diff --git a/metropolis/node/core/rpc/BUILD.bazel b/metropolis/node/core/rpc/BUILD.bazel
index e1017d7..bdddb1e 100644
--- a/metropolis/node/core/rpc/BUILD.bazel
+++ b/metropolis/node/core/rpc/BUILD.bazel
@@ -15,7 +15,6 @@
     deps = [
         "//metropolis/node/core/identity",
         "//metropolis/pkg/logtree",
-        "//metropolis/pkg/pki",
         "//metropolis/proto/api",
         "//metropolis/proto/ext",
         "@org_golang_google_grpc//:go_default_library",
diff --git a/metropolis/node/core/rpc/client.go b/metropolis/node/core/rpc/client.go
index 656fee5..aeaed7e 100644
--- a/metropolis/node/core/rpc/client.go
+++ b/metropolis/node/core/rpc/client.go
@@ -14,10 +14,20 @@
 	"google.golang.org/grpc/status"
 
 	"source.monogon.dev/metropolis/node/core/identity"
-	"source.monogon.dev/metropolis/pkg/pki"
 	apb "source.monogon.dev/metropolis/proto/api"
 )
 
+// UnknownNotAfter is a copy of //metroplis/pkg/pki.UnknownNotAfter.
+//
+// We copy it so that we can decouple the rpc package from the pki package, the
+// former being used by metroctl (and thus needing to be portable), the latter
+// having a dependency on fileargs (which isn't portable). The correct solution
+// here is to clarify portability policy of each workspace path, and apply it.
+// But this will do for now.
+//
+// TODO(issues/252): clean up and merge this back.
+var UnknownNotAfter = time.Unix(253402300799, 0)
+
 type verifyPeerCertificate func(rawCerts [][]byte, verifiedChains [][]*x509.Certificate) error
 
 func verifyClusterCertificateAndNodeID(ca *x509.Certificate, nodeID string) verifyPeerCertificate {
@@ -70,7 +80,7 @@
 	template := x509.Certificate{
 		SerialNumber: big.NewInt(1),
 		NotBefore:    time.Now(),
-		NotAfter:     pki.UnknownNotAfter,
+		NotAfter:     UnknownNotAfter,
 
 		KeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
 		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},