diff --git a/cmd/fetchkeys/runner.go b/cmd/fetchkeys/runner.go
index 03c43a5b..e246b63d 100644
--- a/cmd/fetchkeys/runner.go
+++ b/cmd/fetchkeys/runner.go
@@ -9,8 +9,8 @@ import (
 	"github.com/giantswarm/micrologger"
 	"github.com/spf13/cobra"
 
-	"github.com/giantswarm/konfigure/internal/sopsenv"
-	"github.com/giantswarm/konfigure/internal/sopsenv/key"
+	"github.com/giantswarm/konfigure/pkg/sopsenv"
+	"github.com/giantswarm/konfigure/pkg/sopsenv/key"
 )
 
 type runner struct {
diff --git a/cmd/generate/flag.go b/cmd/generate/flag.go
index 4d3edba0..a6a197f9 100644
--- a/cmd/generate/flag.go
+++ b/cmd/generate/flag.go
@@ -4,7 +4,7 @@ import (
 	"github.com/giantswarm/microerror"
 	"github.com/spf13/cobra"
 
-	"github.com/giantswarm/konfigure/internal/sopsenv/key"
+	"github.com/giantswarm/konfigure/pkg/sopsenv/key"
 )
 
 const (
diff --git a/cmd/generate/runner.go b/cmd/generate/runner.go
index 7133493c..2d44ce52 100644
--- a/cmd/generate/runner.go
+++ b/cmd/generate/runner.go
@@ -16,9 +16,9 @@ import (
 	corev1 "k8s.io/api/core/v1"
 	"sigs.k8s.io/yaml"
 
-	"github.com/giantswarm/konfigure/internal/generator"
-	"github.com/giantswarm/konfigure/internal/meta"
-	"github.com/giantswarm/konfigure/internal/vaultclient"
+	"github.com/giantswarm/konfigure/pkg/meta"
+	"github.com/giantswarm/konfigure/pkg/service"
+	"github.com/giantswarm/konfigure/pkg/vaultclient"
 )
 
 const (
@@ -72,9 +72,9 @@ func (r *runner) run(ctx context.Context, cmd *cobra.Command, args []string) err
 			}
 		}
 
-		var gen *generator.Service
+		var gen *service.Service
 		{
-			c := generator.Config{
+			c := service.Config{
 				VaultClient: vaultClient,
 
 				Log:            r.logger,
@@ -85,13 +85,13 @@ func (r *runner) run(ctx context.Context, cmd *cobra.Command, args []string) err
 				Verbose:        r.flag.Verbose,
 			}
 
-			gen, err = generator.New(c)
+			gen, err = service.New(c)
 			if err != nil {
 				return microerror.Mask(err)
 			}
 		}
 
-		in := generator.GenerateInput{
+		in := service.GenerateInput{
 			App:       r.flag.AppName,
 			Name:      addNameSuffix(r.flag.Name),
 			Namespace: giantswarmNamespace,
diff --git a/cmd/kustomizepatch/runner.go b/cmd/kustomizepatch/runner.go
index 9e204453..7bc0ba86 100644
--- a/cmd/kustomizepatch/runner.go
+++ b/cmd/kustomizepatch/runner.go
@@ -28,10 +28,10 @@ import (
 	kyaml "sigs.k8s.io/kustomize/kyaml/yaml"
 	"sigs.k8s.io/yaml"
 
-	"github.com/giantswarm/konfigure/internal/generator"
-	"github.com/giantswarm/konfigure/internal/meta"
-	"github.com/giantswarm/konfigure/internal/sopsenv/key"
-	"github.com/giantswarm/konfigure/internal/vaultclient"
+	"github.com/giantswarm/konfigure/pkg/meta"
+	"github.com/giantswarm/konfigure/pkg/service"
+	"github.com/giantswarm/konfigure/pkg/sopsenv/key"
+	"github.com/giantswarm/konfigure/pkg/vaultclient"
 )
 
 const (
@@ -161,9 +161,9 @@ func (r *runner) run(items []*kyaml.RNode) ([]*kyaml.RNode, error) {
 			}
 		}
 
-		var gen *generator.Service
+		var gen *service.Service
 		{
-			c := generator.Config{
+			c := service.Config{
 				VaultClient: vaultClient,
 
 				Log:            r.logger,
@@ -173,13 +173,13 @@ func (r *runner) run(items []*kyaml.RNode) ([]*kyaml.RNode, error) {
 				SOPSKeysSource: sopsKeysSource,
 			}
 
-			gen, err = generator.New(c)
+			gen, err = service.New(c)
 			if err != nil {
 				return nil, microerror.Mask(err)
 			}
 		}
 
-		in := generator.GenerateInput{
+		in := service.GenerateInput{
 			App:       r.config.AppName,
 			Name:      addNameSuffix(r.config.Name),
 			Namespace: giantswarmNamespace,
diff --git a/pkg/decrypt/vault_decrypter.go b/pkg/decrypt/vault_decrypter.go
index 6152d9f3..a8be5f98 100644
--- a/pkg/decrypt/vault_decrypter.go
+++ b/pkg/decrypt/vault_decrypter.go
@@ -4,7 +4,7 @@ import (
 	"context"
 	"encoding/base64"
 
-	"github.com/giantswarm/konfigure/internal/vaultclient"
+	"github.com/giantswarm/konfigure/pkg/vaultclient"
 
 	"github.com/giantswarm/microerror"
 	"github.com/giantswarm/valuemodifier/vault/decrypt"
diff --git a/pkg/generator/generator_test.go b/pkg/generator/generator_test.go
index f5cc31bb..05a6f908 100644
--- a/pkg/generator/generator_test.go
+++ b/pkg/generator/generator_test.go
@@ -10,9 +10,9 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/giantswarm/konfigure/internal/sopsenv"
-	"github.com/giantswarm/konfigure/internal/sopsenv/key"
-	"github.com/giantswarm/konfigure/internal/testutils"
+	"github.com/giantswarm/konfigure/pkg/sopsenv"
+	"github.com/giantswarm/konfigure/pkg/sopsenv/key"
+	"github.com/giantswarm/konfigure/pkg/testutils"
 
 	"github.com/ghodss/yaml"
 	"github.com/giantswarm/microerror"
diff --git a/internal/meta/annotation.go b/pkg/meta/annotation.go
similarity index 100%
rename from internal/meta/annotation.go
rename to pkg/meta/annotation.go
diff --git a/internal/meta/label.go b/pkg/meta/label.go
similarity index 100%
rename from internal/meta/label.go
rename to pkg/meta/label.go
diff --git a/internal/meta/meta.go b/pkg/meta/meta.go
similarity index 100%
rename from internal/meta/meta.go
rename to pkg/meta/meta.go
diff --git a/internal/meta/types.go b/pkg/meta/types.go
similarity index 100%
rename from internal/meta/types.go
rename to pkg/meta/types.go
diff --git a/internal/generator/error.go b/pkg/service/error.go
similarity index 93%
rename from internal/generator/error.go
rename to pkg/service/error.go
index 448bfcba..38bb53d9 100644
--- a/internal/generator/error.go
+++ b/pkg/service/error.go
@@ -1,4 +1,4 @@
-package generator
+package service
 
 import (
 	"github.com/giantswarm/microerror"
diff --git a/internal/generator/service.go b/pkg/service/service.go
similarity index 95%
rename from internal/generator/service.go
rename to pkg/service/service.go
index c5f92932..de04d0ef 100644
--- a/internal/generator/service.go
+++ b/pkg/service/service.go
@@ -1,20 +1,20 @@
-package generator
+package service
 
 import (
 	"context"
 
-	"github.com/giantswarm/konfigure/internal/vaultclient"
+	"github.com/giantswarm/konfigure/pkg/vaultclient"
 
 	"github.com/giantswarm/microerror"
 	"github.com/giantswarm/micrologger"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
-	"github.com/giantswarm/konfigure/internal/meta"
-	"github.com/giantswarm/konfigure/internal/sopsenv"
 	"github.com/giantswarm/konfigure/pkg/decrypt"
 	"github.com/giantswarm/konfigure/pkg/filesystem"
 	"github.com/giantswarm/konfigure/pkg/generator"
+	"github.com/giantswarm/konfigure/pkg/meta"
+	"github.com/giantswarm/konfigure/pkg/sopsenv"
 	"github.com/giantswarm/konfigure/pkg/xstrings"
 )
 
diff --git a/internal/sopsenv/error.go b/pkg/sopsenv/error.go
similarity index 100%
rename from internal/sopsenv/error.go
rename to pkg/sopsenv/error.go
diff --git a/internal/sopsenv/key/key.go b/pkg/sopsenv/key/key.go
similarity index 100%
rename from internal/sopsenv/key/key.go
rename to pkg/sopsenv/key/key.go
diff --git a/internal/sopsenv/sopsenv.go b/pkg/sopsenv/sopsenv.go
similarity index 99%
rename from internal/sopsenv/sopsenv.go
rename to pkg/sopsenv/sopsenv.go
index 58fb3e62..f8f2d462 100644
--- a/internal/sopsenv/sopsenv.go
+++ b/pkg/sopsenv/sopsenv.go
@@ -16,7 +16,7 @@ import (
 	"k8s.io/client-go/kubernetes"
 	ctrl "sigs.k8s.io/controller-runtime"
 
-	"github.com/giantswarm/konfigure/internal/sopsenv/key"
+	"github.com/giantswarm/konfigure/pkg/sopsenv/key"
 
 	// GS stuff uses `kgs`-generated kubeconfigs that use
 	// `oidc` auth provider. This import makes is possible to
diff --git a/internal/sopsenv/sopsenv_test.go b/pkg/sopsenv/sopsenv_test.go
similarity index 98%
rename from internal/sopsenv/sopsenv_test.go
rename to pkg/sopsenv/sopsenv_test.go
index dfa6694b..a9ceb2b1 100644
--- a/internal/sopsenv/sopsenv_test.go
+++ b/pkg/sopsenv/sopsenv_test.go
@@ -16,8 +16,8 @@ import (
 	"k8s.io/apimachinery/pkg/runtime"
 	clientgofake "k8s.io/client-go/kubernetes/fake"
 
-	"github.com/giantswarm/konfigure/internal/sopsenv/key"
-	"github.com/giantswarm/konfigure/internal/testutils"
+	"github.com/giantswarm/konfigure/pkg/sopsenv/key"
+	"github.com/giantswarm/konfigure/pkg/testutils"
 )
 
 func TestSetups(t *testing.T) {
diff --git a/internal/sopsenv/testdata/expected/expected.tgz b/pkg/sopsenv/testdata/expected/expected.tgz
similarity index 100%
rename from internal/sopsenv/testdata/expected/expected.tgz
rename to pkg/sopsenv/testdata/expected/expected.tgz
diff --git a/internal/sopsenv/testdata/keys/keys.tgz b/pkg/sopsenv/testdata/keys/keys.tgz
similarity index 100%
rename from internal/sopsenv/testdata/keys/keys.tgz
rename to pkg/sopsenv/testdata/keys/keys.tgz
diff --git a/internal/testutils/testutils.go b/pkg/testutils/testutils.go
similarity index 100%
rename from internal/testutils/testutils.go
rename to pkg/testutils/testutils.go
diff --git a/internal/vaultclient/error.go b/pkg/vaultclient/error.go
similarity index 100%
rename from internal/vaultclient/error.go
rename to pkg/vaultclient/error.go
diff --git a/internal/vaultclient/vaultclient.go b/pkg/vaultclient/vaultclient.go
similarity index 100%
rename from internal/vaultclient/vaultclient.go
rename to pkg/vaultclient/vaultclient.go