diff --git a/hack/verify-typecheck-dockerless.sh b/hack/verify-typecheck-dockerless.sh
index c8364d3446a..d8f95e6b2ec 100755
--- a/hack/verify-typecheck-dockerless.sh
+++ b/hack/verify-typecheck-dockerless.sh
@@ -22,4 +22,13 @@ KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
 
 cd "${KUBE_ROOT}"
 # verify the dockerless build
+# https://github.com/kubernetes/enhancements/blob/master/keps/sig-node/1547-building-kubelet-without-docker/README.md
 hack/verify-typecheck.sh --skip-test --tags=dockerless --ignore-dirs=test
+
+# verify using go list
+if _out="$(go list -mod=readonly -tags "dockerless" -e -json  k8s.io/kubernetes/cmd/kubelet/... \
+  | grep -e dockershim)"; then
+    echo "${_out}" >&2
+    echo "Verify typecheck for dockerless tag failed. Found restricted packages." >&2
+    exit 1
+fi
diff --git a/hack/verify-typecheck-providerless.sh b/hack/verify-typecheck-providerless.sh
index 6b1b78f3835..de3c76c2861 100755
--- a/hack/verify-typecheck-providerless.sh
+++ b/hack/verify-typecheck-providerless.sh
@@ -27,3 +27,11 @@ cd "${KUBE_ROOT}"
 # verify the providerless build
 # https://github.com/kubernetes/enhancements/blob/master/keps/sig-cloud-provider/1179-building-without-in-tree-providers/README.md
 hack/verify-typecheck.sh --skip-test --tags=providerless --ignore-dirs=test
+
+# verify using go list
+if _out="$(go list -mod=readonly -tags "providerless" -e -json  k8s.io/kubernetes/cmd/kubelet/... \
+  | grep -e Azure/azure-sdk-for-go -e github.com/aws/aws-sdk-go -e google.golang.org/api)"; then
+    echo "${_out}" >&2
+    echo "Verify typecheck for providerless tag failed. Found restricted packages." >&2
+    exit 1
+fi