diff --git a/metropolis/node/kubernetes/pki/BUILD.bazel b/metropolis/node/kubernetes/pki/BUILD.bazel
index 1471fd3..60121c7 100644
--- a/metropolis/node/kubernetes/pki/BUILD.bazel
+++ b/metropolis/node/kubernetes/pki/BUILD.bazel
@@ -8,7 +8,7 @@
     deps = [
         "//metropolis/node",
         "//metropolis/node/core/consensus",
-        "//metropolis/pkg/pki",
+        "//osbase/pki",
         "@io_etcd_go_etcd_client_v3//:client",
         "@io_k8s_client_go//tools/clientcmd",
         "@io_k8s_client_go//tools/clientcmd/api",
diff --git a/metropolis/node/kubernetes/pki/kubernetes.go b/metropolis/node/kubernetes/pki/kubernetes.go
index 66731ae..5ea1e3e 100644
--- a/metropolis/node/kubernetes/pki/kubernetes.go
+++ b/metropolis/node/kubernetes/pki/kubernetes.go
@@ -14,7 +14,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-// package pki builds upon metropolis/pkg/pki/ to provide an
+// package pki builds upon osbase/pki/ to provide an
 // etcd-backed implementation of all x509 PKI Certificates/CAs required to run
 // Kubernetes.
 // Most elements of the PKI are 'static' long-standing certificates/credentials
@@ -41,7 +41,7 @@
 
 	common "source.monogon.dev/metropolis/node"
 	"source.monogon.dev/metropolis/node/core/consensus"
-	opki "source.monogon.dev/metropolis/pkg/pki"
+	opki "source.monogon.dev/osbase/pki"
 )
 
 // KubeCertificateName is an enum-like unique name of a static Kubernetes