diff --git a/metropolis/node/core/cluster/cluster_join.go b/metropolis/node/core/cluster/cluster_join.go
index eb0ff73..1a0a442 100644
--- a/metropolis/node/core/cluster/cluster_join.go
+++ b/metropolis/node/core/cluster/cluster_join.go
@@ -63,9 +63,9 @@
 	if err != nil {
 		return fmt.Errorf("could not create ephemeral credentials: %w", err)
 	}
-	eph, err := grpc.Dial(resolver.MetropolisControlAddress, grpc.WithTransportCredentials(ephCreds), grpc.WithResolvers(r))
+	eph, err := grpc.NewClient(resolver.MetropolisControlAddress, grpc.WithTransportCredentials(ephCreds), grpc.WithResolvers(r))
 	if err != nil {
-		return fmt.Errorf("could not dial cluster with join credentials: %w", err)
+		return fmt.Errorf("could not create client with join credentials: %w", err)
 	}
 	cur := ipb.NewCuratorClient(eph)
 
diff --git a/metropolis/node/core/cluster/cluster_register.go b/metropolis/node/core/cluster/cluster_register.go
index a6089cb..61cd22a 100644
--- a/metropolis/node/core/cluster/cluster_register.go
+++ b/metropolis/node/core/cluster/cluster_register.go
@@ -35,7 +35,7 @@
 // test multiple nodes in a cluster. It does notably not run either
 // etcd/consensus or the curator, which also prevents Kubernetes from running.
 func (m *Manager) register(ctx context.Context, register *apb.NodeParameters_ClusterRegister) error {
-	//// Do a validation pass on the provided NodeParameters.Register data, fail early
+	// Do a validation pass on the provided NodeParameters.Register data, fail early
 	// if it looks invalid.
 	ca, err := x509.ParseCertificate(register.CaCertificate)
 	if err != nil {
@@ -90,9 +90,9 @@
 	if err != nil {
 		return fmt.Errorf("could not create ephemeral credentials: %w", err)
 	}
-	eph, err := grpc.Dial(resolver.MetropolisControlAddress, grpc.WithTransportCredentials(ephCreds), grpc.WithResolvers(r))
+	eph, err := grpc.NewClient(resolver.MetropolisControlAddress, grpc.WithTransportCredentials(ephCreds), grpc.WithResolvers(r))
 	if err != nil {
-		return fmt.Errorf("could not dial cluster with ephemeral credentials: %w", err)
+		return fmt.Errorf("could not create client with ephemeral credentials: %w", err)
 	}
 	cur := ipb.NewCuratorClient(eph)
 
diff --git a/metropolis/node/core/curator/impl_leader_test.go b/metropolis/node/core/curator/impl_leader_test.go
index 72c8658..e593bbd 100644
--- a/metropolis/node/core/curator/impl_leader_test.go
+++ b/metropolis/node/core/curator/impl_leader_test.go
@@ -243,17 +243,17 @@
 	// Create an authenticated manager gRPC client.
 	creds := rpc.NewAuthenticatedCredentials(ownerCreds, rpc.WantRemoteCluster(ca))
 	gcreds := grpc.WithTransportCredentials(creds)
-	mcl, err := grpc.Dial("local", withLocalDialer, gcreds)
+	mcl, err := grpc.NewClient("passthrough:///local", withLocalDialer, gcreds)
 	if err != nil {
-		t.Fatalf("Dialing external GRPC failed: %v", err)
+		t.Fatalf("Creating external GRPC client failed: %v", err)
 	}
 
 	// Create a node gRPC client for the local node.
 	creds = rpc.NewAuthenticatedCredentials(nodeCredentials.TLSCredentials(), rpc.WantRemoteCluster(ca))
 	gcreds = grpc.WithTransportCredentials(creds)
-	lcl, err := grpc.Dial("local", withLocalDialer, gcreds)
+	lcl, err := grpc.NewClient("passthrough:///local", withLocalDialer, gcreds)
 	if err != nil {
-		t.Fatalf("Dialing external GRPC failed: %v", err)
+		t.Fatalf("Creating external GRPC client failed: %v", err)
 	}
 
 	// Create an ephemeral node gRPC client for the 'other node'.
@@ -261,9 +261,9 @@
 	if err != nil {
 		t.Fatalf("NewEphemeralCredentials: %v", err)
 	}
-	ocl, err := grpc.Dial("local", withLocalDialer, grpc.WithTransportCredentials(otherEphCreds))
+	ocl, err := grpc.NewClient("passthrough:///local", withLocalDialer, grpc.WithTransportCredentials(otherEphCreds))
 	if err != nil {
-		t.Fatalf("Dialing external GRPC failed: %v", err)
+		t.Fatalf("Creating external GRPC client failed: %v", err)
 	}
 
 	// Close the clients on context cancel.
@@ -858,9 +858,9 @@
 	if err != nil {
 		t.Fatalf("NewEphemeralCredentials: %v", err)
 	}
-	eph, err := grpc.Dial("local", withLocalDialer, grpc.WithTransportCredentials(ephCreds))
+	eph, err := grpc.NewClient("passthrough:///local", withLocalDialer, grpc.WithTransportCredentials(ephCreds))
 	if err != nil {
-		t.Fatalf("Dialing external GRPC failed: %v", err)
+		t.Fatalf("Creating external GRPC client failed: %v", err)
 	}
 	cur := ipb.NewCuratorClient(eph)
 	jr, err := cur.JoinNode(ctx, &ipb.JoinNodeRequest{
@@ -1794,9 +1794,9 @@
 			withLocalDialer := grpc.WithContextDialer(func(_ context.Context, _ string) (net.Conn, error) {
 				return cl.curatorLis.Dial()
 			})
-			eph, err := grpc.Dial("local", withLocalDialer, grpc.WithTransportCredentials(ephCreds))
+			eph, err := grpc.NewClient("passthrough:///local", withLocalDialer, grpc.WithTransportCredentials(ephCreds))
 			if err != nil {
-				t.Fatalf("Dialing external GRPC failed: %v", err)
+				t.Fatalf("Creating external GRPC client failed: %v", err)
 			}
 			t.Cleanup(func() {
 				eph.Close()
diff --git a/metropolis/node/core/mgmt/svc_logs_test.go b/metropolis/node/core/mgmt/svc_logs_test.go
index f650b4e..ee2e03d 100644
--- a/metropolis/node/core/mgmt/svc_logs_test.go
+++ b/metropolis/node/core/mgmt/svc_logs_test.go
@@ -46,9 +46,9 @@
 	withLocalDialer := grpc.WithContextDialer(func(_ context.Context, _ string) (net.Conn, error) {
 		return externalLis.Dial()
 	})
-	cl, err := grpc.Dial("local", withLocalDialer, grpc.WithTransportCredentials(insecure.NewCredentials()))
+	cl, err := grpc.NewClient("passthrough:///local", withLocalDialer, grpc.WithTransportCredentials(insecure.NewCredentials()))
 	if err != nil {
-		t.Fatalf("Dialing GRPC failed: %v", err)
+		t.Fatalf("Creating GRPC client failed: %v", err)
 	}
 
 	return s, cl
diff --git a/metropolis/node/core/roleserve/values.go b/metropolis/node/core/roleserve/values.go
index fda776c..3708e45 100644
--- a/metropolis/node/core/roleserve/values.go
+++ b/metropolis/node/core/roleserve/values.go
@@ -53,9 +53,9 @@
 
 func newCuratorConnection(creds *identity.NodeCredentials, res *resolver.Resolver) *CuratorConnection {
 	c := rpc.NewAuthenticatedCredentials(creds.TLSCredentials(), rpc.WantRemoteCluster(creds.ClusterCA()))
-	conn, err := grpc.Dial(resolver.MetropolisControlAddress, grpc.WithTransportCredentials(c), grpc.WithResolvers(res))
+	conn, err := grpc.NewClient(resolver.MetropolisControlAddress, grpc.WithTransportCredentials(c), grpc.WithResolvers(res))
 	if err != nil {
-		// TOOD(q3k): triple check that Dial will not fail
+		// TODO: triple check that NewClient will not fail
 		panic(err)
 	}
 	return &CuratorConnection{
diff --git a/metropolis/node/core/roleserve/worker_statuspush_test.go b/metropolis/node/core/roleserve/worker_statuspush_test.go
index 54683e7..78c5f9c 100644
--- a/metropolis/node/core/roleserve/worker_statuspush_test.go
+++ b/metropolis/node/core/roleserve/worker_statuspush_test.go
@@ -114,9 +114,9 @@
 	withLocalDialer := grpc.WithContextDialer(func(_ context.Context, _ string) (net.Conn, error) {
 		return lis.Dial()
 	})
-	cl, err := grpc.Dial("local", withLocalDialer, grpc.WithTransportCredentials(insecure.NewCredentials()))
+	cl, err := grpc.NewClient("passthrough:///local", withLocalDialer, grpc.WithTransportCredentials(insecure.NewCredentials()))
 	if err != nil {
-		t.Fatalf("Dial failed: %v", err)
+		t.Fatalf("NewClient failed: %v", err)
 	}
 	defer cl.Close()
 
diff --git a/metropolis/node/core/rpc/resolver/resolver.go b/metropolis/node/core/rpc/resolver/resolver.go
index 51b9cdf..c865130 100644
--- a/metropolis/node/core/rpc/resolver/resolver.go
+++ b/metropolis/node/core/rpc/resolver/resolver.go
@@ -222,10 +222,10 @@
 		Time:    10 * time.Second,
 		Timeout: 5 * time.Second,
 	}))
-	cl, err := grpc.Dial(MetropolisControlAddress, opts...)
+	cl, err := grpc.NewClient(MetropolisControlAddress, opts...)
 	if err != nil {
 		// This generally shouldn't happen.
-		return fmt.Errorf("could not dial gRPC: %w", err)
+		return fmt.Errorf("could not create gRPC client: %w", err)
 	}
 	defer cl.Close()
 
@@ -342,9 +342,9 @@
 		Timeout:             5 * time.Second,
 		PermitWithoutStream: true,
 	}))
-	cl, err := grpc.Dial(via, opts...)
+	cl, err := grpc.NewClient(via, opts...)
 	if err != nil {
-		r.logger.Infof("WATCHLEADER: dialing %s failed: %v", via, err)
+		r.logger.Infof("WATCHLEADER: creating client %s failed: %v", via, err)
 		return false
 	}
 	defer cl.Close()
diff --git a/metropolis/node/core/rpc/resolver/resolver_test.go b/metropolis/node/core/rpc/resolver/resolver_test.go
index 72da280..f9125c9 100644
--- a/metropolis/node/core/rpc/resolver/resolver_test.go
+++ b/metropolis/node/core/rpc/resolver/resolver_test.go
@@ -176,9 +176,10 @@
 		Certificates:       []tls.Certificate{eph.Manager},
 		InsecureSkipVerify: true,
 	})
-	cl, err := grpc.Dial("metropolis:///control", grpc.WithTransportCredentials(creds), grpc.WithResolvers(r))
+
+	cl, err := grpc.NewClient(MetropolisControlAddress, grpc.WithTransportCredentials(creds), grpc.WithResolvers(r))
 	if err != nil {
-		t.Fatalf("Could not dial: %v", err)
+		t.Fatalf("Could not create client: %v", err)
 	}
 
 	// Test logic follows.
diff --git a/metropolis/node/core/rpc/server_authentication_test.go b/metropolis/node/core/rpc/server_authentication_test.go
index a30ee86..90f638a 100644
--- a/metropolis/node/core/rpc/server_authentication_test.go
+++ b/metropolis/node/core/rpc/server_authentication_test.go
@@ -66,11 +66,11 @@
 	})
 
 	// Authenticate as manager externally, ensure that GetRegisterTicket runs.
-	cl, err := grpc.Dial("local",
+	cl, err := grpc.NewClient("passthrough:///local",
 		grpc.WithTransportCredentials(NewAuthenticatedCredentials(eph.Manager, WantRemoteCluster(eph.CA))),
 		withLocalDialer)
 	if err != nil {
-		t.Fatalf("Dial: %v", err)
+		t.Fatalf("NewClient: %v", err)
 	}
 	defer cl.Close()
 	mgmt := apb.NewManagementClient(cl)
@@ -81,11 +81,11 @@
 
 	// Authenticate as node externally, ensure that GetRegisterTicket is refused
 	// (this is because nodes miss the GET_REGISTER_TICKET permissions).
-	cl, err = grpc.Dial("local",
+	cl, err = grpc.NewClient("passthrough:///local",
 		grpc.WithTransportCredentials(NewAuthenticatedCredentials(eph.Nodes[0].TLSCredentials(), WantRemoteCluster(eph.CA))),
 		withLocalDialer)
 	if err != nil {
-		t.Fatalf("Dial: %v", err)
+		t.Fatalf("NewClient: %v", err)
 	}
 	defer cl.Close()
 	mgmt = apb.NewManagementClient(cl)
@@ -114,9 +114,9 @@
 	if err != nil {
 		t.Fatalf("NewEphemeralCredentials: %v", err)
 	}
-	cl, err = grpc.Dial("local", grpc.WithTransportCredentials(ephCreds), withLocalDialer)
+	cl, err = grpc.NewClient("passthrough:///local", grpc.WithTransportCredentials(ephCreds), withLocalDialer)
 	if err != nil {
-		t.Fatalf("Dial: %v", err)
+		t.Fatalf("NewClient: %v", err)
 	}
 	defer cl.Close()
 	mgmt = apb.NewManagementClient(cl)