diff --git a/build/analysis/BUILD.bazel b/build/analysis/BUILD.bazel
index f4f3f66..938867f 100644
--- a/build/analysis/BUILD.bazel
+++ b/build/analysis/BUILD.bazel
@@ -41,5 +41,6 @@
         # 'standard' 80 characters long, as prose within comment blocks does not
         # soft-reflow well.
         "@com_github_corverroos_commentwrap//:go_default_library",
+        "//build/analysis/noioutil:go_default_library",
     ],
 )
diff --git a/build/analysis/nogo_config.json b/build/analysis/nogo_config.json
index 8f97918..d2c824d 100644
--- a/build/analysis/nogo_config.json
+++ b/build/analysis/nogo_config.json
@@ -81,5 +81,10 @@
     "exclude_files": {
       "external/": "third_party"
     }
+  },
+  "noioutil": {
+    "exclude_files": {
+      "external/": "third_party"
+    }
   }
 }
diff --git a/build/analysis/noioutil/BUILD.bazel b/build/analysis/noioutil/BUILD.bazel
new file mode 100644
index 0000000..1770430
--- /dev/null
+++ b/build/analysis/noioutil/BUILD.bazel
@@ -0,0 +1,9 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+
+go_library(
+    name = "go_default_library",
+    srcs = ["noioutil.go"],
+    importpath = "source.monogon.dev/build/analysis/noioutil",
+    visibility = ["//visibility:public"],
+    deps = ["@org_golang_x_tools//go/analysis:go_default_library"],
+)
diff --git a/build/analysis/noioutil/noioutil.go b/build/analysis/noioutil/noioutil.go
new file mode 100644
index 0000000..96286e3
--- /dev/null
+++ b/build/analysis/noioutil/noioutil.go
@@ -0,0 +1,58 @@
+// Package noioutil contains a Go analysis pass designed to prevent use of the
+// deprecated ioutil package for which a tree-wide migration was already done.
+package noioutil
+
+import (
+	"go/ast"
+	"strconv"
+	"strings"
+
+	"golang.org/x/tools/go/analysis"
+)
+
+var Analyzer = &analysis.Analyzer{
+	Name: "noioutil",
+	Doc:  "noioutil checks for imports of the deprecated ioutil package",
+	Run:  run,
+}
+
+func run(p *analysis.Pass) (interface{}, error) {
+	for _, file := range p.Files {
+		if isGeneratedFile(file) {
+			continue
+		}
+		for _, i := range file.Imports {
+			importPath, err := strconv.Unquote(i.Path.Value)
+			if err != nil {
+				continue
+			}
+			if importPath == "io/ioutil" {
+				p.Report(analysis.Diagnostic{
+					Pos:     i.Path.ValuePos,
+					End:     i.Path.End(),
+					Message: "File imports the deprecated io/ioutil package. See https://pkg.go.dev/io/ioutil for replacements.",
+				})
+			}
+		}
+	}
+
+	return nil, nil
+}
+
+const (
+	genPrefix = "// Code generated"
+	genSuffix = "DO NOT EDIT."
+)
+
+// isGeneratedFile returns true if the file is generated
+// according to https://golang.org/s/generatedcode.
+func isGeneratedFile(file *ast.File) bool {
+	for _, c := range file.Comments {
+		for _, t := range c.List {
+			if strings.HasPrefix(t.Text, genPrefix) && strings.HasSuffix(t.Text, genSuffix) {
+				return true
+			}
+		}
+	}
+	return false
+}