diff --git a/integrations/lib/testing/fakejoin/kubesigner.go b/integrations/lib/testing/fakejoin/kubesigner.go
index 479c1817a9877..460bfff21320f 100644
--- a/integrations/lib/testing/fakejoin/kubesigner.go
+++ b/integrations/lib/testing/fakejoin/kubesigner.go
@@ -21,7 +21,6 @@ package fakejoin
 import (
 	"encoding/json"
 	"fmt"
-	kubetoken "github.com/gravitational/teleport/lib/kube/token"
 	"time"
 
 	"github.com/go-jose/go-jose/v3"
@@ -31,6 +30,7 @@ import (
 	"github.com/jonboulle/clockwork"
 
 	"github.com/gravitational/teleport/lib/cryptosuites"
+	kubetoken "github.com/gravitational/teleport/lib/kube/token"
 )
 
 // KubernetesSigner is a JWT signer that mimicks the Kubernetes one. The signer mock Kubernetes and
diff --git a/lib/auth/auth.go b/lib/auth/auth.go
index 41ea4e03e4b97..bdc25add96773 100644
--- a/lib/auth/auth.go
+++ b/lib/auth/auth.go
@@ -35,7 +35,6 @@ import (
 	"encoding/pem"
 	"errors"
 	"fmt"
-	kubetoken "github.com/gravitational/teleport/lib/kube/token"
 	"io"
 	"log/slog"
 	"math/big"
@@ -101,6 +100,7 @@ import (
 	"github.com/gravitational/teleport/lib/githubactions"
 	"github.com/gravitational/teleport/lib/gitlab"
 	"github.com/gravitational/teleport/lib/inventory"
+	kubetoken "github.com/gravitational/teleport/lib/kube/token"
 	kubeutils "github.com/gravitational/teleport/lib/kube/utils"
 	"github.com/gravitational/teleport/lib/limiter"
 	"github.com/gravitational/teleport/lib/loginrule"
diff --git a/lib/auth/bot_test.go b/lib/auth/bot_test.go
index 5145513e4412b..ae4ddb14136b9 100644
--- a/lib/auth/bot_test.go
+++ b/lib/auth/bot_test.go
@@ -27,8 +27,6 @@ import (
 	"encoding/base64"
 	"encoding/json"
 	"encoding/pem"
-	"github.com/gravitational/teleport/lib/kube/token"
-	kubetoken "github.com/gravitational/teleport/lib/kube/token"
 	"net/http"
 	"strings"
 	"testing"
@@ -64,6 +62,8 @@ import (
 	libevents "github.com/gravitational/teleport/lib/events"
 	"github.com/gravitational/teleport/lib/events/eventstest"
 	"github.com/gravitational/teleport/lib/fixtures"
+	"github.com/gravitational/teleport/lib/kube/token"
+	kubetoken "github.com/gravitational/teleport/lib/kube/token"
 	"github.com/gravitational/teleport/lib/reversetunnelclient"
 	"github.com/gravitational/teleport/lib/tbot/identity"
 	"github.com/gravitational/teleport/lib/tlsca"
diff --git a/lib/auth/join/join.go b/lib/auth/join/join.go
index 6587ebc0ced2f..b00c4b6bf2a7d 100644
--- a/lib/auth/join/join.go
+++ b/lib/auth/join/join.go
@@ -20,7 +20,6 @@ import (
 	"context"
 	"crypto"
 	"crypto/x509"
-	kubetoken "github.com/gravitational/teleport/lib/kube/token"
 	"log/slog"
 	"os"
 	"time"
@@ -51,6 +50,7 @@ import (
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/githubactions"
 	"github.com/gravitational/teleport/lib/gitlab"
+	kubetoken "github.com/gravitational/teleport/lib/kube/token"
 	"github.com/gravitational/teleport/lib/spacelift"
 	"github.com/gravitational/teleport/lib/terraformcloud"
 	"github.com/gravitational/teleport/lib/tlsca"
diff --git a/lib/auth/join_kubernetes.go b/lib/auth/join_kubernetes.go
index 5bca6fdd600c8..9952343e9f6e4 100644
--- a/lib/auth/join_kubernetes.go
+++ b/lib/auth/join_kubernetes.go
@@ -21,13 +21,13 @@ package auth
 import (
 	"context"
 	"fmt"
-	kubetoken "github.com/gravitational/teleport/lib/kube/token"
 	"time"
 
 	"github.com/gravitational/trace"
 	"github.com/sirupsen/logrus"
 
 	"github.com/gravitational/teleport/api/types"
+	kubetoken "github.com/gravitational/teleport/lib/kube/token"
 )
 
 type k8sTokenReviewValidator interface {
diff --git a/lib/auth/join_kubernetes_test.go b/lib/auth/join_kubernetes_test.go
index 5d0ba42ac1a8f..699f4a57cc29f 100644
--- a/lib/auth/join_kubernetes_test.go
+++ b/lib/auth/join_kubernetes_test.go
@@ -20,7 +20,6 @@ package auth
 
 import (
 	"context"
-	kubetoken "github.com/gravitational/teleport/lib/kube/token"
 	"testing"
 	"time"
 
@@ -29,6 +28,7 @@ import (
 
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/auth/testauthority"
+	kubetoken "github.com/gravitational/teleport/lib/kube/token"
 )
 
 type mockK8STokenReviewValidator struct {