diff --git a/metropolis/cli/metroctl/cmd_cluster_configure.go b/metropolis/cli/metroctl/cmd_cluster_configure.go
index 73483c1..2439c95 100644
--- a/metropolis/cli/metroctl/cmd_cluster_configure.go
+++ b/metropolis/cli/metroctl/cmd_cluster_configure.go
@@ -103,9 +103,9 @@
 		}
 
 		ctx, _ := signal.NotifyContext(context.Background(), os.Interrupt)
-		cc, err := dialAuthenticated(ctx)
+		cc, err := newAuthenticatedClient(ctx)
 		if err != nil {
-			return fmt.Errorf("while dialing node: %w", err)
+			return fmt.Errorf("while creating client: %w", err)
 		}
 		mgmt := apb.NewManagementClient(cc)
 
diff --git a/metropolis/cli/metroctl/cmd_cluster_takeownership.go b/metropolis/cli/metroctl/cmd_cluster_takeownership.go
index 3566ea0..d917bc3 100644
--- a/metropolis/cli/metroctl/cmd_cluster_takeownership.go
+++ b/metropolis/cli/metroctl/cmd_cluster_takeownership.go
@@ -64,9 +64,9 @@
 		}
 		opts = append(opts, grpc.WithTransportCredentials(creds))
 
-		cc, err := grpc.Dial(resolver.MetropolisControlAddress, opts...)
+		cc, err := grpc.NewClient(resolver.MetropolisControlAddress, opts...)
 		if err != nil {
-			return fmt.Errorf("while dialing the cluster: %w", err)
+			return fmt.Errorf("while creating client: %w", err)
 		}
 		aaa := apb.NewAAAClient(cc)
 
diff --git a/metropolis/cli/metroctl/cmd_install.go b/metropolis/cli/metroctl/cmd_install.go
index 1f73d76..a34e470 100644
--- a/metropolis/cli/metroctl/cmd_install.go
+++ b/metropolis/cli/metroctl/cmd_install.go
@@ -86,9 +86,9 @@
 			},
 		}
 	} else {
-		cc, err := dialAuthenticated(ctx)
+		cc, err := newAuthenticatedClient(ctx)
 		if err != nil {
-			return nil, fmt.Errorf("while dialing node: %w", err)
+			return nil, fmt.Errorf("while creating client: %w", err)
 		}
 		mgmt := api.NewManagementClient(cc)
 		resT, err := mgmt.GetRegisterTicket(ctx, &api.GetRegisterTicketRequest{})
diff --git a/metropolis/cli/metroctl/cmd_node.go b/metropolis/cli/metroctl/cmd_node.go
index 2e0b537..620a7f5 100644
--- a/metropolis/cli/metroctl/cmd_node.go
+++ b/metropolis/cli/metroctl/cmd_node.go
@@ -35,9 +35,9 @@
 	Example: "metroctl node describe metropolis-c556e31c3fa2bf0a36e9ccb9fd5d6056",
 	RunE: func(cmd *cobra.Command, args []string) error {
 		ctx, _ := signal.NotifyContext(context.Background(), os.Interrupt)
-		cc, err := dialAuthenticated(ctx)
+		cc, err := newAuthenticatedClient(ctx)
 		if err != nil {
-			return fmt.Errorf("while dialing node: %w", err)
+			return fmt.Errorf("while creating client: %w", err)
 		}
 		mgmt := apb.NewManagementClient(cc)
 
@@ -67,9 +67,9 @@
 	Example: "metroctl node list --filter node.status.external_address==\"10.8.0.2\"",
 	RunE: func(cmd *cobra.Command, args []string) error {
 		ctx, _ := signal.NotifyContext(context.Background(), os.Interrupt)
-		cc, err := dialAuthenticated(ctx)
+		cc, err := newAuthenticatedClient(ctx)
 		if err != nil {
-			return fmt.Errorf("while dialing node: %w", err)
+			return fmt.Errorf("while creating client: %w", err)
 		}
 		mgmt := apb.NewManagementClient(cc)
 
@@ -130,7 +130,7 @@
 			return fmt.Errorf("could not get CA certificate: %w", err)
 		}
 
-		conn, err := dialAuthenticated(ctx)
+		conn, err := newAuthenticatedClient(ctx)
 		if err != nil {
 			return err
 		}
@@ -182,9 +182,9 @@
 
 			go func(n *apb.Node) {
 				defer wg.Done()
-				cc, err := dialAuthenticatedNode(ctx, n.Id, n.Status.ExternalAddress, cacert)
+				cc, err := newAuthenticatedNodeClient(ctx, n.Id, n.Status.ExternalAddress, cacert)
 				if err != nil {
-					log.Fatalf("failed to dial node: %v", err)
+					log.Fatalf("failed to create node client: %v", err)
 				}
 				nodeMgmt := apb.NewNodeManagementClient(cc)
 				log.Printf("sending update request to: %s (%s)", n.Id, n.Status.ExternalAddress)
@@ -258,7 +258,7 @@
 		}
 
 		ctx, _ := signal.NotifyContext(context.Background(), os.Interrupt)
-		conn, err := dialAuthenticated(ctx)
+		conn, err := newAuthenticatedClient(ctx)
 		if err != nil {
 			return err
 		}
@@ -304,12 +304,12 @@
 	Args: PrintUsageOnWrongArgs(cobra.ExactArgs(1)),
 }
 
-func dialNode(ctx context.Context, node string) (apb.NodeManagementClient, error) {
+func newNodeClient(ctx context.Context, node string) (apb.NodeManagementClient, error) {
 	// First connect to the main management service and figure out the node's IP
 	// address.
-	cc, err := dialAuthenticated(ctx)
+	cc, err := newAuthenticatedClient(ctx)
 	if err != nil {
-		return nil, fmt.Errorf("while dialing node: %w", err)
+		return nil, fmt.Errorf("while creating client: %w", err)
 	}
 	mgmt := apb.NewManagementClient(cc)
 	nodes, err := core.GetNodes(ctx, mgmt, fmt.Sprintf("node.id == %q", node))
@@ -333,10 +333,10 @@
 		return nil, fmt.Errorf("could not get CA certificate: %w", err)
 	}
 
-	// Dial the actual node at its management port.
-	cl, err := dialAuthenticatedNode(ctx, n.Id, n.Status.ExternalAddress, cacert)
+	// Create a gprc client with the actual node and its management port.
+	cl, err := newAuthenticatedNodeClient(ctx, n.Id, n.Status.ExternalAddress, cacert)
 	if err != nil {
-		return nil, fmt.Errorf("while dialing node: %w", err)
+		return nil, fmt.Errorf("while creating client: %w", err)
 	}
 	nmgmt := apb.NewNodeManagementClient(cl)
 	return nmgmt, nil
@@ -392,9 +392,9 @@
 			req.NextBoot = apb.RebootRequest_NEXT_BOOT_START_ROLLBACK
 		}
 
-		nmgmt, err := dialNode(ctx, args[0])
+		nmgmt, err := newNodeClient(ctx, args[0])
 		if err != nil {
-			return fmt.Errorf("failed to dial node: %w", err)
+			return fmt.Errorf("failed to create node client: %w", err)
 		}
 
 		if _, err := nmgmt.Reboot(ctx, &req); err != nil {
@@ -414,7 +414,7 @@
 	RunE: func(cmd *cobra.Command, args []string) error {
 		ctx := cmd.Context()
 
-		nmgmt, err := dialNode(ctx, args[0])
+		nmgmt, err := newNodeClient(ctx, args[0])
 		if err != nil {
 			return err
 		}
diff --git a/metropolis/cli/metroctl/cmd_node_approve.go b/metropolis/cli/metroctl/cmd_node_approve.go
index 65d2811..c966d6e 100644
--- a/metropolis/cli/metroctl/cmd_node_approve.go
+++ b/metropolis/cli/metroctl/cmd_node_approve.go
@@ -22,9 +22,9 @@
 	Args:  PrintUsageOnWrongArgs(cobra.MaximumNArgs(1)), // One positional argument: node ID
 	RunE: func(cmd *cobra.Command, args []string) error {
 		ctx, _ := signal.NotifyContext(context.Background(), os.Interrupt)
-		cc, err := dialAuthenticated(ctx)
+		cc, err := newAuthenticatedClient(ctx)
 		if err != nil {
-			return fmt.Errorf("while dialing node: %w", err)
+			return fmt.Errorf("while creating client: %w", err)
 		}
 		mgmt := api.NewManagementClient(cc)
 
diff --git a/metropolis/cli/metroctl/cmd_node_logs.go b/metropolis/cli/metroctl/cmd_node_logs.go
index 5baf2f6..4f5c5e4 100644
--- a/metropolis/cli/metroctl/cmd_node_logs.go
+++ b/metropolis/cli/metroctl/cmd_node_logs.go
@@ -63,9 +63,9 @@
 
 		// First connect to the main management service and figure out the node's IP
 		// address.
-		cc, err := dialAuthenticated(ctx)
+		cc, err := newAuthenticatedClient(ctx)
 		if err != nil {
-			return fmt.Errorf("while dialing node: %w", err)
+			return fmt.Errorf("while creating client: %w", err)
 		}
 		mgmt := api.NewManagementClient(cc)
 		nodes, err := core.GetNodes(ctx, mgmt, fmt.Sprintf("node.id == %q", args[0]))
@@ -90,10 +90,10 @@
 		}
 
 		fmt.Printf("=== Logs from %s (%s):\n", n.Id, n.Status.ExternalAddress)
-		// Dial the actual node at its management port.
-		cl, err := dialAuthenticatedNode(ctx, n.Id, n.Status.ExternalAddress, cacert)
+		// Create a gprc client with the actual node and its management port.
+		cl, err := newAuthenticatedNodeClient(ctx, n.Id, n.Status.ExternalAddress, cacert)
 		if err != nil {
-			return fmt.Errorf("while dialing node: %w", err)
+			return fmt.Errorf("while creating client: %w", err)
 		}
 		nmgmt := api.NewNodeManagementClient(cl)
 
diff --git a/metropolis/cli/metroctl/cmd_node_metrics.go b/metropolis/cli/metroctl/cmd_node_metrics.go
index 6b108ae..648fe60 100644
--- a/metropolis/cli/metroctl/cmd_node_metrics.go
+++ b/metropolis/cli/metroctl/cmd_node_metrics.go
@@ -48,9 +48,9 @@
 
 		// First connect to the main management service and figure out the node's IP
 		// address.
-		cc, err := dialAuthenticated(ctx)
+		cc, err := newAuthenticatedClient(ctx)
 		if err != nil {
-			return fmt.Errorf("while dialing node: %w", err)
+			return fmt.Errorf("while creating client: %w", err)
 		}
 		mgmt := api.NewManagementClient(cc)
 		nodes, err := core.GetNodes(ctx, mgmt, fmt.Sprintf("node.id == %q", args[0]))
diff --git a/metropolis/cli/metroctl/cmd_node_set.go b/metropolis/cli/metroctl/cmd_node_set.go
index 677a425..41e2d08 100644
--- a/metropolis/cli/metroctl/cmd_node_set.go
+++ b/metropolis/cli/metroctl/cmd_node_set.go
@@ -34,9 +34,9 @@
 	Args:    PrintUsageOnWrongArgs(cobra.MinimumNArgs(2)),
 	RunE: func(cmd *cobra.Command, args []string) error {
 		ctx, _ := signal.NotifyContext(context.Background(), os.Interrupt)
-		cc, err := dialAuthenticated(ctx)
+		cc, err := newAuthenticatedClient(ctx)
 		if err != nil {
-			return fmt.Errorf("while dialing node: %w", err)
+			return fmt.Errorf("while creating client: %w", err)
 		}
 		mgmt := api.NewManagementClient(cc)
 
@@ -78,9 +78,9 @@
 	Args:    PrintUsageOnWrongArgs(cobra.ArbitraryArgs),
 	RunE: func(cmd *cobra.Command, args []string) error {
 		ctx, _ := signal.NotifyContext(context.Background(), os.Interrupt)
-		cc, err := dialAuthenticated(ctx)
+		cc, err := newAuthenticatedClient(ctx)
 		if err != nil {
-			return fmt.Errorf("while dialing node: %w", err)
+			return fmt.Errorf("while creating client: %w", err)
 		}
 		mgmt := api.NewManagementClient(cc)
 
diff --git a/metropolis/cli/metroctl/core/ca_tofu.go b/metropolis/cli/metroctl/core/ca_tofu.go
index 3f3c135..c19c303 100644
--- a/metropolis/cli/metroctl/core/ca_tofu.go
+++ b/metropolis/cli/metroctl/core/ca_tofu.go
@@ -156,9 +156,9 @@
 		return nil, err
 	}
 	opts = append(opts, grpc.WithTransportCredentials(creds))
-	cc, err := grpc.Dial(resolver.MetropolisControlAddress, opts...)
+	cc, err := grpc.NewClient(resolver.MetropolisControlAddress, opts...)
 	if err != nil {
-		return nil, fmt.Errorf("while dialing cluster to retrieve CA: %w", err)
+		return nil, fmt.Errorf("while creating grpc client: %w", err)
 	}
 	cur := ipb.NewCuratorLocalClient(cc)
 	res, err := cur.GetCACertificate(ctx, &ipb.GetCACertificateRequest{})
diff --git a/metropolis/cli/metroctl/core/rpc.go b/metropolis/cli/metroctl/core/rpc.go
index 8b377f5..a8f933c 100644
--- a/metropolis/cli/metroctl/core/rpc.go
+++ b/metropolis/cli/metroctl/core/rpc.go
@@ -53,7 +53,7 @@
 	return opts, nil
 }
 
-func DialNode(ctx context.Context, opkey ed25519.PrivateKey, ocert, ca *x509.Certificate, proxyAddr, nodeId, nodeAddr string) (*grpc.ClientConn, error) {
+func NewNodeClient(ctx context.Context, opkey ed25519.PrivateKey, ocert, ca *x509.Certificate, proxyAddr, nodeId, nodeAddr string) (*grpc.ClientConn, error) {
 	var dialOpts []grpc.DialOption
 
 	if opkey == nil {
@@ -77,7 +77,7 @@
 	dialOpts = append(dialOpts, grpc.WithTransportCredentials(creds))
 
 	endpoint := net.JoinHostPort(nodeAddr, node.NodeManagementPort.PortString())
-	return grpc.Dial(endpoint, dialOpts...)
+	return grpc.NewClient(endpoint, dialOpts...)
 }
 
 // GetNodes retrieves node records, filtered by the supplied node filter
diff --git a/metropolis/cli/metroctl/rpc.go b/metropolis/cli/metroctl/rpc.go
index ec3a4e4..b3a9819 100644
--- a/metropolis/cli/metroctl/rpc.go
+++ b/metropolis/cli/metroctl/rpc.go
@@ -20,9 +20,9 @@
 	"source.monogon.dev/metropolis/node/core/rpc/resolver"
 )
 
-func dialAuthenticated(ctx context.Context) (*grpc.ClientConn, error) {
-	// Collect credentials, validate command parameters, and try dialing the
-	// cluster.
+func newAuthenticatedClient(ctx context.Context) (*grpc.ClientConn, error) {
+	// Collect credentials, validate command parameters, and create the grpc
+	// client.
 	ocert, opkey, err := core.GetOwnerCredentials(flags.configPath)
 	if errors.Is(err, core.ErrNoCredentials) {
 		return nil, fmt.Errorf("you have to take ownership of the cluster first: %w", err)
@@ -50,23 +50,23 @@
 	}
 	opts = append(opts, grpc.WithTransportCredentials(creds))
 
-	cc, err := grpc.Dial(resolver.MetropolisControlAddress, opts...)
+	cc, err := grpc.NewClient(resolver.MetropolisControlAddress, opts...)
 	if err != nil {
-		return nil, fmt.Errorf("while dialing cluster: %w", err)
+		return nil, fmt.Errorf("while creating client: %w", err)
 	}
 	return cc, nil
 }
 
-func dialAuthenticatedNode(ctx context.Context, id, address string, cacert *x509.Certificate) (*grpc.ClientConn, error) {
-	// Collect credentials, validate command parameters, and try dialing the
-	// cluster.
+func newAuthenticatedNodeClient(ctx context.Context, id, address string, cacert *x509.Certificate) (*grpc.ClientConn, error) {
+	// Collect credentials, validate command parameters, and create the grpc
+	// client.
 	ocert, opkey, err := core.GetOwnerCredentials(flags.configPath)
 	if errors.Is(err, core.ErrNoCredentials) {
 		return nil, fmt.Errorf("you have to take ownership of the cluster first: %w", err)
 	}
-	cc, err := core.DialNode(ctx, opkey, ocert, cacert, flags.proxyAddr, id, address)
+	cc, err := core.NewNodeClient(ctx, opkey, ocert, cacert, flags.proxyAddr, id, address)
 	if err != nil {
-		return nil, fmt.Errorf("while dialing node: %w", err)
+		return nil, fmt.Errorf("while creating client: %w", err)
 	}
 	return cc, nil
 }