diff --git a/Dockerfile b/Dockerfile
index b01a45d2d..75ac93045 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -3,9 +3,12 @@
 # Meta args applied to stage base names.
 
 ARG TOOLS
+ARG IMPORTVET
 
 # The tools target provides base toolchain for the build.
 
+FROM $IMPORTVET as importvet
+
 FROM $TOOLS AS tools
 ENV PATH /toolchain/bin:/toolchain/go/bin
 RUN ["/toolchain/bin/mkdir", "/bin", "/tmp"]
@@ -22,6 +25,7 @@ COPY ./hack/docgen /go/src/github.com/talos-systems/docgen
 RUN cd /go/src/github.com/talos-systems/docgen \
     && go build . \
     && mv docgen /toolchain/go/bin/
+COPY --from=importvet /importvet /toolchain/go/bin/importvet
 
 # The build target creates a container that will be used to build Talos source
 # code.
@@ -468,7 +472,8 @@ COPY --from=integration-test-provision-linux-build /src/integration.test /integr
 FROM base AS lint-go
 COPY .golangci.yml .
 ENV GOGC=50
-RUN --mount=type=cache,target=/.cache/go-build golangci-lint run --config .golangci.yml
+RUN --mount=type=cache,target=/.cache/go-build --mount=type=cache,target=/.cache/golangci-lint golangci-lint run --config .golangci.yml
+RUN --mount=type=cache,target=/.cache/go-build importvet ./...
 RUN find . -name '*.pb.go' | xargs rm
 RUN FILES="$(gofumports -l -local github.com/talos-systems/talos .)" && test -z "${FILES}" || (echo -e "Source code is not formatted with 'gofumports -w -local github.com/talos-systems/talos .':\n${FILES}"; exit 1)
 
diff --git a/Makefile b/Makefile
index 4e56f2bd4..7b3eba9be 100644
--- a/Makefile
+++ b/Makefile
@@ -10,6 +10,7 @@ ARTIFACTS := _out
 TOOLS ?= autonomy/tools:v0.2.0-8-g7e14b0a
 GO_VERSION ?= 1.14
 GOFUMPT_VERSION ?= abc0db2c416aca0f60ea33c23c76665f6e7ba0b6
+IMPORTVET ?= autonomy/importvet:f6b07d9
 OPERATING_SYSTEM := $(shell uname -s | tr "[:upper:]" "[:lower:]")
 TALOSCTL_DEFAULT_TARGET := talosctl-$(OPERATING_SYSTEM)
 INTEGRATION_TEST_DEFAULT_TARGET := integration-test-$(OPERATING_SYSTEM)
@@ -37,6 +38,7 @@ COMMON_ARGS += --build-arg=GOFUMPT_VERSION=$(GOFUMPT_VERSION)
 COMMON_ARGS += --build-arg=SHA=$(SHA)
 COMMON_ARGS += --build-arg=TAG=$(TAG)
 COMMON_ARGS += --build-arg=ARTIFACTS=$(ARTIFACTS)
+COMMON_ARGS += --build-arg=IMPORTVET=$(IMPORTVET)
 COMMON_ARGS += --build-arg=TESTPKGS=$(TESTPKGS)
 COMMON_ARGS += --build-arg=USERNAME=$(USERNAME)
 COMMON_ARGS += --build-arg=http_proxy=$(http_proxy)
diff --git a/pkg/.importvet.yaml b/pkg/.importvet.yaml
new file mode 100644
index 000000000..c1649e1f0
--- /dev/null
+++ b/pkg/.importvet.yaml
@@ -0,0 +1,8 @@
+---
+rules:
+  - regexp: ^github.com/talos-systems/talos/
+    action: deny
+  - regexp: ^github.com/talos-systems/talos/pkg
+    action: allow
+  - regexp: ^github.com/talos-systems/talos/api
+    action: allow
diff --git a/internal/pkg/cis/cis.go b/pkg/config/internal/cis/cis.go
similarity index 100%
rename from internal/pkg/cis/cis.go
rename to pkg/config/internal/cis/cis.go
diff --git a/internal/pkg/cis/cis_test.go b/pkg/config/internal/cis/cis_test.go
similarity index 100%
rename from internal/pkg/cis/cis_test.go
rename to pkg/config/internal/cis/cis_test.go
diff --git a/pkg/config/types/v1alpha1/generate/generate.go b/pkg/config/types/v1alpha1/generate/generate.go
index 759308e8a..de6d7b555 100644
--- a/pkg/config/types/v1alpha1/generate/generate.go
+++ b/pkg/config/types/v1alpha1/generate/generate.go
@@ -15,7 +15,7 @@ import (
 
 	stdlibx509 "crypto/x509"
 
-	"github.com/talos-systems/talos/internal/pkg/cis"
+	"github.com/talos-systems/talos/pkg/config/internal/cis"
 	v1alpha1 "github.com/talos-systems/talos/pkg/config/types/v1alpha1"
 	"github.com/talos-systems/talos/pkg/config/types/v1alpha1/machine"
 	"github.com/talos-systems/talos/pkg/constants"