diff --git a/python/ql/examples/snippets/builtin_object.ql b/python/ql/examples/snippets/builtin_object.ql
index 7f552a5aa796..36b2d92e0b97 100644
--- a/python/ql/examples/snippets/builtin_object.ql
+++ b/python/ql/examples/snippets/builtin_object.ql
@@ -8,7 +8,8 @@
  */
 
 import python
+private import LegacyPointsTo
 
-from Expr e, string name
+from ExprWithPointsTo e, string name
 where e.pointsTo(Value::named(name)) and not name.charAt(_) = "."
 select e
diff --git a/python/ql/examples/snippets/catch_exception.ql b/python/ql/examples/snippets/catch_exception.ql
index 9d67d0056b62..b4a77f267d09 100644
--- a/python/ql/examples/snippets/catch_exception.ql
+++ b/python/ql/examples/snippets/catch_exception.ql
@@ -8,9 +8,10 @@
  */
 
 import python
+private import LegacyPointsTo
 
 from ExceptStmt ex, ClassValue cls
 where
   cls.getName() = "MyExceptionClass" and
-  ex.getType().pointsTo(cls)
+  ex.getType().(ExprWithPointsTo).pointsTo(cls)
 select ex
diff --git a/python/ql/examples/snippets/conditional_expression.ql b/python/ql/examples/snippets/conditional_expression.ql
index 8af55ca104ff..876c34678692 100644
--- a/python/ql/examples/snippets/conditional_expression.ql
+++ b/python/ql/examples/snippets/conditional_expression.ql
@@ -9,10 +9,11 @@
  */
 
 import python
+private import LegacyPointsTo
 
 from IfExp e, ClassObject cls1, ClassObject cls2
 where
-  e.getBody().refersTo(_, cls1, _) and
-  e.getOrelse().refersTo(_, cls2, _) and
+  e.getBody().(ExprWithPointsTo).refersTo(_, cls1, _) and
+  e.getOrelse().(ExprWithPointsTo).refersTo(_, cls2, _) and
   cls1 != cls2
 select e
diff --git a/python/ql/examples/snippets/new_instance.ql b/python/ql/examples/snippets/new_instance.ql
index 75a1ea635d53..b0be6f77197c 100644
--- a/python/ql/examples/snippets/new_instance.ql
+++ b/python/ql/examples/snippets/new_instance.ql
@@ -8,9 +8,10 @@
  */
 
 import python
+private import LegacyPointsTo
 
 from Call new, ClassValue cls
 where
   cls.getName() = "MyClass" and
-  new.getFunc().pointsTo(cls)
+  new.getFunc().(ExprWithPointsTo).pointsTo(cls)
 select new
diff --git a/python/ql/examples/snippets/print.ql b/python/ql/examples/snippets/print.ql
index f0ba47eafeb3..ba4d730118d6 100644
--- a/python/ql/examples/snippets/print.ql
+++ b/python/ql/examples/snippets/print.ql
@@ -6,6 +6,7 @@
  */
 
 import python
+private import LegacyPointsTo
 
 from AstNode print
 where
@@ -13,5 +14,5 @@ where
   print instanceof Print
   or
   /* Python 3 or with `from __future__ import print_function` */
-  print.(Call).getFunc().pointsTo(Value::named("print"))
+  print.(Call).getFunc().(ExprWithPointsTo).pointsTo(Value::named("print"))
 select print
diff --git a/python/ql/examples/snippets/raise_exception.ql b/python/ql/examples/snippets/raise_exception.ql
index 12e4f93a349c..23cf26a8c60a 100644
--- a/python/ql/examples/snippets/raise_exception.ql
+++ b/python/ql/examples/snippets/raise_exception.ql
@@ -8,9 +8,10 @@
  */
 
 import python
+private import LegacyPointsTo
 
 from Raise raise, ClassValue ex
 where
   ex.getName() = "AnException" and
-  raise.getException().pointsTo(ex.getASuperType())
+  raise.getException().(ExprWithPointsTo).pointsTo(ex.getASuperType())
 select raise, "Don't raise instances of 'AnException'"
diff --git a/python/ql/examples/snippets/store_none.ql b/python/ql/examples/snippets/store_none.ql
index 57be82f229dc..b35c5fc84b4e 100644
--- a/python/ql/examples/snippets/store_none.ql
+++ b/python/ql/examples/snippets/store_none.ql
@@ -10,9 +10,10 @@
  */
 
 import python
+private import LegacyPointsTo
 
 from SubscriptNode store
 where
   store.isStore() and
-  store.getIndex().pointsTo(Value::named("None"))
+  store.getIndex().(ControlFlowNodeWithPointsTo).pointsTo(Value::named("None"))
 select store
diff --git a/python/ql/lib/LegacyPointsTo.qll b/python/ql/lib/LegacyPointsTo.qll
new file mode 100644
index 000000000000..3e6758546018
--- /dev/null
+++ b/python/ql/lib/LegacyPointsTo.qll
@@ -0,0 +1,210 @@
+/**
+ * DEPRECATED: Using the methods in this module may lead to a degradation of performance. Use at
+ * your own peril.
+ *
+ * This module contains legacy points-to predicates and methods for various classes in the
+ * points-to analysis.
+ *
+ * Existing code that depends on, say, points-to predicates on `ControlFlowNode` should be modified
+ * to use `ControlFlowNodeWithPointsTo` instead. In particular, if inside a method call chain such
+ * as
+ *
+ * `someCallNode.getFunction().pointsTo(...)`
+ *
+ *  an explicit cast should be added as follows
+ *
+ * `someCallNode.getFunction().(ControlFlowNodeWithPointsTo).pointsTo(...)`
+ *
+ * Similarly, if a bound variable has type `ControlFlowNode`, and a points-to method is called on
+ * it, the type should be changed to `ControlFlowNodeWithPointsTo`.
+ */
+
+private import python
+private import semmle.python.pointsto.PointsTo
+private import semmle.python.objects.Modules
+
+/**
+ * An extension of `ControlFlowNode` that provides points-to predicates.
+ */
+class ControlFlowNodeWithPointsTo extends ControlFlowNode {
+  /** Gets the value that this ControlFlowNode points-to. */
+  predicate pointsTo(Value value) { this.pointsTo(_, value, _) }
+
+  /** Gets the value that this ControlFlowNode points-to. */
+  Value pointsTo() { this.pointsTo(_, result, _) }
+
+  /** Gets a value that this ControlFlowNode may points-to. */
+  Value inferredValue() { this.pointsTo(_, result, _) }
+
+  /** Gets the value and origin that this ControlFlowNode points-to. */
+  predicate pointsTo(Value value, ControlFlowNode origin) { this.pointsTo(_, value, origin) }
+
+  /** Gets the value and origin that this ControlFlowNode points-to, given the context. */
+  predicate pointsTo(Context context, Value value, ControlFlowNode origin) {
+    PointsTo::pointsTo(this, context, value, origin)
+  }
+
+  /**
+   * Gets what this flow node might "refer-to". Performs a combination of localized (intra-procedural) points-to
+   * analysis and global module-level analysis. This points-to analysis favours precision over recall. It is highly
+   * precise, but may not provide information for a significant number of flow-nodes.
+   * If the class is unimportant then use `refersTo(value)` or `refersTo(value, origin)` instead.
+   */
+  pragma[nomagic]
+  predicate refersTo(Object obj, ClassObject cls, ControlFlowNode origin) {
+    this.refersTo(_, obj, cls, origin)
+  }
+
+  /** Gets what this expression might "refer-to" in the given `context`. */
+  pragma[nomagic]
+  predicate refersTo(Context context, Object obj, ClassObject cls, ControlFlowNode origin) {
+    not obj = unknownValue() and
+    not cls = theUnknownType() and
+    PointsTo::points_to(this, context, obj, cls, origin)
+  }
+
+  /**
+   * Whether this flow node might "refer-to" to `value` which is from `origin`
+   * Unlike `this.refersTo(value, _, origin)` this predicate includes results
+   * where the class cannot be inferred.
+   */
+  pragma[nomagic]
+  predicate refersTo(Object obj, ControlFlowNode origin) {
+    not obj = unknownValue() and
+    PointsTo::points_to(this, _, obj, _, origin)
+  }
+
+  /** Equivalent to `this.refersTo(value, _)` */
+  predicate refersTo(Object obj) { this.refersTo(obj, _) }
+
+  /**
+   * Check whether this control-flow node has complete points-to information.
+   * This would mean that the analysis managed to infer an over approximation
+   * of possible values at runtime.
+   */
+  predicate hasCompletePointsToSet() {
+    // If the tracking failed, then `this` will be its own "origin". In that
+    // case, we want to exclude nodes for which there is also a different
+    // origin, as that would indicate that some paths failed and some did not.
+    this.refersTo(_, _, this) and
+    not exists(ControlFlowNode other | other != this and this.refersTo(_, _, other))
+    or
+    // If `this` is a use of a variable, then we must have complete points-to
+    // for that variable.
+    exists(SsaVariable v | v.getAUse() = this | varHasCompletePointsToSet(v))
+  }
+}
+
+/**
+ * Check whether a SSA variable has complete points-to information.
+ * This would mean that the analysis managed to infer an overapproximation
+ * of possible values at runtime.
+ */
+private predicate varHasCompletePointsToSet(SsaVariable var) {
+  // Global variables may be modified non-locally or concurrently.
+  not var.getVariable() instanceof GlobalVariable and
+  (
+    // If we have complete points-to information on the definition of
+    // this variable, then the variable has complete information.
+    var.getDefinition()
+        .(DefinitionNode)
+        .getValue()
+        .(ControlFlowNodeWithPointsTo)
+        .hasCompletePointsToSet()
+    or
+    // If this variable is a phi output, then we have complete
+    // points-to information about it if all phi inputs had complete
+    // information.
+    forex(SsaVariable phiInput | phiInput = var.getAPhiInput() |
+      varHasCompletePointsToSet(phiInput)
+    )
+  )
+}
+
+/**
+ * An extension of `Expr` that provides points-to predicates.
+ */
+class ExprWithPointsTo extends Expr {
+  /**
+   * NOTE: `refersTo` will be deprecated in 2019. Use `pointsTo` instead.
+   * Gets what this expression might "refer-to". Performs a combination of localized (intra-procedural) points-to
+   *  analysis and global module-level analysis. This points-to analysis favours precision over recall. It is highly
+   *  precise, but may not provide information for a significant number of flow-nodes.
+   *  If the class is unimportant then use `refersTo(value)` or `refersTo(value, origin)` instead.
+   * NOTE: For complex dataflow, involving multiple stages of points-to analysis, it may be more precise to use
+   * `ControlFlowNode.refersTo(...)` instead.
+   */
+  predicate refersTo(Object obj, ClassObject cls, AstNode origin) {
+    this.refersTo(_, obj, cls, origin)
+  }
+
+  /**
+   * NOTE: `refersTo` will be deprecated in 2019. Use `pointsTo` instead.
+   * Gets what this expression might "refer-to" in the given `context`.
+   */
+  predicate refersTo(Context context, Object obj, ClassObject cls, AstNode origin) {
+    this.getAFlowNode()
+        .(ControlFlowNodeWithPointsTo)
+        .refersTo(context, obj, cls, origin.getAFlowNode())
+  }
+
+  /**
+   * NOTE: `refersTo` will be deprecated in 2019. Use `pointsTo` instead.
+   * Holds if this expression might "refer-to" to `value` which is from `origin`
+   * Unlike `this.refersTo(value, _, origin)`, this predicate includes results
+   * where the class cannot be inferred.
+   */
+  pragma[nomagic]
+  predicate refersTo(Object obj, AstNode origin) {
+    this.getAFlowNode().(ControlFlowNodeWithPointsTo).refersTo(obj, origin.getAFlowNode())
+  }
+
+  /**
+   * NOTE: `refersTo` will be deprecated in 2019. Use `pointsTo` instead.
+   * Equivalent to `this.refersTo(value, _)`
+   */
+  predicate refersTo(Object obj) { this.refersTo(obj, _) }
+
+  /**
+   * Holds if this expression might "point-to" to `value` which is from `origin`
+   * in the given `context`.
+   */
+  predicate pointsTo(Context context, Value value, AstNode origin) {
+    this.getAFlowNode()
+        .(ControlFlowNodeWithPointsTo)
+        .pointsTo(context, value, origin.getAFlowNode())
+  }
+
+  /**
+   * Holds if this expression might "point-to" to `value` which is from `origin`.
+   */
+  predicate pointsTo(Value value, AstNode origin) {
+    this.getAFlowNode().(ControlFlowNodeWithPointsTo).pointsTo(value, origin.getAFlowNode())
+  }
+
+  /**
+   * Holds if this expression might "point-to" to `value`.
+   */
+  predicate pointsTo(Value value) { this.pointsTo(value, _) }
+
+  /** Gets a value that this expression might "point-to". */
+  Value pointsTo() { this.pointsTo(result) }
+
+  override string getAQlClass() { none() }
+}
+
+/**
+ * An extension of `Module` that provides points-to related methods.
+ */
+class ModuleWithPointsTo extends Module {
+  /** Gets a name exported by this module, that is the names that will be added to a namespace by 'from this-module import *' */
+  string getAnExport() {
+    py_exports(this, result)
+    or
+    exists(ModuleObjectInternal mod | mod.getSource() = this.getEntryNode() |
+      mod.(ModuleValue).exports(result)
+    )
+  }
+
+  override string getAQlClass() { none() }
+}
diff --git a/python/ql/lib/analysis/DefinitionTracking.qll b/python/ql/lib/analysis/DefinitionTracking.qll
index e015d0f70a97..53f8e791cd8b 100644
--- a/python/ql/lib/analysis/DefinitionTracking.qll
+++ b/python/ql/lib/analysis/DefinitionTracking.qll
@@ -3,6 +3,7 @@
  */
 
 import python
+private import LegacyPointsTo
 import semmle.python.pointsto.PointsTo
 import IDEContextual
 
@@ -36,22 +37,22 @@ private predicate jump_to_defn(ControlFlowNode use, Definition defn) {
   )
   or
   exists(PythonModuleObject mod |
-    use.(ImportExprNode).refersTo(mod) and
+    use.(ImportExprNode).(ControlFlowNodeWithPointsTo).refersTo(mod) and
     defn.getAstNode() = mod.getModule()
   )
   or
   exists(PythonModuleObject mod, string name |
-    use.(ImportMemberNode).getModule(name).refersTo(mod) and
+    use.(ImportMemberNode).getModule(name).(ControlFlowNodeWithPointsTo).refersTo(mod) and
     scope_jump_to_defn_attribute(mod.getModule(), name, defn)
   )
   or
   exists(PackageObject package |
-    use.(ImportExprNode).refersTo(package) and
+    use.(ImportExprNode).(ControlFlowNodeWithPointsTo).refersTo(package) and
     defn.getAstNode() = package.getInitModule().getModule()
   )
   or
   exists(PackageObject package, string name |
-    use.(ImportMemberNode).getModule(name).refersTo(package) and
+    use.(ImportMemberNode).getModule(name).(ControlFlowNodeWithPointsTo).refersTo(package) and
     scope_jump_to_defn_attribute(package.getInitModule().getModule(), name, defn)
   )
   or
@@ -230,7 +231,7 @@ private predicate module_and_name_for_import_star_helper(
   ModuleObject mod, string name, ImportStarNode im_star, ImportStarRefinement def
 ) {
   im_star = def.getDefiningNode() and
-  im_star.getModule().refersTo(mod) and
+  im_star.getModule().(ControlFlowNodeWithPointsTo).refersTo(mod) and
   name = def.getSourceVariable().getName()
 }
 
@@ -239,7 +240,7 @@ pragma[noinline]
 private predicate variable_not_redefined_by_import_star(EssaVariable var, ImportStarRefinement def) {
   var = def.getInput() and
   exists(ModuleObject mod |
-    def.getDefiningNode().(ImportStarNode).getModule().refersTo(mod) and
+    def.getDefiningNode().(ImportStarNode).getModule().(ControlFlowNodeWithPointsTo).refersTo(mod) and
     not mod.exports(var.getSourceVariable().getName())
   )
 }
@@ -352,7 +353,9 @@ private predicate scope_jump_to_defn_attribute(ImportTimeScope s, string name, D
   )
 }
 
-private predicate jump_to_defn_attribute(ControlFlowNode use, string name, Definition defn) {
+private predicate jump_to_defn_attribute(
+  ControlFlowNodeWithPointsTo use, string name, Definition defn
+) {
   /* Local attribute */
   exists(EssaVariable var |
     use = var.getASourceUse() and
@@ -367,7 +370,7 @@ private predicate jump_to_defn_attribute(ControlFlowNode use, string name, Defin
   /* Super attributes */
   exists(AttrNode f, SuperBoundMethod sbm, Object function |
     use = f.getObject(name) and
-    f.refersTo(sbm) and
+    f.(ControlFlowNodeWithPointsTo).refersTo(sbm) and
     function = sbm.getFunction(_) and
     function.getOrigin() = defn.getAstNode()
   )
@@ -408,7 +411,7 @@ private predicate attribute_assignment_jump_to_defn_attribute(
 private predicate sets_attribute(ArgumentRefinement def, string name) {
   exists(CallNode call |
     call = def.getDefiningNode() and
-    call.getFunction().refersTo(Object::builtin("setattr")) and
+    call.getFunction().(ControlFlowNodeWithPointsTo).refersTo(Object::builtin("setattr")) and
     def.getInput().getAUse() = call.getArg(0) and
     call.getArg(1).getNode().(StringLiteral).getText() = name
   )
diff --git a/python/ql/lib/change-notes/2025-10-30-remove-points-to-from-cfg-and-expr.md b/python/ql/lib/change-notes/2025-10-30-remove-points-to-from-cfg-and-expr.md
new file mode 100644
index 000000000000..9b8eef6bcbae
--- /dev/null
+++ b/python/ql/lib/change-notes/2025-10-30-remove-points-to-from-cfg-and-expr.md
@@ -0,0 +1,5 @@
+---
+category: breaking
+---
+
+- The classes `ControlFlowNode`, `Expr`, and `Module` no longer expose predicates that invoke the points-to analysis. To access these predicates, import the module `LegacyPointsTo` and follow the instructions given therein.
diff --git a/python/ql/lib/semmle/python/Exprs.qll b/python/ql/lib/semmle/python/Exprs.qll
index a7f67b0b80ea..e5ee2bdb28c7 100644
--- a/python/ql/lib/semmle/python/Exprs.qll
+++ b/python/ql/lib/semmle/python/Exprs.qll
@@ -1,6 +1,4 @@
-import python
-private import semmle.python.pointsto.PointsTo
-private import semmle.python.objects.ObjectInternal
+private import python
 private import semmle.python.internal.CachedStages
 
 /** An expression */
@@ -52,67 +50,6 @@ class Expr extends Expr_, AstNode {
   Expr getASubExpression() { none() }
 
   override AstNode getAChildNode() { result = this.getASubExpression() }
-
-  /**
-   * NOTE: `refersTo` will be deprecated in 2019. Use `pointsTo` instead.
-   * Gets what this expression might "refer-to". Performs a combination of localized (intra-procedural) points-to
-   *  analysis and global module-level analysis. This points-to analysis favours precision over recall. It is highly
-   *  precise, but may not provide information for a significant number of flow-nodes.
-   *  If the class is unimportant then use `refersTo(value)` or `refersTo(value, origin)` instead.
-   * NOTE: For complex dataflow, involving multiple stages of points-to analysis, it may be more precise to use
-   * `ControlFlowNode.refersTo(...)` instead.
-   */
-  predicate refersTo(Object obj, ClassObject cls, AstNode origin) {
-    this.refersTo(_, obj, cls, origin)
-  }
-
-  /**
-   * NOTE: `refersTo` will be deprecated in 2019. Use `pointsTo` instead.
-   * Gets what this expression might "refer-to" in the given `context`.
-   */
-  predicate refersTo(Context context, Object obj, ClassObject cls, AstNode origin) {
-    this.getAFlowNode().refersTo(context, obj, cls, origin.getAFlowNode())
-  }
-
-  /**
-   * NOTE: `refersTo` will be deprecated in 2019. Use `pointsTo` instead.
-   * Holds if this expression might "refer-to" to `value` which is from `origin`
-   * Unlike `this.refersTo(value, _, origin)`, this predicate includes results
-   * where the class cannot be inferred.
-   */
-  pragma[nomagic]
-  predicate refersTo(Object obj, AstNode origin) {
-    this.getAFlowNode().refersTo(obj, origin.getAFlowNode())
-  }
-
-  /**
-   * NOTE: `refersTo` will be deprecated in 2019. Use `pointsTo` instead.
-   * Equivalent to `this.refersTo(value, _)`
-   */
-  predicate refersTo(Object obj) { this.refersTo(obj, _) }
-
-  /**
-   * Holds if this expression might "point-to" to `value` which is from `origin`
-   * in the given `context`.
-   */
-  predicate pointsTo(Context context, Value value, AstNode origin) {
-    this.getAFlowNode().pointsTo(context, value, origin.getAFlowNode())
-  }
-
-  /**
-   * Holds if this expression might "point-to" to `value` which is from `origin`.
-   */
-  predicate pointsTo(Value value, AstNode origin) {
-    this.getAFlowNode().pointsTo(value, origin.getAFlowNode())
-  }
-
-  /**
-   * Holds if this expression might "point-to" to `value`.
-   */
-  predicate pointsTo(Value value) { this.pointsTo(value, _) }
-
-  /** Gets a value that this expression might "point-to". */
-  Value pointsTo() { this.pointsTo(result) }
 }
 
 /** An assignment expression, such as `x := y` */
@@ -332,8 +269,6 @@ abstract class ImmutableLiteral extends Expr {
   abstract Object getLiteralObject();
 
   abstract boolean booleanValue();
-
-  final Value getLiteralValue() { result.(ConstantObjectInternal).getLiteral() = this }
 }
 
 /** A numerical constant expression, such as `7` or `4.2` */
diff --git a/python/ql/lib/semmle/python/Flow.qll b/python/ql/lib/semmle/python/Flow.qll
index 621013adcd56..496c1abc52a1 100644
--- a/python/ql/lib/semmle/python/Flow.qll
+++ b/python/ql/lib/semmle/python/Flow.qll
@@ -1,5 +1,4 @@
 import python
-private import semmle.python.pointsto.PointsTo
 private import semmle.python.internal.CachedStages
 private import codeql.controlflow.BasicBlock as BB
 
@@ -144,56 +143,6 @@ class ControlFlowNode extends @py_flow_node {
   /** Whether this flow node is the first in its scope */
   predicate isEntryNode() { py_scope_flow(this, _, -1) }
 
-  /** Gets the value that this ControlFlowNode points-to. */
-  predicate pointsTo(Value value) { this.pointsTo(_, value, _) }
-
-  /** Gets the value that this ControlFlowNode points-to. */
-  Value pointsTo() { this.pointsTo(_, result, _) }
-
-  /** Gets a value that this ControlFlowNode may points-to. */
-  Value inferredValue() { this.pointsTo(_, result, _) }
-
-  /** Gets the value and origin that this ControlFlowNode points-to. */
-  predicate pointsTo(Value value, ControlFlowNode origin) { this.pointsTo(_, value, origin) }
-
-  /** Gets the value and origin that this ControlFlowNode points-to, given the context. */
-  predicate pointsTo(Context context, Value value, ControlFlowNode origin) {
-    PointsTo::pointsTo(this, context, value, origin)
-  }
-
-  /**
-   * Gets what this flow node might "refer-to". Performs a combination of localized (intra-procedural) points-to
-   * analysis and global module-level analysis. This points-to analysis favours precision over recall. It is highly
-   * precise, but may not provide information for a significant number of flow-nodes.
-   * If the class is unimportant then use `refersTo(value)` or `refersTo(value, origin)` instead.
-   */
-  pragma[nomagic]
-  predicate refersTo(Object obj, ClassObject cls, ControlFlowNode origin) {
-    this.refersTo(_, obj, cls, origin)
-  }
-
-  /** Gets what this expression might "refer-to" in the given `context`. */
-  pragma[nomagic]
-  predicate refersTo(Context context, Object obj, ClassObject cls, ControlFlowNode origin) {
-    not obj = unknownValue() and
-    not cls = theUnknownType() and
-    PointsTo::points_to(this, context, obj, cls, origin)
-  }
-
-  /**
-   * Whether this flow node might "refer-to" to `value` which is from `origin`
-   * Unlike `this.refersTo(value, _, origin)` this predicate includes results
-   * where the class cannot be inferred.
-   */
-  pragma[nomagic]
-  predicate refersTo(Object obj, ControlFlowNode origin) {
-    not obj = unknownValue() and
-    PointsTo::points_to(this, _, obj, _, origin)
-  }
-
-  /** Equivalent to `this.refersTo(value, _)` */
-  predicate refersTo(Object obj) { this.refersTo(obj, _) }
-
   /** Gets the basic block containing this flow node */
   BasicBlock getBasicBlock() { result.contains(this) }
 
@@ -259,23 +208,6 @@ class ControlFlowNode extends @py_flow_node {
     )
   }
 
-  /**
-   * Check whether this control-flow node has complete points-to information.
-   * This would mean that the analysis managed to infer an over approximation
-   * of possible values at runtime.
-   */
-  predicate hasCompletePointsToSet() {
-    // If the tracking failed, then `this` will be its own "origin". In that
-    // case, we want to exclude nodes for which there is also a different
-    // origin, as that would indicate that some paths failed and some did not.
-    this.refersTo(_, _, this) and
-    not exists(ControlFlowNode other | other != this and this.refersTo(_, _, other))
-    or
-    // If `this` is a use of a variable, then we must have complete points-to
-    // for that variable.
-    exists(SsaVariable v | v.getAUse() = this | varHasCompletePointsToSet(v))
-  }
-
   /** Whether this strictly dominates other. */
   pragma[inline]
   predicate strictlyDominates(ControlFlowNode other) {
@@ -332,28 +264,6 @@ private class AnyNode extends ControlFlowNode {
   override AstNode getNode() { result = super.getNode() }
 }
 
-/**
- * Check whether a SSA variable has complete points-to information.
- * This would mean that the analysis managed to infer an overapproximation
- * of possible values at runtime.
- */
-private predicate varHasCompletePointsToSet(SsaVariable var) {
-  // Global variables may be modified non-locally or concurrently.
-  not var.getVariable() instanceof GlobalVariable and
-  (
-    // If we have complete points-to information on the definition of
-    // this variable, then the variable has complete information.
-    var.getDefinition().(DefinitionNode).getValue().hasCompletePointsToSet()
-    or
-    // If this variable is a phi output, then we have complete
-    // points-to information about it if all phi inputs had complete
-    // information.
-    forex(SsaVariable phiInput | phiInput = var.getAPhiInput() |
-      varHasCompletePointsToSet(phiInput)
-    )
-  )
-}
-
 /** A control flow node corresponding to a call expression, such as `func(...)` */
 class CallNode extends ControlFlowNode {
   CallNode() { toAst(this) instanceof Call }
diff --git a/python/ql/lib/semmle/python/Metrics.qll b/python/ql/lib/semmle/python/Metrics.qll
index e5130ba000f5..dcc5cf959d93 100644
--- a/python/ql/lib/semmle/python/Metrics.qll
+++ b/python/ql/lib/semmle/python/Metrics.qll
@@ -1,4 +1,5 @@
 import python
+private import LegacyPointsTo
 
 /** The metrics for a function */
 class FunctionMetrics extends Function {
@@ -59,7 +60,7 @@ class FunctionMetrics extends Function {
     not non_coupling_method(result) and
     exists(Call call | call.getScope() = this |
       exists(FunctionObject callee | callee.getFunction() = result |
-        call.getAFlowNode().getFunction().refersTo(callee)
+        call.getAFlowNode().getFunction().(ControlFlowNodeWithPointsTo).refersTo(callee)
       )
       or
       exists(Attribute a | call.getFunc() = a |
@@ -123,7 +124,7 @@ class ClassMetrics extends Class {
       )
       or
       exists(Function f, Call c, ClassObject cls | c.getScope() = f and f.getScope() = this |
-        c.getFunc().refersTo(cls) and
+        c.getFunc().(ExprWithPointsTo).refersTo(cls) and
         cls.getPyClass() = other
       )
     )
@@ -292,7 +293,7 @@ class ModuleMetrics extends Module {
       )
       or
       exists(Function f, Call c, ClassObject cls | c.getScope() = f and f.getScope() = this |
-        c.getFunc().refersTo(cls) and
+        c.getFunc().(ExprWithPointsTo).refersTo(cls) and
         cls.getPyClass().getEnclosingModule() = other
       )
     )
diff --git a/python/ql/lib/semmle/python/Module.qll b/python/ql/lib/semmle/python/Module.qll
index 307433fe95bc..666217874b79 100644
--- a/python/ql/lib/semmle/python/Module.qll
+++ b/python/ql/lib/semmle/python/Module.qll
@@ -1,5 +1,4 @@
 import python
-private import semmle.python.objects.Modules
 private import semmle.python.internal.CachedStages
 
 /**
@@ -66,15 +65,6 @@ class Module extends Module_, Scope, AstNode {
   /** Whether this module is a package initializer */
   predicate isPackageInit() { this.getName().matches("%\\_\\_init\\_\\_") and not this.isPackage() }
 
-  /** Gets a name exported by this module, that is the names that will be added to a namespace by 'from this-module import *' */
-  string getAnExport() {
-    py_exports(this, result)
-    or
-    exists(ModuleObjectInternal mod | mod.getSource() = this.getEntryNode() |
-      mod.(ModuleValue).exports(result)
-    )
-  }
-
   /** Gets the source file for this module */
   File getFile() { py_module_path(this, result) }
 
diff --git a/python/ql/lib/semmle/python/SpecialMethods.qll b/python/ql/lib/semmle/python/SpecialMethods.qll
index a5832ae45ae1..ea9e753d0f89 100644
--- a/python/ql/lib/semmle/python/SpecialMethods.qll
+++ b/python/ql/lib/semmle/python/SpecialMethods.qll
@@ -9,6 +9,7 @@
  */
 
 private import python
+private import LegacyPointsTo
 
 /** A control flow node which might correspond to a special method call. */
 class PotentialSpecialMethodCallNode extends ControlFlowNode instanceof SpecialMethod::Potential { }
@@ -106,7 +107,11 @@ class SpecialMethodCallNode extends PotentialSpecialMethodCallNode {
   SpecialMethodCallNode() {
     exists(SpecialMethod::Potential pot |
       this = pot and
-      pot.getSelf().pointsTo().getClass().lookup(pot.getSpecialMethodName()) = resolvedSpecialMethod
+      pot.getSelf()
+          .(ControlFlowNodeWithPointsTo)
+          .pointsTo()
+          .getClass()
+          .lookup(pot.getSpecialMethodName()) = resolvedSpecialMethod
     )
   }
 
diff --git a/python/ql/lib/semmle/python/dataflow/old/Implementation.qll b/python/ql/lib/semmle/python/dataflow/old/Implementation.qll
index 19197f4bd306..83476db803c6 100644
--- a/python/ql/lib/semmle/python/dataflow/old/Implementation.qll
+++ b/python/ql/lib/semmle/python/dataflow/old/Implementation.qll
@@ -1,4 +1,5 @@
 import python
+private import LegacyPointsTo
 import semmle.python.dataflow.TaintTracking
 private import semmle.python.objects.ObjectInternal
 private import semmle.python.pointsto.Filters as Filters
@@ -374,7 +375,7 @@ class TaintTrackingImplementation extends string instanceof TaintTracking::Confi
     exists(ModuleValue m, string name |
       src = TTaintTrackingNode_(_, context, path, kind, this) and
       this.moduleAttributeTainted(m, name, src) and
-      node.asCfgNode().(ImportMemberNode).getModule(name).pointsTo(m)
+      node.asCfgNode().(ImportMemberNode).getModule(name).(ControlFlowNodeWithPointsTo).pointsTo(m)
     )
   }
 
@@ -408,7 +409,9 @@ class TaintTrackingImplementation extends string instanceof TaintTracking::Confi
       src = TTaintTrackingNode_(srcnode, context, srcpath, srckind, this) and
       exists(CallNode call, ControlFlowNode arg |
         call = node.asCfgNode() and
-        call.getFunction().pointsTo(ObjectInternal::builtin("getattr")) and
+        call.getFunction()
+            .(ControlFlowNodeWithPointsTo)
+            .pointsTo(ObjectInternal::builtin("getattr")) and
         arg = call.getArg(0) and
         attrname = call.getArg(1).getNode().(StringLiteral).getText() and
         arg = srcnode.asCfgNode()
@@ -515,7 +518,7 @@ class TaintTrackingImplementation extends string instanceof TaintTracking::Confi
     TaintTrackingContext caller, TaintTrackingContext callee
   ) {
     exists(ClassValue cls |
-      call.getFunction().pointsTo(cls) and
+      call.getFunction().(ControlFlowNodeWithPointsTo).pointsTo(cls) and
       cls.lookup("__init__") = init
     |
       exists(int arg, TaintKind callerKind, AttributePath callerPath, DataFlow::Node argument |
@@ -878,7 +881,7 @@ private class EssaTaintTracking extends string instanceof TaintTracking::Configu
         const.getNode() instanceof ImmutableLiteral
       )
       or
-      exists(ControlFlowNode c, ClassValue cls |
+      exists(ControlFlowNodeWithPointsTo c, ClassValue cls |
         Filters::isinstance(test, c, use) and
         c.pointsTo(cls)
       |
@@ -978,7 +981,7 @@ module Implementation {
       tonode.getArg(0) = fromnode
     )
     or
-    tonode.getFunction().pointsTo(ObjectInternal::builtin("reversed")) and
+    tonode.getFunction().(ControlFlowNodeWithPointsTo).pointsTo(ObjectInternal::builtin("reversed")) and
     tonode.getArg(0) = fromnode
   }
 }
diff --git a/python/ql/lib/semmle/python/dataflow/old/TaintTracking.qll b/python/ql/lib/semmle/python/dataflow/old/TaintTracking.qll
index 0ce4bc27790e..15459a310438 100644
--- a/python/ql/lib/semmle/python/dataflow/old/TaintTracking.qll
+++ b/python/ql/lib/semmle/python/dataflow/old/TaintTracking.qll
@@ -87,6 +87,7 @@
  */
 
 import python
+private import LegacyPointsTo
 private import semmle.python.pointsto.Filters as Filters
 private import semmle.python.objects.ObjectInternal
 private import semmle.python.dataflow.Implementation
@@ -267,7 +268,11 @@ module DictKind {
     Implementation::copyCall(fromnode, tonode) and
     edgeLabel = "dict copy"
     or
-    tonode.(CallNode).getFunction().pointsTo(ObjectInternal::builtin("dict")) and
+    tonode
+        .(CallNode)
+        .getFunction()
+        .(ControlFlowNodeWithPointsTo)
+        .pointsTo(ObjectInternal::builtin("dict")) and
     tonode.(CallNode).getArg(0) = fromnode and
     edgeLabel = "dict() call"
   }
@@ -615,7 +620,7 @@ module DataFlow {
     TCfgNode(ControlFlowNode node)
 
   abstract class Node extends TDataFlowNode {
-    abstract ControlFlowNode asCfgNode();
+    abstract ControlFlowNodeWithPointsTo asCfgNode();
 
     abstract EssaVariable asVariable();
 
@@ -632,7 +637,7 @@ module DataFlow {
   }
 
   class CfgNode extends Node, TCfgNode {
-    override ControlFlowNode asCfgNode() { this = TCfgNode(result) }
+    override ControlFlowNodeWithPointsTo asCfgNode() { this = TCfgNode(result) }
 
     override EssaVariable asVariable() { none() }
 
@@ -647,7 +652,7 @@ module DataFlow {
   }
 
   class EssaNode extends Node, TEssaNode {
-    override ControlFlowNode asCfgNode() { none() }
+    override ControlFlowNodeWithPointsTo asCfgNode() { none() }
 
     override EssaVariable asVariable() { this = TEssaNode(result) }
 
@@ -668,7 +673,11 @@ pragma[noinline]
 private predicate dict_construct(ControlFlowNode itemnode, ControlFlowNode dictnode) {
   dictnode.(DictNode).getAValue() = itemnode
   or
-  dictnode.(CallNode).getFunction().pointsTo(ObjectInternal::builtin("dict")) and
+  dictnode
+      .(CallNode)
+      .getFunction()
+      .(ControlFlowNodeWithPointsTo)
+      .pointsTo(ObjectInternal::builtin("dict")) and
   dictnode.(CallNode).getArgByName(_) = itemnode
 }
 
@@ -688,7 +697,7 @@ private predicate sequence_construct(ControlFlowNode itemnode, ControlFlowNode s
 pragma[noinline]
 private predicate sequence_call(ControlFlowNode fromnode, CallNode tonode) {
   tonode.getArg(0) = fromnode and
-  exists(ControlFlowNode cls | cls = tonode.getFunction() |
+  exists(ControlFlowNodeWithPointsTo cls | cls = tonode.getFunction() |
     cls.pointsTo(ObjectInternal::builtin("list"))
     or
     cls.pointsTo(ObjectInternal::builtin("tuple"))
diff --git a/python/ql/lib/semmle/python/dependencies/Dependencies.qll b/python/ql/lib/semmle/python/dependencies/Dependencies.qll
index 6f70c7e4ec06..a224ad1b9601 100644
--- a/python/ql/lib/semmle/python/dependencies/Dependencies.qll
+++ b/python/ql/lib/semmle/python/dependencies/Dependencies.qll
@@ -1,4 +1,5 @@
 import python
+private import LegacyPointsTo
 import semmle.python.dependencies.DependencyKind
 
 private predicate importDependency(Object target, AstNode source) {
@@ -59,7 +60,7 @@ class PythonUse extends DependencyKind {
     interesting(target) and
     this = this and
     source != target.(ControlFlowNode).getNode() and
-    exists(ControlFlowNode use, Object obj |
+    exists(ControlFlowNodeWithPointsTo use, Object obj |
       use.getNode() = source and
       use.refersTo(obj) and
       use.isLoad()
@@ -114,12 +115,14 @@ private predicate attribute_access_dependency(Object target, AstNode source) {
 
 private predicate use_of_attribute(Attribute attr, Scope s, string name) {
   exists(AttrNode cfg | cfg.isLoad() and cfg.getNode() = attr |
-    exists(Object obj | cfg.getObject(name).refersTo(obj) |
+    exists(Object obj | cfg.getObject(name).(ControlFlowNodeWithPointsTo).refersTo(obj) |
       s = obj.(PythonModuleObject).getModule() or
       s = obj.(ClassObject).getPyClass()
     )
     or
-    exists(ClassObject cls | cfg.getObject(name).refersTo(_, cls, _) | s = cls.getPyClass())
+    exists(ClassObject cls | cfg.getObject(name).(ControlFlowNodeWithPointsTo).refersTo(_, cls, _) |
+      s = cls.getPyClass()
+    )
   )
   or
   exists(SelfAttributeRead sar | sar = attr |
diff --git a/python/ql/lib/semmle/python/objects/ObjectAPI.qll b/python/ql/lib/semmle/python/objects/ObjectAPI.qll
index 4a36ec6d847f..45247c5d9d44 100644
--- a/python/ql/lib/semmle/python/objects/ObjectAPI.qll
+++ b/python/ql/lib/semmle/python/objects/ObjectAPI.qll
@@ -4,6 +4,7 @@
  */
 
 import python
+private import LegacyPointsTo
 private import TObject
 private import semmle.python.objects.ObjectInternal
 private import semmle.python.pointsto.PointsTo
@@ -696,7 +697,9 @@ abstract class FunctionValue extends CallableValue {
     exists(ClassValue cls, string name |
       cls.declaredAttribute(name) = this and
       name != "__new__" and
-      exists(Expr expr, AstNode origin | expr.pointsTo(this, origin) | not origin instanceof Lambda)
+      exists(ExprWithPointsTo expr, AstNode origin | expr.pointsTo(this, origin) |
+        not origin instanceof Lambda
+      )
     )
   }
 
@@ -704,12 +707,14 @@ abstract class FunctionValue extends CallableValue {
   abstract ClassValue getARaisedType();
 
   /** Gets a call-site from where this function is called as a function */
-  CallNode getAFunctionCall() { result.getFunction().pointsTo() = this }
+  CallNode getAFunctionCall() {
+    result.getFunction().(ControlFlowNodeWithPointsTo).pointsTo() = this
+  }
 
   /** Gets a call-site from where this function is called as a method */
   CallNode getAMethodCall() {
     exists(BoundMethodObjectInternal bm |
-      result.getFunction().pointsTo() = bm and
+      result.getFunction().(ControlFlowNodeWithPointsTo).pointsTo() = bm and
       bm.getFunction() = this
     )
   }
@@ -753,7 +758,7 @@ class PythonFunctionValue extends FunctionValue {
      * explicit return nodes that we can query and get the class of.
      */
 
-    result = this.getAReturnedNode().pointsTo().getClass()
+    result = this.getAReturnedNode().(ControlFlowNodeWithPointsTo).pointsTo().getClass()
   }
 }
 
diff --git a/python/ql/lib/semmle/python/types/ClassObject.qll b/python/ql/lib/semmle/python/types/ClassObject.qll
index e3ad51ea1626..6954a83463c6 100644
--- a/python/ql/lib/semmle/python/types/ClassObject.qll
+++ b/python/ql/lib/semmle/python/types/ClassObject.qll
@@ -1,4 +1,5 @@
 import python
+private import LegacyPointsTo
 private import semmle.python.objects.Classes
 private import semmle.python.objects.Instances
 private import semmle.python.pointsto.PointsTo
@@ -193,7 +194,9 @@ class ClassObject extends Object {
    * It is guaranteed that getProbableSingletonInstance() returns at most one Object for each ClassObject.
    */
   Object getProbableSingletonInstance() {
-    exists(ControlFlowNode use, Expr origin | use.refersTo(result, this, origin.getAFlowNode()) |
+    exists(ControlFlowNodeWithPointsTo use, Expr origin |
+      use.refersTo(result, this, origin.getAFlowNode())
+    |
       this.hasStaticallyUniqueInstance() and
       /* Ensure that original expression will be executed only one. */
       origin.getScope() instanceof ImportTimeScope and
@@ -351,7 +354,7 @@ class ClassObject extends Object {
    * Gets a call to this class. Note that the call may not create a new instance of
    * this class, as that depends on the `__new__` method of this class.
    */
-  CallNode getACall() { result.getFunction().refersTo(this) }
+  CallNode getACall() { result.getFunction().(ControlFlowNodeWithPointsTo).refersTo(this) }
 
   override predicate notClass() { none() }
 }
diff --git a/python/ql/lib/semmle/python/types/Exceptions.qll b/python/ql/lib/semmle/python/types/Exceptions.qll
index 93bace1cf516..5e982aa01346 100644
--- a/python/ql/lib/semmle/python/types/Exceptions.qll
+++ b/python/ql/lib/semmle/python/types/Exceptions.qll
@@ -12,6 +12,7 @@
  */
 
 import python
+private import LegacyPointsTo
 
 /** The subset of ControlFlowNodes which might raise an exception */
 class RaisingNode extends ControlFlowNode {
@@ -30,7 +31,9 @@ class RaisingNode extends ControlFlowNode {
     )
   }
 
-  private predicate quits() { this.(CallNode).getFunction().refersTo(Object::quitter(_)) }
+  private predicate quits() {
+    this.(CallNode).getFunction().(ControlFlowNodeWithPointsTo).refersTo(Object::quitter(_))
+  }
 
   /**
    * Gets the type of an exception that may be raised
@@ -68,7 +71,7 @@ class RaisingNode extends ControlFlowNode {
   private ClassObject localRaisedType_objectapi() {
     result.isSubclassOf(theBaseExceptionType()) and
     (
-      exists(ControlFlowNode ex |
+      exists(ControlFlowNodeWithPointsTo ex |
         ex = this.getExceptionNode() and
         (ex.refersTo(result) or ex.refersTo(_, result, _))
       )
@@ -95,7 +98,7 @@ class RaisingNode extends ControlFlowNode {
   private ClassValue localRaisedType() {
     result.getASuperType() = ClassValue::baseException() and
     (
-      exists(ControlFlowNode ex |
+      exists(ControlFlowNodeWithPointsTo ex |
         ex = this.getExceptionNode() and
         (ex.pointsTo(result) or ex.pointsTo().getClass() = result)
       )
@@ -153,7 +156,9 @@ class RaisingNode extends ControlFlowNode {
       /* Call to an unknown object */
       this.getNode() instanceof Call and
       not exists(FunctionObject func | this = func.getACall()) and
-      not exists(ClassObject known | this.(CallNode).getFunction().refersTo(known))
+      not exists(ClassObject known |
+        this.(CallNode).getFunction().(ControlFlowNodeWithPointsTo).refersTo(known)
+      )
       or
       this.getNode() instanceof Exec
       or
@@ -371,7 +376,7 @@ class ExceptFlowNode extends ControlFlowNode {
    * Gets the type handled by this exception handler.
    * `ExceptionType` in `except ExceptionType as e:`
    */
-  ControlFlowNode getType() {
+  ControlFlowNodeWithPointsTo getType() {
     exists(ExceptStmt ex |
       this.getBasicBlock().dominates(result.getBasicBlock()) and
       ex = this.getNode() and
@@ -470,7 +475,7 @@ class ExceptGroupFlowNode extends ControlFlowNode {
   }
 }
 
-private ControlFlowNode element_from_tuple_objectapi(Object tuple) {
+private ControlFlowNodeWithPointsTo element_from_tuple_objectapi(Object tuple) {
   exists(Tuple t | t = tuple.getOrigin() and result = t.getAnElt().getAFlowNode())
 }
 
diff --git a/python/ql/lib/semmle/python/types/FunctionObject.qll b/python/ql/lib/semmle/python/types/FunctionObject.qll
index f64c02b9c6bf..72ddb9411fb1 100644
--- a/python/ql/lib/semmle/python/types/FunctionObject.qll
+++ b/python/ql/lib/semmle/python/types/FunctionObject.qll
@@ -1,4 +1,5 @@
 import python
+private import LegacyPointsTo
 import semmle.python.types.Exceptions
 private import semmle.python.pointsto.PointsTo
 private import semmle.python.objects.Callables
@@ -32,27 +33,31 @@ abstract class FunctionObject extends Object {
   abstract string descriptiveString();
 
   /** Gets a call-site from where this function is called as a function */
-  CallNode getAFunctionCall() { result.getFunction().inferredValue() = this.theCallable() }
+  CallNode getAFunctionCall() {
+    result.getFunction().(ControlFlowNodeWithPointsTo).inferredValue() = this.theCallable()
+  }
 
   /** Gets a call-site from where this function is called as a method */
   CallNode getAMethodCall() {
     exists(BoundMethodObjectInternal bm |
-      result.getFunction().inferredValue() = bm and
+      result.getFunction().(ControlFlowNodeWithPointsTo).inferredValue() = bm and
       bm.getFunction() = this.theCallable()
     )
   }
 
   /** Gets a call-site from where this function is called */
-  ControlFlowNode getACall() { result = this.theCallable().getACall() }
+  ControlFlowNodeWithPointsTo getACall() { result = this.theCallable().getACall() }
 
   /** Gets a call-site from where this function is called, given the `context` */
-  ControlFlowNode getACall(Context context) { result = this.theCallable().getACall(context) }
+  ControlFlowNodeWithPointsTo getACall(Context context) {
+    result = this.theCallable().getACall(context)
+  }
 
   /**
    * Gets the `ControlFlowNode` that will be passed as the nth argument to `this` when called at `call`.
    * This predicate will correctly handle `x.y()`, treating `x` as the zeroth argument.
    */
-  ControlFlowNode getArgumentForCall(CallNode call, int n) {
+  ControlFlowNodeWithPointsTo getArgumentForCall(CallNode call, int n) {
     result = this.theCallable().getArgumentForCall(call, n)
   }
 
@@ -60,7 +65,7 @@ abstract class FunctionObject extends Object {
    * Gets the `ControlFlowNode` that will be passed as the named argument to `this` when called at `call`.
    * This predicate will correctly handle `x.y()`, treating `x` as the self argument.
    */
-  ControlFlowNode getNamedArgumentForCall(CallNode call, string name) {
+  ControlFlowNodeWithPointsTo getNamedArgumentForCall(CallNode call, string name) {
     result = this.theCallable().getNamedArgumentForCall(call, name)
   }
 
@@ -134,7 +139,9 @@ class PyFunctionObject extends FunctionObject {
   override predicate raisesUnknownType() { scope_raises_unknown(this.getFunction()) }
 
   /** Gets a control flow node corresponding to the value of a return statement */
-  ControlFlowNode getAReturnedNode() { result = this.getFunction().getAReturnValueFlowNode() }
+  ControlFlowNodeWithPointsTo getAReturnedNode() {
+    result = this.getFunction().getAReturnValueFlowNode()
+  }
 
   override string descriptiveString() {
     if this.getFunction().isMethod()
@@ -216,7 +223,7 @@ abstract class BuiltinCallable extends FunctionObject {
 
   abstract override string getQualifiedName();
 
-  override ControlFlowNode getArgumentForCall(CallNode call, int n) {
+  override ControlFlowNodeWithPointsTo getArgumentForCall(CallNode call, int n) {
     call = this.getACall() and result = call.getArg(n)
   }
 }
diff --git a/python/ql/lib/semmle/python/types/Object.qll b/python/ql/lib/semmle/python/types/Object.qll
index 6c76067dc68e..1e0868648be0 100644
--- a/python/ql/lib/semmle/python/types/Object.qll
+++ b/python/ql/lib/semmle/python/types/Object.qll
@@ -1,4 +1,5 @@
 import python
+private import LegacyPointsTo
 private import semmle.python.objects.ObjectInternal
 private import semmle.python.types.Builtins
 private import semmle.python.internal.CachedStages
@@ -41,7 +42,7 @@ class Object extends @py_object {
    * for a control flow node 'f'
    */
   ClassObject getAnInferredType() {
-    exists(ControlFlowNode somewhere | somewhere.refersTo(this, result, _))
+    exists(ControlFlowNodeWithPointsTo somewhere | somewhere.refersTo(this, result, _))
     or
     this.asBuiltin().getClass() = result.asBuiltin() and not this = unknownValue()
     or
@@ -327,7 +328,7 @@ abstract class SequenceObject extends Object {
   Object getInferredElement(int n) {
     result = this.getBuiltinElement(n)
     or
-    this.getSourceElement(n).refersTo(result)
+    this.getSourceElement(n).(ControlFlowNodeWithPointsTo).refersTo(result)
   }
 }
 
@@ -438,7 +439,8 @@ class SuperBoundMethod extends Object {
   string name;
 
   SuperBoundMethod() {
-    this.(AttrNode).getObject(name).inferredValue().getClass() = Value::named("super")
+    this.(AttrNode).getObject(name).(ControlFlowNodeWithPointsTo).inferredValue().getClass() =
+      Value::named("super")
   }
 
   override string toString() { result = "super()." + name }
@@ -446,7 +448,7 @@ class SuperBoundMethod extends Object {
   Object getFunction(string fname) {
     fname = name and
     exists(SuperInstance sup, BoundMethodObjectInternal m |
-      sup = this.(AttrNode).getObject(name).inferredValue() and
+      sup = this.(AttrNode).getObject(name).(ControlFlowNodeWithPointsTo).inferredValue() and
       sup.attribute(name, m, _) and
       result = m.getFunction().getSource()
     )
diff --git a/python/ql/lib/semmle/python/types/Properties.qll b/python/ql/lib/semmle/python/types/Properties.qll
index a0efe6ca5eb9..899f0a3407ec 100644
--- a/python/ql/lib/semmle/python/types/Properties.qll
+++ b/python/ql/lib/semmle/python/types/Properties.qll
@@ -1,4 +1,5 @@
 import python
+private import LegacyPointsTo
 
 /**
  * A Python property:
@@ -77,32 +78,32 @@ class BuiltinPropertyObject extends PropertyObject {
 }
 
 private predicate property_getter(CallNode decorated, FunctionObject getter) {
-  decorated.getFunction().refersTo(thePropertyType()) and
-  decorated.getArg(0).refersTo(getter)
+  decorated.getFunction().(ControlFlowNodeWithPointsTo).refersTo(thePropertyType()) and
+  decorated.getArg(0).(ControlFlowNodeWithPointsTo).refersTo(getter)
 }
 
 private predicate property_setter(CallNode decorated, FunctionObject setter) {
   property_getter(decorated, _) and
   exists(CallNode setter_call, AttrNode prop_setter |
-    prop_setter.getObject("setter").refersTo(decorated)
+    prop_setter.getObject("setter").(ControlFlowNodeWithPointsTo).refersTo(decorated)
   |
-    setter_call.getArg(0).refersTo(setter) and
+    setter_call.getArg(0).(ControlFlowNodeWithPointsTo).refersTo(setter) and
     setter_call.getFunction() = prop_setter
   )
   or
-  decorated.getFunction().refersTo(thePropertyType()) and
-  decorated.getArg(1).refersTo(setter)
+  decorated.getFunction().(ControlFlowNodeWithPointsTo).refersTo(thePropertyType()) and
+  decorated.getArg(1).(ControlFlowNodeWithPointsTo).refersTo(setter)
 }
 
 private predicate property_deleter(CallNode decorated, FunctionObject deleter) {
   property_getter(decorated, _) and
   exists(CallNode deleter_call, AttrNode prop_deleter |
-    prop_deleter.getObject("deleter").refersTo(decorated)
+    prop_deleter.getObject("deleter").(ControlFlowNodeWithPointsTo).refersTo(decorated)
   |
-    deleter_call.getArg(0).refersTo(deleter) and
+    deleter_call.getArg(0).(ControlFlowNodeWithPointsTo).refersTo(deleter) and
     deleter_call.getFunction() = prop_deleter
   )
   or
-  decorated.getFunction().refersTo(thePropertyType()) and
-  decorated.getArg(2).refersTo(deleter)
+  decorated.getFunction().(ControlFlowNodeWithPointsTo).refersTo(thePropertyType()) and
+  decorated.getArg(2).(ControlFlowNodeWithPointsTo).refersTo(deleter)
 }
diff --git a/python/ql/lib/semmle/python/values/StringAttributes.qll b/python/ql/lib/semmle/python/values/StringAttributes.qll
index 792ee9232275..e94540dbf204 100644
--- a/python/ql/lib/semmle/python/values/StringAttributes.qll
+++ b/python/ql/lib/semmle/python/values/StringAttributes.qll
@@ -1,6 +1,10 @@
 import python
+private import LegacyPointsTo
+private import semmle.python.types.Object
+private import semmle.python.types.ClassObject
+private import semmle.python.types.FunctionObject
 
-predicate string_attribute_all(ControlFlowNode n, string attr) {
+predicate string_attribute_all(ControlFlowNodeWithPointsTo n, string attr) {
   (n.getNode() instanceof Unicode or n.getNode() instanceof Bytes) and
   attr = "const"
   or
@@ -19,18 +23,27 @@ predicate tracked_object(ControlFlowNode obj, string attr) {
   tracked_object_any(obj, attr)
 }
 
-predicate open_file(Object obj) { obj.(CallNode).getFunction().refersTo(Object::builtin("open")) }
+predicate open_file(Object obj) {
+  obj.(CallNode).getFunction().(ControlFlowNodeWithPointsTo).refersTo(Object::builtin("open"))
+}
 
-predicate string_attribute_any(ControlFlowNode n, string attr) {
+predicate string_attribute_any(ControlFlowNodeWithPointsTo n, string attr) {
   attr = "user-input" and
-  exists(Object input | n.(CallNode).getFunction().refersTo(input) |
+  exists(Object input | n.(CallNode).getFunction().(ControlFlowNodeWithPointsTo).refersTo(input) |
     if major_version() = 2
     then input = Object::builtin("raw_input")
     else input = Object::builtin("input")
   )
   or
   attr = "file-input" and
-  exists(Object fd | n.(CallNode).getFunction().(AttrNode).getObject("read").refersTo(fd) |
+  exists(Object fd |
+    n.(CallNode)
+        .getFunction()
+        .(AttrNode)
+        .getObject("read")
+        .(ControlFlowNodeWithPointsTo)
+        .refersTo(fd)
+  |
     open_file(fd)
   )
   or
@@ -65,7 +78,7 @@ ControlFlowNode sequence_for_iterator(ControlFlowNode f) {
 }
 
 pragma[noinline]
-private predicate tracking_step(ControlFlowNode src, ControlFlowNode dest) {
+private predicate tracking_step(ControlFlowNode src, ControlFlowNodeWithPointsTo dest) {
   src = dest.(BinaryExprNode).getAnOperand()
   or
   src = dest.(UnaryExprNode).getOperand()
diff --git a/python/ql/src/Exceptions/NotImplemented.qll b/python/ql/src/Exceptions/NotImplemented.qll
index 2186a7b5f30b..498165d29826 100644
--- a/python/ql/src/Exceptions/NotImplemented.qll
+++ b/python/ql/src/Exceptions/NotImplemented.qll
@@ -1,7 +1,8 @@
 import python
+private import LegacyPointsTo
 
 /** Holds if `notimpl` refers to `NotImplemented` or `NotImplemented()` in the `raise` statement */
-predicate use_of_not_implemented_in_raise(Raise raise, Expr notimpl) {
+predicate use_of_not_implemented_in_raise(Raise raise, ExprWithPointsTo notimpl) {
   notimpl.pointsTo(Value::named("NotImplemented")) and
   (
     notimpl = raise.getException() or
diff --git a/python/ql/src/Exceptions/Raising.qll b/python/ql/src/Exceptions/Raising.qll
index c81494811875..c509c41819d6 100644
--- a/python/ql/src/Exceptions/Raising.qll
+++ b/python/ql/src/Exceptions/Raising.qll
@@ -1,8 +1,9 @@
 import python
+private import LegacyPointsTo
 
 /** Whether the raise statement 'r' raises 'type' from origin 'orig' */
 predicate type_or_typeof(Raise r, ClassValue type, AstNode orig) {
-  exists(Expr exception | exception = r.getRaised() |
+  exists(ExprWithPointsTo exception | exception = r.getRaised() |
     exception.pointsTo(type, orig)
     or
     not exists(ClassValue exc_type | exception.pointsTo(exc_type)) and
diff --git a/python/ql/src/Expressions/CallArgs.qll b/python/ql/src/Expressions/CallArgs.qll
index d2f94ca7cf08..709915afbc61 100644
--- a/python/ql/src/Expressions/CallArgs.qll
+++ b/python/ql/src/Expressions/CallArgs.qll
@@ -1,12 +1,13 @@
 /** INTERNAL - Methods used by queries that test whether functions are invoked correctly. */
 
 import python
+private import LegacyPointsTo
 import Testing.Mox
 
 private int varargs_length_objectapi(Call call) {
   not exists(call.getStarargs()) and result = 0
   or
-  exists(TupleObject t | call.getStarargs().refersTo(t) | result = t.getLength())
+  exists(TupleObject t | call.getStarargs().(ExprWithPointsTo).refersTo(t) | result = t.getLength())
   or
   result = count(call.getStarargs().(List).getAnElt())
 }
@@ -14,7 +15,7 @@ private int varargs_length_objectapi(Call call) {
 private int varargs_length(Call call) {
   not exists(call.getStarargs()) and result = 0
   or
-  exists(TupleValue t | call.getStarargs().pointsTo(t) | result = t.length())
+  exists(TupleValue t | call.getStarargs().(ExprWithPointsTo).pointsTo(t) | result = t.length())
   or
   result = count(call.getStarargs().(List).getAnElt())
 }
diff --git a/python/ql/src/Expressions/ContainsNonContainer.ql b/python/ql/src/Expressions/ContainsNonContainer.ql
index cf6af5ce7b18..fd2123dd436e 100644
--- a/python/ql/src/Expressions/ContainsNonContainer.ql
+++ b/python/ql/src/Expressions/ContainsNonContainer.ql
@@ -12,6 +12,7 @@
  */
 
 import python
+private import LegacyPointsTo
 import semmle.python.pointsto.PointsTo
 
 predicate rhs_in_expr(ControlFlowNode rhs, Compare cmp) {
@@ -20,7 +21,8 @@ predicate rhs_in_expr(ControlFlowNode rhs, Compare cmp) {
   )
 }
 
-from ControlFlowNode non_seq, Compare cmp, Value v, ClassValue cls, ControlFlowNode origin
+from
+  ControlFlowNodeWithPointsTo non_seq, Compare cmp, Value v, ClassValue cls, ControlFlowNode origin
 where
   rhs_in_expr(non_seq, cmp) and
   non_seq.pointsTo(_, v, origin) and
diff --git a/python/ql/src/Expressions/ExpectedMappingForFormatString.ql b/python/ql/src/Expressions/ExpectedMappingForFormatString.ql
index 4342062270b7..c11ab58688ea 100644
--- a/python/ql/src/Expressions/ExpectedMappingForFormatString.ql
+++ b/python/ql/src/Expressions/ExpectedMappingForFormatString.ql
@@ -12,9 +12,10 @@
  */
 
 import python
+private import LegacyPointsTo
 import semmle.python.strings
 
-from Expr e, ClassValue t
+from ExprWithPointsTo e, ClassValue t
 where
   exists(BinaryExpr b |
     b.getOp() instanceof Mod and
diff --git a/python/ql/src/Expressions/Formatting/AdvancedFormatting.qll b/python/ql/src/Expressions/Formatting/AdvancedFormatting.qll
index 7da80ffa0278..d98286d85faf 100644
--- a/python/ql/src/Expressions/Formatting/AdvancedFormatting.qll
+++ b/python/ql/src/Expressions/Formatting/AdvancedFormatting.qll
@@ -1,4 +1,5 @@
 import python
+private import LegacyPointsTo
 
 /** A string constant that looks like it may be used in string formatting operations. */
 class PossibleAdvancedFormatString extends StringLiteral {
@@ -98,11 +99,15 @@ private predicate brace_pair(PossibleAdvancedFormatString fmt, int start, int en
 
 private predicate advanced_format_call(Call format_expr, PossibleAdvancedFormatString fmt, int args) {
   exists(CallNode call | call = format_expr.getAFlowNode() |
-    call.getFunction().pointsTo(Value::named("format")) and
-    call.getArg(0).pointsTo(_, fmt.getAFlowNode()) and
+    call.getFunction().(ControlFlowNodeWithPointsTo).pointsTo(Value::named("format")) and
+    call.getArg(0).(ControlFlowNodeWithPointsTo).pointsTo(_, fmt.getAFlowNode()) and
     args = count(format_expr.getAnArg()) - 1
     or
-    call.getFunction().(AttrNode).getObject("format").pointsTo(_, fmt.getAFlowNode()) and
+    call.getFunction()
+        .(AttrNode)
+        .getObject("format")
+        .(ControlFlowNodeWithPointsTo)
+        .pointsTo(_, fmt.getAFlowNode()) and
     args = count(format_expr.getAnArg())
   )
 }
diff --git a/python/ql/src/Expressions/HashedButNoHash.ql b/python/ql/src/Expressions/HashedButNoHash.ql
index eb86f3b55332..705806bf3605 100644
--- a/python/ql/src/Expressions/HashedButNoHash.ql
+++ b/python/ql/src/Expressions/HashedButNoHash.ql
@@ -12,6 +12,7 @@
  */
 
 import python
+private import LegacyPointsTo
 
 /*
  * This assumes that any indexing operation where the value is not a sequence or numpy array involves hashing.
@@ -41,13 +42,13 @@ predicate unhashable_subscript(ControlFlowNode f, ClassValue c, ControlFlowNode
   is_unhashable(f, c, origin) and
   exists(SubscriptNode sub | sub.getIndex() = f |
     exists(Value custom_getitem |
-      sub.getObject().pointsTo(custom_getitem) and
+      sub.getObject().(ControlFlowNodeWithPointsTo).pointsTo(custom_getitem) and
       not has_custom_getitem(custom_getitem)
     )
   )
 }
 
-predicate is_unhashable(ControlFlowNode f, ClassValue cls, ControlFlowNode origin) {
+predicate is_unhashable(ControlFlowNodeWithPointsTo f, ClassValue cls, ControlFlowNode origin) {
   exists(Value v | f.pointsTo(v, origin) and v.getClass() = cls |
     not cls.hasAttribute("__hash__") and not cls.failedInference(_) and cls.isNewStyle()
     or
@@ -71,7 +72,7 @@ predicate is_unhashable(ControlFlowNode f, ClassValue cls, ControlFlowNode origi
 predicate typeerror_is_caught(ControlFlowNode f) {
   exists(Try try |
     try.getBody().contains(f.getNode()) and
-    try.getAHandler().getType().pointsTo(ClassValue::typeError())
+    try.getAHandler().getType().(ExprWithPointsTo).pointsTo(ClassValue::typeError())
   )
 }
 
diff --git a/python/ql/src/Expressions/IsComparisons.qll b/python/ql/src/Expressions/IsComparisons.qll
index 7825d01999b9..1ed4534bd234 100644
--- a/python/ql/src/Expressions/IsComparisons.qll
+++ b/python/ql/src/Expressions/IsComparisons.qll
@@ -1,6 +1,8 @@
 /** INTERNAL - Helper predicates for queries that inspect the comparison of objects using `is`. */
 
 import python
+private import LegacyPointsTo
+private import semmle.python.objects.ObjectInternal
 
 /** Holds if the comparison `comp` uses `is` or `is not` (represented as `op`) to compare its `left` and `right` arguments. */
 predicate comparison_using_is(Compare comp, ControlFlowNode left, Cmpop op, ControlFlowNode right) {
@@ -42,7 +44,7 @@ predicate invalid_to_use_is_portably(ClassValue c) {
 }
 
 /** Holds if the control flow node `f` points to either `True`, `False`, or `None`. */
-predicate simple_constant(ControlFlowNode f) {
+predicate simple_constant(ControlFlowNodeWithPointsTo f) {
   exists(Value val | f.pointsTo(val) |
     val = Value::named("True") or val = Value::named("False") or val = Value::named("None")
   )
@@ -74,17 +76,17 @@ private predicate universally_interned_value(Expr e) {
 }
 
 /** Holds if the expression `e` points to an interned constant in CPython. */
-predicate cpython_interned_constant(Expr e) {
+predicate cpython_interned_constant(ExprWithPointsTo e) {
   exists(Expr const | e.pointsTo(_, const) | cpython_interned_value(const))
 }
 
 /** Holds if the expression `e` points to a value that can be reasonably expected to be interned across all implementations of Python. */
-predicate universally_interned_constant(Expr e) {
+predicate universally_interned_constant(ExprWithPointsTo e) {
   exists(Expr const | e.pointsTo(_, const) | universally_interned_value(const))
 }
 
 private predicate comparison_both_types(Compare comp, Cmpop op, ClassValue cls1, ClassValue cls2) {
-  exists(ControlFlowNode op1, ControlFlowNode op2 |
+  exists(ControlFlowNodeWithPointsTo op1, ControlFlowNodeWithPointsTo op2 |
     comparison_using_is(comp, op1, op, op2) or comparison_using_is(comp, op2, op, op1)
   |
     op1.inferredValue().getClass() = cls1 and
@@ -94,7 +96,7 @@ private predicate comparison_both_types(Compare comp, Cmpop op, ClassValue cls1,
 
 private predicate comparison_one_type(Compare comp, Cmpop op, ClassValue cls) {
   not comparison_both_types(comp, _, _, _) and
-  exists(ControlFlowNode operand |
+  exists(ControlFlowNodeWithPointsTo operand |
     comparison_using_is(comp, operand, op, _) or comparison_using_is(comp, _, op, operand)
   |
     operand.inferredValue().getClass() = cls
@@ -118,9 +120,9 @@ predicate invalid_portable_is_comparison(Compare comp, Cmpop op, ClassValue cls)
     )
   ) and
   // OK to use 'is' when comparing items from a known set of objects
-  not exists(Expr left, Expr right, Value val |
+  not exists(ExprWithPointsTo left, ExprWithPointsTo right, Value val |
     comp.compares(left, op, right) and
-    exists(ImmutableLiteral il | il.getLiteralValue() = val)
+    exists(ImmutableLiteral il | il = val.(ConstantObjectInternal).getLiteral())
   |
     left.pointsTo(val) and right.pointsTo(val)
     or
@@ -132,7 +134,7 @@ predicate invalid_portable_is_comparison(Compare comp, Cmpop op, ClassValue cls)
     )
   ) and
   // OK to use 'is' when comparing with a member of an enum
-  not exists(Expr left, Expr right, AstNode origin |
+  not exists(ExprWithPointsTo left, ExprWithPointsTo right, AstNode origin |
     comp.compares(left, op, right) and
     enum_member(origin)
   |
diff --git a/python/ql/src/Expressions/NonCallableCalled.ql b/python/ql/src/Expressions/NonCallableCalled.ql
index 2740dbe5fb26..2e593f88ca50 100644
--- a/python/ql/src/Expressions/NonCallableCalled.ql
+++ b/python/ql/src/Expressions/NonCallableCalled.ql
@@ -12,9 +12,10 @@
  */
 
 import python
+private import LegacyPointsTo
 import Exceptions.NotImplemented
 
-from Call c, Value v, ClassValue t, Expr f, AstNode origin
+from Call c, Value v, ClassValue t, ExprWithPointsTo f, AstNode origin
 where
   f = c.getFunc() and
   f.pointsTo(v, origin) and
diff --git a/python/ql/src/Expressions/TruncatedDivision.ql b/python/ql/src/Expressions/TruncatedDivision.ql
index 54758b4b78e2..c731a21f7d26 100644
--- a/python/ql/src/Expressions/TruncatedDivision.ql
+++ b/python/ql/src/Expressions/TruncatedDivision.ql
@@ -12,6 +12,7 @@
  */
 
 import python
+private import LegacyPointsTo
 
 from BinaryExpr div, ControlFlowNode left, ControlFlowNode right
 where
@@ -20,9 +21,9 @@ where
   exists(BinaryExprNode bin, Value lval, Value rval |
     bin = div.getAFlowNode() and
     bin.getNode().getOp() instanceof Div and
-    bin.getLeft().pointsTo(lval, left) and
+    bin.getLeft().(ControlFlowNodeWithPointsTo).pointsTo(lval, left) and
     lval.getClass() = ClassValue::int_() and
-    bin.getRight().pointsTo(rval, right) and
+    bin.getRight().(ControlFlowNodeWithPointsTo).pointsTo(rval, right) and
     rval.getClass() = ClassValue::int_() and
     // Ignore instances where integer division leaves no remainder
     not lval.(NumericValue).getIntValue() % rval.(NumericValue).getIntValue() = 0 and
diff --git a/python/ql/src/Expressions/UnnecessaryLambda.ql b/python/ql/src/Expressions/UnnecessaryLambda.ql
index 5ba2dd171240..770dde6fece4 100644
--- a/python/ql/src/Expressions/UnnecessaryLambda.ql
+++ b/python/ql/src/Expressions/UnnecessaryLambda.ql
@@ -12,6 +12,7 @@
  */
 
 import python
+private import LegacyPointsTo
 
 /* f consists of a single return statement, whose value is a call. The arguments of the call are exactly the parameters of f */
 predicate simple_wrapper(Lambda l, Expr wrapped) {
@@ -39,7 +40,7 @@ predicate simple_wrapper(Lambda l, Expr wrapped) {
 }
 
 /* The expression called will refer to the same object if evaluated when the lambda is created or when the lambda is executed. */
-predicate unnecessary_lambda(Lambda l, Expr e) {
+predicate unnecessary_lambda(Lambda l, ExprWithPointsTo e) {
   simple_wrapper(l, e) and
   (
     /* plain class */
diff --git a/python/ql/src/Expressions/UseofApply.ql b/python/ql/src/Expressions/UseofApply.ql
index 7a0d72b43cf6..2012f2d93618 100644
--- a/python/ql/src/Expressions/UseofApply.ql
+++ b/python/ql/src/Expressions/UseofApply.ql
@@ -10,8 +10,9 @@
  */
 
 import python
+private import LegacyPointsTo
 private import semmle.python.types.Builtins
 
-from CallNode call, ControlFlowNode func
+from CallNode call, ControlFlowNodeWithPointsTo func
 where major_version() = 2 and call.getFunction() = func and func.pointsTo(Value::named("apply"))
 select call, "Call to the obsolete builtin function 'apply'."
diff --git a/python/ql/src/Expressions/WrongNumberArgumentsForFormat.ql b/python/ql/src/Expressions/WrongNumberArgumentsForFormat.ql
index e47d4a55bf5d..d7b27e5c3d75 100644
--- a/python/ql/src/Expressions/WrongNumberArgumentsForFormat.ql
+++ b/python/ql/src/Expressions/WrongNumberArgumentsForFormat.ql
@@ -14,24 +14,26 @@
  */
 
 import python
+import LegacyPointsTo
+import semmle.python.objects.ObjectInternal
 import semmle.python.strings
 
 predicate string_format(BinaryExpr operation, StringLiteral str, Value args, AstNode origin) {
   operation.getOp() instanceof Mod and
   exists(Context ctx |
-    operation.getLeft().pointsTo(ctx, _, str) and
-    operation.getRight().pointsTo(ctx, args, origin)
+    operation.getLeft().(ExprWithPointsTo).pointsTo(ctx, _, str) and
+    operation.getRight().(ExprWithPointsTo).pointsTo(ctx, args, origin)
   )
 }
 
 int sequence_length(Value args) {
   /* Guess length of sequence */
-  exists(Tuple seq | seq.pointsTo(args, _) |
+  exists(Tuple seq | seq.(ExprWithPointsTo).pointsTo(args, _) |
     result = strictcount(seq.getAnElt()) and
     not seq.getAnElt() instanceof Starred
   )
   or
-  exists(ImmutableLiteral i | i.getLiteralValue() = args | result = 1)
+  exists(ImmutableLiteral i | i = args.(ConstantObjectInternal).getLiteral() | result = 1)
 }
 
 from
diff --git a/python/ql/src/Functions/ExplicitReturnInInit.ql b/python/ql/src/Functions/ExplicitReturnInInit.ql
index c4deea6111c6..f1300afbfd0a 100644
--- a/python/ql/src/Functions/ExplicitReturnInInit.ql
+++ b/python/ql/src/Functions/ExplicitReturnInInit.ql
@@ -12,8 +12,9 @@
  */
 
 import python
+private import LegacyPointsTo
 
-from Return r, Expr rv
+from Return r, ExprWithPointsTo rv
 where
   exists(Function init | init.isInitMethod() and r.getScope() = init) and
   r.getValue() = rv and
diff --git a/python/ql/src/Functions/UseImplicitNoneReturnValue.ql b/python/ql/src/Functions/UseImplicitNoneReturnValue.ql
index aeac382f6380..4a8b8edd6235 100644
--- a/python/ql/src/Functions/UseImplicitNoneReturnValue.ql
+++ b/python/ql/src/Functions/UseImplicitNoneReturnValue.ql
@@ -12,6 +12,7 @@
  */
 
 import python
+private import LegacyPointsTo
 import Testing.Mox
 
 predicate is_used(Call c) {
@@ -31,10 +32,12 @@ from Call c, FunctionValue func
 where
   /* Call result is used, but callee is a procedure */
   is_used(c) and
-  c.getFunc().pointsTo(func) and
+  c.getFunc().(ExprWithPointsTo).pointsTo(func) and
   func.getScope().isProcedure() and
   /* All callees are procedures */
-  forall(FunctionValue callee | c.getFunc().pointsTo(callee) | callee.getScope().isProcedure()) and
+  forall(FunctionValue callee | c.getFunc().(ExprWithPointsTo).pointsTo(callee) |
+    callee.getScope().isProcedure()
+  ) and
   /* Mox return objects have an `AndReturn` method */
   not useOfMoxInModule(c.getEnclosingModule())
 select c, "The result of $@ is used even though it is always None.", func, func.getQualifiedName()
diff --git a/python/ql/src/Imports/Cyclic.qll b/python/ql/src/Imports/Cyclic.qll
index dd25f06d0e5d..720ea8f00481 100644
--- a/python/ql/src/Imports/Cyclic.qll
+++ b/python/ql/src/Imports/Cyclic.qll
@@ -1,4 +1,5 @@
 import python
+private import LegacyPointsTo
 
 predicate is_import_time(Stmt s) { not s.getScope+() instanceof Function }
 
@@ -21,7 +22,7 @@ predicate circular_import(ModuleValue m1, ModuleValue m2) {
 ModuleValue stmt_imports(ImportingStmt s) {
   exists(string name | result.importedAs(name) and not name = "__main__" |
     name = s.getAnImportedModuleName() and
-    s.getASubExpression().pointsTo(result) and
+    s.getASubExpression().(ExprWithPointsTo).pointsTo(result) and
     not result.isPackage()
   )
 }
@@ -57,7 +58,7 @@ predicate import_time_transitive_import(ModuleValue base, Stmt imp, ModuleValue
  * Returns import-time usages of module 'm' in module 'enclosing'
  */
 predicate import_time_module_use(ModuleValue m, ModuleValue enclosing, Expr use, string attr) {
-  exists(Expr mod |
+  exists(ExprWithPointsTo mod |
     use.getEnclosingModule() = enclosing.getScope() and
     not use.getScope+() instanceof Function and
     mod.pointsTo(m) and
@@ -90,7 +91,8 @@ predicate is_used_in_annotation(Expr use) {
  */
 predicate is_annotation_with_from_future_import_annotations(Expr use) {
   exists(ImportMember i | i.getScope() = use.getEnclosingModule() |
-    i.getModule().pointsTo().getName() = "__future__" and i.getName() = "annotations"
+    i.getModule().(ExprWithPointsTo).pointsTo().getName() = "__future__" and
+    i.getName() = "annotations"
   ) and
   is_used_in_annotation(use)
 }
diff --git a/python/ql/src/Imports/DeprecatedModule.ql b/python/ql/src/Imports/DeprecatedModule.ql
index 5f5a8af3ae9a..3d529943fb8f 100644
--- a/python/ql/src/Imports/DeprecatedModule.ql
+++ b/python/ql/src/Imports/DeprecatedModule.ql
@@ -11,6 +11,7 @@
  */
 
 import python
+private import LegacyPointsTo
 
 /**
  * Holds if the module `name` was deprecated in Python version `major`.`minor`,
@@ -79,7 +80,7 @@ where
   name = imp.getName() and
   deprecated_module(name, instead, _, _) and
   not exists(Try try, ExceptStmt except | except = try.getAHandler() |
-    except.getType().pointsTo(ClassValue::importError()) and
+    except.getType().(ExprWithPointsTo).pointsTo(ClassValue::importError()) and
     except.containsInScope(imp)
   )
 select imp, deprecation_message(name) + replacement_message(name)
diff --git a/python/ql/src/Imports/FromImportOfMutableAttribute.ql b/python/ql/src/Imports/FromImportOfMutableAttribute.ql
index c66a7578de61..63198bece30c 100644
--- a/python/ql/src/Imports/FromImportOfMutableAttribute.ql
+++ b/python/ql/src/Imports/FromImportOfMutableAttribute.ql
@@ -12,6 +12,7 @@
  */
 
 import python
+private import LegacyPointsTo
 import semmle.python.filters.Tests
 
 from ImportMember im, ModuleValue m, AttrNode store_attr, string name
@@ -23,7 +24,7 @@ where
   /* variable resulting from import must have a long lifetime */
   not im.getScope() instanceof Function and
   store_attr.isStore() and
-  store_attr.getObject(name).pointsTo(m) and
+  store_attr.getObject(name).(ControlFlowNodeWithPointsTo).pointsTo(m) and
   /* Import not in same module as modification. */
   not im.getEnclosingModule() = store_attr.getScope().getEnclosingModule() and
   /* Modification is not in a test */
diff --git a/python/ql/src/Imports/UnusedImport.ql b/python/ql/src/Imports/UnusedImport.ql
index 020356901652..370daf405fe7 100644
--- a/python/ql/src/Imports/UnusedImport.ql
+++ b/python/ql/src/Imports/UnusedImport.ql
@@ -12,6 +12,7 @@
  */
 
 import python
+private import LegacyPointsTo
 import Variables.Definition
 import semmle.python.ApiGraphs
 
@@ -94,7 +95,7 @@ private string typehint_annotation_in_module(Module module_scope) {
     or
     annotation = any(FunctionExpr f).getReturns().getASubExpression*()
   |
-    annotation.pointsTo(Value::forString(result)) and
+    annotation.(ExprWithPointsTo).pointsTo(Value::forString(result)) and
     annotation.getEnclosingModule() = module_scope
   )
 }
@@ -144,7 +145,7 @@ predicate unused_import(Import imp, Variable name) {
   not is_pytest_fixture(imp, name) and
   // Only consider import statements that actually point-to something (possibly an unknown module).
   // If this is not the case, it's likely that the import statement never gets executed.
-  imp.getAName().getValue().pointsTo(_)
+  imp.getAName().getValue().(ExprWithPointsTo).pointsTo(_)
 }
 
 from Stmt s, Variable name
diff --git a/python/ql/src/Statements/IterableStringOrSequence.ql b/python/ql/src/Statements/IterableStringOrSequence.ql
index 5cf92754f622..d1c4a507f0d1 100644
--- a/python/ql/src/Statements/IterableStringOrSequence.ql
+++ b/python/ql/src/Statements/IterableStringOrSequence.ql
@@ -12,6 +12,7 @@
  */
 
 import python
+private import LegacyPointsTo
 import semmle.python.filters.Tests
 
 predicate has_string_type(Value v) {
@@ -21,7 +22,7 @@ predicate has_string_type(Value v) {
 }
 
 from
-  For loop, ControlFlowNode iter, Value str, Value seq, ControlFlowNode seq_origin,
+  For loop, ControlFlowNodeWithPointsTo iter, Value str, Value seq, ControlFlowNode seq_origin,
   ControlFlowNode str_origin
 where
   loop.getIter().getAFlowNode() = iter and
diff --git a/python/ql/src/Statements/MismatchInMultipleAssignment.ql b/python/ql/src/Statements/MismatchInMultipleAssignment.ql
index 188bdd7b9156..c44d8e348c66 100644
--- a/python/ql/src/Statements/MismatchInMultipleAssignment.ql
+++ b/python/ql/src/Statements/MismatchInMultipleAssignment.ql
@@ -13,6 +13,7 @@
  */
 
 import python
+private import LegacyPointsTo
 
 private int len(ExprList el) { result = count(el.getAnItem()) }
 
@@ -41,7 +42,7 @@ predicate mismatched_tuple_rhs(Assign a, int lcount, int rcount, Location loc) {
       a.getATarget().(Tuple).getElts() = l or
       a.getATarget().(List).getElts() = l
     ) and
-    a.getValue().pointsTo(r, origin) and
+    a.getValue().(ExprWithPointsTo).pointsTo(r, origin) and
     loc = origin.getLocation() and
     lcount = len(l) and
     rcount = r.length() and
diff --git a/python/ql/src/Statements/ModificationOfLocals.ql b/python/ql/src/Statements/ModificationOfLocals.ql
index 05c2095f88cb..e4791a410f7a 100644
--- a/python/ql/src/Statements/ModificationOfLocals.ql
+++ b/python/ql/src/Statements/ModificationOfLocals.ql
@@ -12,8 +12,11 @@
  */
 
 import python
+private import LegacyPointsTo
 
-predicate originIsLocals(ControlFlowNode n) { n.pointsTo(_, _, Value::named("locals").getACall()) }
+predicate originIsLocals(ControlFlowNodeWithPointsTo n) {
+  n.pointsTo(_, _, Value::named("locals").getACall())
+}
 
 predicate modification_of_locals(ControlFlowNode f) {
   originIsLocals(f.(SubscriptNode).getObject()) and
diff --git a/python/ql/src/Statements/NonIteratorInForLoop.ql b/python/ql/src/Statements/NonIteratorInForLoop.ql
index 92527a10e3bb..f8e6e51b55ff 100644
--- a/python/ql/src/Statements/NonIteratorInForLoop.ql
+++ b/python/ql/src/Statements/NonIteratorInForLoop.ql
@@ -12,8 +12,9 @@
  */
 
 import python
+private import LegacyPointsTo
 
-from For loop, ControlFlowNode iter, Value v, ClassValue t, ControlFlowNode origin
+from For loop, ControlFlowNodeWithPointsTo iter, Value v, ClassValue t, ControlFlowNode origin
 where
   loop.getIter().getAFlowNode() = iter and
   iter.pointsTo(_, v, origin) and
diff --git a/python/ql/src/Statements/RedundantAssignment.ql b/python/ql/src/Statements/RedundantAssignment.ql
index 42561905bacd..357364c41b2f 100644
--- a/python/ql/src/Statements/RedundantAssignment.ql
+++ b/python/ql/src/Statements/RedundantAssignment.ql
@@ -13,6 +13,7 @@
  */
 
 import python
+private import LegacyPointsTo
 
 predicate assignment(AssignStmt a, Expr left, Expr right) {
   a.getATarget() = left and a.getValue() = right
@@ -57,7 +58,9 @@ predicate same_name(Name n1, Name n2) {
   not maybe_defined_in_outer_scope(n2)
 }
 
-ClassValue value_type(Attribute a) { a.getObject().pointsTo().getClass() = result }
+ClassValue value_type(Attribute a) {
+  a.getObject().(ExprWithPointsTo).pointsTo().getClass() = result
+}
 
 predicate is_property_access(Attribute a) {
   value_type(a).lookup(a.getName()) instanceof PropertyValue
@@ -87,7 +90,7 @@ predicate pyflakes_commented(AssignStmt assignment) {
 
 predicate side_effecting_lhs(Attribute lhs) {
   exists(ClassValue cls, ClassValue decl |
-    lhs.getObject().pointsTo().getClass() = cls and
+    lhs.getObject().(ExprWithPointsTo).pointsTo().getClass() = cls and
     decl = cls.getASuperType() and
     not decl.isBuiltin()
   |
diff --git a/python/ql/src/Statements/ShouldUseWithStatement.ql b/python/ql/src/Statements/ShouldUseWithStatement.ql
index 2ad76b5c832d..eb5cf9237d57 100644
--- a/python/ql/src/Statements/ShouldUseWithStatement.ql
+++ b/python/ql/src/Statements/ShouldUseWithStatement.ql
@@ -13,6 +13,7 @@
  */
 
 import python
+private import LegacyPointsTo
 
 predicate calls_close(Call c) { exists(Attribute a | c.getFunc() = a and a.getName() = "close") }
 
@@ -22,7 +23,7 @@ predicate only_stmt_in_finally(Try t, Call c) {
   )
 }
 
-predicate points_to_context_manager(ControlFlowNode f, ClassValue cls) {
+predicate points_to_context_manager(ControlFlowNodeWithPointsTo f, ClassValue cls) {
   forex(Value v | f.pointsTo(v) | v.getClass() = cls) and
   cls.isContextManager()
 }
diff --git a/python/ql/src/Statements/StatementNoEffect.ql b/python/ql/src/Statements/StatementNoEffect.ql
index a5806e7082dd..222907f24e33 100644
--- a/python/ql/src/Statements/StatementNoEffect.ql
+++ b/python/ql/src/Statements/StatementNoEffect.ql
@@ -13,10 +13,11 @@
  */
 
 import python
+private import LegacyPointsTo
 
 predicate understood_attribute(Attribute attr, ClassValue cls, ClassValue attr_cls) {
   exists(string name | attr.getName() = name |
-    attr.getObject().pointsTo().getClass() = cls and
+    attr.getObject().(ExprWithPointsTo).pointsTo().getClass() = cls and
     cls.attr(name).getClass() = attr_cls
   )
 }
@@ -30,7 +31,7 @@ predicate side_effecting_attribute(Attribute attr) {
 }
 
 predicate maybe_side_effecting_attribute(Attribute attr) {
-  not understood_attribute(attr, _, _) and not attr.pointsTo(_)
+  not understood_attribute(attr, _, _) and not attr.(ExprWithPointsTo).pointsTo(_)
   or
   side_effecting_attribute(attr)
 }
@@ -68,7 +69,7 @@ predicate side_effecting_binary(Expr b) {
 
 pragma[nomagic]
 private predicate binary_operator_special_method(
-  BinaryExpr b, Expr sub, ClassValue cls, string method_name
+  BinaryExpr b, ExprWithPointsTo sub, ClassValue cls, string method_name
 ) {
   method_name = special_method() and
   sub = b.getLeft() and
@@ -77,7 +78,9 @@ private predicate binary_operator_special_method(
 }
 
 pragma[nomagic]
-private predicate comparison_special_method(Compare b, Expr sub, ClassValue cls, string method_name) {
+private predicate comparison_special_method(
+  Compare b, ExprWithPointsTo sub, ClassValue cls, string method_name
+) {
   exists(Cmpop op |
     b.compares(sub, op, _) and
     method_name = op.getSpecialMethodName()
diff --git a/python/ql/src/Statements/StringConcatenationInLoop.ql b/python/ql/src/Statements/StringConcatenationInLoop.ql
index 563a42e5462a..c85292cf26aa 100644
--- a/python/ql/src/Statements/StringConcatenationInLoop.ql
+++ b/python/ql/src/Statements/StringConcatenationInLoop.ql
@@ -11,6 +11,7 @@
  */
 
 import python
+private import LegacyPointsTo
 
 predicate string_concat_in_loop(BinaryExpr b) {
   b.getOp() instanceof Add and
@@ -19,7 +20,7 @@ predicate string_concat_in_loop(BinaryExpr b) {
   |
     d.getDefinition().(DefinitionNode).getValue() = add and
     u.getAUse() = add.getAnOperand() and
-    add.getAnOperand().pointsTo().getClass() = ClassValue::str()
+    add.getAnOperand().(ControlFlowNodeWithPointsTo).pointsTo().getClass() = ClassValue::str()
   )
 }
 
diff --git a/python/ql/src/Statements/UnreachableCode.ql b/python/ql/src/Statements/UnreachableCode.ql
index 98c99ac12185..55582ed2f061 100644
--- a/python/ql/src/Statements/UnreachableCode.ql
+++ b/python/ql/src/Statements/UnreachableCode.ql
@@ -13,6 +13,7 @@
  */
 
 import python
+private import LegacyPointsTo
 
 predicate typing_import(ImportingStmt is) {
   exists(Module m |
@@ -33,7 +34,11 @@ predicate unique_yield(Stmt s) {
 /** Holds if `contextlib.suppress` may be used in the same scope as `s` */
 predicate suppression_in_scope(Stmt s) {
   exists(With w |
-    w.getContextExpr().(Call).getFunc().pointsTo(Value::named("contextlib.suppress")) and
+    w.getContextExpr()
+        .(Call)
+        .getFunc()
+        .(ExprWithPointsTo)
+        .pointsTo(Value::named("contextlib.suppress")) and
     w.getScope() = s.getScope()
   )
 }
diff --git a/python/ql/src/Statements/UnusedExceptionObject.ql b/python/ql/src/Statements/UnusedExceptionObject.ql
index 90724b9f1671..9a6a3650b7e6 100644
--- a/python/ql/src/Statements/UnusedExceptionObject.ql
+++ b/python/ql/src/Statements/UnusedExceptionObject.ql
@@ -12,10 +12,11 @@
  */
 
 import python
+private import LegacyPointsTo
 
 from Call call, ClassValue ex
 where
-  call.getFunc().pointsTo(ex) and
+  call.getFunc().(ExprWithPointsTo).pointsTo(ex) and
   ex.getASuperType() = ClassValue::exception() and
   exists(ExprStmt s | s.getValue() = call)
 select call, "Instantiating an exception, but not raising it, has no effect."
diff --git a/python/ql/src/Statements/UseOfExit.ql b/python/ql/src/Statements/UseOfExit.ql
index be3579481fcb..437ff93b5371 100644
--- a/python/ql/src/Statements/UseOfExit.ql
+++ b/python/ql/src/Statements/UseOfExit.ql
@@ -12,9 +12,10 @@
  */
 
 import python
+private import LegacyPointsTo
 
 from CallNode call, string name
-where call.getFunction().pointsTo(Value::siteQuitter(name))
+where call.getFunction().(ControlFlowNodeWithPointsTo).pointsTo(Value::siteQuitter(name))
 select call,
   "The '" + name +
     "' site.Quitter object may not exist if the 'site' module is not loaded or is modified."
diff --git a/python/ql/src/Testing/Mox.qll b/python/ql/src/Testing/Mox.qll
index a131ca7eecaf..969c49c68438 100644
--- a/python/ql/src/Testing/Mox.qll
+++ b/python/ql/src/Testing/Mox.qll
@@ -1,9 +1,10 @@
 import python
+private import LegacyPointsTo
 
 /** Whether `mox` or `.StubOutWithMock()` is used in thin module `m`. */
 predicate useOfMoxInModule(Module m) {
   exists(ModuleObject mox | mox.getName() = "mox" or mox.getName() = "mox3.mox" |
-    exists(ControlFlowNode use |
+    exists(ControlFlowNodeWithPointsTo use |
       use.refersTo(mox) and
       use.getScope().getEnclosingModule() = m
     )
diff --git a/python/ql/src/Variables/MonkeyPatched.qll b/python/ql/src/Variables/MonkeyPatched.qll
index ab842afbf265..86d9edac0a9b 100644
--- a/python/ql/src/Variables/MonkeyPatched.qll
+++ b/python/ql/src/Variables/MonkeyPatched.qll
@@ -1,4 +1,5 @@
 import python
+private import LegacyPointsTo
 
 predicate monkey_patched_builtin(string name) {
   exists(AttrNode attr, SubscriptNode subscr, StringLiteral s |
@@ -6,19 +7,19 @@ predicate monkey_patched_builtin(string name) {
     subscr.getIndex().getNode() = s and
     s.getText() = name and
     subscr.getObject() = attr and
-    attr.getObject("__dict__").pointsTo(Module::builtinModule())
+    attr.getObject("__dict__").(ControlFlowNodeWithPointsTo).pointsTo(Module::builtinModule())
   )
   or
-  exists(CallNode call, ControlFlowNode bltn, StringLiteral s |
+  exists(CallNode call, ControlFlowNodeWithPointsTo bltn, StringLiteral s |
     call.getArg(0) = bltn and
     bltn.pointsTo(Module::builtinModule()) and
     call.getArg(1).getNode() = s and
     s.getText() = name and
-    call.getFunction().pointsTo(Value::named("setattr"))
+    call.getFunction().(ControlFlowNodeWithPointsTo).pointsTo(Value::named("setattr"))
   )
   or
   exists(AttrNode attr |
     attr.isStore() and
-    attr.getObject(name).pointsTo(Module::builtinModule())
+    attr.getObject(name).(ControlFlowNodeWithPointsTo).pointsTo(Module::builtinModule())
   )
 }
diff --git a/python/ql/src/Variables/ShadowGlobal.ql b/python/ql/src/Variables/ShadowGlobal.ql
index 2f06e4fe57d7..fad86935cf1d 100644
--- a/python/ql/src/Variables/ShadowGlobal.ql
+++ b/python/ql/src/Variables/ShadowGlobal.ql
@@ -15,6 +15,7 @@
  */
 
 import python
+private import LegacyPointsTo
 import Shadowing
 import semmle.python.types.Builtins
 
@@ -35,7 +36,9 @@ predicate shadows(Name d, GlobalVariable g, Function scope, int line) {
 
 /* pytest dynamically populates its namespace so, we cannot look directly for the pytest.fixture function */
 AttrNode pytest_fixture_attr() {
-  exists(ModuleValue pytest | result.getObject("fixture").pointsTo(pytest))
+  exists(ModuleValue pytest |
+    result.getObject("fixture").(ControlFlowNodeWithPointsTo).pointsTo(pytest)
+  )
 }
 
 Value pytest_fixture() {
@@ -44,14 +47,15 @@ Value pytest_fixture() {
     or
     call.getFunction().(CallNode).getFunction() = pytest_fixture_attr()
   |
-    call.pointsTo(result)
+    call.(ControlFlowNodeWithPointsTo).pointsTo(result)
   )
 }
 
 /* pytest fixtures require that the parameter name is also a global */
 predicate assigned_pytest_fixture(GlobalVariable v) {
   exists(NameNode def |
-    def.defines(v) and def.(DefinitionNode).getValue().pointsTo(pytest_fixture())
+    def.defines(v) and
+    def.(DefinitionNode).getValue().(ControlFlowNodeWithPointsTo).pointsTo(pytest_fixture())
   )
 }
 
diff --git a/python/ql/src/Variables/SuspiciousUnusedLoopIterationVariable.ql b/python/ql/src/Variables/SuspiciousUnusedLoopIterationVariable.ql
index fbeb9b2b4f96..87900c48fc58 100644
--- a/python/ql/src/Variables/SuspiciousUnusedLoopIterationVariable.ql
+++ b/python/ql/src/Variables/SuspiciousUnusedLoopIterationVariable.ql
@@ -12,6 +12,7 @@
  */
 
 import python
+private import LegacyPointsTo
 import Definition
 
 predicate is_increment(Stmt s) {
@@ -55,7 +56,7 @@ predicate points_to_call_to_range(ControlFlowNode f) {
   )
   or
   /* Handle list(range(...)) and list(list(range(...))) */
-  f.(CallNode).pointsTo().getClass() = ClassValue::list() and
+  f.(CallNode).(ControlFlowNodeWithPointsTo).pointsTo().getClass() = ClassValue::list() and
   points_to_call_to_range(f.(CallNode).getArg(0))
 }
 
diff --git a/python/ql/src/Variables/UndefinedExport.ql b/python/ql/src/Variables/UndefinedExport.ql
index 173139e224a8..ff3f78ec4bcc 100644
--- a/python/ql/src/Variables/UndefinedExport.ql
+++ b/python/ql/src/Variables/UndefinedExport.ql
@@ -13,6 +13,7 @@
  */
 
 import python
+private import LegacyPointsTo
 
 /** Whether name is declared in the __all__ list of this module */
 predicate declaredInAll(Module m, StringLiteral name) {
@@ -44,7 +45,7 @@ predicate mutates_globals(ModuleValue m) {
         enum_convert = enum_class.attr("_convert") and
         exists(CallNode call | call.getScope() = m.getScope() |
           enum_convert.getACall() = call or
-          call.getFunction().pointsTo(enum_convert)
+          call.getFunction().(ControlFlowNodeWithPointsTo).pointsTo(enum_convert)
         )
       )
       or
@@ -52,7 +53,11 @@ predicate mutates_globals(ModuleValue m) {
       // analysis doesn't handle that well enough. So we need a special case for this
       not exists(enum_class.attr("_convert")) and
       exists(CallNode call | call.getScope() = m.getScope() |
-        call.getFunction().(AttrNode).getObject(["_convert", "_convert_"]).pointsTo() = enum_class
+        call.getFunction()
+            .(AttrNode)
+            .getObject(["_convert", "_convert_"])
+            .(ControlFlowNodeWithPointsTo)
+            .pointsTo() = enum_class
       )
     )
   )
@@ -65,9 +70,9 @@ predicate is_exported_submodule_name(ModuleValue m, string exported_name) {
 
 predicate contains_unknown_import_star(ModuleValue m) {
   exists(ImportStarNode imp | imp.getEnclosingModule() = m.getScope() |
-    imp.getModule().pointsTo().isAbsent()
+    imp.getModule().(ControlFlowNodeWithPointsTo).pointsTo().isAbsent()
     or
-    not exists(imp.getModule().pointsTo())
+    not exists(imp.getModule().(ControlFlowNodeWithPointsTo).pointsTo())
   )
 }
 
diff --git a/python/ql/src/Variables/UndefinedGlobal.ql b/python/ql/src/Variables/UndefinedGlobal.ql
index f88f5504df81..3ea1c0d38eb6 100644
--- a/python/ql/src/Variables/UndefinedGlobal.ql
+++ b/python/ql/src/Variables/UndefinedGlobal.ql
@@ -11,6 +11,7 @@
  */
 
 import python
+private import LegacyPointsTo
 import Variables.MonkeyPatched
 import Loop
 import semmle.python.pointsto.PointsTo
@@ -95,7 +96,7 @@ predicate undefined_use(Name u) {
   not contains_unknown_import_star(u.getEnclosingModule()) and
   not use_of_exec(u.getEnclosingModule()) and
   not exists(u.getVariable().getAStore()) and
-  not u.pointsTo(_) and
+  not u.(ExprWithPointsTo).pointsTo(_) and
   not probably_defined_in_loop(u)
 }
 
diff --git a/python/ql/src/Variables/UninitializedLocal.ql b/python/ql/src/Variables/UninitializedLocal.ql
index a6ac7d490ce6..d4d94f5a4f37 100644
--- a/python/ql/src/Variables/UninitializedLocal.ql
+++ b/python/ql/src/Variables/UninitializedLocal.ql
@@ -12,6 +12,7 @@
  */
 
 import python
+private import LegacyPointsTo
 import Undefined
 import semmle.python.pointsto.PointsTo
 
@@ -30,7 +31,7 @@ predicate uninitialized_local(NameNode use) {
 predicate explicitly_guarded(NameNode u) {
   exists(Try t |
     t.getBody().contains(u.getNode()) and
-    t.getAHandler().getType().pointsTo(ClassValue::nameError())
+    t.getAHandler().getType().(ExprWithPointsTo).pointsTo(ClassValue::nameError())
   )
 }
 
diff --git a/python/ql/src/Variables/UnusedModuleVariable.ql b/python/ql/src/Variables/UnusedModuleVariable.ql
index 855ca27a7417..24d6559d6fea 100644
--- a/python/ql/src/Variables/UnusedModuleVariable.ql
+++ b/python/ql/src/Variables/UnusedModuleVariable.ql
@@ -13,6 +13,7 @@
  */
 
 import python
+private import LegacyPointsTo
 import Definition
 
 /**
@@ -58,7 +59,7 @@ predicate unused_global(Name unused, GlobalVariable v) {
       // indirectly
       defn.getBasicBlock().reachesExit() and u.getScope() != unused.getScope()
     ) and
-    not unused.getEnclosingModule().getAnExport() = v.getId() and
+    not unused.getEnclosingModule().(ModuleWithPointsTo).getAnExport() = v.getId() and
     not exists(unused.getParentNode().(ClassDef).getDefinedClass().getADecorator()) and
     not exists(unused.getParentNode().(FunctionDef).getDefinedFunction().getADecorator()) and
     unused.defines(v) and
diff --git a/python/ql/src/analysis/Consistency.ql b/python/ql/src/analysis/Consistency.ql
index f7d80a5da957..aafb461a5045 100644
--- a/python/ql/src/analysis/Consistency.ql
+++ b/python/ql/src/analysis/Consistency.ql
@@ -5,6 +5,7 @@
  */
 
 import python
+private import LegacyPointsTo
 import analysis.DefinitionTracking
 
 predicate uniqueness_error(int number, string what, string problem) {
@@ -208,18 +209,22 @@ predicate function_object_consistency(string clsname, string problem, string wha
 predicate multiple_origins_per_object(Object obj) {
   not obj.isC() and
   not obj instanceof ModuleObject and
-  exists(ControlFlowNode use, Context ctx |
+  exists(ControlFlowNodeWithPointsTo use, Context ctx |
     strictcount(ControlFlowNode orig | use.refersTo(ctx, obj, _, orig)) > 1
   )
 }
 
-predicate intermediate_origins(ControlFlowNode use, ControlFlowNode inter, Object obj) {
+predicate intermediate_origins(
+  ControlFlowNodeWithPointsTo use, ControlFlowNodeWithPointsTo inter, Object obj
+) {
   exists(ControlFlowNode orig, Context ctx | not inter = orig |
     use.refersTo(ctx, obj, _, inter) and
     inter.refersTo(ctx, obj, _, orig) and
     // It can sometimes happen that two different modules (e.g. cPickle and Pickle)
     // have the same attribute, but different origins.
-    not strictcount(Object val | inter.(AttrNode).getObject().refersTo(val)) > 1
+    not strictcount(Object val |
+      inter.(AttrNode).getObject().(ControlFlowNodeWithPointsTo).refersTo(val)
+    ) > 1
   )
 }
 
diff --git a/python/ql/src/analysis/Efficiency.ql b/python/ql/src/analysis/Efficiency.ql
index ff44fc2c47d0..37cb5c973879 100644
--- a/python/ql/src/analysis/Efficiency.ql
+++ b/python/ql/src/analysis/Efficiency.ql
@@ -4,6 +4,7 @@
  */
 
 import python
+private import LegacyPointsTo
 import semmle.python.pointsto.PointsTo
 import semmle.python.pointsto.PointsToContext
 
@@ -18,11 +19,11 @@ predicate trivial(ControlFlowNode f) {
 from int interesting_facts, int interesting_facts_in_source, int total_size, float efficiency
 where
   interesting_facts =
-    strictcount(ControlFlowNode f, Object value, ClassObject cls |
+    strictcount(ControlFlowNodeWithPointsTo f, Object value, ClassObject cls |
       f.refersTo(value, cls, _) and not trivial(f)
     ) and
   interesting_facts_in_source =
-    strictcount(ControlFlowNode f, Object value, ClassObject cls |
+    strictcount(ControlFlowNodeWithPointsTo f, Object value, ClassObject cls |
       f.refersTo(value, cls, _) and
       not trivial(f) and
       exists(f.getScope().getEnclosingModule().getFile().getRelativePath())
diff --git a/python/ql/src/analysis/ImportFailure.ql b/python/ql/src/analysis/ImportFailure.ql
index 62de72f3b3ea..c9289a8b474a 100644
--- a/python/ql/src/analysis/ImportFailure.ql
+++ b/python/ql/src/analysis/ImportFailure.ql
@@ -7,6 +7,7 @@
  */
 
 import python
+private import LegacyPointsTo
 
 ImportExpr alternative_import(ImportExpr ie) {
   exists(Alias thisalias, Alias otheralias |
@@ -53,7 +54,7 @@ string os_specific_import(ImportExpr ie) {
 string get_os() { py_flags_versioned("sys.platform", result, major_version().toString()) }
 
 predicate ok_to_fail(ImportExpr ie) {
-  alternative_import(ie).refersTo(_)
+  alternative_import(ie).(ExprWithPointsTo).refersTo(_)
   or
   os_specific_import(ie) != get_os()
 }
@@ -62,7 +63,10 @@ class VersionTest extends ControlFlowNode {
   VersionTest() {
     exists(string name |
       name.matches("%version%") and
-      this.(CompareNode).getAChild+().pointsTo(Module::named("sys").attr(name))
+      this.(CompareNode)
+          .getAChild+()
+          .(ControlFlowNodeWithPointsTo)
+          .pointsTo(Module::named("sys").attr(name))
     )
   }
 
@@ -76,7 +80,7 @@ class VersionGuard extends ConditionBlock {
 
 from ImportExpr ie
 where
-  not ie.refersTo(_) and
+  not ie.(ExprWithPointsTo).refersTo(_) and
   exists(Context c | c.appliesTo(ie.getAFlowNode())) and
   not ok_to_fail(ie) and
   not exists(VersionGuard guard | guard.controls(ie.getAFlowNode().getBasicBlock(), _))
diff --git a/python/ql/src/analysis/PointsToFailure.ql b/python/ql/src/analysis/PointsToFailure.ql
index 66ff2d811a36..7b9a2ac06595 100644
--- a/python/ql/src/analysis/PointsToFailure.ql
+++ b/python/ql/src/analysis/PointsToFailure.ql
@@ -9,7 +9,8 @@
  */
 
 import python
+private import LegacyPointsTo
 
 from Expr e
-where exists(ControlFlowNode f | f = e.getAFlowNode() | not f.refersTo(_))
+where exists(ControlFlowNodeWithPointsTo f | f = e.getAFlowNode() | not f.refersTo(_))
 select e, "Expression does not 'point-to' any object."
diff --git a/python/ql/src/analysis/RatioOfDefinitions.ql b/python/ql/src/analysis/RatioOfDefinitions.ql
index 562deb750051..84b8d7602ec7 100644
--- a/python/ql/src/analysis/RatioOfDefinitions.ql
+++ b/python/ql/src/analysis/RatioOfDefinitions.ql
@@ -3,9 +3,10 @@
  */
 
 import python
+private import LegacyPointsTo
 import analysis.DefinitionTracking
 
-predicate want_to_have_definition(Expr e) {
+predicate want_to_have_definition(ExprWithPointsTo e) {
   /* not builtin object like len, tuple, etc. */
   not exists(Value builtin | e.pointsTo(builtin) and builtin.isBuiltin()) and
   (
diff --git a/python/ql/src/analysis/TypeInferenceFailure.ql b/python/ql/src/analysis/TypeInferenceFailure.ql
index 70c4e880879d..5cfafee36b1e 100644
--- a/python/ql/src/analysis/TypeInferenceFailure.ql
+++ b/python/ql/src/analysis/TypeInferenceFailure.ql
@@ -8,8 +8,9 @@
  */
 
 import python
+private import LegacyPointsTo
 
-from ControlFlowNode f, Object o
+from ControlFlowNodeWithPointsTo f, Object o
 where
   f.refersTo(o) and
   not f.refersTo(o, _, _)
diff --git a/python/ql/test/2/library-tests/PointsTo/class_properties/ClassValues.ql b/python/ql/test/2/library-tests/PointsTo/class_properties/ClassValues.ql
index 3281b8d26e64..382312a4b5c6 100644
--- a/python/ql/test/2/library-tests/PointsTo/class_properties/ClassValues.ql
+++ b/python/ql/test/2/library-tests/PointsTo/class_properties/ClassValues.ql
@@ -1,10 +1,11 @@
 import python
+private import LegacyPointsTo
 
 from ClassValue cls, string res
 where
   exists(CallNode call |
     call.getFunction().(NameNode).getId() = "test" and
-    call.getAnArg().pointsTo(cls)
+    call.getAnArg().(ControlFlowNodeWithPointsTo).pointsTo(cls)
   ) and
   (
     cls.isSequence() and
diff --git a/python/ql/test/2/library-tests/PointsTo/imports/Runtime.ql b/python/ql/test/2/library-tests/PointsTo/imports/Runtime.ql
index 7a46cc8cad13..aad100c14d52 100644
--- a/python/ql/test/2/library-tests/PointsTo/imports/Runtime.ql
+++ b/python/ql/test/2/library-tests/PointsTo/imports/Runtime.ql
@@ -1,6 +1,7 @@
 import python
+private import LegacyPointsTo
 
-from int line, ControlFlowNode f, Object o, ControlFlowNode orig
+from int line, ControlFlowNodeWithPointsTo f, Object o, ControlFlowNode orig
 where
   not f.getLocation().getFile().inStdlib() and
   f.refersTo(o, orig) and
diff --git a/python/ql/test/2/library-tests/PointsTo/imports2/Runtime.ql b/python/ql/test/2/library-tests/PointsTo/imports2/Runtime.ql
index f694bc64cf01..19add3600a04 100644
--- a/python/ql/test/2/library-tests/PointsTo/imports2/Runtime.ql
+++ b/python/ql/test/2/library-tests/PointsTo/imports2/Runtime.ql
@@ -1,6 +1,7 @@
 import python
+private import LegacyPointsTo
 
-from int line, ControlFlowNode f, Object o, ControlFlowNode orig
+from int line, ControlFlowNodeWithPointsTo f, Object o, ControlFlowNode orig
 where
   not f.getLocation().getFile().inStdlib() and
   f.refersTo(o, orig) and
diff --git a/python/ql/test/2/library-tests/PointsTo/imports2/RuntimeWithType.ql b/python/ql/test/2/library-tests/PointsTo/imports2/RuntimeWithType.ql
index 99a5f7b81630..09c330596c96 100644
--- a/python/ql/test/2/library-tests/PointsTo/imports2/RuntimeWithType.ql
+++ b/python/ql/test/2/library-tests/PointsTo/imports2/RuntimeWithType.ql
@@ -1,6 +1,7 @@
 import python
+private import LegacyPointsTo
 
-from int line, ControlFlowNode f, Object o, ClassObject cls, ControlFlowNode orig
+from int line, ControlFlowNodeWithPointsTo f, Object o, ClassObject cls, ControlFlowNode orig
 where
   not f.getLocation().getFile().inStdlib() and
   f.refersTo(o, cls, orig) and
diff --git a/python/ql/test/2/library-tests/PointsTo/origin_uniqueness/Origin.ql b/python/ql/test/2/library-tests/PointsTo/origin_uniqueness/Origin.ql
index 4c7a4fff3588..3f923bc63fa3 100644
--- a/python/ql/test/2/library-tests/PointsTo/origin_uniqueness/Origin.ql
+++ b/python/ql/test/2/library-tests/PointsTo/origin_uniqueness/Origin.ql
@@ -1,8 +1,9 @@
 import python
+private import LegacyPointsTo
 
 string short_loc(Location l) { result = l.getFile().getShortName() + ":" + l.getStartLine() }
 
-from ControlFlowNode use, Object obj, ControlFlowNode orig, int line
+from ControlFlowNodeWithPointsTo use, Object obj, ControlFlowNode orig, int line
 where
   use.refersTo(obj, orig) and
   use.getLocation().getFile().getShortName() = "test.py" and
diff --git a/python/ql/test/2/library-tests/six/pointsto.ql b/python/ql/test/2/library-tests/six/pointsto.ql
index cca7eeede109..66a9d449a768 100644
--- a/python/ql/test/2/library-tests/six/pointsto.ql
+++ b/python/ql/test/2/library-tests/six/pointsto.ql
@@ -1,4 +1,5 @@
 import python
+private import LegacyPointsTo
 
 string longname(Expr e) {
   result = e.(Name).getId()
@@ -6,6 +7,6 @@ string longname(Expr e) {
   exists(Attribute a | a = e | result = longname(a.getObject()) + "." + a.getName())
 }
 
-from Expr e, Value v
+from ExprWithPointsTo e, Value v
 where e.pointsTo(v) and e.getLocation().getFile().getShortName() = "test.py"
 select longname(e), v.toString()
diff --git a/python/ql/test/3/library-tests/PointsTo/attributes/Test.ql b/python/ql/test/3/library-tests/PointsTo/attributes/Test.ql
index cc191d7c7d84..ad7b74f8c581 100644
--- a/python/ql/test/3/library-tests/PointsTo/attributes/Test.ql
+++ b/python/ql/test/3/library-tests/PointsTo/attributes/Test.ql
@@ -1,5 +1,6 @@
 import python
+private import LegacyPointsTo
 
-from ControlFlowNode f, Object o, ControlFlowNode x
+from ControlFlowNodeWithPointsTo f, Object o, ControlFlowNode x
 where f.refersTo(o, x)
 select f.getLocation().getStartLine(), f.toString(), o.toString(), x.getLocation().getStartLine()
diff --git a/python/ql/test/3/library-tests/PointsTo/attributes/TestWithType.ql b/python/ql/test/3/library-tests/PointsTo/attributes/TestWithType.ql
index 2b4b8a8c70ca..dc19fefb4ce3 100644
--- a/python/ql/test/3/library-tests/PointsTo/attributes/TestWithType.ql
+++ b/python/ql/test/3/library-tests/PointsTo/attributes/TestWithType.ql
@@ -1,6 +1,7 @@
 import python
+private import LegacyPointsTo
 
-from ControlFlowNode f, Object o, ClassObject c, ControlFlowNode x
+from ControlFlowNodeWithPointsTo f, Object o, ClassObject c, ControlFlowNode x
 where f.refersTo(o, c, x)
 select f.getLocation().getStartLine(), f.toString(), o.toString(), c.toString(),
   x.getLocation().getStartLine()
diff --git a/python/ql/test/3/library-tests/PointsTo/class_properties/ClassValues.ql b/python/ql/test/3/library-tests/PointsTo/class_properties/ClassValues.ql
index 3281b8d26e64..382312a4b5c6 100644
--- a/python/ql/test/3/library-tests/PointsTo/class_properties/ClassValues.ql
+++ b/python/ql/test/3/library-tests/PointsTo/class_properties/ClassValues.ql
@@ -1,10 +1,11 @@
 import python
+private import LegacyPointsTo
 
 from ClassValue cls, string res
 where
   exists(CallNode call |
     call.getFunction().(NameNode).getId() = "test" and
-    call.getAnArg().pointsTo(cls)
+    call.getAnArg().(ControlFlowNodeWithPointsTo).pointsTo(cls)
   ) and
   (
     cls.isSequence() and
diff --git a/python/ql/test/3/library-tests/PointsTo/imports/Runtime.ql b/python/ql/test/3/library-tests/PointsTo/imports/Runtime.ql
index f694bc64cf01..19add3600a04 100644
--- a/python/ql/test/3/library-tests/PointsTo/imports/Runtime.ql
+++ b/python/ql/test/3/library-tests/PointsTo/imports/Runtime.ql
@@ -1,6 +1,7 @@
 import python
+private import LegacyPointsTo
 
-from int line, ControlFlowNode f, Object o, ControlFlowNode orig
+from int line, ControlFlowNodeWithPointsTo f, Object o, ControlFlowNode orig
 where
   not f.getLocation().getFile().inStdlib() and
   f.refersTo(o, orig) and
diff --git a/python/ql/test/3/library-tests/PointsTo/imports/RuntimeWithType.ql b/python/ql/test/3/library-tests/PointsTo/imports/RuntimeWithType.ql
index 99a5f7b81630..09c330596c96 100644
--- a/python/ql/test/3/library-tests/PointsTo/imports/RuntimeWithType.ql
+++ b/python/ql/test/3/library-tests/PointsTo/imports/RuntimeWithType.ql
@@ -1,6 +1,7 @@
 import python
+private import LegacyPointsTo
 
-from int line, ControlFlowNode f, Object o, ClassObject cls, ControlFlowNode orig
+from int line, ControlFlowNodeWithPointsTo f, Object o, ClassObject cls, ControlFlowNode orig
 where
   not f.getLocation().getFile().inStdlib() and
   f.refersTo(o, cls, orig) and
diff --git a/python/ql/test/3/library-tests/PointsTo/typehints/Values.ql b/python/ql/test/3/library-tests/PointsTo/typehints/Values.ql
index 192468a2248c..be451d6f5960 100644
--- a/python/ql/test/3/library-tests/PointsTo/typehints/Values.ql
+++ b/python/ql/test/3/library-tests/PointsTo/typehints/Values.ql
@@ -1,6 +1,7 @@
 import python
+private import LegacyPointsTo
 
-from ControlFlowNode f, Context ctx, Value v, ControlFlowNode origin
+from ControlFlowNodeWithPointsTo f, Context ctx, Value v, ControlFlowNode origin
 where
   f.pointsTo(ctx, v, origin) and
   f.getLocation().getFile().getBaseName() = "test.py"
diff --git a/python/ql/test/3/library-tests/six/pointsto.ql b/python/ql/test/3/library-tests/six/pointsto.ql
index cca7eeede109..66a9d449a768 100644
--- a/python/ql/test/3/library-tests/six/pointsto.ql
+++ b/python/ql/test/3/library-tests/six/pointsto.ql
@@ -1,4 +1,5 @@
 import python
+private import LegacyPointsTo
 
 string longname(Expr e) {
   result = e.(Name).getId()
@@ -6,6 +7,6 @@ string longname(Expr e) {
   exists(Attribute a | a = e | result = longname(a.getObject()) + "." + a.getName())
 }
 
-from Expr e, Value v
+from ExprWithPointsTo e, Value v
 where e.pointsTo(v) and e.getLocation().getFile().getShortName() = "test.py"
 select longname(e), v.toString()
diff --git a/python/ql/test/extractor-tests/exports/Test.ql b/python/ql/test/extractor-tests/exports/Test.ql
index 50bc0a4ab56d..b04a904197ca 100644
--- a/python/ql/test/extractor-tests/exports/Test.ql
+++ b/python/ql/test/extractor-tests/exports/Test.ql
@@ -1,4 +1,5 @@
 import python
+private import LegacyPointsTo
 
-from Module m
+from ModuleWithPointsTo m
 select m.toString(), m.getAnExport().toString()
diff --git a/python/ql/test/library-tests/PointsTo/absent/Absent.ql b/python/ql/test/library-tests/PointsTo/absent/Absent.ql
index 95cdf3a10844..b73eb9b5296c 100644
--- a/python/ql/test/library-tests/PointsTo/absent/Absent.ql
+++ b/python/ql/test/library-tests/PointsTo/absent/Absent.ql
@@ -1,6 +1,7 @@
 import python
+private import LegacyPointsTo
 import semmle.python.objects.Modules
 
-from Value val, ControlFlowNode f
+from Value val, ControlFlowNodeWithPointsTo f
 where f.pointsTo(val)
 select f, val
diff --git a/python/ql/test/library-tests/PointsTo/calls/CallPointsTo.ql b/python/ql/test/library-tests/PointsTo/calls/CallPointsTo.ql
index 10247a98f941..70a9bbd914b0 100644
--- a/python/ql/test/library-tests/PointsTo/calls/CallPointsTo.ql
+++ b/python/ql/test/library-tests/PointsTo/calls/CallPointsTo.ql
@@ -1,5 +1,6 @@
 import python
+private import LegacyPointsTo
 
 from CallNode call, Value func
-where call.getFunction().pointsTo(func)
+where call.getFunction().(ControlFlowNodeWithPointsTo).pointsTo(func)
 select call.getLocation().getStartLine(), call.toString(), func.toString()
diff --git a/python/ql/test/library-tests/PointsTo/comparisons/PointsTo.ql b/python/ql/test/library-tests/PointsTo/comparisons/PointsTo.ql
index 61f802a2ea5a..31d2f1cab36c 100644
--- a/python/ql/test/library-tests/PointsTo/comparisons/PointsTo.ql
+++ b/python/ql/test/library-tests/PointsTo/comparisons/PointsTo.ql
@@ -1,6 +1,7 @@
 import python
+private import LegacyPointsTo
 
-from int line, ControlFlowNode f, Value v
+from int line, ControlFlowNodeWithPointsTo f, Value v
 where
   any(ExprStmt s).getValue() = f.getNode() and
   line = f.getLocation().getStartLine() and
diff --git a/python/ql/test/library-tests/PointsTo/decorators/Test.ql b/python/ql/test/library-tests/PointsTo/decorators/Test.ql
index b5175845070d..b237ce513d2b 100644
--- a/python/ql/test/library-tests/PointsTo/decorators/Test.ql
+++ b/python/ql/test/library-tests/PointsTo/decorators/Test.ql
@@ -1,10 +1,11 @@
 import python
+private import LegacyPointsTo
 
 // We don't care about the internals of functools which vary from
 // version to version, just the end result.
 from NameNode f, Object o, ControlFlowNode x, int line
 where
-  f.refersTo(o, x) and
+  f.(ControlFlowNodeWithPointsTo).refersTo(o, x) and
   f.getLocation().getFile().getBaseName() = "test.py" and
   line = f.getLocation().getStartLine()
 select line, f.toString(), o.toString(), x.getLocation().toString()
diff --git a/python/ql/test/library-tests/PointsTo/general/GlobalPointsTo.ql b/python/ql/test/library-tests/PointsTo/general/GlobalPointsTo.ql
index 8caa54ccc237..e90674bab2e3 100644
--- a/python/ql/test/library-tests/PointsTo/general/GlobalPointsTo.ql
+++ b/python/ql/test/library-tests/PointsTo/general/GlobalPointsTo.ql
@@ -1,7 +1,8 @@
 import python
+private import LegacyPointsTo
 import interesting
 
-from int line, ControlFlowNode f, Object o, ImportTimeScope n
+from int line, ControlFlowNodeWithPointsTo f, Object o, ImportTimeScope n
 where
   of_interest(f, line) and
   f.refersTo(o) and
diff --git a/python/ql/test/library-tests/PointsTo/general/LocalPointsTo.ql b/python/ql/test/library-tests/PointsTo/general/LocalPointsTo.ql
index aee2cb11bf4c..76d711c00e08 100644
--- a/python/ql/test/library-tests/PointsTo/general/LocalPointsTo.ql
+++ b/python/ql/test/library-tests/PointsTo/general/LocalPointsTo.ql
@@ -6,10 +6,11 @@
  */
 
 import python
+private import LegacyPointsTo
 import interesting
 import Util
 
-from int line, ControlFlowNode f, Object o
+from int line, ControlFlowNodeWithPointsTo f, Object o
 where
   of_interest(f, line) and
   f.refersTo(o)
diff --git a/python/ql/test/library-tests/PointsTo/general/LocalPointsToType.ql b/python/ql/test/library-tests/PointsTo/general/LocalPointsToType.ql
index fe14e61e01b4..8b5e008d60a0 100644
--- a/python/ql/test/library-tests/PointsTo/general/LocalPointsToType.ql
+++ b/python/ql/test/library-tests/PointsTo/general/LocalPointsToType.ql
@@ -1,8 +1,9 @@
 import python
+private import LegacyPointsTo
 import interesting
 import Util
 
-from int line, ControlFlowNode f, Object o, ClassObject cls
+from int line, ControlFlowNodeWithPointsTo f, Object o, ClassObject cls
 where
   of_interest(f, line) and
   f.refersTo(o, cls, _)
diff --git a/python/ql/test/library-tests/PointsTo/guarded/PointsTo.ql b/python/ql/test/library-tests/PointsTo/guarded/PointsTo.ql
index db4710786ac1..c264bf040136 100644
--- a/python/ql/test/library-tests/PointsTo/guarded/PointsTo.ql
+++ b/python/ql/test/library-tests/PointsTo/guarded/PointsTo.ql
@@ -1,6 +1,7 @@
 import python
+private import LegacyPointsTo
 
-from ControlFlowNode f, Object o, ControlFlowNode x
+from ControlFlowNodeWithPointsTo f, Object o, ControlFlowNode x
 where
   f.refersTo(o, x) and
   exists(CallNode call | call.getFunction().getNode().(Name).getId() = "use" and call.getArg(0) = f)
diff --git a/python/ql/test/library-tests/PointsTo/guarded/PointsToWithType.ql b/python/ql/test/library-tests/PointsTo/guarded/PointsToWithType.ql
index 1c294e642820..f7c3d5a5c717 100644
--- a/python/ql/test/library-tests/PointsTo/guarded/PointsToWithType.ql
+++ b/python/ql/test/library-tests/PointsTo/guarded/PointsToWithType.ql
@@ -1,6 +1,7 @@
 import python
+private import LegacyPointsTo
 
-from ControlFlowNode f, Object o, ClassObject c, ControlFlowNode x
+from ControlFlowNodeWithPointsTo f, Object o, ClassObject c, ControlFlowNode x
 where
   f.refersTo(o, c, x) and
   exists(CallNode call | call.getFunction().getNode().(Name).getId() = "use" and call.getArg(0) = f)
diff --git a/python/ql/test/library-tests/PointsTo/import_star/Values.ql b/python/ql/test/library-tests/PointsTo/import_star/Values.ql
index b54b8c6c78dc..f8c620662d63 100644
--- a/python/ql/test/library-tests/PointsTo/import_star/Values.ql
+++ b/python/ql/test/library-tests/PointsTo/import_star/Values.ql
@@ -1,5 +1,6 @@
 import python
+private import LegacyPointsTo
 
-from ControlFlowNode f, Context ctx, Value v, ControlFlowNode origin
+from ControlFlowNodeWithPointsTo f, Context ctx, Value v, ControlFlowNode origin
 where f.pointsTo(ctx, v, origin)
 select f, ctx, v
diff --git a/python/ql/test/library-tests/PointsTo/indexing/Test.ql b/python/ql/test/library-tests/PointsTo/indexing/Test.ql
index 694e4d8e98e0..d9a9d7156dea 100644
--- a/python/ql/test/library-tests/PointsTo/indexing/Test.ql
+++ b/python/ql/test/library-tests/PointsTo/indexing/Test.ql
@@ -1,6 +1,7 @@
 import python
+private import LegacyPointsTo
 
-from ControlFlowNode f, Object o, ControlFlowNode x
+from ControlFlowNodeWithPointsTo f, Object o, ControlFlowNode x
 where
   f.refersTo(o, x) and
   f.getLocation().getFile().getBaseName() = "test.py"
diff --git a/python/ql/test/library-tests/PointsTo/indexing/TestWithType.ql b/python/ql/test/library-tests/PointsTo/indexing/TestWithType.ql
index 9f16abc2de07..b3888d5bf109 100644
--- a/python/ql/test/library-tests/PointsTo/indexing/TestWithType.ql
+++ b/python/ql/test/library-tests/PointsTo/indexing/TestWithType.ql
@@ -1,6 +1,7 @@
 import python
+private import LegacyPointsTo
 
-from ControlFlowNode f, Object o, ClassObject c, ControlFlowNode x
+from ControlFlowNodeWithPointsTo f, Object o, ClassObject c, ControlFlowNode x
 where
   f.refersTo(o, c, x) and
   f.getLocation().getFile().getBaseName() = "test.py"
diff --git a/python/ql/test/library-tests/PointsTo/inheritance/Self.ql b/python/ql/test/library-tests/PointsTo/inheritance/Self.ql
index 050690fd1cb5..571f39d34ab5 100644
--- a/python/ql/test/library-tests/PointsTo/inheritance/Self.ql
+++ b/python/ql/test/library-tests/PointsTo/inheritance/Self.ql
@@ -1,5 +1,6 @@
 import python
+private import LegacyPointsTo
 
 from NameNode n, Object value, ClassObject cls
-where n.getId() = "self" and n.refersTo(value, cls, _)
+where n.getId() = "self" and n.(ControlFlowNodeWithPointsTo).refersTo(value, cls, _)
 select n.getNode().getLocation().getStartLine(), value.toString(), cls.toString()
diff --git a/python/ql/test/library-tests/PointsTo/new/ImpliesDataflow.ql b/python/ql/test/library-tests/PointsTo/new/ImpliesDataflow.ql
index 620cac343329..da4b46595e67 100644
--- a/python/ql/test/library-tests/PointsTo/new/ImpliesDataflow.ql
+++ b/python/ql/test/library-tests/PointsTo/new/ImpliesDataflow.ql
@@ -4,10 +4,11 @@
  */
 
 private import python
+private import LegacyPointsTo
 import semmle.python.dataflow.new.DataFlow
 
 predicate pointsToOrigin(DataFlow::CfgNode pointer, DataFlow::CfgNode origin) {
-  origin.getNode() = pointer.getNode().pointsTo().getOrigin()
+  origin.getNode() = pointer.getNode().(ControlFlowNodeWithPointsTo).pointsTo().getOrigin()
 }
 
 module PointsToConfig implements DataFlow::ConfigSig {
diff --git a/python/ql/test/library-tests/PointsTo/new/PointsToNone.ql b/python/ql/test/library-tests/PointsTo/new/PointsToNone.ql
index c5009ad4cb67..8dca05a8a273 100644
--- a/python/ql/test/library-tests/PointsTo/new/PointsToNone.ql
+++ b/python/ql/test/library-tests/PointsTo/new/PointsToNone.ql
@@ -1,6 +1,7 @@
 import python
+private import LegacyPointsTo
 import Util
 
-from ControlFlowNode f, ControlFlowNode x
+from ControlFlowNodeWithPointsTo f, ControlFlowNode x
 where f.refersTo(theNoneObject(), _, x)
 select locate(f.getLocation(), "abcdghijklmopqr"), f.toString(), x.getLocation().getStartLine()
diff --git a/python/ql/test/library-tests/PointsTo/new/Values.ql b/python/ql/test/library-tests/PointsTo/new/Values.ql
index 668e7a6b2655..9e49b44d37ea 100644
--- a/python/ql/test/library-tests/PointsTo/new/Values.ql
+++ b/python/ql/test/library-tests/PointsTo/new/Values.ql
@@ -1,7 +1,8 @@
 import python
+private import LegacyPointsTo
 import Util
 
-from ControlFlowNode f, Context ctx, Value v, ControlFlowNode origin
+from ControlFlowNodeWithPointsTo f, Context ctx, Value v, ControlFlowNode origin
 where f.pointsTo(ctx, v, origin)
 select locate(f.getLocation(), "abeghijklmnpqrstu"), f.toString(), ctx, vrepr(v),
   vrepr(v.getClass())
diff --git a/python/ql/test/library-tests/PointsTo/properties/Values.ql b/python/ql/test/library-tests/PointsTo/properties/Values.ql
index 23416efc0ebd..6ab52924bb9e 100644
--- a/python/ql/test/library-tests/PointsTo/properties/Values.ql
+++ b/python/ql/test/library-tests/PointsTo/properties/Values.ql
@@ -1,4 +1,5 @@
 import python
+private import LegacyPointsTo
 import semmle.python.objects.ObjectInternal
 
 string vrepr(Value v) {
@@ -8,6 +9,6 @@ string vrepr(Value v) {
   v = ObjectInternal::boundMethod() and result = "builtin-class method"
 }
 
-from ControlFlowNode f, Context ctx, Value v, ControlFlowNode origin
+from ControlFlowNodeWithPointsTo f, Context ctx, Value v, ControlFlowNode origin
 where f.pointsTo(ctx, v, origin)
 select f.getLocation(), f.toString(), ctx, vrepr(v), vrepr(v.getClass())
diff --git a/python/ql/test/library-tests/PointsTo/regressions/missing/if-urlsplit-access/Test.ql b/python/ql/test/library-tests/PointsTo/regressions/missing/if-urlsplit-access/Test.ql
index db02e9c4f085..87b4bb605d74 100644
--- a/python/ql/test/library-tests/PointsTo/regressions/missing/if-urlsplit-access/Test.ql
+++ b/python/ql/test/library-tests/PointsTo/regressions/missing/if-urlsplit-access/Test.ql
@@ -1,6 +1,7 @@
 import python
+private import LegacyPointsTo
 
-from ControlFlowNode arg, CallNode call, string debug
+from ControlFlowNodeWithPointsTo arg, CallNode call, string debug
 where
   call.getAnArg() = arg and
   call.getFunction().(NameNode).getId() = "check" and
diff --git a/python/ql/test/library-tests/PointsTo/regressions/missing/re-compile/Test.ql b/python/ql/test/library-tests/PointsTo/regressions/missing/re-compile/Test.ql
index db02e9c4f085..87b4bb605d74 100644
--- a/python/ql/test/library-tests/PointsTo/regressions/missing/re-compile/Test.ql
+++ b/python/ql/test/library-tests/PointsTo/regressions/missing/re-compile/Test.ql
@@ -1,6 +1,7 @@
 import python
+private import LegacyPointsTo
 
-from ControlFlowNode arg, CallNode call, string debug
+from ControlFlowNodeWithPointsTo arg, CallNode call, string debug
 where
   call.getAnArg() = arg and
   call.getFunction().(NameNode).getId() = "check" and
diff --git a/python/ql/test/library-tests/PointsTo/regressions/missing/uncalled-function/Test.ql b/python/ql/test/library-tests/PointsTo/regressions/missing/uncalled-function/Test.ql
index db02e9c4f085..87b4bb605d74 100644
--- a/python/ql/test/library-tests/PointsTo/regressions/missing/uncalled-function/Test.ql
+++ b/python/ql/test/library-tests/PointsTo/regressions/missing/uncalled-function/Test.ql
@@ -1,6 +1,7 @@
 import python
+private import LegacyPointsTo
 
-from ControlFlowNode arg, CallNode call, string debug
+from ControlFlowNodeWithPointsTo arg, CallNode call, string debug
 where
   call.getAnArg() = arg and
   call.getFunction().(NameNode).getId() = "check" and
diff --git a/python/ql/test/library-tests/PointsTo/regressions/wrong/classmethod/Test.ql b/python/ql/test/library-tests/PointsTo/regressions/wrong/classmethod/Test.ql
index 700e0dd72a59..a7be670276fd 100644
--- a/python/ql/test/library-tests/PointsTo/regressions/wrong/classmethod/Test.ql
+++ b/python/ql/test/library-tests/PointsTo/regressions/wrong/classmethod/Test.ql
@@ -1,10 +1,11 @@
 import python
+private import LegacyPointsTo
 
 from NameNode name, CallNode call, string debug
 where
   call.getAnArg() = name and
   call.getFunction().(NameNode).getId() = "check" and
-  if exists(name.pointsTo())
-  then debug = name.pointsTo().toString()
+  if exists(name.(ControlFlowNodeWithPointsTo).pointsTo())
+  then debug = name.(ControlFlowNodeWithPointsTo).pointsTo().toString()
   else debug = "<MISSING pointsTo()>"
 select name, debug
diff --git a/python/ql/test/library-tests/PointsTo/super/SuperMethodCall.ql b/python/ql/test/library-tests/PointsTo/super/SuperMethodCall.ql
index 86ad5bee155f..43149df47b81 100644
--- a/python/ql/test/library-tests/PointsTo/super/SuperMethodCall.ql
+++ b/python/ql/test/library-tests/PointsTo/super/SuperMethodCall.ql
@@ -1,11 +1,12 @@
 import python
+private import LegacyPointsTo
 import semmle.python.pointsto.PointsTo
 import semmle.python.pointsto.PointsToContext
 import semmle.python.objects.ObjectInternal
 
 from CallNode call, SuperInstance sup, BoundMethodObjectInternal bm
 where
-  call.getFunction().inferredValue() = bm and
-  call.getFunction().(AttrNode).getObject().inferredValue() = sup
+  call.getFunction().(ControlFlowNodeWithPointsTo).inferredValue() = bm and
+  call.getFunction().(AttrNode).getObject().(ControlFlowNodeWithPointsTo).inferredValue() = sup
 select call.getLocation().getStartLine(), call.toString(),
   bm.getFunction().getSource().(FunctionObject).getQualifiedName()
diff --git a/python/ql/test/library-tests/objects/Strings.ql b/python/ql/test/library-tests/objects/Strings.ql
index eca8dec51fd3..4c79df89dafd 100644
--- a/python/ql/test/library-tests/objects/Strings.ql
+++ b/python/ql/test/library-tests/objects/Strings.ql
@@ -1,5 +1,6 @@
 import python
+private import LegacyPointsTo
 
-from StringObject s, ControlFlowNode f
+from StringObject s, ControlFlowNodeWithPointsTo f
 where f.refersTo(s)
 select f.getLocation().toString(), s.getText()
diff --git a/python/ql/test/library-tests/taint/extensions/ExtensionsLib.qll b/python/ql/test/library-tests/taint/extensions/ExtensionsLib.qll
index 4ae53e94a381..e6874512f5cd 100644
--- a/python/ql/test/library-tests/taint/extensions/ExtensionsLib.qll
+++ b/python/ql/test/library-tests/taint/extensions/ExtensionsLib.qll
@@ -1,4 +1,5 @@
 import python
+private import LegacyPointsTo
 import semmle.python.dataflow.TaintTracking
 
 class SimpleTest extends TaintKind {
@@ -30,7 +31,7 @@ predicate visit_call(CallNode call, FunctionObject func) {
   exists(AttrNode attr, ClassObject cls, string name |
     name.matches("visit\\_%") and
     func = cls.lookupAttribute(name) and
-    attr.getObject("visit").refersTo(_, cls, _) and
+    attr.getObject("visit").(ControlFlowNodeWithPointsTo).refersTo(_, cls, _) and
     attr = call.getFunction()
   )
 }