diff --git a/metropolis/node/core/curator/impl_leader_test.go b/metropolis/node/core/curator/impl_leader_test.go
index 2951191..94fcd0c 100644
--- a/metropolis/node/core/curator/impl_leader_test.go
+++ b/metropolis/node/core/curator/impl_leader_test.go
@@ -1331,12 +1331,11 @@
 	}
 
 	// Give second node some roles.
-	yes := true
 	_, err = mgmt.UpdateNodeRoles(ctx, &apb.UpdateNodeRolesRequest{
 		Node: &apb.UpdateNodeRolesRequest_Id{
 			Id: tn[1].ID(),
 		},
-		KubernetesWorker: &yes,
+		KubernetesWorker: ptr.To(true),
 	})
 	if err != nil {
 		t.Fatalf("Adding node 1 a role failed: %v", err)
@@ -1427,12 +1426,11 @@
 	defer ctxC()
 
 	mgmt := apb.NewManagementClient(cl.mgmtConn)
-	true_ := true
 	_, err := mgmt.UpdateNodeRoles(ctx, &apb.UpdateNodeRolesRequest{
 		Node: &apb.UpdateNodeRolesRequest_Id{
 			Id: cl.localNodeID,
 		},
-		KubernetesWorker: &true_,
+		KubernetesWorker: ptr.To(true),
 	})
 	if err != nil {
 		t.Fatalf("Could not make node into Kubernetes worker: %v", err)
diff --git a/metropolis/node/kubernetes/reconciler/resources_csi.go b/metropolis/node/kubernetes/reconciler/resources_csi.go
index a1ca29f..2754528 100644
--- a/metropolis/node/kubernetes/reconciler/resources_csi.go
+++ b/metropolis/node/kubernetes/reconciler/resources_csi.go
@@ -63,7 +63,6 @@
 }
 
 func (r resourceCSIDrivers) Expected() []meta.Object {
-	fsGroupPolicy := storage.FileFSGroupPolicy
 	return []meta.Object{
 		&storage.CSIDriver{
 			ObjectMeta: meta.ObjectMeta{
@@ -75,7 +74,7 @@
 				PodInfoOnMount:       ptr.To(false),
 				VolumeLifecycleModes: []storage.VolumeLifecycleMode{storage.VolumeLifecyclePersistent},
 				StorageCapacity:      ptr.To(false),
-				FSGroupPolicy:        &fsGroupPolicy,
+				FSGroupPolicy:        ptr.To(storage.FileFSGroupPolicy),
 				RequiresRepublish:    ptr.To(false),
 				SELinuxMount:         ptr.To(false),
 			},
diff --git a/metropolis/node/kubernetes/reconciler/resources_storageclass.go b/metropolis/node/kubernetes/reconciler/resources_storageclass.go
index b3afc13..6b4ec73 100644
--- a/metropolis/node/kubernetes/reconciler/resources_storageclass.go
+++ b/metropolis/node/kubernetes/reconciler/resources_storageclass.go
@@ -26,9 +26,6 @@
 	"k8s.io/utils/ptr"
 )
 
-var reclaimPolicyDelete = core.PersistentVolumeReclaimDelete
-var waitForConsumerBinding = storage.VolumeBindingWaitForFirstConsumer
-
 type resourceStorageClasses struct {
 	kubernetes.Interface
 }
@@ -74,8 +71,8 @@
 			},
 			AllowVolumeExpansion: ptr.To(true),
 			Provisioner:          csiProvisionerName,
-			ReclaimPolicy:        &reclaimPolicyDelete,
-			VolumeBindingMode:    &waitForConsumerBinding,
+			ReclaimPolicy:        ptr.To(core.PersistentVolumeReclaimDelete),
+			VolumeBindingMode:    ptr.To(storage.VolumeBindingWaitForFirstConsumer),
 			MountOptions: []string{
 				"exec",
 				"dev",
diff --git a/metropolis/test/e2e/suites/ha_cold/BUILD.bazel b/metropolis/test/e2e/suites/ha_cold/BUILD.bazel
index 2ace798..d3370d0 100644
--- a/metropolis/test/e2e/suites/ha_cold/BUILD.bazel
+++ b/metropolis/test/e2e/suites/ha_cold/BUILD.bazel
@@ -21,5 +21,6 @@
         "//metropolis/test/launch",
         "//metropolis/test/util",
         "//osbase/test/launch",
+        "@io_k8s_utils//ptr",
     ],
 )
diff --git a/metropolis/test/e2e/suites/ha_cold/run_test.go b/metropolis/test/e2e/suites/ha_cold/run_test.go
index 43ff689..ae6a043 100644
--- a/metropolis/test/e2e/suites/ha_cold/run_test.go
+++ b/metropolis/test/e2e/suites/ha_cold/run_test.go
@@ -6,6 +6,8 @@
 	"testing"
 	"time"
 
+	"k8s.io/utils/ptr"
+
 	mlaunch "source.monogon.dev/metropolis/test/launch"
 	"source.monogon.dev/metropolis/test/util"
 	"source.monogon.dev/osbase/test/launch"
@@ -96,22 +98,20 @@
 	cur := ipb.NewCuratorClient(curC)
 
 	util.MustTestEventual(t, "Remove KubernetesController role", ctx, 10*time.Second, func(ctx context.Context) error {
-		fa := false
 		_, err := mgmt.UpdateNodeRoles(ctx, &apb.UpdateNodeRolesRequest{
 			Node: &apb.UpdateNodeRolesRequest_Id{
 				Id: cluster.NodeIDs[0],
 			},
-			KubernetesController: &fa,
+			KubernetesController: ptr.To(false),
 		})
 		return err
 	})
 	util.MustTestEventual(t, "Remove ConsensusMember role", ctx, time.Minute, func(ctx context.Context) error {
-		fa := false
 		_, err := mgmt.UpdateNodeRoles(ctx, &apb.UpdateNodeRolesRequest{
 			Node: &apb.UpdateNodeRolesRequest_Id{
 				Id: cluster.NodeIDs[0],
 			},
-			ConsensusMember: &fa,
+			ConsensusMember: ptr.To(false),
 		})
 		return err
 	})
diff --git a/metropolis/test/e2e/suites/kubernetes/kubernetes_helpers.go b/metropolis/test/e2e/suites/kubernetes/kubernetes_helpers.go
index 9c67117..c8e04bf 100644
--- a/metropolis/test/e2e/suites/kubernetes/kubernetes_helpers.go
+++ b/metropolis/test/e2e/suites/kubernetes/kubernetes_helpers.go
@@ -73,14 +73,13 @@
 // makeHTTPServerDeploymentSpec generates the deployment spec for the test HTTP
 // server.
 func makeHTTPServerDeploymentSpec(name string) *appsv1.Deployment {
-	oneVal := int32(1)
 	return &appsv1.Deployment{
 		ObjectMeta: metav1.ObjectMeta{Name: name},
 		Spec: appsv1.DeploymentSpec{
 			Selector: &metav1.LabelSelector{MatchLabels: map[string]string{
 				"name": name,
 			}},
-			Replicas: &oneVal,
+			Replicas: ptr.To(int32(1)),
 			Template: corev1.PodTemplateSpec{
 				ObjectMeta: metav1.ObjectMeta{
 					Labels: map[string]string{
@@ -129,11 +128,10 @@
 
 // makeSelftestSpec generates a Job spec for the E2E self-test image.
 func makeSelftestSpec(name string) *batchv1.Job {
-	one := int32(1)
 	return &batchv1.Job{
 		ObjectMeta: metav1.ObjectMeta{Name: name},
 		Spec: batchv1.JobSpec{
-			BackoffLimit: &one,
+			BackoffLimit: ptr.To(int32(1)),
 			Template: corev1.PodTemplateSpec{
 				ObjectMeta: metav1.ObjectMeta{
 					Labels: map[string]string{
diff --git a/metropolis/test/e2e/suites/kubernetes/run_test.go b/metropolis/test/e2e/suites/kubernetes/run_test.go
index 18239e0..c7f5612 100644
--- a/metropolis/test/e2e/suites/kubernetes/run_test.go
+++ b/metropolis/test/e2e/suites/kubernetes/run_test.go
@@ -132,12 +132,11 @@
 	}
 	// Nominate both nodes to be Kubernetes workers.
 	for _, nid := range cluster.NodeIDs {
-		yes := true
 		_, err := mgmt.UpdateNodeRoles(ctx, &apb.UpdateNodeRolesRequest{
 			Node: &apb.UpdateNodeRolesRequest_Id{
 				Id: nid,
 			},
-			KubernetesWorker: &yes,
+			KubernetesWorker: ptr.To(true),
 		})
 		if err != nil {
 			t.Fatalf("Could not make %s a KubernetesWorker: %v", nid, err)
@@ -163,12 +162,11 @@
 
 	// Remove KubernetesWorker from first node again. It will stay in k8s (arguably,
 	// this is a bug) but its role label should be removed.
-	no := false
 	_, err = mgmt.UpdateNodeRoles(ctx, &apb.UpdateNodeRolesRequest{
 		Node: &apb.UpdateNodeRolesRequest_Id{
 			Id: cluster.NodeIDs[0],
 		},
-		KubernetesWorker: &no,
+		KubernetesWorker: ptr.To(false),
 	})
 	if err != nil {
 		t.Fatalf("Could not remove KubernetesWorker from %s: %v", cluster.NodeIDs[0], err)
diff --git a/metropolis/test/launch/BUILD.bazel b/metropolis/test/launch/BUILD.bazel
index 50f0ede..fca8bbf 100644
--- a/metropolis/test/launch/BUILD.bazel
+++ b/metropolis/test/launch/BUILD.bazel
@@ -56,6 +56,7 @@
         "@io_bazel_rules_go//go/runfiles:go_default_library",
         "@io_k8s_client_go//kubernetes",
         "@io_k8s_client_go//rest",
+        "@io_k8s_utils//ptr",
         "@org_golang_google_grpc//:grpc",
         "@org_golang_google_grpc//codes",
         "@org_golang_google_grpc//status",
diff --git a/metropolis/test/launch/cluster.go b/metropolis/test/launch/cluster.go
index 107cd55..b46cc68 100644
--- a/metropolis/test/launch/cluster.go
+++ b/metropolis/test/launch/cluster.go
@@ -36,6 +36,7 @@
 	"google.golang.org/protobuf/proto"
 	"k8s.io/client-go/kubernetes"
 	"k8s.io/client-go/rest"
+	"k8s.io/utils/ptr"
 
 	ipb "source.monogon.dev/metropolis/node/core/curator/proto/api"
 	apb "source.monogon.dev/metropolis/proto/api"
@@ -1415,13 +1416,12 @@
 	}
 	mgmt := apb.NewManagementClient(curC)
 
-	tr := true
 	launch.Log("Cluster: %s: adding KubernetesWorker", id)
 	_, err = mgmt.UpdateNodeRoles(ctx, &apb.UpdateNodeRolesRequest{
 		Node: &apb.UpdateNodeRolesRequest_Id{
 			Id: id,
 		},
-		KubernetesWorker: &tr,
+		KubernetesWorker: ptr.To(true),
 	})
 	return err
 }
@@ -1434,13 +1434,12 @@
 	}
 	mgmt := apb.NewManagementClient(curC)
 
-	tr := true
 	launch.Log("Cluster: %s: adding KubernetesController", id)
 	_, err = mgmt.UpdateNodeRoles(ctx, &apb.UpdateNodeRolesRequest{
 		Node: &apb.UpdateNodeRolesRequest_Id{
 			Id: id,
 		},
-		KubernetesController: &tr,
+		KubernetesController: ptr.To(true),
 	})
 	return err
 }
@@ -1454,7 +1453,6 @@
 	mgmt := apb.NewManagementClient(curC)
 	cur := ipb.NewCuratorClient(curC)
 
-	tr := true
 	launch.Log("Cluster: %s: adding ConsensusMember", id)
 	bo := backoff.NewExponentialBackOff()
 	bo.MaxElapsedTime = 10 * time.Second
@@ -1464,7 +1462,7 @@
 			Node: &apb.UpdateNodeRolesRequest_Id{
 				Id: id,
 			},
-			ConsensusMember: &tr,
+			ConsensusMember: ptr.To(true),
 		})
 		if err != nil {
 			launch.Log("Cluster: %s: UpdateNodeRoles failed: %v", id, err)