diff --git a/packages/@aws-cdk/toolkit/.eslintrc.js b/packages/@aws-cdk/toolkit/.eslintrc.js
index 72af6da5766c9..4f2d392811098 100644
--- a/packages/@aws-cdk/toolkit/.eslintrc.js
+++ b/packages/@aws-cdk/toolkit/.eslintrc.js
@@ -10,4 +10,13 @@ baseConfig.overrides.push({
   },
 });
 
+// all aws-cdk files must be loaded through lib/api/aws-cdk.ts
+baseConfig.rules['import/no-restricted-paths'] = ['error', {
+  zones: [{
+    target: './',
+    from: '../../aws-cdk',
+    message: "All `aws-cdk` code must be used via lib/api/aws-cdk.ts",
+  }]
+}];
+
 module.exports = baseConfig;
diff --git a/packages/@aws-cdk/toolkit/lib/api/aws-cdk.ts b/packages/@aws-cdk/toolkit/lib/api/aws-cdk.ts
index 5fe454011acd5..037ed505043dd 100644
--- a/packages/@aws-cdk/toolkit/lib/api/aws-cdk.ts
+++ b/packages/@aws-cdk/toolkit/lib/api/aws-cdk.ts
@@ -1,3 +1,5 @@
+/* eslint-disable import/no-restricted-paths */
+export { formatErrorMessage } from '../../../../aws-cdk/lib/util/error';
 export { DEFAULT_TOOLKIT_STACK_NAME, SdkProvider } from '../../../../aws-cdk/lib/api';
 export type { SuccessfulDeployStackResult } from '../../../../aws-cdk/lib/api';
 export { formatSdkLoggerContent } from '../../../../aws-cdk/lib/api/aws-auth/sdk-logger';
diff --git a/packages/@aws-cdk/toolkit/lib/toolkit/toolkit.ts b/packages/@aws-cdk/toolkit/lib/toolkit/toolkit.ts
index f3cbc681ded4b..421740526930f 100644
--- a/packages/@aws-cdk/toolkit/lib/toolkit/toolkit.ts
+++ b/packages/@aws-cdk/toolkit/lib/toolkit/toolkit.ts
@@ -4,7 +4,6 @@ import * as chalk from 'chalk';
 import * as chokidar from 'chokidar';
 import * as fs from 'fs-extra';
 import { ToolkitServices } from './private';
-import { formatErrorMessage } from '../../../../aws-cdk/lib/util/error';
 import { AssetBuildTime, DeployOptions, RequireApproval } from '../actions/deploy';
 import { buildParameterMap, removePublishedAssets } from '../actions/deploy/private';
 import { DestroyOptions } from '../actions/destroy';
@@ -15,7 +14,7 @@ import { RollbackOptions } from '../actions/rollback';
 import { SynthOptions } from '../actions/synth';
 import { patternsArrayForWatch, WatchOptions } from '../actions/watch';
 import { SdkOptions } from '../api/aws-auth';
-import { DEFAULT_TOOLKIT_STACK_NAME, SdkProvider, SuccessfulDeployStackResult, StackCollection, Deployments, HotswapMode, StackActivityProgress, ResourceMigrator, obscureTemplate, serializeStructure, tagsForStack, CliIoHost, validateSnsTopicArn, Concurrency, WorkGraphBuilder, AssetBuildNode, AssetPublishNode, StackNode } from '../api/aws-cdk';
+import { DEFAULT_TOOLKIT_STACK_NAME, SdkProvider, SuccessfulDeployStackResult, StackCollection, Deployments, HotswapMode, StackActivityProgress, ResourceMigrator, obscureTemplate, serializeStructure, tagsForStack, CliIoHost, validateSnsTopicArn, Concurrency, WorkGraphBuilder, AssetBuildNode, AssetPublishNode, StackNode, formatErrorMessage } from '../api/aws-cdk';
 import { CachedCloudAssemblySource, IdentityCloudAssemblySource, StackAssembly, ICloudAssemblySource, StackSelectionStrategy } from '../api/cloud-assembly';
 import { ALL_STACKS, CloudAssemblySourceBuilder } from '../api/cloud-assembly/private';
 import { ToolkitError } from '../api/errors';