diff --git a/build/analysis/BUILD.bazel b/build/analysis/BUILD.bazel
index 621e30b..f4f3f66 100644
--- a/build/analysis/BUILD.bazel
+++ b/build/analysis/BUILD.bazel
@@ -5,28 +5,28 @@
 # that are always correct).
 # You can see the what `go vet` does by running `go doc cmd/vet`.
 govet = [
-    "@org_golang_x_tools//go/analysis/passes/asmdecl:go_tool_library",
-    "@org_golang_x_tools//go/analysis/passes/assign:go_tool_library",
-    "@org_golang_x_tools//go/analysis/passes/atomic:go_tool_library",
-    "@org_golang_x_tools//go/analysis/passes/bools:go_tool_library",
-    "@org_golang_x_tools//go/analysis/passes/buildtag:go_tool_library",
+    "@org_golang_x_tools//go/analysis/passes/asmdecl:go_default_library",
+    "@org_golang_x_tools//go/analysis/passes/assign:go_default_library",
+    "@org_golang_x_tools//go/analysis/passes/atomic:go_default_library",
+    "@org_golang_x_tools//go/analysis/passes/bools:go_default_library",
+    "@org_golang_x_tools//go/analysis/passes/buildtag:go_default_library",
     # Disable cgocall because it fails processing com_github_mattn_go_sqlite3 before exclusions are applied
-    #"@org_golang_x_tools//go/analysis/passes/cgocall:go_tool_library",
-    "@org_golang_x_tools//go/analysis/passes/composite:go_tool_library",
-    "@org_golang_x_tools//go/analysis/passes/copylock:go_tool_library",
-    "@org_golang_x_tools//go/analysis/passes/httpresponse:go_tool_library",
-    "@org_golang_x_tools//go/analysis/passes/loopclosure:go_tool_library",
-    "@org_golang_x_tools//go/analysis/passes/lostcancel:go_tool_library",
-    "@org_golang_x_tools//go/analysis/passes/nilfunc:go_tool_library",
-    "@org_golang_x_tools//go/analysis/passes/printf:go_tool_library",
-    "@org_golang_x_tools//go/analysis/passes/shift:go_tool_library",
-    "@org_golang_x_tools//go/analysis/passes/stdmethods:go_tool_library",
-    "@org_golang_x_tools//go/analysis/passes/structtag:go_tool_library",
-    "@org_golang_x_tools//go/analysis/passes/tests:go_tool_library",
-    "@org_golang_x_tools//go/analysis/passes/unmarshal:go_tool_library",
-    "@org_golang_x_tools//go/analysis/passes/unreachable:go_tool_library",
-    "@org_golang_x_tools//go/analysis/passes/unsafeptr:go_tool_library",
-    "@org_golang_x_tools//go/analysis/passes/unusedresult:go_tool_library",
+    #"@org_golang_x_tools//go/analysis/passes/cgocall:go_default_library",
+    "@org_golang_x_tools//go/analysis/passes/composite:go_default_library",
+    "@org_golang_x_tools//go/analysis/passes/copylock:go_default_library",
+    "@org_golang_x_tools//go/analysis/passes/httpresponse:go_default_library",
+    "@org_golang_x_tools//go/analysis/passes/loopclosure:go_default_library",
+    "@org_golang_x_tools//go/analysis/passes/lostcancel:go_default_library",
+    "@org_golang_x_tools//go/analysis/passes/nilfunc:go_default_library",
+    "@org_golang_x_tools//go/analysis/passes/printf:go_default_library",
+    "@org_golang_x_tools//go/analysis/passes/shift:go_default_library",
+    "@org_golang_x_tools//go/analysis/passes/stdmethods:go_default_library",
+    "@org_golang_x_tools//go/analysis/passes/structtag:go_default_library",
+    "@org_golang_x_tools//go/analysis/passes/tests:go_default_library",
+    "@org_golang_x_tools//go/analysis/passes/unmarshal:go_default_library",
+    "@org_golang_x_tools//go/analysis/passes/unreachable:go_default_library",
+    "@org_golang_x_tools//go/analysis/passes/unsafeptr:go_default_library",
+    "@org_golang_x_tools//go/analysis/passes/unusedresult:go_default_library",
 ]
 
 nogo(
@@ -40,6 +40,6 @@
         # to be soft-reflowable by text editors), but comments are kept at a
         # 'standard' 80 characters long, as prose within comment blocks does not
         # soft-reflow well.
-        "@com_github_corverroos_commentwrap//:go_tool_library",
+        "@com_github_corverroos_commentwrap//:go_default_library",
     ],
 )
diff --git a/build/analysis/nogo_config.json b/build/analysis/nogo_config.json
index e9054ca..8f97918 100644
--- a/build/analysis/nogo_config.json
+++ b/build/analysis/nogo_config.json
@@ -1,20 +1,7 @@
 {
   "composites": {
     "exclude_files": {
-      "external/io_k8s_kubernetes/": "third_party",
-      "external/bazel_gazelle/language/go/": "third_party",
-      "external/com_github_golang_protobuf/": "third_party",
-      "external/com_github_google_gvisor/": "third_party",
-      "external/io_k8s_apimachinery/pkg/runtime/serializer/versioning/": "third_party",
-      "external/io_k8s_sigs_structured_merge_diff/": "third_party",
-      "external/io_k8s_client_go/": "third_party",
-      "external/io_k8s_kube_openapi/": "third_party",
-      "external/io_k8s_apiserver/": "third_party",
-      "external/org_golang_x_tools/": "third_party",
-      "external/io_k8s_apiextensions_apiserver/": "third_party",
-      "external/org_golang_x_text/": "third_party",
-      "external/io_bazel_rules_docker/": "third_party",
-      "external/com_github_grpc_ecosystem_grpc_opentracing": "third_party"
+      "external/": "third_party"
     }
   },
   "copylocks": {
@@ -65,7 +52,8 @@
       "external/io_k8s_sigs_structured_merge_diff/": "third_party",
       "external/com_github_go_delve_delve/": "third_party",
       "external/com_github_mailru_easyjson/jlexer/": "third_party",
-      "external/com_github_cilium_ebpf/": "third_party"
+      "external/com_github_cilium_ebpf/": "third_party",
+      "external/org_golang_x_sys": "third_party"
     }
   },
   "unusedresult": {
diff --git a/build/fietsje/dependency.go b/build/fietsje/dependency.go
index e3520a4..1eeb52c 100644
--- a/build/fietsje/dependency.go
+++ b/build/fietsje/dependency.go
@@ -53,6 +53,7 @@
 	patches              []string
 	prePatches           []string
 	buildExtraArgs       []string
+	useImportAliasNaming bool
 	// replace is an importpath that this dependency will replace. If this is set, this
 	// dependency will be visible in the build as 'importpath', but downloaded at
 	// 'replace'/'version'. This might be slighly confusing, but follows the semantics
diff --git a/build/fietsje/deps_containerd.go b/build/fietsje/deps_containerd.go
index 37c71c5..9461cdb 100644
--- a/build/fietsje/deps_containerd.go
+++ b/build/fietsje/deps_containerd.go
@@ -81,12 +81,13 @@
 		"go.opencensus.io",
 		"golang.org/x/crypto",
 		"golang.org/x/oauth2",
-		"golang.org/x/sync",
 		"google.golang.org/genproto",
 		"gopkg.in/inf.v0",
 		"gopkg.in/yaml.v2",
 		"k8s.io/klog/v2",
 		"sigs.k8s.io/yaml",
+	).with(useImportAliasNaming).use(
+		"golang.org/x/sync",
 	).with(disabledProtoBuild, patches("containerd-netns-statedir.patch")).use(
 		"github.com/containerd/cri",
 	).with(disabledProtoBuild).use(
diff --git a/build/fietsje/deps_gvisor.go b/build/fietsje/deps_gvisor.go
index c4e7ca0..8810a83 100644
--- a/build/fietsje/deps_gvisor.go
+++ b/build/fietsje/deps_gvisor.go
@@ -20,10 +20,11 @@
 
 func depsGVisor(p *planner) {
 	p.collect(
-		"github.com/google/gvisor", "release-20201216.0",
+		"github.com/google/gvisor", "release-20211101.0",
 		patches(
 			"gvisor.patch",
 			"gvisor-build-against-newer-runtime-specs.patch",
+			"gvisor-cgroup-fix.patch",
 		),
 	).use(
 		"github.com/cenkalti/backoff",
diff --git a/build/fietsje/deps_kubernetes.go b/build/fietsje/deps_kubernetes.go
index bea586e..e3b00cf 100644
--- a/build/fietsje/deps_kubernetes.go
+++ b/build/fietsje/deps_kubernetes.go
@@ -41,7 +41,7 @@
 	).inject(
 		// repo infra, not requested by k8s, but used with bazel
 		"k8s.io/repo-infra", "a3483874bd37251c629c92df6d82a226b0e6ad92",
-		prePatches("k8s-infra-bzl4-compat.patch"),
+		prePatches("k8s-infra-bzl4-compat.patch", "k8s-infra-fix-go116.patch"),
 	).with(prePatches("k8s-client-go.patch")).use(
 		"k8s.io/client-go",
 	).with(patches("k8s-native-mounter.patch")).use(
@@ -113,7 +113,6 @@
 		"github.com/golang/groupcache",
 		"github.com/google/btree",
 		"github.com/google/go-cmp",
-		"github.com/googleapis/gnostic",
 		"github.com/gorilla/websocket",
 		"github.com/gregjones/httpcache",
 		"github.com/grpc-ecosystem/go-grpc-middleware",
@@ -182,5 +181,6 @@
 		"github.com/google/cadvisor",
 	).with(disabledProtoBuild).use(
 		"go.etcd.io/etcd",
+		"github.com/googleapis/gnostic",
 	)
 }
diff --git a/build/fietsje/deps_monogon.go b/build/fietsje/deps_monogon.go
index f192b6c..6d1ddda 100644
--- a/build/fietsje/deps_monogon.go
+++ b/build/fietsje/deps_monogon.go
@@ -39,7 +39,7 @@
 
 	// our own deps, common
 	p.collectOverride("go.uber.org/zap", "v1.15.0")
-	p.collectOverride("golang.org/x/mod", "v0.3.0")
+	p.collectOverride("golang.org/x/mod", "v0.3.0", useImportAliasNaming)
 	p.collectOverride("github.com/spf13/viper", "v1.9.0").use(
 		"gopkg.in/ini.v1",
 		"github.com/subosito/gotenv",
@@ -117,13 +117,7 @@
 
 	// commentwrap is used as a nogo analyzer to stick to a maximum line
 	// length for comments.
-	// We have to patch both it and its only direct dependency to add generated
-	// go_tool_library targets. This is needed as Gazelle doesn't generate them,
-	// because they're a temporary solution to a problem that shouldn't exist soon:
-	// https://github.com/bazelbuild/rules_go/issues/2374
-	p.collect("github.com/corverroos/commentwrap", "2926638be44ce0c6c0ee2471e9b5ad9473c984cd",
-		patches("commentwrap-tool-library.patch"),
-	).with(patches("reflow-tool-library.patch")).use(
+	p.collect("github.com/corverroos/commentwrap", "2926638be44ce0c6c0ee2471e9b5ad9473c984cd").use(
 		"github.com/muesli/reflow",
 	)
 
diff --git a/build/fietsje/planner.go b/build/fietsje/planner.go
index 0be1b8a..9e4889c 100644
--- a/build/fietsje/planner.go
+++ b/build/fietsje/planner.go
@@ -209,6 +209,13 @@
 	}
 }
 
+// useImportAliasNaming instructs Gazelle to name the generated targets in a way
+// which is both compatible with the old go_default_library convention as well
+// as the import convention. See `go_naming_convention=import_alias` in Gazelle.
+func useImportAliasNaming(d *dependency) {
+	d.useImportAliasNaming = true
+}
+
 func forceBazelGeneration(d *dependency) {
 	d.forceBazelGeneration = true
 }
diff --git a/build/fietsje/render.go b/build/fietsje/render.go
index 5890411..5ad26d0 100644
--- a/build/fietsje/render.go
+++ b/build/fietsje/render.go
@@ -82,8 +82,13 @@
 			fmt.Fprintf(w, "        patch_args = [%q],\n", "-p1")
 		}
 		fmt.Fprintf(w, "        build_extra_args = [\n")
-		fmt.Fprintf(w, "            %q,\n", "-go_naming_convention=go_default_library")
-		fmt.Fprintf(w, "            %q,\n", "-go_naming_convention_external=go_default_library")
+		if d.useImportAliasNaming {
+			fmt.Fprintf(w, "            %q,\n", "-go_naming_convention=import_alias")
+			fmt.Fprintf(w, "            %q,\n", "-go_naming_convention_external=import_alias")
+		} else {
+			fmt.Fprintf(w, "            %q,\n", "-go_naming_convention=go_default_library")
+			fmt.Fprintf(w, "            %q,\n", "-go_naming_convention_external=go_default_library")
+		}
 		for _, arg := range d.buildExtraArgs {
 			fmt.Fprintf(w, "            %q,\n", arg)
 		}