diff --git a/cmd/derper/depaware.txt b/cmd/derper/depaware.txt
index d2869845e..0e40377c7 100644
--- a/cmd/derper/depaware.txt
+++ b/cmd/derper/depaware.txt
@@ -186,7 +186,6 @@ tailscale.com/cmd/derper dependencies: (generated by github.com/tailscale/depawa
         golang.org/x/crypto/nacl/box                                 from tailscale.com/types/key
         golang.org/x/crypto/nacl/secretbox                           from golang.org/x/crypto/nacl/box
         golang.org/x/crypto/salsa20/salsa                            from golang.org/x/crypto/nacl/box+
-        golang.org/x/exp/maps                                        from tailscale.com/tailcfg
    L    golang.org/x/net/bpf                                         from github.com/mdlayher/netlink+
         golang.org/x/net/dns/dnsmessage                              from net+
         golang.org/x/net/http/httpguts                               from net/http
diff --git a/cmd/k8s-operator/ingress.go b/cmd/k8s-operator/ingress.go
index 72291afe8..a3c7e1cd5 100644
--- a/cmd/k8s-operator/ingress.go
+++ b/cmd/k8s-operator/ingress.go
@@ -8,11 +8,11 @@ package main
 import (
 	"context"
 	"fmt"
+	"slices"
 	"strings"
 	"sync"
 
 	"go.uber.org/zap"
-	"golang.org/x/exp/slices"
 	corev1 "k8s.io/api/core/v1"
 	networkingv1 "k8s.io/api/networking/v1"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
diff --git a/cmd/k8s-operator/svc.go b/cmd/k8s-operator/svc.go
index 4fe8e44de..701c3fb18 100644
--- a/cmd/k8s-operator/svc.go
+++ b/cmd/k8s-operator/svc.go
@@ -9,11 +9,11 @@ import (
 	"context"
 	"fmt"
 	"net/netip"
+	"slices"
 	"strings"
 	"sync"
 
 	"go.uber.org/zap"
-	"golang.org/x/exp/slices"
 	corev1 "k8s.io/api/core/v1"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/types"
diff --git a/cmd/tailscale/depaware.txt b/cmd/tailscale/depaware.txt
index 86d48fc57..5a5b5b62e 100644
--- a/cmd/tailscale/depaware.txt
+++ b/cmd/tailscale/depaware.txt
@@ -194,7 +194,7 @@ tailscale.com/cmd/tailscale dependencies: (generated by github.com/tailscale/dep
         golang.org/x/crypto/pbkdf2                                   from software.sslmate.com/src/go-pkcs12
         golang.org/x/crypto/salsa20/salsa                            from golang.org/x/crypto/nacl/box+
    W    golang.org/x/exp/constraints                                 from github.com/dblohm7/wingoes/pe
-        golang.org/x/exp/maps                                        from tailscale.com/cmd/tailscale/cli+
+        golang.org/x/exp/maps                                        from tailscale.com/cmd/tailscale/cli
         golang.org/x/net/bpf                                         from github.com/mdlayher/netlink+
         golang.org/x/net/dns/dnsmessage                              from net+
         golang.org/x/net/http/httpguts                               from net/http+
diff --git a/cmd/testwrapper/testwrapper.go b/cmd/testwrapper/testwrapper.go
index 7f1342a4f..4878a9448 100644
--- a/cmd/testwrapper/testwrapper.go
+++ b/cmd/testwrapper/testwrapper.go
@@ -19,12 +19,12 @@ import (
 	"log"
 	"os"
 	"os/exec"
+	"slices"
 	"sort"
 	"strings"
 	"time"
 
 	xmaps "golang.org/x/exp/maps"
-	"golang.org/x/exp/slices"
 	"tailscale.com/cmd/testwrapper/flakytest"
 )
 
diff --git a/tailcfg/tailcfg.go b/tailcfg/tailcfg.go
index 1a7cb3850..b679c7584 100644
--- a/tailcfg/tailcfg.go
+++ b/tailcfg/tailcfg.go
@@ -10,13 +10,13 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"maps"
 	"net/netip"
 	"reflect"
 	"slices"
 	"strings"
 	"time"
 
-	"golang.org/x/exp/maps"
 	"tailscale.com/types/dnstype"
 	"tailscale.com/types/key"
 	"tailscale.com/types/opt"
diff --git a/tstest/deptest/deptest.go b/tstest/deptest/deptest.go
index 6c8614593..8ea39e243 100644
--- a/tstest/deptest/deptest.go
+++ b/tstest/deptest/deptest.go
@@ -10,7 +10,10 @@ import (
 	"encoding/json"
 	"os"
 	"os/exec"
+	"path/filepath"
+	"regexp"
 	"runtime"
+	"strings"
 	"testing"
 )
 
@@ -52,5 +55,30 @@ func (c DepChecker) Check(t *testing.T) {
 		}
 	}
 	t.Logf("got %d dependencies", len(res.Deps))
+}
+
+// ImportAliasCheck checks that all packages are imported according to Tailscale
+// conventions.
+func ImportAliasCheck(t testing.TB, relDir string) {
+	dir, err := os.Getwd()
+	if err != nil {
+		t.Fatal(err)
+	}
+	dir = filepath.Join(dir, relDir)
 
+	cmd := exec.Command("git", "grep", "-n", "-F", `"golang.org/x/exp/`)
+	cmd.Dir = dir
+	matches, err := cmd.CombinedOutput()
+	if err != nil {
+		t.Logf("ignoring error: %v, %s", err, matches)
+		return
+	}
+	badRx := regexp.MustCompile(`^([^:]+:\d+):\s+"golang.org/x/exp/(slices|maps)"`)
+	if s := strings.TrimSpace(string(matches)); s != "" {
+		for _, line := range strings.Split(s, "\n") {
+			if m := badRx.FindStringSubmatch(line); m != nil {
+				t.Errorf("%s: the x/exp/%s package should be imported as x%s", m[1], m[2], m[2])
+			}
+		}
+	}
 }
diff --git a/tstest/deptest/deptest_test.go b/tstest/deptest/deptest_test.go
new file mode 100644
index 000000000..ebafa5684
--- /dev/null
+++ b/tstest/deptest/deptest_test.go
@@ -0,0 +1,10 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+package deptest
+
+import "testing"
+
+func TestImports(t *testing.T) {
+	ImportAliasCheck(t, "../../")
+}