diff --git a/cloud/agent/e2e/BUILD.bazel b/cloud/agent/e2e/BUILD.bazel
index fa03d66..16e9731 100644
--- a/cloud/agent/e2e/BUILD.bazel
+++ b/cloud/agent/e2e/BUILD.bazel
@@ -12,11 +12,11 @@
     deps = [
         "//cloud/agent/api",
         "//cloud/bmaas/server/api",
-        "//metropolis/cli/pkg/datafile",
         "//metropolis/pkg/pki",
         "//metropolis/proto/api",
         "@com_github_cavaliergopher_cpio//:cpio",
         "@com_github_klauspost_compress//zstd",
+        "@io_bazel_rules_go//go/runfiles:go_default_library",
         "@org_golang_google_grpc//:go_default_library",
         "@org_golang_google_grpc//credentials",
         "@org_golang_google_protobuf//proto",
diff --git a/cloud/agent/e2e/main_test.go b/cloud/agent/e2e/main_test.go
index 277cc55..a422d0e 100644
--- a/cloud/agent/e2e/main_test.go
+++ b/cloud/agent/e2e/main_test.go
@@ -20,6 +20,7 @@
 	"testing"
 	"time"
 
+	"github.com/bazelbuild/rules_go/go/runfiles"
 	"github.com/cavaliergopher/cpio"
 	"github.com/klauspost/compress/zstd"
 	"golang.org/x/sys/unix"
@@ -29,9 +30,9 @@
 
 	apb "source.monogon.dev/cloud/agent/api"
 	bpb "source.monogon.dev/cloud/bmaas/server/api"
-	"source.monogon.dev/metropolis/cli/pkg/datafile"
-	"source.monogon.dev/metropolis/pkg/pki"
 	mpb "source.monogon.dev/metropolis/proto/api"
+
+	"source.monogon.dev/metropolis/pkg/pki"
 )
 
 type fakeServer struct {
@@ -136,7 +137,7 @@
 	grpcListenAddr := grpcLis.Addr().(*net.TCPAddr)
 
 	m := http.NewServeMux()
-	bundleFilePath, err := datafile.ResolveRunfile("metropolis/installer/test/testos/testos_bundle.zip")
+	bundleFilePath, err := runfiles.Rlocation("_main/metropolis/installer/test/testos/testos_bundle.zip")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -171,19 +172,19 @@
 		t.Fatalf("ftruncate failed: %v", err)
 	}
 
-	ovmfVarsPath, err := datafile.ResolveRunfile("external/edk2/OVMF_VARS.fd")
+	ovmfVarsPath, err := runfiles.Rlocation("edk2/OVMF_VARS.fd")
 	if err != nil {
 		t.Fatal(err)
 	}
-	ovmfCodePath, err := datafile.ResolveRunfile("external/edk2/OVMF_CODE.fd")
+	ovmfCodePath, err := runfiles.Rlocation("edk2/OVMF_CODE.fd")
 	if err != nil {
 		t.Fatal(err)
 	}
-	kernelPath, err := datafile.ResolveRunfile("third_party/linux/bzImage")
+	kernelPath, err := runfiles.Rlocation("_main/third_party/linux/bzImage")
 	if err != nil {
 		t.Fatal(err)
 	}
-	initramfsOrigPath, err := datafile.ResolveRunfile("cloud/agent/initramfs.cpio.zst")
+	initramfsOrigPath, err := runfiles.Rlocation("_main/cloud/agent/initramfs.cpio.zst")
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/cloud/lib/component/BUILD.bazel b/cloud/lib/component/BUILD.bazel
index dcbe0fe..71c1ab4 100644
--- a/cloud/lib/component/BUILD.bazel
+++ b/cloud/lib/component/BUILD.bazel
@@ -10,7 +10,6 @@
     importpath = "source.monogon.dev/cloud/lib/component",
     visibility = ["//visibility:public"],
     deps = [
-        "//metropolis/cli/pkg/datafile",
         "//metropolis/pkg/pki",
         "@com_github_adrg_xdg//:xdg",
         "@com_github_cockroachdb_cockroach_go_v2//testserver",
@@ -21,6 +20,7 @@
         "@com_github_prometheus_client_golang//prometheus",
         "@com_github_prometheus_client_golang//prometheus/collectors",
         "@com_github_prometheus_client_golang//prometheus/promhttp",
+        "@io_bazel_rules_go//go/runfiles:go_default_library",
         "@io_k8s_klog_v2//:klog",
         "@org_golang_google_grpc//:go_default_library",
         "@org_golang_google_grpc//credentials",
diff --git a/cloud/lib/component/crdb.go b/cloud/lib/component/crdb.go
index 7c9c1a8..aae1f77 100644
--- a/cloud/lib/component/crdb.go
+++ b/cloud/lib/component/crdb.go
@@ -9,14 +9,13 @@
 	"os"
 	"sync"
 
+	"github.com/bazelbuild/rules_go/go/runfiles"
 	"github.com/cockroachdb/cockroach-go/v2/testserver"
 	"github.com/golang-migrate/migrate/v4"
 	_ "github.com/golang-migrate/migrate/v4/database/cockroachdb"
 	"github.com/golang-migrate/migrate/v4/source"
 	_ "github.com/lib/pq"
 	"k8s.io/klog/v2"
-
-	"source.monogon.dev/metropolis/cli/pkg/datafile"
 )
 
 // CockroachConfig is the common configuration of a components' connection to
@@ -81,7 +80,7 @@
 		opts := []testserver.TestServerOpt{
 			testserver.SecureOpt(),
 		}
-		if path, err := datafile.ResolveRunfile("external/cockroach/cockroach"); err == nil {
+		if path, err := runfiles.Rlocation("cockroach/cockroach"); err == nil {
 			opts = append(opts, testserver.CockroachBinaryPathOpt(path))
 		} else {
 			if os.Getenv("TEST_TMPDIR") != "" {
diff --git a/cloud/takeover/e2e/BUILD.bazel b/cloud/takeover/e2e/BUILD.bazel
index 82ccd7d..b03e4be 100644
--- a/cloud/takeover/e2e/BUILD.bazel
+++ b/cloud/takeover/e2e/BUILD.bazel
@@ -10,10 +10,10 @@
     ],
     deps = [
         "//cloud/agent/api",
-        "//metropolis/cli/pkg/datafile",
         "//metropolis/pkg/fat32",
         "//metropolis/pkg/freeport",
         "@com_github_pkg_sftp//:sftp",
+        "@io_bazel_rules_go//go/runfiles:go_default_library",
         "@org_golang_google_protobuf//proto",
         "@org_golang_x_crypto//ssh",
     ],
diff --git a/cloud/takeover/e2e/main_test.go b/cloud/takeover/e2e/main_test.go
index 2b15174..02b982a 100644
--- a/cloud/takeover/e2e/main_test.go
+++ b/cloud/takeover/e2e/main_test.go
@@ -15,12 +15,13 @@
 	"testing"
 	"time"
 
+	"github.com/bazelbuild/rules_go/go/runfiles"
 	"github.com/pkg/sftp"
 	"golang.org/x/crypto/ssh"
 	"google.golang.org/protobuf/proto"
 
 	"source.monogon.dev/cloud/agent/api"
-	"source.monogon.dev/metropolis/cli/pkg/datafile"
+
 	"source.monogon.dev/metropolis/pkg/fat32"
 	"source.monogon.dev/metropolis/pkg/freeport"
 )
@@ -73,15 +74,15 @@
 	if err := fat32.WriteFS(cloudInitDataFile, rootInode, fat32.Options{Label: "cidata"}); err != nil {
 		t.Fatal(err)
 	}
-	cloudImagePath, err := datafile.ResolveRunfile("external/debian_11_cloudimage/file/downloaded")
+	cloudImagePath, err := runfiles.Rlocation("debian_11_cloudimage/file/downloaded")
 	if err != nil {
 		t.Fatal(err)
 	}
-	ovmfVarsPath, err := datafile.ResolveRunfile("external/edk2/OVMF_VARS.fd")
+	ovmfVarsPath, err := runfiles.Rlocation("edk2/OVMF_VARS.fd")
 	if err != nil {
 		t.Fatal(err)
 	}
-	ovmfCodePath, err := datafile.ResolveRunfile("external/edk2/OVMF_CODE.fd")
+	ovmfCodePath, err := runfiles.Rlocation("edk2/OVMF_CODE.fd")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -157,7 +158,7 @@
 	if err := takeoverFile.Chmod(0o755); err != nil {
 		t.Fatal(err)
 	}
-	takeoverPath, err := datafile.ResolveRunfile("cloud/takeover/takeover_/takeover")
+	takeoverPath, err := runfiles.Rlocation("_main/cloud/takeover/takeover_/takeover")
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/metropolis/cli/metroctl/BUILD.bazel b/metropolis/cli/metroctl/BUILD.bazel
index 9100031..af520e1 100644
--- a/metropolis/cli/metroctl/BUILD.bazel
+++ b/metropolis/cli/metroctl/BUILD.bazel
@@ -43,7 +43,6 @@
         "//go/clitable",
         "//metropolis/cli/metroctl/core",
         "//metropolis/cli/pkg/context",
-        "//metropolis/cli/pkg/datafile",
         "//metropolis/node/core/identity",
         "//metropolis/node/core/rpc",
         "//metropolis/node/core/rpc/resolver",
@@ -55,6 +54,7 @@
         "//version",
         "@com_github_adrg_xdg//:xdg",
         "@com_github_spf13_cobra//:cobra",
+        "@io_bazel_rules_go//go/runfiles:go_default_library",
         "@io_k8s_apimachinery//pkg/apis/meta/v1:meta",
         "@io_k8s_client_go//pkg/apis/clientauthentication/v1:clientauthentication",
         "@org_golang_google_grpc//:go_default_library",
diff --git a/metropolis/cli/metroctl/cmd_install.go b/metropolis/cli/metroctl/cmd_install.go
index 39790f1..64cdb26 100644
--- a/metropolis/cli/metroctl/cmd_install.go
+++ b/metropolis/cli/metroctl/cmd_install.go
@@ -10,15 +10,16 @@
 	"os"
 	"strings"
 
+	"github.com/bazelbuild/rules_go/go/runfiles"
 	"github.com/spf13/cobra"
 
+	"source.monogon.dev/metropolis/proto/api"
+	cpb "source.monogon.dev/metropolis/proto/common"
+
 	"source.monogon.dev/metropolis/cli/metroctl/core"
 	clicontext "source.monogon.dev/metropolis/cli/pkg/context"
-	"source.monogon.dev/metropolis/cli/pkg/datafile"
 	"source.monogon.dev/metropolis/pkg/blkio"
 	"source.monogon.dev/metropolis/pkg/fat32"
-	"source.monogon.dev/metropolis/proto/api"
-	cpb "source.monogon.dev/metropolis/proto/common"
 )
 
 var installCmd = &cobra.Command{
@@ -53,10 +54,14 @@
 
 func external(name, datafilePath string, flag *string) fat32.SizedReader {
 	if flag == nil || *flag == "" {
-		df, err := datafile.Get(datafilePath)
+		rPath, err := runfiles.Rlocation(datafilePath)
 		if err != nil {
 			log.Fatalf("No %s specified", name)
 		}
+		df, err := os.ReadFile(rPath)
+		if err != nil {
+			log.Fatalf("Cant read file: %v", err)
+		}
 		return bytes.NewReader(df)
 	}
 
diff --git a/metropolis/cli/metroctl/test/BUILD.bazel b/metropolis/cli/metroctl/test/BUILD.bazel
index 36f5a2d..dc3f456 100644
--- a/metropolis/cli/metroctl/test/BUILD.bazel
+++ b/metropolis/cli/metroctl/test/BUILD.bazel
@@ -13,13 +13,13 @@
     ],
     rundir = ".",
     deps = [
-        "//metropolis/cli/pkg/datafile",
         "//metropolis/node",
         "//metropolis/pkg/cmd",
         "//metropolis/test/launch/cluster",
         "//metropolis/test/util",
         "//metropolis/version",
         "//version",
+        "@io_bazel_rules_go//go/runfiles:go_default_library",
     ],
 )
 
@@ -29,11 +29,11 @@
     importpath = "source.monogon.dev/metropolis/cli/metroctl/test",
     visibility = ["//visibility:private"],
     deps = [
-        "//metropolis/cli/pkg/datafile",
         "//metropolis/pkg/cmd",
         "//metropolis/test/launch/cluster",
         "//metropolis/test/util",
         "//metropolis/version",
         "//version",
+        "@io_bazel_rules_go//go/runfiles:go_default_library",
     ],
 )
diff --git a/metropolis/cli/metroctl/test/test.go b/metropolis/cli/metroctl/test/test.go
index b031271..85bbaa2 100644
--- a/metropolis/cli/metroctl/test/test.go
+++ b/metropolis/cli/metroctl/test/test.go
@@ -11,18 +11,20 @@
 	"testing"
 	"time"
 
-	"source.monogon.dev/metropolis/cli/pkg/datafile"
+	"github.com/bazelbuild/rules_go/go/runfiles"
+
+	mversion "source.monogon.dev/metropolis/version"
+
 	"source.monogon.dev/metropolis/pkg/cmd"
 	"source.monogon.dev/metropolis/test/launch/cluster"
 	"source.monogon.dev/metropolis/test/util"
-	mversion "source.monogon.dev/metropolis/version"
 	"source.monogon.dev/version"
 )
 
 // resolveMetroctl resolves metroctl filesystem path. It will return a correct
 // path, or terminate test execution.
 func resolveMetroctl() string {
-	path, err := datafile.ResolveRunfile("metropolis/cli/metroctl/metroctl_/metroctl")
+	path, err := runfiles.Rlocation("_main/metropolis/cli/metroctl/metroctl_/metroctl")
 	if err != nil {
 		log.Fatalf("Couldn't resolve metroctl binary: %v", err)
 	}
diff --git a/metropolis/cli/pkg/datafile/BUILD.bazel b/metropolis/cli/pkg/datafile/BUILD.bazel
deleted file mode 100644
index 8c47aeb..0000000
--- a/metropolis/cli/pkg/datafile/BUILD.bazel
+++ /dev/null
@@ -1,9 +0,0 @@
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
-
-go_library(
-    name = "datafile",
-    srcs = ["datafile.go"],
-    importpath = "source.monogon.dev/metropolis/cli/pkg/datafile",
-    visibility = ["//visibility:public"],
-    deps = ["@io_bazel_rules_go//go/tools/bazel:go_default_library"],
-)
diff --git a/metropolis/cli/pkg/datafile/datafile.go b/metropolis/cli/pkg/datafile/datafile.go
deleted file mode 100644
index a78416e..0000000
--- a/metropolis/cli/pkg/datafile/datafile.go
+++ /dev/null
@@ -1,99 +0,0 @@
-// datafile provides an abstraction for accessing files passed through the data
-// attribute in a Bazel build rule.
-//
-// It thinly wraps around the Bazel/Go runfile library (to allow running from
-// outside `bazel run`).
-package datafile
-
-import (
-	"bufio"
-	"fmt"
-	"log"
-	"os"
-	"path/filepath"
-	"strings"
-
-	"github.com/bazelbuild/rules_go/go/tools/bazel"
-)
-
-// parseManifest takes a bazel runfile MANIFEST and parses it into a map from
-// workspace-relative path to absolute path, flattening all workspaces into a
-// single tree.
-func parseManifest(path string) (map[string]string, error) {
-	f, err := os.Open(path)
-	if err != nil {
-		return nil, fmt.Errorf("could not open MANIFEST: %v", err)
-	}
-	defer f.Close()
-
-	manifest := make(map[string]string)
-	scanner := bufio.NewScanner(f)
-	for scanner.Scan() {
-		parts := strings.Split(scanner.Text(), " ")
-		if len(parts) != 2 {
-			continue
-		}
-		fpathParts := strings.Split(parts[0], string(os.PathSeparator))
-		fpath := strings.Join(fpathParts[1:], string(os.PathSeparator))
-		manifest[fpath] = parts[1]
-	}
-	return manifest, nil
-}
-
-// ResolveRunfile tries to resolve a workspace-relative file path into an
-// absolute path with the use of bazel runfiles, through either the original
-// Bazel/Go runfile integration or a wrapper that also supports running from
-// outside `bazel run`.
-func ResolveRunfile(path string) (string, error) {
-	var errEx error
-	ep, err := os.Executable()
-	if err == nil {
-		rfdir := ep + ".runfiles"
-		mfpath := filepath.Join(rfdir, "MANIFEST")
-		if stat, err := os.Stat(rfdir); err == nil && stat.IsDir() {
-			// We have a runfiles directory, parse MANIFEST and resolve files this way.
-			manifest, err := parseManifest(mfpath)
-			if err == nil {
-				tpath := manifest[path]
-				if tpath == "" {
-					errEx = fmt.Errorf("not in MANIFEST")
-				} else {
-					return tpath, err
-				}
-			} else {
-				errEx = err
-			}
-		} else {
-			errEx = err
-		}
-	}
-
-	// Try runfiles just in case.
-	rf, errRF := bazel.Runfile(path)
-	if errRF == nil {
-		return rf, nil
-	}
-	return "", fmt.Errorf("could not resolve via executable location (%v) and runfile resolution failed: %v", errEx, errRF)
-}
-
-// Get tries to read a workspace-relative file path through the use of Bazel
-// runfiles, including for cases when executables are running outside `bazel
-// run`.
-func Get(path string) ([]byte, error) {
-	rfpath, err := ResolveRunfile(path)
-	if err != nil {
-		return nil, err
-	}
-	return os.ReadFile(rfpath)
-}
-
-// MustGet either successfully resolves a file through Get() or logs an error
-// (through the stdlib log library) and stops execution. This should thus only
-// be used in binaries which use the log library.
-func MustGet(path string) []byte {
-	res, err := Get(path)
-	if err != nil {
-		log.Fatalf("Could not get datafile %s: %v", path, err)
-	}
-	return res
-}
diff --git a/metropolis/installer/test/BUILD.bazel b/metropolis/installer/test/BUILD.bazel
index ba16f77..0f3583a 100644
--- a/metropolis/installer/test/BUILD.bazel
+++ b/metropolis/installer/test/BUILD.bazel
@@ -21,13 +21,13 @@
     visibility = ["//visibility:private"],
     deps = [
         "//metropolis/cli/metroctl/core",
-        "//metropolis/cli/pkg/datafile",
         "//metropolis/node/build/mkimage/osimage",
         "//metropolis/pkg/cmd",
         "//metropolis/proto/api",
         "@com_github_diskfs_go_diskfs//:go-diskfs",
         "@com_github_diskfs_go_diskfs//disk",
         "@com_github_diskfs_go_diskfs//partition/gpt",
+        "@io_bazel_rules_go//go/runfiles:go_default_library",
     ],
 )
 
diff --git a/metropolis/installer/test/main.go b/metropolis/installer/test/main.go
index ec4f736..82efb44 100644
--- a/metropolis/installer/test/main.go
+++ b/metropolis/installer/test/main.go
@@ -30,15 +30,16 @@
 	"testing"
 	"time"
 
-	diskfs "github.com/diskfs/go-diskfs"
+	"github.com/bazelbuild/rules_go/go/runfiles"
+	"github.com/diskfs/go-diskfs"
 	"github.com/diskfs/go-diskfs/disk"
 	"github.com/diskfs/go-diskfs/partition/gpt"
 
+	"source.monogon.dev/metropolis/proto/api"
+
 	mctl "source.monogon.dev/metropolis/cli/metroctl/core"
-	"source.monogon.dev/metropolis/cli/pkg/datafile"
 	"source.monogon.dev/metropolis/node/build/mkimage/osimage"
 	"source.monogon.dev/metropolis/pkg/cmd"
-	"source.monogon.dev/metropolis/proto/api"
 )
 
 // Each variable in this block points to either a test dependency or a side
@@ -123,8 +124,24 @@
 func TestMain(m *testing.M) {
 	installerImage = filepath.Join(os.Getenv("TEST_TMPDIR"), "installer.img")
 
-	installer := datafile.MustGet("metropolis/installer/test/kernel.efi")
-	bundle := datafile.MustGet("metropolis/installer/test/testos/testos_bundle.zip")
+	installerPath, err := runfiles.Rlocation("_main/metropolis/installer/test/kernel.efi")
+	if err != nil {
+		log.Fatal(err)
+	}
+	installer, err := os.ReadFile(installerPath)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	bundlePath, err := runfiles.Rlocation("_main/metropolis/installer/test/testos/testos_bundle.zip")
+	if err != nil {
+		log.Fatal(err)
+	}
+	bundle, err := os.ReadFile(bundlePath)
+	if err != nil {
+		log.Fatal(err)
+	}
+
 	iargs := mctl.MakeInstallerImageArgs{
 		Installer:  bytes.NewReader(installer),
 		TargetPath: installerImage,
diff --git a/metropolis/node/core/metrics/BUILD.bazel b/metropolis/node/core/metrics/BUILD.bazel
index 6483377..9169ae6 100644
--- a/metropolis/node/core/metrics/BUILD.bazel
+++ b/metropolis/node/core/metrics/BUILD.bazel
@@ -28,12 +28,12 @@
     ],
     embed = [":metrics"],
     deps = [
-        "//metropolis/cli/pkg/datafile",
         "//metropolis/node",
         "//metropolis/node/core/curator/proto/api",
         "//metropolis/pkg/freeport",
         "//metropolis/pkg/supervisor",
         "//metropolis/test/util",
         "@com_zx2c4_golang_wireguard_wgctrl//wgtypes",
+        "@io_bazel_rules_go//go/runfiles:go_default_library",
     ],
 )
diff --git a/metropolis/node/core/metrics/metrics_test.go b/metropolis/node/core/metrics/metrics_test.go
index c946250..e458f71 100644
--- a/metropolis/node/core/metrics/metrics_test.go
+++ b/metropolis/node/core/metrics/metrics_test.go
@@ -12,11 +12,11 @@
 	"testing"
 	"time"
 
+	"github.com/bazelbuild/rules_go/go/runfiles"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 
 	apb "source.monogon.dev/metropolis/node/core/curator/proto/api"
 
-	"source.monogon.dev/metropolis/cli/pkg/datafile"
 	"source.monogon.dev/metropolis/node"
 	"source.monogon.dev/metropolis/pkg/freeport"
 	"source.monogon.dev/metropolis/pkg/supervisor"
@@ -24,7 +24,7 @@
 )
 
 func fakeExporter(name, value string) *Exporter {
-	path, _ := datafile.ResolveRunfile("metropolis/node/core/metrics/fake_exporter/fake_exporter_/fake_exporter")
+	path, _ := runfiles.Rlocation("_main/metropolis/node/core/metrics/fake_exporter/fake_exporter_/fake_exporter")
 
 	p, closer, err := freeport.AllocateTCPPort()
 	if err != nil {
diff --git a/metropolis/node/core/update/e2e/BUILD.bazel b/metropolis/node/core/update/e2e/BUILD.bazel
index 5f2b15f..0b3fbce 100644
--- a/metropolis/node/core/update/e2e/BUILD.bazel
+++ b/metropolis/node/core/update/e2e/BUILD.bazel
@@ -15,9 +15,9 @@
         "//metropolis/node/core/update/e2e/testos:testos_bundle_z",
     ],
     deps = [
-        "//metropolis/cli/pkg/datafile",
         "//metropolis/node/build/mkimage/osimage",
         "//metropolis/pkg/blkio",
         "//metropolis/pkg/blockdev",
+        "@io_bazel_rules_go//go/runfiles:go_default_library",
     ],
 )
diff --git a/metropolis/node/core/update/e2e/e2e_test.go b/metropolis/node/core/update/e2e/e2e_test.go
index b5de3da..4740419 100644
--- a/metropolis/node/core/update/e2e/e2e_test.go
+++ b/metropolis/node/core/update/e2e/e2e_test.go
@@ -16,7 +16,8 @@
 	"testing"
 	"time"
 
-	"source.monogon.dev/metropolis/cli/pkg/datafile"
+	"github.com/bazelbuild/rules_go/go/runfiles"
+
 	"source.monogon.dev/metropolis/node/build/mkimage/osimage"
 	"source.monogon.dev/metropolis/pkg/blkio"
 	"source.monogon.dev/metropolis/pkg/blockdev"
@@ -142,12 +143,12 @@
 	}
 
 	m := http.NewServeMux()
-	bundleYPath, err := datafile.ResolveRunfile("metropolis/node/core/update/e2e/testos/testos_bundle_y.zip")
+	bundleYPath, err := runfiles.Rlocation("_main/metropolis/node/core/update/e2e/testos/testos_bundle_y.zip")
 	if err != nil {
 		t.Fatal(err)
 	}
 	b.bundlePaths["Y"] = bundleYPath
-	bundleZPath, err := datafile.ResolveRunfile("metropolis/node/core/update/e2e/testos/testos_bundle_z.zip")
+	bundleZPath, err := runfiles.Rlocation("_main/metropolis/node/core/update/e2e/testos/testos_bundle_z.zip")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -180,15 +181,15 @@
 	t.Cleanup(func() { os.Remove(rootDevPath) })
 	defer rootDisk.Close()
 
-	ovmfVarsPath, err := datafile.ResolveRunfile("external/edk2/OVMF_VARS.fd")
+	ovmfVarsPath, err := runfiles.Rlocation("edk2/OVMF_VARS.fd")
 	if err != nil {
 		t.Fatal(err)
 	}
-	ovmfCodePath, err := datafile.ResolveRunfile("external/edk2/OVMF_CODE.fd")
+	ovmfCodePath, err := runfiles.Rlocation("edk2/OVMF_CODE.fd")
 	if err != nil {
 		t.Fatal(err)
 	}
-	bootPath, err := datafile.ResolveRunfile("metropolis/node/core/update/e2e/testos/kernel_efi_x.efi")
+	bootPath, err := runfiles.Rlocation("_main/metropolis/node/core/update/e2e/testos/kernel_efi_x.efi")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -197,7 +198,7 @@
 		t.Fatal(err)
 	}
 	defer boot.Close()
-	systemXPath, err := datafile.ResolveRunfile("metropolis/node/core/update/e2e/testos/verity_rootfs_x.img")
+	systemXPath, err := runfiles.Rlocation("_main/metropolis/node/core/update/e2e/testos/verity_rootfs_x.img")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -207,7 +208,7 @@
 	}
 	defer system.Close()
 
-	abloaderPath, err := datafile.ResolveRunfile("metropolis/node/core/abloader/abloader_bin.efi")
+	abloaderPath, err := runfiles.Rlocation("_main/metropolis/node/core/abloader/abloader_bin.efi")
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/metropolis/pkg/fat32/BUILD.bazel b/metropolis/pkg/fat32/BUILD.bazel
index d62196a..b39b40b 100644
--- a/metropolis/pkg/fat32/BUILD.bazel
+++ b/metropolis/pkg/fat32/BUILD.bazel
@@ -23,9 +23,9 @@
     data = ["@com_github_dosfstools_dosfstools//:fsck"],
     embed = [":fat32"],
     deps = [
-        "//metropolis/cli/pkg/datafile",
         "@com_github_stretchr_testify//assert",
         "@com_github_stretchr_testify//require",
+        "@io_bazel_rules_go//go/runfiles:go_default_library",
         "@org_golang_x_mod//semver",
         "@org_golang_x_sys//unix",
     ],
diff --git a/metropolis/pkg/fat32/fsck_test.go b/metropolis/pkg/fat32/fsck_test.go
index 687504a..27de542 100644
--- a/metropolis/pkg/fat32/fsck_test.go
+++ b/metropolis/pkg/fat32/fsck_test.go
@@ -8,12 +8,12 @@
 	"testing"
 	"time"
 
-	"source.monogon.dev/metropolis/cli/pkg/datafile"
+	"github.com/bazelbuild/rules_go/go/runfiles"
 )
 
 func testWithFsck(t *testing.T, rootInode Inode, opts Options) {
 	t.Helper()
-	fsckPath, err := datafile.ResolveRunfile("external/com_github_dosfstools_dosfstools/fsck")
+	fsckPath, err := runfiles.Rlocation("com_github_dosfstools_dosfstools/fsck")
 	if err != nil {
 		t.Fatalf("unable to get path to fsck: %v", err)
 	}
diff --git a/metropolis/test/e2e/BUILD.bazel b/metropolis/test/e2e/BUILD.bazel
index 1e21035..c77e334 100644
--- a/metropolis/test/e2e/BUILD.bazel
+++ b/metropolis/test/e2e/BUILD.bazel
@@ -38,7 +38,6 @@
     embed = [":e2e"],
     rundir = ".",
     deps = [
-        "//metropolis/cli/pkg/datafile",
         "//metropolis/node",
         "//metropolis/node/core/identity",
         "//metropolis/node/core/rpc",
@@ -47,6 +46,7 @@
         "//metropolis/test/launch",
         "//metropolis/test/launch/cluster",
         "//metropolis/test/util",
+        "@io_bazel_rules_go//go/runfiles:go_default_library",
         "@io_k8s_api//core/v1:core",
         "@io_k8s_apimachinery//pkg/api/resource",
         "@io_k8s_apimachinery//pkg/apis/meta/v1:meta",
diff --git a/metropolis/test/e2e/main_test.go b/metropolis/test/e2e/main_test.go
index 812ae9d..2409aed 100644
--- a/metropolis/test/e2e/main_test.go
+++ b/metropolis/test/e2e/main_test.go
@@ -33,18 +33,19 @@
 	"testing"
 	"time"
 
+	"github.com/bazelbuild/rules_go/go/runfiles"
 	"google.golang.org/grpc"
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/resource"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	podv1 "k8s.io/kubernetes/pkg/api/v1/pod"
 
-	"source.monogon.dev/metropolis/cli/pkg/datafile"
+	apb "source.monogon.dev/metropolis/proto/api"
+
 	common "source.monogon.dev/metropolis/node"
 	"source.monogon.dev/metropolis/node/core/identity"
 	"source.monogon.dev/metropolis/node/core/rpc"
 	"source.monogon.dev/metropolis/pkg/localregistry"
-	apb "source.monogon.dev/metropolis/proto/api"
 	"source.monogon.dev/metropolis/test/launch"
 	"source.monogon.dev/metropolis/test/launch/cluster"
 	"source.monogon.dev/metropolis/test/util"
@@ -71,11 +72,18 @@
 	ctx, cancel := context.WithTimeout(context.Background(), globalTestTimeout)
 	defer cancel()
 
-	lr, err := localregistry.FromBazelManifest(datafile.MustGet("metropolis/test/e2e/testimages_manifest.prototxt"))
+	rPath, err := runfiles.Rlocation("_main/metropolis/test/e2e/testimages_manifest.prototxt")
+	if err != nil {
+		t.Fatalf("Resolving registry manifest failed: %v", err)
+	}
+	df, err := os.ReadFile(rPath)
+	if err != nil {
+		t.Fatalf("Reading registry manifest failed: %v", err)
+	}
+	lr, err := localregistry.FromBazelManifest(df)
 	if err != nil {
 		t.Fatalf("Creating test image registry failed: %v", err)
 	}
-
 	// Launch cluster.
 	clusterOptions := cluster.ClusterOptions{
 		NumNodes:      2,
@@ -190,7 +198,15 @@
 	ctx, cancel := context.WithTimeout(context.Background(), globalTestTimeout)
 	defer cancel()
 
-	lr, err := localregistry.FromBazelManifest(datafile.MustGet("metropolis/test/e2e/testimages_manifest.prototxt"))
+	rPath, err := runfiles.Rlocation("_main/metropolis/test/e2e/testimages_manifest.prototxt")
+	if err != nil {
+		t.Fatalf("Resolving registry manifest failed: %v", err)
+	}
+	df, err := os.ReadFile(rPath)
+	if err != nil {
+		t.Fatalf("Reading registry manifest failed: %v", err)
+	}
+	lr, err := localregistry.FromBazelManifest(df)
 	if err != nil {
 		t.Fatalf("Creating test image registry failed: %v", err)
 	}
diff --git a/metropolis/test/launch/cluster/BUILD.bazel b/metropolis/test/launch/cluster/BUILD.bazel
index 08d4cfe..6c9b10a 100644
--- a/metropolis/test/launch/cluster/BUILD.bazel
+++ b/metropolis/test/launch/cluster/BUILD.bazel
@@ -20,7 +20,6 @@
     visibility = ["//visibility:public"],
     deps = [
         "//metropolis/cli/metroctl/core",
-        "//metropolis/cli/pkg/datafile",
         "//metropolis/node",
         "//metropolis/node/core/identity",
         "//metropolis/node/core/rpc",
@@ -32,6 +31,7 @@
         "//metropolis/test/launch",
         "@com_github_cenkalti_backoff_v4//:backoff",
         "@com_github_kballard_go_shellquote//:go-shellquote",
+        "@io_bazel_rules_go//go/runfiles:go_default_library",
         "@io_k8s_client_go//kubernetes",
         "@io_k8s_client_go//rest",
         "@org_golang_google_grpc//:go_default_library",
diff --git a/metropolis/test/launch/cluster/cluster.go b/metropolis/test/launch/cluster/cluster.go
index 06b928b..fd69b77 100644
--- a/metropolis/test/launch/cluster/cluster.go
+++ b/metropolis/test/launch/cluster/cluster.go
@@ -25,6 +25,7 @@
 	"syscall"
 	"time"
 
+	"github.com/bazelbuild/rules_go/go/runfiles"
 	"github.com/cenkalti/backoff/v4"
 	"go.uber.org/multierr"
 	"golang.org/x/net/proxy"
@@ -39,7 +40,6 @@
 	cpb "source.monogon.dev/metropolis/proto/common"
 
 	metroctl "source.monogon.dev/metropolis/cli/metroctl/core"
-	"source.monogon.dev/metropolis/cli/pkg/datafile"
 	"source.monogon.dev/metropolis/node"
 	"source.monogon.dev/metropolis/node/core/identity"
 	"source.monogon.dev/metropolis/node/core/rpc"
@@ -130,7 +130,7 @@
 	}
 
 	// Initialize the node's storage with a prebuilt image.
-	si, err := datafile.ResolveRunfile("metropolis/node/image.img")
+	si, err := runfiles.Rlocation("_main/metropolis/node/image.img")
 	if err != nil {
 		return nil, fmt.Errorf("while resolving a path: %w", err)
 	}
@@ -141,7 +141,7 @@
 	}
 
 	// Initialize the OVMF firmware variables file.
-	sv, err := datafile.ResolveRunfile("external/edk2/OVMF_VARS.fd")
+	sv, err := runfiles.Rlocation("edk2/OVMF_VARS.fd")
 	if err != nil {
 		return nil, fmt.Errorf("while resolving a path: %w", err)
 	}
@@ -155,7 +155,7 @@
 	if err := os.Mkdir(tpmt, 0o755); err != nil {
 		return nil, fmt.Errorf("while creating the TPM directory: %w", err)
 	}
-	tpms, err := datafile.ResolveRunfile("metropolis/node/tpm")
+	tpms, err := runfiles.Rlocation("_main/metropolis/node/tpm")
 	if err != nil {
 		return nil, fmt.Errorf("while resolving a path: %w", err)
 	}
@@ -165,7 +165,7 @@
 	}
 	for _, file := range tpmf {
 		name := file.Name()
-		src, err := datafile.ResolveRunfile(filepath.Join(tpms, name))
+		src, err := runfiles.Rlocation(filepath.Join(tpms, name))
 		if err != nil {
 			return nil, fmt.Errorf("while resolving a path: %w", err)
 		}
diff --git a/metropolis/test/launch/cluster/metroctl.go b/metropolis/test/launch/cluster/metroctl.go
index 54a62fc..fbf968a 100644
--- a/metropolis/test/launch/cluster/metroctl.go
+++ b/metropolis/test/launch/cluster/metroctl.go
@@ -9,10 +9,10 @@
 	"path"
 	"sort"
 
+	"github.com/bazelbuild/rules_go/go/runfiles"
 	"github.com/kballard/go-shellquote"
 
 	metroctl "source.monogon.dev/metropolis/cli/metroctl/core"
-	"source.monogon.dev/metropolis/cli/pkg/datafile"
 )
 
 const metroctlRunfile = "metropolis/cli/metroctl/metroctl_/metroctl"
@@ -21,7 +21,7 @@
 // if the built target depends on //metropolis/cli/metroctl. Otherwise, an error
 // is returned.
 func MetroctlRunfilePath() (string, error) {
-	path, err := datafile.ResolveRunfile(metroctlRunfile)
+	path, err := runfiles.Rlocation(metroctlRunfile)
 	if err != nil {
 		return "", fmt.Errorf("//metropolis/cli/metroctl not found in runfiles, did you include it as a data dependency? error: %w", err)
 	}