diff --git a/cloud/agent/takeover/BUILD.bazel b/cloud/agent/takeover/BUILD.bazel
index 6fe88bd..61d6480 100644
--- a/cloud/agent/takeover/BUILD.bazel
+++ b/cloud/agent/takeover/BUILD.bazel
@@ -50,9 +50,9 @@
 node_initramfs(
     name = "initramfs",
     files = {
-        "//cloud/agent:agent": "/init",
-        "//osbase/net/dns:resolv.conf": "/etc/resolv.conf",
-        "@cacerts//file": "/etc/ssl/cert.pem",
+        "/init": "//cloud/agent:agent",
+        "/etc/resolv.conf": "//osbase/net/dns:resolv.conf",
+        "/etc/ssl/cert.pem": "@cacerts//file",
     },
     fsspecs = [
         "//osbase/build:earlydev.fsspec",
diff --git a/metropolis/installer/BUILD.bazel b/metropolis/installer/BUILD.bazel
index 61cf7b6..a2790b4 100644
--- a/metropolis/installer/BUILD.bazel
+++ b/metropolis/installer/BUILD.bazel
@@ -31,7 +31,7 @@
 node_initramfs(
     name = "initramfs",
     files = {
-        "//metropolis/installer": "/init",
+        "/init": "//metropolis/installer",
     },
     fsspecs = [
         "//osbase/build:earlydev.fsspec",
diff --git a/metropolis/installer/test/testos/BUILD.bazel b/metropolis/installer/test/testos/BUILD.bazel
index c41fbee..c7d58f0 100644
--- a/metropolis/installer/test/testos/BUILD.bazel
+++ b/metropolis/installer/test/testos/BUILD.bazel
@@ -6,7 +6,7 @@
 erofs_image(
     name = "rootfs",
     files = {
-        ":testos": "/init",
+        "/init": ":testos",
     },
 )
 
diff --git a/metropolis/node/BUILD.bazel b/metropolis/node/BUILD.bazel
index d04db8b..109b0f5 100644
--- a/metropolis/node/BUILD.bazel
+++ b/metropolis/node/BUILD.bazel
@@ -45,56 +45,56 @@
 erofs_image(
     name = "rootfs",
     files = {
-        "//metropolis/node/core": "/core",
+        "/core": "//metropolis/node/core",
 
         # CA Certificate bundle & os-release & resolv.conf & hosts
         # These should not be explicitly used by Metropolis code and are only here for compatibility with
         # paths hardcoded by standard libraries (like Go's).
-        "@cacerts//file": "/etc/ssl/cert.pem",
-        "//metropolis/node:passwd": "/etc/passwd",
-        "//osbase/net/dns:resolv.conf": "/etc/resolv.conf",
-        "//osbase/net/dns:hosts": "/etc/hosts",
-        ":os-release-info": "/etc/os-release",
+        "/etc/ssl/cert.pem": "@cacerts//file",
+        "/etc/passwd": ":passwd",
+        "/etc/resolv.conf": "//osbase/net/dns:resolv.conf",
+        "/etc/hosts": "//osbase/net/dns:hosts",
+        "/etc/os-release": ":os-release-info",
 
         # Metrics exporters
-        "@com_github_prometheus_node_exporter//:node_exporter": "/metrics/bin/node_exporter",
+        "/metrics/bin/node_exporter": "@com_github_prometheus_node_exporter//:node_exporter",
 
         # Hyperkube
-        "//metropolis/node/kubernetes/hyperkube": "/kubernetes/bin/kube",
+        "/kubernetes/bin/kube": "//metropolis/node/kubernetes/hyperkube",
 
         # runsc/gVisor
-        "@dev_gvisor_gvisor//runsc": "/containerd/bin/runsc",
-        "@dev_gvisor_gvisor//shim": "/containerd/bin/containerd-shim-runsc-v1",
+        "/containerd/bin/runsc": "@dev_gvisor_gvisor//runsc",
+        "/containerd/bin/containerd-shim-runsc-v1": "@dev_gvisor_gvisor//shim",
 
         # runc (runtime in files_cc because of cgo)
-        "@com_github_containerd_containerd_v2//cmd/containerd-shim-runc-v2": "/containerd/bin/containerd-shim-runc-v2",
+        "/containerd/bin/containerd-shim-runc-v2": "@com_github_containerd_containerd_v2//cmd/containerd-shim-runc-v2",
 
         # Containerd
-        "@com_github_containerd_containerd_v2//cmd/containerd": "/containerd/bin/containerd",
+        "/containerd/bin/containerd": "@com_github_containerd_containerd_v2//cmd/containerd",
 
         # Containerd config files
-        "//metropolis/node/kubernetes/containerd:runsc.toml": "/containerd/conf/runsc.toml",
-        "//metropolis/node/kubernetes/containerd:config.toml": "/containerd/conf/config.toml",
-        "//metropolis/node/kubernetes/containerd:cnispec.gojson": "/containerd/conf/cnispec.gojson",
+        "/containerd/conf/runsc.toml": "//metropolis/node/kubernetes/containerd:runsc.toml",
+        "/containerd/conf/config.toml": "//metropolis/node/kubernetes/containerd:config.toml",
+        "/containerd/conf/cnispec.gojson": "//metropolis/node/kubernetes/containerd:cnispec.gojson",
 
         # Containerd preseed bundles
-        "//metropolis/test/e2e/preseedtest:preseedtest_tarball": "/containerd/preseed/k8s.io/preseedtest.tar",
-        "//metropolis/node/kubernetes/pause:pause_tarball": "/containerd/preseed/k8s.io/pause.tar",
+        "/containerd/preseed/k8s.io/preseedtest.tar": "//metropolis/test/e2e/preseedtest:preseedtest_tarball",
+        "/containerd/preseed/k8s.io/pause.tar": "//metropolis/node/kubernetes/pause:pause_tarball",
 
         # CNI Plugins
-        "@com_github_containernetworking_plugins//plugins/main/loopback": "/containerd/bin/cni/loopback",
-        "@com_github_containernetworking_plugins//plugins/main/ptp": "/containerd/bin/cni/ptp",
-        "@com_github_containernetworking_plugins//plugins/ipam/host-local": "/containerd/bin/cni/host-local",
+        "/containerd/bin/cni/loopback": "@com_github_containernetworking_plugins//plugins/main/loopback",
+        "/containerd/bin/cni/ptp": "@com_github_containernetworking_plugins//plugins/main/ptp",
+        "/containerd/bin/cni/host-local": "@com_github_containernetworking_plugins//plugins/ipam/host-local",
 
         # Delve
-        "@com_github_go_delve_delve//cmd/dlv:dlv": "/dlv",
+        "/dlv": "@com_github_go_delve_delve//cmd/dlv:dlv",
     },
     files_cc = {
-        "//metropolis/node/core/minit": "/init",
+        "/init": "//metropolis/node/core/minit",
         # runc runtime, with cgo
-        ":runc": "/containerd/bin/runc",
-        "@xfsprogs//:mkfs": "/bin/mkfs.xfs",
-        "@chrony//:chrony": "/time/chrony",
+        "/containerd/bin/runc": ":runc",
+        "/bin/mkfs.xfs": "@xfsprogs//:mkfs",
+        "/time/chrony": "@chrony//:chrony",
     },
     fsspecs = [
         ":erofs-layout.fsspec",
diff --git a/metropolis/node/core/update/e2e/testos/testos.bzl b/metropolis/node/core/update/e2e/testos/testos.bzl
index c663bc6..e37ddb5 100644
--- a/metropolis/node/core/update/e2e/testos/testos.bzl
+++ b/metropolis/node/core/update/e2e/testos/testos.bzl
@@ -10,8 +10,8 @@
     erofs_image(
         name = "rootfs_" + variant,
         files = {
-            ":testos_" + variant: "/init",
-            "//osbase/net/dns:resolv.conf": "/etc/resolv.conf",
+            "/init": ":testos_" + variant,
+            "/etc/resolv.conf": "//osbase/net/dns:resolv.conf",
         },
         fsspecs = [
             "//osbase/build:earlydev.fsspec",
diff --git a/metropolis/test/nanoswitch/BUILD.bazel b/metropolis/test/nanoswitch/BUILD.bazel
index 8e246ba..1dbf267 100644
--- a/metropolis/test/nanoswitch/BUILD.bazel
+++ b/metropolis/test/nanoswitch/BUILD.bazel
@@ -35,10 +35,10 @@
 node_initramfs(
     name = "initramfs",
     files = {
-        ":nanoswitch": "/init",
+        "/init": ":nanoswitch",
 
         # CA Certificate bundle
-        "@cacerts//file": "/etc/ssl/cert.pem",
+        "/etc/ssl/cert.pem": "@cacerts//file",
     },
     fsspecs = [
         "//osbase/build:earlydev.fsspec",
diff --git a/osbase/bringup/test/BUILD.bazel b/osbase/bringup/test/BUILD.bazel
index 1e9312a..a5f3768 100644
--- a/osbase/bringup/test/BUILD.bazel
+++ b/osbase/bringup/test/BUILD.bazel
@@ -28,6 +28,7 @@
     ],
 )
 
+# TODO(tim): Replace instances with macro
 go_library(
     name = "succeeded_lib",
     srcs = ["main_succeeded.go"],
@@ -53,7 +54,7 @@
 node_initramfs(
     name = "initramfs_succeeded",
     files = {
-        ":succeeded": "/init",
+        "/init": ":succeeded",
     },
     fsspecs = [
         "//osbase/build:earlydev.fsspec",
@@ -94,7 +95,7 @@
 node_initramfs(
     name = "initramfs_panic",
     files = {
-        ":panic": "/init",
+        "/init": ":panic",
     },
     fsspecs = [
         "//osbase/build:earlydev.fsspec",
@@ -135,7 +136,7 @@
 node_initramfs(
     name = "initramfs_error",
     files = {
-        ":error": "/init",
+        "/init": ":error",
     },
     fsspecs = [
         "//osbase/build:earlydev.fsspec",
diff --git a/osbase/build/def.bzl b/osbase/build/def.bzl
index 73752f7..d4b497c 100644
--- a/osbase/build/def.bzl
+++ b/osbase/build/def.bzl
@@ -61,7 +61,7 @@
 
     fs_files = []
     inputs = []
-    for label, p in ctx.attr.files.items() + ctx.attr.files_cc.items() + extra_files:
+    for p, label in ctx.attr.files.items() + ctx.attr.files_cc.items() + extra_files:
         if not p.startswith("/"):
             fail("file {} invalid: must begin with /".format(p))
 
@@ -134,7 +134,7 @@
         their permissions set to 0444. All parent directories will be created with 0755 permissions.
     """,
     attrs = {
-        "files": attr.label_keyed_string_dict(
+        "files": attr.string_keyed_label_dict(
             mandatory = True,
             allow_files = True,
             doc = """
@@ -144,7 +144,7 @@
             # Attach pure transition to ensure all binaries added to the initramfs are pure/static binaries.
             cfg = build_pure_transition,
         ),
-        "files_cc": attr.label_keyed_string_dict(
+        "files_cc": attr.string_keyed_label_dict(
             allow_files = True,
             doc = """
                  Special case of 'files' for compilation targets that need to be built with the musl toolchain like
@@ -196,7 +196,7 @@
         their permissions set to 0444. All parent directories will be created with 0555 permissions.
     """,
     attrs = {
-        "files": attr.label_keyed_string_dict(
+        "files": attr.string_keyed_label_dict(
             mandatory = True,
             allow_files = True,
             doc = """
@@ -206,7 +206,7 @@
             # Attach pure transition to ensure all binaries added to the initramfs are pure/static binaries.
             cfg = build_pure_transition,
         ),
-        "files_cc": attr.label_keyed_string_dict(
+        "files_cc": attr.string_keyed_label_dict(
             allow_files = True,
             doc = """
                  Special case of 'files' for compilation targets that need to be built with the musl toolchain like
diff --git a/osbase/fsquota/BUILD.bazel b/osbase/fsquota/BUILD.bazel
index 75a3133..0293e25 100644
--- a/osbase/fsquota/BUILD.bazel
+++ b/osbase/fsquota/BUILD.bazel
@@ -27,7 +27,7 @@
     name = "ktest",
     cmdline = "ramdisk_size=51200",
     files_cc = {
-        "@xfsprogs//:mkfs": "/mkfs.xfs",
+        "/mkfs.xfs": "@xfsprogs//:mkfs",
     },
     tester = ":fsquota_test",
 )
diff --git a/osbase/test/ktest/ktest.bzl b/osbase/test/ktest/ktest.bzl
index 42e6b60..37efd30 100644
--- a/osbase/test/ktest/ktest.bzl
+++ b/osbase/test/ktest/ktest.bzl
@@ -30,7 +30,7 @@
     initramfs_name = ctx.label.name + ".cpio.zst"
     initramfs = ctx.actions.declare_file(initramfs_name)
 
-    fsspec_core_impl(ctx, ctx.executable._mkcpio, initramfs, [(ctx.attr._ktest_init[0], "/init"), (ctx.attr.tester[0], "/tester")], [ctx.attr._earlydev])
+    fsspec_core_impl(ctx, ctx.executable._mkcpio, initramfs, [("/init", ctx.attr._ktest_init[0]), ("/tester", ctx.attr.tester[0])], [ctx.attr._earlydev])
 
     script_file = ctx.actions.declare_file(ctx.label.name + ".sh")
 
@@ -65,7 +65,7 @@
             # Runs inside the given kernel, needs to be build for Linux/static
             cfg = build_static_transition,
         ),
-        "files": attr.label_keyed_string_dict(
+        "files": attr.string_keyed_label_dict(
             allow_files = True,
             doc = """
                 Dictionary of Labels to String, placing a given Label's output file in the initramfs at the location
@@ -74,7 +74,7 @@
             # Attach pure transition to ensure all binaries added to the initramfs are pure/static binaries.
             cfg = build_pure_transition,
         ),
-        "files_cc": attr.label_keyed_string_dict(
+        "files_cc": attr.string_keyed_label_dict(
             allow_files = True,
             doc = """
                  Special case of 'files' for compilation targets that need to be built with the musl toolchain like