diff --git a/Dockerfile b/Dockerfile
index 52b3ac88..8bc8cbb1 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -9,7 +9,7 @@ COPY go.mod .
 COPY go.sum .
 RUN go mod download
 COPY ./proxy-init ./proxy-init
-COPY pkg pkg
+COPY ./internal ./internal
 ARG TARGETARCH
 RUN CGO_ENABLED=0 GOOS=linux GOARCH=$TARGETARCH go build -o /out/linkerd2-proxy-init -mod=readonly -ldflags "-s -w" -v ./proxy-init
 
diff --git a/cni-plugin/main.go b/cni-plugin/main.go
index 030612db..93296e67 100644
--- a/cni-plugin/main.go
+++ b/cni-plugin/main.go
@@ -30,7 +30,7 @@ import (
 	"github.com/containernetworking/cni/pkg/types"
 	cniv1 "github.com/containernetworking/cni/pkg/types/100"
 	"github.com/containernetworking/cni/pkg/version"
-	iptables "github.com/linkerd/linkerd2-proxy-init/pkg/linkerd-iptables"
+	"github.com/linkerd/linkerd2-proxy-init/internal/iptables"
 	"github.com/linkerd/linkerd2-proxy-init/proxy-init/cmd"
 
 	"github.com/sirupsen/logrus"
diff --git a/pkg/linkerd-iptables/iptables.go b/internal/iptables/iptables.go
similarity index 99%
rename from pkg/linkerd-iptables/iptables.go
rename to internal/iptables/iptables.go
index 5060f85a..fc20b06f 100644
--- a/pkg/linkerd-iptables/iptables.go
+++ b/internal/iptables/iptables.go
@@ -12,7 +12,7 @@ import (
 
 	log "github.com/sirupsen/logrus"
 
-	"github.com/linkerd/linkerd2-proxy-init/pkg/linkerd-util"
+	util "github.com/linkerd/linkerd2-proxy-init/internal/util"
 )
 
 const (
diff --git a/pkg/linkerd-iptables/iptables_test.go b/internal/iptables/iptables_test.go
similarity index 100%
rename from pkg/linkerd-iptables/iptables_test.go
rename to internal/iptables/iptables_test.go
diff --git a/pkg/linkerd-util/portrange.go b/internal/util/portrange.go
similarity index 100%
rename from pkg/linkerd-util/portrange.go
rename to internal/util/portrange.go
diff --git a/pkg/linkerd-util/portrange_test.go b/internal/util/portrange_test.go
similarity index 100%
rename from pkg/linkerd-util/portrange_test.go
rename to internal/util/portrange_test.go
diff --git a/proxy-init/cmd/root.go b/proxy-init/cmd/root.go
index 3ba38bb2..56876972 100644
--- a/proxy-init/cmd/root.go
+++ b/proxy-init/cmd/root.go
@@ -6,10 +6,10 @@ import (
 	"os/exec"
 
 	log "github.com/sirupsen/logrus"
-
-	"github.com/linkerd/linkerd2-proxy-init/pkg/linkerd-iptables"
-	"github.com/linkerd/linkerd2-proxy-init/pkg/linkerd-util"
 	"github.com/spf13/cobra"
+
+	"github.com/linkerd/linkerd2-proxy-init/internal/iptables"
+	"github.com/linkerd/linkerd2-proxy-init/internal/util"
 )
 
 // RootOptions provides the information that will be used to build a firewall configuration.
diff --git a/proxy-init/cmd/root_test.go b/proxy-init/cmd/root_test.go
index 730db3d7..222e9222 100644
--- a/proxy-init/cmd/root_test.go
+++ b/proxy-init/cmd/root_test.go
@@ -4,7 +4,7 @@ import (
 	"reflect"
 	"testing"
 
-	"github.com/linkerd/linkerd2-proxy-init/pkg/linkerd-iptables"
+	"github.com/linkerd/linkerd2-proxy-init/internal/iptables"
 )
 
 func TestBuildFirewallConfiguration(t *testing.T) {