diff --git a/.buildkite/pipeline.yaml b/.buildkite/pipeline.yaml
index 405ca6caa..20f1ccd53 100644
--- a/.buildkite/pipeline.yaml
+++ b/.buildkite/pipeline.yaml
@@ -409,53 +409,6 @@ steps:
       <<: *ubuntu_agents
       arch: "amd64"
 
-  # Runtime tests (LISAFS).
-  - <<: *common
-    label: ":php: PHP runtime tests (LISAFS)"
-    command: make RUNTIME_LOG_DIR=/tmp/$${BUILDKITE_JOB_ID} php8.1.1-runtime-tests_lisafs
-    parallelism: 10
-    if: build.message =~ /lisafs/ || build.branch == "master"
-    agents:
-      <<: *platform_specific_agents
-      <<: *ubuntu_agents
-      arch: "amd64"
-  - <<: *common
-    label: ":java: Java runtime tests (LISAFS)"
-    command: make RUNTIME_LOG_DIR=/tmp/$${BUILDKITE_JOB_ID} java17-runtime-tests_lisafs
-    parallelism: 40
-    if: build.message =~ /lisafs/ || build.branch == "master"
-    agents:
-      <<: *platform_specific_agents
-      <<: *ubuntu_agents
-      arch: "amd64"
-  - <<: *common
-    label: ":golang: Go runtime tests (LISAFS)"
-    command: make RUNTIME_LOG_DIR=/tmp/$${BUILDKITE_JOB_ID} go1.16-runtime-tests_lisafs
-    parallelism: 10
-    if: build.message =~ /lisafs/ || build.branch == "master"
-    agents:
-      <<: *platform_specific_agents
-      <<: *ubuntu_agents
-      arch: "amd64"
-  - <<: *common
-    label: ":node: NodeJS runtime tests (LISAFS)"
-    command: make RUNTIME_LOG_DIR=/tmp/$${BUILDKITE_JOB_ID} nodejs16.13.2-runtime-tests_lisafs
-    parallelism: 10
-    if: build.message =~ /lisafs/ || build.branch == "master"
-    agents:
-      <<: *platform_specific_agents
-      <<: *ubuntu_agents
-      arch: "amd64"
-  - <<: *common
-    label: ":python: Python runtime tests (LISAFS)"
-    command: make RUNTIME_LOG_DIR=/tmp/$${BUILDKITE_JOB_ID} python3.10.2-runtime-tests_lisafs
-    parallelism: 10
-    if: build.message =~ /lisafs/ || build.branch == "master"
-    agents:
-      <<: *platform_specific_agents
-      <<: *ubuntu_agents
-      arch: "amd64"
-
   # Run basic benchmarks smoke tests (no upload).
   - <<: *common
     label: ":fire: Benchmarks smoke test"
diff --git a/Makefile b/Makefile
index a0e4dd1ab..9e7ebc822 100644
--- a/Makefile
+++ b/Makefile
@@ -164,7 +164,6 @@ dev: $(RUNTIME_BIN) ## Installs a set of local runtimes. Requires sudo.
 	@$(call configure_noreload,$(RUNTIME)-p,--net-raw --profile)
 	@$(call configure_noreload,$(RUNTIME)-fuse-d,--net-raw --debug --strace --log-packets --fuse)
 	@$(call configure_noreload,$(RUNTIME)-cgroup-d,--net-raw --debug --strace --log-packets --cgroupfs)
-	@$(call configure_noreload,$(RUNTIME)-lisafs-d,--net-raw --debug --strace --log-packets --lisafs)
 	@$(call configure_noreload,$(RUNTIME)-systemd-d,--net-raw --debug --strace --log-packets --systemd-cgroup)
 	@$(call reload_docker)
 .PHONY: dev
@@ -247,10 +246,6 @@ RUNTIME_TESTS_FLAKY_SHORT_CIRCUIT ?= true
 	@$(call install_runtime,$(RUNTIME),--watchdog-action=panic)
 	@$(call test_runtime,$(RUNTIME),--test_timeout=1800 --test_env=RUNTIME_TESTS_FILTER=$(RUNTIME_TESTS_FILTER) --test_env=RUNTIME_TESTS_PER_TEST_TIMEOUT=$(RUNTIME_TESTS_PER_TEST_TIMEOUT) --test_env=RUNTIME_TESTS_RUNS_PER_TEST=$(RUNTIME_TESTS_RUNS_PER_TEST) --test_env=RUNTIME_TESTS_FLAKY_IS_ERROR=$(RUNTIME_TESTS_FLAKY_IS_ERROR) --test_env=RUNTIME_TESTS_FLAKY_SHORT_CIRCUIT=$(RUNTIME_TESTS_FLAKY_SHORT_CIRCUIT) //test/runtimes:$*)
 
-%-runtime-tests_lisafs: load-runtimes_% $(RUNTIME_BIN)
-	@$(call install_runtime,$(RUNTIME), --lisafs --watchdog-action=panic)
-	@$(call test_runtime,$(RUNTIME),--test_timeout=1800 --test_env=RUNTIME_TESTS_FILTER=$(RUNTIME_TESTS_FILTER) --test_env=RUNTIME_TESTS_PER_TEST_TIMEOUT=$(RUNTIME_TESTS_PER_TEST_TIMEOUT) --test_env=RUNTIME_TESTS_RUNS_PER_TEST=$(RUNTIME_TESTS_RUNS_PER_TEST) --test_env=RUNTIME_TESTS_FLAKY_IS_ERROR=$(RUNTIME_TESTS_FLAKY_IS_ERROR) --test_env=RUNTIME_TESTS_FLAKY_SHORT_CIRCUIT=$(RUNTIME_TESTS_FLAKY_SHORT_CIRCUIT) //test/runtimes:$*)
-
 do-tests: $(RUNTIME_BIN)
 	@$(RUNTIME_BIN) --rootless do true
 	@$(RUNTIME_BIN) --rootless -network=none do true
@@ -277,10 +272,6 @@ docker-tests: load-basic $(RUNTIME_BIN)
 	@$(call install_runtime,$(RUNTIME)-fdlimit,--fdlimit=2000)
 	@$(call install_runtime,$(RUNTIME)-dcache,--fdlimit=2000 --dcache=100)
 	@$(call test_runtime,$(RUNTIME),$(INTEGRATION_TARGETS) //test/e2e:integration_runtime_test)
-	@$(call install_runtime,$(RUNTIME), --lisafs) # Run again with lisafs.
-	@$(call install_runtime,$(RUNTIME)-fdlimit,--lisafs --fdlimit=2000)
-	@$(call install_runtime,$(RUNTIME)-dcache,--lisafs --fdlimit=2000 --dcache=100)
-	@$(call test_runtime,$(RUNTIME),$(INTEGRATION_TARGETS) //test/e2e:integration_runtime_test)
 .PHONY: docker-tests
 
 overlay-tests: load-basic $(RUNTIME_BIN)
diff --git a/runsc/boot/BUILD b/runsc/boot/BUILD
index 9571a9814..389bcb301 100644
--- a/runsc/boot/BUILD
+++ b/runsc/boot/BUILD
@@ -138,7 +138,6 @@ go_test(
         "//pkg/control/server",
         "//pkg/fspath",
         "//pkg/log",
-        "//pkg/p9",
         "//pkg/sentry/vfs",
         "//pkg/sync",
         "//pkg/unet",
diff --git a/runsc/boot/loader_test.go b/runsc/boot/loader_test.go
index 695b3c782..f6d20af93 100644
--- a/runsc/boot/loader_test.go
+++ b/runsc/boot/loader_test.go
@@ -26,7 +26,6 @@ import (
 	"gvisor.dev/gvisor/pkg/control/server"
 	"gvisor.dev/gvisor/pkg/fspath"
 	"gvisor.dev/gvisor/pkg/log"
-	"gvisor.dev/gvisor/pkg/p9"
 	"gvisor.dev/gvisor/pkg/sentry/vfs"
 	"gvisor.dev/gvisor/pkg/sync"
 	"gvisor.dev/gvisor/pkg/unet"
@@ -87,21 +86,19 @@ func startGofer(root string) (int, func(), error) {
 		unix.Close(goferEnd)
 		return 0, nil, fmt.Errorf("error creating server on FD %d: %v", goferEnd, err)
 	}
-	at, err := fsgofer.NewAttachPoint(root, fsgofer.Config{ROMount: true})
+	server := fsgofer.NewLisafsServer(fsgofer.Config{})
+	c, err := server.CreateConnection(socket, root, true /* readonly */)
 	if err != nil {
 		return 0, nil, err
 	}
-	go func() {
-		s := p9.NewServer(at)
-		if err := s.Handle(socket); err != nil {
-			log.Infof("Gofer is stopping. FD: %d, err: %v\n", goferEnd, err)
-		}
-	}()
+	server.StartConnection(c)
 	// Closing the gofer socket will stop the gofer and exit goroutine above.
 	cleanup := func() {
 		if err := socket.Close(); err != nil {
 			log.Warningf("Error closing gofer socket: %v", err)
 		}
+		server.Wait()
+		server.Destroy()
 	}
 	return sandboxEnd, cleanup, nil
 }
diff --git a/runsc/config/flags.go b/runsc/config/flags.go
index 513d66397..8d8e62bfa 100644
--- a/runsc/config/flags.go
+++ b/runsc/config/flags.go
@@ -81,7 +81,7 @@ func RegisterFlags(flagSet *flag.FlagSet) {
 	flagSet.Bool("fsgofer-host-uds", false, "allow the gofer to mount Unix Domain Sockets.")
 	flagSet.Bool("vfs2", true, "DEPRECATED: this flag has no effect.")
 	flagSet.Bool("fuse", false, "TEST ONLY; use while FUSE in VFSv2 is landing. This allows the use of the new experimental FUSE filesystem.")
-	flagSet.Bool("lisafs", false, "Enables lisafs protocol instead of 9P.")
+	flagSet.Bool("lisafs", true, "Enables lisafs protocol instead of 9P.")
 	flagSet.Bool("cgroupfs", false, "Automatically mount cgroupfs.")
 	flagSet.Bool("ignore-cgroups", false, "don't configure cgroups.")
 	flagSet.Int("fdlimit", -1, "Specifies a limit on the number of host file descriptors that can be open. Applies separately to the sentry and gofer. Note: each file in the sandbox holds more than one host FD open.")
diff --git a/test/runner/defs.bzl b/test/runner/defs.bzl
index a14818c15..4b4925135 100644
--- a/test/runner/defs.bzl
+++ b/test/runner/defs.bzl
@@ -69,7 +69,7 @@ def _syscall_test(
         file_access = "exclusive",
         overlay = False,
         add_uds_tree = False,
-        lisafs = False,
+        lisafs = True,
         fuse = False,
         container = None,
         **kwargs):
@@ -170,7 +170,6 @@ def syscall_test(
         add_overlay = False,
         add_uds_tree = False,
         add_hostinet = False,
-        add_lisafs = True,
         fuse = False,
         allow_native = True,
         debug = True,
@@ -185,7 +184,6 @@ def syscall_test(
       add_overlay: add an overlay test.
       add_uds_tree: add a UDS test.
       add_hostinet: add a hostinet test.
-      add_lisafs: add a lisafs test.
       fuse: enable FUSE support.
       allow_native: generate a native test variant.
       debug: enable debug output.
@@ -222,20 +220,19 @@ def syscall_test(
             **kwargs
         )
 
-    if add_lisafs:
-        # Generate a *_lisafs variant with the default platform.
-        _syscall_test(
-            test = test,
-            platform = default_platform,
-            use_tmpfs = use_tmpfs,
-            add_uds_tree = add_uds_tree,
-            tags = platforms[default_platform] + tags + ["lisafs"],
-            debug = debug,
-            fuse = fuse,
-            container = container,
-            lisafs = True,
-            **kwargs
-        )
+    # Generate a P9 variant with the default platform.
+    _syscall_test(
+        test = test,
+        platform = default_platform,
+        use_tmpfs = use_tmpfs,
+        add_uds_tree = add_uds_tree,
+        tags = platforms[default_platform] + tags,
+        debug = debug,
+        fuse = fuse,
+        container = container,
+        lisafs = False,
+        **kwargs
+    )
     if add_overlay:
         _syscall_test(
             test = test,
diff --git a/test/runner/main.go b/test/runner/main.go
index 97f8b96a4..468f318e5 100644
--- a/test/runner/main.go
+++ b/test/runner/main.go
@@ -51,7 +51,7 @@ var (
 	fileAccess         = flag.String("file-access", "exclusive", "mounts root in exclusive or shared mode")
 	overlay            = flag.Bool("overlay", false, "wrap filesystem mounts with writable tmpfs overlay")
 	fuse               = flag.Bool("fuse", false, "enable FUSE")
-	lisafs             = flag.Bool("lisafs", false, "enable lisafs protocol if vfs2 is also enabled")
+	lisafs             = flag.Bool("lisafs", true, "enable lisafs protocol if vfs2 is also enabled")
 	container          = flag.Bool("container", false, "run tests in their own namespaces (user ns, network ns, etc), pretending to be root. Implicitly enabled if network=host, or if using network namespaces")
 	setupContainerPath = flag.String("setup-container", "", "path to setup_container binary (for use with --container)")
 	trace              = flag.Bool("trace", false, "enables all trace points")
@@ -195,6 +195,7 @@ func runRunsc(tc gtest.TestCase, spec *specs.Spec) error {
 		"-TESTONLY-allow-packet-endpoint-write=true",
 		"-net-raw=true",
 		fmt.Sprintf("-panic-signal=%d", unix.SIGTERM),
+		fmt.Sprintf("-lisafs=%t", *lisafs),
 		"-watchdog-action=panic",
 		"-platform", *platform,
 		"-file-access", *fileAccess,
@@ -205,9 +206,6 @@ func runRunsc(tc gtest.TestCase, spec *specs.Spec) error {
 	if *fuse {
 		args = append(args, "-fuse")
 	}
-	if *lisafs {
-		args = append(args, "-lisafs")
-	}
 	if *debug {
 		args = append(args, "-debug", "-log-packets=true")
 	}