diff --git a/.github/workflows/build-test.yml b/.github/workflows/build-test.yml
index 127fb0e..685e26c 100644
--- a/.github/workflows/build-test.yml
+++ b/.github/workflows/build-test.yml
@@ -13,12 +13,10 @@ jobs:
 
       - uses: actions/setup-go@v5
         with:
-          go-version-file: src/go.mod
+          go-version-file: go.mod
 
       - name: Build
-        working-directory: src
         run: go build ./...
 
       - name: Test
-        working-directory: src
         run: go test ./...
diff --git a/AGENTS.md b/AGENTS.md
index 8fd0eca..853127d 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -2,11 +2,12 @@
 
 ## General
 
-- This is a Go HTTP API backed by PostgreSQL. Source lives under `src/`.
-- Build: `cd src && go build ./...`
-- Test: `cd src && go test ./...`
+- This is a Go HTTP API backed by PostgreSQL. The executable entrypoint lives under `cmd/fmsg-webapi/`, with application packages under `internal/`.
+- Build: `go build ./...`
+- Test: `go test ./...`
 - Always run tests after making code changes to verify nothing is broken.
 - This repository is an open-source implementation and not tied to one specific deployment - config should come from the environment
+- Check sensitive files are not accidentally committed to git, e.g .env should NEVER be
 
 ## README
 
@@ -18,7 +19,7 @@
 - Change build or run instructions.
 
 The API routes table and each route's section must reflect the live code in
-`src/main.go` and `src/handlers/`.
+`cmd/fmsg-webapi/main.go` and `internal/handlers/`.
 
 ## Database
 
diff --git a/README.md b/README.md
index 192c27c..810fd6a 100644
--- a/README.md
+++ b/README.md
@@ -79,14 +79,12 @@ shared secret in `FMSG_API_JWT_SECRET`. Required claims are `sub` and `exp`;
 Requires **Go 1.25** or newer.
 
 ```bash
-cd src
 go build ./...
 ```
 
 ## Testing
 
 ```bash
-cd src
 go test ./...
 ```
 
@@ -110,8 +108,7 @@ export PGUSER=fmsg
 export PGPASSWORD=secret
 export PGDATABASE=fmsg
 
-cd src
-go run .
+go run ./cmd/fmsg-webapi
 ```
 
 ### Plain HTTP mode (development / reverse proxy)
@@ -131,8 +128,7 @@ export PGUSER=fmsg
 export PGPASSWORD=secret
 export PGDATABASE=fmsg
 
-cd src
-go run .
+go run ./cmd/fmsg-webapi
 ```
 
 The server starts on port `8000` by default. Override with `FMSG_API_PORT`.
diff --git a/src/main.go b/cmd/fmsg-webapi/main.go
similarity index 98%
rename from src/main.go
rename to cmd/fmsg-webapi/main.go
index f76ccdd..4348132 100644
--- a/src/main.go
+++ b/cmd/fmsg-webapi/main.go
@@ -16,9 +16,9 @@ import (
 	"github.com/gin-gonic/gin"
 	"github.com/joho/godotenv"
 
-	"github.com/markmnl/fmsg-webapi/db"
-	"github.com/markmnl/fmsg-webapi/handlers"
-	"github.com/markmnl/fmsg-webapi/middleware"
+	"github.com/markmnl/fmsg-webapi/internal/db"
+	"github.com/markmnl/fmsg-webapi/internal/handlers"
+	"github.com/markmnl/fmsg-webapi/internal/middleware"
 )
 
 func main() {
diff --git a/src/go.mod b/go.mod
similarity index 100%
rename from src/go.mod
rename to go.mod
diff --git a/src/go.sum b/go.sum
similarity index 100%
rename from src/go.sum
rename to go.sum
diff --git a/src/db/db.go b/internal/db/db.go
similarity index 100%
rename from src/db/db.go
rename to internal/db/db.go
diff --git a/src/handlers/attachments.go b/internal/handlers/attachments.go
similarity index 99%
rename from src/handlers/attachments.go
rename to internal/handlers/attachments.go
index c92b3da..51b22e4 100644
--- a/src/handlers/attachments.go
+++ b/internal/handlers/attachments.go
@@ -13,8 +13,8 @@ import (
 	"github.com/gin-gonic/gin"
 	"github.com/jackc/pgx/v5"
 
-	"github.com/markmnl/fmsg-webapi/db"
-	"github.com/markmnl/fmsg-webapi/middleware"
+	"github.com/markmnl/fmsg-webapi/internal/db"
+	"github.com/markmnl/fmsg-webapi/internal/middleware"
 )
 
 // AttachmentHandler holds dependencies for attachment routes.
diff --git a/src/handlers/hub.go b/internal/handlers/hub.go
similarity index 100%
rename from src/handlers/hub.go
rename to internal/handlers/hub.go
diff --git a/src/handlers/hub_test.go b/internal/handlers/hub_test.go
similarity index 100%
rename from src/handlers/hub_test.go
rename to internal/handlers/hub_test.go
diff --git a/src/handlers/messages.go b/internal/handlers/messages.go
similarity index 99%
rename from src/handlers/messages.go
rename to internal/handlers/messages.go
index f76143d..3a7613a 100644
--- a/src/handlers/messages.go
+++ b/internal/handlers/messages.go
@@ -19,9 +19,9 @@ import (
 	"github.com/gin-gonic/gin"
 	"github.com/jackc/pgx/v5"
 
-	"github.com/markmnl/fmsg-webapi/db"
-	"github.com/markmnl/fmsg-webapi/middleware"
-	"github.com/markmnl/fmsg-webapi/models"
+	"github.com/markmnl/fmsg-webapi/internal/db"
+	"github.com/markmnl/fmsg-webapi/internal/middleware"
+	"github.com/markmnl/fmsg-webapi/internal/models"
 )
 
 // MessageHandler holds dependencies for message routes.
diff --git a/src/handlers/messages_test.go b/internal/handlers/messages_test.go
similarity index 100%
rename from src/handlers/messages_test.go
rename to internal/handlers/messages_test.go
diff --git a/src/handlers/push.go b/internal/handlers/push.go
similarity index 98%
rename from src/handlers/push.go
rename to internal/handlers/push.go
index 0414fc7..1c9a7bf 100644
--- a/src/handlers/push.go
+++ b/internal/handlers/push.go
@@ -13,8 +13,8 @@ import (
 	"github.com/gin-gonic/gin"
 	"github.com/jackc/pgx/v5"
 
-	"github.com/markmnl/fmsg-webapi/db"
-	"github.com/markmnl/fmsg-webapi/middleware"
+	"github.com/markmnl/fmsg-webapi/internal/db"
+	"github.com/markmnl/fmsg-webapi/internal/middleware"
 )
 
 // pushTimeout caps how long a single new_msg push fan-out may take. It runs on
diff --git a/src/handlers/push_test.go b/internal/handlers/push_test.go
similarity index 98%
rename from src/handlers/push_test.go
rename to internal/handlers/push_test.go
index 3781283..93a1ad9 100644
--- a/src/handlers/push_test.go
+++ b/internal/handlers/push_test.go
@@ -8,7 +8,7 @@ import (
 
 	"github.com/gin-gonic/gin"
 
-	"github.com/markmnl/fmsg-webapi/middleware"
+	"github.com/markmnl/fmsg-webapi/internal/middleware"
 )
 
 func TestShouldPrune(t *testing.T) {
diff --git a/src/handlers/ws.go b/internal/handlers/ws.go
similarity index 98%
rename from src/handlers/ws.go
rename to internal/handlers/ws.go
index b40118f..e85f941 100644
--- a/src/handlers/ws.go
+++ b/internal/handlers/ws.go
@@ -10,7 +10,7 @@ import (
 	"github.com/gin-gonic/gin"
 	"github.com/gorilla/websocket"
 
-	"github.com/markmnl/fmsg-webapi/middleware"
+	"github.com/markmnl/fmsg-webapi/internal/middleware"
 )
 
 // WebSocket tuning constants.
diff --git a/src/middleware/cors.go b/internal/middleware/cors.go
similarity index 100%
rename from src/middleware/cors.go
rename to internal/middleware/cors.go
diff --git a/src/middleware/cors_test.go b/internal/middleware/cors_test.go
similarity index 100%
rename from src/middleware/cors_test.go
rename to internal/middleware/cors_test.go
diff --git a/src/middleware/jwt.go b/internal/middleware/jwt.go
similarity index 100%
rename from src/middleware/jwt.go
rename to internal/middleware/jwt.go
diff --git a/src/middleware/jwt_test.go b/internal/middleware/jwt_test.go
similarity index 100%
rename from src/middleware/jwt_test.go
rename to internal/middleware/jwt_test.go
diff --git a/src/middleware/util.go b/internal/middleware/util.go
similarity index 100%
rename from src/middleware/util.go
rename to internal/middleware/util.go
diff --git a/src/models/models.go b/internal/models/models.go
similarity index 100%
rename from src/models/models.go
rename to internal/models/models.go