diff --git a/metropolis/node/core/curator/BUILD.bazel b/metropolis/node/core/curator/BUILD.bazel
index 86d2629..fffb664 100644
--- a/metropolis/node/core/curator/BUILD.bazel
+++ b/metropolis/node/core/curator/BUILD.bazel
@@ -91,6 +91,7 @@
         "@com_github_google_go_cmp//cmp",
         "@io_etcd_go_etcd_client_v3//:client",
         "@io_etcd_go_etcd_tests_v3//integration",
+        "@io_k8s_utils//ptr",
         "@org_golang_google_grpc//:grpc",
         "@org_golang_google_grpc//grpclog",
         "@org_golang_google_grpc//test/bufconn",
diff --git a/metropolis/node/core/curator/impl_leader_test.go b/metropolis/node/core/curator/impl_leader_test.go
index 6550a30..2951191 100644
--- a/metropolis/node/core/curator/impl_leader_test.go
+++ b/metropolis/node/core/curator/impl_leader_test.go
@@ -25,6 +25,7 @@
 	"google.golang.org/protobuf/proto"
 	"google.golang.org/protobuf/testing/protocmp"
 	"google.golang.org/protobuf/types/known/timestamppb"
+	"k8s.io/utils/ptr"
 
 	common "source.monogon.dev/metropolis/node"
 	"source.monogon.dev/metropolis/node/core/consensus"
@@ -285,7 +286,7 @@
 
 type fakeLeaderOption struct {
 	// icc is the initial cluster configuration to be set when bootstrapping the
-	//fake cluster. If not set, uses system defaults.
+	// fake cluster. If not set, uses system defaults.
 	icc    *cpb.ClusterConfiguration
 	labels map[string]string
 }
@@ -1199,28 +1200,27 @@
 
 	// Define the test payloads. Each role is optional, and will be updated
 	// only if it's not nil, and its value differs from the current state.
-	opt := func(v bool) *bool { return &v }
 	ue := []*apb.UpdateNodeRolesRequest{
 		&apb.UpdateNodeRolesRequest{
 			Node: &apb.UpdateNodeRolesRequest_Pubkey{
 				Pubkey: tn[0].pubkey,
 			},
-			KubernetesWorker: opt(false),
-			ConsensusMember:  opt(false),
+			KubernetesWorker: ptr.To(false),
+			ConsensusMember:  ptr.To(false),
 		},
 		&apb.UpdateNodeRolesRequest{
 			Node: &apb.UpdateNodeRolesRequest_Pubkey{
 				Pubkey: tn[1].pubkey,
 			},
-			KubernetesWorker: opt(false),
-			ConsensusMember:  opt(true),
+			KubernetesWorker: ptr.To(false),
+			ConsensusMember:  ptr.To(true),
 		},
 		&apb.UpdateNodeRolesRequest{
 			Node: &apb.UpdateNodeRolesRequest_Pubkey{
 				Pubkey: tn[2].pubkey,
 			},
-			KubernetesWorker: opt(true),
-			ConsensusMember:  opt(true),
+			KubernetesWorker: ptr.To(true),
+			ConsensusMember:  ptr.To(true),
 		},
 		&apb.UpdateNodeRolesRequest{
 			Node: &apb.UpdateNodeRolesRequest_Pubkey{
@@ -1274,14 +1274,14 @@
 			Node: &apb.UpdateNodeRolesRequest_Pubkey{
 				Pubkey: tn[0].pubkey,
 			},
-			KubernetesController: opt(true),
-			ConsensusMember:      opt(false),
+			KubernetesController: ptr.To(true),
+			ConsensusMember:      ptr.To(false),
 		},
 		&apb.UpdateNodeRolesRequest{
 			Node: &apb.UpdateNodeRolesRequest_Pubkey{
 				Pubkey: tn[0].pubkey,
 			},
-			KubernetesController: opt(true),
+			KubernetesController: ptr.To(true),
 			ConsensusMember:      nil,
 		},
 	}
diff --git a/metropolis/node/kubernetes/BUILD.bazel b/metropolis/node/kubernetes/BUILD.bazel
index 15eec36..16f773c 100644
--- a/metropolis/node/kubernetes/BUILD.bazel
+++ b/metropolis/node/kubernetes/BUILD.bazel
@@ -69,6 +69,7 @@
         "@io_k8s_kubernetes//pkg/features",
         "@io_k8s_kubernetes//plugin/pkg/admission/security/podsecurity",
         "@io_k8s_pod_security_admission//admission/api/v1:api",
+        "@io_k8s_utils//ptr",
         "@org_golang_google_grpc//:grpc",
         "@org_golang_google_grpc//codes",
         "@org_golang_google_grpc//status",
diff --git a/metropolis/node/kubernetes/kubelet.go b/metropolis/node/kubernetes/kubelet.go
index 9845b3b..16fb520 100644
--- a/metropolis/node/kubernetes/kubelet.go
+++ b/metropolis/node/kubernetes/kubelet.go
@@ -27,12 +27,12 @@
 
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	kubeletconfig "k8s.io/kubelet/config/v1beta1"
+	"k8s.io/utils/ptr"
 
 	ipb "source.monogon.dev/metropolis/node/core/curator/proto/api"
 
 	"source.monogon.dev/metropolis/node/core/localstorage"
 	"source.monogon.dev/metropolis/node/kubernetes/pki"
-	"source.monogon.dev/metropolis/node/kubernetes/reconciler"
 	"source.monogon.dev/osbase/fileargs"
 	"source.monogon.dev/osbase/supervisor"
 )
@@ -99,10 +99,10 @@
 		},
 		// TODO(q3k): move reconciler.False to a generic package, fix the following references.
 		ClusterDomain:                s.ClusterDomain,
-		EnableControllerAttachDetach: reconciler.False(),
+		EnableControllerAttachDetach: ptr.To(false),
 		HairpinMode:                  "none",
-		MakeIPTablesUtilChains:       reconciler.False(), // We don't have iptables
-		FailSwapOn:                   reconciler.False(),
+		MakeIPTablesUtilChains:       ptr.To(false), // We don't have iptables
+		FailSwapOn:                   ptr.To(false),
 		MemorySwap: kubeletconfig.MemorySwapConfiguration{
 			// Only allow burstable pods to use swap
 			SwapBehavior: "LimitedSwap",
diff --git a/metropolis/node/kubernetes/reconciler/BUILD.bazel b/metropolis/node/kubernetes/reconciler/BUILD.bazel
index 1616787..3e66db3 100644
--- a/metropolis/node/kubernetes/reconciler/BUILD.bazel
+++ b/metropolis/node/kubernetes/reconciler/BUILD.bazel
@@ -35,6 +35,7 @@
         "@io_k8s_apimachinery//pkg/api/validation",
         "@io_k8s_apimachinery//pkg/apis/meta/v1:meta",
         "@io_k8s_client_go//kubernetes",
+        "@io_k8s_utils//ptr",
         "@org_golang_google_protobuf//proto",
     ],
 )
diff --git a/metropolis/node/kubernetes/reconciler/reconciler.go b/metropolis/node/kubernetes/reconciler/reconciler.go
index 523b31b..b791341 100644
--- a/metropolis/node/kubernetes/reconciler/reconciler.go
+++ b/metropolis/node/kubernetes/reconciler/reconciler.go
@@ -41,16 +41,6 @@
 	"source.monogon.dev/osbase/supervisor"
 )
 
-// True is a sad workaround for all the pointer booleans in K8s specs
-func True() *bool {
-	val := true
-	return &val
-}
-func False() *bool {
-	val := false
-	return &val
-}
-
 const (
 	// BuiltinLabelKey is used as a k8s label to mark built-in objects (ie.,
 	// managed by the reconciler)
diff --git a/metropolis/node/kubernetes/reconciler/resources_csi.go b/metropolis/node/kubernetes/reconciler/resources_csi.go
index 06eb3ac..a1ca29f 100644
--- a/metropolis/node/kubernetes/reconciler/resources_csi.go
+++ b/metropolis/node/kubernetes/reconciler/resources_csi.go
@@ -22,6 +22,7 @@
 	storage "k8s.io/api/storage/v1"
 	meta "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/client-go/kubernetes"
+	"k8s.io/utils/ptr"
 )
 
 // TODO(q3k): this is duplicated with
@@ -70,13 +71,13 @@
 				Labels: builtinLabels(nil),
 			},
 			Spec: storage.CSIDriverSpec{
-				AttachRequired:       False(),
-				PodInfoOnMount:       False(),
+				AttachRequired:       ptr.To(false),
+				PodInfoOnMount:       ptr.To(false),
 				VolumeLifecycleModes: []storage.VolumeLifecycleMode{storage.VolumeLifecyclePersistent},
-				StorageCapacity:      False(),
+				StorageCapacity:      ptr.To(false),
 				FSGroupPolicy:        &fsGroupPolicy,
-				RequiresRepublish:    False(),
-				SELinuxMount:         False(),
+				RequiresRepublish:    ptr.To(false),
+				SELinuxMount:         ptr.To(false),
 			},
 		},
 	}
diff --git a/metropolis/node/kubernetes/reconciler/resources_storageclass.go b/metropolis/node/kubernetes/reconciler/resources_storageclass.go
index 9be81fb..b3afc13 100644
--- a/metropolis/node/kubernetes/reconciler/resources_storageclass.go
+++ b/metropolis/node/kubernetes/reconciler/resources_storageclass.go
@@ -23,6 +23,7 @@
 	storage "k8s.io/api/storage/v1"
 	meta "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/client-go/kubernetes"
+	"k8s.io/utils/ptr"
 )
 
 var reclaimPolicyDelete = core.PersistentVolumeReclaimDelete
@@ -71,7 +72,7 @@
 						"It is backed by XFS.",
 				},
 			},
-			AllowVolumeExpansion: True(),
+			AllowVolumeExpansion: ptr.To(true),
 			Provisioner:          csiProvisionerName,
 			ReclaimPolicy:        &reclaimPolicyDelete,
 			VolumeBindingMode:    &waitForConsumerBinding,