diff --git a/cloud/agent/e2e/BUILD.bazel b/cloud/agent/e2e/BUILD.bazel
index fa03d66..16e9731 100644
--- a/cloud/agent/e2e/BUILD.bazel
+++ b/cloud/agent/e2e/BUILD.bazel
@@ -12,11 +12,11 @@
     deps = [
         "//cloud/agent/api",
         "//cloud/bmaas/server/api",
-        "//metropolis/cli/pkg/datafile",
         "//metropolis/pkg/pki",
         "//metropolis/proto/api",
         "@com_github_cavaliergopher_cpio//:cpio",
         "@com_github_klauspost_compress//zstd",
+        "@io_bazel_rules_go//go/runfiles:go_default_library",
         "@org_golang_google_grpc//:go_default_library",
         "@org_golang_google_grpc//credentials",
         "@org_golang_google_protobuf//proto",
diff --git a/cloud/agent/e2e/main_test.go b/cloud/agent/e2e/main_test.go
index 277cc55..a422d0e 100644
--- a/cloud/agent/e2e/main_test.go
+++ b/cloud/agent/e2e/main_test.go
@@ -20,6 +20,7 @@
 	"testing"
 	"time"
 
+	"github.com/bazelbuild/rules_go/go/runfiles"
 	"github.com/cavaliergopher/cpio"
 	"github.com/klauspost/compress/zstd"
 	"golang.org/x/sys/unix"
@@ -29,9 +30,9 @@
 
 	apb "source.monogon.dev/cloud/agent/api"
 	bpb "source.monogon.dev/cloud/bmaas/server/api"
-	"source.monogon.dev/metropolis/cli/pkg/datafile"
-	"source.monogon.dev/metropolis/pkg/pki"
 	mpb "source.monogon.dev/metropolis/proto/api"
+
+	"source.monogon.dev/metropolis/pkg/pki"
 )
 
 type fakeServer struct {
@@ -136,7 +137,7 @@
 	grpcListenAddr := grpcLis.Addr().(*net.TCPAddr)
 
 	m := http.NewServeMux()
-	bundleFilePath, err := datafile.ResolveRunfile("metropolis/installer/test/testos/testos_bundle.zip")
+	bundleFilePath, err := runfiles.Rlocation("_main/metropolis/installer/test/testos/testos_bundle.zip")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -171,19 +172,19 @@
 		t.Fatalf("ftruncate failed: %v", err)
 	}
 
-	ovmfVarsPath, err := datafile.ResolveRunfile("external/edk2/OVMF_VARS.fd")
+	ovmfVarsPath, err := runfiles.Rlocation("edk2/OVMF_VARS.fd")
 	if err != nil {
 		t.Fatal(err)
 	}
-	ovmfCodePath, err := datafile.ResolveRunfile("external/edk2/OVMF_CODE.fd")
+	ovmfCodePath, err := runfiles.Rlocation("edk2/OVMF_CODE.fd")
 	if err != nil {
 		t.Fatal(err)
 	}
-	kernelPath, err := datafile.ResolveRunfile("third_party/linux/bzImage")
+	kernelPath, err := runfiles.Rlocation("_main/third_party/linux/bzImage")
 	if err != nil {
 		t.Fatal(err)
 	}
-	initramfsOrigPath, err := datafile.ResolveRunfile("cloud/agent/initramfs.cpio.zst")
+	initramfsOrigPath, err := runfiles.Rlocation("_main/cloud/agent/initramfs.cpio.zst")
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/cloud/lib/component/BUILD.bazel b/cloud/lib/component/BUILD.bazel
index dcbe0fe..71c1ab4 100644
--- a/cloud/lib/component/BUILD.bazel
+++ b/cloud/lib/component/BUILD.bazel
@@ -10,7 +10,6 @@
     importpath = "source.monogon.dev/cloud/lib/component",
     visibility = ["//visibility:public"],
     deps = [
-        "//metropolis/cli/pkg/datafile",
         "//metropolis/pkg/pki",
         "@com_github_adrg_xdg//:xdg",
         "@com_github_cockroachdb_cockroach_go_v2//testserver",
@@ -21,6 +20,7 @@
         "@com_github_prometheus_client_golang//prometheus",
         "@com_github_prometheus_client_golang//prometheus/collectors",
         "@com_github_prometheus_client_golang//prometheus/promhttp",
+        "@io_bazel_rules_go//go/runfiles:go_default_library",
         "@io_k8s_klog_v2//:klog",
         "@org_golang_google_grpc//:go_default_library",
         "@org_golang_google_grpc//credentials",
diff --git a/cloud/lib/component/crdb.go b/cloud/lib/component/crdb.go
index 7c9c1a8..aae1f77 100644
--- a/cloud/lib/component/crdb.go
+++ b/cloud/lib/component/crdb.go
@@ -9,14 +9,13 @@
 	"os"
 	"sync"
 
+	"github.com/bazelbuild/rules_go/go/runfiles"
 	"github.com/cockroachdb/cockroach-go/v2/testserver"
 	"github.com/golang-migrate/migrate/v4"
 	_ "github.com/golang-migrate/migrate/v4/database/cockroachdb"
 	"github.com/golang-migrate/migrate/v4/source"
 	_ "github.com/lib/pq"
 	"k8s.io/klog/v2"
-
-	"source.monogon.dev/metropolis/cli/pkg/datafile"
 )
 
 // CockroachConfig is the common configuration of a components' connection to
@@ -81,7 +80,7 @@
 		opts := []testserver.TestServerOpt{
 			testserver.SecureOpt(),
 		}
-		if path, err := datafile.ResolveRunfile("external/cockroach/cockroach"); err == nil {
+		if path, err := runfiles.Rlocation("cockroach/cockroach"); err == nil {
 			opts = append(opts, testserver.CockroachBinaryPathOpt(path))
 		} else {
 			if os.Getenv("TEST_TMPDIR") != "" {
diff --git a/cloud/takeover/e2e/BUILD.bazel b/cloud/takeover/e2e/BUILD.bazel
index 82ccd7d..b03e4be 100644
--- a/cloud/takeover/e2e/BUILD.bazel
+++ b/cloud/takeover/e2e/BUILD.bazel
@@ -10,10 +10,10 @@
     ],
     deps = [
         "//cloud/agent/api",
-        "//metropolis/cli/pkg/datafile",
         "//metropolis/pkg/fat32",
         "//metropolis/pkg/freeport",
         "@com_github_pkg_sftp//:sftp",
+        "@io_bazel_rules_go//go/runfiles:go_default_library",
         "@org_golang_google_protobuf//proto",
         "@org_golang_x_crypto//ssh",
     ],
diff --git a/cloud/takeover/e2e/main_test.go b/cloud/takeover/e2e/main_test.go
index 2b15174..02b982a 100644
--- a/cloud/takeover/e2e/main_test.go
+++ b/cloud/takeover/e2e/main_test.go
@@ -15,12 +15,13 @@
 	"testing"
 	"time"
 
+	"github.com/bazelbuild/rules_go/go/runfiles"
 	"github.com/pkg/sftp"
 	"golang.org/x/crypto/ssh"
 	"google.golang.org/protobuf/proto"
 
 	"source.monogon.dev/cloud/agent/api"
-	"source.monogon.dev/metropolis/cli/pkg/datafile"
+
 	"source.monogon.dev/metropolis/pkg/fat32"
 	"source.monogon.dev/metropolis/pkg/freeport"
 )
@@ -73,15 +74,15 @@
 	if err := fat32.WriteFS(cloudInitDataFile, rootInode, fat32.Options{Label: "cidata"}); err != nil {
 		t.Fatal(err)
 	}
-	cloudImagePath, err := datafile.ResolveRunfile("external/debian_11_cloudimage/file/downloaded")
+	cloudImagePath, err := runfiles.Rlocation("debian_11_cloudimage/file/downloaded")
 	if err != nil {
 		t.Fatal(err)
 	}
-	ovmfVarsPath, err := datafile.ResolveRunfile("external/edk2/OVMF_VARS.fd")
+	ovmfVarsPath, err := runfiles.Rlocation("edk2/OVMF_VARS.fd")
 	if err != nil {
 		t.Fatal(err)
 	}
-	ovmfCodePath, err := datafile.ResolveRunfile("external/edk2/OVMF_CODE.fd")
+	ovmfCodePath, err := runfiles.Rlocation("edk2/OVMF_CODE.fd")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -157,7 +158,7 @@
 	if err := takeoverFile.Chmod(0o755); err != nil {
 		t.Fatal(err)
 	}
-	takeoverPath, err := datafile.ResolveRunfile("cloud/takeover/takeover_/takeover")
+	takeoverPath, err := runfiles.Rlocation("_main/cloud/takeover/takeover_/takeover")
 	if err != nil {
 		t.Fatal(err)
 	}