diff --git a/tools/watch/until.go b/tools/watch/until.go
index 724e7269..1907b68a 100644
--- a/tools/watch/until.go
+++ b/tools/watch/until.go
@@ -23,8 +23,10 @@ import (
 
 	"github.com/golang/glog"
 	"k8s.io/apimachinery/pkg/api/meta"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/util/wait"
 	"k8s.io/apimachinery/pkg/watch"
+	"k8s.io/client-go/tools/cache"
 )
 
 // ConditionFunc returns true if the condition has been reached, false if it has not been reached yet,
@@ -105,7 +107,10 @@ func ContextWithOptionalTimeout(parent context.Context, timeout time.Duration) (
 // ListWatchUntil checks the provided conditions against the items returned by the list watcher, returning wait.ErrWaitTimeout
 // if timeout is exceeded without all conditions returning true, or an error if an error occurs.
 // TODO: check for watch expired error and retry watch from latest point?  Same issue exists for Until.
-func ListWatchUntil(timeout time.Duration, lw ListerWatcher, conditions ...watchtools.ConditionFunc) (*watch.Event, error) {
+// TODO: remove when no longer used
+//
+// Deprecated: Use UntilWithSync instead.
+func ListWatchUntil(timeout time.Duration, lw cache.ListerWatcher, conditions ...ConditionFunc) (*watch.Event, error) {
 	if len(conditions) == 0 {
 		return nil, nil
 	}
@@ -167,10 +172,10 @@ func ListWatchUntil(timeout time.Duration, lw ListerWatcher, conditions ...watch
 		return nil, err
 	}
 
-	ctx, cancel := watchtools.ContextWithOptionalTimeout(context.Background(), timeout)
+	ctx, cancel := ContextWithOptionalTimeout(context.Background(), timeout)
 	defer cancel()
-	evt, err := watchtools.UntilWithoutRetry(ctx, watchInterface, remainingConditions...)
-	if err == watchtools.ErrWatchClosed {
+	evt, err := UntilWithoutRetry(ctx, watchInterface, remainingConditions...)
+	if err == ErrWatchClosed {
 		// present a consistent error interface to callers
 		err = wait.ErrWaitTimeout
 	}
diff --git a/util/certificate/csr/csr.go b/util/certificate/csr/csr.go
index 22112a5b..4a53352f 100644
--- a/util/certificate/csr/csr.go
+++ b/util/certificate/csr/csr.go
@@ -24,10 +24,11 @@ import (
 	"encoding/base64"
 	"encoding/pem"
 	"fmt"
-	"github.com/golang/glog"
 	"reflect"
 	"time"
 
+	"github.com/golang/glog"
+
 	certificates "k8s.io/api/certificates/v1beta1"
 	"k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -38,6 +39,7 @@ import (
 	"k8s.io/apimachinery/pkg/watch"
 	certificatesclient "k8s.io/client-go/kubernetes/typed/certificates/v1beta1"
 	"k8s.io/client-go/tools/cache"
+	watchtools "k8s.io/client-go/tools/watch"
 	certutil "k8s.io/client-go/util/cert"
 )
 
@@ -121,7 +123,7 @@ func RequestCertificate(client certificatesclient.CertificateSigningRequestInter
 func WaitForCertificate(client certificatesclient.CertificateSigningRequestInterface, req *certificates.CertificateSigningRequest, timeout time.Duration) (certData []byte, err error) {
 	fieldSelector := fields.OneTermEqualSelector("metadata.name", req.Name).String()
 
-	event, err := cache.ListWatchUntil(
+	event, err := watchtools.ListWatchUntil(
 		timeout,
 		&cache.ListWatch{
 			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {