/proto/common",
         "//metropolis/test/e2e/connectivity",
diff --git a/metropolis/test/e2e/suites/kubernetes/run_test.go b/metropolis/test/e2e/suites/kubernetes/run_test.go
index 8333567..64da63e 100644
--- a/metropolis/test/e2e/suites/kubernetes/run_test.go
+++ b/metropolis/test/e2e/suites/kubernetes/run_test.go
@@ -32,6 +32,7 @@
 	"k8s.io/utils/ptr"
 
 	common "source.monogon.dev/metropolis/node"
+	"source.monogon.dev/metropolis/node/allocs"
 	apb "source.monogon.dev/metropolis/proto/api"
 	cpb "source.monogon.dev/metropolis/proto/common"
 	"source.monogon.dev/metropolis/test/e2e/connectivity"
@@ -620,7 +621,7 @@
 		}
 		u := url.URL{
 			Scheme: "https",
-			Host:   net.JoinHostPort(cluster.NodeIDs[1], common.MetricsPort.PortString()),
+			Host:   net.JoinHostPort(cluster.NodeIDs[1], allocs.PortMetrics.PortString()),
 			Path:   "/metrics/containerd",
 		}
 		res, err := cl.Get(u.String())
diff --git a/metropolis/test/launch/BUILD.bazel b/metropolis/test/launch/BUILD.bazel
index b2530c5..f93cda8 100644
--- a/metropolis/test/launch/BUILD.bazel
+++ b/metropolis/test/launch/BUILD.bazel
@@ -48,6 +48,7 @@
         "//metropolis/cli/metroctl/core",
         "//metropolis/installer/install",
         "//metropolis/node",
+        "//metropolis/node/allocs",
         "//metropolis/node/core/curator/proto/api",
         "//metropolis/node/core/rpc",
         "//metropolis/node/core/rpc/resolver",
diff --git a/metropolis/test/launch/cli/launch-cluster/BUILD.bazel b/metropolis/test/launch/cli/launch-cluster/BUILD.bazel
index 339ea4c..0e9795b 100644
--- a/metropolis/test/launch/cli/launch-cluster/BUILD.bazel
+++ b/metropolis/test/launch/cli/launch-cluster/BUILD.bazel
@@ -14,7 +14,7 @@
     deps = [
         "//metropolis/cli/flagdefs",
         "//metropolis/cli/metroctl/core",
-        "//metropolis/node",
+        "//metropolis/node/allocs",
         "//metropolis/proto/common",
         "//metropolis/test/launch",
         "@io_bazel_rules_go//go/runfiles",
diff --git a/metropolis/test/launch/cli/launch-cluster/main.go b/metropolis/test/launch/cli/launch-cluster/main.go
index 1aec556..e94f0cf 100644
--- a/metropolis/test/launch/cli/launch-cluster/main.go
+++ b/metropolis/test/launch/cli/launch-cluster/main.go
@@ -20,7 +20,7 @@
 
 	"source.monogon.dev/metropolis/cli/flagdefs"
 	metroctl "source.monogon.dev/metropolis/cli/metroctl/core"
-	"source.monogon.dev/metropolis/node"
+	"source.monogon.dev/metropolis/node/allocs"
 	cpb "source.monogon.dev/metropolis/proto/common"
 	mlaunch "source.monogon.dev/metropolis/test/launch"
 )
@@ -183,7 +183,7 @@
 	apiserver := cl.Nodes[cl.NodeIDs[0]].ManagementAddress
 	// Wait for the API server to start listening.
 	for {
-		conn, err := cl.DialNode(ctx, net.JoinHostPort(apiserver, node.KubernetesAPIWrappedPort.PortString()))
+		conn, err := cl.DialNode(ctx, net.JoinHostPort(apiserver, allocs.PortKubernetesAPIWrapped.PortString()))
 		if err == nil {
 			conn.Close()
 			break
diff --git a/metropolis/test/launch/cluster.go b/metropolis/test/launch/cluster.go
index c77a101..c6711c8 100644
--- a/metropolis/test/launch/cluster.go
+++ b/metropolis/test/launch/cluster.go
@@ -41,6 +41,7 @@
 	"k8s.io/client-go/rest"
 	"k8s.io/utils/ptr"
 
+	"source.monogon.dev/metropolis/node/allocs"
 	ipb "source.monogon.dev/metropolis/node/core/curator/proto/api"
 	apb "source.monogon.dev/metropolis/proto/api"
 	cpb "source.monogon.dev/metropolis/proto/common"
@@ -141,17 +142,17 @@
 }
 
 // NodePorts is the list of ports a fully operational Metropolis node listens on
-var NodePorts = []node.Port{
-	node.ConsensusPort,
+var NodePorts = []allocs.Port{
+	allocs.PortConsensus,
 
-	node.CuratorServicePort,
-	node.DebugServicePort,
+	allocs.PortCuratorService,
+	allocs.PortDebugService,
 
-	node.KubernetesAPIPort,
-	node.KubernetesAPIWrappedPort,
-	node.CuratorServicePort,
-	node.DebuggerPort,
-	node.MetricsPort,
+	allocs.PortKubernetesAPI,
+	allocs.PortKubernetesAPIWrapped,
+	allocs.PortCuratorService,
+	allocs.PortDebugger,
+	allocs.PortMetrics,
 }
 
 // setupRuntime creates the node's QEMU runtime directory, together with all
@@ -579,10 +580,10 @@
 // ClusterPorts contains all ports handled by Nanoswitch.
 var ClusterPorts = []uint16{
 	// Forwarded to the first node.
-	uint16(node.CuratorServicePort),
-	uint16(node.DebugServicePort),
-	uint16(node.KubernetesAPIPort),
-	uint16(node.KubernetesAPIWrappedPort),
+	uint16(allocs.PortCuratorService),
+	uint16(allocs.PortDebugService),
+	uint16(allocs.PortKubernetesAPI),
+	uint16(allocs.PortKubernetesAPIWrapped),
 
 	// SOCKS proxy to the switch network
 	SOCKSPort,
@@ -694,7 +695,7 @@
 // information as NodeInCluster.
 func firstConnection(ctx context.Context, socksDialer proxy.Dialer) (*tls.Certificate, *NodeInCluster, error) {
 	// Dial external service.
-	remote := fmt.Sprintf("10.1.0.2:%s", node.CuratorServicePort.PortString())
+	remote := fmt.Sprintf("10.1.0.2:%s", allocs.PortCuratorService.PortString())
 	initCreds, err := rpc.NewEphemeralCredentials(InsecurePrivateKey, rpc.WantInsecure())
 	if err != nil {
 		return nil, nil, fmt.Errorf("NewEphemeralCredentials: %w", err)
@@ -1320,7 +1321,7 @@
 		panic(err)
 	}
 
-	host := net.JoinHostPort(c.NodeIDs[0], node.KubernetesAPIWrappedPort.PortString())
+	host := net.JoinHostPort(c.NodeIDs[0], allocs.PortKubernetesAPIWrapped.PortString())
 	clientConfig := rest.Config{
 		Host: host,
 		TLSClientConfig: rest.TLSClientConfig{
diff --git a/metropolis/test/nanoswitch/BUILD.bazel b/metropolis/test/nanoswitch/BUILD.bazel
index ef80101..58555b5 100644
--- a/metropolis/test/nanoswitch/BUILD.bazel
+++ b/metropolis/test/nanoswitch/BUILD.bazel
@@ -10,7 +10,7 @@
     importpath = "source.monogon.dev/metropolis/test/nanoswitch",
     visibility = ["//visibility:private"],
     deps = [
-        "//metropolis/node",
+        "//metropolis/node/allocs",
         "//osbase/bringup",
         "//osbase/net/dhcp4c",
         "//osbase/net/dhcp4c/callback",
diff --git a/metropolis/test/nanoswitch/nanoswitch.go b/metropolis/test/nanoswitch/nanoswitch.go
index 78d8efe..56f11a8 100644
--- a/metropolis/test/nanoswitch/nanoswitch.go
+++ b/metropolis/test/nanoswitch/nanoswitch.go
@@ -28,7 +28,7 @@
 	"github.com/insomniacslk/dhcp/dhcpv4/server4"
 	"github.com/vishvananda/netlink"
 
-	common "source.monogon.dev/metropolis/node"
+	"source.monogon.dev/metropolis/node/allocs"
 	"source.monogon.dev/osbase/bringup"
 	"source.monogon.dev/osbase/net/dhcp4c"
 	dhcpcb "source.monogon.dev/osbase/net/dhcp4c/callback"
@@ -128,7 +128,7 @@
 
 // userspaceProxy listens on port and proxies all TCP connections to the same
 // port on targetIP
-func userspaceProxy(targetIP net.IP, port common.Port) supervisor.Runnable {
+func userspaceProxy(targetIP net.IP, port allocs.Port) supervisor.Runnable {
 	return func(ctx context.Context) error {
 		logger := supervisor.Logger(ctx)
 		tcpListener, err := net.ListenTCP("tcp", &net.TCPAddr{IP: net.IPv4(0, 0, 0, 0), Port: int(port)})
@@ -289,10 +289,10 @@
 		logger.Info("No upstream interface detected")
 	}
 	supervisor.Run(ctx, "dhcp-server", runDHCPServer(vmBridgeLink))
-	supervisor.Run(ctx, "proxy-cur1", userspaceProxy(net.IPv4(10, 1, 0, 2), common.CuratorServicePort))
-	supervisor.Run(ctx, "proxy-dbg1", userspaceProxy(net.IPv4(10, 1, 0, 2), common.DebugServicePort))
-	supervisor.Run(ctx, "proxy-k8s-api1", userspaceProxy(net.IPv4(10, 1, 0, 2), common.KubernetesAPIPort))
-	supervisor.Run(ctx, "proxy-k8s-api-wrapped1", userspaceProxy(net.IPv4(10, 1, 0, 2), common.KubernetesAPIWrappedPort))
+	supervisor.Run(ctx, "proxy-cur1", userspaceProxy(net.IPv4(10, 1, 0, 2), allocs.PortCuratorService))
+	supervisor.Run(ctx, "proxy-dbg1", userspaceProxy(net.IPv4(10, 1, 0, 2), allocs.PortDebugService))
+	supervisor.Run(ctx, "proxy-k8s-api1", userspaceProxy(net.IPv4(10, 1, 0, 2), allocs.PortKubernetesAPI))
+	supervisor.Run(ctx, "proxy-k8s-api-wrapped1", userspaceProxy(net.IPv4(10, 1, 0, 2), allocs.PortKubernetesAPIWrapped))
 	supervisor.Run(ctx, "socks", runSOCKSProxy)
 	supervisor.Signal(ctx, supervisor.SignalHealthy)
 	supervisor.Signal(ctx, supervisor.SignalDone)