diff --git a/metropolis/cli/metroctl/BUILD.bazel b/metropolis/cli/metroctl/BUILD.bazel
index 2b53acf..6e75400 100644
--- a/metropolis/cli/metroctl/BUILD.bazel
+++ b/metropolis/cli/metroctl/BUILD.bazel
@@ -36,6 +36,7 @@
     visibility = ["//visibility:private"],
     deps = [
         "//go/clitable",
+        "//go/logging",
         "//metropolis/cli/flagdefs",
         "//metropolis/cli/metroctl/core",
         "//metropolis/node",
diff --git a/metropolis/cli/metroctl/core/BUILD.bazel b/metropolis/cli/metroctl/core/BUILD.bazel
index e65a8a7..3a599a7 100644
--- a/metropolis/cli/metroctl/core/BUILD.bazel
+++ b/metropolis/cli/metroctl/core/BUILD.bazel
@@ -12,6 +12,7 @@
     importpath = "source.monogon.dev/metropolis/cli/metroctl/core",
     visibility = ["//visibility:public"],
     deps = [
+        "//go/logging",
         "//metropolis/node",
         "//metropolis/node/core/curator/proto/api",
         "//metropolis/node/core/rpc",
diff --git a/metropolis/cli/metroctl/core/config.go b/metropolis/cli/metroctl/core/config.go
index d119883..d22dd9a 100644
--- a/metropolis/cli/metroctl/core/config.go
+++ b/metropolis/cli/metroctl/core/config.go
@@ -20,6 +20,7 @@
 	"k8s.io/client-go/tools/clientcmd"
 	clientapi "k8s.io/client-go/tools/clientcmd/api"
 
+	"source.monogon.dev/go/logging"
 	"source.monogon.dev/metropolis/node"
 )
 
@@ -339,7 +340,7 @@
 	Endpoints []string
 	// ResolverLogger can be set to enable verbose logging of the Metropolis RPC
 	// resolver layer.
-	ResolverLogger ResolverLogger
+	ResolverLogger logging.Leveled
 	// TOFU overrides the trust-on-first-use behaviour for CA certificates for the
 	// connection. If not set, TerminalTOFU is used which will interactively ask the
 	// user to accept a CA certificate using os.Stdin/Stdout.
diff --git a/metropolis/cli/metroctl/core/rpc.go b/metropolis/cli/metroctl/core/rpc.go
index a5aac60..91d5175 100644
--- a/metropolis/cli/metroctl/core/rpc.go
+++ b/metropolis/cli/metroctl/core/rpc.go
@@ -18,8 +18,6 @@
 	"source.monogon.dev/metropolis/proto/api"
 )
 
-type ResolverLogger func(format string, args ...interface{})
-
 func DialOpts(ctx context.Context, c *ConnectOptions) ([]grpc.DialOption, error) {
 	var opts []grpc.DialOption
 	if c.ProxyServer != "" {
diff --git a/metropolis/cli/metroctl/main.go b/metropolis/cli/metroctl/main.go
index cdc4947..fcdbccd 100644
--- a/metropolis/cli/metroctl/main.go
+++ b/metropolis/cli/metroctl/main.go
@@ -3,12 +3,13 @@
 import (
 	"context"
 	"crypto/x509"
-	"log"
+	"os"
 	"path/filepath"
 
 	"github.com/adrg/xdg"
 	"github.com/spf13/cobra"
 
+	"source.monogon.dev/go/logging"
 	"source.monogon.dev/metropolis/cli/metroctl/core"
 )
 
@@ -61,14 +62,6 @@
 	rootCmd.PersistentFlags().BoolVar(&flags.acceptAnyCA, "insecure-accept-and-persist-first-encountered-ca", false, "Accept the first encountered CA while connecting as the trusted CA for future metroctl connections with this config path. This is very insecure and should only be used for testing.")
 }
 
-// rpcLogger passes through the cluster resolver logs, if "--verbose" flag was
-// used.
-func rpcLogger(f string, args ...interface{}) {
-	if flags.verbose {
-		log.Printf("resolver: "+f, args...)
-	}
-}
-
 func main() {
 	cobra.CheckErr(rootCmd.Execute())
 }
@@ -86,11 +79,15 @@
 	if flags.acceptAnyCA {
 		tofu = &acceptall{}
 	}
+	logger := logging.NewWriterBackend(os.Stderr)
+	if !flags.verbose {
+		logger.MinimumSeverity = logging.WARNING
+	}
 	return &core.ConnectOptions{
 		ConfigPath:     flags.configPath,
 		ProxyServer:    flags.proxyAddr,
 		Endpoints:      flags.clusterEndpoints,
-		ResolverLogger: rpcLogger,
+		ResolverLogger: logger,
 		TOFU:           tofu,
 	}
 }