diff --git a/build/fietsje/main.go b/build/fietsje/main.go
index b511873..6fb66e1 100644
--- a/build/fietsje/main.go
+++ b/build/fietsje/main.go
@@ -69,6 +69,11 @@
 	// our own deps, common
 	p.collectOverride("go.uber.org/zap", "v1.15.0")
 	p.collectOverride("golang.org/x/mod", "v0.3.0")
+	p.collectOverride("github.com/spf13/viper", "v1.9.0").use(
+		"gopkg.in/ini.v1",
+		"github.com/subosito/gotenv",
+	)
+	p.collectOverride("github.com/spf13/cobra", "v1.2.1")
 	p.collect("github.com/cenkalti/backoff/v4", "v4.0.2")
 
 	p.collect("github.com/google/go-tpm", "ae6dd98980d4")
diff --git a/metropolis/cli/metroctl/BUILD.bazel b/metropolis/cli/metroctl/BUILD.bazel
new file mode 100644
index 0000000..154fba1
--- /dev/null
+++ b/metropolis/cli/metroctl/BUILD.bazel
@@ -0,0 +1,15 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
+
+go_library(
+    name = "go_default_library",
+    srcs = ["main.go"],
+    importpath = "source.monogon.dev/metropolis/cli/metroctl",
+    visibility = ["//visibility:private"],
+    deps = ["@com_github_spf13_cobra//:go_default_library"],
+)
+
+go_binary(
+    name = "metroctl",
+    embed = [":go_default_library"],
+    visibility = ["//visibility:public"],
+)
diff --git a/metropolis/cli/metroctl/main.go b/metropolis/cli/metroctl/main.go
new file mode 100644
index 0000000..29d44e8
--- /dev/null
+++ b/metropolis/cli/metroctl/main.go
@@ -0,0 +1,15 @@
+package main
+
+import (
+	"github.com/spf13/cobra"
+)
+
+// rootCmd represents the base command when called without any subcommands
+var rootCmd = &cobra.Command{
+	Use:   "metroctl",
+	Short: "metroctl controls Metropolis nodes and clusters.",
+}
+
+func main() {
+	cobra.CheckErr(rootCmd.Execute())
+}
diff --git a/third_party/go/repositories.bzl b/third_party/go/repositories.bzl
index 5778b9c..c134586 100644
--- a/third_party/go/repositories.bzl
+++ b/third_party/go/repositories.bzl
@@ -1928,8 +1928,8 @@
     go_repository(
         name = "com_github_spf13_cobra",
         importpath = "github.com/spf13/cobra",
-        version = "v1.0.0",
-        sum = "h1:6m/oheQuQ13N9ks4hubMG6BnvwOeaJrqSPLahSnczz8=",
+        version = "v1.2.1",
+        sum = "h1:+KmjbUw1hriSNMF55oPrkZcb27aECyrj8V2ytv7kWDw=",
         build_extra_args = [
             "-go_naming_convention=go_default_library",
             "-go_naming_convention_external=go_default_library",
@@ -1958,8 +1958,8 @@
     go_repository(
         name = "com_github_spf13_viper",
         importpath = "github.com/spf13/viper",
-        version = "v1.4.0",
-        sum = "h1:yXHLWeravcrgGyFSyCgdYpXQ9dR9c/WED3pg1RhxqEU=",
+        version = "v1.9.0",
+        sum = "h1:yR6EXjTp0y0cLN8OZg1CRZmOBdI88UcGkhgyJhu6nZk=",
         build_extra_args = [
             "-go_naming_convention=go_default_library",
             "-go_naming_convention_external=go_default_library",
@@ -1976,6 +1976,16 @@
         ],
     )
     go_repository(
+        name = "com_github_subosito_gotenv",
+        importpath = "github.com/subosito/gotenv",
+        version = "v1.2.0",
+        sum = "h1:Slr1R9HxAlEKefgq5jn9U+DnETlIUa6HfgEzj0g5d7s=",
+        build_extra_args = [
+            "-go_naming_convention=go_default_library",
+            "-go_naming_convention_external=go_default_library",
+        ],
+    )
+    go_repository(
         name = "com_github_syndtr_gocapability",
         importpath = "github.com/syndtr/gocapability",
         version = "v0.0.0-20180916011248-d98352740cb2",
@@ -2330,6 +2340,16 @@
         ],
     )
     go_repository(
+        name = "in_gopkg_ini_v1",
+        importpath = "gopkg.in/ini.v1",
+        version = "v1.63.2",
+        sum = "h1:tGK/CyBg7SMzb60vP1M03vNZ3VDu3wGQJwn7Sxi9r3c=",
+        build_extra_args = [
+            "-go_naming_convention=go_default_library",
+            "-go_naming_convention_external=go_default_library",
+        ],
+    )
+    go_repository(
         name = "in_gopkg_natefinch_lumberjack_v2",
         importpath = "gopkg.in/natefinch/lumberjack.v2",
         version = "v2.0.0",
diff --git a/third_party/go/shelf.pb.text b/third_party/go/shelf.pb.text
index e9bfcef..b3f3007 100644
--- a/third_party/go/shelf.pb.text
+++ b/third_party/go/shelf.pb.text
@@ -2295,6 +2295,13 @@
   semver: "v1.0.0"
 >
 entry: <
+  import_path: "github.com/spf13/cobra"
+  version: "v1.2.1"
+  bazel_name: "com_github_spf13_cobra"
+  sum: "h1:+KmjbUw1hriSNMF55oPrkZcb27aECyrj8V2ytv7kWDw="
+  semver: "v1.2.1"
+>
+entry: <
   import_path: "github.com/spf13/jwalterweatherman"
   version: "v1.1.0"
   bazel_name: "com_github_spf13_jwalterweatherman"
@@ -2316,6 +2323,13 @@
   semver: "v1.4.0"
 >
 entry: <
+  import_path: "github.com/spf13/viper"
+  version: "v1.9.0"
+  bazel_name: "com_github_spf13_viper"
+  sum: "h1:yR6EXjTp0y0cLN8OZg1CRZmOBdI88UcGkhgyJhu6nZk="
+  semver: "v1.9.0"
+>
+entry: <
   import_path: "github.com/stretchr/testify"
   version: "221dbe5ed46703ee255b1da0dec05086f5035f62"
   bazel_name: "com_github_stretchr_testify"
@@ -2330,6 +2344,13 @@
   semver: "v1.4.0"
 >
 entry: <
+  import_path: "github.com/subosito/gotenv"
+  version: "v1.2.0"
+  bazel_name: "com_github_subosito_gotenv"
+  sum: "h1:Slr1R9HxAlEKefgq5jn9U+DnETlIUa6HfgEzj0g5d7s="
+  semver: "v1.2.0"
+>
+entry: <
   import_path: "github.com/syndtr/gocapability"
   version: "d98352740cb2c55f81556b63d4a1ec64c5a319c2"
   bazel_name: "com_github_syndtr_gocapability"
@@ -2750,6 +2771,13 @@
   semver: "v0.9.1"
 >
 entry: <
+  import_path: "gopkg.in/ini.v1"
+  version: "v1.63.2"
+  bazel_name: "in_gopkg_ini_v1"
+  sum: "h1:tGK/CyBg7SMzb60vP1M03vNZ3VDu3wGQJwn7Sxi9r3c="
+  semver: "v1.63.2"
+>
+entry: <
   import_path: "gopkg.in/natefinch/lumberjack.v2"
   version: "v2.0.0"
   bazel_name: "in_gopkg_natefinch_lumberjack_v2"