diff --git a/metropolis/build/gotoolwrap/BUILD.bazel b/metropolis/build/gotoolwrap/BUILD.bazel
index ce2aa6a..281f4b3 100644
--- a/metropolis/build/gotoolwrap/BUILD.bazel
+++ b/metropolis/build/gotoolwrap/BUILD.bazel
@@ -1,7 +1,7 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "gotoolwrap_lib",
     srcs = ["main.go"],
     importpath = "source.monogon.dev/metropolis/build/gotoolwrap",
     visibility = ["//visibility:private"],
@@ -9,6 +9,6 @@
 
 go_binary(
     name = "gotoolwrap",
-    embed = [":go_default_library"],
+    embed = [":gotoolwrap_lib"],
     visibility = ["//visibility:public"],
 )
diff --git a/metropolis/cli/dbg/BUILD.bazel b/metropolis/cli/dbg/BUILD.bazel
index 6d2769f..4eed080 100644
--- a/metropolis/cli/dbg/BUILD.bazel
+++ b/metropolis/cli/dbg/BUILD.bazel
@@ -1,24 +1,24 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "dbg_lib",
     srcs = ["main.go"],
     importpath = "source.monogon.dev/metropolis/cli/dbg",
     visibility = ["//visibility:private"],
     deps = [
-        "//metropolis/pkg/logtree:go_default_library",
-        "//metropolis/proto/api:go_default_library",
-        "@com_github_spf13_pflag//:go_default_library",
-        "@io_k8s_component_base//cli/flag:go_default_library",
-        "@io_k8s_kubectl//pkg/cmd/plugin:go_default_library",
-        "@io_k8s_kubectl//pkg/util/logs:go_default_library",
-        "@io_k8s_kubernetes//pkg/kubectl/cmd:go_default_library",
+        "//metropolis/pkg/logtree",
+        "//metropolis/proto/api",
+        "@io_k8s_cli_runtime//pkg/genericclioptions",
+        "@io_k8s_component_base//cli",
+        "@io_k8s_kubectl//pkg/cmd",
+        "@io_k8s_kubectl//pkg/cmd/plugin",
+        "@io_k8s_kubectl//pkg/cmd/util",
         "@org_golang_google_grpc//:go_default_library",
     ],
 )
 
 go_binary(
     name = "dbg",
-    embed = [":go_default_library"],
+    embed = [":dbg_lib"],
     visibility = ["//visibility:private"],
 )
diff --git a/metropolis/cli/dbg/main.go b/metropolis/cli/dbg/main.go
index 99aff6c..c2c0cb9 100644
--- a/metropolis/cli/dbg/main.go
+++ b/metropolis/cli/dbg/main.go
@@ -26,12 +26,12 @@
 	"strings"
 	"time"
 
-	"github.com/spf13/pflag"
 	"google.golang.org/grpc"
-	cliflag "k8s.io/component-base/cli/flag"
+	"k8s.io/cli-runtime/pkg/genericclioptions"
+	"k8s.io/component-base/cli"
+	"k8s.io/kubectl/pkg/cmd"
 	"k8s.io/kubectl/pkg/cmd/plugin"
-	"k8s.io/kubectl/pkg/util/logs"
-	"k8s.io/kubernetes/pkg/kubectl/cmd"
+	"k8s.io/kubectl/pkg/cmd/util"
 
 	"source.monogon.dev/metropolis/pkg/logtree"
 	apb "source.monogon.dev/metropolis/proto/api"
@@ -168,14 +168,15 @@
 		//   https://github.com/kubernetes/kubernetes/blob/master/cmd/kubectl/kubectl.go
 		os.Setenv("KUBECONFIG", kubeconfigFile.Name())
 		rand.Seed(time.Now().UnixNano())
-		pflag.CommandLine.SetNormalizeFunc(cliflag.WordSepNormalizeFunc)
-		pflag.CommandLine.AddGoFlagSet(flag.CommandLine)
-		logs.InitLogs()
-		defer logs.FlushLogs()
-		command := cmd.NewDefaultKubectlCommandWithArgs(cmd.NewDefaultPluginHandler(plugin.ValidPluginFilenamePrefixes), os.Args[2:], os.Stdin, os.Stdout, os.Stderr)
-		command.SetArgs(os.Args[2:])
-		if err := command.Execute(); err != nil {
-			os.Exit(1)
+		command := cmd.NewDefaultKubectlCommandWithArgs(cmd.KubectlOptions{
+			PluginHandler: cmd.NewDefaultPluginHandler(plugin.ValidPluginFilenamePrefixes),
+			Arguments:     os.Args[2:],
+			ConfigFlags:   genericclioptions.NewConfigFlags(true).WithDiscoveryBurst(300).WithDiscoveryQPS(50.0),
+			IOStreams:     genericclioptions.IOStreams{In: os.Stdin, Out: os.Stdout, ErrOut: os.Stderr},
+		})
+		if err := cli.RunNoErrOutput(command); err != nil {
+			// Pretty-print the error and exit with an error.
+			util.CheckErr(err)
 		}
 	case "trace":
 		traceCmd.Parse(os.Args[2:])
diff --git a/metropolis/cli/metroctl/BUILD.bazel b/metropolis/cli/metroctl/BUILD.bazel
index 8d4fee4..8175ca4 100644
--- a/metropolis/cli/metroctl/BUILD.bazel
+++ b/metropolis/cli/metroctl/BUILD.bazel
@@ -1,7 +1,7 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "metroctl_lib",
     srcs = [
         "credentials.go",
         "install.go",
@@ -11,27 +11,27 @@
     ],
     data = [
         "//metropolis/installer:kernel",
-        "//metropolis/node",
+        "//metropolis/node:bundle",
     ],
     importpath = "source.monogon.dev/metropolis/cli/metroctl",
     visibility = ["//visibility:private"],
     deps = [
-        "//metropolis/cli/metroctl/core:go_default_library",
-        "//metropolis/cli/pkg/context:go_default_library",
-        "//metropolis/cli/pkg/datafile:go_default_library",
-        "//metropolis/node:go_default_library",
-        "//metropolis/node/core/rpc:go_default_library",
-        "//metropolis/proto/api:go_default_library",
-        "@com_github_adrg_xdg//:go_default_library",
-        "@com_github_spf13_cobra//:go_default_library",
-        "@io_k8s_apimachinery//pkg/apis/meta/v1:go_default_library",
-        "@io_k8s_client_go//pkg/apis/clientauthentication/v1beta1:go_default_library",
+        "//metropolis/cli/metroctl/core",
+        "//metropolis/cli/pkg/context",
+        "//metropolis/cli/pkg/datafile",
+        "//metropolis/node",
+        "//metropolis/node/core/rpc",
+        "//metropolis/proto/api",
+        "@com_github_adrg_xdg//:xdg",
+        "@com_github_spf13_cobra//:cobra",
+        "@io_k8s_apimachinery//pkg/apis/meta/v1:meta",
+        "@io_k8s_client_go//pkg/apis/clientauthentication/v1beta1",
         "@org_golang_google_grpc//:go_default_library",
     ],
 )
 
 go_binary(
     name = "metroctl",
-    embed = [":go_default_library"],
+    embed = [":metroctl_lib"],
     visibility = ["//visibility:public"],
 )
diff --git a/metropolis/cli/metroctl/core/BUILD.bazel b/metropolis/cli/metroctl/core/BUILD.bazel
index 3c59706..cdde06b 100644
--- a/metropolis/cli/metroctl/core/BUILD.bazel
+++ b/metropolis/cli/metroctl/core/BUILD.bazel
@@ -1,7 +1,7 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "core",
     srcs = [
         "core.go",
         "install.go",
@@ -9,11 +9,11 @@
     importpath = "source.monogon.dev/metropolis/cli/metroctl/core",
     visibility = ["//visibility:public"],
     deps = [
-        "//metropolis/proto/api:go_default_library",
-        "@com_github_diskfs_go_diskfs//:go_default_library",
-        "@com_github_diskfs_go_diskfs//disk:go_default_library",
-        "@com_github_diskfs_go_diskfs//filesystem:go_default_library",
-        "@com_github_diskfs_go_diskfs//partition/gpt:go_default_library",
-        "@org_golang_google_protobuf//proto:go_default_library",
+        "//metropolis/proto/api",
+        "@com_github_diskfs_go_diskfs//:go-diskfs",
+        "@com_github_diskfs_go_diskfs//disk",
+        "@com_github_diskfs_go_diskfs//filesystem",
+        "@com_github_diskfs_go_diskfs//partition/gpt",
+        "@org_golang_google_protobuf//proto",
     ],
 )
diff --git a/metropolis/cli/pkg/context/BUILD.bazel b/metropolis/cli/pkg/context/BUILD.bazel
index b03a35d..2418a82 100644
--- a/metropolis/cli/pkg/context/BUILD.bazel
+++ b/metropolis/cli/pkg/context/BUILD.bazel
@@ -1,7 +1,7 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "context",
     srcs = ["context.go"],
     importpath = "source.monogon.dev/metropolis/cli/pkg/context",
     visibility = ["//visibility:public"],
diff --git a/metropolis/cli/pkg/datafile/BUILD.bazel b/metropolis/cli/pkg/datafile/BUILD.bazel
index 8628d9a..8c47aeb 100644
--- a/metropolis/cli/pkg/datafile/BUILD.bazel
+++ b/metropolis/cli/pkg/datafile/BUILD.bazel
@@ -1,7 +1,7 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "datafile",
     srcs = ["datafile.go"],
     importpath = "source.monogon.dev/metropolis/cli/pkg/datafile",
     visibility = ["//visibility:public"],
diff --git a/metropolis/installer/BUILD.bazel b/metropolis/installer/BUILD.bazel
index f4b125f..989a850 100644
--- a/metropolis/installer/BUILD.bazel
+++ b/metropolis/installer/BUILD.bazel
@@ -4,21 +4,21 @@
 load("//metropolis/node/build:efi.bzl", "efi_unified_kernel_image")
 
 go_library(
-    name = "go_default_library",
+    name = "installer_lib",
     srcs = ["main.go"],
     importpath = "source.monogon.dev/metropolis/installer",
     visibility = ["//visibility:private"],
     deps = [
-        "//metropolis/node/build/mkimage/osimage:go_default_library",
-        "//metropolis/pkg/efivarfs:go_default_library",
-        "//metropolis/pkg/sysfs:go_default_library",
-        "@org_golang_x_sys//unix:go_default_library",
+        "//metropolis/node/build/mkimage/osimage",
+        "//metropolis/pkg/efivarfs",
+        "//metropolis/pkg/sysfs",
+        "@org_golang_x_sys//unix",
     ],
 )
 
 go_binary(
     name = "installer",
-    embed = [":go_default_library"],
+    embed = [":installer_lib"],
     visibility = ["//visibility:private"],
 )
 
diff --git a/metropolis/installer/test/BUILD.bazel b/metropolis/installer/test/BUILD.bazel
index c958ac2..b296631 100644
--- a/metropolis/installer/test/BUILD.bazel
+++ b/metropolis/installer/test/BUILD.bazel
@@ -10,24 +10,24 @@
         "//third_party/edk2:firmware",
         "@qemu//:qemu-x86_64-softmmu",
     ],
-    embed = [":go_default_library"],
+    embed = [":test"],
     rundir = ".",
 )
 
 go_library(
-    name = "go_default_library",
+    name = "test",
     srcs = ["main.go"],
     importpath = "source.monogon.dev/metropolis/installer/test",
     visibility = ["//visibility:private"],
     deps = [
-        "//metropolis/cli/metroctl/core:go_default_library",
-        "//metropolis/cli/pkg/datafile:go_default_library",
-        "//metropolis/node/build/mkimage/osimage:go_default_library",
-        "//metropolis/pkg/logbuffer:go_default_library",
-        "//metropolis/proto/api:go_default_library",
-        "@com_github_diskfs_go_diskfs//:go_default_library",
-        "@com_github_diskfs_go_diskfs//disk:go_default_library",
-        "@com_github_diskfs_go_diskfs//partition/gpt:go_default_library",
+        "//metropolis/cli/metroctl/core",
+        "//metropolis/cli/pkg/datafile",
+        "//metropolis/node/build/mkimage/osimage",
+        "//metropolis/pkg/logbuffer",
+        "//metropolis/proto/api",
+        "@com_github_diskfs_go_diskfs//:go-diskfs",
+        "@com_github_diskfs_go_diskfs//disk",
+        "@com_github_diskfs_go_diskfs//partition/gpt",
     ],
 )
 
diff --git a/metropolis/installer/test/testos/BUILD b/metropolis/installer/test/testos/BUILD
index 0dcb8cb..9445e21 100644
--- a/metropolis/installer/test/testos/BUILD
+++ b/metropolis/installer/test/testos/BUILD
@@ -35,15 +35,15 @@
 )
 
 go_library(
-    name = "go_default_library",
+    name = "testos_lib",
     srcs = ["main.go"],
     importpath = "source.monogon.dev/metropolis/installer/test/testos",
     visibility = ["//visibility:private"],
-    deps = ["@org_golang_x_sys//unix:go_default_library"],
+    deps = ["@org_golang_x_sys//unix"],
 )
 
 go_binary(
     name = "testos",
-    embed = [":go_default_library"],
+    embed = [":testos_lib"],
     visibility = ["//visibility:public"],
 )
diff --git a/metropolis/node/BUILD.bazel b/metropolis/node/BUILD.bazel
index 893a481..d97cb60 100644
--- a/metropolis/node/BUILD.bazel
+++ b/metropolis/node/BUILD.bazel
@@ -6,7 +6,7 @@
 load("@rules_pkg//:pkg.bzl", "pkg_zip")
 
 go_library(
-    name = "go_default_library",
+    name = "node",
     srcs = [
         "ids.go",
         "ports.go",
@@ -70,8 +70,8 @@
         "@com_github_coredns_coredns//:coredns": "/kubernetes/bin/coredns",
 
         # runsc/gVisor
-        "@com_github_google_gvisor//runsc": "/containerd/bin/runsc",
-        "@com_github_google_gvisor//shim:containerd-shim-runsc-v1": "/containerd/bin/containerd-shim-runsc-v1",
+        "@dev_gvisor_gvisor//runsc": "/containerd/bin/runsc",
+        "@dev_gvisor_gvisor//shim": "/containerd/bin/containerd-shim-runsc-v1",
 
         # runc (runtime in files_cc because of cgo)
         "@com_github_containerd_containerd//cmd/containerd-shim-runc-v2": "/containerd/bin/containerd-shim-runc-v2",
@@ -85,8 +85,7 @@
         "//metropolis/node/kubernetes/containerd:cnispec.gojson": "/containerd/conf/cnispec.gojson",
 
         # Containerd preseed bundles
-        "//metropolis/test/e2e/preseedtest:preseedtest.tar": "/containerd/preseed/k8s.io/preseedtest.tar",
-        "//metropolis/test/e2e/k8s_cts:k8s_cts_image.tar": "/containerd/preseed/k8s.io/k8s_cts.tar",
+        "//metropolis/test/e2e/preseedtest:preseedtest_image.tar": "/containerd/preseed/k8s.io/preseedtest.tar",
         "//metropolis/vm/smoketest:smoketest_container.tar": "/containerd/preseed/k8s.io/smoketest.tar",
 
         # CNI Plugins
@@ -129,7 +128,7 @@
 # to the actual bundle format.
 # TODO(lorenz): Replace this
 pkg_zip(
-    name = "node",
+    name = "bundle",
     srcs = [
         ":kernel_efi",
         ":verity_rootfs",
diff --git a/metropolis/node/build/fsspec/BUILD.bazel b/metropolis/node/build/fsspec/BUILD.bazel
index e0ce66d..49ff9a0 100644
--- a/metropolis/node/build/fsspec/BUILD.bazel
+++ b/metropolis/node/build/fsspec/BUILD.bazel
@@ -9,7 +9,7 @@
 )
 
 go_library(
-    name = "go_default_library",
+    name = "fsspec",
     srcs = ["utils.go"],
     embed = [":fsspec_go_proto"],
     importpath = "source.monogon.dev/metropolis/node/build/fsspec",
diff --git a/metropolis/node/build/fwprune/BUILD.bazel b/metropolis/node/build/fwprune/BUILD.bazel
index 18e83b1..578b829 100644
--- a/metropolis/node/build/fwprune/BUILD.bazel
+++ b/metropolis/node/build/fwprune/BUILD.bazel
@@ -1,18 +1,18 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "fwprune_lib",
     srcs = ["main.go"],
     importpath = "source.monogon.dev/metropolis/node/build/fwprune",
     visibility = ["//visibility:private"],
     deps = [
-        "//metropolis/node/build/fsspec:go_default_library",
-        "@org_golang_google_protobuf//encoding/prototext:go_default_library",
+        "//metropolis/node/build/fsspec",
+        "@org_golang_google_protobuf//encoding/prototext",
     ],
 )
 
 go_binary(
     name = "fwprune",
-    embed = [":go_default_library"],
+    embed = [":fwprune_lib"],
     visibility = ["//visibility:public"],
 )
diff --git a/metropolis/node/build/genosrelease/BUILD.bazel b/metropolis/node/build/genosrelease/BUILD.bazel
index b48b602..5ac09d5 100644
--- a/metropolis/node/build/genosrelease/BUILD.bazel
+++ b/metropolis/node/build/genosrelease/BUILD.bazel
@@ -1,16 +1,16 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "genosrelease_lib",
     srcs = ["main.go"],
     importpath = "source.monogon.dev/metropolis/node/build/genosrelease",
     visibility = ["//visibility:private"],
-    deps = ["@com_github_joho_godotenv//:go_default_library"],
+    deps = ["@com_github_joho_godotenv//:godotenv"],
 )
 
 go_binary(
     name = "genosrelease",
-    embed = [":go_default_library"],
+    embed = [":genosrelease_lib"],
     visibility = [
         "//metropolis/installer:__subpackages__",
         "//metropolis/node:__subpackages__",
diff --git a/metropolis/node/build/kconfig-patcher/BUILD.bazel b/metropolis/node/build/kconfig-patcher/BUILD.bazel
index ee97c39..e838f9e 100644
--- a/metropolis/node/build/kconfig-patcher/BUILD.bazel
+++ b/metropolis/node/build/kconfig-patcher/BUILD.bazel
@@ -1,7 +1,7 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library", "go_test")
 
 go_library(
-    name = "go_default_library",
+    name = "kconfig-patcher_lib",
     srcs = ["main.go"],
     importpath = "source.monogon.dev/metropolis/node/build/kconfig-patcher",
     visibility = ["//visibility:private"],
@@ -9,7 +9,7 @@
 
 go_binary(
     name = "kconfig-patcher",
-    embed = [":go_default_library"],
+    embed = [":kconfig-patcher_lib"],
     visibility = [
         "//metropolis/node:__pkg__",
         "//metropolis/test/ktest:__pkg__",
@@ -17,7 +17,7 @@
 )
 
 go_test(
-    name = "go_default_test",
+    name = "kconfig-patcher_test",
     srcs = ["main_test.go"],
-    embed = [":go_default_library"],
+    embed = [":kconfig-patcher_lib"],
 )
diff --git a/metropolis/node/build/mkcpio/BUILD.bazel b/metropolis/node/build/mkcpio/BUILD.bazel
index 5a93d3a..f0bb779 100644
--- a/metropolis/node/build/mkcpio/BUILD.bazel
+++ b/metropolis/node/build/mkcpio/BUILD.bazel
@@ -1,20 +1,20 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "mkcpio_lib",
     srcs = ["main.go"],
     importpath = "source.monogon.dev/metropolis/node/build/mkcpio",
     visibility = ["//visibility:private"],
     deps = [
-        "//metropolis/node/build/fsspec:go_default_library",
-        "@com_github_cavaliergopher_cpio//:go_default_library",
-        "@com_github_pierrec_lz4_v4//:go_default_library",
-        "@org_golang_x_sys//unix:go_default_library",
+        "//metropolis/node/build/fsspec",
+        "@com_github_cavaliergopher_cpio//:cpio",
+        "@com_github_pierrec_lz4_v4//:lz4",
+        "@org_golang_x_sys//unix",
     ],
 )
 
 go_binary(
     name = "mkcpio",
-    embed = [":go_default_library"],
+    embed = [":mkcpio_lib"],
     visibility = ["//visibility:public"],
 )
diff --git a/metropolis/node/build/mkcpio/main.go b/metropolis/node/build/mkcpio/main.go
index 10deb5a..bde7082 100644
--- a/metropolis/node/build/mkcpio/main.go
+++ b/metropolis/node/build/mkcpio/main.go
@@ -174,7 +174,7 @@
 			inF.Close()
 		case *fsspec.Directory:
 			if err := cpioWriter.WriteHeader(&cpio.Header{
-				Mode: cpio.FileMode(i.Mode) | cpio.ModeDir,
+				Mode: cpio.FileMode(i.Mode) | cpio.TypeDir,
 				Name: strings.TrimPrefix(i.Path, "/"),
 			}); err != nil {
 				log.Fatalf("Failed to write cpio header for directory %q: %v", i.Path, err)
@@ -182,7 +182,7 @@
 		case *fsspec.SymbolicLink:
 			if err := cpioWriter.WriteHeader(&cpio.Header{
 				// Symlinks are 0777 by definition (from man 7 symlink on Linux)
-				Mode:     0777 | cpio.ModeSymlink,
+				Mode:     0777 | cpio.TypeSymlink,
 				Name:     strings.TrimPrefix(i.Path, "/"),
 				Linkname: i.TargetPath,
 			}); err != nil {
@@ -192,11 +192,11 @@
 			mode := cpio.FileMode(i.Mode)
 			switch i.Type {
 			case fsspec.SpecialFile_CHARACTER_DEV:
-				mode |= cpio.ModeCharDevice
+				mode |= cpio.TypeChar
 			case fsspec.SpecialFile_BLOCK_DEV:
-				mode |= cpio.ModeDevice
+				mode |= cpio.TypeBlock
 			case fsspec.SpecialFile_FIFO:
-				mode |= cpio.ModeNamedPipe
+				mode |= cpio.TypeFifo
 			}
 
 			if err := cpioWriter.WriteHeader(&cpio.Header{
diff --git a/metropolis/node/build/mkerofs/BUILD.bazel b/metropolis/node/build/mkerofs/BUILD.bazel
index 43e2f5c..73fda98 100644
--- a/metropolis/node/build/mkerofs/BUILD.bazel
+++ b/metropolis/node/build/mkerofs/BUILD.bazel
@@ -1,18 +1,18 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "mkerofs_lib",
     srcs = ["main.go"],
     importpath = "source.monogon.dev/metropolis/node/build/mkerofs",
     visibility = ["//visibility:public"],
     deps = [
-        "//metropolis/node/build/fsspec:go_default_library",
-        "//metropolis/pkg/erofs:go_default_library",
+        "//metropolis/node/build/fsspec",
+        "//metropolis/pkg/erofs",
     ],
 )
 
 go_binary(
     name = "mkerofs",
-    embed = [":go_default_library"],
+    embed = [":mkerofs_lib"],
     visibility = ["//visibility:public"],
 )
diff --git a/metropolis/node/build/mkimage/BUILD.bazel b/metropolis/node/build/mkimage/BUILD.bazel
index a18bb85..2bf8229 100644
--- a/metropolis/node/build/mkimage/BUILD.bazel
+++ b/metropolis/node/build/mkimage/BUILD.bazel
@@ -1,15 +1,15 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "mkimage_lib",
     srcs = ["main.go"],
     importpath = "source.monogon.dev/metropolis/node/build/mkimage",
     visibility = ["//visibility:private"],
-    deps = ["//metropolis/node/build/mkimage/osimage:go_default_library"],
+    deps = ["//metropolis/node/build/mkimage/osimage"],
 )
 
 go_binary(
     name = "mkimage",
-    embed = [":go_default_library"],
+    embed = [":mkimage_lib"],
     visibility = ["//metropolis/node:__pkg__"],
 )
diff --git a/metropolis/node/build/mkimage/osimage/BUILD.bazel b/metropolis/node/build/mkimage/osimage/BUILD.bazel
index 88f1dd8..35bfb9c 100644
--- a/metropolis/node/build/mkimage/osimage/BUILD.bazel
+++ b/metropolis/node/build/mkimage/osimage/BUILD.bazel
@@ -1,16 +1,16 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "osimage",
     srcs = ["osimage.go"],
     importpath = "source.monogon.dev/metropolis/node/build/mkimage/osimage",
     visibility = ["//visibility:public"],
     deps = [
-        "//metropolis/pkg/efivarfs:go_default_library",
-        "@com_github_diskfs_go_diskfs//:go_default_library",
-        "@com_github_diskfs_go_diskfs//disk:go_default_library",
-        "@com_github_diskfs_go_diskfs//filesystem:go_default_library",
-        "@com_github_diskfs_go_diskfs//partition/gpt:go_default_library",
-        "@com_github_google_uuid//:go_default_library",
+        "//metropolis/pkg/efivarfs",
+        "@com_github_diskfs_go_diskfs//:go-diskfs",
+        "@com_github_diskfs_go_diskfs//disk",
+        "@com_github_diskfs_go_diskfs//filesystem",
+        "@com_github_diskfs_go_diskfs//partition/gpt",
+        "@com_github_google_uuid//:uuid",
     ],
 )
diff --git a/metropolis/node/build/mkpayload/BUILD.bazel b/metropolis/node/build/mkpayload/BUILD.bazel
index 7716e60..b092791 100644
--- a/metropolis/node/build/mkpayload/BUILD.bazel
+++ b/metropolis/node/build/mkpayload/BUILD.bazel
@@ -2,12 +2,12 @@
 
 go_binary(
     name = "mkpayload",
-    embed = [":go_default_library"],
+    embed = [":mkpayload_lib"],
     visibility = ["//visibility:public"],
 )
 
 go_library(
-    name = "go_default_library",
+    name = "mkpayload_lib",
     srcs = ["mkpayload.go"],
     importpath = "source.monogon.dev/metropolis/node/build/mkpayload",
     visibility = ["//visibility:private"],
diff --git a/metropolis/node/build/mkucode/BUILD.bazel b/metropolis/node/build/mkucode/BUILD.bazel
index 5f310c2..c1f5667 100644
--- a/metropolis/node/build/mkucode/BUILD.bazel
+++ b/metropolis/node/build/mkucode/BUILD.bazel
@@ -1,19 +1,19 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "mkucode_lib",
     srcs = ["main.go"],
     importpath = "source.monogon.dev/metropolis/node/build/mkucode",
     visibility = ["//visibility:private"],
     deps = [
-        "//metropolis/node/build/mkucode/spec:go_default_library",
-        "@com_github_cavaliergopher_cpio//:go_default_library",
-        "@org_golang_google_protobuf//encoding/prototext:go_default_library",
+        "//metropolis/node/build/mkucode/spec",
+        "@com_github_cavaliergopher_cpio//:cpio",
+        "@org_golang_google_protobuf//encoding/prototext",
     ],
 )
 
 go_binary(
     name = "mkucode",
-    embed = [":go_default_library"],
+    embed = [":mkucode_lib"],
     visibility = ["//visibility:public"],
 )
diff --git a/metropolis/node/build/mkucode/spec/BUILD.bazel b/metropolis/node/build/mkucode/spec/BUILD.bazel
index f41e2e9..84e7c7b 100644
--- a/metropolis/node/build/mkucode/spec/BUILD.bazel
+++ b/metropolis/node/build/mkucode/spec/BUILD.bazel
@@ -16,7 +16,7 @@
 )
 
 go_library(
-    name = "go_default_library",
+    name = "spec",
     embed = [":spec_go_proto"],
     importpath = "source.monogon.dev/metropolis/node/build/mkucode/spec",
     visibility = ["//visibility:public"],
diff --git a/metropolis/node/build/mkverity/BUILD.bazel b/metropolis/node/build/mkverity/BUILD.bazel
index 2fe6768..faf7908 100644
--- a/metropolis/node/build/mkverity/BUILD.bazel
+++ b/metropolis/node/build/mkverity/BUILD.bazel
@@ -2,7 +2,7 @@
 
 go_binary(
     name = "mkverity",
-    embed = [":go_default_library"],
+    embed = [":mkverity_lib"],
     visibility = [
         "//metropolis/installer/test/testos:__pkg__",
         "//metropolis/node:__pkg__",
@@ -10,9 +10,9 @@
 )
 
 go_library(
-    name = "go_default_library",
+    name = "mkverity_lib",
     srcs = ["mkverity.go"],
     importpath = "source.monogon.dev/metropolis/node/build/mkverity",
     visibility = ["//visibility:private"],
-    deps = ["//metropolis/pkg/verity:go_default_library"],
+    deps = ["//metropolis/pkg/verity"],
 )
diff --git a/metropolis/node/core/BUILD.bazel b/metropolis/node/core/BUILD.bazel
index 651e9df..6d2c9c3 100644
--- a/metropolis/node/core/BUILD.bazel
+++ b/metropolis/node/core/BUILD.bazel
@@ -1,7 +1,7 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "core_lib",
     # keep
     srcs = [
         "main.go",
@@ -19,30 +19,30 @@
     importpath = "source.monogon.dev/metropolis/node/core",
     visibility = ["//visibility:private"],
     deps = [
-        "//metropolis/node:go_default_library",
-        "//metropolis/node/core/cluster:go_default_library",
-        "//metropolis/node/core/localstorage:go_default_library",
-        "//metropolis/node/core/localstorage/declarative:go_default_library",
-        "//metropolis/node/core/network:go_default_library",
-        "//metropolis/node/core/network/hostsfile:go_default_library",
-        "//metropolis/node/core/roleserve:go_default_library",
-        "//metropolis/node/core/time:go_default_library",
-        "//metropolis/pkg/logtree:go_default_library",
-        "//metropolis/pkg/supervisor:go_default_library",
-        "//metropolis/pkg/tpm:go_default_library",
-        "//metropolis/proto/api:go_default_library",
-        "@com_github_containerd_containerd//:go_default_library",
-        "@com_github_containerd_containerd//namespaces:go_default_library",
+        "//metropolis/node",
+        "//metropolis/node/core/cluster",
+        "//metropolis/node/core/localstorage",
+        "//metropolis/node/core/localstorage/declarative",
+        "//metropolis/node/core/network",
+        "//metropolis/node/core/network/hostsfile",
+        "//metropolis/node/core/roleserve",
+        "//metropolis/node/core/time",
+        "//metropolis/pkg/logtree",
+        "//metropolis/pkg/supervisor",
+        "//metropolis/pkg/tpm",
+        "//metropolis/proto/api",
+        "@com_github_containerd_containerd//:containerd",
+        "@com_github_containerd_containerd//namespaces",
         "@org_golang_google_grpc//:go_default_library",
-        "@org_golang_google_grpc//codes:go_default_library",
-        "@org_golang_google_grpc//status:go_default_library",
-        "@org_golang_x_sys//unix:go_default_library",
+        "@org_golang_google_grpc//codes",
+        "@org_golang_google_grpc//status",
+        "@org_golang_x_sys//unix",
     ],
 )
 
 go_binary(
     name = "core",
-    embed = [":go_default_library"],
+    embed = [":core_lib"],
     pure = "on",  # keep
     visibility = ["//metropolis/node:__pkg__"],
 )
diff --git a/metropolis/node/core/cluster/BUILD.bazel b/metropolis/node/core/cluster/BUILD.bazel
index 93cc5de..78078bb 100644
--- a/metropolis/node/core/cluster/BUILD.bazel
+++ b/metropolis/node/core/cluster/BUILD.bazel
@@ -1,7 +1,7 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "cluster",
     srcs = [
         "cluster.go",
         "cluster_bootstrap.go",
@@ -11,20 +11,20 @@
     importpath = "source.monogon.dev/metropolis/node/core/cluster",
     visibility = ["//metropolis/node/core:__subpackages__"],
     deps = [
-        "//metropolis/node:go_default_library",
-        "//metropolis/node/core/consensus:go_default_library",
-        "//metropolis/node/core/curator/proto/api:go_default_library",
-        "//metropolis/node/core/identity:go_default_library",
-        "//metropolis/node/core/localstorage:go_default_library",
-        "//metropolis/node/core/network:go_default_library",
-        "//metropolis/node/core/roleserve:go_default_library",
-        "//metropolis/node/core/rpc:go_default_library",
-        "//metropolis/pkg/event/memory:go_default_library",
-        "//metropolis/pkg/supervisor:go_default_library",
-        "//metropolis/proto/api:go_default_library",
-        "//metropolis/proto/private:go_default_library",
-        "@com_github_cenkalti_backoff_v4//:go_default_library",
+        "//metropolis/node",
+        "//metropolis/node/core/consensus",
+        "//metropolis/node/core/curator/proto/api",
+        "//metropolis/node/core/identity",
+        "//metropolis/node/core/localstorage",
+        "//metropolis/node/core/network",
+        "//metropolis/node/core/roleserve",
+        "//metropolis/node/core/rpc",
+        "//metropolis/pkg/event/memory",
+        "//metropolis/pkg/supervisor",
+        "//metropolis/proto/api",
+        "//metropolis/proto/private",
+        "@com_github_cenkalti_backoff_v4//:backoff",
         "@org_golang_google_grpc//:go_default_library",
-        "@org_golang_google_protobuf//proto:go_default_library",
+        "@org_golang_google_protobuf//proto",
     ],
 )
diff --git a/metropolis/node/core/consensus/BUILD.bazel b/metropolis/node/core/consensus/BUILD.bazel
index c4f65ec..693f789 100644
--- a/metropolis/node/core/consensus/BUILD.bazel
+++ b/metropolis/node/core/consensus/BUILD.bazel
@@ -1,7 +1,7 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
 
 go_library(
-    name = "go_default_library",
+    name = "consensus",
     srcs = [
         "configuration.go",
         "consensus.go",
@@ -12,30 +12,30 @@
     importpath = "source.monogon.dev/metropolis/node/core/consensus",
     visibility = ["//:__subpackages__"],
     deps = [
-        "//metropolis/node:go_default_library",
-        "//metropolis/node/core/consensus/client:go_default_library",
-        "//metropolis/node/core/identity:go_default_library",
-        "//metropolis/node/core/localstorage:go_default_library",
-        "//metropolis/pkg/event:go_default_library",
-        "//metropolis/pkg/event/memory:go_default_library",
-        "//metropolis/pkg/logbuffer:go_default_library",
-        "//metropolis/pkg/logtree:go_default_library",
-        "//metropolis/pkg/logtree/unraw:go_default_library",
-        "//metropolis/pkg/pki:go_default_library",
-        "//metropolis/pkg/supervisor:go_default_library",
-        "@io_etcd_go_etcd//clientv3:go_default_library",
-        "@io_etcd_go_etcd//embed:go_default_library",
+        "//metropolis/node",
+        "//metropolis/node/core/consensus/client",
+        "//metropolis/node/core/identity",
+        "//metropolis/node/core/localstorage",
+        "//metropolis/pkg/event",
+        "//metropolis/pkg/event/memory",
+        "//metropolis/pkg/logbuffer",
+        "//metropolis/pkg/logtree",
+        "//metropolis/pkg/logtree/unraw",
+        "//metropolis/pkg/pki",
+        "//metropolis/pkg/supervisor",
+        "@io_etcd_go_etcd_client_v3//:client",
+        "@io_etcd_go_etcd_server_v3//embed",
     ],
 )
 
 go_test(
-    name = "go_default_test",
+    name = "consensus_test",
     size = "small",
     srcs = [
         "consensus_test.go",
         "logparser_test.go",
     ],
-    embed = [":go_default_library"],
+    embed = [":consensus"],
     tags = [
         # Enable network sandboxing by asking the Bazel executor to block any
         # network access. This is necessary as tests listen on static ports on
@@ -43,11 +43,11 @@
         "block-network",
     ],
     deps = [
-        "//metropolis/node/core/localstorage:go_default_library",
-        "//metropolis/node/core/localstorage/declarative:go_default_library",
-        "//metropolis/pkg/logbuffer:go_default_library",
-        "//metropolis/pkg/logtree:go_default_library",
-        "//metropolis/pkg/supervisor:go_default_library",
-        "@com_github_google_go_cmp//cmp:go_default_library",
+        "//metropolis/node/core/localstorage",
+        "//metropolis/node/core/localstorage/declarative",
+        "//metropolis/pkg/logbuffer",
+        "//metropolis/pkg/logtree",
+        "//metropolis/pkg/supervisor",
+        "@com_github_google_go_cmp//cmp",
     ],
 )
diff --git a/metropolis/node/core/consensus/client/BUILD.bazel b/metropolis/node/core/consensus/client/BUILD.bazel
index a98eaf5..23c6c14 100644
--- a/metropolis/node/core/consensus/client/BUILD.bazel
+++ b/metropolis/node/core/consensus/client/BUILD.bazel
@@ -1,7 +1,7 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "client",
     srcs = [
         "client.go",
         "unimplemented.go",
@@ -9,7 +9,7 @@
     importpath = "source.monogon.dev/metropolis/node/core/consensus/client",
     visibility = ["//visibility:public"],
     deps = [
-        "@io_etcd_go_etcd//clientv3:go_default_library",
-        "@io_etcd_go_etcd//clientv3/namespace:go_default_library",
+        "@io_etcd_go_etcd_client_v3//:client",
+        "@io_etcd_go_etcd_client_v3//namespace",
     ],
 )
diff --git a/metropolis/node/core/consensus/client/client.go b/metropolis/node/core/consensus/client/client.go
index 1304cf1..821919b 100644
--- a/metropolis/node/core/consensus/client/client.go
+++ b/metropolis/node/core/consensus/client/client.go
@@ -25,8 +25,8 @@
 	"fmt"
 	"strings"
 
-	"go.etcd.io/etcd/clientv3"
-	"go.etcd.io/etcd/clientv3/namespace"
+	clientv3 "go.etcd.io/etcd/client/v3"
+	"go.etcd.io/etcd/client/v3/namespace"
 )
 
 // Namespaced etcd/consensus client. Each Namespaced client allows access to a
diff --git a/metropolis/node/core/consensus/client/unimplemented.go b/metropolis/node/core/consensus/client/unimplemented.go
index b0bb695..047e8ee 100644
--- a/metropolis/node/core/consensus/client/unimplemented.go
+++ b/metropolis/node/core/consensus/client/unimplemented.go
@@ -5,7 +5,7 @@
 	"errors"
 	"io"
 
-	"go.etcd.io/etcd/clientv3"
+	clientv3 "go.etcd.io/etcd/client/v3"
 )
 
 var (
@@ -59,6 +59,10 @@
 	panic(UnimplementedInNamespaced)
 }
 
+func (c *unimplementedAuth) AuthStatus(ctx context.Context) (*clientv3.AuthStatusResponse, error) {
+	panic(UnimplementedInNamespaced)
+}
+
 func (c *unimplementedAuth) UserAdd(ctx context.Context, name string, password string) (*clientv3.AuthUserAddResponse, error) {
 	panic(UnimplementedInNamespaced)
 }
diff --git a/metropolis/node/core/consensus/configuration.go b/metropolis/node/core/consensus/configuration.go
index 1e7cff6..552b81d 100644
--- a/metropolis/node/core/consensus/configuration.go
+++ b/metropolis/node/core/consensus/configuration.go
@@ -9,8 +9,8 @@
 	"strconv"
 	"time"
 
-	"go.etcd.io/etcd/clientv3"
-	"go.etcd.io/etcd/embed"
+	clientv3 "go.etcd.io/etcd/client/v3"
+	"go.etcd.io/etcd/server/v3/embed"
 
 	"source.monogon.dev/metropolis/node"
 	"source.monogon.dev/metropolis/node/core/identity"
diff --git a/metropolis/node/core/consensus/consensus.go b/metropolis/node/core/consensus/consensus.go
index d4ab964..1137556 100644
--- a/metropolis/node/core/consensus/consensus.go
+++ b/metropolis/node/core/consensus/consensus.go
@@ -94,8 +94,8 @@
 	"math/big"
 	"time"
 
-	"go.etcd.io/etcd/clientv3"
-	"go.etcd.io/etcd/embed"
+	clientv3 "go.etcd.io/etcd/client/v3"
+	"go.etcd.io/etcd/server/v3/embed"
 
 	"source.monogon.dev/metropolis/node/core/consensus/client"
 	"source.monogon.dev/metropolis/node/core/identity"
diff --git a/metropolis/node/core/consensus/status.go b/metropolis/node/core/consensus/status.go
index 43a70fd..e2b15f8 100644
--- a/metropolis/node/core/consensus/status.go
+++ b/metropolis/node/core/consensus/status.go
@@ -8,7 +8,7 @@
 	"net"
 	"strconv"
 
-	"go.etcd.io/etcd/clientv3"
+	clientv3 "go.etcd.io/etcd/client/v3"
 
 	"source.monogon.dev/metropolis/node"
 	"source.monogon.dev/metropolis/node/core/consensus/client"
diff --git a/metropolis/node/core/consensus/testhelpers.go b/metropolis/node/core/consensus/testhelpers.go
index 627a278..32bbc46 100644
--- a/metropolis/node/core/consensus/testhelpers.go
+++ b/metropolis/node/core/consensus/testhelpers.go
@@ -4,7 +4,7 @@
 	"context"
 	"testing"
 
-	"go.etcd.io/etcd/clientv3"
+	clientv3 "go.etcd.io/etcd/client/v3"
 
 	"source.monogon.dev/metropolis/pkg/event/memory"
 )
diff --git a/metropolis/node/core/curator/BUILD.bazel b/metropolis/node/core/curator/BUILD.bazel
index 90ae216..c13282e 100644
--- a/metropolis/node/core/curator/BUILD.bazel
+++ b/metropolis/node/core/curator/BUILD.bazel
@@ -1,7 +1,7 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
 
 go_library(
-    name = "go_default_library",
+    name = "curator",
     srcs = [
         "bootstrap.go",
         "curator.go",
@@ -19,57 +19,58 @@
     importpath = "source.monogon.dev/metropolis/node/core/curator",
     visibility = ["//visibility:public"],
     deps = [
-        "//metropolis/node:go_default_library",
-        "//metropolis/node/core/consensus:go_default_library",
-        "//metropolis/node/core/consensus/client:go_default_library",
-        "//metropolis/node/core/curator/proto/api:go_default_library",
-        "//metropolis/node/core/curator/proto/private:go_default_library",
-        "//metropolis/node/core/identity:go_default_library",
-        "//metropolis/node/core/rpc:go_default_library",
-        "//metropolis/pkg/combinectx:go_default_library",
-        "//metropolis/pkg/event:go_default_library",
-        "//metropolis/pkg/event/etcd:go_default_library",
-        "//metropolis/pkg/event/memory:go_default_library",
-        "//metropolis/pkg/pki:go_default_library",
-        "//metropolis/pkg/supervisor:go_default_library",
-        "//metropolis/proto/api:go_default_library",
-        "//metropolis/proto/common:go_default_library",
-        "@io_etcd_go_etcd//clientv3:go_default_library",
-        "@io_etcd_go_etcd//clientv3/concurrency:go_default_library",
+        "//metropolis/node",
+        "//metropolis/node/core/consensus",
+        "//metropolis/node/core/consensus/client",
+        "//metropolis/node/core/curator/proto/api",
+        "//metropolis/node/core/curator/proto/private",
+        "//metropolis/node/core/identity",
+        "//metropolis/node/core/rpc",
+        "//metropolis/pkg/combinectx",
+        "//metropolis/pkg/event",
+        "//metropolis/pkg/event/etcd",
+        "//metropolis/pkg/event/memory",
+        "//metropolis/pkg/pki",
+        "//metropolis/pkg/supervisor",
+        "//metropolis/proto/api",
+        "//metropolis/proto/common",
+        "@io_etcd_go_etcd_client_v3//:client",
+        "@io_etcd_go_etcd_client_v3//concurrency",
         "@org_golang_google_grpc//:go_default_library",
-        "@org_golang_google_grpc//codes:go_default_library",
-        "@org_golang_google_grpc//status:go_default_library",
-        "@org_golang_google_protobuf//proto:go_default_library",
+        "@org_golang_google_grpc//codes",
+        "@org_golang_google_grpc//status",
+        "@org_golang_google_protobuf//proto",
     ],
 )
 
 go_test(
-    name = "go_default_test",
+    name = "curator_test",
     srcs = [
         "curator_test.go",
         "impl_leader_test.go",
         "listener_test.go",
         "state_test.go",
     ],
-    embed = [":go_default_library"],
+    embed = [":curator"],
     deps = [
-        "//metropolis/node/core/consensus:go_default_library",
-        "//metropolis/node/core/consensus/client:go_default_library",
-        "//metropolis/node/core/curator/proto/api:go_default_library",
-        "//metropolis/node/core/curator/proto/private:go_default_library",
-        "//metropolis/node/core/identity:go_default_library",
-        "//metropolis/node/core/rpc:go_default_library",
-        "//metropolis/pkg/event/memory:go_default_library",
-        "//metropolis/pkg/pki:go_default_library",
-        "//metropolis/pkg/supervisor:go_default_library",
-        "//metropolis/proto/api:go_default_library",
-        "//metropolis/proto/common:go_default_library",
-        "@io_etcd_go_etcd//clientv3:go_default_library",
-        "@io_etcd_go_etcd//integration:go_default_library",
+        "//metropolis/node/core/consensus",
+        "//metropolis/node/core/consensus/client",
+        "//metropolis/node/core/curator/proto/api",
+        "//metropolis/node/core/curator/proto/private",
+        "//metropolis/node/core/identity",
+        "//metropolis/node/core/rpc",
+        "//metropolis/pkg/event/memory",
+        "//metropolis/pkg/pki",
+        "//metropolis/pkg/supervisor",
+        "//metropolis/proto/api",
+        "//metropolis/proto/common",
+        "@io_etcd_go_etcd_client_pkg_v3//testutil",
+        "@io_etcd_go_etcd_client_v3//:client",
+        "@io_etcd_go_etcd_tests_v3//integration",
         "@org_golang_google_grpc//:go_default_library",
-        "@org_golang_google_grpc//codes:go_default_library",
-        "@org_golang_google_grpc//status:go_default_library",
-        "@org_golang_google_grpc//test/bufconn:go_default_library",
-        "@org_golang_google_protobuf//proto:go_default_library",
+        "@org_golang_google_grpc//codes",
+        "@org_golang_google_grpc//status",
+        "@org_golang_google_grpc//test/bufconn",
+        "@org_golang_google_protobuf//proto",
     ],
 )
diff --git a/metropolis/node/core/curator/bootstrap.go b/metropolis/node/core/curator/bootstrap.go
index d05a764..12b24fd 100644
--- a/metropolis/node/core/curator/bootstrap.go
+++ b/metropolis/node/core/curator/bootstrap.go
@@ -5,7 +5,7 @@
 	"crypto/x509"
 	"fmt"
 
-	"go.etcd.io/etcd/clientv3"
+	clientv3 "go.etcd.io/etcd/client/v3"
 	"google.golang.org/protobuf/proto"
 
 	"source.monogon.dev/metropolis/node/core/consensus"
diff --git a/metropolis/node/core/curator/curator.go b/metropolis/node/core/curator/curator.go
index 5d6eedd..d6ec579 100644
--- a/metropolis/node/core/curator/curator.go
+++ b/metropolis/node/core/curator/curator.go
@@ -19,7 +19,7 @@
 	"fmt"
 	"time"
 
-	"go.etcd.io/etcd/clientv3/concurrency"
+	"go.etcd.io/etcd/client/v3/concurrency"
 	"google.golang.org/protobuf/proto"
 
 	"source.monogon.dev/metropolis/node/core/consensus"
diff --git a/metropolis/node/core/curator/curator_test.go b/metropolis/node/core/curator/curator_test.go
index cd5889b..3ea66a0 100644
--- a/metropolis/node/core/curator/curator_test.go
+++ b/metropolis/node/core/curator/curator_test.go
@@ -2,13 +2,15 @@
 
 import (
 	"context"
+	"flag"
 	"fmt"
 	"os"
 	"testing"
 	"time"
 
-	"go.etcd.io/etcd/clientv3"
-	"go.etcd.io/etcd/integration"
+	"go.etcd.io/etcd/client/pkg/v3/testutil"
+	clientv3 "go.etcd.io/etcd/client/v3"
+	"go.etcd.io/etcd/tests/v3/integration"
 
 	"source.monogon.dev/metropolis/node/core/consensus"
 	"source.monogon.dev/metropolis/node/core/identity"
@@ -29,14 +31,21 @@
 		Size:                 3,
 		GRPCKeepAliveMinTime: time.Millisecond,
 	}
-	cluster = integration.NewClusterV3(nil, &cfg)
+	t, cancel := testutil.NewTestingTBProthesis("curator")
+	defer cancel()
+
+	flag.Parse()
+
+	integration.BeforeTest(t)
+
+	cluster = integration.NewClusterV3(t, &cfg)
 	endpoints = make([]string, 3)
 	for i := range endpoints {
 		endpoints[i] = cluster.Client(i).Endpoints()[0]
 	}
 
 	v := m.Run()
-	cluster.Terminate(nil)
+	cluster.Terminate(t)
 	os.Exit(v)
 }
 
diff --git a/metropolis/node/core/curator/impl_leader.go b/metropolis/node/core/curator/impl_leader.go
index 75ede5d..d6894a2 100644
--- a/metropolis/node/core/curator/impl_leader.go
+++ b/metropolis/node/core/curator/impl_leader.go
@@ -7,7 +7,7 @@
 	"strings"
 	"sync"
 
-	"go.etcd.io/etcd/clientv3"
+	clientv3 "go.etcd.io/etcd/client/v3"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
 
diff --git a/metropolis/node/core/curator/impl_leader_test.go b/metropolis/node/core/curator/impl_leader_test.go
index b07b49f..7254fab 100644
--- a/metropolis/node/core/curator/impl_leader_test.go
+++ b/metropolis/node/core/curator/impl_leader_test.go
@@ -11,7 +11,7 @@
 	"net"
 	"testing"
 
-	"go.etcd.io/etcd/integration"
+	"go.etcd.io/etcd/tests/v3/integration"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/test/bufconn"
 	"google.golang.org/protobuf/proto"
@@ -44,13 +44,14 @@
 	ctx, ctxC := context.WithCancel(context.Background())
 
 	// Start a single-node etcd cluster.
-	cluster := integration.NewClusterV3(nil, &integration.ClusterConfig{
+	integration.BeforeTest(t)
+	cluster := integration.NewClusterV3(t, &integration.ClusterConfig{
 		Size: 1,
 	})
 	// Terminate the etcd cluster on context cancel.
 	go func() {
 		<-ctx.Done()
-		cluster.Terminate(nil)
+		cluster.Terminate(t)
 	}()
 
 	// Create etcd client to test cluster.
diff --git a/metropolis/node/core/curator/proto/api/BUILD.bazel b/metropolis/node/core/curator/proto/api/BUILD.bazel
index 2cec346..dbc1cbf 100644
--- a/metropolis/node/core/curator/proto/api/BUILD.bazel
+++ b/metropolis/node/core/curator/proto/api/BUILD.bazel
@@ -19,13 +19,13 @@
     proto = ":api_proto",
     visibility = ["//visibility:public"],
     deps = [
-        "//metropolis/proto/common:go_default_library",
-        "//metropolis/proto/ext:go_default_library",
+        "//metropolis/proto/common",
+        "//metropolis/proto/ext",
     ],
 )
 
 go_library(
-    name = "go_default_library",
+    name = "api",
     embed = [":api_go_proto"],
     importpath = "source.monogon.dev/metropolis/node/core/curator/proto/api",
     visibility = ["//visibility:public"],
diff --git a/metropolis/node/core/curator/proto/private/BUILD.bazel b/metropolis/node/core/curator/proto/private/BUILD.bazel
index e3c032d..a731e06 100644
--- a/metropolis/node/core/curator/proto/private/BUILD.bazel
+++ b/metropolis/node/core/curator/proto/private/BUILD.bazel
@@ -17,11 +17,11 @@
     importpath = "source.monogon.dev/metropolis/node/core/curator/proto/private",
     proto = ":private_proto",
     visibility = ["//visibility:public"],
-    deps = ["//metropolis/proto/common:go_default_library"],
+    deps = ["//metropolis/proto/common"],
 )
 
 go_library(
-    name = "go_default_library",
+    name = "private",
     embed = [":private_go_proto"],
     importpath = "source.monogon.dev/metropolis/node/core/curator/proto/private",
     visibility = ["//visibility:public"],
diff --git a/metropolis/node/core/curator/state.go b/metropolis/node/core/curator/state.go
index 0db9af5..c1969d4 100644
--- a/metropolis/node/core/curator/state.go
+++ b/metropolis/node/core/curator/state.go
@@ -4,7 +4,7 @@
 	"fmt"
 	"strings"
 
-	"go.etcd.io/etcd/clientv3"
+	clientv3 "go.etcd.io/etcd/client/v3"
 )
 
 // etcdPrefix is the location of some data in etcd, with each data element keyed
diff --git a/metropolis/node/core/curator/state_node.go b/metropolis/node/core/curator/state_node.go
index f20f981..ce87723 100644
--- a/metropolis/node/core/curator/state_node.go
+++ b/metropolis/node/core/curator/state_node.go
@@ -21,7 +21,7 @@
 	"crypto/x509"
 	"fmt"
 
-	"go.etcd.io/etcd/clientv3"
+	clientv3 "go.etcd.io/etcd/client/v3"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
 	"google.golang.org/protobuf/proto"
diff --git a/metropolis/node/core/curator/state_registerticket.go b/metropolis/node/core/curator/state_registerticket.go
index 4b674aa..8b8ea15 100644
--- a/metropolis/node/core/curator/state_registerticket.go
+++ b/metropolis/node/core/curator/state_registerticket.go
@@ -4,7 +4,7 @@
 	"context"
 	"crypto/rand"
 
-	"go.etcd.io/etcd/clientv3"
+	clientv3 "go.etcd.io/etcd/client/v3"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
 	"google.golang.org/protobuf/proto"
diff --git a/metropolis/node/core/identity/BUILD.bazel b/metropolis/node/core/identity/BUILD.bazel
index c5b481a..92e8943 100644
--- a/metropolis/node/core/identity/BUILD.bazel
+++ b/metropolis/node/core/identity/BUILD.bazel
@@ -1,18 +1,18 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
 
 go_library(
-    name = "go_default_library",
+    name = "identity",
     srcs = [
         "certificates.go",
         "identity.go",
     ],
     importpath = "source.monogon.dev/metropolis/node/core/identity",
     visibility = ["//visibility:public"],
-    deps = ["//metropolis/node/core/localstorage:go_default_library"],
+    deps = ["//metropolis/node/core/localstorage"],
 )
 
 go_test(
-    name = "go_default_test",
+    name = "identity_test",
     srcs = ["certificates_test.go"],
-    embed = [":go_default_library"],
+    embed = [":identity"],
 )
diff --git a/metropolis/node/core/localstorage/BUILD.bazel b/metropolis/node/core/localstorage/BUILD.bazel
index 13cd8a9..b360e2c 100644
--- a/metropolis/node/core/localstorage/BUILD.bazel
+++ b/metropolis/node/core/localstorage/BUILD.bazel
@@ -1,7 +1,7 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
 
 go_library(
-    name = "go_default_library",
+    name = "localstorage",
     srcs = [
         "directory_data.go",
         "directory_pki.go",
@@ -12,19 +12,19 @@
     importpath = "source.monogon.dev/metropolis/node/core/localstorage",
     visibility = ["//metropolis/node:__subpackages__"],
     deps = [
-        "//metropolis/node/core/localstorage/crypt:go_default_library",
-        "//metropolis/node/core/localstorage/declarative:go_default_library",
-        "//metropolis/pkg/tpm:go_default_library",
-        "//metropolis/proto/api:go_default_library",
-        "//metropolis/proto/private:go_default_library",
-        "@org_golang_google_protobuf//proto:go_default_library",
-        "@org_golang_x_sys//unix:go_default_library",
+        "//metropolis/node/core/localstorage/crypt",
+        "//metropolis/node/core/localstorage/declarative",
+        "//metropolis/pkg/tpm",
+        "//metropolis/proto/api",
+        "//metropolis/proto/private",
+        "@org_golang_google_protobuf//proto",
+        "@org_golang_x_sys//unix",
     ],
 )
 
 go_test(
-    name = "go_default_test",
+    name = "localstorage_test",
     srcs = ["storage_test.go"],
-    embed = [":go_default_library"],
-    deps = ["//metropolis/node/core/localstorage/declarative:go_default_library"],
+    embed = [":localstorage"],
+    deps = ["//metropolis/node/core/localstorage/declarative"],
 )
diff --git a/metropolis/node/core/localstorage/crypt/BUILD.bazel b/metropolis/node/core/localstorage/crypt/BUILD.bazel
index 39afbb8..36e17bb 100644
--- a/metropolis/node/core/localstorage/crypt/BUILD.bazel
+++ b/metropolis/node/core/localstorage/crypt/BUILD.bazel
@@ -1,7 +1,7 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "crypt",
     # keep
     srcs = [
         "blockdev.go",
@@ -12,9 +12,9 @@
     importpath = "source.monogon.dev/metropolis/node/core/localstorage/crypt",
     visibility = ["//metropolis/node/core/localstorage:__subpackages__"],
     deps = [
-        "//metropolis/pkg/devicemapper:go_default_library",
-        "//metropolis/pkg/sysfs:go_default_library",
-        "@com_github_rekby_gpt//:go_default_library",
-        "@org_golang_x_sys//unix:go_default_library",
+        "//metropolis/pkg/devicemapper",
+        "//metropolis/pkg/sysfs",
+        "@com_github_rekby_gpt//:gpt",
+        "@org_golang_x_sys//unix",
     ],
 )
diff --git a/metropolis/node/core/localstorage/declarative/BUILD.bazel b/metropolis/node/core/localstorage/declarative/BUILD.bazel
index de35579..53d1608 100644
--- a/metropolis/node/core/localstorage/declarative/BUILD.bazel
+++ b/metropolis/node/core/localstorage/declarative/BUILD.bazel
@@ -1,7 +1,7 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "declarative",
     srcs = [
         "declarative.go",
         "placement.go",
@@ -9,5 +9,5 @@
     ],
     importpath = "source.monogon.dev/metropolis/node/core/localstorage/declarative",
     visibility = ["//metropolis/node:__subpackages__"],
-    deps = ["@org_golang_x_sys//unix:go_default_library"],
+    deps = ["@org_golang_x_sys//unix"],
 )
diff --git a/metropolis/node/core/network/BUILD.bazel b/metropolis/node/core/network/BUILD.bazel
index 489f1d4..86ffda8 100644
--- a/metropolis/node/core/network/BUILD.bazel
+++ b/metropolis/node/core/network/BUILD.bazel
@@ -1,20 +1,20 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "network",
     srcs = ["main.go"],
     importpath = "source.monogon.dev/metropolis/node/core/network",
     visibility = ["//:__subpackages__"],
     deps = [
-        "//metropolis/node/core/network/dhcp4c:go_default_library",
-        "//metropolis/node/core/network/dhcp4c/callback:go_default_library",
-        "//metropolis/node/core/network/dns:go_default_library",
-        "//metropolis/pkg/event:go_default_library",
-        "//metropolis/pkg/event/memory:go_default_library",
-        "//metropolis/pkg/supervisor:go_default_library",
-        "@com_github_google_nftables//:go_default_library",
-        "@com_github_google_nftables//expr:go_default_library",
-        "@com_github_insomniacslk_dhcp//dhcpv4:go_default_library",
-        "@com_github_vishvananda_netlink//:go_default_library",
+        "//metropolis/node/core/network/dhcp4c",
+        "//metropolis/node/core/network/dhcp4c/callback",
+        "//metropolis/node/core/network/dns",
+        "//metropolis/pkg/event",
+        "//metropolis/pkg/event/memory",
+        "//metropolis/pkg/supervisor",
+        "@com_github_google_nftables//:nftables",
+        "@com_github_google_nftables//expr",
+        "@com_github_insomniacslk_dhcp//dhcpv4",
+        "@com_github_vishvananda_netlink//:netlink",
     ],
 )
diff --git a/metropolis/node/core/network/dhcp4c/BUILD.bazel b/metropolis/node/core/network/dhcp4c/BUILD.bazel
index 72e16f6..d514f2d 100644
--- a/metropolis/node/core/network/dhcp4c/BUILD.bazel
+++ b/metropolis/node/core/network/dhcp4c/BUILD.bazel
@@ -1,7 +1,7 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
 
 go_library(
-    name = "go_default_library",
+    name = "dhcp4c",
     srcs = [
         "dhcpc.go",
         "doc.go",
@@ -14,26 +14,26 @@
         "//metropolis/test/nanoswitch:__subpackages__",
     ],
     deps = [
-        "//metropolis/node/core/network/dhcp4c/transport:go_default_library",
-        "//metropolis/pkg/supervisor:go_default_library",
-        "@com_github_cenkalti_backoff_v4//:go_default_library",
-        "@com_github_insomniacslk_dhcp//dhcpv4:go_default_library",
-        "@com_github_insomniacslk_dhcp//iana:go_default_library",
+        "//metropolis/node/core/network/dhcp4c/transport",
+        "//metropolis/pkg/supervisor",
+        "@com_github_cenkalti_backoff_v4//:backoff",
+        "@com_github_insomniacslk_dhcp//dhcpv4",
+        "@com_github_insomniacslk_dhcp//iana",
     ],
 )
 
 go_test(
-    name = "go_default_test",
+    name = "dhcp4c_test",
     srcs = [
         "dhcpc_test.go",
         "lease_test.go",
     ],
-    embed = [":go_default_library"],
+    embed = [":dhcp4c"],
     pure = "on",
     deps = [
-        "//metropolis/node/core/network/dhcp4c/transport:go_default_library",
-        "@com_github_cenkalti_backoff_v4//:go_default_library",
-        "@com_github_insomniacslk_dhcp//dhcpv4:go_default_library",
-        "@com_github_stretchr_testify//assert:go_default_library",
+        "//metropolis/node/core/network/dhcp4c/transport",
+        "@com_github_cenkalti_backoff_v4//:backoff",
+        "@com_github_insomniacslk_dhcp//dhcpv4",
+        "@com_github_stretchr_testify//assert",
     ],
 )
diff --git a/metropolis/node/core/network/dhcp4c/callback/BUILD.bazel b/metropolis/node/core/network/dhcp4c/callback/BUILD.bazel
index 622fb48..d841c6e 100644
--- a/metropolis/node/core/network/dhcp4c/callback/BUILD.bazel
+++ b/metropolis/node/core/network/dhcp4c/callback/BUILD.bazel
@@ -2,7 +2,7 @@
 load("//metropolis/test/ktest:ktest.bzl", "ktest")
 
 go_library(
-    name = "go_default_library",
+    name = "callback",
     srcs = ["callback.go"],
     importpath = "source.monogon.dev/metropolis/node/core/network/dhcp4c/callback",
     visibility = [
@@ -11,27 +11,27 @@
         "//metropolis/test/nanoswitch:__subpackages__",
     ],
     deps = [
-        "//metropolis/node/core/network/dhcp4c:go_default_library",
-        "@com_github_insomniacslk_dhcp//dhcpv4:go_default_library",
-        "@com_github_vishvananda_netlink//:go_default_library",
-        "@org_golang_x_sys//unix:go_default_library",
+        "//metropolis/node/core/network/dhcp4c",
+        "@com_github_insomniacslk_dhcp//dhcpv4",
+        "@com_github_vishvananda_netlink//:netlink",
+        "@org_golang_x_sys//unix",
     ],
 )
 
 go_test(
-    name = "go_default_test",
+    name = "callback_test",
     srcs = ["callback_test.go"],
-    embed = [":go_default_library"],
+    embed = [":callback"],
     pure = "on",
     deps = [
-        "//metropolis/node/core/network/dhcp4c:go_default_library",
-        "@com_github_insomniacslk_dhcp//dhcpv4:go_default_library",
-        "@com_github_stretchr_testify//require:go_default_library",
-        "@com_github_vishvananda_netlink//:go_default_library",
-        "@org_golang_x_sys//unix:go_default_library",
+        "//metropolis/node/core/network/dhcp4c",
+        "@com_github_insomniacslk_dhcp//dhcpv4",
+        "@com_github_stretchr_testify//require",
+        "@com_github_vishvananda_netlink//:netlink",
+        "@org_golang_x_sys//unix",
     ],
 )
 
 ktest(
-    tester = ":go_default_test",
+    tester = ":callback_test",
 )
diff --git a/metropolis/node/core/network/dhcp4c/callback/callback_test.go b/metropolis/node/core/network/dhcp4c/callback/callback_test.go
index 7f5b5d3..7b06713 100644
--- a/metropolis/node/core/network/dhcp4c/callback/callback_test.go
+++ b/metropolis/node/core/network/dhcp4c/callback/callback_test.go
@@ -128,6 +128,7 @@
 			// Associate dynamically-generated interface name for later comparison
 			for i := range test.expectedAddrs {
 				test.expectedAddrs[i].Label = testLink.Name
+				test.expectedAddrs[i].LinkIndex = testLink.Index
 			}
 			cb := ManageIP(testLink)
 			if err := cb(test.oldLease, test.newLease); err != nil {
diff --git a/metropolis/node/core/network/dhcp4c/transport/BUILD.bazel b/metropolis/node/core/network/dhcp4c/transport/BUILD.bazel
index f9e3a74..8b8e02b 100644
--- a/metropolis/node/core/network/dhcp4c/transport/BUILD.bazel
+++ b/metropolis/node/core/network/dhcp4c/transport/BUILD.bazel
@@ -1,7 +1,7 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "transport",
     srcs = [
         "transport.go",
         "transport_broadcast.go",
@@ -10,11 +10,11 @@
     importpath = "source.monogon.dev/metropolis/node/core/network/dhcp4c/transport",
     visibility = ["//metropolis/node/core/network/dhcp4c:__subpackages__"],
     deps = [
-        "@com_github_google_gopacket//:go_default_library",
-        "@com_github_google_gopacket//layers:go_default_library",
-        "@com_github_insomniacslk_dhcp//dhcpv4:go_default_library",
-        "@com_github_mdlayher_raw//:go_default_library",
-        "@org_golang_x_net//bpf:go_default_library",
-        "@org_golang_x_sys//unix:go_default_library",
+        "@com_github_google_gopacket//:gopacket",
+        "@com_github_google_gopacket//layers",
+        "@com_github_insomniacslk_dhcp//dhcpv4",
+        "@com_github_mdlayher_raw//:raw",
+        "@org_golang_x_net//bpf",
+        "@org_golang_x_sys//unix",
     ],
 )
diff --git a/metropolis/node/core/network/dns/BUILD.bazel b/metropolis/node/core/network/dns/BUILD.bazel
index 1ef31f1..7d5419e 100644
--- a/metropolis/node/core/network/dns/BUILD.bazel
+++ b/metropolis/node/core/network/dns/BUILD.bazel
@@ -1,7 +1,7 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "dns",
     srcs = [
         "coredns.go",
         "directives.go",
@@ -9,8 +9,8 @@
     importpath = "source.monogon.dev/metropolis/node/core/network/dns",
     visibility = ["//metropolis/node:__subpackages__"],
     deps = [
-        "//metropolis/pkg/fileargs:go_default_library",
-        "//metropolis/pkg/supervisor:go_default_library",
+        "//metropolis/pkg/fileargs",
+        "//metropolis/pkg/supervisor",
     ],
 )
 
diff --git a/metropolis/node/core/network/hostsfile/BUILD.bazel b/metropolis/node/core/network/hostsfile/BUILD.bazel
index 5cfffc9..7c0b117 100644
--- a/metropolis/node/core/network/hostsfile/BUILD.bazel
+++ b/metropolis/node/core/network/hostsfile/BUILD.bazel
@@ -1,17 +1,17 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "hostsfile",
     srcs = ["hostsfile.go"],
     importpath = "source.monogon.dev/metropolis/node/core/network/hostsfile",
     visibility = ["//visibility:public"],
     deps = [
-        "//metropolis/node/core/curator/proto/api:go_default_library",
-        "//metropolis/node/core/localstorage:go_default_library",
-        "//metropolis/node/core/network:go_default_library",
-        "//metropolis/node/core/roleserve:go_default_library",
-        "//metropolis/pkg/supervisor:go_default_library",
+        "//metropolis/node/core/curator/proto/api",
+        "//metropolis/node/core/localstorage",
+        "//metropolis/node/core/network",
+        "//metropolis/node/core/roleserve",
+        "//metropolis/pkg/supervisor",
         "@org_golang_google_grpc//:go_default_library",
-        "@org_golang_x_sys//unix:go_default_library",
+        "@org_golang_x_sys//unix",
     ],
 )
diff --git a/metropolis/node/core/roleserve/BUILD.bazel b/metropolis/node/core/roleserve/BUILD.bazel
index ec1d443..4188202 100644
--- a/metropolis/node/core/roleserve/BUILD.bazel
+++ b/metropolis/node/core/roleserve/BUILD.bazel
@@ -1,7 +1,7 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "roleserve",
     srcs = [
         "roleserve.go",
         "value_bootstrapdata.go",
@@ -16,22 +16,22 @@
     importpath = "source.monogon.dev/metropolis/node/core/roleserve",
     visibility = ["//visibility:public"],
     deps = [
-        "//metropolis/node:go_default_library",
-        "//metropolis/node/core/consensus:go_default_library",
-        "//metropolis/node/core/curator:go_default_library",
-        "//metropolis/node/core/curator/proto/api:go_default_library",
-        "//metropolis/node/core/identity:go_default_library",
-        "//metropolis/node/core/localstorage:go_default_library",
-        "//metropolis/node/core/network:go_default_library",
-        "//metropolis/node/core/rpc:go_default_library",
-        "//metropolis/node/kubernetes:go_default_library",
-        "//metropolis/node/kubernetes/containerd:go_default_library",
-        "//metropolis/node/kubernetes/pki:go_default_library",
-        "//metropolis/pkg/event:go_default_library",
-        "//metropolis/pkg/event/memory:go_default_library",
-        "//metropolis/pkg/pki:go_default_library",
-        "//metropolis/pkg/supervisor:go_default_library",
-        "//metropolis/proto/common:go_default_library",
+        "//metropolis/node",
+        "//metropolis/node/core/consensus",
+        "//metropolis/node/core/curator",
+        "//metropolis/node/core/curator/proto/api",
+        "//metropolis/node/core/identity",
+        "//metropolis/node/core/localstorage",
+        "//metropolis/node/core/network",
+        "//metropolis/node/core/rpc",
+        "//metropolis/node/kubernetes",
+        "//metropolis/node/kubernetes/containerd",
+        "//metropolis/node/kubernetes/pki",
+        "//metropolis/pkg/event",
+        "//metropolis/pkg/event/memory",
+        "//metropolis/pkg/pki",
+        "//metropolis/pkg/supervisor",
+        "//metropolis/proto/common",
         "@org_golang_google_grpc//:go_default_library",
     ],
 )
diff --git a/metropolis/node/core/rpc/BUILD.bazel b/metropolis/node/core/rpc/BUILD.bazel
index 8ec88c0..9b171e3 100644
--- a/metropolis/node/core/rpc/BUILD.bazel
+++ b/metropolis/node/core/rpc/BUILD.bazel
@@ -1,7 +1,7 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
 
 go_library(
-    name = "go_default_library",
+    name = "rpc",
     srcs = [
         "client.go",
         "methodinfo.go",
@@ -14,39 +14,39 @@
     importpath = "source.monogon.dev/metropolis/node/core/rpc",
     visibility = ["//visibility:public"],
     deps = [
-        "//metropolis/node/core/curator/proto/api:go_default_library",
-        "//metropolis/node/core/identity:go_default_library",
-        "//metropolis/pkg/logtree:go_default_library",
-        "//metropolis/pkg/pki:go_default_library",
-        "//metropolis/proto/api:go_default_library",
-        "//metropolis/proto/ext:go_default_library",
+        "//metropolis/node/core/curator/proto/api",
+        "//metropolis/node/core/identity",
+        "//metropolis/pkg/logtree",
+        "//metropolis/pkg/pki",
+        "//metropolis/proto/api",
+        "//metropolis/proto/ext",
         "@org_golang_google_grpc//:go_default_library",
-        "@org_golang_google_grpc//codes:go_default_library",
-        "@org_golang_google_grpc//credentials:go_default_library",
-        "@org_golang_google_grpc//peer:go_default_library",
-        "@org_golang_google_grpc//status:go_default_library",
-        "@org_golang_google_protobuf//encoding/prototext:go_default_library",
-        "@org_golang_google_protobuf//proto:go_default_library",
-        "@org_golang_google_protobuf//reflect/protoreflect:go_default_library",
-        "@org_golang_google_protobuf//reflect/protoregistry:go_default_library",
+        "@org_golang_google_grpc//codes",
+        "@org_golang_google_grpc//credentials",
+        "@org_golang_google_grpc//peer",
+        "@org_golang_google_grpc//status",
+        "@org_golang_google_protobuf//encoding/prototext",
+        "@org_golang_google_protobuf//proto",
+        "@org_golang_google_protobuf//reflect/protoreflect",
+        "@org_golang_google_protobuf//reflect/protoregistry",
     ],
 )
 
 go_test(
-    name = "go_default_test",
+    name = "rpc_test",
     srcs = [
         "server_authentication_test.go",
         "trace_test.go",
     ],
-    embed = [":go_default_library"],
+    embed = [":rpc"],
     deps = [
-        "//metropolis/node/core/curator/proto/api:go_default_library",
-        "//metropolis/pkg/logtree:go_default_library",
-        "//metropolis/proto/api:go_default_library",
-        "//metropolis/proto/ext:go_default_library",
+        "//metropolis/node/core/curator/proto/api",
+        "//metropolis/pkg/logtree",
+        "//metropolis/proto/api",
+        "//metropolis/proto/ext",
         "@org_golang_google_grpc//:go_default_library",
-        "@org_golang_google_grpc//codes:go_default_library",
-        "@org_golang_google_grpc//status:go_default_library",
-        "@org_golang_google_grpc//test/bufconn:go_default_library",
+        "@org_golang_google_grpc//codes",
+        "@org_golang_google_grpc//status",
+        "@org_golang_google_grpc//test/bufconn",
     ],
 )
diff --git a/metropolis/node/core/time/BUILD.bazel b/metropolis/node/core/time/BUILD.bazel
index 05a938a..fb9af73 100644
--- a/metropolis/node/core/time/BUILD.bazel
+++ b/metropolis/node/core/time/BUILD.bazel
@@ -1,13 +1,13 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "time",
     srcs = ["time.go"],
     importpath = "source.monogon.dev/metropolis/node/core/time",
     visibility = ["//visibility:public"],
     deps = [
-        "//metropolis/node:go_default_library",
-        "//metropolis/pkg/fileargs:go_default_library",
-        "//metropolis/pkg/supervisor:go_default_library",
+        "//metropolis/node",
+        "//metropolis/pkg/fileargs",
+        "//metropolis/pkg/supervisor",
     ],
 )
diff --git a/metropolis/node/kubernetes/BUILD.bazel b/metropolis/node/kubernetes/BUILD.bazel
index 2a35c4b..c92ca06 100644
--- a/metropolis/node/kubernetes/BUILD.bazel
+++ b/metropolis/node/kubernetes/BUILD.bazel
@@ -1,7 +1,7 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "kubernetes",
     srcs = [
         "apiserver.go",
         "controller-manager.go",
@@ -14,46 +14,46 @@
     importpath = "source.monogon.dev/metropolis/node/kubernetes",
     visibility = ["//metropolis/node:__subpackages__"],
     deps = [
-        "//metropolis/node:go_default_library",
-        "//metropolis/node/core/identity:go_default_library",
-        "//metropolis/node/core/localstorage:go_default_library",
-        "//metropolis/node/core/network:go_default_library",
-        "//metropolis/node/core/network/dns:go_default_library",
-        "//metropolis/node/kubernetes/authproxy:go_default_library",
-        "//metropolis/node/kubernetes/clusternet:go_default_library",
-        "//metropolis/node/kubernetes/nfproxy:go_default_library",
-        "//metropolis/node/kubernetes/pki:go_default_library",
-        "//metropolis/node/kubernetes/plugins/kvmdevice:go_default_library",
-        "//metropolis/node/kubernetes/reconciler:go_default_library",
-        "//metropolis/pkg/fileargs:go_default_library",
-        "//metropolis/pkg/fsquota:go_default_library",
-        "//metropolis/pkg/logtree:go_default_library",
-        "//metropolis/pkg/loop:go_default_library",
-        "//metropolis/pkg/pki:go_default_library",
-        "//metropolis/pkg/supervisor:go_default_library",
-        "//metropolis/proto/api:go_default_library",
-        "@com_github_container_storage_interface_spec//lib/go/csi:go_default_library",
+        "//metropolis/node",
+        "//metropolis/node/core/identity",
+        "//metropolis/node/core/localstorage",
+        "//metropolis/node/core/network",
+        "//metropolis/node/core/network/dns",
+        "//metropolis/node/kubernetes/authproxy",
+        "//metropolis/node/kubernetes/clusternet",
+        "//metropolis/node/kubernetes/nfproxy",
+        "//metropolis/node/kubernetes/pki",
+        "//metropolis/node/kubernetes/plugins/kvmdevice",
+        "//metropolis/node/kubernetes/reconciler",
+        "//metropolis/pkg/fileargs",
+        "//metropolis/pkg/fsquota",
+        "//metropolis/pkg/logtree",
+        "//metropolis/pkg/loop",
+        "//metropolis/pkg/pki",
+        "//metropolis/pkg/supervisor",
+        "//metropolis/proto/api",
+        "@com_github_container_storage_interface_spec//lib/go/csi",
         "@io_bazel_rules_go//proto/wkt:wrappers_go_proto",
-        "@io_k8s_api//core/v1:go_default_library",
-        "@io_k8s_api//storage/v1:go_default_library",
-        "@io_k8s_apimachinery//pkg/api/errors:go_default_library",
-        "@io_k8s_apimachinery//pkg/apis/meta/v1:go_default_library",
-        "@io_k8s_client_go//informers:go_default_library",
-        "@io_k8s_client_go//informers/core/v1:go_default_library",
-        "@io_k8s_client_go//informers/storage/v1:go_default_library",
-        "@io_k8s_client_go//kubernetes:go_default_library",
-        "@io_k8s_client_go//kubernetes/scheme:go_default_library",
-        "@io_k8s_client_go//kubernetes/typed/core/v1:go_default_library",
-        "@io_k8s_client_go//tools/cache:go_default_library",
-        "@io_k8s_client_go//tools/clientcmd:go_default_library",
-        "@io_k8s_client_go//tools/record:go_default_library",
-        "@io_k8s_client_go//tools/reference:go_default_library",
-        "@io_k8s_client_go//util/workqueue:go_default_library",
-        "@io_k8s_kubelet//config/v1beta1:go_default_library",
-        "@io_k8s_kubelet//pkg/apis/pluginregistration/v1:go_default_library",
+        "@io_k8s_api//core/v1:core",
+        "@io_k8s_api//storage/v1:storage",
+        "@io_k8s_apimachinery//pkg/api/errors",
+        "@io_k8s_apimachinery//pkg/apis/meta/v1:meta",
+        "@io_k8s_client_go//informers",
+        "@io_k8s_client_go//informers/core/v1:core",
+        "@io_k8s_client_go//informers/storage/v1:storage",
+        "@io_k8s_client_go//kubernetes",
+        "@io_k8s_client_go//kubernetes/scheme",
+        "@io_k8s_client_go//kubernetes/typed/core/v1:core",
+        "@io_k8s_client_go//tools/cache",
+        "@io_k8s_client_go//tools/clientcmd",
+        "@io_k8s_client_go//tools/record",
+        "@io_k8s_client_go//tools/reference",
+        "@io_k8s_client_go//util/workqueue",
+        "@io_k8s_kubelet//config/v1beta1",
+        "@io_k8s_kubelet//pkg/apis/pluginregistration/v1:pluginregistration",
         "@org_golang_google_grpc//:go_default_library",
-        "@org_golang_google_grpc//codes:go_default_library",
-        "@org_golang_google_grpc//status:go_default_library",
-        "@org_golang_x_sys//unix:go_default_library",
+        "@org_golang_google_grpc//codes",
+        "@org_golang_google_grpc//status",
+        "@org_golang_x_sys//unix",
     ],
 )
diff --git a/metropolis/node/kubernetes/apiserver.go b/metropolis/node/kubernetes/apiserver.go
index cd4ff60..aeaa80e 100644
--- a/metropolis/node/kubernetes/apiserver.go
+++ b/metropolis/node/kubernetes/apiserver.go
@@ -97,7 +97,6 @@
 			pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: s.idCA})),
 		"--enable-admission-plugins=NodeRestriction,PodSecurityPolicy",
 		"--enable-aggregator-routing=true",
-		"--insecure-port=0",
 		fmt.Sprintf("--secure-port=%d", common.KubernetesAPIPort),
 		fmt.Sprintf("--etcd-servers=unix:///%s:0", s.EphemeralConsensusDirectory.ClientSocket.FullPath()),
 		args.FileOpt("--kubelet-client-certificate", "kubelet-client-cert.pem",
@@ -117,6 +116,9 @@
 		"--requestheader-username-headers=X-Remote-User",
 		args.FileOpt("--service-account-key-file", "service-account-pubkey.pem",
 			pem.EncodeToMemory(&pem.Block{Type: "PRIVATE KEY", Bytes: s.serviceAccountPrivKey})),
+		args.FileOpt("--service-account-signing-key-file", "service-account-signing-key.pem",
+			pem.EncodeToMemory(&pem.Block{Type: "PRIVATE KEY", Bytes: s.serviceAccountPrivKey})),
+		"--service-account-issuer", "https://metropolis.internal", // TODO: Figure out federation
 		fmt.Sprintf("--service-cluster-ip-range=%v", s.ServiceIPRange.String()),
 		args.FileOpt("--tls-cert-file", "server-cert.pem",
 			pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: s.serverCert})),
diff --git a/metropolis/node/kubernetes/authproxy/BUILD.bazel b/metropolis/node/kubernetes/authproxy/BUILD.bazel
index 965e8ad..9cf57cb 100644
--- a/metropolis/node/kubernetes/authproxy/BUILD.bazel
+++ b/metropolis/node/kubernetes/authproxy/BUILD.bazel
@@ -1,15 +1,15 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "authproxy",
     srcs = ["authproxy.go"],
     importpath = "source.monogon.dev/metropolis/node/kubernetes/authproxy",
     visibility = ["//visibility:public"],
     deps = [
-        "//metropolis/node:go_default_library",
-        "//metropolis/node/core/identity:go_default_library",
-        "//metropolis/node/kubernetes/pki:go_default_library",
-        "//metropolis/pkg/supervisor:go_default_library",
-        "@io_k8s_apimachinery//pkg/apis/meta/v1:go_default_library",
+        "//metropolis/node",
+        "//metropolis/node/core/identity",
+        "//metropolis/node/kubernetes/pki",
+        "//metropolis/pkg/supervisor",
+        "@io_k8s_apimachinery//pkg/apis/meta/v1:meta",
     ],
 )
diff --git a/metropolis/node/kubernetes/clusternet/BUILD.bazel b/metropolis/node/kubernetes/clusternet/BUILD.bazel
index b2f0687..8e8f820 100644
--- a/metropolis/node/kubernetes/clusternet/BUILD.bazel
+++ b/metropolis/node/kubernetes/clusternet/BUILD.bazel
@@ -1,7 +1,7 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "clusternet",
     srcs = [
         "clusternet.go",
         "netlink_compat.go",
@@ -9,19 +9,19 @@
     importpath = "source.monogon.dev/metropolis/node/kubernetes/clusternet",
     visibility = ["//metropolis/node/kubernetes:__subpackages__"],
     deps = [
-        "//metropolis/node:go_default_library",
-        "//metropolis/node/core/localstorage:go_default_library",
-        "//metropolis/pkg/jsonpatch:go_default_library",
-        "//metropolis/pkg/logtree:go_default_library",
-        "//metropolis/pkg/supervisor:go_default_library",
-        "@com_github_vishvananda_netlink//:go_default_library",
-        "@com_zx2c4_golang_wireguard_wgctrl//:go_default_library",
-        "@com_zx2c4_golang_wireguard_wgctrl//wgtypes:go_default_library",
-        "@io_k8s_api//core/v1:go_default_library",
-        "@io_k8s_apimachinery//pkg/apis/meta/v1:go_default_library",
-        "@io_k8s_apimachinery//pkg/types:go_default_library",
-        "@io_k8s_client_go//informers:go_default_library",
-        "@io_k8s_client_go//kubernetes:go_default_library",
-        "@io_k8s_client_go//tools/cache:go_default_library",
+        "//metropolis/node",
+        "//metropolis/node/core/localstorage",
+        "//metropolis/pkg/jsonpatch",
+        "//metropolis/pkg/logtree",
+        "//metropolis/pkg/supervisor",
+        "@com_github_vishvananda_netlink//:netlink",
+        "@com_zx2c4_golang_wireguard_wgctrl//:wgctrl",
+        "@com_zx2c4_golang_wireguard_wgctrl//wgtypes",
+        "@io_k8s_api//core/v1:core",
+        "@io_k8s_apimachinery//pkg/apis/meta/v1:meta",
+        "@io_k8s_apimachinery//pkg/types",
+        "@io_k8s_client_go//informers",
+        "@io_k8s_client_go//kubernetes",
+        "@io_k8s_client_go//tools/cache",
     ],
 )
diff --git a/metropolis/node/kubernetes/containerd/BUILD.bazel b/metropolis/node/kubernetes/containerd/BUILD.bazel
index 58534d7..ef6606d 100644
--- a/metropolis/node/kubernetes/containerd/BUILD.bazel
+++ b/metropolis/node/kubernetes/containerd/BUILD.bazel
@@ -1,15 +1,15 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "containerd",
     srcs = ["main.go"],
     importpath = "source.monogon.dev/metropolis/node/kubernetes/containerd",
     visibility = ["//metropolis/node/core:__subpackages__"],
     deps = [
-        "//metropolis/node/core/localstorage:go_default_library",
-        "//metropolis/pkg/supervisor:go_default_library",
-        "@com_github_containerd_containerd//:go_default_library",
-        "@com_github_containerd_containerd//namespaces:go_default_library",
+        "//metropolis/node/core/localstorage",
+        "//metropolis/pkg/supervisor",
+        "@com_github_containerd_containerd//:containerd",
+        "@com_github_containerd_containerd//namespaces",
     ],
 )
 
diff --git a/metropolis/node/kubernetes/containerd/config.toml b/metropolis/node/kubernetes/containerd/config.toml
index da2bed7..98a11fe 100644
--- a/metropolis/node/kubernetes/containerd/config.toml
+++ b/metropolis/node/kubernetes/containerd/config.toml
@@ -58,6 +58,7 @@
     systemd_cgroup = false
     enable_tls_streaming = false
     ignore_image_defined_volumes = true
+    netns_mounts_under_state_dir = true
     max_container_log_line_size = 16384
     disable_cgroup = false
     disable_apparmor = true
diff --git a/metropolis/node/kubernetes/hyperkube/BUILD b/metropolis/node/kubernetes/hyperkube/BUILD
index 3b5deb3..ed27296 100644
--- a/metropolis/node/kubernetes/hyperkube/BUILD
+++ b/metropolis/node/kubernetes/hyperkube/BUILD
@@ -2,27 +2,27 @@
 load("@//third_party/go:kubernetes_version_def.bzl", "version_x_defs")
 
 go_library(
-    name = "go_default_library",
+    name = "hyperkube_lib",
     srcs = ["main.go"],
     importpath = "source.monogon.dev/metropolis/node/kubernetes/hyperkube",
     visibility = ["//visibility:private"],
     deps = [
-        "@com_github_spf13_cobra//:go_default_library",
-        "@com_github_spf13_pflag//:go_default_library",
-        "@io_k8s_component_base//cli/flag:go_default_library",
-        "@io_k8s_component_base//logs:go_default_library",
-        "@io_k8s_component_base//metrics/prometheus/restclient:go_default_library",
-        "@io_k8s_component_base//metrics/prometheus/version:go_default_library",
-        "@io_k8s_kubernetes//cmd/kube-apiserver/app:go_default_library",
-        "@io_k8s_kubernetes//cmd/kube-controller-manager/app:go_default_library",
-        "@io_k8s_kubernetes//cmd/kube-scheduler/app:go_default_library",
-        "@io_k8s_kubernetes//cmd/kubelet/app:go_default_library",
+        "@com_github_spf13_cobra//:cobra",
+        "@com_github_spf13_pflag//:pflag",
+        "@io_k8s_component_base//cli/flag",
+        "@io_k8s_component_base//logs",
+        "@io_k8s_component_base//metrics/prometheus/restclient",
+        "@io_k8s_component_base//metrics/prometheus/version",
+        "@io_k8s_kubernetes//cmd/kube-apiserver/app",
+        "@io_k8s_kubernetes//cmd/kube-controller-manager/app",
+        "@io_k8s_kubernetes//cmd/kube-scheduler/app",
+        "@io_k8s_kubernetes//cmd/kubelet/app",
     ],
 )
 
 go_binary(
     name = "hyperkube",
-    embed = [":go_default_library"],
+    embed = [":hyperkube_lib"],
     pure = "on",
     visibility = ["//metropolis/node:__pkg__"],
     x_defs = version_x_defs(),
diff --git a/metropolis/node/kubernetes/nfproxy/BUILD.bazel b/metropolis/node/kubernetes/nfproxy/BUILD.bazel
index 1dc5bbc..e8dce41 100644
--- a/metropolis/node/kubernetes/nfproxy/BUILD.bazel
+++ b/metropolis/node/kubernetes/nfproxy/BUILD.bazel
@@ -1,22 +1,22 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "nfproxy",
     srcs = ["nfproxy.go"],
     importpath = "source.monogon.dev/metropolis/node/kubernetes/nfproxy",
     visibility = ["//metropolis/node/kubernetes:__subpackages__"],
     deps = [
-        "//metropolis/pkg/supervisor:go_default_library",
-        "@com_github_sbezverk_nfproxy//pkg/controller:go_default_library",
-        "@com_github_sbezverk_nfproxy//pkg/nftables:go_default_library",
-        "@com_github_sbezverk_nfproxy//pkg/proxy:go_default_library",
-        "@io_k8s_api//core/v1:go_default_library",
-        "@io_k8s_apimachinery//pkg/apis/meta/v1:go_default_library",
-        "@io_k8s_apimachinery//pkg/labels:go_default_library",
-        "@io_k8s_apimachinery//pkg/selection:go_default_library",
-        "@io_k8s_client_go//informers:go_default_library",
-        "@io_k8s_client_go//kubernetes:go_default_library",
-        "@io_k8s_client_go//kubernetes/scheme:go_default_library",
-        "@io_k8s_client_go//tools/record:go_default_library",
+        "//metropolis/pkg/supervisor",
+        "@com_github_sbezverk_nfproxy//pkg/controller",
+        "@com_github_sbezverk_nfproxy//pkg/nftables",
+        "@com_github_sbezverk_nfproxy//pkg/proxy",
+        "@io_k8s_api//core/v1:core",
+        "@io_k8s_apimachinery//pkg/apis/meta/v1:meta",
+        "@io_k8s_apimachinery//pkg/labels",
+        "@io_k8s_apimachinery//pkg/selection",
+        "@io_k8s_client_go//informers",
+        "@io_k8s_client_go//kubernetes",
+        "@io_k8s_client_go//kubernetes/scheme",
+        "@io_k8s_client_go//tools/record",
     ],
 )
diff --git a/metropolis/node/kubernetes/pki/BUILD.bazel b/metropolis/node/kubernetes/pki/BUILD.bazel
index cfbba0c..f2e4e3c 100644
--- a/metropolis/node/kubernetes/pki/BUILD.bazel
+++ b/metropolis/node/kubernetes/pki/BUILD.bazel
@@ -1,16 +1,16 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "pki",
     srcs = ["kubernetes.go"],
     importpath = "source.monogon.dev/metropolis/node/kubernetes/pki",
     visibility = ["//metropolis/node:__subpackages__"],
     deps = [
-        "//metropolis/node:go_default_library",
-        "//metropolis/pkg/logtree:go_default_library",
-        "//metropolis/pkg/pki:go_default_library",
-        "@io_etcd_go_etcd//clientv3:go_default_library",
-        "@io_k8s_client_go//tools/clientcmd:go_default_library",
-        "@io_k8s_client_go//tools/clientcmd/api:go_default_library",
+        "//metropolis/node",
+        "//metropolis/pkg/logtree",
+        "//metropolis/pkg/pki",
+        "@io_etcd_go_etcd_client_v3//:client",
+        "@io_k8s_client_go//tools/clientcmd",
+        "@io_k8s_client_go//tools/clientcmd/api",
     ],
 )
diff --git a/metropolis/node/kubernetes/pki/kubernetes.go b/metropolis/node/kubernetes/pki/kubernetes.go
index 542c614..1a14f99 100644
--- a/metropolis/node/kubernetes/pki/kubernetes.go
+++ b/metropolis/node/kubernetes/pki/kubernetes.go
@@ -32,7 +32,7 @@
 	"fmt"
 	"net"
 
-	"go.etcd.io/etcd/clientv3"
+	clientv3 "go.etcd.io/etcd/client/v3"
 	"k8s.io/client-go/tools/clientcmd"
 	configapi "k8s.io/client-go/tools/clientcmd/api"
 
diff --git a/metropolis/node/kubernetes/plugins/kvmdevice/BUILD.bazel b/metropolis/node/kubernetes/plugins/kvmdevice/BUILD.bazel
index a4e0f93..7d9b43f 100644
--- a/metropolis/node/kubernetes/plugins/kvmdevice/BUILD.bazel
+++ b/metropolis/node/kubernetes/plugins/kvmdevice/BUILD.bazel
@@ -1,18 +1,18 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "kvmdevice",
     srcs = ["kvmdevice.go"],
     importpath = "source.monogon.dev/metropolis/node/kubernetes/plugins/kvmdevice",
     visibility = ["//visibility:public"],
     deps = [
-        "//metropolis/node/core/localstorage:go_default_library",
-        "//metropolis/pkg/logtree:go_default_library",
-        "//metropolis/pkg/supervisor:go_default_library",
-        "@io_k8s_api//core/v1:go_default_library",
-        "@io_k8s_kubelet//pkg/apis/deviceplugin/v1beta1:go_default_library",
-        "@io_k8s_kubelet//pkg/apis/pluginregistration/v1:go_default_library",
+        "//metropolis/node/core/localstorage",
+        "//metropolis/pkg/logtree",
+        "//metropolis/pkg/supervisor",
+        "@io_k8s_api//core/v1:core",
+        "@io_k8s_kubelet//pkg/apis/deviceplugin/v1beta1",
+        "@io_k8s_kubelet//pkg/apis/pluginregistration/v1:pluginregistration",
         "@org_golang_google_grpc//:go_default_library",
-        "@org_golang_x_sys//unix:go_default_library",
+        "@org_golang_x_sys//unix",
     ],
 )
diff --git a/metropolis/node/kubernetes/reconciler/BUILD.bazel b/metropolis/node/kubernetes/reconciler/BUILD.bazel
index fadcd96..bba9f4c 100644
--- a/metropolis/node/kubernetes/reconciler/BUILD.bazel
+++ b/metropolis/node/kubernetes/reconciler/BUILD.bazel
@@ -1,7 +1,7 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
 
 go_library(
-    name = "go_default_library",
+    name = "reconciler",
     srcs = [
         "reconciler.go",
         "resources_csi.go",
@@ -13,26 +13,26 @@
     importpath = "source.monogon.dev/metropolis/node/kubernetes/reconciler",
     visibility = ["//metropolis/node:__subpackages__"],
     deps = [
-        "//metropolis/pkg/supervisor:go_default_library",
-        "@io_k8s_api//core/v1:go_default_library",
-        "@io_k8s_api//node/v1beta1:go_default_library",
-        "@io_k8s_api//policy/v1beta1:go_default_library",
-        "@io_k8s_api//rbac/v1:go_default_library",
-        "@io_k8s_api//storage/v1:go_default_library",
-        "@io_k8s_apimachinery//pkg/apis/meta/v1:go_default_library",
-        "@io_k8s_client_go//kubernetes:go_default_library",
+        "//metropolis/pkg/supervisor",
+        "@io_k8s_api//core/v1:core",
+        "@io_k8s_api//node/v1beta1",
+        "@io_k8s_api//policy/v1beta1",
+        "@io_k8s_api//rbac/v1:rbac",
+        "@io_k8s_api//storage/v1:storage",
+        "@io_k8s_apimachinery//pkg/apis/meta/v1:meta",
+        "@io_k8s_client_go//kubernetes",
     ],
 )
 
 go_test(
-    name = "go_default_test",
+    name = "reconciler_test",
     srcs = ["reconciler_test.go"],
-    embed = [":go_default_library"],
+    embed = [":reconciler"],
     deps = [
-        "@io_k8s_api//node/v1beta1:go_default_library",
-        "@io_k8s_api//policy/v1beta1:go_default_library",
-        "@io_k8s_api//rbac/v1:go_default_library",
-        "@io_k8s_api//storage/v1:go_default_library",
-        "@io_k8s_apimachinery//pkg/apis/meta/v1:go_default_library",
+        "@io_k8s_api//node/v1beta1",
+        "@io_k8s_api//policy/v1beta1",
+        "@io_k8s_api//rbac/v1:rbac",
+        "@io_k8s_api//storage/v1:storage",
+        "@io_k8s_apimachinery//pkg/apis/meta/v1:meta",
     ],
 )
diff --git a/metropolis/node/tools.go b/metropolis/node/tools.go
new file mode 100644
index 0000000..9dcb15c
--- /dev/null
+++ b/metropolis/node/tools.go
@@ -0,0 +1,15 @@
+//go:build tools
+// +build tools
+
+package node
+
+import (
+	_ "github.com/containerd/containerd"
+	_ "github.com/containernetworking/plugins/plugins/ipam/host-local"
+	_ "github.com/containernetworking/plugins/plugins/main/loopback"
+	_ "github.com/containernetworking/plugins/plugins/main/ptp"
+	_ "github.com/coredns/coredns"
+	_ "github.com/go-delve/delve/cmd/dlv"
+	_ "github.com/opencontainers/runc"
+	_ "gvisor.dev/gvisor/runsc"
+)
diff --git a/metropolis/pkg/combinectx/BUILD.bazel b/metropolis/pkg/combinectx/BUILD.bazel
index d467c47..4eeca7f 100644
--- a/metropolis/pkg/combinectx/BUILD.bazel
+++ b/metropolis/pkg/combinectx/BUILD.bazel
@@ -1,17 +1,17 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
 
 go_library(
-    name = "go_default_library",
+    name = "combinectx",
     srcs = ["combinectx.go"],
     importpath = "source.monogon.dev/metropolis/pkg/combinectx",
     visibility = ["//visibility:public"],
 )
 
 go_test(
-    name = "go_default_test",
+    name = "combinectx_test",
     srcs = [
         "combinectx_test.go",
         "example_test.go",
     ],
-    embed = [":go_default_library"],
+    embed = [":combinectx"],
 )
diff --git a/metropolis/pkg/devicemapper/BUILD.bazel b/metropolis/pkg/devicemapper/BUILD.bazel
index e0dca24..7d4c132 100644
--- a/metropolis/pkg/devicemapper/BUILD.bazel
+++ b/metropolis/pkg/devicemapper/BUILD.bazel
@@ -1,7 +1,7 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "devicemapper",
     srcs = [
         "ctype.go",
         "devicemapper.go",
@@ -9,8 +9,8 @@
     importpath = "source.monogon.dev/metropolis/pkg/devicemapper",
     visibility = ["//metropolis:__subpackages__"],
     deps = [
-        "@com_github_pkg_errors//:go_default_library",
-        "@com_github_yalue_native_endian//:go_default_library",
-        "@org_golang_x_sys//unix:go_default_library",
+        "@com_github_pkg_errors//:errors",
+        "@com_github_yalue_native_endian//:native_endian",
+        "@org_golang_x_sys//unix",
     ],
 )
diff --git a/metropolis/pkg/efivarfs/BUILD.bazel b/metropolis/pkg/efivarfs/BUILD.bazel
index c41bb88..33b0685 100644
--- a/metropolis/pkg/efivarfs/BUILD.bazel
+++ b/metropolis/pkg/efivarfs/BUILD.bazel
@@ -1,7 +1,7 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "efivarfs",
     srcs = [
         "boot.go",
         "efivarfs.go",
@@ -10,8 +10,8 @@
     importpath = "source.monogon.dev/metropolis/pkg/efivarfs",
     visibility = ["//visibility:public"],
     deps = [
-        "@com_github_google_uuid//:go_default_library",
-        "@org_golang_x_text//encoding/unicode:go_default_library",
-        "@org_golang_x_text//transform:go_default_library",
+        "@com_github_google_uuid//:uuid",
+        "@org_golang_x_text//encoding/unicode",
+        "@org_golang_x_text//transform",
     ],
 )
diff --git a/metropolis/pkg/erofs/BUILD.bazel b/metropolis/pkg/erofs/BUILD.bazel
index af484a8..ce1622c 100644
--- a/metropolis/pkg/erofs/BUILD.bazel
+++ b/metropolis/pkg/erofs/BUILD.bazel
@@ -2,7 +2,7 @@
 load("//metropolis/test/ktest:ktest.bzl", "ktest")
 
 go_library(
-    name = "go_default_library",
+    name = "erofs",
     srcs = [
         "compression.go",
         "defs.go",
@@ -12,26 +12,26 @@
     ],
     importpath = "source.monogon.dev/metropolis/pkg/erofs",
     visibility = ["//visibility:public"],
-    deps = ["@org_golang_x_sys//unix:go_default_library"],
+    deps = ["@org_golang_x_sys//unix"],
 )
 
 go_test(
-    name = "go_default_test",
+    name = "erofs_test",
     srcs = [
         "compression_test.go",
         "defs_test.go",
         "erofs_test.go",
     ],
-    embed = [":go_default_library"],
+    embed = [":erofs"],
     pure = "on",  # keep
     deps = [
-        "@com_github_stretchr_testify//assert:go_default_library",
-        "@com_github_stretchr_testify//require:go_default_library",
-        "@org_golang_x_sys//unix:go_default_library",
+        "@com_github_stretchr_testify//assert",
+        "@com_github_stretchr_testify//require",
+        "@org_golang_x_sys//unix",
     ],
 )
 
 ktest(
     cmdline = "ramdisk_size=128",
-    tester = ":go_default_test",
+    tester = ":erofs_test",
 )
diff --git a/metropolis/pkg/event/BUILD.bazel b/metropolis/pkg/event/BUILD.bazel
index 0217c8a..92405ff 100644
--- a/metropolis/pkg/event/BUILD.bazel
+++ b/metropolis/pkg/event/BUILD.bazel
@@ -1,7 +1,7 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "event",
     srcs = ["event.go"],
     importpath = "source.monogon.dev/metropolis/pkg/event",
     visibility = ["//visibility:public"],
diff --git a/metropolis/pkg/event/etcd/BUILD.bazel b/metropolis/pkg/event/etcd/BUILD.bazel
index b00bc47..51ad5c1 100644
--- a/metropolis/pkg/event/etcd/BUILD.bazel
+++ b/metropolis/pkg/event/etcd/BUILD.bazel
@@ -1,28 +1,29 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
 
 go_library(
-    name = "go_default_library",
+    name = "etcd",
     srcs = ["etcd.go"],
     importpath = "source.monogon.dev/metropolis/pkg/event/etcd",
     visibility = ["//visibility:public"],
     deps = [
-        "//metropolis/node/core/consensus/client:go_default_library",
-        "//metropolis/pkg/event:go_default_library",
-        "@com_github_cenkalti_backoff_v4//:go_default_library",
-        "@io_etcd_go_etcd//clientv3:go_default_library",
+        "//metropolis/node/core/consensus/client",
+        "//metropolis/pkg/event",
+        "@com_github_cenkalti_backoff_v4//:backoff",
+        "@io_etcd_go_etcd_client_v3//:client",
     ],
 )
 
 go_test(
-    name = "go_default_test",
+    name = "etcd_test",
     srcs = ["etcd_test.go"],
-    embed = [":go_default_library"],
+    embed = [":etcd"],
     deps = [
-        "//metropolis/node/core/consensus/client:go_default_library",
-        "//metropolis/pkg/event:go_default_library",
-        "@io_etcd_go_etcd//clientv3:go_default_library",
-        "@io_etcd_go_etcd//etcdserver/api/v3rpc/rpctypes:go_default_library",
-        "@io_etcd_go_etcd//integration:go_default_library",
-        "@org_golang_google_grpc//codes:go_default_library",
+        "//metropolis/node/core/consensus/client",
+        "//metropolis/pkg/event",
+        "@io_etcd_go_etcd_api_v3//v3rpc/rpctypes",
+        "@io_etcd_go_etcd_client_pkg_v3//testutil",
+        "@io_etcd_go_etcd_client_v3//:client",
+        "@io_etcd_go_etcd_tests_v3//integration",
+        "@org_golang_google_grpc//codes",
     ],
 )
diff --git a/metropolis/pkg/event/etcd/etcd.go b/metropolis/pkg/event/etcd/etcd.go
index 7b914f7..cb93325 100644
--- a/metropolis/pkg/event/etcd/etcd.go
+++ b/metropolis/pkg/event/etcd/etcd.go
@@ -7,7 +7,7 @@
 	"sync"
 
 	"github.com/cenkalti/backoff/v4"
-	"go.etcd.io/etcd/clientv3"
+	clientv3 "go.etcd.io/etcd/client/v3"
 
 	"source.monogon.dev/metropolis/node/core/consensus/client"
 	"source.monogon.dev/metropolis/pkg/event"
diff --git a/metropolis/pkg/event/etcd/etcd_test.go b/metropolis/pkg/event/etcd/etcd_test.go
index 4b620c0..faa9629 100644
--- a/metropolis/pkg/event/etcd/etcd_test.go
+++ b/metropolis/pkg/event/etcd/etcd_test.go
@@ -3,6 +3,7 @@
 import (
 	"context"
 	"errors"
+	"flag"
 	"fmt"
 	"log"
 	"os"
@@ -11,9 +12,10 @@
 	"testing"
 	"time"
 
-	"go.etcd.io/etcd/clientv3"
-	"go.etcd.io/etcd/etcdserver/api/v3rpc/rpctypes"
-	"go.etcd.io/etcd/integration"
+	"go.etcd.io/etcd/api/v3/v3rpc/rpctypes"
+	"go.etcd.io/etcd/client/pkg/v3/testutil"
+	clientv3 "go.etcd.io/etcd/client/v3"
+	"go.etcd.io/etcd/tests/v3/integration"
 	"google.golang.org/grpc/codes"
 
 	"source.monogon.dev/metropolis/node/core/consensus/client"
@@ -31,14 +33,18 @@
 		Size:                 3,
 		GRPCKeepAliveMinTime: time.Millisecond,
 	}
-	cluster = integration.NewClusterV3(nil, &cfg)
+	tb, cancel := testutil.NewTestingTBProthesis("curator")
+	defer cancel()
+	flag.Parse()
+	integration.BeforeTest(tb)
+	cluster = integration.NewClusterV3(tb, &cfg)
 	endpoints = make([]string, 3)
 	for i := range endpoints {
 		endpoints[i] = cluster.Client(i).Endpoints()[0]
 	}
 
 	v := m.Run()
-	cluster.Terminate(nil)
+	cluster.Terminate(tb)
 	os.Exit(v)
 }
 
diff --git a/metropolis/pkg/event/memory/BUILD.bazel b/metropolis/pkg/event/memory/BUILD.bazel
index 4ba79d2..da07dc3 100644
--- a/metropolis/pkg/event/memory/BUILD.bazel
+++ b/metropolis/pkg/event/memory/BUILD.bazel
@@ -1,19 +1,19 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
 
 go_library(
-    name = "go_default_library",
+    name = "memory",
     srcs = ["memory.go"],
     importpath = "source.monogon.dev/metropolis/pkg/event/memory",
     visibility = ["//visibility:public"],
-    deps = ["//metropolis/pkg/event:go_default_library"],
+    deps = ["//metropolis/pkg/event"],
 )
 
 go_test(
-    name = "go_default_test",
+    name = "memory_test",
     srcs = [
         "example_test.go",
         "memory_test.go",
     ],
-    embed = [":go_default_library"],
-    deps = ["//metropolis/pkg/event:go_default_library"],
+    embed = [":memory"],
+    deps = ["//metropolis/pkg/event"],
 )
diff --git a/metropolis/pkg/fileargs/BUILD.bazel b/metropolis/pkg/fileargs/BUILD.bazel
index 3abaf26..0b7b2fc 100644
--- a/metropolis/pkg/fileargs/BUILD.bazel
+++ b/metropolis/pkg/fileargs/BUILD.bazel
@@ -1,9 +1,9 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "fileargs",
     srcs = ["fileargs.go"],
     importpath = "source.monogon.dev/metropolis/pkg/fileargs",
     visibility = ["//metropolis:__subpackages__"],
-    deps = ["@org_golang_x_sys//unix:go_default_library"],
+    deps = ["@org_golang_x_sys//unix"],
 )
diff --git a/metropolis/pkg/freeport/BUILD.bazel b/metropolis/pkg/freeport/BUILD.bazel
index 990cfa8..6933128 100644
--- a/metropolis/pkg/freeport/BUILD.bazel
+++ b/metropolis/pkg/freeport/BUILD.bazel
@@ -1,7 +1,7 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "freeport",
     srcs = ["freeport.go"],
     importpath = "source.monogon.dev/metropolis/pkg/freeport",
     visibility = ["//metropolis:__subpackages__"],
diff --git a/metropolis/pkg/fsquota/BUILD.bazel b/metropolis/pkg/fsquota/BUILD.bazel
index b25d812..5fa7037 100644
--- a/metropolis/pkg/fsquota/BUILD.bazel
+++ b/metropolis/pkg/fsquota/BUILD.bazel
@@ -2,25 +2,25 @@
 load("//metropolis/test/ktest:ktest.bzl", "ktest")
 
 go_library(
-    name = "go_default_library",
+    name = "fsquota",
     srcs = ["fsquota.go"],
     importpath = "source.monogon.dev/metropolis/pkg/fsquota",
     visibility = ["//metropolis:__subpackages__"],
     deps = [
-        "//metropolis/pkg/fsquota/fsxattrs:go_default_library",
-        "//metropolis/pkg/fsquota/quotactl:go_default_library",
-        "@org_golang_x_sys//unix:go_default_library",
+        "//metropolis/pkg/fsquota/fsxattrs",
+        "//metropolis/pkg/fsquota/quotactl",
+        "@org_golang_x_sys//unix",
     ],
 )
 
 go_test(
-    name = "go_default_test",
+    name = "fsquota_test",
     srcs = ["fsquota_test.go"],
-    embed = [":go_default_library"],
+    embed = [":fsquota"],
     pure = "on",
     deps = [
-        "@com_github_stretchr_testify//require:go_default_library",
-        "@org_golang_x_sys//unix:go_default_library",
+        "@com_github_stretchr_testify//require",
+        "@org_golang_x_sys//unix",
     ],
 )
 
@@ -29,5 +29,5 @@
     files_cc = {
         "@xfsprogs//:mkfs": "/mkfs.xfs",
     },
-    tester = ":go_default_test",
+    tester = ":fsquota_test",
 )
diff --git a/metropolis/pkg/fsquota/fsxattrs/BUILD.bazel b/metropolis/pkg/fsquota/fsxattrs/BUILD.bazel
index 5af2ebb..2d23e99 100644
--- a/metropolis/pkg/fsquota/fsxattrs/BUILD.bazel
+++ b/metropolis/pkg/fsquota/fsxattrs/BUILD.bazel
@@ -1,9 +1,9 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "fsxattrs",
     srcs = ["fsxattrs.go"],
     importpath = "source.monogon.dev/metropolis/pkg/fsquota/fsxattrs",
     visibility = ["//metropolis:__subpackages__"],
-    deps = ["@org_golang_x_sys//unix:go_default_library"],
+    deps = ["@org_golang_x_sys//unix"],
 )
diff --git a/metropolis/pkg/fsquota/quotactl/BUILD.bazel b/metropolis/pkg/fsquota/quotactl/BUILD.bazel
index 8c5205d..108b771 100644
--- a/metropolis/pkg/fsquota/quotactl/BUILD.bazel
+++ b/metropolis/pkg/fsquota/quotactl/BUILD.bazel
@@ -1,9 +1,9 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "quotactl",
     srcs = ["quotactl.go"],
     importpath = "source.monogon.dev/metropolis/pkg/fsquota/quotactl",
     visibility = ["//metropolis:__subpackages__"],
-    deps = ["@org_golang_x_sys//unix:go_default_library"],
+    deps = ["@org_golang_x_sys//unix"],
 )
diff --git a/metropolis/pkg/jsonpatch/BUILD.bazel b/metropolis/pkg/jsonpatch/BUILD.bazel
index f9b6239..3aa6d95 100644
--- a/metropolis/pkg/jsonpatch/BUILD.bazel
+++ b/metropolis/pkg/jsonpatch/BUILD.bazel
@@ -1,14 +1,14 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
 
 go_library(
-    name = "go_default_library",
+    name = "jsonpatch",
     srcs = ["jsonpatch.go.go"],
     importpath = "source.monogon.dev/metropolis/pkg/jsonpatch",
     visibility = ["//metropolis:__subpackages__"],
 )
 
 go_test(
-    name = "go_default_test",
+    name = "jsonpatch_test",
     srcs = ["jsonpatch_test.go"],
-    embed = [":go_default_library"],
+    embed = [":jsonpatch"],
 )
diff --git a/metropolis/pkg/logbuffer/BUILD.bazel b/metropolis/pkg/logbuffer/BUILD.bazel
index c3e9e2a..cd0e3af 100644
--- a/metropolis/pkg/logbuffer/BUILD.bazel
+++ b/metropolis/pkg/logbuffer/BUILD.bazel
@@ -1,22 +1,22 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
 
 go_library(
-    name = "go_default_library",
+    name = "logbuffer",
     srcs = [
         "linebuffer.go",
         "logbuffer.go",
     ],
     importpath = "source.monogon.dev/metropolis/pkg/logbuffer",
     visibility = ["//metropolis:__subpackages__"],
-    deps = ["//metropolis/proto/api:go_default_library"],
+    deps = ["//metropolis/proto/api"],
 )
 
 go_test(
-    name = "go_default_test",
+    name = "logbuffer_test",
     srcs = [
         "linebuffer_test.go",
         "logbuffer_test.go",
     ],
-    embed = [":go_default_library"],
-    deps = ["@com_github_stretchr_testify//require:go_default_library"],
+    embed = [":logbuffer"],
+    deps = ["@com_github_stretchr_testify//require"],
 )
diff --git a/metropolis/pkg/logtree/BUILD.bazel b/metropolis/pkg/logtree/BUILD.bazel
index f49430e..0df5679 100644
--- a/metropolis/pkg/logtree/BUILD.bazel
+++ b/metropolis/pkg/logtree/BUILD.bazel
@@ -1,7 +1,7 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
 
 go_library(
-    name = "go_default_library",
+    name = "logtree",
     srcs = [
         "doc.go",
         "journal.go",
@@ -19,18 +19,18 @@
     importpath = "source.monogon.dev/metropolis/pkg/logtree",
     visibility = ["//metropolis:__subpackages__"],
     deps = [
-        "//metropolis/pkg/logbuffer:go_default_library",
-        "//metropolis/proto/api:go_default_library",
+        "//metropolis/pkg/logbuffer",
+        "//metropolis/proto/api",
     ],
 )
 
 go_test(
-    name = "go_default_test",
+    name = "logtree_test",
     srcs = [
         "journal_test.go",
         "klog_test.go",
         "logtree_test.go",
     ],
-    embed = [":go_default_library"],
-    deps = ["@com_github_google_go_cmp//cmp:go_default_library"],
+    embed = [":logtree"],
+    deps = ["@com_github_google_go_cmp//cmp"],
 )
diff --git a/metropolis/pkg/logtree/unraw/BUILD.bazel b/metropolis/pkg/logtree/unraw/BUILD.bazel
index 00a15d3..646d631 100644
--- a/metropolis/pkg/logtree/unraw/BUILD.bazel
+++ b/metropolis/pkg/logtree/unraw/BUILD.bazel
@@ -1,24 +1,24 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
 
 go_library(
-    name = "go_default_library",
+    name = "unraw",
     srcs = ["unraw.go"],
     importpath = "source.monogon.dev/metropolis/pkg/logtree/unraw",
     visibility = ["//visibility:public"],
     deps = [
-        "//metropolis/pkg/logbuffer:go_default_library",
-        "//metropolis/pkg/logtree:go_default_library",
-        "//metropolis/pkg/supervisor:go_default_library",
+        "//metropolis/pkg/logbuffer",
+        "//metropolis/pkg/logtree",
+        "//metropolis/pkg/supervisor",
     ],
 )
 
 go_test(
-    name = "go_default_test",
+    name = "unraw_test",
     srcs = ["unraw_test.go"],
-    embed = [":go_default_library"],
+    embed = [":unraw"],
     deps = [
-        "//metropolis/pkg/logbuffer:go_default_library",
-        "//metropolis/pkg/logtree:go_default_library",
-        "//metropolis/pkg/supervisor:go_default_library",
+        "//metropolis/pkg/logbuffer",
+        "//metropolis/pkg/logtree",
+        "//metropolis/pkg/supervisor",
     ],
 )
diff --git a/metropolis/pkg/loop/BUILD.bazel b/metropolis/pkg/loop/BUILD.bazel
index 1bf0722..8c4e10a 100644
--- a/metropolis/pkg/loop/BUILD.bazel
+++ b/metropolis/pkg/loop/BUILD.bazel
@@ -2,24 +2,24 @@
 load("//metropolis/test/ktest:ktest.bzl", "ktest")
 
 go_library(
-    name = "go_default_library",
+    name = "loop",
     srcs = ["loop.go"],
     importpath = "source.monogon.dev/metropolis/pkg/loop",
     visibility = ["//visibility:public"],
-    deps = ["@org_golang_x_sys//unix:go_default_library"],
+    deps = ["@org_golang_x_sys//unix"],
 )
 
 go_test(
-    name = "go_default_test",
+    name = "loop_test",
     srcs = ["loop_test.go"],
-    embed = [":go_default_library"],
+    embed = [":loop"],
     deps = [
-        "@com_github_stretchr_testify//assert:go_default_library",
-        "@com_github_stretchr_testify//require:go_default_library",
-        "@org_golang_x_sys//unix:go_default_library",
+        "@com_github_stretchr_testify//assert",
+        "@com_github_stretchr_testify//require",
+        "@org_golang_x_sys//unix",
     ],
 )
 
 ktest(
-    tester = ":go_default_test",
+    tester = ":loop_test",
 )
diff --git a/metropolis/pkg/pki/BUILD.bazel b/metropolis/pkg/pki/BUILD.bazel
index 04f02ae..ec3babe 100644
--- a/metropolis/pkg/pki/BUILD.bazel
+++ b/metropolis/pkg/pki/BUILD.bazel
@@ -1,7 +1,7 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
 
 go_library(
-    name = "go_default_library",
+    name = "pki",
     srcs = [
         "ca.go",
         "certificate.go",
@@ -11,23 +11,24 @@
     importpath = "source.monogon.dev/metropolis/pkg/pki",
     visibility = ["//visibility:public"],
     deps = [
-        "//metropolis/node/core/consensus/client:go_default_library",
-        "//metropolis/pkg/event:go_default_library",
-        "//metropolis/pkg/event/etcd:go_default_library",
-        "//metropolis/pkg/fileargs:go_default_library",
-        "@io_etcd_go_etcd//clientv3:go_default_library",
+        "//metropolis/node/core/consensus/client",
+        "//metropolis/pkg/event",
+        "//metropolis/pkg/event/etcd",
+        "//metropolis/pkg/fileargs",
+        "@io_etcd_go_etcd_client_v3//:client",
     ],
 )
 
 go_test(
-    name = "go_default_test",
+    name = "pki_test",
     srcs = [
         "certificate_test.go",
         "crl_test.go",
     ],
-    embed = [":go_default_library"],
+    embed = [":pki"],
     deps = [
-        "//metropolis/node/core/consensus/client:go_default_library",
-        "@io_etcd_go_etcd//integration:go_default_library",
+        "//metropolis/node/core/consensus/client",
+        "@io_etcd_go_etcd_client_pkg_v3//testutil",
+        "@io_etcd_go_etcd_tests_v3//integration",
     ],
 )
diff --git a/metropolis/pkg/pki/ca.go b/metropolis/pkg/pki/ca.go
index 7c03f9f..29d1335 100644
--- a/metropolis/pkg/pki/ca.go
+++ b/metropolis/pkg/pki/ca.go
@@ -25,7 +25,7 @@
 	"math/big"
 	"time"
 
-	"go.etcd.io/etcd/clientv3"
+	clientv3 "go.etcd.io/etcd/client/v3"
 )
 
 // Issuer is an entity that can issue certificates. This interface is
diff --git a/metropolis/pkg/pki/certificate.go b/metropolis/pkg/pki/certificate.go
index f6d480a..a423680 100644
--- a/metropolis/pkg/pki/certificate.go
+++ b/metropolis/pkg/pki/certificate.go
@@ -29,7 +29,7 @@
 	"fmt"
 	"net"
 
-	"go.etcd.io/etcd/clientv3"
+	clientv3 "go.etcd.io/etcd/client/v3"
 
 	"source.monogon.dev/metropolis/pkg/fileargs"
 )
diff --git a/metropolis/pkg/pki/certificate_test.go b/metropolis/pkg/pki/certificate_test.go
index da8dee9..d38b559 100644
--- a/metropolis/pkg/pki/certificate_test.go
+++ b/metropolis/pkg/pki/certificate_test.go
@@ -8,17 +8,20 @@
 	"crypto/x509"
 	"testing"
 
-	"go.etcd.io/etcd/integration"
+	"go.etcd.io/etcd/client/pkg/v3/testutil"
+	"go.etcd.io/etcd/tests/v3/integration"
 )
 
 // TestManaged ensures Managed Certificates work, including re-ensuring
 // certificates with the same data and issuing subordinate certificates.
 func TestManaged(t *testing.T) {
-	cluster := integration.NewClusterV3(nil, &integration.ClusterConfig{
+	tb, cancel := testutil.NewTestingTBProthesis("pki-managed")
+	defer cancel()
+	cluster := integration.NewClusterV3(tb, &integration.ClusterConfig{
 		Size: 1,
 	})
 	cl := cluster.Client(0)
-	defer cluster.Terminate(nil)
+	defer cluster.Terminate(tb)
 	ctx, ctxC := context.WithCancel(context.Background())
 	defer ctxC()
 	ns := Namespaced("/test-managed/")
@@ -100,11 +103,13 @@
 // re-Ensuring certificates with the same public key, and attempting to re-issue
 // the same certificate with a different public key (which should fail).
 func TestExternal(t *testing.T) {
-	cluster := integration.NewClusterV3(nil, &integration.ClusterConfig{
+	tb, cancel := testutil.NewTestingTBProthesis("pki-managed")
+	defer cancel()
+	cluster := integration.NewClusterV3(tb, &integration.ClusterConfig{
 		Size: 1,
 	})
 	cl := cluster.Client(0)
-	defer cluster.Terminate(nil)
+	defer cluster.Terminate(tb)
 	ctx, ctxC := context.WithCancel(context.Background())
 	defer ctxC()
 	ns := Namespaced("/test-external/")
diff --git a/metropolis/pkg/pki/crl.go b/metropolis/pkg/pki/crl.go
index 2627776..8b886bf 100644
--- a/metropolis/pkg/pki/crl.go
+++ b/metropolis/pkg/pki/crl.go
@@ -9,7 +9,7 @@
 	"math/big"
 	"time"
 
-	"go.etcd.io/etcd/clientv3"
+	clientv3 "go.etcd.io/etcd/client/v3"
 
 	"source.monogon.dev/metropolis/node/core/consensus/client"
 	"source.monogon.dev/metropolis/pkg/event"
diff --git a/metropolis/pkg/pki/crl_test.go b/metropolis/pkg/pki/crl_test.go
index 39a0b0e..8f9cf5d 100644
--- a/metropolis/pkg/pki/crl_test.go
+++ b/metropolis/pkg/pki/crl_test.go
@@ -5,7 +5,8 @@
 	"crypto/x509"
 	"testing"
 
-	"go.etcd.io/etcd/integration"
+	"go.etcd.io/etcd/client/pkg/v3/testutil"
+	"go.etcd.io/etcd/tests/v3/integration"
 
 	"source.monogon.dev/metropolis/node/core/consensus/client"
 )
@@ -13,11 +14,13 @@
 // TestRevoke exercises the CRL revocation and watching functionality of a CA
 // certificate.
 func TestRevoke(t *testing.T) {
-	cluster := integration.NewClusterV3(nil, &integration.ClusterConfig{
+	tb, cancel := testutil.NewTestingTBProthesis("pki-revoke")
+	defer cancel()
+	cluster := integration.NewClusterV3(tb, &integration.ClusterConfig{
 		Size: 1,
 	})
 	cl := client.NewLocal(cluster.Client(0))
-	defer cluster.Terminate(nil)
+	defer cluster.Terminate(tb)
 	ctx, ctxC := context.WithCancel(context.Background())
 	defer ctxC()
 	ns := Namespaced("/test-managed/")
diff --git a/metropolis/pkg/supervisor/BUILD.bazel b/metropolis/pkg/supervisor/BUILD.bazel
index fdac70f..f51612c 100644
--- a/metropolis/pkg/supervisor/BUILD.bazel
+++ b/metropolis/pkg/supervisor/BUILD.bazel
@@ -1,7 +1,7 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
 
 go_library(
-    name = "go_default_library",
+    name = "supervisor",
     srcs = [
         "supervisor.go",
         "supervisor_node.go",
@@ -12,15 +12,15 @@
     importpath = "source.monogon.dev/metropolis/pkg/supervisor",
     visibility = ["//metropolis:__subpackages__"],
     deps = [
-        "//metropolis/pkg/logtree:go_default_library",
-        "@com_github_cenkalti_backoff_v4//:go_default_library",
+        "//metropolis/pkg/logtree",
+        "@com_github_cenkalti_backoff_v4//:backoff",
         "@org_golang_google_grpc//:go_default_library",
     ],
 )
 
 go_test(
-    name = "go_default_test",
+    name = "supervisor_test",
     srcs = ["supervisor_test.go"],
-    embed = [":go_default_library"],
-    deps = ["//metropolis/pkg/logtree:go_default_library"],
+    embed = [":supervisor"],
+    deps = ["//metropolis/pkg/logtree"],
 )
diff --git a/metropolis/pkg/sysfs/BUILD.bazel b/metropolis/pkg/sysfs/BUILD.bazel
index 87fa937..068f9f6 100644
--- a/metropolis/pkg/sysfs/BUILD.bazel
+++ b/metropolis/pkg/sysfs/BUILD.bazel
@@ -1,7 +1,7 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "sysfs",
     srcs = [
         "block.go",
         "uevents.go",
diff --git a/metropolis/pkg/tpm/BUILD.bazel b/metropolis/pkg/tpm/BUILD.bazel
index da2154a..4873a82 100644
--- a/metropolis/pkg/tpm/BUILD.bazel
+++ b/metropolis/pkg/tpm/BUILD.bazel
@@ -1,7 +1,7 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "tpm",
     srcs = [
         "credactivation_compat.go",
         "tpm.go",
@@ -9,15 +9,15 @@
     importpath = "source.monogon.dev/metropolis/pkg/tpm",
     visibility = ["//metropolis:__subpackages__"],
     deps = [
-        "//metropolis/pkg/logtree:go_default_library",
-        "//metropolis/pkg/sysfs:go_default_library",
-        "//metropolis/pkg/tpm/proto:go_default_library",
+        "//metropolis/pkg/logtree",
+        "//metropolis/pkg/sysfs",
+        "//metropolis/pkg/tpm/proto",
         "@com_github_golang_protobuf//proto:go_default_library",
-        "@com_github_google_go_tpm//tpm2:go_default_library",
-        "@com_github_google_go_tpm//tpmutil:go_default_library",
-        "@com_github_google_go_tpm_tools//tpm2tools:go_default_library",
-        "@com_github_pkg_errors//:go_default_library",
-        "@org_golang_x_crypto//nacl/secretbox:go_default_library",
-        "@org_golang_x_sys//unix:go_default_library",
+        "@com_github_google_go_tpm//tpm2",
+        "@com_github_google_go_tpm//tpmutil",
+        "@com_github_google_go_tpm_tools//client",
+        "@com_github_pkg_errors//:errors",
+        "@org_golang_x_crypto//nacl/secretbox",
+        "@org_golang_x_sys//unix",
     ],
 )
diff --git a/metropolis/pkg/tpm/credactivation_compat.go b/metropolis/pkg/tpm/credactivation_compat.go
index a6710ae..24766a7 100644
--- a/metropolis/pkg/tpm/credactivation_compat.go
+++ b/metropolis/pkg/tpm/credactivation_compat.go
@@ -46,7 +46,7 @@
 )
 
 func generateRSA(aik *tpm2.HashValue, pub *rsa.PublicKey, symBlockSize int, secret []byte, rnd io.Reader) ([]byte, []byte, error) {
-	newAIKHash, err := aik.Alg.HashConstructor()
+	aikHash, err := aik.Alg.Hash()
 	if err != nil {
 		return nil, nil, err
 	}
@@ -63,7 +63,7 @@
 	// Encrypt the seed value using the provided public key.
 	// See annex B, section 10.4 of the TPM specification revision 2 part 1.
 	label := append([]byte(labelIdentity), 0)
-	encSecret, err := rsa.EncryptOAEP(newAIKHash(), rnd, pub, seed, label)
+	encSecret, err := rsa.EncryptOAEP(aikHash.New(), rnd, pub, seed, label)
 	if err != nil {
 		return nil, nil, fmt.Errorf("generating encrypted seed: %v", err)
 	}
@@ -95,12 +95,12 @@
 	// Generate the integrity HMAC, which is used to protect the integrity of the
 	// encrypted structure.
 	// See section 24.5 of the TPM specification revision 2 part 1.
-	macKey, err := tpm2.KDFa(aik.Alg, seed, labelIntegrity, nil, nil, newAIKHash().Size()*8)
+	macKey, err := tpm2.KDFa(aik.Alg, seed, labelIntegrity, nil, nil, aikHash.Size()*8)
 	if err != nil {
 		return nil, nil, fmt.Errorf("generating HMAC key: %v", err)
 	}
 
-	mac := hmac.New(newAIKHash, macKey)
+	mac := hmac.New(aikHash.New, macKey)
 	mac.Write(encIdentity)
 	mac.Write(aikNameEncoded)
 	integrityHMAC := mac.Sum(nil)
diff --git a/metropolis/pkg/tpm/eventlog/BUILD.bazel b/metropolis/pkg/tpm/eventlog/BUILD.bazel
index a678808..7bbd464 100644
--- a/metropolis/pkg/tpm/eventlog/BUILD.bazel
+++ b/metropolis/pkg/tpm/eventlog/BUILD.bazel
@@ -1,7 +1,7 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "eventlog",
     srcs = [
         "compat.go",
         "eventlog.go",
@@ -10,8 +10,8 @@
     importpath = "source.monogon.dev/metropolis/pkg/tpm/eventlog",
     visibility = ["//metropolis:__subpackages__"],
     deps = [
-        "//metropolis/pkg/tpm/eventlog/internal:go_default_library",
-        "@com_github_google_certificate_transparency_go//x509:go_default_library",
-        "@com_github_google_go_tpm//tpm2:go_default_library",
+        "//metropolis/pkg/tpm/eventlog/internal",
+        "@com_github_google_certificate_transparency_go//x509",
+        "@com_github_google_go_tpm//tpm2",
     ],
 )
diff --git a/metropolis/pkg/tpm/eventlog/internal/BUILD.bazel b/metropolis/pkg/tpm/eventlog/internal/BUILD.bazel
index d4730aa..f134e7c 100644
--- a/metropolis/pkg/tpm/eventlog/internal/BUILD.bazel
+++ b/metropolis/pkg/tpm/eventlog/internal/BUILD.bazel
@@ -1,12 +1,12 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "internal",
     srcs = ["events.go"],
     importpath = "source.monogon.dev/metropolis/pkg/tpm/eventlog/internal",
     visibility = ["//metropolis/pkg/tpm/eventlog:__subpackages__"],
     deps = [
-        "@com_github_google_certificate_transparency_go//asn1:go_default_library",
-        "@com_github_google_certificate_transparency_go//x509:go_default_library",
+        "@com_github_google_certificate_transparency_go//asn1",
+        "@com_github_google_certificate_transparency_go//x509",
     ],
 )
diff --git a/metropolis/pkg/tpm/proto/BUILD.bazel b/metropolis/pkg/tpm/proto/BUILD.bazel
index 7d7ee86..81c42e6 100644
--- a/metropolis/pkg/tpm/proto/BUILD.bazel
+++ b/metropolis/pkg/tpm/proto/BUILD.bazel
@@ -6,7 +6,7 @@
     name = "proto_proto",
     srcs = ["tpm.proto"],
     visibility = ["//visibility:public"],
-    deps = ["@com_github_google_go_tpm_tools//proto:proto_proto"],  #keep
+    deps = ["@com_github_google_go_tpm_tools//proto/tpm:tpm_proto"],  #keep
 )
 
 go_proto_library(
@@ -14,11 +14,11 @@
     importpath = "source.monogon.dev/metropolis/pkg/tpm/proto",
     proto = ":proto_proto",
     visibility = ["//visibility:public"],
-    deps = ["@com_github_google_go_tpm_tools//proto:go_default_library"],  #keep
+    deps = ["@com_github_google_go_tpm_tools//proto/tpm"],  #keep
 )
 
 go_library(
-    name = "go_default_library",
+    name = "proto",
     embed = [":proto_go_proto"],
     importpath = "source.monogon.dev/metropolis/pkg/tpm/proto",
     visibility = ["//visibility:public"],
diff --git a/metropolis/pkg/tpm/proto/tpm.proto b/metropolis/pkg/tpm/proto/tpm.proto
index 29b74aa..9f86291 100644
--- a/metropolis/pkg/tpm/proto/tpm.proto
+++ b/metropolis/pkg/tpm/proto/tpm.proto
@@ -2,7 +2,7 @@
 option go_package = "source.monogon.dev/metropolis/pkg/tpm/proto";
 package metropolis.pkg.tpm;
 
-import "proto/tpm.proto";
+import "proto/tpm/tpm.proto";
 
 // ExtendedSealedBytes contains data sealed by a TPM2 via an indirection to
 // allow for more than 128 bytes of payload. It seals an ephemeral key for
@@ -10,7 +10,7 @@
 // key.
 message ExtendedSealedBytes {
   // The secretbox key, as sealed by the TPM.
-  .proto.SealedBytes sealed_key = 1;
+  .tpm.SealedBytes sealed_key = 1;
   // The encrypted box contents.
   bytes encrypted_payload = 2;
 }
\ No newline at end of file
diff --git a/metropolis/pkg/tpm/tpm.go b/metropolis/pkg/tpm/tpm.go
index fe7c698..2b7d20d 100644
--- a/metropolis/pkg/tpm/tpm.go
+++ b/metropolis/pkg/tpm/tpm.go
@@ -32,7 +32,7 @@
 	"time"
 
 	"github.com/golang/protobuf/proto"
-	"github.com/google/go-tpm-tools/tpm2tools"
+	tpm2tools "github.com/google/go-tpm-tools/client"
 	"github.com/google/go-tpm/tpm2"
 	"github.com/google/go-tpm/tpmutil"
 	"github.com/pkg/errors"
@@ -247,7 +247,7 @@
 	// therefore we can just leave it all-zero.
 	var unusedNonce [24]byte
 	encryptedData := secretbox.Seal(nil, data, &unusedNonce, &boxKeyArr)
-	sealedKey, err := srk.Seal(pcrs, boxKey)
+	sealedKey, err := srk.Seal(boxKey, tpm2tools.SealOpts{Current: tpm2.PCRSelection{Hash: tpm2.AlgSHA256, PCRs: pcrs}})
 	if err != nil {
 		return []byte{}, fmt.Errorf("failed to seal boxKey: %w", err)
 	}
@@ -286,7 +286,7 @@
 		pcrList = append(pcrList, string(pcr))
 	}
 	tpm.logger.Infof("Attempting to unseal key protected with PCRs %s", strings.Join(pcrList, ","))
-	unsealedKey, err := srk.Unseal(sealedBytes.SealedKey)
+	unsealedKey, err := srk.Unseal(sealedBytes.SealedKey, tpm2tools.UnsealOpts{})
 	if err != nil {
 		return []byte{}, errors.Wrap(err, "failed to unseal key")
 	}
@@ -460,7 +460,7 @@
 	}
 	defer tpm2.FlushContext(tpm.device, endorsementSession)
 
-	_, err = tpm2.PolicySecret(tpm.device, tpm2.HandleEndorsement, tpm2.AuthCommand{Session: tpm2.HandlePasswordSession, Attributes: tpm2.AttrContinueSession}, endorsementSession, nil, nil, nil, 0)
+	_, _, err = tpm2.PolicySecret(tpm.device, tpm2.HandleEndorsement, tpm2.AuthCommand{Session: tpm2.HandlePasswordSession, Attributes: tpm2.AttrContinueSession}, endorsementSession, nil, nil, nil, 0)
 	if err != nil {
 		return []byte{}, fmt.Errorf("failed to make a policy secret session: %w", err)
 	}
diff --git a/metropolis/pkg/verity/BUILD.bazel b/metropolis/pkg/verity/BUILD.bazel
index b500b31..7e0e465 100644
--- a/metropolis/pkg/verity/BUILD.bazel
+++ b/metropolis/pkg/verity/BUILD.bazel
@@ -2,24 +2,24 @@
 load("//metropolis/test/ktest:ktest.bzl", "ktest")
 
 go_library(
-    name = "go_default_library",
+    name = "verity",
     srcs = ["encoder.go"],
     importpath = "source.monogon.dev/metropolis/pkg/verity",
     visibility = ["//visibility:public"],
 )
 
 go_test(
-    name = "go_default_test",
+    name = "verity_test",
     srcs = ["encoder_test.go"],
-    embed = [":go_default_library"],
+    embed = [":verity"],
     deps = [
-        "//metropolis/pkg/devicemapper:go_default_library",
-        "@com_github_stretchr_testify//require:go_default_library",
-        "@org_golang_x_sys//unix:go_default_library",
+        "//metropolis/pkg/devicemapper",
+        "@com_github_stretchr_testify//require",
+        "@org_golang_x_sys//unix",
     ],
 )
 
 ktest(
     cmdline = "ramdisk_size=16384",
-    tester = ":go_default_test",
+    tester = ":verity_test",
 )
diff --git a/metropolis/proto/api/BUILD.bazel b/metropolis/proto/api/BUILD.bazel
index 9f46fb4..b732f18 100644
--- a/metropolis/proto/api/BUILD.bazel
+++ b/metropolis/proto/api/BUILD.bazel
@@ -24,13 +24,13 @@
     proto = ":api_proto",
     visibility = ["//visibility:public"],
     deps = [
-        "//metropolis/proto/common:go_default_library",
-        "//metropolis/proto/ext:go_default_library",
+        "//metropolis/proto/common",
+        "//metropolis/proto/ext",
     ],
 )
 
 go_library(
-    name = "go_default_library",
+    name = "api",
     embed = [":api_go_proto"],
     importpath = "source.monogon.dev/metropolis/proto/api",
     visibility = ["//visibility:public"],
diff --git a/metropolis/proto/common/BUILD.bazel b/metropolis/proto/common/BUILD.bazel
index b451dd4..45dafd8 100644
--- a/metropolis/proto/common/BUILD.bazel
+++ b/metropolis/proto/common/BUILD.bazel
@@ -16,7 +16,7 @@
 )
 
 go_library(
-    name = "go_default_library",
+    name = "common",
     embed = [":common_go_proto"],
     importpath = "source.monogon.dev/metropolis/proto/common",
     visibility = ["//metropolis:__subpackages__"],
diff --git a/metropolis/proto/ext/BUILD.bazel b/metropolis/proto/ext/BUILD.bazel
index c93882e..e84153b 100644
--- a/metropolis/proto/ext/BUILD.bazel
+++ b/metropolis/proto/ext/BUILD.bazel
@@ -17,7 +17,7 @@
 )
 
 go_library(
-    name = "go_default_library",
+    name = "ext",
     embed = [":ext_go_proto"],
     importpath = "source.monogon.dev/metropolis/proto/ext",
     visibility = ["//visibility:public"],
diff --git a/metropolis/proto/private/BUILD.bazel b/metropolis/proto/private/BUILD.bazel
index 8f7cd50..57b7ba4 100644
--- a/metropolis/proto/private/BUILD.bazel
+++ b/metropolis/proto/private/BUILD.bazel
@@ -16,7 +16,7 @@
 )
 
 go_library(
-    name = "go_default_library",
+    name = "private",
     embed = [":private_go_proto"],
     importpath = "source.monogon.dev/metropolis/proto/private",
     visibility = ["//metropolis:__subpackages__"],
diff --git a/metropolis/test/e2e/BUILD.bazel b/metropolis/test/e2e/BUILD.bazel
index 138fd4a..30932de 100644
--- a/metropolis/test/e2e/BUILD.bazel
+++ b/metropolis/test/e2e/BUILD.bazel
@@ -1,7 +1,7 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
 
 go_library(
-    name = "go_default_library",
+    name = "e2e",
     srcs = [
         "kubernetes_helpers.go",
         "utils.go",
@@ -9,19 +9,19 @@
     importpath = "source.monogon.dev/metropolis/test/e2e",
     visibility = ["//metropolis/test:__subpackages__"],
     deps = [
-        "//metropolis/test/launch/cluster:go_default_library",
-        "@io_k8s_api//apps/v1:go_default_library",
-        "@io_k8s_api//core/v1:go_default_library",
-        "@io_k8s_apimachinery//pkg/api/resource:go_default_library",
-        "@io_k8s_apimachinery//pkg/apis/meta/v1:go_default_library",
-        "@io_k8s_apimachinery//pkg/util/intstr:go_default_library",
-        "@io_k8s_client_go//kubernetes:go_default_library",
-        "@io_k8s_client_go//rest:go_default_library",
+        "//metropolis/test/launch/cluster",
+        "@io_k8s_api//apps/v1:apps",
+        "@io_k8s_api//core/v1:core",
+        "@io_k8s_apimachinery//pkg/api/resource",
+        "@io_k8s_apimachinery//pkg/apis/meta/v1:meta",
+        "@io_k8s_apimachinery//pkg/util/intstr",
+        "@io_k8s_client_go//kubernetes",
+        "@io_k8s_client_go//rest",
     ],
 )
 
 go_test(
-    name = "go_default_test",
+    name = "e2e_test",
     size = "large",
     srcs = ["main_test.go"],
     data = [
@@ -29,16 +29,16 @@
         "//metropolis/node:swtpm_data",
         "//third_party/edk2:firmware",
     ],
-    embed = [":go_default_library"],
+    embed = [":e2e"],
     rundir = ".",
     deps = [
-        "//metropolis/node:go_default_library",
-        "//metropolis/node/core/identity:go_default_library",
-        "//metropolis/proto/api:go_default_library",
-        "//metropolis/test/launch/cluster:go_default_library",
-        "@io_k8s_api//core/v1:go_default_library",
-        "@io_k8s_apimachinery//pkg/api/resource:go_default_library",
-        "@io_k8s_apimachinery//pkg/apis/meta/v1:go_default_library",
-        "@io_k8s_kubernetes//pkg/api/v1/pod:go_default_library",
+        "//metropolis/node",
+        "//metropolis/node/core/identity",
+        "//metropolis/proto/api",
+        "//metropolis/test/launch/cluster",
+        "@io_k8s_api//core/v1:core",
+        "@io_k8s_apimachinery//pkg/api/resource",
+        "@io_k8s_apimachinery//pkg/apis/meta/v1:meta",
+        "@io_k8s_kubernetes//pkg/api/v1/pod",
     ],
 )
diff --git a/metropolis/test/e2e/k8s_cts/BUILD.bazel b/metropolis/test/e2e/k8s_cts/BUILD.bazel
index 2d8ac79..6cc4080 100644
--- a/metropolis/test/e2e/k8s_cts/BUILD.bazel
+++ b/metropolis/test/e2e/k8s_cts/BUILD.bazel
@@ -1,47 +1,22 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
-load("@io_bazel_rules_docker//go:image.bzl", "go_image")
-load("@io_bazel_rules_docker//container:container.bzl", "container_image")
-
-go_image(
-    name = "kubectl",
-    binary = "@io_k8s_kubernetes//cmd/kubectl",
-    pure = "on",
-)
-
-container_image(
-    name = "kubectl_in_path",
-    base = ":kubectl",
-    env = {
-        # Don't include FHS paths since they aren't available anyways
-        "PATH": "/app/cmd/kubectl",
-    },
-)
-
-go_image(
-    name = "k8s_cts_image",
-    base = ":kubectl_in_path",
-    binary = "@io_k8s_kubernetes//test/e2e:e2e.test",
-    pure = "on",
-    visibility = ["//metropolis/node:__pkg__"],
-)
 
 go_library(
-    name = "go_default_library",
+    name = "k8s_cts_lib",
     srcs = ["main.go"],
     importpath = "source.monogon.dev/metropolis/test/e2e/k8s_cts",
     visibility = ["//visibility:private"],
     deps = [
-        "//metropolis/node:go_default_library",
-        "//metropolis/test/e2e:go_default_library",
-        "//metropolis/test/launch/cluster:go_default_library",
-        "@io_k8s_api//core/v1:go_default_library",
-        "@io_k8s_api//rbac/v1:go_default_library",
-        "@io_k8s_apimachinery//pkg/apis/meta/v1:go_default_library",
+        "//metropolis/node",
+        "//metropolis/test/e2e",
+        "//metropolis/test/launch/cluster",
+        "@io_k8s_api//core/v1:core",
+        "@io_k8s_api//rbac/v1:rbac",
+        "@io_k8s_apimachinery//pkg/apis/meta/v1:meta",
     ],
 )
 
 go_binary(
     name = "k8s_cts",
-    embed = [":go_default_library"],
+    embed = [":k8s_cts_lib"],
     visibility = ["//visibility:private"],
 )
diff --git a/metropolis/test/e2e/kubernetes_helpers.go b/metropolis/test/e2e/kubernetes_helpers.go
index ec12ca0..44fa660 100644
--- a/metropolis/test/e2e/kubernetes_helpers.go
+++ b/metropolis/test/e2e/kubernetes_helpers.go
@@ -79,7 +79,7 @@
 							// TODO(phab/T793): Build and preseed our own container images
 							Image: "nginx:alpine",
 							ReadinessProbe: &corev1.Probe{
-								Handler: corev1.Handler{
+								ProbeHandler: corev1.ProbeHandler{
 									HTTPGet: &corev1.HTTPGetAction{Port: intstr.FromInt(80)},
 								},
 							},
@@ -123,7 +123,7 @@
 							Name:  "test",
 							Image: "nginx:alpine",
 							ReadinessProbe: &corev1.Probe{
-								Handler: corev1.Handler{
+								ProbeHandler: corev1.ProbeHandler{
 									HTTPGet: &corev1.HTTPGetAction{Port: intstr.FromInt(80)},
 								},
 							},
diff --git a/metropolis/test/e2e/main_test.go b/metropolis/test/e2e/main_test.go
index 80140a3..f7dfff8 100644
--- a/metropolis/test/e2e/main_test.go
+++ b/metropolis/test/e2e/main_test.go
@@ -265,7 +265,7 @@
 						Containers: []corev1.Container{{
 							Name:            "preseed-test-1",
 							ImagePullPolicy: corev1.PullNever,
-							Image:           "bazel/metropolis/test/e2e/preseedtest:preseedtest",
+							Image:           "bazel/metropolis/test/e2e/preseedtest:preseedtest_image",
 						}},
 						RestartPolicy: corev1.RestartPolicyNever,
 					},
diff --git a/metropolis/test/e2e/preseedtest/BUILD.bazel b/metropolis/test/e2e/preseedtest/BUILD.bazel
index f88d9ad..8f13e23 100644
--- a/metropolis/test/e2e/preseedtest/BUILD.bazel
+++ b/metropolis/test/e2e/preseedtest/BUILD.bazel
@@ -2,15 +2,15 @@
 load("@io_bazel_rules_docker//go:image.bzl", "go_image")
 
 go_library(
-    name = "go_default_library",
+    name = "preseedtest",
     srcs = ["main.go"],
     importpath = "source.monogon.dev/metropolis/test/e2e/preseedtest",
     visibility = ["//visibility:private"],
 )
 
 go_image(
-    name = "preseedtest",
-    embed = [":go_default_library"],
+    name = "preseedtest_image",
+    embed = [":preseedtest"],
     pure = "on",
     visibility = ["//metropolis/node:__pkg__"],
 )
diff --git a/metropolis/test/ktest/BUILD b/metropolis/test/ktest/BUILD
index e994c48..0a5f5b3 100644
--- a/metropolis/test/ktest/BUILD
+++ b/metropolis/test/ktest/BUILD
@@ -3,16 +3,16 @@
 load("//third_party/linux:def.bzl", "linux_image")
 
 go_library(
-    name = "go_default_library",
+    name = "ktest_lib",
     srcs = ["main.go"],
     importpath = "source.monogon.dev/metropolis/test/ktest",
     visibility = ["//visibility:private"],
-    deps = ["//metropolis/test/launch:go_default_library"],
+    deps = ["//metropolis/test/launch"],
 )
 
 go_binary(
     name = "ktest",
-    embed = [":go_default_library"],
+    embed = [":ktest_lib"],
     pure = "on",
     visibility = ["//metropolis:__subpackages__"],
 )
diff --git a/metropolis/test/ktest/init/BUILD.bazel b/metropolis/test/ktest/init/BUILD.bazel
index 93637aa..f6b540f 100644
--- a/metropolis/test/ktest/init/BUILD.bazel
+++ b/metropolis/test/ktest/init/BUILD.bazel
@@ -1,16 +1,16 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "init_lib",
     srcs = ["main.go"],
     importpath = "source.monogon.dev/metropolis/test/ktest/init",
     visibility = ["//visibility:private"],
-    deps = ["@org_golang_x_sys//unix:go_default_library"],
+    deps = ["@org_golang_x_sys//unix"],
 )
 
 go_binary(
     name = "init",
-    embed = [":go_default_library"],
+    embed = [":init_lib"],
     pure = "on",
     visibility = ["//metropolis:__subpackages__"],
 )
diff --git a/metropolis/test/launch/BUILD.bazel b/metropolis/test/launch/BUILD.bazel
index 1cb6b24..4508dd5 100644
--- a/metropolis/test/launch/BUILD.bazel
+++ b/metropolis/test/launch/BUILD.bazel
@@ -1,14 +1,14 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "launch",
     srcs = ["launch.go"],
     importpath = "source.monogon.dev/metropolis/test/launch",
     visibility = ["//metropolis:__subpackages__"],
     deps = [
-        "//metropolis/node:go_default_library",
-        "//metropolis/pkg/freeport:go_default_library",
+        "//metropolis/node",
+        "//metropolis/pkg/freeport",
         "@org_golang_google_grpc//:go_default_library",
-        "@org_golang_x_sys//unix:go_default_library",
+        "@org_golang_x_sys//unix",
     ],
 )
diff --git a/metropolis/test/launch/cli/launch-multi2/BUILD.bazel b/metropolis/test/launch/cli/launch-multi2/BUILD.bazel
index 932b57b..c53b626 100644
--- a/metropolis/test/launch/cli/launch-multi2/BUILD.bazel
+++ b/metropolis/test/launch/cli/launch-multi2/BUILD.bazel
@@ -1,13 +1,13 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "launch-multi2_lib",
     srcs = ["main.go"],
     importpath = "source.monogon.dev/metropolis/test/launch/cli/launch-multi2",
     visibility = ["//visibility:private"],
     deps = [
-        "//metropolis/cli/pkg/context:go_default_library",
-        "//metropolis/test/launch/cluster:go_default_library",
+        "//metropolis/cli/pkg/context",
+        "//metropolis/test/launch/cluster",
     ],
 )
 
@@ -21,6 +21,6 @@
         "//third_party/edk2:firmware",
         "@com_github_bonzini_qboot//:qboot-bin",
     ],
-    embed = [":go_default_library"],
+    embed = [":launch-multi2_lib"],
     visibility = ["//:__pkg__"],
 )
diff --git a/metropolis/test/launch/cli/launch/BUILD.bazel b/metropolis/test/launch/cli/launch/BUILD.bazel
index cb2cbb5..31d491a 100644
--- a/metropolis/test/launch/cli/launch/BUILD.bazel
+++ b/metropolis/test/launch/cli/launch/BUILD.bazel
@@ -1,15 +1,15 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "launch_lib",
     srcs = ["main.go"],
     importpath = "source.monogon.dev/metropolis/test/launch/cli/launch",
     visibility = ["//visibility:private"],
     deps = [
-        "//metropolis/cli/pkg/context:go_default_library",
-        "//metropolis/proto/api:go_default_library",
-        "//metropolis/test/launch:go_default_library",
-        "//metropolis/test/launch/cluster:go_default_library",
+        "//metropolis/cli/pkg/context",
+        "//metropolis/proto/api",
+        "//metropolis/test/launch",
+        "//metropolis/test/launch/cluster",
     ],
 )
 
@@ -20,6 +20,6 @@
         "//metropolis/node:swtpm_data",
         "//third_party/edk2:firmware",
     ],
-    embed = [":go_default_library"],
+    embed = [":launch_lib"],
     visibility = ["//:__pkg__"],
 )
diff --git a/metropolis/test/launch/cluster/BUILD.bazel b/metropolis/test/launch/cluster/BUILD.bazel
index 8e829df..2ca9816 100644
--- a/metropolis/test/launch/cluster/BUILD.bazel
+++ b/metropolis/test/launch/cluster/BUILD.bazel
@@ -1,7 +1,7 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "cluster",
     srcs = [
         "cluster.go",
         "insecure_key.go",
@@ -18,19 +18,19 @@
     importpath = "source.monogon.dev/metropolis/test/launch/cluster",
     visibility = ["//visibility:public"],
     deps = [
-        "//metropolis/node:go_default_library",
-        "//metropolis/node/core/identity:go_default_library",
-        "//metropolis/node/core/rpc:go_default_library",
-        "//metropolis/pkg/logbuffer:go_default_library",
-        "//metropolis/proto/api:go_default_library",
-        "//metropolis/proto/common:go_default_library",
-        "//metropolis/test/launch:go_default_library",
-        "@com_github_cenkalti_backoff_v4//:go_default_library",
-        "@com_github_grpc_ecosystem_go_grpc_middleware//retry:go_default_library",
+        "//metropolis/node",
+        "//metropolis/node/core/identity",
+        "//metropolis/node/core/rpc",
+        "//metropolis/pkg/logbuffer",
+        "//metropolis/proto/api",
+        "//metropolis/proto/common",
+        "//metropolis/test/launch",
+        "@com_github_cenkalti_backoff_v4//:backoff",
+        "@com_github_grpc_ecosystem_go_grpc_middleware//retry",
         "@org_golang_google_grpc//:go_default_library",
-        "@org_golang_google_grpc//codes:go_default_library",
-        "@org_golang_google_grpc//status:go_default_library",
-        "@org_golang_google_protobuf//proto:go_default_library",
-        "@org_uber_go_multierr//:go_default_library",
+        "@org_golang_google_grpc//codes",
+        "@org_golang_google_grpc//status",
+        "@org_golang_google_protobuf//proto",
+        "@org_uber_go_multierr//:multierr",
     ],
 )
diff --git a/metropolis/test/nanoswitch/BUILD b/metropolis/test/nanoswitch/BUILD
index 5a71c94..ce22acd 100644
--- a/metropolis/test/nanoswitch/BUILD
+++ b/metropolis/test/nanoswitch/BUILD
@@ -2,29 +2,29 @@
 load("//metropolis/node/build:def.bzl", "node_initramfs")
 
 go_library(
-    name = "go_default_library",
+    name = "nanoswitch_lib",
     srcs = ["nanoswitch.go"],
     importpath = "source.monogon.dev/metropolis/test/nanoswitch",
     visibility = ["//visibility:private"],
     deps = [
-        "//metropolis/node:go_default_library",
-        "//metropolis/node/core/network/dhcp4c:go_default_library",
-        "//metropolis/node/core/network/dhcp4c/callback:go_default_library",
-        "//metropolis/pkg/logtree:go_default_library",
-        "//metropolis/pkg/supervisor:go_default_library",
-        "//metropolis/test/launch:go_default_library",
-        "@com_github_google_nftables//:go_default_library",
-        "@com_github_google_nftables//expr:go_default_library",
-        "@com_github_insomniacslk_dhcp//dhcpv4:go_default_library",
-        "@com_github_insomniacslk_dhcp//dhcpv4/server4:go_default_library",
-        "@com_github_vishvananda_netlink//:go_default_library",
-        "@org_golang_x_sys//unix:go_default_library",
+        "//metropolis/node",
+        "//metropolis/node/core/network/dhcp4c",
+        "//metropolis/node/core/network/dhcp4c/callback",
+        "//metropolis/pkg/logtree",
+        "//metropolis/pkg/supervisor",
+        "//metropolis/test/launch",
+        "@com_github_google_nftables//:nftables",
+        "@com_github_google_nftables//expr",
+        "@com_github_insomniacslk_dhcp//dhcpv4",
+        "@com_github_insomniacslk_dhcp//dhcpv4/server4",
+        "@com_github_vishvananda_netlink//:netlink",
+        "@org_golang_x_sys//unix",
     ],
 )
 
 go_binary(
     name = "nanoswitch",
-    embed = [":go_default_library"],
+    embed = [":nanoswitch_lib"],
     pure = "on",
     visibility = ["//visibility:private"],
 )
diff --git a/metropolis/vm/kube/apis/vm/BUILD.bazel b/metropolis/vm/kube/apis/vm/BUILD.bazel
index 3b758f3..35fab05 100644
--- a/metropolis/vm/kube/apis/vm/BUILD.bazel
+++ b/metropolis/vm/kube/apis/vm/BUILD.bazel
@@ -1,7 +1,7 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "vm",
     srcs = ["register.go"],
     importpath = "source.monogon.dev/metropolis/vm/kube/apis/vm",
     visibility = ["//visibility:public"],
diff --git a/metropolis/vm/kube/apis/vm/v1alpha1/BUILD.bazel b/metropolis/vm/kube/apis/vm/v1alpha1/BUILD.bazel
index 4b4bfd4..64b7a9b 100644
--- a/metropolis/vm/kube/apis/vm/v1alpha1/BUILD.bazel
+++ b/metropolis/vm/kube/apis/vm/v1alpha1/BUILD.bazel
@@ -2,7 +2,7 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "v1alpha1",
     srcs = [
         "doc.go",
         "register.go",
@@ -15,11 +15,11 @@
     importpath = "source.monogon.dev/metropolis/vm/kube/apis/vm/v1alpha1",
     visibility = ["//visibility:public"],
     deps = [
-        "//metropolis/vm/kube/apis/vm:go_default_library",
-        "@io_k8s_api//core/v1:go_default_library",
-        "@io_k8s_apimachinery//pkg/apis/meta/v1:go_default_library",
-        "@io_k8s_apimachinery//pkg/runtime:go_default_library",
-        "@io_k8s_apimachinery//pkg/runtime/schema:go_default_library",
+        "//metropolis/vm/kube/apis/vm",
+        "@io_k8s_api//core/v1:core",
+        "@io_k8s_apimachinery//pkg/apis/meta/v1:meta",
+        "@io_k8s_apimachinery//pkg/runtime",
+        "@io_k8s_apimachinery//pkg/runtime/schema",
     ],
 )
 
diff --git a/metropolis/vm/kube/generated/BUILD.bazel b/metropolis/vm/kube/generated/BUILD.bazel
index 5e30cdc..7e4d8f3 100644
--- a/metropolis/vm/kube/generated/BUILD.bazel
+++ b/metropolis/vm/kube/generated/BUILD.bazel
@@ -15,6 +15,6 @@
 go_path(
     name = "go_path",
     deps = [
-        "//metropolis/vm/kube/apis/vm/v1alpha1:go_default_library",
+        "//metropolis/vm/kube/apis/vm/v1alpha1",
     ],
 )
diff --git a/metropolis/vm/kube/generated/clientset/versioned/scheme/BUILD.bazel b/metropolis/vm/kube/generated/clientset/versioned/scheme/BUILD.bazel
index 49f7a99..1d2daa7 100644
--- a/metropolis/vm/kube/generated/clientset/versioned/scheme/BUILD.bazel
+++ b/metropolis/vm/kube/generated/clientset/versioned/scheme/BUILD.bazel
@@ -13,11 +13,11 @@
     bundle = "//metropolis/vm/kube/generated:bundle",
     importpath = "source.monogon.dev/metropolis/vm/kube/generated/clientset/versioned/scheme",
     deps = [
-        "//metropolis/vm/kube/apis/vm/v1alpha1:go_default_library",
-        "@io_k8s_apimachinery//pkg/apis/meta/v1:go_default_library",
-        "@io_k8s_apimachinery//pkg/runtime:go_default_library",
-        "@io_k8s_apimachinery//pkg/runtime/schema:go_default_library",
-        "@io_k8s_apimachinery//pkg/runtime/serializer:go_default_library",
-        "@io_k8s_apimachinery//pkg/util/runtime:go_default_library",
+        "//metropolis/vm/kube/apis/vm/v1alpha1",
+        "@io_k8s_apimachinery//pkg/apis/meta/v1:meta",
+        "@io_k8s_apimachinery//pkg/runtime",
+        "@io_k8s_apimachinery//pkg/runtime/schema",
+        "@io_k8s_apimachinery//pkg/runtime/serializer",
+        "@io_k8s_apimachinery//pkg/util/runtime",
     ],
 )
diff --git a/metropolis/vm/kube/generated/clientset/versioned/typed/vm/v1alpha1/BUILD.bazel b/metropolis/vm/kube/generated/clientset/versioned/typed/vm/v1alpha1/BUILD.bazel
index 312009d..6ffcb60 100644
--- a/metropolis/vm/kube/generated/clientset/versioned/typed/vm/v1alpha1/BUILD.bazel
+++ b/metropolis/vm/kube/generated/clientset/versioned/typed/vm/v1alpha1/BUILD.bazel
@@ -13,11 +13,11 @@
     bundle = "//metropolis/vm/kube/generated:bundle",
     importpath = "source.monogon.dev/metropolis/vm/kube/generated/clientset/versioned/typed/vm/v1alpha1",
     deps = [
-        "//metropolis/vm/kube/apis/vm/v1alpha1:go_default_library",
+        "//metropolis/vm/kube/apis/vm/v1alpha1",
         "//metropolis/vm/kube/generated/clientset/versioned/scheme:go_default_library",
-        "@io_k8s_apimachinery//pkg/apis/meta/v1:go_default_library",
-        "@io_k8s_apimachinery//pkg/types:go_default_library",
-        "@io_k8s_apimachinery//pkg/watch:go_default_library",
-        "@io_k8s_client_go//rest:go_default_library",
+        "@io_k8s_apimachinery//pkg/apis/meta/v1:meta",
+        "@io_k8s_apimachinery//pkg/types",
+        "@io_k8s_apimachinery//pkg/watch",
+        "@io_k8s_client_go//rest",
     ],
 )
diff --git a/metropolis/vm/kube/generated/informers/externalversions/BUILD.bazel b/metropolis/vm/kube/generated/informers/externalversions/BUILD.bazel
index 290b40a..78516e0 100644
--- a/metropolis/vm/kube/generated/informers/externalversions/BUILD.bazel
+++ b/metropolis/vm/kube/generated/informers/externalversions/BUILD.bazel
@@ -13,13 +13,13 @@
     bundle = "//metropolis/vm/kube/generated:bundle",
     importpath = "source.monogon.dev/metropolis/vm/kube/generated/informers/externalversions",
     deps = [
-        "//metropolis/vm/kube/apis/vm/v1alpha1:go_default_library",
+        "//metropolis/vm/kube/apis/vm/v1alpha1",
         "//metropolis/vm/kube/generated/clientset/versioned:go_default_library",
         "//metropolis/vm/kube/generated/informers/externalversions/internalinterfaces:go_default_library",
         "//metropolis/vm/kube/generated/informers/externalversions/vm:go_default_library",
-        "@io_k8s_apimachinery//pkg/apis/meta/v1:go_default_library",
-        "@io_k8s_apimachinery//pkg/runtime:go_default_library",
-        "@io_k8s_apimachinery//pkg/runtime/schema:go_default_library",
-        "@io_k8s_client_go//tools/cache:go_default_library",
+        "@io_k8s_apimachinery//pkg/apis/meta/v1:meta",
+        "@io_k8s_apimachinery//pkg/runtime",
+        "@io_k8s_apimachinery//pkg/runtime/schema",
+        "@io_k8s_client_go//tools/cache",
     ],
 )
diff --git a/metropolis/vm/kube/generated/informers/externalversions/vm/v1alpha1/BUILD.bazel b/metropolis/vm/kube/generated/informers/externalversions/vm/v1alpha1/BUILD.bazel
index a4c5f12..d51c170 100644
--- a/metropolis/vm/kube/generated/informers/externalversions/vm/v1alpha1/BUILD.bazel
+++ b/metropolis/vm/kube/generated/informers/externalversions/vm/v1alpha1/BUILD.bazel
@@ -13,7 +13,7 @@
     bundle = "//metropolis/vm/kube/generated:bundle",
     importpath = "source.monogon.dev/metropolis/vm/kube/generated/informers/externalversions/vm/v1alpha1",
     deps = [
-        "//metropolis/vm/kube/apis/vm/v1alpha1:go_default_library",
+        "//metropolis/vm/kube/apis/vm/v1alpha1",
         "//metropolis/vm/kube/generated/clientset/versioned:go_default_library",
         "//metropolis/vm/kube/generated/informers/externalversions/internalinterfaces:go_default_library",
         "//metropolis/vm/kube/generated/listers/vm/v1alpha1:go_default_library",
diff --git a/metropolis/vm/kube/generated/listers/vm/v1alpha1/BUILD.bazel b/metropolis/vm/kube/generated/listers/vm/v1alpha1/BUILD.bazel
index 8b60875..d9fa05a 100644
--- a/metropolis/vm/kube/generated/listers/vm/v1alpha1/BUILD.bazel
+++ b/metropolis/vm/kube/generated/listers/vm/v1alpha1/BUILD.bazel
@@ -13,9 +13,9 @@
     bundle = "//metropolis/vm/kube/generated:bundle",
     importpath = "source.monogon.dev/metropolis/vm/kube/generated/listers/vm/v1alpha1",
     deps = [
-        "//metropolis/vm/kube/apis/vm/v1alpha1:go_default_library",
-        "@io_k8s_apimachinery//pkg/api/errors:go_default_library",
-        "@io_k8s_apimachinery//pkg/labels:go_default_library",
-        "@io_k8s_client_go//tools/cache:go_default_library",
+        "//metropolis/vm/kube/apis/vm/v1alpha1",
+        "@io_k8s_apimachinery//pkg/api/errors",
+        "@io_k8s_apimachinery//pkg/labels",
+        "@io_k8s_client_go//tools/cache",
     ],
 )
diff --git a/metropolis/vm/proto/BUILD.bazel b/metropolis/vm/proto/BUILD.bazel
index 0ad5b7b..be0ceec 100644
--- a/metropolis/vm/proto/BUILD.bazel
+++ b/metropolis/vm/proto/BUILD.bazel
@@ -17,7 +17,7 @@
 )
 
 go_library(
-    name = "go_default_library",
+    name = "proto",
     embed = [":metropolis_vm_go_proto"],
     importpath = "source.monogon.dev/metropolis/vm/proto",
     visibility = ["//visibility:public"],
diff --git a/metropolis/vm/smoketest/BUILD.bazel b/metropolis/vm/smoketest/BUILD.bazel
index 7fe529d..d594e58 100644
--- a/metropolis/vm/smoketest/BUILD.bazel
+++ b/metropolis/vm/smoketest/BUILD.bazel
@@ -4,7 +4,7 @@
 load("//build/static_binary_tarball:def.bzl", "static_binary_tarball")
 
 go_library(
-    name = "go_default_library",
+    name = "smoketest_lib",
     srcs = ["main.go"],
     importpath = "source.monogon.dev/metropolis/vm/smoketest",
     visibility = ["//visibility:private"],
@@ -24,7 +24,7 @@
         "//metropolis/test/ktest:linux-testing",
         "@qemu//:qemu-x86_64-softmmu",
     ],
-    embed = [":go_default_library"],
+    embed = [":smoketest_lib"],
     visibility = ["//visibility:public"],
 )
 
diff --git a/metropolis/vm/smoketest/payload/BUILD.bazel b/metropolis/vm/smoketest/payload/BUILD.bazel
index 52b27e1..b2cb04b 100644
--- a/metropolis/vm/smoketest/payload/BUILD.bazel
+++ b/metropolis/vm/smoketest/payload/BUILD.bazel
@@ -1,15 +1,15 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "payload_lib",
     srcs = ["main.go"],
     importpath = "source.monogon.dev/metropolis/vm/smoketest/payload",
     visibility = ["//visibility:private"],
-    deps = ["@org_golang_x_sys//unix:go_default_library"],
+    deps = ["@org_golang_x_sys//unix"],
 )
 
 go_binary(
     name = "payload",
-    embed = [":go_default_library"],
+    embed = [":payload_lib"],
     visibility = ["//visibility:public"],
 )