diff --git a/build/fietsje/dependency.go b/build/fietsje/dependency.go
index e3520a4..1eeb52c 100644
--- a/build/fietsje/dependency.go
+++ b/build/fietsje/dependency.go
@@ -53,6 +53,7 @@
 	patches              []string
 	prePatches           []string
 	buildExtraArgs       []string
+	useImportAliasNaming bool
 	// replace is an importpath that this dependency will replace. If this is set, this
 	// dependency will be visible in the build as 'importpath', but downloaded at
 	// 'replace'/'version'. This might be slighly confusing, but follows the semantics
diff --git a/build/fietsje/deps_containerd.go b/build/fietsje/deps_containerd.go
index 37c71c5..9461cdb 100644
--- a/build/fietsje/deps_containerd.go
+++ b/build/fietsje/deps_containerd.go
@@ -81,12 +81,13 @@
 		"go.opencensus.io",
 		"golang.org/x/crypto",
 		"golang.org/x/oauth2",
-		"golang.org/x/sync",
 		"google.golang.org/genproto",
 		"gopkg.in/inf.v0",
 		"gopkg.in/yaml.v2",
 		"k8s.io/klog/v2",
 		"sigs.k8s.io/yaml",
+	).with(useImportAliasNaming).use(
+		"golang.org/x/sync",
 	).with(disabledProtoBuild, patches("containerd-netns-statedir.patch")).use(
 		"github.com/containerd/cri",
 	).with(disabledProtoBuild).use(
diff --git a/build/fietsje/deps_gvisor.go b/build/fietsje/deps_gvisor.go
index c4e7ca0..8810a83 100644
--- a/build/fietsje/deps_gvisor.go
+++ b/build/fietsje/deps_gvisor.go
@@ -20,10 +20,11 @@
 
 func depsGVisor(p *planner) {
 	p.collect(
-		"github.com/google/gvisor", "release-20201216.0",
+		"github.com/google/gvisor", "release-20211101.0",
 		patches(
 			"gvisor.patch",
 			"gvisor-build-against-newer-runtime-specs.patch",
+			"gvisor-cgroup-fix.patch",
 		),
 	).use(
 		"github.com/cenkalti/backoff",
diff --git a/build/fietsje/deps_kubernetes.go b/build/fietsje/deps_kubernetes.go
index bea586e..e3b00cf 100644
--- a/build/fietsje/deps_kubernetes.go
+++ b/build/fietsje/deps_kubernetes.go
@@ -41,7 +41,7 @@
 	).inject(
 		// repo infra, not requested by k8s, but used with bazel
 		"k8s.io/repo-infra", "a3483874bd37251c629c92df6d82a226b0e6ad92",
-		prePatches("k8s-infra-bzl4-compat.patch"),
+		prePatches("k8s-infra-bzl4-compat.patch", "k8s-infra-fix-go116.patch"),
 	).with(prePatches("k8s-client-go.patch")).use(
 		"k8s.io/client-go",
 	).with(patches("k8s-native-mounter.patch")).use(
@@ -113,7 +113,6 @@
 		"github.com/golang/groupcache",
 		"github.com/google/btree",
 		"github.com/google/go-cmp",
-		"github.com/googleapis/gnostic",
 		"github.com/gorilla/websocket",
 		"github.com/gregjones/httpcache",
 		"github.com/grpc-ecosystem/go-grpc-middleware",
@@ -182,5 +181,6 @@
 		"github.com/google/cadvisor",
 	).with(disabledProtoBuild).use(
 		"go.etcd.io/etcd",
+		"github.com/googleapis/gnostic",
 	)
 }
diff --git a/build/fietsje/deps_monogon.go b/build/fietsje/deps_monogon.go
index f192b6c..6d1ddda 100644
--- a/build/fietsje/deps_monogon.go
+++ b/build/fietsje/deps_monogon.go
@@ -39,7 +39,7 @@
 
 	// our own deps, common
 	p.collectOverride("go.uber.org/zap", "v1.15.0")
-	p.collectOverride("golang.org/x/mod", "v0.3.0")
+	p.collectOverride("golang.org/x/mod", "v0.3.0", useImportAliasNaming)
 	p.collectOverride("github.com/spf13/viper", "v1.9.0").use(
 		"gopkg.in/ini.v1",
 		"github.com/subosito/gotenv",
@@ -117,13 +117,7 @@
 
 	// commentwrap is used as a nogo analyzer to stick to a maximum line
 	// length for comments.
-	// We have to patch both it and its only direct dependency to add generated
-	// go_tool_library targets. This is needed as Gazelle doesn't generate them,
-	// because they're a temporary solution to a problem that shouldn't exist soon:
-	// https://github.com/bazelbuild/rules_go/issues/2374
-	p.collect("github.com/corverroos/commentwrap", "2926638be44ce0c6c0ee2471e9b5ad9473c984cd",
-		patches("commentwrap-tool-library.patch"),
-	).with(patches("reflow-tool-library.patch")).use(
+	p.collect("github.com/corverroos/commentwrap", "2926638be44ce0c6c0ee2471e9b5ad9473c984cd").use(
 		"github.com/muesli/reflow",
 	)
 
diff --git a/build/fietsje/planner.go b/build/fietsje/planner.go
index 0be1b8a..9e4889c 100644
--- a/build/fietsje/planner.go
+++ b/build/fietsje/planner.go
@@ -209,6 +209,13 @@
 	}
 }
 
+// useImportAliasNaming instructs Gazelle to name the generated targets in a way
+// which is both compatible with the old go_default_library convention as well
+// as the import convention. See `go_naming_convention=import_alias` in Gazelle.
+func useImportAliasNaming(d *dependency) {
+	d.useImportAliasNaming = true
+}
+
 func forceBazelGeneration(d *dependency) {
 	d.forceBazelGeneration = true
 }
diff --git a/build/fietsje/render.go b/build/fietsje/render.go
index 5890411..5ad26d0 100644
--- a/build/fietsje/render.go
+++ b/build/fietsje/render.go
@@ -82,8 +82,13 @@
 			fmt.Fprintf(w, "        patch_args = [%q],\n", "-p1")
 		}
 		fmt.Fprintf(w, "        build_extra_args = [\n")
-		fmt.Fprintf(w, "            %q,\n", "-go_naming_convention=go_default_library")
-		fmt.Fprintf(w, "            %q,\n", "-go_naming_convention_external=go_default_library")
+		if d.useImportAliasNaming {
+			fmt.Fprintf(w, "            %q,\n", "-go_naming_convention=import_alias")
+			fmt.Fprintf(w, "            %q,\n", "-go_naming_convention_external=import_alias")
+		} else {
+			fmt.Fprintf(w, "            %q,\n", "-go_naming_convention=go_default_library")
+			fmt.Fprintf(w, "            %q,\n", "-go_naming_convention_external=go_default_library")
+		}
 		for _, arg := range d.buildExtraArgs {
 			fmt.Fprintf(w, "            %q,\n", arg)
 		}