diff --git a/cmd/reloader/main.go b/cmd/reloader/main.go
index 35151f9b..ff7ba9af 100644
--- a/cmd/reloader/main.go
+++ b/cmd/reloader/main.go
@@ -17,12 +17,13 @@ import (
 	"k8s.io/client-go/discovery"
 	controllerruntime "sigs.k8s.io/controller-runtime"
 
-	"github.com/stakater/Reloader/internal/pkg/config"
+	"github.com/stakater/Reloader/internal/pkg/config/flags"
 	"github.com/stakater/Reloader/internal/pkg/controller"
 	"github.com/stakater/Reloader/internal/pkg/csi"
-	"github.com/stakater/Reloader/internal/pkg/metadata"
 	"github.com/stakater/Reloader/internal/pkg/metrics"
 	"github.com/stakater/Reloader/internal/pkg/openshift"
+	"github.com/stakater/Reloader/pkg/config"
+	"github.com/stakater/Reloader/pkg/metadata"
 )
 
 // Environment variable names for pod identity in HA mode.
@@ -49,12 +50,12 @@ func newReloaderCommand() *cobra.Command {
 		RunE:  run,
 	}
 
-	config.BindFlags(cmd.PersistentFlags(), cfg)
+	flags.BindFlags(cmd.PersistentFlags(), cfg)
 	return cmd
 }
 
 func run(cmd *cobra.Command, args []string) error {
-	if err := config.ApplyFlags(cfg); err != nil {
+	if err := flags.ApplyFlags(cfg); err != nil {
 		return fmt.Errorf("applying flags: %w", err)
 	}
 
@@ -115,7 +116,7 @@ func run(cmd *cobra.Command, args []string) error {
 		log.V(1).Info("Failed to create discovery client", "error", discErr)
 	}
 
-	if config.ShouldAutoDetectOpenShift() {
+	if flags.ShouldAutoDetectOpenShift() {
 		if discoveryClient != nil && openshift.HasDeploymentConfigSupport(discoveryClient, log) {
 			cfg.DeploymentConfigEnabled = true
 		}
diff --git a/internal/pkg/alerting/alerter.go b/internal/pkg/alerting/alerter.go
index edbc2281..1d9cf224 100644
--- a/internal/pkg/alerting/alerter.go
+++ b/internal/pkg/alerting/alerter.go
@@ -4,7 +4,7 @@ import (
 	"context"
 	"time"
 
-	"github.com/stakater/Reloader/internal/pkg/config"
+	"github.com/stakater/Reloader/pkg/config"
 )
 
 // AlertMessage contains the details of a reload event to be sent as an alert.
diff --git a/internal/pkg/alerting/alerter_test.go b/internal/pkg/alerting/alerter_test.go
index d6ae4ad4..30b68e22 100644
--- a/internal/pkg/alerting/alerter_test.go
+++ b/internal/pkg/alerting/alerter_test.go
@@ -10,7 +10,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/stakater/Reloader/internal/pkg/config"
+	"github.com/stakater/Reloader/pkg/config"
 )
 
 // testServer creates a test HTTP server that captures the request body.
diff --git a/internal/pkg/config/flags.go b/internal/pkg/config/flags/flags.go
similarity index 98%
rename from internal/pkg/config/flags.go
rename to internal/pkg/config/flags/flags.go
index 784fef10..87ef26ba 100644
--- a/internal/pkg/config/flags.go
+++ b/internal/pkg/config/flags/flags.go
@@ -1,4 +1,4 @@
-package config
+package flags
 
 import (
 	"fmt"
@@ -8,6 +8,8 @@ import (
 	"github.com/spf13/pflag"
 	"github.com/spf13/viper"
 	"k8s.io/apimachinery/pkg/labels"
+
+	"github.com/stakater/Reloader/pkg/config"
 )
 
 // v is the viper instance for configuration.
@@ -22,7 +24,7 @@ func init() {
 
 // BindFlags binds configuration flags to the provided flag set.
 // Call this before parsing flags, then call ApplyFlags after parsing.
-func BindFlags(fs *pflag.FlagSet, cfg *Config) {
+func BindFlags(fs *pflag.FlagSet, cfg *config.Config) {
 	// Auto reload
 	fs.Bool(
 		"auto-reload-all", cfg.AutoReloadAll,
@@ -265,7 +267,7 @@ func BindFlags(fs *pflag.FlagSet, cfg *Config) {
 
 // ApplyFlags applies flag values from viper to the config struct.
 // Call this after parsing flags.
-func ApplyFlags(cfg *Config) error {
+func ApplyFlags(cfg *config.Config) error {
 	// Boolean flags
 	cfg.AutoReloadAll = v.GetBool("auto-reload-all")
 	cfg.SyncAfterRestart = v.GetBool("sync-after-restart")
@@ -287,7 +289,7 @@ func ApplyFlags(cfg *Config) error {
 	}
 
 	// String flags
-	cfg.ReloadStrategy = ReloadStrategy(v.GetString("reload-strategy"))
+	cfg.ReloadStrategy = config.ReloadStrategy(v.GetString("reload-strategy"))
 	cfg.WebhookURL = v.GetString("webhook-url")
 	cfg.LogFormat = v.GetString("log-format")
 	cfg.LogLevel = v.GetString("log-level")
diff --git a/internal/pkg/config/flags_test.go b/internal/pkg/config/flags/flags_test.go
similarity index 93%
rename from internal/pkg/config/flags_test.go
rename to internal/pkg/config/flags/flags_test.go
index f9c6819a..9bd67fa1 100644
--- a/internal/pkg/config/flags_test.go
+++ b/internal/pkg/config/flags/flags_test.go
@@ -1,4 +1,4 @@
-package config
+package flags
 
 import (
 	"strings"
@@ -6,6 +6,8 @@ import (
 
 	"github.com/spf13/pflag"
 	"github.com/spf13/viper"
+
+	"github.com/stakater/Reloader/pkg/config"
 )
 
 // resetViper resets the viper instance for testing.
@@ -17,7 +19,7 @@ func resetViper() {
 
 func TestBindFlags(t *testing.T) {
 	resetViper()
-	cfg := NewDefault()
+	cfg := config.NewDefault()
 	fs := pflag.NewFlagSet("test", pflag.ContinueOnError)
 
 	BindFlags(fs, cfg)
@@ -83,7 +85,7 @@ func TestBindFlags(t *testing.T) {
 
 func TestBindFlags_DefaultValues(t *testing.T) {
 	resetViper()
-	cfg := NewDefault()
+	cfg := config.NewDefault()
 	fs := pflag.NewFlagSet("test", pflag.ContinueOnError)
 
 	BindFlags(fs, cfg)
@@ -96,8 +98,8 @@ func TestBindFlags_DefaultValues(t *testing.T) {
 		t.Fatalf("ApplyFlags() error = %v", err)
 	}
 
-	if cfg.ReloadStrategy != ReloadStrategyEnvVars {
-		t.Errorf("ReloadStrategy = %v, want %v", cfg.ReloadStrategy, ReloadStrategyEnvVars)
+	if cfg.ReloadStrategy != config.ReloadStrategyEnvVars {
+		t.Errorf("ReloadStrategy = %v, want %v", cfg.ReloadStrategy, config.ReloadStrategyEnvVars)
 	}
 
 	if cfg.LogLevel != "info" {
@@ -107,7 +109,7 @@ func TestBindFlags_DefaultValues(t *testing.T) {
 
 func TestBindFlags_CustomValues(t *testing.T) {
 	resetViper()
-	cfg := NewDefault()
+	cfg := config.NewDefault()
 	fs := pflag.NewFlagSet("test", pflag.ContinueOnError)
 
 	BindFlags(fs, cfg)
@@ -134,8 +136,8 @@ func TestBindFlags_CustomValues(t *testing.T) {
 		t.Error("AutoReloadAll should be true")
 	}
 
-	if cfg.ReloadStrategy != ReloadStrategyAnnotations {
-		t.Errorf("ReloadStrategy = %v, want %v", cfg.ReloadStrategy, ReloadStrategyAnnotations)
+	if cfg.ReloadStrategy != config.ReloadStrategyAnnotations {
+		t.Errorf("ReloadStrategy = %v, want %v", cfg.ReloadStrategy, config.ReloadStrategyAnnotations)
 	}
 
 	if cfg.LogLevel != "debug" {
@@ -162,7 +164,7 @@ func TestBindFlags_CustomValues(t *testing.T) {
 func TestApplyFlags_SecretProviderClassAnnotations(t *testing.T) {
 	// Defaults are preserved when the flags are not provided.
 	resetViper()
-	cfg := NewDefault()
+	cfg := config.NewDefault()
 	fs := pflag.NewFlagSet("test", pflag.ContinueOnError)
 	BindFlags(fs, cfg)
 	if err := fs.Parse(nil); err != nil {
@@ -171,7 +173,7 @@ func TestApplyFlags_SecretProviderClassAnnotations(t *testing.T) {
 	if err := ApplyFlags(cfg); err != nil {
 		t.Fatalf("ApplyFlags() error = %v", err)
 	}
-	defaults := DefaultAnnotations()
+	defaults := config.DefaultAnnotations()
 	if cfg.Annotations.SecretProviderClassAuto != defaults.SecretProviderClassAuto {
 		t.Errorf("SecretProviderClassAuto = %q, want default %q", cfg.Annotations.SecretProviderClassAuto, defaults.SecretProviderClassAuto)
 	}
@@ -184,7 +186,7 @@ func TestApplyFlags_SecretProviderClassAnnotations(t *testing.T) {
 
 	// Custom values are applied from the flags.
 	resetViper()
-	cfg = NewDefault()
+	cfg = config.NewDefault()
 	fs = pflag.NewFlagSet("test", pflag.ContinueOnError)
 	BindFlags(fs, cfg)
 	args := []string{
@@ -212,7 +214,7 @@ func TestApplyFlags_SecretProviderClassAnnotations(t *testing.T) {
 func TestApplyFlags_ExcludeAnnotations(t *testing.T) {
 	// Defaults are preserved when the flags are not provided.
 	resetViper()
-	cfg := NewDefault()
+	cfg := config.NewDefault()
 	fs := pflag.NewFlagSet("test", pflag.ContinueOnError)
 	BindFlags(fs, cfg)
 	if err := fs.Parse(nil); err != nil {
@@ -221,7 +223,7 @@ func TestApplyFlags_ExcludeAnnotations(t *testing.T) {
 	if err := ApplyFlags(cfg); err != nil {
 		t.Fatalf("ApplyFlags() error = %v", err)
 	}
-	defaults := DefaultAnnotations()
+	defaults := config.DefaultAnnotations()
 	if cfg.Annotations.ConfigmapExclude != defaults.ConfigmapExclude {
 		t.Errorf("ConfigmapExclude = %q, want default %q", cfg.Annotations.ConfigmapExclude, defaults.ConfigmapExclude)
 	}
@@ -231,7 +233,7 @@ func TestApplyFlags_ExcludeAnnotations(t *testing.T) {
 
 	// Custom values are applied from the flags.
 	resetViper()
-	cfg = NewDefault()
+	cfg = config.NewDefault()
 	fs = pflag.NewFlagSet("test", pflag.ContinueOnError)
 	BindFlags(fs, cfg)
 	args := []string{
@@ -255,7 +257,7 @@ func TestApplyFlags_ExcludeAnnotations(t *testing.T) {
 func TestApplyFlags_IgnoreAnnotation(t *testing.T) {
 	// Default is preserved when the flag is not provided.
 	resetViper()
-	cfg := NewDefault()
+	cfg := config.NewDefault()
 	fs := pflag.NewFlagSet("test", pflag.ContinueOnError)
 	BindFlags(fs, cfg)
 	if err := fs.Parse(nil); err != nil {
@@ -264,13 +266,13 @@ func TestApplyFlags_IgnoreAnnotation(t *testing.T) {
 	if err := ApplyFlags(cfg); err != nil {
 		t.Fatalf("ApplyFlags() error = %v", err)
 	}
-	if cfg.Annotations.Ignore != DefaultAnnotations().Ignore {
-		t.Errorf("Ignore = %q, want default %q", cfg.Annotations.Ignore, DefaultAnnotations().Ignore)
+	if cfg.Annotations.Ignore != config.DefaultAnnotations().Ignore {
+		t.Errorf("Ignore = %q, want default %q", cfg.Annotations.Ignore, config.DefaultAnnotations().Ignore)
 	}
 
 	// Custom value is applied from the flag.
 	resetViper()
-	cfg = NewDefault()
+	cfg = config.NewDefault()
 	fs = pflag.NewFlagSet("test", pflag.ContinueOnError)
 	BindFlags(fs, cfg)
 	if err := fs.Parse([]string{"--ignore-annotation=my.company.com/reloader-ignore"}); err != nil {
@@ -305,7 +307,7 @@ func TestApplyFlags_BooleanStrings(t *testing.T) {
 		t.Run(
 			tt.name, func(t *testing.T) {
 				resetViper()
-				cfg := NewDefault()
+				cfg := config.NewDefault()
 				fs := pflag.NewFlagSet("test", pflag.ContinueOnError)
 				BindFlags(fs, cfg)
 
@@ -329,7 +331,7 @@ func TestApplyFlags_BooleanStrings(t *testing.T) {
 
 func TestApplyFlags_CommaSeparatedLists(t *testing.T) {
 	resetViper()
-	cfg := NewDefault()
+	cfg := config.NewDefault()
 	fs := pflag.NewFlagSet("test", pflag.ContinueOnError)
 	BindFlags(fs, cfg)
 
@@ -365,7 +367,7 @@ func TestApplyFlags_CommaSeparatedLists(t *testing.T) {
 
 func TestApplyFlags_Selectors(t *testing.T) {
 	resetViper()
-	cfg := NewDefault()
+	cfg := config.NewDefault()
 	fs := pflag.NewFlagSet("test", pflag.ContinueOnError)
 	BindFlags(fs, cfg)
 
@@ -397,7 +399,7 @@ func TestApplyFlags_Selectors(t *testing.T) {
 
 func TestApplyFlags_InvalidSelector(t *testing.T) {
 	resetViper()
-	cfg := NewDefault()
+	cfg := config.NewDefault()
 	fs := pflag.NewFlagSet("test", pflag.ContinueOnError)
 	BindFlags(fs, cfg)
 
@@ -453,7 +455,7 @@ func TestApplyFlags_AlertingEnvVars(t *testing.T) {
 					t.Setenv(k, val)
 				}
 
-				cfg := NewDefault()
+				cfg := config.NewDefault()
 				fs := pflag.NewFlagSet("test", pflag.ContinueOnError)
 				BindFlags(fs, cfg)
 
@@ -486,7 +488,7 @@ func TestApplyFlags_LegacyProxyEnvVar(t *testing.T) {
 
 	t.Setenv("ALERT_WEBHOOK_PROXY", "http://legacy-proxy:8080")
 
-	cfg := NewDefault()
+	cfg := config.NewDefault()
 	fs := pflag.NewFlagSet("test", pflag.ContinueOnError)
 	BindFlags(fs, cfg)
 
@@ -505,7 +507,7 @@ func TestApplyFlags_LegacyProxyEnvVar(t *testing.T) {
 
 func TestApplyFlagsCSIIntegration(t *testing.T) {
 	resetViper()
-	cfg := NewDefault()
+	cfg := config.NewDefault()
 	fs := pflag.NewFlagSet("test", pflag.ContinueOnError)
 	BindFlags(fs, cfg)
 	if err := fs.Parse([]string{"--enable-csi-integration=true"}); err != nil {
diff --git a/internal/pkg/controller/configmap_reconciler.go b/internal/pkg/controller/configmap_reconciler.go
index 04bd3bb3..96c17b5a 100644
--- a/internal/pkg/controller/configmap_reconciler.go
+++ b/internal/pkg/controller/configmap_reconciler.go
@@ -9,10 +9,10 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 
 	"github.com/stakater/Reloader/internal/pkg/alerting"
-	"github.com/stakater/Reloader/internal/pkg/config"
+	"github.com/stakater/Reloader/pkg/config"
 	"github.com/stakater/Reloader/internal/pkg/events"
 	"github.com/stakater/Reloader/internal/pkg/metrics"
-	"github.com/stakater/Reloader/internal/pkg/reload"
+	"github.com/stakater/Reloader/pkg/reload"
 	"github.com/stakater/Reloader/internal/pkg/webhook"
 	"github.com/stakater/Reloader/internal/pkg/workload"
 )
diff --git a/internal/pkg/controller/configmap_reconciler_test.go b/internal/pkg/controller/configmap_reconciler_test.go
index 1b114057..c8c6c250 100644
--- a/internal/pkg/controller/configmap_reconciler_test.go
+++ b/internal/pkg/controller/configmap_reconciler_test.go
@@ -3,7 +3,7 @@ package controller_test
 import (
 	"testing"
 
-	"github.com/stakater/Reloader/internal/pkg/config"
+	"github.com/stakater/Reloader/pkg/config"
 	"github.com/stakater/Reloader/internal/pkg/testutil"
 )
 
diff --git a/internal/pkg/controller/deployment_reconciler.go b/internal/pkg/controller/deployment_reconciler.go
index ebc1b759..402b4012 100644
--- a/internal/pkg/controller/deployment_reconciler.go
+++ b/internal/pkg/controller/deployment_reconciler.go
@@ -10,8 +10,8 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/predicate"
 
-	"github.com/stakater/Reloader/internal/pkg/config"
-	"github.com/stakater/Reloader/internal/pkg/reload"
+	"github.com/stakater/Reloader/pkg/config"
+	"github.com/stakater/Reloader/pkg/reload"
 )
 
 // DeploymentReconciler reconciles Deployment objects to handle pause expiration.
diff --git a/internal/pkg/controller/filter.go b/internal/pkg/controller/filter.go
index 7503bc40..e66939cc 100644
--- a/internal/pkg/controller/filter.go
+++ b/internal/pkg/controller/filter.go
@@ -6,8 +6,8 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/event"
 	"sigs.k8s.io/controller-runtime/pkg/predicate"
 
-	"github.com/stakater/Reloader/internal/pkg/config"
-	"github.com/stakater/Reloader/internal/pkg/reload"
+	"github.com/stakater/Reloader/pkg/config"
+	"github.com/stakater/Reloader/pkg/reload"
 )
 
 // BuildEventFilter combines a resource-specific predicate with common filters.
diff --git a/internal/pkg/controller/filter_test.go b/internal/pkg/controller/filter_test.go
index 16b2ae8e..420194ae 100644
--- a/internal/pkg/controller/filter_test.go
+++ b/internal/pkg/controller/filter_test.go
@@ -8,7 +8,7 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"sigs.k8s.io/controller-runtime/pkg/event"
 
-	"github.com/stakater/Reloader/internal/pkg/config"
+	"github.com/stakater/Reloader/pkg/config"
 )
 
 func TestCreateEventPredicate_CreateEvent(t *testing.T) {
diff --git a/internal/pkg/controller/handler.go b/internal/pkg/controller/handler.go
index 06200184..a5732ba1 100644
--- a/internal/pkg/controller/handler.go
+++ b/internal/pkg/controller/handler.go
@@ -11,7 +11,7 @@ import (
 	"github.com/stakater/Reloader/internal/pkg/alerting"
 	"github.com/stakater/Reloader/internal/pkg/events"
 	"github.com/stakater/Reloader/internal/pkg/metrics"
-	"github.com/stakater/Reloader/internal/pkg/reload"
+	"github.com/stakater/Reloader/pkg/reload"
 	"github.com/stakater/Reloader/internal/pkg/webhook"
 	"github.com/stakater/Reloader/internal/pkg/workload"
 )
diff --git a/internal/pkg/controller/manager.go b/internal/pkg/controller/manager.go
index 869bdf00..d9762d32 100644
--- a/internal/pkg/controller/manager.go
+++ b/internal/pkg/controller/manager.go
@@ -18,10 +18,10 @@ import (
 	csiv1 "sigs.k8s.io/secrets-store-csi-driver/apis/v1"
 
 	"github.com/stakater/Reloader/internal/pkg/alerting"
-	"github.com/stakater/Reloader/internal/pkg/config"
+	"github.com/stakater/Reloader/pkg/config"
 	"github.com/stakater/Reloader/internal/pkg/events"
 	"github.com/stakater/Reloader/internal/pkg/metrics"
-	"github.com/stakater/Reloader/internal/pkg/reload"
+	"github.com/stakater/Reloader/pkg/reload"
 	"github.com/stakater/Reloader/internal/pkg/webhook"
 	"github.com/stakater/Reloader/internal/pkg/workload"
 )
diff --git a/internal/pkg/controller/namespace_reconciler.go b/internal/pkg/controller/namespace_reconciler.go
index 4e220fd5..5159a1b4 100644
--- a/internal/pkg/controller/namespace_reconciler.go
+++ b/internal/pkg/controller/namespace_reconciler.go
@@ -11,8 +11,8 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 
-	"github.com/stakater/Reloader/internal/pkg/config"
-	"github.com/stakater/Reloader/internal/pkg/reload"
+	"github.com/stakater/Reloader/pkg/config"
+	"github.com/stakater/Reloader/pkg/reload"
 )
 
 // NamespaceCache provides thread-safe access to the set of namespaces
diff --git a/internal/pkg/controller/namespace_reconciler_test.go b/internal/pkg/controller/namespace_reconciler_test.go
index 604dca92..db1a7c82 100644
--- a/internal/pkg/controller/namespace_reconciler_test.go
+++ b/internal/pkg/controller/namespace_reconciler_test.go
@@ -5,7 +5,7 @@ import (
 
 	"k8s.io/apimachinery/pkg/labels"
 
-	"github.com/stakater/Reloader/internal/pkg/config"
+	"github.com/stakater/Reloader/pkg/config"
 	"github.com/stakater/Reloader/internal/pkg/controller"
 	"github.com/stakater/Reloader/internal/pkg/testutil"
 )
diff --git a/internal/pkg/controller/resource_reconciler.go b/internal/pkg/controller/resource_reconciler.go
index 1476d642..621e759d 100644
--- a/internal/pkg/controller/resource_reconciler.go
+++ b/internal/pkg/controller/resource_reconciler.go
@@ -11,10 +11,10 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/predicate"
 
 	"github.com/stakater/Reloader/internal/pkg/alerting"
-	"github.com/stakater/Reloader/internal/pkg/config"
+	"github.com/stakater/Reloader/pkg/config"
 	"github.com/stakater/Reloader/internal/pkg/events"
 	"github.com/stakater/Reloader/internal/pkg/metrics"
-	"github.com/stakater/Reloader/internal/pkg/reload"
+	"github.com/stakater/Reloader/pkg/reload"
 	"github.com/stakater/Reloader/internal/pkg/webhook"
 	"github.com/stakater/Reloader/internal/pkg/workload"
 )
diff --git a/internal/pkg/controller/retry.go b/internal/pkg/controller/retry.go
index ffb30615..802d1b69 100644
--- a/internal/pkg/controller/retry.go
+++ b/internal/pkg/controller/retry.go
@@ -7,7 +7,7 @@ import (
 	"k8s.io/client-go/util/retry"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
-	"github.com/stakater/Reloader/internal/pkg/reload"
+	"github.com/stakater/Reloader/pkg/reload"
 	"github.com/stakater/Reloader/internal/pkg/workload"
 )
 
diff --git a/internal/pkg/controller/retry_test.go b/internal/pkg/controller/retry_test.go
index ff33c0b5..ab351722 100644
--- a/internal/pkg/controller/retry_test.go
+++ b/internal/pkg/controller/retry_test.go
@@ -13,9 +13,9 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/client/fake"
 
-	"github.com/stakater/Reloader/internal/pkg/config"
+	"github.com/stakater/Reloader/pkg/config"
 	"github.com/stakater/Reloader/internal/pkg/controller"
-	"github.com/stakater/Reloader/internal/pkg/reload"
+	"github.com/stakater/Reloader/pkg/reload"
 	"github.com/stakater/Reloader/internal/pkg/testutil"
 	"github.com/stakater/Reloader/internal/pkg/workload"
 )
diff --git a/internal/pkg/controller/secret_reconciler.go b/internal/pkg/controller/secret_reconciler.go
index b50c7547..ac16cc4f 100644
--- a/internal/pkg/controller/secret_reconciler.go
+++ b/internal/pkg/controller/secret_reconciler.go
@@ -9,10 +9,10 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 
 	"github.com/stakater/Reloader/internal/pkg/alerting"
-	"github.com/stakater/Reloader/internal/pkg/config"
+	"github.com/stakater/Reloader/pkg/config"
 	"github.com/stakater/Reloader/internal/pkg/events"
 	"github.com/stakater/Reloader/internal/pkg/metrics"
-	"github.com/stakater/Reloader/internal/pkg/reload"
+	"github.com/stakater/Reloader/pkg/reload"
 	"github.com/stakater/Reloader/internal/pkg/webhook"
 	"github.com/stakater/Reloader/internal/pkg/workload"
 )
diff --git a/internal/pkg/controller/secret_reconciler_test.go b/internal/pkg/controller/secret_reconciler_test.go
index f55e84a8..e8688801 100644
--- a/internal/pkg/controller/secret_reconciler_test.go
+++ b/internal/pkg/controller/secret_reconciler_test.go
@@ -3,7 +3,7 @@ package controller_test
 import (
 	"testing"
 
-	"github.com/stakater/Reloader/internal/pkg/config"
+	"github.com/stakater/Reloader/pkg/config"
 	"github.com/stakater/Reloader/internal/pkg/testutil"
 )
 
diff --git a/internal/pkg/controller/secretproviderclass_filter_test.go b/internal/pkg/controller/secretproviderclass_filter_test.go
index 4c49cc5d..6f569a88 100644
--- a/internal/pkg/controller/secretproviderclass_filter_test.go
+++ b/internal/pkg/controller/secretproviderclass_filter_test.go
@@ -8,8 +8,8 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/event"
 	csiv1 "sigs.k8s.io/secrets-store-csi-driver/apis/v1"
 
-	"github.com/stakater/Reloader/internal/pkg/config"
-	"github.com/stakater/Reloader/internal/pkg/reload"
+	"github.com/stakater/Reloader/pkg/config"
+	"github.com/stakater/Reloader/pkg/reload"
 )
 
 // TestSecretProviderClassReconciler_FilterIgnoresResourceLabelSelector pins the
diff --git a/internal/pkg/controller/secretproviderclass_reconciler.go b/internal/pkg/controller/secretproviderclass_reconciler.go
index 710a1eb9..e921a8d7 100644
--- a/internal/pkg/controller/secretproviderclass_reconciler.go
+++ b/internal/pkg/controller/secretproviderclass_reconciler.go
@@ -12,8 +12,8 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 	csiv1 "sigs.k8s.io/secrets-store-csi-driver/apis/v1"
 
-	"github.com/stakater/Reloader/internal/pkg/config"
-	"github.com/stakater/Reloader/internal/pkg/reload"
+	"github.com/stakater/Reloader/pkg/config"
+	"github.com/stakater/Reloader/pkg/reload"
 )
 
 // SecretProviderClassReconciler watches SecretProviderClassPodStatus (the per-pod
diff --git a/internal/pkg/controller/secretproviderclass_reconciler_test.go b/internal/pkg/controller/secretproviderclass_reconciler_test.go
index 2ba6bae7..7114a834 100644
--- a/internal/pkg/controller/secretproviderclass_reconciler_test.go
+++ b/internal/pkg/controller/secretproviderclass_reconciler_test.go
@@ -10,9 +10,9 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	csiv1 "sigs.k8s.io/secrets-store-csi-driver/apis/v1"
 
-	"github.com/stakater/Reloader/internal/pkg/config"
+	"github.com/stakater/Reloader/pkg/config"
 	"github.com/stakater/Reloader/internal/pkg/controller"
-	"github.com/stakater/Reloader/internal/pkg/reload"
+	"github.com/stakater/Reloader/pkg/reload"
 	"github.com/stakater/Reloader/internal/pkg/testutil"
 )
 
diff --git a/internal/pkg/controller/test_helpers_test.go b/internal/pkg/controller/test_helpers_test.go
index 2b0f9e75..cd23486f 100644
--- a/internal/pkg/controller/test_helpers_test.go
+++ b/internal/pkg/controller/test_helpers_test.go
@@ -13,11 +13,11 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client/fake"
 
 	"github.com/stakater/Reloader/internal/pkg/alerting"
-	"github.com/stakater/Reloader/internal/pkg/config"
+	"github.com/stakater/Reloader/pkg/config"
 	"github.com/stakater/Reloader/internal/pkg/controller"
 	"github.com/stakater/Reloader/internal/pkg/events"
 	"github.com/stakater/Reloader/internal/pkg/metrics"
-	"github.com/stakater/Reloader/internal/pkg/reload"
+	"github.com/stakater/Reloader/pkg/reload"
 	"github.com/stakater/Reloader/internal/pkg/testutil"
 	"github.com/stakater/Reloader/internal/pkg/webhook"
 	"github.com/stakater/Reloader/internal/pkg/workload"
diff --git a/internal/pkg/config/config.go b/pkg/config/config.go
similarity index 100%
rename from internal/pkg/config/config.go
rename to pkg/config/config.go
diff --git a/internal/pkg/config/config_test.go b/pkg/config/config_test.go
similarity index 100%
rename from internal/pkg/config/config_test.go
rename to pkg/config/config_test.go
diff --git a/internal/pkg/config/validation.go b/pkg/config/validation.go
similarity index 100%
rename from internal/pkg/config/validation.go
rename to pkg/config/validation.go
diff --git a/internal/pkg/config/validation_test.go b/pkg/config/validation_test.go
similarity index 100%
rename from internal/pkg/config/validation_test.go
rename to pkg/config/validation_test.go
diff --git a/internal/pkg/metadata/metadata.go b/pkg/metadata/metadata.go
similarity index 98%
rename from internal/pkg/metadata/metadata.go
rename to pkg/metadata/metadata.go
index df306af4..efa238a1 100644
--- a/internal/pkg/metadata/metadata.go
+++ b/pkg/metadata/metadata.go
@@ -11,7 +11,7 @@ import (
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
-	"github.com/stakater/Reloader/internal/pkg/config"
+	"github.com/stakater/Reloader/pkg/config"
 )
 
 const (
diff --git a/internal/pkg/metadata/metadata_test.go b/pkg/metadata/metadata_test.go
similarity index 99%
rename from internal/pkg/metadata/metadata_test.go
rename to pkg/metadata/metadata_test.go
index 52c5f199..9a36f956 100644
--- a/internal/pkg/metadata/metadata_test.go
+++ b/pkg/metadata/metadata_test.go
@@ -11,7 +11,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/client/fake"
 
-	"github.com/stakater/Reloader/internal/pkg/config"
+	"github.com/stakater/Reloader/pkg/config"
 )
 
 // testLogger returns a no-op logger for testing.
diff --git a/internal/pkg/metadata/publisher.go b/pkg/metadata/publisher.go
similarity index 98%
rename from internal/pkg/metadata/publisher.go
rename to pkg/metadata/publisher.go
index 6c6a4222..64749459 100644
--- a/internal/pkg/metadata/publisher.go
+++ b/pkg/metadata/publisher.go
@@ -10,8 +10,8 @@ import (
 	"k8s.io/apimachinery/pkg/api/errors"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
-	"github.com/stakater/Reloader/internal/pkg/config"
 	"github.com/stakater/Reloader/internal/pkg/workload"
+	"github.com/stakater/Reloader/pkg/config"
 )
 
 // Publisher handles creating and updating the metadata ConfigMap.
diff --git a/internal/pkg/reload/change.go b/pkg/reload/change.go
similarity index 100%
rename from internal/pkg/reload/change.go
rename to pkg/reload/change.go
diff --git a/internal/pkg/reload/change_test.go b/pkg/reload/change_test.go
similarity index 100%
rename from internal/pkg/reload/change_test.go
rename to pkg/reload/change_test.go
diff --git a/internal/pkg/reload/csi_dep_check_test.go b/pkg/reload/csi_dep_check_test.go
similarity index 100%
rename from internal/pkg/reload/csi_dep_check_test.go
rename to pkg/reload/csi_dep_check_test.go
diff --git a/internal/pkg/reload/decision.go b/pkg/reload/decision.go
similarity index 84%
rename from internal/pkg/reload/decision.go
rename to pkg/reload/decision.go
index 62592582..ac3b264b 100644
--- a/internal/pkg/reload/decision.go
+++ b/pkg/reload/decision.go
@@ -5,6 +5,9 @@ import (
 )
 
 // ReloadDecision contains the result of evaluating whether to reload a workload.
+//
+// NOTE: not part of the public API — the Workload field is an internal/pkg/workload
+// type and is therefore not usable from outside this module.
 type ReloadDecision struct {
 	// Workload is the workload accessor.
 	Workload workload.Workload
diff --git a/internal/pkg/reload/decision_test.go b/pkg/reload/decision_test.go
similarity index 100%
rename from internal/pkg/reload/decision_test.go
rename to pkg/reload/decision_test.go
diff --git a/internal/pkg/reload/hasher.go b/pkg/reload/hasher.go
similarity index 100%
rename from internal/pkg/reload/hasher.go
rename to pkg/reload/hasher.go
diff --git a/internal/pkg/reload/hasher_test.go b/pkg/reload/hasher_test.go
similarity index 100%
rename from internal/pkg/reload/hasher_test.go
rename to pkg/reload/hasher_test.go
diff --git a/internal/pkg/reload/matcher.go b/pkg/reload/matcher.go
similarity index 99%
rename from internal/pkg/reload/matcher.go
rename to pkg/reload/matcher.go
index 9fb8ba11..a7ddc50a 100644
--- a/internal/pkg/reload/matcher.go
+++ b/pkg/reload/matcher.go
@@ -4,7 +4,7 @@ import (
 	"regexp"
 	"strings"
 
-	"github.com/stakater/Reloader/internal/pkg/config"
+	"github.com/stakater/Reloader/pkg/config"
 )
 
 // MatchResult contains the result of checking if a workload should be reloaded.
diff --git a/internal/pkg/reload/matcher_test.go b/pkg/reload/matcher_test.go
similarity index 99%
rename from internal/pkg/reload/matcher_test.go
rename to pkg/reload/matcher_test.go
index b683ffb1..f51c5638 100644
--- a/internal/pkg/reload/matcher_test.go
+++ b/pkg/reload/matcher_test.go
@@ -3,7 +3,7 @@ package reload
 import (
 	"testing"
 
-	"github.com/stakater/Reloader/internal/pkg/config"
+	"github.com/stakater/Reloader/pkg/config"
 )
 
 func TestMatcher_ShouldReload(t *testing.T) {
diff --git a/internal/pkg/reload/pause.go b/pkg/reload/pause.go
similarity index 94%
rename from internal/pkg/reload/pause.go
rename to pkg/reload/pause.go
index e995dc33..bc8d02e0 100644
--- a/internal/pkg/reload/pause.go
+++ b/pkg/reload/pause.go
@@ -6,11 +6,14 @@ import (
 
 	appsv1 "k8s.io/api/apps/v1"
 
-	"github.com/stakater/Reloader/internal/pkg/config"
 	"github.com/stakater/Reloader/internal/pkg/workload"
+	"github.com/stakater/Reloader/pkg/config"
 )
 
 // PauseHandler handles pause deployment logic.
+//
+// NOTE: not part of the public API — its methods reference internal/pkg/workload
+// and are therefore not usable from outside this module.
 type PauseHandler struct {
 	cfg *config.Config
 }
diff --git a/internal/pkg/reload/pause_test.go b/pkg/reload/pause_test.go
similarity index 99%
rename from internal/pkg/reload/pause_test.go
rename to pkg/reload/pause_test.go
index 1962194d..76bc869d 100644
--- a/internal/pkg/reload/pause_test.go
+++ b/pkg/reload/pause_test.go
@@ -7,8 +7,8 @@ import (
 	appsv1 "k8s.io/api/apps/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
-	"github.com/stakater/Reloader/internal/pkg/config"
 	"github.com/stakater/Reloader/internal/pkg/workload"
+	"github.com/stakater/Reloader/pkg/config"
 )
 
 func TestPauseHandler_ShouldPause(t *testing.T) {
diff --git a/internal/pkg/reload/predicate.go b/pkg/reload/predicate.go
similarity index 99%
rename from internal/pkg/reload/predicate.go
rename to pkg/reload/predicate.go
index 38fa5841..21846d0a 100644
--- a/internal/pkg/reload/predicate.go
+++ b/pkg/reload/predicate.go
@@ -7,7 +7,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/predicate"
 	csiv1 "sigs.k8s.io/secrets-store-csi-driver/apis/v1"
 
-	"github.com/stakater/Reloader/internal/pkg/config"
+	"github.com/stakater/Reloader/pkg/config"
 )
 
 // resourcePredicates returns predicates for filtering resource events.
diff --git a/internal/pkg/reload/predicate_test.go b/pkg/reload/predicate_test.go
similarity index 99%
rename from internal/pkg/reload/predicate_test.go
rename to pkg/reload/predicate_test.go
index f62e292c..fd57c4d2 100644
--- a/internal/pkg/reload/predicate_test.go
+++ b/pkg/reload/predicate_test.go
@@ -9,7 +9,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/event"
 	csiv1 "sigs.k8s.io/secrets-store-csi-driver/apis/v1"
 
-	"github.com/stakater/Reloader/internal/pkg/config"
+	"github.com/stakater/Reloader/pkg/config"
 )
 
 func TestNamespaceFilterPredicate_Create(t *testing.T) {
diff --git a/internal/pkg/reload/resource_type.go b/pkg/reload/resource_type.go
similarity index 100%
rename from internal/pkg/reload/resource_type.go
rename to pkg/reload/resource_type.go
diff --git a/internal/pkg/reload/resource_type_test.go b/pkg/reload/resource_type_test.go
similarity index 100%
rename from internal/pkg/reload/resource_type_test.go
rename to pkg/reload/resource_type_test.go
diff --git a/internal/pkg/reload/service.go b/pkg/reload/service.go
similarity index 96%
rename from internal/pkg/reload/service.go
rename to pkg/reload/service.go
index 346539d6..88f25666 100644
--- a/internal/pkg/reload/service.go
+++ b/pkg/reload/service.go
@@ -9,11 +9,15 @@ import (
 	"github.com/go-logr/logr"
 	corev1 "k8s.io/api/core/v1"
 
-	"github.com/stakater/Reloader/internal/pkg/config"
 	"github.com/stakater/Reloader/internal/pkg/workload"
+	"github.com/stakater/Reloader/pkg/config"
 )
 
 // Service orchestrates the reload logic for ConfigMaps and Secrets.
+//
+// NOTE: not part of the public API — its methods reference internal/pkg/workload
+// and are therefore not usable from outside this module. External, decision-only
+// consumers should use Matcher instead.
 type Service struct {
 	cfg      *config.Config
 	log      logr.Logger
diff --git a/internal/pkg/reload/service_test.go b/pkg/reload/service_test.go
similarity index 99%
rename from internal/pkg/reload/service_test.go
rename to pkg/reload/service_test.go
index 9d12554d..b2c868fe 100644
--- a/internal/pkg/reload/service_test.go
+++ b/pkg/reload/service_test.go
@@ -10,9 +10,9 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	csiv1 "sigs.k8s.io/secrets-store-csi-driver/apis/v1"
 
-	"github.com/stakater/Reloader/internal/pkg/config"
 	"github.com/stakater/Reloader/internal/pkg/testutil"
 	"github.com/stakater/Reloader/internal/pkg/workload"
+	"github.com/stakater/Reloader/pkg/config"
 )
 
 func TestService_ProcessConfigMap_AutoReload(t *testing.T) {
diff --git a/internal/pkg/reload/strategy.go b/pkg/reload/strategy.go
similarity index 99%
rename from internal/pkg/reload/strategy.go
rename to pkg/reload/strategy.go
index 8881362e..1e85c620 100644
--- a/internal/pkg/reload/strategy.go
+++ b/pkg/reload/strategy.go
@@ -9,7 +9,7 @@ import (
 
 	corev1 "k8s.io/api/core/v1"
 
-	"github.com/stakater/Reloader/internal/pkg/config"
+	"github.com/stakater/Reloader/pkg/config"
 )
 
 const (
diff --git a/internal/pkg/reload/strategy_test.go b/pkg/reload/strategy_test.go
similarity index 99%
rename from internal/pkg/reload/strategy_test.go
rename to pkg/reload/strategy_test.go
index 30571135..3702ce66 100644
--- a/internal/pkg/reload/strategy_test.go
+++ b/pkg/reload/strategy_test.go
@@ -6,7 +6,7 @@ import (
 
 	corev1 "k8s.io/api/core/v1"
 
-	"github.com/stakater/Reloader/internal/pkg/config"
+	"github.com/stakater/Reloader/pkg/config"
 )
 
 func TestEnvVarStrategy_Apply(t *testing.T) {