diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index 1255f676..8eb12852 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -2,12 +2,12 @@ builds:
   - id: &build_id_ssh_inscribe ssh-inscribe
     env:
       - CGO_ENABLED=0
-    main: .
+    main: ./cmd/ssh-inscribe
     binary: ssh-inscribe
     ldflags:
-      - -X github.com/aakso/ssh-inscribe/pkg/globals.version={{ .Version }}
-      - -X github.com/aakso/ssh-inscribe/pkg/globals.confDir=/etc/ssh-inscribe
-      - -X github.com/aakso/ssh-inscribe/pkg/globals.varDir=/var/lib/ssh-inscribe
+      - -X github.com/aakso/ssh-inscribe/internal/globals.version={{ .Version }}
+      - -X github.com/aakso/ssh-inscribe/internal/globals.confDir=/etc/ssh-inscribe
+      - -X github.com/aakso/ssh-inscribe/internal/globals.varDir=/var/lib/ssh-inscribe
     goos: [darwin, linux]
     goarch: [amd64, arm64]
     ignore:
@@ -17,10 +17,10 @@ builds:
   - id: &build_id_sshi sshi
     env:
       - CGO_ENABLED=0
-    main: ./cliclient/sshi
+    main: ./cmd/sshi
     binary: sshi
     ldflags:
-      - -X github.com/aakso/ssh-inscribe/pkg/globals.version={{ .Version }}
+      - -X github.com/aakso/ssh-inscribe/internal/globals.version={{ .Version }}
     goos: [darwin, linux, windows]
     goarch: [amd64, arm64]
     ignore:
diff --git a/Makefile b/Makefile
index 78270c86..c536913c 100644
--- a/Makefile
+++ b/Makefile
@@ -20,5 +20,5 @@ dist:
 
 .PHONY: test
 test:
-	go test $(shell git grep  -l '!race' ./pkg | xargs -n 1 dirname | uniq | sed 's/^/\.\//')
-	go test -race ./pkg/...
+	go test $(shell git grep  -l '!race' ./internal | xargs -n 1 dirname | uniq | sed 's/^/\.\//')
+	go test -race ./internal/...
diff --git a/cliclient/sshi/main.go b/cliclient/sshi/main.go
deleted file mode 100644
index 3105b329..00000000
--- a/cliclient/sshi/main.go
+++ /dev/null
@@ -1,15 +0,0 @@
-package main
-
-import (
-	"fmt"
-	"os"
-
-	"github.com/aakso/ssh-inscribe/cliclient/cmd"
-)
-
-func main() {
-	if err := cmd.RootCmd.Execute(); err != nil {
-		fmt.Println(err)
-		os.Exit(-1)
-	}
-}
diff --git a/cmd/crypt.go b/cmd/ssh-inscribe/crypt.go
similarity index 98%
rename from cmd/crypt.go
rename to cmd/ssh-inscribe/crypt.go
index 25094ada..17490237 100644
--- a/cmd/crypt.go
+++ b/cmd/ssh-inscribe/crypt.go
@@ -1,4 +1,4 @@
-package cmd
+package main
 
 import (
 	"fmt"
diff --git a/cmd/defaults.go b/cmd/ssh-inscribe/defaults.go
similarity index 76%
rename from cmd/defaults.go
rename to cmd/ssh-inscribe/defaults.go
index e6380841..8cd2ae27 100644
--- a/cmd/defaults.go
+++ b/cmd/ssh-inscribe/defaults.go
@@ -1,13 +1,14 @@
-package cmd
+package main
 
 import (
 	"fmt"
 
-	_ "github.com/aakso/ssh-inscribe/pkg/auth/backend/all"
-	"github.com/aakso/ssh-inscribe/pkg/config"
-	_ "github.com/aakso/ssh-inscribe/pkg/server"
 	"github.com/spf13/cobra"
 	"gopkg.in/yaml.v2"
+
+	_ "github.com/aakso/ssh-inscribe/internal/auth/backend/all"
+	"github.com/aakso/ssh-inscribe/internal/config"
+	_ "github.com/aakso/ssh-inscribe/internal/server"
 )
 
 // serverCmd represents the server command
diff --git a/main.go b/cmd/ssh-inscribe/main.go
similarity index 84%
rename from main.go
rename to cmd/ssh-inscribe/main.go
index a156a3c1..71eab25d 100644
--- a/main.go
+++ b/cmd/ssh-inscribe/main.go
@@ -14,8 +14,14 @@
 
 package main
 
-import "github.com/aakso/ssh-inscribe/cmd"
+import (
+	"fmt"
+	"os"
+)
 
 func main() {
-	cmd.Execute()
+	if err := RootCmd.Execute(); err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(-1)
+	}
 }
diff --git a/cmd/root.go b/cmd/ssh-inscribe/root.go
similarity index 80%
rename from cmd/root.go
rename to cmd/ssh-inscribe/root.go
index 9c65eb7d..a32b5bd9 100644
--- a/cmd/root.go
+++ b/cmd/ssh-inscribe/root.go
@@ -1,14 +1,15 @@
-package cmd
+package main
 
 import (
 	"fmt"
 	"os"
 	"path"
 
-	"github.com/aakso/ssh-inscribe/pkg/config"
-	"github.com/aakso/ssh-inscribe/pkg/logging"
 	"github.com/pkg/errors"
 	"github.com/spf13/cobra"
+
+	"github.com/aakso/ssh-inscribe/internal/config"
+	"github.com/aakso/ssh-inscribe/internal/logging"
 )
 
 var cfgFile string
@@ -20,13 +21,6 @@ var RootCmd = &cobra.Command{
 	Long:  "",
 }
 
-func Execute() {
-	if err := RootCmd.Execute(); err != nil {
-		fmt.Println(err)
-		os.Exit(-1)
-	}
-}
-
 func init() {
 	cobra.OnInitialize(rootInit)
 	RootCmd.PersistentFlags().StringVar(
diff --git a/cmd/server.go b/cmd/ssh-inscribe/server.go
similarity index 89%
rename from cmd/server.go
rename to cmd/ssh-inscribe/server.go
index 301e23d1..bc5cd04c 100644
--- a/cmd/server.go
+++ b/cmd/ssh-inscribe/server.go
@@ -1,8 +1,9 @@
-package cmd
+package main
 
 import (
-	"github.com/aakso/ssh-inscribe/pkg/server"
 	"github.com/spf13/cobra"
+
+	"github.com/aakso/ssh-inscribe/internal/server"
 )
 
 // serverCmd represents the server command
diff --git a/cmd/version.go b/cmd/ssh-inscribe/version.go
similarity index 88%
rename from cmd/version.go
rename to cmd/ssh-inscribe/version.go
index d672fdc7..bd41665c 100644
--- a/cmd/version.go
+++ b/cmd/ssh-inscribe/version.go
@@ -1,10 +1,11 @@
-package cmd
+package main
 
 import (
 	"fmt"
 
-	"github.com/aakso/ssh-inscribe/pkg/globals"
 	"github.com/spf13/cobra"
+
+	"github.com/aakso/ssh-inscribe/internal/globals"
 )
 
 // serverCmd represents the server command
diff --git a/cliclient/cmd/ca.go b/cmd/sshi/ca.go
similarity index 94%
rename from cliclient/cmd/ca.go
rename to cmd/sshi/ca.go
index adcf8726..652717c8 100644
--- a/cliclient/cmd/ca.go
+++ b/cmd/sshi/ca.go
@@ -1,4 +1,4 @@
-package cmd
+package main
 
 import (
 	"fmt"
@@ -7,7 +7,7 @@ import (
 	"github.com/spf13/cobra"
 	"golang.org/x/crypto/ssh"
 
-	"github.com/aakso/ssh-inscribe/pkg/client"
+	"github.com/aakso/ssh-inscribe/internal/ui"
 )
 
 var principals []string
@@ -23,7 +23,7 @@ var ShowCaCmd = &cobra.Command{
 	Args:              cobra.NoArgs,
 	ValidArgsFunction: cobra.NoFileCompletions,
 	RunE: func(cmd *cobra.Command, args []string) error {
-		c := &client.Client{
+		c := &ui.Client{
 			Config: ClientConfig,
 		}
 		defer c.Close()
@@ -51,7 +51,7 @@ var AddCaCmd = &cobra.Command{
 		if len(args) > 0 {
 			ClientConfig.CAKeyFile = args[0]
 		}
-		c := &client.Client{
+		c := &ui.Client{
 			Config: ClientConfig,
 		}
 		defer c.Close()
@@ -65,7 +65,7 @@ var ResponseCmd = &cobra.Command{
 	Args:              cobra.NoArgs,
 	ValidArgsFunction: cobra.NoFileCompletions,
 	RunE: func(cmd *cobra.Command, args []string) error {
-		c := &client.Client{
+		c := &ui.Client{
 			Config: ClientConfig,
 		}
 		defer c.Close()
diff --git a/cliclient/cmd/exec.go b/cmd/sshi/exec.go
similarity index 93%
rename from cliclient/cmd/exec.go
rename to cmd/sshi/exec.go
index d60ed42a..36e5f1f7 100644
--- a/cliclient/cmd/exec.go
+++ b/cmd/sshi/exec.go
@@ -1,4 +1,4 @@
-package cmd
+package main
 
 import (
 	"fmt"
@@ -14,10 +14,10 @@ import (
 	"github.com/spf13/cobra"
 	"golang.org/x/crypto/ssh/agent"
 
-	"github.com/aakso/ssh-inscribe/pkg/client"
-	"github.com/aakso/ssh-inscribe/pkg/filteringagent"
-	"github.com/aakso/ssh-inscribe/pkg/logging"
-	"github.com/aakso/ssh-inscribe/pkg/util"
+	"github.com/aakso/ssh-inscribe/internal/filteringagent"
+	"github.com/aakso/ssh-inscribe/internal/logging"
+	"github.com/aakso/ssh-inscribe/internal/ui"
+	"github.com/aakso/ssh-inscribe/internal/util"
 )
 
 const (
@@ -80,7 +80,7 @@ func runExecCommand(args []string) error {
 		}
 	}
 	ClientConfig.GenerateKeypair = true
-	c := &client.Client{Config: ClientConfig}
+	c := &ui.Client{Config: ClientConfig}
 	defer c.Close()
 	if err := c.Login(); err != nil {
 		return err
diff --git a/cmd/sshi/main.go b/cmd/sshi/main.go
new file mode 100644
index 00000000..bb924801
--- /dev/null
+++ b/cmd/sshi/main.go
@@ -0,0 +1,13 @@
+package main
+
+import (
+	"fmt"
+	"os"
+)
+
+func main() {
+	if err := RootCmd.Execute(); err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(-1)
+	}
+}
diff --git a/cliclient/cmd/request.go b/cmd/sshi/request.go
similarity index 97%
rename from cliclient/cmd/request.go
rename to cmd/sshi/request.go
index ee5ecae5..675f2aa6 100644
--- a/cliclient/cmd/request.go
+++ b/cmd/sshi/request.go
@@ -1,12 +1,13 @@
-package cmd
+package main
 
 import (
 	"fmt"
 	"os"
 	"strconv"
 
-	"github.com/aakso/ssh-inscribe/pkg/client"
 	"github.com/spf13/cobra"
+
+	"github.com/aakso/ssh-inscribe/internal/ui"
 )
 
 var ReqCmd = &cobra.Command{
@@ -15,7 +16,7 @@ var ReqCmd = &cobra.Command{
 	Args:              cobra.NoArgs,
 	ValidArgsFunction: cobra.NoFileCompletions,
 	RunE: func(cmd *cobra.Command, args []string) error {
-		c := &client.Client{
+		c := &ui.Client{
 			Config: ClientConfig,
 		}
 		defer c.Close()
diff --git a/cliclient/cmd/root.go b/cmd/sshi/root.go
similarity index 98%
rename from cliclient/cmd/root.go
rename to cmd/sshi/root.go
index 32371c44..4d909086 100644
--- a/cliclient/cmd/root.go
+++ b/cmd/sshi/root.go
@@ -1,4 +1,4 @@
-package cmd
+package main
 
 import (
 	"fmt"
@@ -9,8 +9,8 @@ import (
 
 	"github.com/spf13/cobra"
 
-	"github.com/aakso/ssh-inscribe/pkg/client"
-	"github.com/aakso/ssh-inscribe/pkg/logging"
+	"github.com/aakso/ssh-inscribe/internal/logging"
+	"github.com/aakso/ssh-inscribe/internal/ui"
 )
 
 var RootCmd = &cobra.Command{
@@ -19,7 +19,7 @@ var RootCmd = &cobra.Command{
 	SilenceErrors: true,
 	SilenceUsage:  true,
 }
-var ClientConfig = &client.Config{
+var ClientConfig = &ui.Config{
 	UseAgent:            true,
 	Timeout:             2 * time.Second,
 	Retries:             3,
@@ -173,7 +173,7 @@ func init() {
 		"Login to specific auth endpoints ($SSH_INSCRIBE_LOGIN_AUTH_ENDPOINTS)",
 	)
 	_ = RootCmd.RegisterFlagCompletionFunc("login", func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
-		c := &client.Client{
+		c := &ui.Client{
 			Config: ClientConfig,
 		}
 		defer c.Close()
diff --git a/cliclient/cmd/ssh.go b/cmd/sshi/ssh.go
similarity index 99%
rename from cliclient/cmd/ssh.go
rename to cmd/sshi/ssh.go
index 019618ca..82034df7 100644
--- a/cliclient/cmd/ssh.go
+++ b/cmd/sshi/ssh.go
@@ -1,4 +1,4 @@
-package cmd
+package main
 
 import (
 	"bufio"
diff --git a/cliclient/cmd/version.go b/cmd/sshi/version.go
similarity index 82%
rename from cliclient/cmd/version.go
rename to cmd/sshi/version.go
index 17ad49c2..ad51152d 100644
--- a/cliclient/cmd/version.go
+++ b/cmd/sshi/version.go
@@ -1,13 +1,14 @@
-package cmd
+package main
 
 import (
 	"fmt"
 	"os"
 
-	"github.com/aakso/ssh-inscribe/pkg/client"
+	"github.com/aakso/ssh-inscribe/internal/ui"
 
-	"github.com/aakso/ssh-inscribe/pkg/globals"
 	"github.com/spf13/cobra"
+
+	"github.com/aakso/ssh-inscribe/internal/globals"
 )
 
 // versionCmd represents the version command
@@ -18,7 +19,7 @@ var versionCmd = &cobra.Command{
 	Args:              cobra.NoArgs,
 	ValidArgsFunction: cobra.NoFileCompletions,
 	RunE: func(cmd *cobra.Command, args []string) error {
-		c := &client.Client{Config: ClientConfig}
+		c := &ui.Client{Config: ClientConfig}
 		fmt.Printf("local: %s\n", globals.Version())
 
 		if ClientConfig.URL == "" {
diff --git a/pkg/auth/auth.go b/internal/auth/auth.go
similarity index 100%
rename from pkg/auth/auth.go
rename to internal/auth/auth.go
diff --git a/pkg/auth/authz/authzfilter/init.go b/internal/auth/authz/authzfilter/init.go
similarity index 76%
rename from pkg/auth/authz/authzfilter/init.go
rename to internal/auth/authz/authzfilter/init.go
index e490f7f6..3b86f340 100644
--- a/pkg/auth/authz/authzfilter/init.go
+++ b/internal/auth/authz/authzfilter/init.go
@@ -2,7 +2,8 @@ package authzfilter
 
 import (
 	"github.com/sirupsen/logrus"
-	"github.com/aakso/ssh-inscribe/pkg/logging"
+
+	"github.com/aakso/ssh-inscribe/internal/logging"
 )
 
 var Log *logrus.Entry = logging.GetLogger("authzfilter").WithField("pkg", "auth/authz/authzfilter")
diff --git a/pkg/auth/authz/authzfilter/principal_filter.go b/internal/auth/authz/authzfilter/principal_filter.go
similarity index 98%
rename from pkg/auth/authz/authzfilter/principal_filter.go
rename to internal/auth/authz/authzfilter/principal_filter.go
index 1a350549..03a15adf 100644
--- a/pkg/auth/authz/authzfilter/principal_filter.go
+++ b/internal/auth/authz/authzfilter/principal_filter.go
@@ -1,10 +1,11 @@
 package authzfilter
 
 import (
-	"github.com/sirupsen/logrus"
-	"github.com/aakso/ssh-inscribe/pkg/auth"
 	"github.com/gobwas/glob"
 	"github.com/pkg/errors"
+	"github.com/sirupsen/logrus"
+
+	"github.com/aakso/ssh-inscribe/internal/auth"
 )
 
 type PrincipalFilterConfig struct {
diff --git a/pkg/auth/authz/authzfilter/principal_filter_test.go b/internal/auth/authz/authzfilter/principal_filter_test.go
similarity index 96%
rename from pkg/auth/authz/authzfilter/principal_filter_test.go
rename to internal/auth/authz/authzfilter/principal_filter_test.go
index 97f60d7c..b03fb898 100644
--- a/pkg/auth/authz/authzfilter/principal_filter_test.go
+++ b/internal/auth/authz/authzfilter/principal_filter_test.go
@@ -7,8 +7,8 @@ import (
 	"github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/assert"
 
-	"github.com/aakso/ssh-inscribe/pkg/auth"
-	"github.com/aakso/ssh-inscribe/pkg/logging"
+	"github.com/aakso/ssh-inscribe/internal/auth"
+	"github.com/aakso/ssh-inscribe/internal/logging"
 )
 
 func authContext() *auth.AuthContext {
diff --git a/internal/auth/backend/all/init.go b/internal/auth/backend/all/init.go
new file mode 100644
index 00000000..cde1e7b6
--- /dev/null
+++ b/internal/auth/backend/all/init.go
@@ -0,0 +1,7 @@
+package all
+
+import (
+	_ "github.com/aakso/ssh-inscribe/internal/auth/backend/authfile"
+	_ "github.com/aakso/ssh-inscribe/internal/auth/backend/authldap"
+	_ "github.com/aakso/ssh-inscribe/internal/auth/backend/authoidc"
+)
diff --git a/pkg/auth/backend/authfile/auth.go b/internal/auth/backend/authfile/auth.go
similarity index 98%
rename from pkg/auth/backend/authfile/auth.go
rename to internal/auth/backend/authfile/auth.go
index f8967986..bbae0949 100644
--- a/pkg/auth/backend/authfile/auth.go
+++ b/internal/auth/backend/authfile/auth.go
@@ -8,9 +8,10 @@ import (
 
 	"golang.org/x/crypto/bcrypt"
 
-	"github.com/sirupsen/logrus"
-	"github.com/aakso/ssh-inscribe/pkg/auth"
 	"github.com/pkg/errors"
+	"github.com/sirupsen/logrus"
+
+	"github.com/aakso/ssh-inscribe/internal/auth"
 )
 
 type AuthFile struct {
diff --git a/pkg/auth/backend/authfile/auth_test.go b/internal/auth/backend/authfile/auth_test.go
similarity index 95%
rename from pkg/auth/backend/authfile/auth_test.go
rename to internal/auth/backend/authfile/auth_test.go
index 20ceb69b..2b57877d 100644
--- a/pkg/auth/backend/authfile/auth_test.go
+++ b/internal/auth/backend/authfile/auth_test.go
@@ -7,9 +7,10 @@ import (
 	"testing"
 
 	"github.com/sirupsen/logrus"
-	"github.com/aakso/ssh-inscribe/pkg/auth"
-	"github.com/aakso/ssh-inscribe/pkg/logging"
 	"github.com/stretchr/testify/assert"
+
+	"github.com/aakso/ssh-inscribe/internal/auth"
+	"github.com/aakso/ssh-inscribe/internal/logging"
 )
 
 var tmpfiles []string
diff --git a/pkg/auth/backend/authfile/config.go b/internal/auth/backend/authfile/config.go
similarity index 82%
rename from pkg/auth/backend/authfile/config.go
rename to internal/auth/backend/authfile/config.go
index 42e32472..97c1e90e 100644
--- a/pkg/auth/backend/authfile/config.go
+++ b/internal/auth/backend/authfile/config.go
@@ -3,7 +3,7 @@ package authfile
 import (
 	"path"
 
-	"github.com/aakso/ssh-inscribe/pkg/globals"
+	"github.com/aakso/ssh-inscribe/internal/globals"
 )
 
 type Config struct {
diff --git a/pkg/auth/backend/authfile/init.go b/internal/auth/backend/authfile/init.go
similarity index 79%
rename from pkg/auth/backend/authfile/init.go
rename to internal/auth/backend/authfile/init.go
index bbb9cbf7..19ecf079 100644
--- a/pkg/auth/backend/authfile/init.go
+++ b/internal/auth/backend/authfile/init.go
@@ -1,12 +1,13 @@
 package authfile
 
 import (
-	"github.com/aakso/ssh-inscribe/pkg/auth"
-	"github.com/aakso/ssh-inscribe/pkg/auth/backend"
-	"github.com/aakso/ssh-inscribe/pkg/config"
-	"github.com/aakso/ssh-inscribe/pkg/logging"
 	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
+
+	"github.com/aakso/ssh-inscribe/internal/auth"
+	"github.com/aakso/ssh-inscribe/internal/auth/backend"
+	"github.com/aakso/ssh-inscribe/internal/config"
+	"github.com/aakso/ssh-inscribe/internal/logging"
 )
 
 var Log *logrus.Entry = logging.GetLogger("authfile").WithField("pkg", "auth/backend/authfile")
diff --git a/pkg/auth/backend/authldap/auth.go b/internal/auth/backend/authldap/auth.go
similarity index 99%
rename from pkg/auth/backend/authldap/auth.go
rename to internal/auth/backend/authldap/auth.go
index 0d26b005..8ce8708b 100644
--- a/pkg/auth/backend/authldap/auth.go
+++ b/internal/auth/backend/authldap/auth.go
@@ -10,9 +10,10 @@ import (
 
 	ldap "gopkg.in/ldap.v2"
 
-	"github.com/sirupsen/logrus"
-	"github.com/aakso/ssh-inscribe/pkg/auth"
 	"github.com/pkg/errors"
+	"github.com/sirupsen/logrus"
+
+	"github.com/aakso/ssh-inscribe/internal/auth"
 )
 
 const (
diff --git a/pkg/auth/backend/authldap/auth_test.go b/internal/auth/backend/authldap/auth_test.go
similarity index 95%
rename from pkg/auth/backend/authldap/auth_test.go
rename to internal/auth/backend/authldap/auth_test.go
index 634f298d..e884b2d0 100644
--- a/pkg/auth/backend/authldap/auth_test.go
+++ b/internal/auth/backend/authldap/auth_test.go
@@ -1,3 +1,4 @@
+//go:build !race
 // +build !race
 
 package authldap
@@ -11,10 +12,11 @@ import (
 	"time"
 
 	"github.com/sirupsen/logrus"
-	"github.com/aakso/ssh-inscribe/pkg/auth"
-	"github.com/aakso/ssh-inscribe/pkg/logging"
 	"github.com/stretchr/testify/assert"
 	"github.com/vjeantet/ldapserver"
+
+	"github.com/aakso/ssh-inscribe/internal/auth"
+	"github.com/aakso/ssh-inscribe/internal/logging"
 )
 
 var (
diff --git a/pkg/auth/backend/authldap/config.go b/internal/auth/backend/authldap/config.go
similarity index 100%
rename from pkg/auth/backend/authldap/config.go
rename to internal/auth/backend/authldap/config.go
diff --git a/pkg/auth/backend/authldap/init.go b/internal/auth/backend/authldap/init.go
similarity index 79%
rename from pkg/auth/backend/authldap/init.go
rename to internal/auth/backend/authldap/init.go
index 226c71a1..9d1d9565 100644
--- a/pkg/auth/backend/authldap/init.go
+++ b/internal/auth/backend/authldap/init.go
@@ -1,12 +1,13 @@
 package authldap
 
 import (
-	"github.com/aakso/ssh-inscribe/pkg/auth"
-	"github.com/aakso/ssh-inscribe/pkg/auth/backend"
-	"github.com/aakso/ssh-inscribe/pkg/config"
-	"github.com/aakso/ssh-inscribe/pkg/logging"
 	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
+
+	"github.com/aakso/ssh-inscribe/internal/auth"
+	"github.com/aakso/ssh-inscribe/internal/auth/backend"
+	"github.com/aakso/ssh-inscribe/internal/config"
+	"github.com/aakso/ssh-inscribe/internal/logging"
 )
 
 var Log *logrus.Entry = logging.GetLogger("authldap").WithField("pkg", "auth/backend/authldap")
diff --git a/pkg/auth/backend/authldap/mock_ldap_test.go b/internal/auth/backend/authldap/mock_ldap_test.go
similarity index 98%
rename from pkg/auth/backend/authldap/mock_ldap_test.go
rename to internal/auth/backend/authldap/mock_ldap_test.go
index 3ef5adfb..577f91d2 100644
--- a/pkg/auth/backend/authldap/mock_ldap_test.go
+++ b/internal/auth/backend/authldap/mock_ldap_test.go
@@ -1,4 +1,5 @@
-//+build !race
+//go:build !race
+// +build !race
 
 package authldap
 
diff --git a/pkg/auth/backend/authmock/auth.go b/internal/auth/backend/authmock/auth.go
similarity index 94%
rename from pkg/auth/backend/authmock/auth.go
rename to internal/auth/backend/authmock/auth.go
index f58e6c1b..8aa9d4e4 100644
--- a/pkg/auth/backend/authmock/auth.go
+++ b/internal/auth/backend/authmock/auth.go
@@ -3,7 +3,7 @@ package authmock
 import (
 	"bytes"
 
-	"github.com/aakso/ssh-inscribe/pkg/auth"
+	"github.com/aakso/ssh-inscribe/internal/auth"
 )
 
 type AuthMock struct {
diff --git a/pkg/auth/backend/authoidc/auth.go b/internal/auth/backend/authoidc/auth.go
similarity index 99%
rename from pkg/auth/backend/authoidc/auth.go
rename to internal/auth/backend/authoidc/auth.go
index 2ec09e8d..9cbe0651 100644
--- a/pkg/auth/backend/authoidc/auth.go
+++ b/internal/auth/backend/authoidc/auth.go
@@ -10,12 +10,13 @@ import (
 	"text/template"
 	"time"
 
-	"github.com/aakso/ssh-inscribe/pkg/auth"
-	"github.com/aakso/ssh-inscribe/pkg/util"
 	"github.com/coreos/go-oidc"
 	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
 	"golang.org/x/oauth2"
+
+	"github.com/aakso/ssh-inscribe/internal/auth"
+	"github.com/aakso/ssh-inscribe/internal/util"
 )
 
 const (
diff --git a/pkg/auth/backend/authoidc/auth_test.go b/internal/auth/backend/authoidc/auth_test.go
similarity index 99%
rename from pkg/auth/backend/authoidc/auth_test.go
rename to internal/auth/backend/authoidc/auth_test.go
index 36ca12fe..df1592af 100644
--- a/pkg/auth/backend/authoidc/auth_test.go
+++ b/internal/auth/backend/authoidc/auth_test.go
@@ -7,15 +7,15 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"net/url"
+	"os"
 	"testing"
 	"time"
 
-	"os"
-
-	"github.com/aakso/ssh-inscribe/pkg/auth"
 	"github.com/golang-jwt/jwt/v5"
 	"github.com/stretchr/testify/assert"
 	"gopkg.in/square/go-jose.v2"
+
+	"github.com/aakso/ssh-inscribe/internal/auth"
 )
 
 var (
diff --git a/pkg/auth/backend/authoidc/config.go b/internal/auth/backend/authoidc/config.go
similarity index 100%
rename from pkg/auth/backend/authoidc/config.go
rename to internal/auth/backend/authoidc/config.go
diff --git a/pkg/auth/backend/authoidc/init.go b/internal/auth/backend/authoidc/init.go
similarity index 79%
rename from pkg/auth/backend/authoidc/init.go
rename to internal/auth/backend/authoidc/init.go
index 230f3211..a44a9fd0 100644
--- a/pkg/auth/backend/authoidc/init.go
+++ b/internal/auth/backend/authoidc/init.go
@@ -1,12 +1,13 @@
 package authoidc
 
 import (
-	"github.com/sirupsen/logrus"
-	"github.com/aakso/ssh-inscribe/pkg/auth"
-	"github.com/aakso/ssh-inscribe/pkg/auth/backend"
-	"github.com/aakso/ssh-inscribe/pkg/config"
-	"github.com/aakso/ssh-inscribe/pkg/logging"
 	"github.com/pkg/errors"
+	"github.com/sirupsen/logrus"
+
+	"github.com/aakso/ssh-inscribe/internal/auth"
+	"github.com/aakso/ssh-inscribe/internal/auth/backend"
+	"github.com/aakso/ssh-inscribe/internal/config"
+	"github.com/aakso/ssh-inscribe/internal/logging"
 )
 
 var Log *logrus.Entry = logging.GetLogger("authoidc").WithField("pkg", "auth/backend/authoidc")
diff --git a/pkg/auth/backend/backend.go b/internal/auth/backend/backend.go
similarity index 91%
rename from pkg/auth/backend/backend.go
rename to internal/auth/backend/backend.go
index 979618a3..22becd83 100644
--- a/pkg/auth/backend/backend.go
+++ b/internal/auth/backend/backend.go
@@ -3,8 +3,9 @@ package backend
 import (
 	"fmt"
 
-	"github.com/aakso/ssh-inscribe/pkg/auth"
 	"github.com/pkg/errors"
+
+	"github.com/aakso/ssh-inscribe/internal/auth"
 )
 
 type Factory func(configsection string) (auth.Authenticator, error)
diff --git a/pkg/auth/cert.go b/internal/auth/cert.go
similarity index 100%
rename from pkg/auth/cert.go
rename to internal/auth/cert.go
diff --git a/pkg/config/config.go b/internal/config/config.go
similarity index 100%
rename from pkg/config/config.go
rename to internal/config/config.go
diff --git a/pkg/config/config_test.go b/internal/config/config_test.go
similarity index 100%
rename from pkg/config/config_test.go
rename to internal/config/config_test.go
diff --git a/pkg/filteringagent/agent.go b/internal/filteringagent/agent.go
similarity index 100%
rename from pkg/filteringagent/agent.go
rename to internal/filteringagent/agent.go
diff --git a/pkg/filteringagent/agent_test.go b/internal/filteringagent/agent_test.go
similarity index 99%
rename from pkg/filteringagent/agent_test.go
rename to internal/filteringagent/agent_test.go
index fda40cef..7b977efe 100644
--- a/pkg/filteringagent/agent_test.go
+++ b/internal/filteringagent/agent_test.go
@@ -13,7 +13,7 @@ import (
 	"golang.org/x/crypto/ssh"
 	"golang.org/x/crypto/ssh/agent"
 
-	"github.com/aakso/ssh-inscribe/pkg/keysigner"
+	"github.com/aakso/ssh-inscribe/internal/keysigner"
 )
 
 type certsAndKeys struct {
diff --git a/pkg/globals/globals.go b/internal/globals/globals.go
similarity index 100%
rename from pkg/globals/globals.go
rename to internal/globals/globals.go
diff --git a/pkg/keysigner/init.go b/internal/keysigner/init.go
similarity index 74%
rename from pkg/keysigner/init.go
rename to internal/keysigner/init.go
index a937d212..9828553c 100644
--- a/pkg/keysigner/init.go
+++ b/internal/keysigner/init.go
@@ -2,7 +2,8 @@ package keysigner
 
 import (
 	"github.com/sirupsen/logrus"
-	"github.com/aakso/ssh-inscribe/pkg/logging"
+
+	"github.com/aakso/ssh-inscribe/internal/logging"
 )
 
 var Log *logrus.Entry = logging.GetLogger("keysigner").WithField("pkg", "keysigner")
diff --git a/pkg/keysigner/keysigner.go b/internal/keysigner/keysigner.go
similarity index 99%
rename from pkg/keysigner/keysigner.go
rename to internal/keysigner/keysigner.go
index 524bb72c..3028871b 100644
--- a/pkg/keysigner/keysigner.go
+++ b/internal/keysigner/keysigner.go
@@ -19,7 +19,7 @@ import (
 	"golang.org/x/crypto/ssh"
 	"golang.org/x/crypto/ssh/agent"
 
-	"github.com/aakso/ssh-inscribe/pkg/util"
+	"github.com/aakso/ssh-inscribe/internal/util"
 )
 
 // Taken from stdlib to allow us to talk to the agent directly
diff --git a/pkg/keysigner/keysigner_test.go b/internal/keysigner/keysigner_test.go
similarity index 99%
rename from pkg/keysigner/keysigner_test.go
rename to internal/keysigner/keysigner_test.go
index e168289e..1acb9109 100644
--- a/pkg/keysigner/keysigner_test.go
+++ b/internal/keysigner/keysigner_test.go
@@ -14,8 +14,8 @@ import (
 	"golang.org/x/crypto/ssh"
 	"golang.org/x/crypto/ssh/agent"
 
-	"github.com/aakso/ssh-inscribe/pkg/logging"
-	"github.com/aakso/ssh-inscribe/pkg/util"
+	"github.com/aakso/ssh-inscribe/internal/logging"
+	"github.com/aakso/ssh-inscribe/internal/util"
 )
 
 var (
diff --git a/pkg/logging/config.go b/internal/logging/config.go
similarity index 100%
rename from pkg/logging/config.go
rename to internal/logging/config.go
diff --git a/pkg/logging/init.go b/internal/logging/init.go
similarity index 57%
rename from pkg/logging/init.go
rename to internal/logging/init.go
index c8e25bbc..3017a874 100644
--- a/pkg/logging/init.go
+++ b/internal/logging/init.go
@@ -1,6 +1,6 @@
 package logging
 
-import "github.com/aakso/ssh-inscribe/pkg/config"
+import "github.com/aakso/ssh-inscribe/internal/config"
 
 func init() {
 	config.SetDefault("logging", Defaults)
diff --git a/pkg/logging/logging.go b/internal/logging/logging.go
similarity index 98%
rename from pkg/logging/logging.go
rename to internal/logging/logging.go
index 6d56c761..62ee60bb 100644
--- a/pkg/logging/logging.go
+++ b/internal/logging/logging.go
@@ -4,9 +4,10 @@ import (
 	"io"
 	"strings"
 
-	"github.com/aakso/ssh-inscribe/pkg/config"
 	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
+
+	"github.com/aakso/ssh-inscribe/internal/config"
 )
 
 var pkgLoggers map[string]*logrus.Logger = make(map[string]*logrus.Logger)
diff --git a/pkg/logging/syslog.go b/internal/logging/syslog.go
similarity index 100%
rename from pkg/logging/syslog.go
rename to internal/logging/syslog.go
diff --git a/pkg/logging/syslog_windows.go b/internal/logging/syslog_windows.go
similarity index 100%
rename from pkg/logging/syslog_windows.go
rename to internal/logging/syslog_windows.go
diff --git a/pkg/server/config.go b/internal/server/config.go
similarity index 98%
rename from pkg/server/config.go
rename to internal/server/config.go
index 03fefe03..3eaa297a 100644
--- a/pkg/server/config.go
+++ b/internal/server/config.go
@@ -4,7 +4,7 @@ import (
 	"crypto/tls"
 	"path"
 
-	"github.com/aakso/ssh-inscribe/pkg/globals"
+	"github.com/aakso/ssh-inscribe/internal/globals"
 
 	"github.com/pkg/errors"
 )
diff --git a/pkg/server/init.go b/internal/server/init.go
similarity index 55%
rename from pkg/server/init.go
rename to internal/server/init.go
index e9ba0f9d..f30c430c 100644
--- a/pkg/server/init.go
+++ b/internal/server/init.go
@@ -1,7 +1,9 @@
 package server
 
-import "github.com/aakso/ssh-inscribe/pkg/config"
-import "github.com/aakso/ssh-inscribe/pkg/logging"
+import (
+	"github.com/aakso/ssh-inscribe/internal/config"
+	"github.com/aakso/ssh-inscribe/internal/logging"
+)
 
 var Log = logging.GetLogger("server").WithField("pkg", "server")
 
diff --git a/pkg/server/logger.go b/internal/server/logger.go
similarity index 100%
rename from pkg/server/logger.go
rename to internal/server/logger.go
diff --git a/pkg/server/server.go b/internal/server/server.go
similarity index 94%
rename from pkg/server/server.go
rename to internal/server/server.go
index 35736201..02fc717b 100644
--- a/pkg/server/server.go
+++ b/internal/server/server.go
@@ -8,18 +8,18 @@ import (
 	"runtime"
 	"time"
 
-	"github.com/aakso/ssh-inscribe/pkg/globals"
+	"github.com/aakso/ssh-inscribe/internal/globals"
 
 	"github.com/labstack/echo/v4"
 	"github.com/labstack/echo/v4/middleware"
 	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
 
-	authbackend "github.com/aakso/ssh-inscribe/pkg/auth/backend"
-	"github.com/aakso/ssh-inscribe/pkg/config"
-	"github.com/aakso/ssh-inscribe/pkg/keysigner"
-	"github.com/aakso/ssh-inscribe/pkg/server/signapi"
-	"github.com/aakso/ssh-inscribe/pkg/util"
+	authbackend "github.com/aakso/ssh-inscribe/internal/auth/backend"
+	"github.com/aakso/ssh-inscribe/internal/config"
+	"github.com/aakso/ssh-inscribe/internal/keysigner"
+	"github.com/aakso/ssh-inscribe/internal/server/signapi"
+	"github.com/aakso/ssh-inscribe/internal/util"
 )
 
 type Server struct {
diff --git a/pkg/server/signapi/handle_auth_discover.go b/internal/server/signapi/handle_auth_discover.go
similarity index 88%
rename from pkg/server/signapi/handle_auth_discover.go
rename to internal/server/signapi/handle_auth_discover.go
index 9be89798..137ad39c 100644
--- a/pkg/server/signapi/handle_auth_discover.go
+++ b/internal/server/signapi/handle_auth_discover.go
@@ -3,8 +3,9 @@ package signapi
 import (
 	"net/http"
 
-	"github.com/aakso/ssh-inscribe/pkg/server/signapi/objects"
 	"github.com/labstack/echo/v4"
+
+	"github.com/aakso/ssh-inscribe/internal/server/signapi/objects"
 )
 
 func (sa *SignApi) HandleAuthDiscover(c echo.Context) error {
diff --git a/pkg/server/signapi/handle_ca.go b/internal/server/signapi/handle_ca.go
similarity index 99%
rename from pkg/server/signapi/handle_ca.go
rename to internal/server/signapi/handle_ca.go
index 8281f672..311f1eff 100644
--- a/pkg/server/signapi/handle_ca.go
+++ b/internal/server/signapi/handle_ca.go
@@ -14,7 +14,7 @@ import (
 	"golang.org/x/crypto/ssh"
 	"gopkg.in/square/go-jose.v2"
 
-	"github.com/aakso/ssh-inscribe/pkg/auth"
+	"github.com/aakso/ssh-inscribe/internal/auth"
 )
 
 func (sa *SignApi) HandleAddKey(c echo.Context) error {
diff --git a/pkg/server/signapi/handle_login.go b/internal/server/signapi/handle_login.go
similarity index 98%
rename from pkg/server/signapi/handle_login.go
rename to internal/server/signapi/handle_login.go
index 20073990..fb3b690e 100644
--- a/pkg/server/signapi/handle_login.go
+++ b/internal/server/signapi/handle_login.go
@@ -9,7 +9,7 @@ import (
 	"github.com/labstack/echo/v4"
 	"github.com/pkg/errors"
 
-	"github.com/aakso/ssh-inscribe/pkg/auth"
+	"github.com/aakso/ssh-inscribe/internal/auth"
 )
 
 const (
diff --git a/pkg/server/signapi/handle_ready.go b/internal/server/signapi/handle_ready.go
similarity index 100%
rename from pkg/server/signapi/handle_ready.go
rename to internal/server/signapi/handle_ready.go
diff --git a/pkg/server/signapi/handle_sign.go b/internal/server/signapi/handle_sign.go
similarity index 96%
rename from pkg/server/signapi/handle_sign.go
rename to internal/server/signapi/handle_sign.go
index 10f69984..fbc6d176 100644
--- a/pkg/server/signapi/handle_sign.go
+++ b/internal/server/signapi/handle_sign.go
@@ -6,15 +6,15 @@ import (
 	"strconv"
 	"time"
 
-	"github.com/aakso/ssh-inscribe/pkg/auth/authz/authzfilter"
-	"github.com/aakso/ssh-inscribe/pkg/util"
+	"github.com/aakso/ssh-inscribe/internal/auth/authz/authzfilter"
+	"github.com/aakso/ssh-inscribe/internal/util"
 
 	"github.com/golang-jwt/jwt/v5"
 	"github.com/labstack/echo/v4"
 	"github.com/pkg/errors"
 	"golang.org/x/crypto/ssh"
 
-	"github.com/aakso/ssh-inscribe/pkg/auth"
+	"github.com/aakso/ssh-inscribe/internal/auth"
 )
 
 const minimumPrincipalsBatchSize = 10
diff --git a/pkg/server/signapi/init.go b/internal/server/signapi/init.go
similarity index 65%
rename from pkg/server/signapi/init.go
rename to internal/server/signapi/init.go
index 606d39df..f442d03d 100644
--- a/pkg/server/signapi/init.go
+++ b/internal/server/signapi/init.go
@@ -1,7 +1,7 @@
 package signapi
 
 import (
-	"github.com/aakso/ssh-inscribe/pkg/logging"
+	"github.com/aakso/ssh-inscribe/internal/logging"
 )
 
 var Log = logging.GetLogger("signapi").WithField("pkg", "signapi")
diff --git a/pkg/server/signapi/objects/objects.go b/internal/server/signapi/objects/objects.go
similarity index 100%
rename from pkg/server/signapi/objects/objects.go
rename to internal/server/signapi/objects/objects.go
diff --git a/pkg/server/signapi/routes.go b/internal/server/signapi/routes.go
similarity index 98%
rename from pkg/server/signapi/routes.go
rename to internal/server/signapi/routes.go
index ce7db376..90d70c92 100644
--- a/pkg/server/signapi/routes.go
+++ b/internal/server/signapi/routes.go
@@ -10,7 +10,7 @@ import (
 	"github.com/labstack/gommon/random"
 	"github.com/pkg/errors"
 
-	"github.com/aakso/ssh-inscribe/pkg/auth"
+	"github.com/aakso/ssh-inscribe/internal/auth"
 )
 
 func (sa *SignApi) RegisterRoutes(g *echo.Group) {
diff --git a/pkg/server/signapi/signapi.go b/internal/server/signapi/signapi.go
similarity index 92%
rename from pkg/server/signapi/signapi.go
rename to internal/server/signapi/signapi.go
index 90472058..391a2212 100644
--- a/pkg/server/signapi/signapi.go
+++ b/internal/server/signapi/signapi.go
@@ -8,9 +8,9 @@ import (
 
 	"github.com/golang-jwt/jwt/v5"
 
-	"github.com/aakso/ssh-inscribe/pkg/auth"
-	"github.com/aakso/ssh-inscribe/pkg/keysigner"
-	"github.com/aakso/ssh-inscribe/pkg/util"
+	"github.com/aakso/ssh-inscribe/internal/auth"
+	"github.com/aakso/ssh-inscribe/internal/keysigner"
+	"github.com/aakso/ssh-inscribe/internal/util"
 )
 
 const (
diff --git a/pkg/server/signapi/signapi_test.go b/internal/server/signapi/signapi_test.go
similarity index 98%
rename from pkg/server/signapi/signapi_test.go
rename to internal/server/signapi/signapi_test.go
index 0f85c497..4a66db32 100644
--- a/pkg/server/signapi/signapi_test.go
+++ b/internal/server/signapi/signapi_test.go
@@ -18,11 +18,11 @@ import (
 	"github.com/stretchr/testify/assert"
 	"golang.org/x/crypto/ssh"
 
-	"github.com/aakso/ssh-inscribe/pkg/auth"
-	"github.com/aakso/ssh-inscribe/pkg/auth/backend/authmock"
-	"github.com/aakso/ssh-inscribe/pkg/keysigner"
-	"github.com/aakso/ssh-inscribe/pkg/logging"
-	"github.com/aakso/ssh-inscribe/pkg/util"
+	"github.com/aakso/ssh-inscribe/internal/auth"
+	"github.com/aakso/ssh-inscribe/internal/auth/backend/authmock"
+	"github.com/aakso/ssh-inscribe/internal/keysigner"
+	"github.com/aakso/ssh-inscribe/internal/logging"
+	"github.com/aakso/ssh-inscribe/internal/util"
 )
 
 var (
diff --git a/pkg/client/client.go b/internal/ui/client.go
similarity index 99%
rename from pkg/client/client.go
rename to internal/ui/client.go
index 31d7b840..cbdb0e32 100644
--- a/pkg/client/client.go
+++ b/internal/ui/client.go
@@ -1,4 +1,4 @@
-package client
+package ui
 
 import (
 	"bytes"
@@ -24,8 +24,8 @@ import (
 
 	"github.com/labstack/gommon/log"
 
-	"github.com/aakso/ssh-inscribe/pkg/globals"
-	"github.com/aakso/ssh-inscribe/pkg/util"
+	"github.com/aakso/ssh-inscribe/internal/globals"
+	"github.com/aakso/ssh-inscribe/internal/util"
 
 	"github.com/ScaleFT/sshkeys"
 	"github.com/blang/semver/v4"
@@ -35,8 +35,8 @@ import (
 	"golang.org/x/crypto/ssh/agent"
 	"gopkg.in/resty.v1"
 
-	"github.com/aakso/ssh-inscribe/pkg/auth"
-	"github.com/aakso/ssh-inscribe/pkg/server/signapi/objects"
+	"github.com/aakso/ssh-inscribe/internal/auth"
+	"github.com/aakso/ssh-inscribe/internal/server/signapi/objects"
 )
 
 const (
diff --git a/pkg/client/config.go b/internal/ui/config.go
similarity index 99%
rename from pkg/client/config.go
rename to internal/ui/config.go
index 2c85637e..663de9a1 100644
--- a/pkg/client/config.go
+++ b/internal/ui/config.go
@@ -1,4 +1,4 @@
-package client
+package ui
 
 import "time"
 
diff --git a/internal/ui/init.go b/internal/ui/init.go
new file mode 100644
index 00000000..242b9b39
--- /dev/null
+++ b/internal/ui/init.go
@@ -0,0 +1,7 @@
+package ui
+
+import (
+	"github.com/aakso/ssh-inscribe/internal/logging"
+)
+
+var Log = logging.GetLogger("ui").WithField("pkg", "ui")
diff --git a/pkg/util/auth_sock.go b/internal/util/auth_sock.go
similarity index 97%
rename from pkg/util/auth_sock.go
rename to internal/util/auth_sock.go
index 77f745b9..388a6f77 100644
--- a/pkg/util/auth_sock.go
+++ b/internal/util/auth_sock.go
@@ -1,3 +1,4 @@
+//go:build !windows
 // +build !windows
 
 package util
diff --git a/pkg/util/auth_sock_windows.go b/internal/util/auth_sock_windows.go
similarity index 100%
rename from pkg/util/auth_sock_windows.go
rename to internal/util/auth_sock_windows.go
diff --git a/pkg/util/rand.go b/internal/util/rand.go
similarity index 100%
rename from pkg/util/rand.go
rename to internal/util/rand.go
diff --git a/pkg/util/sshkey.go b/internal/util/sshkey.go
similarity index 100%
rename from pkg/util/sshkey.go
rename to internal/util/sshkey.go
diff --git a/pkg/auth/backend/all/init.go b/pkg/auth/backend/all/init.go
deleted file mode 100644
index 6e8185bb..00000000
--- a/pkg/auth/backend/all/init.go
+++ /dev/null
@@ -1,7 +0,0 @@
-package all
-
-import (
-	_ "github.com/aakso/ssh-inscribe/pkg/auth/backend/authfile"
-	_ "github.com/aakso/ssh-inscribe/pkg/auth/backend/authldap"
-	_ "github.com/aakso/ssh-inscribe/pkg/auth/backend/authoidc"
-)
diff --git a/pkg/client/init.go b/pkg/client/init.go
deleted file mode 100644
index 3de4df05..00000000
--- a/pkg/client/init.go
+++ /dev/null
@@ -1,7 +0,0 @@
-package client
-
-import (
-	"github.com/aakso/ssh-inscribe/pkg/logging"
-)
-
-var Log = logging.GetLogger("client").WithField("pkg", "client")