diff --git a/.changeset/blue-bags-try.md b/.changeset/blue-bags-try.md
new file mode 100644
index 000000000..985dca50b
--- /dev/null
+++ b/.changeset/blue-bags-try.md
@@ -0,0 +1,5 @@
+---
+'@hypermod/cli': minor
+---
+
+Dependency fetching is now done via the loader module on install via reading a small config in a package.json.
diff --git a/.changeset/old-sloths-sell.md b/.changeset/old-sloths-sell.md
new file mode 100644
index 000000000..0b4a58d28
--- /dev/null
+++ b/.changeset/old-sloths-sell.md
@@ -0,0 +1,5 @@
+---
+'@hypermod/fetcher': minor
+---
+
+Removes whitelist dependency fetching, this approach no longer works.
diff --git a/packages/cli/src/main.ts b/packages/cli/src/main.ts
index 4a2b3b325..1f7efc04d 100644
--- a/packages/cli/src/main.ts
+++ b/packages/cli/src/main.ts
@@ -16,29 +16,54 @@ import { mergeConfigs } from './utils/merge-configs';
 import { fetchConfigsForWorkspaces, getPackageJson } from './utils/file-system';
 import { getConfigPrompt, getMultiConfigPrompt } from './prompt';
 
-const ExperimentalModuleLoader = () => ({
-  install: async (packageName: string) =>
-    await installPackage(packageName, {
-      cwd: __dirname,
-      packageManager: 'npm',
-      additionalArgs: ['--force'],
-    }),
-  require: (packageName: string) => require(packageName),
-  getInfo: (packageName: string) => {
+const ExperimentalModuleLoader = () => {
+  const getInfo = (packageName: string) => {
     const entryPath = require.resolve(packageName);
     const location = entryPath.split(packageName)[0] + packageName;
-    const packageJsonRaw = fs.readFileSync(
+    const pkgJsonRaw = fs.readFileSync(
       path.join(location, 'package.json'),
       'utf8',
     );
+    const pkgJson = JSON.parse(pkgJsonRaw);
 
     return {
       location,
       entryPath,
-      pkgJson: JSON.parse(packageJsonRaw),
+      pkgJson,
     };
-  },
-});
+  };
+
+  const install = async (packageName: string) => {
+    await installPackage(packageName, {
+      cwd: __dirname,
+      packageManager: 'npm',
+      additionalArgs: ['--force'],
+    });
+
+    const { pkgJson } = getInfo(packageName);
+
+    // Install whitelisted devDependencies
+    if (pkgJson?.hypermod?.dependencies) {
+      await Promise.all(
+        pkgJson.hypermod.dependencies.map((dep: string) => {
+          const version = pkgJson.devDependencies[dep];
+          if (!version) return;
+          return installPackage(`${dep}@${version}`, {
+            cwd: __dirname,
+            packageManager: 'npm',
+            additionalArgs: ['--force'],
+          });
+        }),
+      );
+    }
+  };
+
+  return {
+    install,
+    getInfo,
+    require: (packageName: string) => require(packageName),
+  };
+};
 
 export default async function main(
   paths: string[],
diff --git a/packages/fetcher/src/index.ts b/packages/fetcher/src/index.ts
index 3ee3bce6b..11774d82a 100644
--- a/packages/fetcher/src/index.ts
+++ b/packages/fetcher/src/index.ts
@@ -147,26 +147,6 @@ export async function fetchRemotePackage(
     const pkg = packageManager.require(packageName);
     const configExport = resolveConfigExport(pkg);
 
-    // Install whitelisted deps
-    if (
-      // @ts-expect-error legacy module loader doesn't know about these properties
-      info.pkgJson &&
-      // @ts-expect-error legacy module loader doesn't know about these properties
-      info.pkgJson.devDependencies &&
-      configExport.dependencies
-    ) {
-      await Promise.all(
-        configExport.dependencies.map(dep => {
-          // @ts-expect-error legacy module loader doesn't know about these properties
-          const version = info.pkgJson.devDependencies[dep];
-
-          if (!version) return;
-
-          return packageManager.install(`${dep}@${version}`);
-        }),
-      );
-    }
-
     if (configExport.transforms || configExport.presets) {
       return {
         filePath: info.location,
diff --git a/website/docs/configuration.mdx b/website/docs/configuration.mdx
index 1afb0b8c8..ee6783001 100644
--- a/website/docs/configuration.mdx
+++ b/website/docs/configuration.mdx
@@ -65,15 +65,3 @@ Targets list the packages that the codemod package targets.
 This is useful for Hypermod packages that have codemods targeting multiple related packages at the same time, such as packages from a monorepo.
 
 For example: `targets: ['@foo/bar', '@foo/baz']`
-
-### `dependencies`
-
-(Experimental feature, this will only work when the `--experimental-loader` flag is specified)
-
-A list of dependencies to be installed before running the transform. These are useful when co-locating codemods with an existing
-package and want to specify a whitelist of `devDependencies` to be installed only when run via `@hypermod/cli`.
-This avoids codemod-related dependencies from unnecessarily increasing the bundlesize for regular consumers of the package.
-
-Note: the versions installed are based on what's specified in the `package.json`
-
-Example: `dependencies: ['@hypermod/utils', 'postcss', 'postcss-less']`