diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6f241c6bf..740c2778c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -175,11 +175,11 @@ jobs:
         run: |
           yq < workspace/coordinator.yaml \
             'select(.kind == "Deployment") | .spec.template.metadata.annotations["io.katacontainers.config.agent.policy"]' |
-            base64 -d | sha256sum | cut -d " " -f1 > cli/assets/coordinator-policy-hash
+            base64 -d | sha256sum | cut -d " " -f1 > cli/cmd/assets/coordinator-policy-hash
 
           git config --global user.name "edgelessci"
           git config --global user.email "edgelessci@users.noreply.github.com"
-          git add cli/assets/coordinator-policy-hash
+          git add cli/cmd/assets/coordinator-policy-hash
           git diff --staged --quiet || git commit -m "release: update coordinator policy hash"
       - name: Build CLI
         run: |
diff --git a/cli/assets/coordinator-policy-hash b/cli/cmd/assets/coordinator-policy-hash
similarity index 100%
rename from cli/assets/coordinator-policy-hash
rename to cli/cmd/assets/coordinator-policy-hash
diff --git a/cli/assets/genpolicy b/cli/cmd/assets/genpolicy
similarity index 100%
rename from cli/assets/genpolicy
rename to cli/cmd/assets/genpolicy
diff --git a/cli/assets/genpolicy-rules.rego b/cli/cmd/assets/genpolicy-rules.rego
similarity index 100%
rename from cli/assets/genpolicy-rules.rego
rename to cli/cmd/assets/genpolicy-rules.rego
diff --git a/cli/assets/genpolicy-settings.json b/cli/cmd/assets/genpolicy-settings.json
similarity index 100%
rename from cli/assets/genpolicy-settings.json
rename to cli/cmd/assets/genpolicy-settings.json
diff --git a/cli/constants.go b/cli/cmd/common.go
similarity index 92%
rename from cli/constants.go
rename to cli/cmd/common.go
index ce4ec73ae..d20f54cc5 100644
--- a/cli/constants.go
+++ b/cli/cmd/common.go
@@ -1,4 +1,4 @@
-package main
+package cmd
 
 import (
 	_ "embed"
@@ -37,3 +37,9 @@ func cachedir(subdir string) (string, error) {
 	}
 	return filepath.Join(dir, subdir), nil
 }
+
+func must(err error) {
+	if err != nil {
+		panic(err)
+	}
+}
diff --git a/cli/generate.go b/cli/cmd/generate.go
similarity index 99%
rename from cli/generate.go
rename to cli/cmd/generate.go
index ace23a12f..e51902dc1 100644
--- a/cli/generate.go
+++ b/cli/cmd/generate.go
@@ -1,4 +1,4 @@
-package main
+package cmd
 
 import (
 	"bytes"
@@ -30,7 +30,8 @@ const (
 	nunkiRoleAnnotationKey  = "nunki.edgeless.systems/pod-role"
 )
 
-func newGenerateCmd() *cobra.Command {
+// NewGenerateCmd creates the nunki generate subcommand.
+func NewGenerateCmd() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "generate [flags] paths...",
 		Short: "generate policies and inject into Kubernetes resources",
diff --git a/cli/log.go b/cli/cmd/log.go
similarity index 98%
rename from cli/log.go
rename to cli/cmd/log.go
index fe719b864..8ee1657e8 100644
--- a/cli/log.go
+++ b/cli/cmd/log.go
@@ -1,4 +1,4 @@
-package main
+package cmd
 
 import (
 	"fmt"
diff --git a/cli/policies.go b/cli/cmd/policies.go
similarity index 99%
rename from cli/policies.go
rename to cli/cmd/policies.go
index 1552700f1..91cc44b27 100644
--- a/cli/policies.go
+++ b/cli/cmd/policies.go
@@ -1,4 +1,4 @@
-package main
+package cmd
 
 import (
 	"fmt"
diff --git a/cli/runtime.go b/cli/cmd/runtime.go
similarity index 94%
rename from cli/runtime.go
rename to cli/cmd/runtime.go
index 5c4782e8c..f3828b06f 100644
--- a/cli/runtime.go
+++ b/cli/cmd/runtime.go
@@ -1,4 +1,4 @@
-package main
+package cmd
 
 // DefaultCoordinatorPolicyHash is derived from the coordinator release candidate and injected at release build time.
 //
diff --git a/cli/set.go b/cli/cmd/set.go
similarity index 98%
rename from cli/set.go
rename to cli/cmd/set.go
index e9cbb55bc..dfc6475a8 100644
--- a/cli/set.go
+++ b/cli/cmd/set.go
@@ -1,4 +1,4 @@
-package main
+package cmd
 
 import (
 	"context"
@@ -28,7 +28,8 @@ import (
 	"google.golang.org/grpc/status"
 )
 
-func newSetCmd() *cobra.Command {
+// NewSetCmd creates the nunki set subcommand.
+func NewSetCmd() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "set [flags] paths...",
 		Short: "Set the given manifest at the coordinator",
diff --git a/cli/verify.go b/cli/cmd/verify.go
similarity index 98%
rename from cli/verify.go
rename to cli/cmd/verify.go
index 13e736dc3..0cdef5f10 100644
--- a/cli/verify.go
+++ b/cli/cmd/verify.go
@@ -1,4 +1,4 @@
-package main
+package cmd
 
 import (
 	"crypto/sha256"
@@ -20,7 +20,8 @@ import (
 	"github.com/spf13/cobra"
 )
 
-func newVerifyCmd() *cobra.Command {
+// NewVerifyCmd creates the nunki verify subcommand.
+func NewVerifyCmd() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "verify",
 		Short: "Verify a nunki deployment",
diff --git a/cli/main.go b/cli/main.go
index ab6314fe5..789804652 100644
--- a/cli/main.go
+++ b/cli/main.go
@@ -6,6 +6,7 @@ import (
 	"os"
 	"os/signal"
 
+	"github.com/edgelesssys/nunki/cli/cmd"
 	"github.com/spf13/cobra"
 )
 
@@ -25,23 +26,23 @@ func execute() error {
 var version = "0.0.0-dev"
 
 func newRootCmd() *cobra.Command {
-	cmd := &cobra.Command{
+	root := &cobra.Command{
 		Short:            "nunki",
 		PersistentPreRun: preRunRoot,
 		Version:          version,
 	}
-	cmd.SetOut(os.Stdout)
+	root.SetOut(os.Stdout)
 
-	cmd.PersistentFlags().String("log-level", "warn", "set logging level (debug, info, warn, error, or a number)")
+	root.PersistentFlags().String("log-level", "warn", "set logging level (debug, info, warn, error, or a number)")
 
-	cmd.InitDefaultVersionFlag()
-	cmd.AddCommand(
-		newGenerateCmd(),
-		newSetCmd(),
-		newVerifyCmd(),
+	root.InitDefaultVersionFlag()
+	root.AddCommand(
+		cmd.NewGenerateCmd(),
+		cmd.NewSetCmd(),
+		cmd.NewVerifyCmd(),
 	)
 
-	return cmd
+	return root
 }
 
 // signalContext returns a context that is canceled on the handed signal.
@@ -74,9 +75,3 @@ func signalContext(ctx context.Context, sig os.Signal) (context.Context, context
 func preRunRoot(cmd *cobra.Command, _ []string) {
 	cmd.SilenceUsage = true
 }
-
-func must(err error) {
-	if err != nil {
-		panic(err)
-	}
-}
diff --git a/packages/by-name/cli-release/package.nix b/packages/by-name/cli-release/package.nix
index 63ec19662..b0c1ce2af 100644
--- a/packages/by-name/cli-release/package.nix
+++ b/packages/by-name/cli-release/package.nix
@@ -6,12 +6,12 @@
 
 (nunki.overrideAttrs (_finalAttrs: previousAttrs: {
   prePatch = ''
-    install -D ${lib.getExe genpolicy} cli/assets/genpolicy
-    install -D ${genpolicy.settings}/genpolicy-settings.json cli/assets/genpolicy-settings.json
-    install -D ${genpolicy.rules}/genpolicy-rules.rego cli/assets/genpolicy-rules.rego
+    install -D ${lib.getExe genpolicy} cli/cmd/assets/genpolicy
+    install -D ${genpolicy.settings}/genpolicy-settings.json cli/cmd/assets/genpolicy-settings.json
+    install -D ${genpolicy.rules}/genpolicy-rules.rego cli/cmd/assets/genpolicy-rules.rego
   '';
 
   ldflags = previousAttrs.ldflags ++ [
-    "-X main.DefaultCoordinatorPolicyHash=${builtins.readFile ../../../cli/assets/coordinator-policy-hash}"
+    "-X main.DefaultCoordinatorPolicyHash=${builtins.readFile ../../../cli/cmd/assets/coordinator-policy-hash}"
   ];
 })).cli
diff --git a/packages/by-name/nunki/package.nix b/packages/by-name/nunki/package.nix
index 8647f628d..0721a4679 100644
--- a/packages/by-name/nunki/package.nix
+++ b/packages/by-name/nunki/package.nix
@@ -48,9 +48,9 @@ buildGoModule rec {
   subPackages = [ "coordinator" "initializer" "cli" ];
 
   prePatch = ''
-    install -D ${lib.getExe genpolicy} cli/assets/genpolicy
-    install -D ${genpolicy.settings-dev}/genpolicy-settings.json cli/assets/genpolicy-settings.json
-    install -D ${genpolicy.rules}/genpolicy-rules.rego cli/assets/genpolicy-rules.rego
+    install -D ${lib.getExe genpolicy} cli/cmd/assets/genpolicy
+    install -D ${genpolicy.settings-dev}/genpolicy-settings.json cli/cmd/assets/genpolicy-settings.json
+    install -D ${genpolicy.rules}/genpolicy-rules.rego cli/cmd/assets/genpolicy-rules.rego
   '';
 
   CGO_ENABLED = 0;