diff --git a/.github/label-pr-config.yml b/.github/label-pr-config.yml
index 4ff8bee4c56d64..551bee55ababce 100644
--- a/.github/label-pr-config.yml
+++ b/.github/label-pr-config.yml
@@ -214,6 +214,7 @@ allJsSubSystems:
   - url
   - util
   - v8
+  - vfs
   - vm
   - wasi
   - worker
diff --git a/SECURITY.md b/SECURITY.md
index ef2509102fe6a3..55251f7da7993b 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -377,7 +377,7 @@ the community they pose.
 #### Permission Model Boundaries (`--permission`)
 
 The Node.js [Permission Model](https://nodejs.org/api/permissions.html)
-(`--experimental-permission`) is an opt-in mechanism that limits which
+(`--permission`) is an opt-in mechanism that limits which
 resources a Node.js process may access. It is designed to reduce the blast
 radius of mistakes in trusted application code, **not** to act as a security
 boundary against intentional misuse or a compromised process.
diff --git a/lib/internal/modules/esm/loader.js b/lib/internal/modules/esm/loader.js
index b39b29fff7779b..5099bc44f8a207 100644
--- a/lib/internal/modules/esm/loader.js
+++ b/lib/internal/modules/esm/loader.js
@@ -14,7 +14,8 @@ const {
   hardenRegExp,
 } = primordials;
 
-
+const { LoadCache, ResolveCache } = require('internal/modules/esm/module_map');
+const { ModuleJob, ModuleJobSync } = require('internal/modules/esm/module_job');
 // This is needed to avoid cycles in esm/resolve <-> cjs/loader
 const {
   kIsExecuting,
@@ -85,24 +86,6 @@ const { isPromise } = require('internal/util/types');
  * @typedef {import('url').URL} URL
  */
 
-/**
- * Lazy loads the module_map module and returns a new instance of ResolveCache.
- * @returns {import('./module_map.js').ResolveCache}
- */
-function newResolveCache() {
-  const { ResolveCache } = require('internal/modules/esm/module_map');
-  return new ResolveCache();
-}
-
-/**
- * Generate a load cache (to store the final result of a load-chain for a particular module).
- * @returns {import('./module_map.js').LoadCache}
- */
-function newLoadCache() {
-  const { LoadCache } = require('internal/modules/esm/module_map');
-  return new LoadCache();
-}
-
 const { translators } = require('internal/modules/esm/translators');
 const { defaultResolve } = require('internal/modules/esm/resolve');
 const { defaultLoadSync, throwUnknownModuleFormat } = require('internal/modules/esm/load');
@@ -161,12 +144,12 @@ class ModuleLoader {
   /**
    * Registry of resolved specifiers
    */
-  #resolveCache = newResolveCache();
+  #resolveCache = new ResolveCache();
 
   /**
    * Registry of loaded modules, akin to `require.cache`
    */
-  loadCache = newLoadCache();
+  loadCache = new LoadCache();
 
   /**
    * @see {AsyncLoaderHooks.isForAsyncLoaderHookWorker}
@@ -238,7 +221,6 @@ class ModuleLoader {
    * @returns {Promise<object>} The module object.
    */
   async executeModuleJob(url, wrap, isEntryPoint = false) {
-    const { ModuleJob } = require('internal/modules/esm/module_job');
     const module = await onImport.tracePromise(async () => {
       const job = new ModuleJob(this, url, undefined, wrap, kEvaluationPhase, false, false, kImportInImportedESM);
       this.loadCache.set(url, undefined, job);
@@ -357,7 +339,6 @@ class ModuleLoader {
     const wrap = compileSourceTextModule(url, source, kUser);
     const inspectBrk = (isMain && getOptionValue('--inspect-brk'));
 
-    const { ModuleJobSync } = require('internal/modules/esm/module_job');
     job = new ModuleJobSync(this, url, kEmptyObject, wrap, kEvaluationPhase, isMain, inspectBrk,
                             kImportInRequiredESM);
     this.loadCache.set(url, kImplicitTypeAttribute, job);
@@ -587,7 +568,6 @@ class ModuleLoader {
       assert(moduleOrModulePromise instanceof ModuleWrap, `Expected ModuleWrap for loading ${url}`);
     }
 
-    const { ModuleJob, ModuleJobSync } = require('internal/modules/esm/module_job');
     // TODO(joyeecheung): use ModuleJobSync for kRequireInImportedCJS too.
     const ModuleJobCtor = (requestType === kImportInRequiredESM ? ModuleJobSync : ModuleJob);
     const isMain = (parentURL === undefined);
diff --git a/test/parallel/test-bootstrap-modules.js b/test/parallel/test-bootstrap-modules.js
index 92bf3be1f612ff..69f1d9f44c9c6c 100644
--- a/test/parallel/test-bootstrap-modules.js
+++ b/test/parallel/test-bootstrap-modules.js
@@ -133,6 +133,8 @@ if (isMainThread) {
     'NativeModule internal/modules/esm/load',
     'NativeModule internal/modules/esm/resolve',
     'NativeModule internal/modules/esm/translators',
+    'NativeModule internal/modules/esm/module_job',
+    'NativeModule internal/modules/esm/module_map',
     'NativeModule url',
   ].forEach(expected.beforePreExec.add.bind(expected.beforePreExec));
 } else {  // Worker.