diff --git a/Makefile b/Makefile
index 518577db670f..ee5c3e4acd92 100644
--- a/Makefile
+++ b/Makefile
@@ -67,7 +67,7 @@ fuzz:
 verify: verify-gofmt verify-bom verify-lint verify-dep verify-shellcheck verify-goword \
 	verify-govet verify-license-header verify-receiver-name verify-mod-tidy \
 	verify-shellws verify-proto-annotations verify-genproto verify-yamllint \
-	verify-govet-shadow verify-markdown-marker verify-go-versions
+	verify-govet-shadow verify-markdown-marker verify-go-versions verify-import-boss
 
 .PHONY: fix
 fix: fix-bom fix-lint fix-yamllint sync-toolchain-directive
@@ -155,6 +155,10 @@ verify-govet-shadow:
 verify-markdown-marker:
 	PASSES="markdown_marker" ./scripts/test.sh
 
+.PHONY: verify-import-boss
+verify-import-boss: install-import-boss
+	PASSES="import_boss" ./scripts/test.sh
+
 YAMLFMT_VERSION = $(shell cd go list -m -f '{{.Version}}' github.com/google/yamlfmt)
 
 .PHONY: fix-yamllint
@@ -180,6 +184,14 @@ ifeq (, $(shell which golangci-lint))
 	$(shell curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(GOPATH)/bin $(GOLANGCI_LINT_VERSION))
 endif
 
+.PHONY: install-import-boss
+install-import-boss:
+ifeq (, $(shell which import-boss))
+	# TODO: This is versionless until v1.31.0 is released
+	$(shell go install k8s.io/kubernetes/cmd/import-boss)
+endif
+
+
 .PHONY: install-lazyfs
 install-lazyfs: bin/lazyfs
 bin/lazyfs:
diff --git a/api/.import-restrictions b/api/.import-restrictions
new file mode 100644
index 000000000000..5ff5fa7f80b1
--- /dev/null
+++ b/api/.import-restrictions
@@ -0,0 +1,5 @@
+rules:
+  # prevent import of go.etcd.io/etcd
+  - selectorRegexp: go[.]etcd[.]io/etcd
+    allowedPrefixes:
+      - go.etcd.io/etcd/api/v3
diff --git a/client/internal/v2/.import-restrictions b/client/internal/v2/.import-restrictions
new file mode 100644
index 000000000000..be6218cc6b3f
--- /dev/null
+++ b/client/internal/v2/.import-restrictions
@@ -0,0 +1,6 @@
+rules:
+  # prevent import of go.etcd.io/etcd
+  - selectorRegexp: go[.]etcd[.]io/etcd
+    allowedPrefixes:
+      - go.etcd.io/etcd/api/v3
+      - go.etcd.io/etcd/client/pkg/v3
diff --git a/client/v3/.import-restrictions b/client/v3/.import-restrictions
new file mode 100644
index 000000000000..409db213f287
--- /dev/null
+++ b/client/v3/.import-restrictions
@@ -0,0 +1,7 @@
+rules:
+  # prevent import of go.etcd.io/etcd
+  - selectorRegexp: go[.]etcd[.]io/etcd
+    allowedPrefixes:
+      - go.etcd.io/etcd/api/v3
+      - go.etcd.io/etcd/client/pkg/v3
+      - go.etcd.io/etcd/client/v3
diff --git a/etcdctl/.import-restrictions b/etcdctl/.import-restrictions
new file mode 100644
index 000000000000..449cfc928ccc
--- /dev/null
+++ b/etcdctl/.import-restrictions
@@ -0,0 +1,9 @@
+rules:
+  # prevent import of go.etcd.io/etcd
+  - selectorRegexp: go[.]etcd[.]io/etcd
+    allowedPrefixes:
+      - go.etcd.io/etcd/api/v3
+      - go.etcd.io/etcd/client/pkg/v3
+      - go.etcd.io/etcd/client/v3
+      - go.etcd.io/etcd/etcdctl/v3
+      - go.etcd.io/etcd/pkg/v3
diff --git a/etcdutl/.import-restrictions b/etcdutl/.import-restrictions
new file mode 100644
index 000000000000..f576b7b85caa
--- /dev/null
+++ b/etcdutl/.import-restrictions
@@ -0,0 +1,10 @@
+rules:
+  # prevent import of go.etcd.io/etcd
+  - selectorRegexp: go[.]etcd[.]io/etcd
+    allowedPrefixes:
+      - go.etcd.io/etcd/api/v3
+      - go.etcd.io/etcd/client/pkg/v3
+      - go.etcd.io/etcd/client/v3
+      - go.etcd.io/etcd/etcdutl/v3
+      - go.etcd.io/etcd/pkg/v3
+      - go.etcd.io/etcd/server/v3
diff --git a/pkg/.import-restrictions b/pkg/.import-restrictions
new file mode 100644
index 000000000000..be16ffbfadf0
--- /dev/null
+++ b/pkg/.import-restrictions
@@ -0,0 +1,6 @@
+rules:
+  # prevent import of go.etcd.io/etcd
+  - selectorRegexp: go[.]etcd[.]io/etcd
+    allowedPrefixes:
+      - go.etcd.io/etcd/client/pkg/v3
+      - go.etcd.io/etcd/pkg/v3
diff --git a/scripts/test.sh b/scripts/test.sh
index 6687091a8bfe..120dcece4282 100755
--- a/scripts/test.sh
+++ b/scripts/test.sh
@@ -431,6 +431,10 @@ function lint_fix_pass {
   run_for_modules generic_checker run golangci-lint run --config "${ETCD_ROOT_DIR}/tools/.golangci.yaml" --fix
 }
 
+function import_boss_pass {
+  run_for_modules generic_checker run import-boss
+}
+
 function license_header_per_module {
   # bash 3.x compatible replacement of: mapfile -t gofiles < <(go_srcs_in_module)
   local gofiles=()
diff --git a/server/.import-restrictions b/server/.import-restrictions
new file mode 100644
index 000000000000..c405c811541b
--- /dev/null
+++ b/server/.import-restrictions
@@ -0,0 +1,10 @@
+rules:
+  # prevent import of go.etcd.io/etcd
+  - selectorRegexp: go[.]etcd[.]io/etcd
+    allowedPrefixes:
+      - go.etcd.io/etcd/server/v3
+      - go.etcd.io/etcd/api/v3
+      - go.etcd.io/etcd/client/pkg/v3
+      - go.etcd.io/etcd/pkg/v3
+      - go.etcd.io/etcd/client/v3
+      - go.etcd.io/etcd/client/v2