diff --git a/cloud/BUILD.bazel b/cloud/BUILD.bazel
index 04222e7..cfafaa7 100644
--- a/cloud/BUILD.bazel
+++ b/cloud/BUILD.bazel
@@ -1,5 +1,7 @@
+load("@aspect_bazel_lib//lib:expand_template.bzl", "expand_template")
 load("@bazel_skylib//rules:write_file.bzl", "write_file")
 load("@rules_multirun//:defs.bzl", "multirun")
+load("@rules_oci//oci:defs.bzl", "oci_push")
 
 write_file(
     name = "tags_tmpl",
@@ -9,8 +11,6 @@
     ],
 )
 
-load("@aspect_bazel_lib//lib:expand_template.bzl", "expand_template")
-
 # Use the value of --embed_label under --stamp, otherwise use a deterministic constant
 # value to ensure cache hits for actions that depend on this.
 expand_template(
@@ -21,8 +21,6 @@
     template = "tags_tmpl",
 )
 
-load("@rules_oci//oci:defs.bzl", "oci_push")
-
 oci_push(
     name = "apigw_image",
     image = "//cloud/apigw:apigw_image",
diff --git a/cloud/agent/api/BUILD.bazel b/cloud/agent/api/BUILD.bazel
index ba31094..73c73b7 100644
--- a/cloud/agent/api/BUILD.bazel
+++ b/cloud/agent/api/BUILD.bazel
@@ -1,6 +1,6 @@
-load("@rules_proto//proto:defs.bzl", "proto_library")
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 load("@io_bazel_rules_go//proto:def.bzl", "go_proto_library")
+load("@rules_proto//proto:defs.bzl", "proto_library")
 
 proto_library(
     name = "api_proto",
diff --git a/cloud/agent/e2e/BUILD.bazel b/cloud/agent/e2e/BUILD.bazel
index 39dd031..c859c2b 100644
--- a/cloud/agent/e2e/BUILD.bazel
+++ b/cloud/agent/e2e/BUILD.bazel
@@ -24,7 +24,7 @@
         "//osbase/pki",
         "@com_github_cavaliergopher_cpio//:cpio",
         "@com_github_klauspost_compress//zstd",
-        "@io_bazel_rules_go//go/runfiles:go_default_library",
+        "@io_bazel_rules_go//go/runfiles",
         "@org_golang_google_grpc//:grpc",
         "@org_golang_google_grpc//credentials",
         "@org_golang_google_protobuf//proto",
diff --git a/cloud/agent/takeover/BUILD.bazel b/cloud/agent/takeover/BUILD.bazel
index 2b28464..6fe88bd 100644
--- a/cloud/agent/takeover/BUILD.bazel
+++ b/cloud/agent/takeover/BUILD.bazel
@@ -2,7 +2,6 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
 load("//build/static_binary_tarball:def.bzl", "static_binary_tarball")
 load("//osbase/build:def.bzl", "node_initramfs")
-load("//osbase/build/fwprune:def.bzl", "fsspec_linux_firmware")
 
 go_library(
     name = "takeover_lib",
diff --git a/cloud/agent/takeover/e2e/BUILD.bazel b/cloud/agent/takeover/e2e/BUILD.bazel
index 3ca92ee..0333753 100644
--- a/cloud/agent/takeover/e2e/BUILD.bazel
+++ b/cloud/agent/takeover/e2e/BUILD.bazel
@@ -22,7 +22,7 @@
         "//osbase/fat32",
         "//osbase/freeport",
         "@com_github_pkg_sftp//:sftp",
-        "@io_bazel_rules_go//go/runfiles:go_default_library",
+        "@io_bazel_rules_go//go/runfiles",
         "@org_golang_google_protobuf//proto",
         "@org_golang_x_crypto//ssh",
     ],
diff --git a/cloud/api/BUILD.bazel b/cloud/api/BUILD.bazel
index 363713f..c9e2abf 100644
--- a/cloud/api/BUILD.bazel
+++ b/cloud/api/BUILD.bazel
@@ -1,6 +1,6 @@
-load("@rules_proto//proto:defs.bzl", "proto_library")
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 load("@io_bazel_rules_go//proto:def.bzl", "go_proto_library")
+load("@rules_proto//proto:defs.bzl", "proto_library")
 
 proto_library(
     name = "api_proto",
diff --git a/cloud/apigw/BUILD.bazel b/cloud/apigw/BUILD.bazel
index a570529..7d2114d 100644
--- a/cloud/apigw/BUILD.bazel
+++ b/cloud/apigw/BUILD.bazel
@@ -1,4 +1,6 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
+load("@rules_oci//oci:defs.bzl", "oci_image")
+load("@rules_pkg//pkg:tar.bzl", "pkg_tar")
 
 go_library(
     name = "apigw_lib",
@@ -17,15 +19,11 @@
     visibility = ["//visibility:public"],
 )
 
-load("@rules_pkg//pkg:tar.bzl", "pkg_tar")
-
 pkg_tar(
     name = "apigw_layer",
     srcs = [":apigw"],
 )
 
-load("@rules_oci//oci:defs.bzl", "oci_image")
-
 oci_image(
     name = "apigw_image",
     base = "@distroless_base",
diff --git a/cloud/bmaas/scruffy/cmd/BUILD.bazel b/cloud/bmaas/scruffy/cmd/BUILD.bazel
index 1d919b4..9284aae 100644
--- a/cloud/bmaas/scruffy/cmd/BUILD.bazel
+++ b/cloud/bmaas/scruffy/cmd/BUILD.bazel
@@ -1,4 +1,6 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
+load("@rules_oci//oci:defs.bzl", "oci_image")
+load("@rules_pkg//pkg:tar.bzl", "pkg_tar")
 
 go_library(
     name = "cmd_lib",
@@ -14,15 +16,11 @@
     visibility = ["//visibility:public"],
 )
 
-load("@rules_pkg//pkg:tar.bzl", "pkg_tar")
-
 pkg_tar(
     name = "cmd_layer",
     srcs = [":cmd"],
 )
 
-load("@rules_oci//oci:defs.bzl", "oci_image")
-
 oci_image(
     name = "cmd_image",
     base = "@distroless_base",
diff --git a/cloud/bmaas/server/api/BUILD.bazel b/cloud/bmaas/server/api/BUILD.bazel
index 10037e1..96c56ab 100644
--- a/cloud/bmaas/server/api/BUILD.bazel
+++ b/cloud/bmaas/server/api/BUILD.bazel
@@ -1,6 +1,6 @@
-load("@rules_proto//proto:defs.bzl", "proto_library")
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 load("@io_bazel_rules_go//proto:def.bzl", "go_proto_library")
+load("@rules_proto//proto:defs.bzl", "proto_library")
 
 proto_library(
     name = "api_proto",
diff --git a/cloud/bmaas/server/cmd/BUILD.bazel b/cloud/bmaas/server/cmd/BUILD.bazel
index 9f3ce58..cbfdfed 100644
--- a/cloud/bmaas/server/cmd/BUILD.bazel
+++ b/cloud/bmaas/server/cmd/BUILD.bazel
@@ -1,5 +1,6 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
-load("//build/static_binary_tarball:def.bzl", "static_binary_tarball")
+load("@rules_oci//oci:defs.bzl", "oci_image")
+load("@rules_pkg//pkg:tar.bzl", "pkg_tar")
 
 go_library(
     name = "cmd_lib",
@@ -18,15 +19,11 @@
     visibility = ["//visibility:public"],
 )
 
-load("@rules_pkg//pkg:tar.bzl", "pkg_tar")
-
 pkg_tar(
     name = "cmd_layer",
     srcs = [":cmd"],
 )
 
-load("@rules_oci//oci:defs.bzl", "oci_image")
-
 oci_image(
     name = "cmd_image",
     base = "@distroless_base",
diff --git a/cloud/lib/component/BUILD.bazel b/cloud/lib/component/BUILD.bazel
index 5f85b83..e751aaf 100644
--- a/cloud/lib/component/BUILD.bazel
+++ b/cloud/lib/component/BUILD.bazel
@@ -20,7 +20,7 @@
         "@com_github_prometheus_client_golang//prometheus",
         "@com_github_prometheus_client_golang//prometheus/collectors",
         "@com_github_prometheus_client_golang//prometheus/promhttp",
-        "@io_bazel_rules_go//go/runfiles:go_default_library",
+        "@io_bazel_rules_go//go/runfiles",
         "@io_k8s_klog_v2//:klog",
         "@org_golang_google_grpc//:grpc",
         "@org_golang_google_grpc//credentials",
diff --git a/cloud/shepherd/mini/BUILD.bazel b/cloud/shepherd/mini/BUILD.bazel
index f8a5e72..948eb40 100644
--- a/cloud/shepherd/mini/BUILD.bazel
+++ b/cloud/shepherd/mini/BUILD.bazel
@@ -1,4 +1,6 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
+load("@rules_oci//oci:defs.bzl", "oci_image")
+load("@rules_pkg//pkg:tar.bzl", "pkg_tar")
 
 go_library(
     name = "mini_lib",
@@ -28,15 +30,11 @@
     visibility = ["//visibility:public"],
 )
 
-load("@rules_pkg//pkg:tar.bzl", "pkg_tar")
-
 pkg_tar(
     name = "mini_layer",
     srcs = [":mini"],
 )
 
-load("@rules_oci//oci:defs.bzl", "oci_image")
-
 oci_image(
     name = "mini_image",
     base = "@distroless_base",
diff --git a/cloud/shepherd/provider/equinix/BUILD.bazel b/cloud/shepherd/provider/equinix/BUILD.bazel
index ef1ab53..23502b3 100644
--- a/cloud/shepherd/provider/equinix/BUILD.bazel
+++ b/cloud/shepherd/provider/equinix/BUILD.bazel
@@ -1,4 +1,6 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library", "go_test")
+load("@rules_oci//oci:defs.bzl", "oci_image")
+load("@rules_pkg//pkg:tar.bzl", "pkg_tar")
 
 go_library(
     name = "equinix_lib",
@@ -57,15 +59,11 @@
     visibility = ["//visibility:public"],
 )
 
-load("@rules_pkg//pkg:tar.bzl", "pkg_tar")
-
 pkg_tar(
     name = "equinix_layer",
     srcs = [":equinix"],
 )
 
-load("@rules_oci//oci:defs.bzl", "oci_image")
-
 oci_image(
     name = "equinix_image",
     base = "@distroless_base",