diff --git a/cmd/servicerunner/servicerunner_test.go b/cmd/servicerunner/servicerunner_test.go
index 6f8d0da..c5614e9 100644
--- a/cmd/servicerunner/servicerunner_test.go
+++ b/cmd/servicerunner/servicerunner_test.go
@@ -12,10 +12,10 @@
 	"path"
 	"testing"
 
-	"v.io/x/ref/lib/testutil"
+	"v.io/x/ref/lib/testutil/testutil"
 )
 
-func TestMain(t *testing.T) {
+func TestServiceRunner(t *testing.T) {
 	testutil.UnsetPrincipalEnvVars()
 	tmpdir, err := ioutil.TempDir("", "servicerunner_test")
 	if err != nil {
diff --git a/lib/modules/queue_rw_test.go b/lib/modules/queue_rw_test.go
index f38c7ff..b7e618c 100644
--- a/lib/modules/queue_rw_test.go
+++ b/lib/modules/queue_rw_test.go
@@ -6,16 +6,16 @@
 	"testing"
 
 	"v.io/x/ref/lib/modules"
-	"v.io/x/ref/lib/testutil"
+	"v.io/x/ref/lib/testutil/testutil"
 )
 
 func TestQueueRW(t *testing.T) {
 	q := modules.NewRW()
-	size := testutil.Rand.Intn(1000)
+	size := testutil.Intn(1000)
 	data := testutil.RandomBytes(size)
 	begin := 0
 	for {
-		end := begin + testutil.Rand.Intn(100) + 1
+		end := begin + testutil.Intn(100) + 1
 		if end > len(data) {
 			end = len(data)
 		}
@@ -33,7 +33,7 @@
 	}
 	readData := make([]byte, 0, size)
 	for {
-		buf := make([]byte, testutil.Rand.Intn(100)+1)
+		buf := make([]byte, testutil.Intn(100)+1)
 		n, err := q.Read(buf)
 		if n > 0 {
 			readData = append(readData, buf[:n]...)
diff --git a/lib/testutil/doc.go b/lib/testutil/doc.go
new file mode 100644
index 0000000..ded0c07
--- /dev/null
+++ b/lib/testutil/doc.go
@@ -0,0 +1,20 @@
+// Package testutil provides initalization for unit and integration tests.
+//
+// Configures logging, random number generators and other global state.
+// Typical usage in _test.go files:
+//
+// import "v.io/x/ref/lib/testutil"
+// func TestMain(m *testing.M) {
+//     testutil.Init()
+//     os.Exit(m.Run())
+// }
+//
+// InitForTest can be used within test functions as a safe alternative
+// to v23.Init.
+//
+// func TestFoo(t *testing.T) {
+//    ctx, shutdown := testutil.InitForTest()
+//    defer shutdown()
+//    ...
+// }
+package testutil
diff --git a/lib/testutil/init.go b/lib/testutil/init.go
index ab09904..9276f44 100644
--- a/lib/testutil/init.go
+++ b/lib/testutil/init.go
@@ -1,63 +1,24 @@
-// Package testutil provides initalization and utility routines for unit tests.
-//
-// Configures logging, random number generators and other global state.
-// Typical usage in _test.go files:
-//   import "v.io/x/ref/lib/testutil"
-//   func TestMain(m *testing.M) {
-//     testutil.Init()
-//     os.Exit(m.Run())
-//   }
 package testutil
 
 import (
 	"flag"
-	"math/rand"
 	"os"
 	"runtime"
-	"strconv"
 	"sync"
-	"time"
-
-	tsecurity "v.io/x/ref/lib/testutil/security"
 
 	"v.io/v23"
 	"v.io/v23/context"
+
 	"v.io/x/lib/vlog"
+
+	tsecurity "v.io/x/ref/lib/testutil/security"
+	"v.io/x/ref/lib/testutil/testutil"
 )
 
 const (
-	SeedEnv      = "VEYRON_RNG_SEED"
 	TestBlessing = "test-blessing"
 )
 
-// Random is a concurrent-access friendly source of randomness.
-type Random struct {
-	mu   sync.Mutex
-	rand *rand.Rand
-}
-
-// Int returns a non-negative pseudo-random int.
-func (r *Random) Int() int {
-	r.mu.Lock()
-	defer r.mu.Unlock()
-	return r.rand.Int()
-}
-
-// Intn returns a non-negative pseudo-random int in the range [0, n).
-func (r *Random) Intn(n int) int {
-	r.mu.Lock()
-	defer r.mu.Unlock()
-	return r.rand.Intn(n)
-}
-
-// Int63 returns a non-negative 63-bit pseudo-random integer as an int64.
-func (r *Random) Int63() int64 {
-	r.mu.Lock()
-	defer r.mu.Unlock()
-	return r.rand.Int63()
-}
-
-var Rand *Random
 var once sync.Once
 var IntegrationTestsEnabled bool
 var IntegrationTestsDebugShellOnError bool
@@ -90,34 +51,15 @@
 		// function of a _test.go file.
 		flag.Parse()
 		vlog.ConfigureLibraryLoggerFromFlags()
-
-		// Initialize pseudo-random number generator.
-		seed := time.Now().UnixNano()
-		seedString := os.Getenv(SeedEnv)
-		if seedString != "" {
-			var err error
-			base, bitSize := 0, 64
-			seed, err = strconv.ParseInt(seedString, base, bitSize)
-			if err != nil {
-				vlog.Fatalf("ParseInt(%v, %v, %v) failed: %v", seedString, base, bitSize, err)
-			}
-		}
-		vlog.Infof("Seeding pseudo-random number generator with %v", seed)
-		Rand = &Random{rand: rand.New(rand.NewSource(seed))}
+		testutil.InitRandGenerator()
 	}
 	once.Do(init)
 }
 
-// UnsetPrincipalEnvVars unsets all environment variables pertaining to principal
-// initialization.
-func UnsetPrincipalEnvVars() {
-	os.Setenv("VEYRON_CREDENTIALS", "")
-	os.Setenv("VEYRON_AGENT_FD", "")
-}
-
 // InitForTest initializes a new context.T and sets a freshly created principal
-// (with a single self-signed blessing) on it. The principal setting step is skipped
-// if this function is invoked from a process run using the modules package.
+// (with a single self-signed blessing) on it. The principal setting step is
+// skipped if this function is invoked from a process run using the modules
+// package.
 func InitForTest() (*context.T, v23.Shutdown) {
 	ctx, shutdown := v23.Init()
 	if len(os.Getenv("VEYRON_SHELL_HELPER_PROCESS_ENTRY_POINT")) != 0 {
diff --git a/lib/testutil/dispatcher.go b/lib/testutil/testutil/dispatcher.go
similarity index 100%
rename from lib/testutil/dispatcher.go
rename to lib/testutil/testutil/dispatcher.go
diff --git a/lib/testutil/glob.go b/lib/testutil/testutil/glob.go
similarity index 100%
rename from lib/testutil/glob.go
rename to lib/testutil/testutil/glob.go
diff --git a/lib/testutil/testutil/rand.go b/lib/testutil/testutil/rand.go
new file mode 100644
index 0000000..9e2b827
--- /dev/null
+++ b/lib/testutil/testutil/rand.go
@@ -0,0 +1,136 @@
+package testutil
+
+import (
+	"math/rand"
+	"os"
+	"strconv"
+	"sync"
+	"time"
+
+	"v.io/x/lib/vlog"
+)
+
+const (
+	SeedEnv = "VANADIUM_RNG_SEED"
+)
+
+// An instance of Random initialized by the InitRandomGenerator function.
+var (
+	Rand *Random
+	once sync.Once
+)
+
+// Random is a concurrent-access friendly source of randomness.
+type Random struct {
+	mu   sync.Mutex
+	rand *rand.Rand
+}
+
+// Int returns a non-negative pseudo-random int.
+func (r *Random) Int() int {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	return r.rand.Int()
+}
+
+// Intn returns a non-negative pseudo-random int in the range [0, n).
+func (r *Random) Intn(n int) int {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	return r.rand.Intn(n)
+}
+
+// Int63 returns a non-negative 63-bit pseudo-random integer as an int64.
+func (r *Random) Int63() int64 {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	return r.rand.Int63()
+}
+
+// RandomBytes generates the given number of random bytes.
+func (rand *Random) RandomBytes(size int) []byte {
+	buffer := make([]byte, size)
+	randomMutex.Lock()
+	defer randomMutex.Unlock()
+	// Generate a 10MB of random bytes since that is a value commonly
+	// used in the tests.
+	if len(random) == 0 {
+		random = generateRandomBytes(rand, 10<<20)
+	}
+	if size > len(random) {
+		extra := generateRandomBytes(rand, size-len(random))
+		random = append(random, extra...)
+	}
+	start := rand.Intn(len(random) - size + 1)
+	copy(buffer, random[start:start+size])
+	return buffer
+}
+
+// Create a new pseudo-random number generator, the seed may be supplied
+// by the VANADIUM_RNG_SEED to allow for reproducing a previous sequence.
+func NewRandGenerator() *Random {
+	seed := time.Now().UnixNano()
+	seedString := os.Getenv(SeedEnv)
+	if seedString != "" {
+		var err error
+		base, bitSize := 0, 64
+		seed, err = strconv.ParseInt(seedString, base, bitSize)
+		if err != nil {
+			vlog.Fatalf("ParseInt(%v, %v, %v) failed: %v", seedString, base, bitSize, err)
+		}
+	}
+	vlog.Infof("Seeding pseudo-random number generator with %v", seed)
+	return &Random{rand: rand.New(rand.NewSource(seed))}
+}
+
+// InitRandGenerator creates an instance of Random in the public variable Rand.
+func InitRandGenerator() {
+	once.Do(func() {
+		Rand = NewRandGenerator()
+	})
+}
+
+var (
+	random      []byte
+	randomMutex sync.Mutex
+)
+
+func generateRandomBytes(rand *Random, size int) []byte {
+	buffer := make([]byte, size)
+	offset := 0
+	for {
+		bits := int64(rand.Int63())
+		for i := 0; i < 8; i++ {
+			buffer[offset] = byte(bits & 0xff)
+			size--
+			if size == 0 {
+				return buffer
+			}
+			offset++
+			bits >>= 8
+		}
+	}
+}
+
+// Int returns a non-negative pseudo-random int using the public variable Rand.
+func Int() int {
+	return Rand.Int()
+}
+
+// Intn returns a non-negative pseudo-random int in the range [0, n) using
+// the public variable Rand.
+func Intn(n int) int {
+	return Rand.Intn(n)
+}
+
+// Int63 returns a non-negative 63-bit pseudo-random integer as an int64
+// using the public variable Rand.
+func Int63() int64 {
+	return Rand.Int63()
+}
+
+// RandomBytes generates the given number of random bytes using
+// the public variable Rand.
+func RandomBytes(size int) []byte {
+	return Rand.RandomBytes(size)
+}
diff --git a/lib/testutil/testutil/util.go b/lib/testutil/testutil/util.go
new file mode 100644
index 0000000..ed1c0c2
--- /dev/null
+++ b/lib/testutil/testutil/util.go
@@ -0,0 +1,45 @@
+package testutil
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"runtime"
+)
+
+// DepthToExternalCaller determines the number of stack frames to the first
+// enclosing caller that is external to the package that this function is
+// called from. Drectory name is used as a proxy for package name,
+// that is, the directory component of the file return runtime.Caller is
+// compared to that of the lowest level caller until a different one is
+// encountered as the stack is walked upwards.
+func DepthToExternalCaller() int {
+	_, file, _, _ := runtime.Caller(1)
+	cwd := filepath.Dir(file)
+	for d := 2; d < 10; d++ {
+		_, file, _, _ := runtime.Caller(d)
+		if cwd != filepath.Dir(file) {
+			return d
+		}
+	}
+	return 1
+}
+
+// FormatLogLine will prepend the file and line number of the caller
+// at the specificied depth (as per runtime.Caller) to the supplied
+// format and args and return a formatted string. It is useful when
+// implementing functions that factor out error handling and reporting
+// in tests.
+func FormatLogLine(depth int, format string, args ...interface{}) string {
+	_, file, line, _ := runtime.Caller(depth)
+	nargs := []interface{}{filepath.Base(file), line}
+	nargs = append(nargs, args...)
+	return fmt.Sprintf("%s:%d: "+format, nargs...)
+}
+
+// UnsetPrincipalEnvVars unsets all environment variables pertaining to
+// principal initialization.
+func UnsetPrincipalEnvVars() {
+	os.Setenv("VEYRON_CREDENTIALS", "")
+	os.Setenv("VEYRON_AGENT_FD", "")
+}
diff --git a/lib/testutil/util_test.go b/lib/testutil/testutil/util_test.go
similarity index 100%
rename from lib/testutil/util_test.go
rename to lib/testutil/testutil/util_test.go
diff --git a/lib/testutil/vtest.go b/lib/testutil/testutil/vtest.go
similarity index 100%
rename from lib/testutil/vtest.go
rename to lib/testutil/testutil/vtest.go
diff --git a/lib/testutil/vtest_test.go b/lib/testutil/testutil/vtest_test.go
similarity index 100%
rename from lib/testutil/vtest_test.go
rename to lib/testutil/testutil/vtest_test.go
diff --git a/lib/testutil/util.go b/lib/testutil/util.go
deleted file mode 100644
index 6dc0b56..0000000
--- a/lib/testutil/util.go
+++ /dev/null
@@ -1,79 +0,0 @@
-package testutil
-
-import (
-	"fmt"
-	"path/filepath"
-	"runtime"
-	"sync"
-)
-
-var (
-	random      []byte
-	randomMutex sync.Mutex
-)
-
-func generateRandomBytes(size int) []byte {
-	buffer := make([]byte, size)
-	offset := 0
-	for {
-		bits := int64(Rand.Int63())
-		for i := 0; i < 8; i++ {
-			buffer[offset] = byte(bits & 0xff)
-			size--
-			if size == 0 {
-				return buffer
-			}
-			offset++
-			bits >>= 8
-		}
-	}
-}
-
-// DepthToExternalCaller determines the number of stack frames to the first
-// enclosing caller that is external to the package that this function is
-// called from. Drectory name is used as a proxy for package name,
-// that is, the directory component of the file return runtime.Caller is
-// compared to that of the lowest level caller until a different one is
-// encountered as the stack is walked upwards.
-func DepthToExternalCaller() int {
-	_, file, _, _ := runtime.Caller(1)
-	cwd := filepath.Dir(file)
-	for d := 2; d < 10; d++ {
-		_, file, _, _ := runtime.Caller(d)
-		if cwd != filepath.Dir(file) {
-			return d
-		}
-	}
-	return 1
-}
-
-// FormatLogLine will prepend the file and line number of the caller
-// at the specificied depth (as per runtime.Caller) to the supplied
-// format and args and return a formatted string. It is useful when
-// implementing functions that factor out error handling and reporting
-// in tests.
-func FormatLogLine(depth int, format string, args ...interface{}) string {
-	_, file, line, _ := runtime.Caller(depth)
-	nargs := []interface{}{filepath.Base(file), line}
-	nargs = append(nargs, args...)
-	return fmt.Sprintf("%s:%d: "+format, nargs...)
-}
-
-// RandomBytes generates the given number of random bytes.
-func RandomBytes(size int) []byte {
-	buffer := make([]byte, size)
-	randomMutex.Lock()
-	defer randomMutex.Unlock()
-	// Generate a 10MB of random bytes since that is a value commonly
-	// used in the tests.
-	if len(random) == 0 {
-		random = generateRandomBytes(10 << 20)
-	}
-	if size > len(random) {
-		extra := generateRandomBytes(size - len(random))
-		random = append(random, extra...)
-	}
-	start := Rand.Intn(len(random) - size + 1)
-	copy(buffer, random[start:start+size])
-	return buffer
-}
diff --git a/lib/testutil/v23tests/v23tests_test.go b/lib/testutil/v23tests/v23tests_test.go
index b253ad9..448b51f 100644
--- a/lib/testutil/v23tests/v23tests_test.go
+++ b/lib/testutil/v23tests/v23tests_test.go
@@ -17,7 +17,8 @@
 	"v.io/x/lib/vlog"
 
 	"v.io/x/ref/lib/modules"
-	"v.io/x/ref/lib/testutil"
+	test "v.io/x/ref/lib/testutil"
+	"v.io/x/ref/lib/testutil/testutil"
 	"v.io/x/ref/lib/testutil/v23tests"
 	_ "v.io/x/ref/profiles"
 )
@@ -105,7 +106,7 @@
 }
 
 func init() {
-	testutil.Init()
+	test.Init()
 	modules.RegisterChild("RunIntegrationTestInChild", "", RunIntegrationTestInChild)
 }
 
@@ -278,7 +279,7 @@
 		msg := recover().(string)
 		// this, and the tests below are intended to ensure that line #s
 		// are captured and reported correctly.
-		if got, want := msg, "v23tests_test.go:288"; !strings.Contains(got, want) {
+		if got, want := msg, "v23tests_test.go:289"; !strings.Contains(got, want) {
 			t.Fatalf("%q does not contain %q", got, want)
 		}
 		if got, want := msg, "fork/exec /bin/echox: no such file or directory"; !strings.Contains(got, want) {
@@ -300,7 +301,7 @@
 	sh.SetDefaultStartOpts(opts)
 	defer func() {
 		msg := recover().(string)
-		if got, want := msg, "v23tests_test.go:310"; !strings.Contains(got, want) {
+		if got, want := msg, "v23tests_test.go:311"; !strings.Contains(got, want) {
 			t.Fatalf("%q does not contain %q", got, want)
 		}
 		if got, want := msg, "StartWithOpts"; !strings.Contains(got, want) {
@@ -324,7 +325,7 @@
 		if iterations == 0 {
 			t.Fatalf("our sleeper didn't get to run")
 		}
-		if got, want := recover().(string), "v23tests_test.go:331: timed out"; !strings.Contains(got, want) {
+		if got, want := recover().(string), "v23tests_test.go:332: timed out"; !strings.Contains(got, want) {
 			t.Fatalf("%q does not contain %q", got, want)
 		}
 	}()
@@ -346,7 +347,7 @@
 		if iterations != 0 {
 			t.Fatalf("our sleeper got to run")
 		}
-		if got, want := recover().(string), "v23tests_test.go:353: timed out"; !strings.Contains(got, want) {
+		if got, want := recover().(string), "v23tests_test.go:354: timed out"; !strings.Contains(got, want) {
 			t.Fatalf("%q does not contain %q", got, want)
 		}
 	}()
diff --git a/profiles/internal/ipc/full_test.go b/profiles/internal/ipc/full_test.go
index 2019b52..d6d9da7 100644
--- a/profiles/internal/ipc/full_test.go
+++ b/profiles/internal/ipc/full_test.go
@@ -32,8 +32,8 @@
 	"v.io/x/lib/netstate"
 	"v.io/x/ref/lib/flags"
 	"v.io/x/ref/lib/stats"
-	"v.io/x/ref/lib/testutil"
 	tsecurity "v.io/x/ref/lib/testutil/security"
+	"v.io/x/ref/lib/testutil/testutil"
 	_ "v.io/x/ref/profiles/internal/ipc/protocols/tcp"
 	_ "v.io/x/ref/profiles/internal/ipc/protocols/ws"
 	_ "v.io/x/ref/profiles/internal/ipc/protocols/wsh"
diff --git a/profiles/internal/ipc/results_store_test.go b/profiles/internal/ipc/results_store_test.go
index 6af36b7..757f344 100644
--- a/profiles/internal/ipc/results_store_test.go
+++ b/profiles/internal/ipc/results_store_test.go
@@ -5,14 +5,14 @@
 	"sync"
 	"testing"
 
-	"v.io/x/ref/lib/testutil"
+	"v.io/x/ref/lib/testutil/testutil"
 )
 
 func randomKeys() []uint64 {
-	n := (testutil.Rand.Intn(256*10) / 10) + 256
+	n := (testutil.Intn(256*10) / 10) + 256
 	k := make([]uint64, n)
 	for i := 0; i < n; i++ {
-		k[i] = uint64(testutil.Rand.Int63())
+		k[i] = uint64(testutil.Int63())
 	}
 	return k
 }
diff --git a/profiles/internal/ipc/stream/vc/vc_test.go b/profiles/internal/ipc/stream/vc/vc_test.go
index 40d549d..9310a5c 100644
--- a/profiles/internal/ipc/stream/vc/vc_test.go
+++ b/profiles/internal/ipc/stream/vc/vc_test.go
@@ -14,22 +14,22 @@
 	"sync"
 	"testing"
 
-	"v.io/x/ref/lib/testutil"
-	tsecurity "v.io/x/ref/lib/testutil/security"
+	"v.io/v23/context"
+	"v.io/v23/ipc/version"
+	"v.io/v23/naming"
+	"v.io/v23/options"
+	"v.io/v23/security"
 
+	"v.io/x/lib/vlog"
+
+	tsecurity "v.io/x/ref/lib/testutil/security"
+	"v.io/x/ref/lib/testutil/testutil"
 	"v.io/x/ref/profiles/internal/ipc/stream"
 	"v.io/x/ref/profiles/internal/ipc/stream/id"
 	"v.io/x/ref/profiles/internal/ipc/stream/vc"
 	"v.io/x/ref/profiles/internal/lib/bqueue"
 	"v.io/x/ref/profiles/internal/lib/bqueue/drrqueue"
 	"v.io/x/ref/profiles/internal/lib/iobuf"
-
-	"v.io/v23/context"
-	"v.io/v23/ipc/version"
-	"v.io/v23/naming"
-	"v.io/v23/options"
-	"v.io/v23/security"
-	"v.io/x/lib/vlog"
 )
 
 var (
@@ -57,7 +57,7 @@
 	go func() {
 		buf := wrote
 		for len(buf) > 0 {
-			limit := 1 + testutil.Rand.Intn(len(buf)) // Random number in [1, n]
+			limit := 1 + testutil.Intn(len(buf)) // Random number in [1, n]
 			n, err := flow.Write(buf[:limit])
 			if n != limit || err != nil {
 				t.Errorf("Write returned (%d, %v) want (%d, nil)", n, err, limit)
diff --git a/profiles/internal/ipc/stream/vif/vif_test.go b/profiles/internal/ipc/stream/vif/vif_test.go
index 959ae0b..38ad2bb 100644
--- a/profiles/internal/ipc/stream/vif/vif_test.go
+++ b/profiles/internal/ipc/stream/vif/vif_test.go
@@ -16,14 +16,15 @@
 	"testing"
 	"time"
 
-	"v.io/x/ref/lib/testutil"
+	"v.io/v23/ipc/version"
+	"v.io/v23/naming"
+
 	tsecurity "v.io/x/ref/lib/testutil/security"
+	"v.io/x/ref/lib/testutil/testutil"
 	"v.io/x/ref/profiles/internal/ipc/stream/vc"
 	"v.io/x/ref/profiles/internal/ipc/stream/vif"
 	iversion "v.io/x/ref/profiles/internal/ipc/version"
 
-	"v.io/v23/ipc/version"
-	"v.io/v23/naming"
 	"v.io/x/ref/profiles/internal/ipc/stream"
 )
 
@@ -135,7 +136,7 @@
 		buf := []byte(data)
 		// Split into a random number of Write calls.
 		for len(buf) > 0 {
-			size := 1 + testutil.Rand.Intn(len(buf)) // Random number in [1, len(buf)]
+			size := 1 + testutil.Intn(len(buf)) // Random number in [1, len(buf)]
 			n, err := flow.Write(buf[:size])
 			if err != nil {
 				t.Errorf("Write failed: (%d, %v)", n, err)
@@ -151,7 +152,7 @@
 		var buf bytes.Buffer
 		var tmp [1024]byte
 		for {
-			n, err := flow.Read(tmp[:testutil.Rand.Intn(len(tmp))])
+			n, err := flow.Read(tmp[:testutil.Intn(len(tmp))])
 			buf.Write(tmp[:n])
 			if err == io.EOF {
 				break
diff --git a/profiles/internal/ipc/test/glob_test.go b/profiles/internal/ipc/test/glob_test.go
index bbdabf2..760fbb1 100644
--- a/profiles/internal/ipc/test/glob_test.go
+++ b/profiles/internal/ipc/test/glob_test.go
@@ -17,7 +17,8 @@
 	"v.io/v23/verror"
 
 	"v.io/x/ref/lib/glob"
-	"v.io/x/ref/lib/testutil"
+	test "v.io/x/ref/lib/testutil"
+	"v.io/x/ref/lib/testutil/testutil"
 	_ "v.io/x/ref/profiles"
 )
 
@@ -38,7 +39,7 @@
 }
 
 func TestGlob(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	namespace := []string{
@@ -199,7 +200,7 @@
 }
 
 func TestGlobDeny(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	tree := newNode()
diff --git a/profiles/internal/lib/deque/deque_test.go b/profiles/internal/lib/deque/deque_test.go
index bffaed0..4906c2e 100644
--- a/profiles/internal/lib/deque/deque_test.go
+++ b/profiles/internal/lib/deque/deque_test.go
@@ -3,7 +3,7 @@
 import (
 	"testing"
 
-	"v.io/x/ref/lib/testutil"
+	"v.io/x/ref/lib/testutil/testutil"
 )
 
 //go:generate v23 test generate
@@ -135,13 +135,13 @@
 	var q T
 	var contents []int
 	for i := 0; i != 1000; i++ {
-		switch testutil.Rand.Intn(4) {
+		switch testutil.Intn(4) {
 		case 0:
-			i := testutil.Rand.Int()
+			i := testutil.Int()
 			contents = append([]int{i}, contents...)
 			q.PushFront(i)
 		case 1:
-			i := testutil.Rand.Int()
+			i := testutil.Int()
 			contents = append(contents, i)
 			q.PushBack(i)
 		case 2:
diff --git a/profiles/internal/lib/sync/wait_group_test.go b/profiles/internal/lib/sync/wait_group_test.go
index ddf883a..8be3907 100644
--- a/profiles/internal/lib/sync/wait_group_test.go
+++ b/profiles/internal/lib/sync/wait_group_test.go
@@ -2,7 +2,8 @@
 
 import (
 	"testing"
-	"v.io/x/ref/lib/testutil"
+
+	"v.io/x/ref/lib/testutil/testutil"
 )
 
 //go:generate v23 test generate
@@ -15,7 +16,7 @@
 
 	count := 0
 	for n := 0; n < N; n++ {
-		if count == 0 || testutil.Rand.Intn(2) == 0 {
+		if count == 0 || testutil.Intn(2) == 0 {
 			if !w.TryAdd() {
 				t.Fatal("TryAdd failed")
 			}
diff --git a/profiles/internal/naming/namespace/all_test.go b/profiles/internal/naming/namespace/all_test.go
index 70b0a95..7ea04ca 100644
--- a/profiles/internal/naming/namespace/all_test.go
+++ b/profiles/internal/naming/namespace/all_test.go
@@ -18,8 +18,9 @@
 	"v.io/v23/verror"
 	"v.io/x/lib/vlog"
 
-	"v.io/x/ref/lib/testutil"
+	test "v.io/x/ref/lib/testutil"
 	tsecurity "v.io/x/ref/lib/testutil/security"
+	"v.io/x/ref/lib/testutil/testutil"
 	_ "v.io/x/ref/profiles"
 	"v.io/x/ref/profiles/internal/naming/namespace"
 	vsecurity "v.io/x/ref/security"
@@ -29,7 +30,7 @@
 //go:generate v23 test generate
 
 func createContexts(t *testing.T) (sc, c *context.T, cleanup func()) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	var (
 		err error
 		psc = tsecurity.NewPrincipal("sc")
diff --git a/profiles/internal/rt/rt_test.go b/profiles/internal/rt/rt_test.go
index cc16af2..39a5f2f 100644
--- a/profiles/internal/rt/rt_test.go
+++ b/profiles/internal/rt/rt_test.go
@@ -15,8 +15,9 @@
 
 	"v.io/x/ref/lib/flags/consts"
 	"v.io/x/ref/lib/modules"
-	"v.io/x/ref/lib/testutil"
+	test "v.io/x/ref/lib/testutil"
 	"v.io/x/ref/lib/testutil/expect"
+	"v.io/x/ref/lib/testutil/testutil"
 	vsecurity "v.io/x/ref/security"
 )
 
@@ -50,7 +51,7 @@
 }
 
 func child(stdin io.Reader, stdout, stderr io.Writer, env map[string]string, args ...string) error {
-	_, shutdown := testutil.InitForTest()
+	_, shutdown := test.InitForTest()
 	defer shutdown()
 
 	logger := vlog.Log
@@ -115,7 +116,7 @@
 }
 
 func principal(stdin io.Reader, stdout, stderr io.Writer, env map[string]string, args ...string) error {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	p := v23.GetPrincipal(ctx)
@@ -129,7 +130,7 @@
 // Runner runs a principal as a subprocess and reports back with its
 // own security info and it's childs.
 func runner(stdin io.Reader, stdout, stderr io.Writer, env map[string]string, args ...string) error {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	p := v23.GetPrincipal(ctx)
@@ -228,7 +229,7 @@
 	}
 	defer sh.Cleanup(os.Stderr, os.Stderr)
 
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	agentSh, err := modules.NewShell(ctx, v23.GetPrincipal(ctx))
@@ -242,7 +243,7 @@
 	if len(collect(sh, nil)) == 0 {
 		t.Fatalf("Without agent: child returned an empty default blessings set")
 	}
-	if got, want := collect(agentSh, nil), testutil.TestBlessing+security.ChainSeparator+"child"; got != want {
+	if got, want := collect(agentSh, nil), test.TestBlessing+security.ChainSeparator+"child"; got != want {
 		t.Fatalf("With agent: got %q, want %q", got, want)
 	}
 
diff --git a/profiles/internal/testing/concurrency/clock_test.go b/profiles/internal/testing/concurrency/clock_test.go
index 0166971..064f2ef 100644
--- a/profiles/internal/testing/concurrency/clock_test.go
+++ b/profiles/internal/testing/concurrency/clock_test.go
@@ -3,7 +3,7 @@
 import (
 	"testing"
 
-	"v.io/x/ref/lib/testutil"
+	"v.io/x/ref/lib/testutil/testutil"
 )
 
 //go:generate v23 test generate
@@ -11,7 +11,7 @@
 // TestClone checks the clone() method of a clock.
 func TestClone(t *testing.T) {
 	c1 := newClock()
-	c1[0] = testutil.Rand.Intn(100)
+	c1[0] = testutil.Intn(100)
 	c2 := c1.clone()
 	c1[0]++
 	if c2[0] != c1[0]-1 {
@@ -23,7 +23,7 @@
 func TestEquality(t *testing.T) {
 	c1, c2 := newClock(), newClock()
 	for i := TID(0); i < TID(10); i++ {
-		c1[i] = testutil.Rand.Intn(100)
+		c1[i] = testutil.Intn(100)
 		c2[i] = c1[i]
 	}
 	if !c1.equals(c2) {
@@ -35,7 +35,7 @@
 func TestHappensBefore(t *testing.T) {
 	c1, c2, c3 := newClock(), newClock(), newClock()
 	for i := TID(0); i < TID(10); i++ {
-		c1[i] = testutil.Rand.Intn(100)
+		c1[i] = testutil.Intn(100)
 		if i%2 == 0 {
 			c2[i] = c1[i] + 1
 			c3[i] = c1[i] + 1
@@ -65,8 +65,8 @@
 func TestMerge(t *testing.T) {
 	c1, c2 := newClock(), newClock()
 	for i := TID(0); i < TID(10); i++ {
-		c1[i] = testutil.Rand.Intn(100)
-		c2[i] = testutil.Rand.Intn(100)
+		c1[i] = testutil.Intn(100)
+		c2[i] = testutil.Intn(100)
 	}
 	c1.merge(c2)
 	for i := TID(0); i < TID(10); i++ {
diff --git a/security/serialization/serialization_test.go b/security/serialization/serialization_test.go
index 3167841..9ab7e9e 100644
--- a/security/serialization/serialization_test.go
+++ b/security/serialization/serialization_test.go
@@ -14,7 +14,8 @@
 	"strings"
 	"testing"
 
-	"v.io/x/ref/lib/testutil"
+	test "v.io/x/ref/lib/testutil"
+	"v.io/x/ref/lib/testutil/testutil"
 	"v.io/x/ref/security/serialization"
 
 	"v.io/v23/security"
@@ -23,7 +24,7 @@
 // We call our own TestMain here because v23 test generate causes an import cycle
 // in this package.
 func TestMain(m *testing.M) {
-	testutil.Init()
+	test.Init()
 	os.Exit(m.Run())
 }
 
diff --git a/services/mgmt/application/impl/impl_test.go b/services/mgmt/application/impl/impl_test.go
index 54168e3..66d980d 100644
--- a/services/mgmt/application/impl/impl_test.go
+++ b/services/mgmt/application/impl/impl_test.go
@@ -13,7 +13,8 @@
 	"v.io/v23/services/mgmt/application"
 	"v.io/v23/verror"
 
-	"v.io/x/ref/lib/testutil"
+	test "v.io/x/ref/lib/testutil"
+	"v.io/x/ref/lib/testutil/testutil"
 	_ "v.io/x/ref/profiles/static"
 	//vsecurity "v.io/x/ref/security"
 	"v.io/x/ref/services/mgmt/application/impl"
@@ -38,7 +39,7 @@
 // TestInterface tests that the implementation correctly implements
 // the Application interface.
 func TestInterface(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	dir, prefix := "", ""
@@ -177,7 +178,7 @@
 }
 
 func TestPreserveAcrossRestarts(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	dir, prefix := "", ""
diff --git a/services/mgmt/binary/binaryd/binaryd_v23_test.go b/services/mgmt/binary/binaryd/binaryd_v23_test.go
index ca3a04f..ae16308 100644
--- a/services/mgmt/binary/binaryd/binaryd_v23_test.go
+++ b/services/mgmt/binary/binaryd/binaryd_v23_test.go
@@ -10,8 +10,8 @@
 	"strings"
 
 	"v.io/v23/naming"
-	"v.io/x/ref/lib/testutil"
 	"v.io/x/ref/lib/testutil/security"
+	"v.io/x/ref/lib/testutil/testutil"
 	"v.io/x/ref/lib/testutil/v23tests"
 )
 
diff --git a/services/mgmt/binary/impl/http_test.go b/services/mgmt/binary/impl/http_test.go
index 3bfabf9..26009cc 100644
--- a/services/mgmt/binary/impl/http_test.go
+++ b/services/mgmt/binary/impl/http_test.go
@@ -12,13 +12,14 @@
 	"v.io/v23/naming"
 	"v.io/v23/services/mgmt/repository"
 
-	"v.io/x/ref/lib/testutil"
+	test "v.io/x/ref/lib/testutil"
+	"v.io/x/ref/lib/testutil/testutil"
 	"v.io/x/ref/services/mgmt/binary/impl"
 )
 
 // TestHTTP checks that HTTP download works.
 func TestHTTP(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	v23.GetNamespace(ctx).CacheCtl(naming.DisableCache(true))
@@ -32,7 +33,7 @@
 		data := make([][]byte, length)
 		for i := 0; i < length; i++ {
 			// Random size, but at least 1 (avoid empty parts).
-			size := testutil.Rand.Intn(1000*impl.BufferLength) + 1
+			size := testutil.Intn(1000*impl.BufferLength) + 1
 			data[i] = testutil.RandomBytes(size)
 		}
 		mediaInfo := repository.MediaInfo{Type: "application/octet-stream"}
diff --git a/services/mgmt/binary/impl/impl_test.go b/services/mgmt/binary/impl/impl_test.go
index 01ede0f..c900944 100644
--- a/services/mgmt/binary/impl/impl_test.go
+++ b/services/mgmt/binary/impl/impl_test.go
@@ -17,7 +17,8 @@
 	"v.io/v23/verror"
 	"v.io/x/lib/vlog"
 
-	"v.io/x/ref/lib/testutil"
+	test "v.io/x/ref/lib/testutil"
+	"v.io/x/ref/lib/testutil/testutil"
 	_ "v.io/x/ref/profiles/static"
 	"v.io/x/ref/services/mgmt/binary/impl"
 	mgmttest "v.io/x/ref/services/mgmt/lib/testutil"
@@ -72,7 +73,7 @@
 // all possible valid values of the depth used for the directory
 // hierarchy that stores binary objects in the local file system.
 func TestHierarchy(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	v23.GetNamespace(ctx).CacheCtl(naming.DisableCache(true))
@@ -126,7 +127,7 @@
 // uploads and downloads ranging the number of parts the test binary
 // consists of.
 func TestMultiPart(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	v23.GetNamespace(ctx).CacheCtl(naming.DisableCache(true))
@@ -180,7 +181,7 @@
 // resumption ranging the number of parts the uploaded binary consists
 // of.
 func TestResumption(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	v23.GetNamespace(ctx).CacheCtl(naming.DisableCache(true))
@@ -211,7 +212,7 @@
 				break
 			}
 			for i := 0; i < length; i++ {
-				fail := testutil.Rand.Intn(2)
+				fail := testutil.Intn(2)
 				if parts[i] == impl.MissingPart && fail != 0 {
 					if streamErr, err := invokeUpload(t, ctx, binary, data[i], int32(i)); streamErr != nil || err != nil {
 						t.FailNow()
@@ -227,7 +228,7 @@
 
 // TestErrors checks that the binary interface correctly reports errors.
 func TestErrors(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	v23.GetNamespace(ctx).CacheCtl(naming.DisableCache(true))
@@ -239,7 +240,7 @@
 	for i := 0; i < length; i++ {
 		data[i] = testData()
 		for j := 0; j < len(data[i]); j++ {
-			data[i][j] = byte(testutil.Rand.Int())
+			data[i][j] = byte(testutil.Int())
 		}
 	}
 	if err := binary.Create(ctx, int32(length), repository.MediaInfo{Type: "application/octet-stream"}); err != nil {
@@ -294,7 +295,7 @@
 }
 
 func TestGlob(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	v23.GetNamespace(ctx).CacheCtl(naming.DisableCache(true))
diff --git a/services/mgmt/binary/impl/util_test.go b/services/mgmt/binary/impl/util_test.go
index d15cb67..b50369d 100644
--- a/services/mgmt/binary/impl/util_test.go
+++ b/services/mgmt/binary/impl/util_test.go
@@ -9,7 +9,7 @@
 	"v.io/v23/context"
 	"v.io/v23/services/mgmt/repository"
 
-	"v.io/x/ref/lib/testutil"
+	"v.io/x/ref/lib/testutil/testutil"
 	"v.io/x/ref/services/mgmt/binary/impl"
 )
 
@@ -85,7 +85,7 @@
 
 // testData creates up to 4MB of random bytes.
 func testData() []byte {
-	size := testutil.Rand.Intn(1000 * impl.BufferLength)
+	size := testutil.Intn(1000 * impl.BufferLength)
 	data := testutil.RandomBytes(size)
 	return data
 }
diff --git a/services/mgmt/debug/dispatcher_test.go b/services/mgmt/debug/dispatcher_test.go
index 06f2f24..d351d52 100644
--- a/services/mgmt/debug/dispatcher_test.go
+++ b/services/mgmt/debug/dispatcher_test.go
@@ -24,7 +24,8 @@
 	"v.io/v23/vtrace"
 
 	libstats "v.io/x/ref/lib/stats"
-	"v.io/x/ref/lib/testutil"
+	test "v.io/x/ref/lib/testutil"
+	"v.io/x/ref/lib/testutil/testutil"
 	_ "v.io/x/ref/profiles"
 )
 
@@ -50,7 +51,7 @@
 }
 
 func TestDebugServer(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	tracedContext := func(ctx *context.T) *context.T {
diff --git a/services/mgmt/device/impl/impl_test.go b/services/mgmt/device/impl/impl_test.go
index e897549..8bb0f3f 100644
--- a/services/mgmt/device/impl/impl_test.go
+++ b/services/mgmt/device/impl/impl_test.go
@@ -46,9 +46,10 @@
 	"v.io/x/ref/lib/flags/consts"
 	"v.io/x/ref/lib/modules"
 	"v.io/x/ref/lib/signals"
-	"v.io/x/ref/lib/testutil"
+	test "v.io/x/ref/lib/testutil"
 	"v.io/x/ref/lib/testutil/expect"
 	tsecurity "v.io/x/ref/lib/testutil/security"
+	"v.io/x/ref/lib/testutil/testutil"
 	binaryimpl "v.io/x/ref/services/mgmt/binary/impl"
 	"v.io/x/ref/services/mgmt/device/config"
 	"v.io/x/ref/services/mgmt/device/impl"
@@ -87,7 +88,7 @@
 }
 
 func TestMain(m *testing.M) {
-	testutil.Init()
+	test.Init()
 	isSuidHelper := len(os.Getenv("VEYRON_SUIDHELPER_TEST")) > 0
 	if modules.IsModulesChildProcess() && !isSuidHelper {
 		if err := modules.Dispatch(); err != nil {
@@ -137,7 +138,7 @@
 // publish the server under as an argument.  Additional arguments can optionally
 // specify device manager config settings.
 func deviceManager(stdin io.Reader, stdout, stderr io.Writer, env map[string]string, args ...string) error {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	if len(args) == 0 {
 		vlog.Fatalf("deviceManager expected at least an argument")
 	}
@@ -277,7 +278,7 @@
 }
 
 func app(stdin io.Reader, stdout, stderr io.Writer, env map[string]string, args ...string) error {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	v23.GetNamespace(ctx).CacheCtl(naming.DisableCache(true))
@@ -331,7 +332,7 @@
 
 func initForTest() (*context.T, v23.Shutdown) {
 	os.Unsetenv(consts.NamespaceRootPrefix)
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	v23.GetNamespace(ctx).CacheCtl(naming.DisableCache(true))
 	return ctx, shutdown
 }
@@ -689,7 +690,7 @@
 	instance1ID := startApp(t, ctx, appID)
 
 	instanceDebug := debug(t, ctx, appID, instance1ID)
-	if !strings.Contains(instanceDebug, fmt.Sprintf("Blessing Store: Default blessings: %s/forapp/google naps", testutil.TestBlessing)) {
+	if !strings.Contains(instanceDebug, fmt.Sprintf("Blessing Store: Default blessings: %s/forapp/google naps", test.TestBlessing)) {
 		t.Fatalf("debug response doesn't contain expected info: %v", instanceDebug)
 	}
 
@@ -1665,7 +1666,7 @@
 	pkgVON := naming.Join(binaryVON, "testpkg")
 	defer startRealBinaryRepository(t, ctx, binaryVON)()
 
-	up := testutil.RandomBytes(testutil.Rand.Intn(5 << 20))
+	up := testutil.RandomBytes(testutil.Intn(5 << 20))
 	mediaInfo := repository.MediaInfo{Type: "application/octet-stream"}
 	sig, err := libbinary.Upload(ctx, naming.Join(binaryVON, "testbinary"), up, mediaInfo)
 	if err != nil {
@@ -1678,7 +1679,7 @@
 		t.Fatalf("ioutil.TempDir failed: %v", err)
 	}
 	defer os.RemoveAll(tmpdir)
-	pkgContents := testutil.RandomBytes(testutil.Rand.Intn(5 << 20))
+	pkgContents := testutil.RandomBytes(testutil.Intn(5 << 20))
 	if err := ioutil.WriteFile(filepath.Join(tmpdir, "pkg.txt"), pkgContents, 0600); err != nil {
 		t.Fatalf("ioutil.WriteFile failed: %v", err)
 	}
diff --git a/services/mgmt/device/impl/proxy_invoker_test.go b/services/mgmt/device/impl/proxy_invoker_test.go
index a6bba55..dda6b38 100644
--- a/services/mgmt/device/impl/proxy_invoker_test.go
+++ b/services/mgmt/device/impl/proxy_invoker_test.go
@@ -10,15 +10,17 @@
 	"v.io/v23/security"
 	"v.io/v23/services/mgmt/stats"
 	"v.io/v23/services/security/access"
+
 	"v.io/x/lib/vlog"
 
-	"v.io/x/ref/lib/testutil"
+	test "v.io/x/ref/lib/testutil"
+	"v.io/x/ref/lib/testutil/testutil"
 )
 
 // TODO(toddw): Add tests of Signature and MethodSignature.
 
 func TestProxyInvoker(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	v23.GetNamespace(ctx).CacheCtl(naming.DisableCache(true))
diff --git a/services/mgmt/device/impl/util_test.go b/services/mgmt/device/impl/util_test.go
index 9d4b7eb..d29c2fb 100644
--- a/services/mgmt/device/impl/util_test.go
+++ b/services/mgmt/device/impl/util_test.go
@@ -24,7 +24,8 @@
 	tsecurity "v.io/x/ref/lib/testutil/security"
 
 	"v.io/x/ref/lib/modules"
-	"v.io/x/ref/lib/testutil"
+	test "v.io/x/ref/lib/testutil"
+	"v.io/x/ref/lib/testutil/testutil"
 	_ "v.io/x/ref/profiles/roaming"
 	"v.io/x/ref/services/mgmt/device/impl"
 	mgmttest "v.io/x/ref/services/mgmt/lib/testutil"
@@ -395,7 +396,7 @@
 // TODO(rjkroege): This helper is generally useful. Use it to reduce
 // boiler plate across all device manager tests.
 func startupHelper(t *testing.T) (func(), *context.T, *modules.Shell, *application.Envelope, string, string, *tsecurity.IDProvider) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	v23.GetNamespace(ctx).CacheCtl(naming.DisableCache(true))
 
 	// Make a new identity context.
diff --git a/services/mgmt/lib/binary/impl_test.go b/services/mgmt/lib/binary/impl_test.go
index 2915ff9..ee15f1f 100644
--- a/services/mgmt/lib/binary/impl_test.go
+++ b/services/mgmt/lib/binary/impl_test.go
@@ -15,7 +15,8 @@
 	"v.io/v23/services/mgmt/repository"
 	"v.io/x/lib/vlog"
 
-	"v.io/x/ref/lib/testutil"
+	test "v.io/x/ref/lib/testutil"
+	"v.io/x/ref/lib/testutil/testutil"
 	_ "v.io/x/ref/profiles"
 	"v.io/x/ref/services/mgmt/binary/impl"
 )
@@ -80,14 +81,14 @@
 // TestBufferAPI tests the binary repository client-side library
 // interface using buffers.
 func TestBufferAPI(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	v23.GetNamespace(ctx).CacheCtl(naming.DisableCache(true))
 
 	von, cleanup := setupRepository(t, ctx)
 	defer cleanup()
-	data := testutil.RandomBytes(testutil.Rand.Intn(10 << 20))
+	data := testutil.RandomBytes(testutil.Intn(10 << 20))
 	mediaInfo := repository.MediaInfo{Type: "application/octet-stream"}
 	sig, err := Upload(ctx, von, data, mediaInfo)
 	if err != nil {
@@ -124,7 +125,7 @@
 // TestFileAPI tests the binary repository client-side library
 // interface using files.
 func TestFileAPI(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	v23.GetNamespace(ctx).CacheCtl(naming.DisableCache(true))
@@ -132,7 +133,7 @@
 	von, cleanup := setupRepository(t, ctx)
 	defer cleanup()
 	// Create up to 10MB of random bytes.
-	data := testutil.RandomBytes(testutil.Rand.Intn(10 << 20))
+	data := testutil.RandomBytes(testutil.Intn(10 << 20))
 	dir, prefix := "", ""
 	src, err := ioutil.TempFile(dir, prefix)
 	if err != nil {
@@ -181,7 +182,7 @@
 // TestDownloadURL tests the binary repository client-side library
 // DownloadURL method.
 func TestDownloadURL(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	v23.GetNamespace(ctx).CacheCtl(naming.DisableCache(true))
diff --git a/services/mgmt/lib/testutil/modules.go b/services/mgmt/lib/testutil/modules.go
index d1ba8af..7bdac3a 100644
--- a/services/mgmt/lib/testutil/modules.go
+++ b/services/mgmt/lib/testutil/modules.go
@@ -16,7 +16,7 @@
 	"v.io/x/ref/lib/flags/consts"
 	"v.io/x/ref/lib/modules"
 	"v.io/x/ref/lib/modules/core"
-	"v.io/x/ref/lib/testutil"
+	"v.io/x/ref/lib/testutil/testutil"
 )
 
 const (
diff --git a/services/mgmt/stats/impl/stats_test.go b/services/mgmt/stats/impl/stats_test.go
index 132f148..ca0b6f5 100644
--- a/services/mgmt/stats/impl/stats_test.go
+++ b/services/mgmt/stats/impl/stats_test.go
@@ -16,7 +16,8 @@
 
 	libstats "v.io/x/ref/lib/stats"
 	"v.io/x/ref/lib/stats/histogram"
-	"v.io/x/ref/lib/testutil"
+	test "v.io/x/ref/lib/testutil"
+	"v.io/x/ref/lib/testutil/testutil"
 	_ "v.io/x/ref/profiles"
 	istats "v.io/x/ref/services/mgmt/stats"
 	"v.io/x/ref/services/mgmt/stats/impl"
@@ -49,7 +50,7 @@
 }
 
 func TestStatsImpl(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	endpoint, stop := startServer(t, ctx)
diff --git a/services/wsprd/app/app_test.go b/services/wsprd/app/app_test.go
index cd70a0a..b32436c 100644
--- a/services/wsprd/app/app_test.go
+++ b/services/wsprd/app/app_test.go
@@ -20,8 +20,10 @@
 	"v.io/v23/verror"
 	"v.io/v23/vom"
 	"v.io/v23/vtrace"
-	"v.io/x/ref/lib/testutil"
+
+	test "v.io/x/ref/lib/testutil"
 	tsecurity "v.io/x/ref/lib/testutil/security"
+	"v.io/x/ref/lib/testutil/testutil"
 	"v.io/x/ref/profiles"
 	vsecurity "v.io/x/ref/security"
 	mounttable "v.io/x/ref/services/mounttable/lib"
@@ -145,7 +147,7 @@
 }
 
 func TestGetGoServerSignature(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	s, endpoint, err := startAdderServer(ctx)
@@ -187,8 +189,8 @@
 	expectedError   error
 }
 
-func runGoServerTestCase(t *testing.T, test goServerTestCase) {
-	ctx, shutdown := testutil.InitForTest()
+func runGoServerTestCase(t *testing.T, testCase goServerTestCase) {
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	s, endpoint, err := startAdderServer(ctx)
@@ -210,13 +212,13 @@
 	}
 	writer := testwriter.Writer{}
 	var stream *outstandingStream
-	if len(test.streamingInputs) > 0 {
+	if len(testCase.streamingInputs) > 0 {
 		stream = newStream()
 		controller.outstandingRequests[0] = &outstandingRequest{
 			stream: stream,
 		}
 		go func() {
-			for _, value := range test.streamingInputs {
+			for _, value := range testCase.streamingInputs {
 				controller.SendOnStream(0, lib.VomEncodeOrDie(value), &writer)
 			}
 			controller.CloseStream(0)
@@ -225,14 +227,14 @@
 
 	request := VeyronRPCRequest{
 		Name:        "/" + endpoint.String(),
-		Method:      test.method,
-		NumInArgs:   int32(len(test.inArgs)),
-		NumOutArgs:  test.numOutArgs,
+		Method:      testCase.method,
+		NumInArgs:   int32(len(testCase.inArgs)),
+		NumOutArgs:  testCase.numOutArgs,
 		IsStreaming: stream != nil,
 	}
-	controller.sendVeyronRequest(ctx, 0, &request, test.inArgs, &writer, stream, vtrace.GetSpan(ctx))
+	controller.sendVeyronRequest(ctx, 0, &request, testCase.inArgs, &writer, stream, vtrace.GetSpan(ctx))
 
-	if err := testwriter.CheckResponses(&writer, test.expectedStream, test.expectedError); err != nil {
+	if err := testwriter.CheckResponses(&writer, testCase.expectedStream, testCase.expectedError); err != nil {
 		t.Error(err)
 	}
 }
@@ -391,24 +393,24 @@
 	hasAuthorizer bool
 }
 
-func runJsServerTestCase(t *testing.T, test jsServerTestCase) {
-	ctx, shutdown := testutil.InitForTest()
+func runJsServerTestCase(t *testing.T, testCase jsServerTestCase) {
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	vomClientStream := []string{}
-	for _, m := range test.clientStream {
+	for _, m := range testCase.clientStream {
 		vomClientStream = append(vomClientStream, lib.VomEncodeOrDie(m))
 	}
 	mock := &mockJSServer{
 		t:                    t,
-		method:               test.method,
+		method:               testCase.method,
 		serviceSignature:     []signature.Interface{simpleAddrSig},
 		expectedClientStream: vomClientStream,
-		serverStream:         test.serverStream,
-		hasAuthorizer:        test.hasAuthorizer,
-		inArgs:               test.inArgs,
-		finalResponse:        test.finalResponse,
-		finalError:           test.err,
+		serverStream:         testCase.serverStream,
+		hasAuthorizer:        testCase.hasAuthorizer,
+		inArgs:               testCase.inArgs,
+		finalResponse:        testCase.finalResponse,
+		finalError:           testCase.err,
 		controllerReady:      sync.RWMutex{},
 	}
 	rt, err := serveServer(ctx, mock, func(controller *Controller) {
@@ -430,12 +432,12 @@
 		t.Fatalf("unable to create client: %v", err)
 	}
 
-	call, err := client.StartCall(rt.controller.Context(), "adder/adder", test.method, test.inArgs)
+	call, err := client.StartCall(rt.controller.Context(), "adder/adder", testCase.method, testCase.inArgs)
 	if err != nil {
 		t.Fatalf("failed to start call: %v", err)
 	}
 
-	for _, msg := range test.clientStream {
+	for _, msg := range testCase.clientStream {
 		if err := call.Send(msg); err != nil {
 			t.Errorf("unexpected error while sending %v: %v", msg, err)
 		}
@@ -444,7 +446,7 @@
 		t.Errorf("unexpected error on close: %v", err)
 	}
 
-	expectedStream := test.serverStream
+	expectedStream := testCase.serverStream
 	for {
 		var data interface{}
 		if err := call.Recv(&data); err != nil {
@@ -463,19 +465,19 @@
 	var result *vdl.Value
 	err = call.Finish(&result)
 
-	// If err is nil and test.err is nil reflect.DeepEqual will return
+	// If err is nil and testCase.err is nil reflect.DeepEqual will return
 	// false because the types are different.  Because of this, we only use
 	// reflect.DeepEqual if one of the values is non-nil.  If both values
 	// are nil, then we consider them equal.
-	if (err != nil || test.err != nil) && !verror.Equal(err, test.err) {
-		t.Errorf("unexpected err: got %#v, expected %#v", err, test.err)
+	if (err != nil || testCase.err != nil) && !verror.Equal(err, testCase.err) {
+		t.Errorf("unexpected err: got %#v, expected %#v", err, testCase.err)
 	}
 
 	if err != nil {
 		return
 	}
 
-	if got, want := result, test.finalResponse; !vdl.EqualValue(got, want) {
+	if got, want := result, testCase.finalResponse; !vdl.EqualValue(got, want) {
 		t.Errorf("unexected final response: got %v, want %v", got, want)
 	}