diff --git a/Makefile b/Makefile
index 95694e0e1..e30469fcb 100644
--- a/Makefile
+++ b/Makefile
@@ -29,9 +29,9 @@ GO_PROJECT=github.com/ceph/ceph-csi
 
 # go build flags
 LDFLAGS ?=
-LDFLAGS += -X $(GO_PROJECT)/pkg/util.GitCommit=$(GIT_COMMIT)
+LDFLAGS += -X $(GO_PROJECT)/internal/util.GitCommit=$(GIT_COMMIT)
 # CSI_IMAGE_VERSION will be considered as the driver version
-LDFLAGS += -X $(GO_PROJECT)/pkg/util.DriverVersion=$(CSI_IMAGE_VERSION)
+LDFLAGS += -X $(GO_PROJECT)/internal/util.DriverVersion=$(CSI_IMAGE_VERSION)
 
 # set GOARCH explicitly for cross building, default to native architecture
 ifndef GOARCH
diff --git a/cmd/cephcsi.go b/cmd/cephcsi.go
index 2c3f92a6b..950a1b917 100644
--- a/cmd/cephcsi.go
+++ b/cmd/cephcsi.go
@@ -24,10 +24,10 @@ import (
 	"runtime"
 	"time"
 
-	"github.com/ceph/ceph-csi/pkg/cephfs"
-	"github.com/ceph/ceph-csi/pkg/liveness"
-	"github.com/ceph/ceph-csi/pkg/rbd"
-	"github.com/ceph/ceph-csi/pkg/util"
+	"github.com/ceph/ceph-csi/internal/cephfs"
+	"github.com/ceph/ceph-csi/internal/liveness"
+	"github.com/ceph/ceph-csi/internal/rbd"
+	"github.com/ceph/ceph-csi/internal/util"
 
 	"k8s.io/klog"
 )
diff --git a/docs/coding.md b/docs/coding.md
index 179fcfb4e..b3e9fb021 100644
--- a/docs/coding.md
+++ b/docs/coding.md
@@ -40,7 +40,7 @@ import (
  "github.com/pborman/uuid"
  "github.com/pkg/errors"
 
- "github.com/ceph/ceph-csi/pkg/util"
+ "github.com/ceph/ceph-csi/internal/util"
 )
 ```
 
diff --git a/pkg/cephfs/cephfs_util.go b/internal/cephfs/cephfs_util.go
similarity index 98%
rename from pkg/cephfs/cephfs_util.go
rename to internal/cephfs/cephfs_util.go
index 7dba08215..cda3b310a 100644
--- a/pkg/cephfs/cephfs_util.go
+++ b/internal/cephfs/cephfs_util.go
@@ -20,7 +20,7 @@ import (
 	"context"
 	"fmt"
 
-	"github.com/ceph/ceph-csi/pkg/util"
+	"github.com/ceph/ceph-csi/internal/util"
 )
 
 // MDSMap is a representation of the mds map sub-structure returned by 'ceph fs get'
diff --git a/pkg/cephfs/cephuser.go b/internal/cephfs/cephuser.go
similarity index 97%
rename from pkg/cephfs/cephuser.go
rename to internal/cephfs/cephuser.go
index 74f0b179d..1ac674397 100644
--- a/pkg/cephfs/cephuser.go
+++ b/internal/cephfs/cephuser.go
@@ -19,7 +19,7 @@ package cephfs
 import (
 	"context"
 
-	"github.com/ceph/ceph-csi/pkg/util"
+	"github.com/ceph/ceph-csi/internal/util"
 )
 
 const (
diff --git a/pkg/cephfs/controllerserver.go b/internal/cephfs/controllerserver.go
similarity index 99%
rename from pkg/cephfs/controllerserver.go
rename to internal/cephfs/controllerserver.go
index 6979ee1bf..ab52689c3 100644
--- a/pkg/cephfs/controllerserver.go
+++ b/internal/cephfs/controllerserver.go
@@ -19,8 +19,8 @@ package cephfs
 import (
 	"context"
 
-	csicommon "github.com/ceph/ceph-csi/pkg/csi-common"
-	"github.com/ceph/ceph-csi/pkg/util"
+	csicommon "github.com/ceph/ceph-csi/internal/csi-common"
+	"github.com/ceph/ceph-csi/internal/util"
 
 	"github.com/container-storage-interface/spec/lib/go/csi"
 	"google.golang.org/grpc/codes"
diff --git a/pkg/cephfs/driver.go b/internal/cephfs/driver.go
similarity index 98%
rename from pkg/cephfs/driver.go
rename to internal/cephfs/driver.go
index 406f39a37..bea2650fa 100644
--- a/pkg/cephfs/driver.go
+++ b/internal/cephfs/driver.go
@@ -19,8 +19,8 @@ package cephfs
 import (
 	"k8s.io/klog"
 
-	csicommon "github.com/ceph/ceph-csi/pkg/csi-common"
-	"github.com/ceph/ceph-csi/pkg/util"
+	csicommon "github.com/ceph/ceph-csi/internal/csi-common"
+	"github.com/ceph/ceph-csi/internal/util"
 
 	"github.com/container-storage-interface/spec/lib/go/csi"
 )
diff --git a/pkg/cephfs/errors.go b/internal/cephfs/errors.go
similarity index 100%
rename from pkg/cephfs/errors.go
rename to internal/cephfs/errors.go
diff --git a/pkg/cephfs/fsjournal.go b/internal/cephfs/fsjournal.go
similarity index 99%
rename from pkg/cephfs/fsjournal.go
rename to internal/cephfs/fsjournal.go
index a3e8ea711..97d60cd51 100644
--- a/pkg/cephfs/fsjournal.go
+++ b/internal/cephfs/fsjournal.go
@@ -19,7 +19,7 @@ package cephfs
 import (
 	"context"
 
-	"github.com/ceph/ceph-csi/pkg/util"
+	"github.com/ceph/ceph-csi/internal/util"
 
 	"k8s.io/klog"
 )
diff --git a/pkg/cephfs/identityserver.go b/internal/cephfs/identityserver.go
similarity index 96%
rename from pkg/cephfs/identityserver.go
rename to internal/cephfs/identityserver.go
index ab560cbf6..79511b6d6 100644
--- a/pkg/cephfs/identityserver.go
+++ b/internal/cephfs/identityserver.go
@@ -19,7 +19,7 @@ package cephfs
 import (
 	"context"
 
-	csicommon "github.com/ceph/ceph-csi/pkg/csi-common"
+	csicommon "github.com/ceph/ceph-csi/internal/csi-common"
 
 	"github.com/container-storage-interface/spec/lib/go/csi"
 )
diff --git a/pkg/cephfs/nodeserver.go b/internal/cephfs/nodeserver.go
similarity index 98%
rename from pkg/cephfs/nodeserver.go
rename to internal/cephfs/nodeserver.go
index 0504eb59d..ddb39b31d 100644
--- a/pkg/cephfs/nodeserver.go
+++ b/internal/cephfs/nodeserver.go
@@ -21,8 +21,8 @@ import (
 	"fmt"
 	"os"
 
-	csicommon "github.com/ceph/ceph-csi/pkg/csi-common"
-	"github.com/ceph/ceph-csi/pkg/util"
+	csicommon "github.com/ceph/ceph-csi/internal/csi-common"
+	"github.com/ceph/ceph-csi/internal/util"
 
 	"github.com/container-storage-interface/spec/lib/go/csi"
 	"google.golang.org/grpc/codes"
diff --git a/pkg/cephfs/util.go b/internal/cephfs/util.go
similarity index 98%
rename from pkg/cephfs/util.go
rename to internal/cephfs/util.go
index 9f57d7de3..b8254c902 100644
--- a/pkg/cephfs/util.go
+++ b/internal/cephfs/util.go
@@ -24,7 +24,7 @@ import (
 	"os"
 	"os/exec"
 
-	"github.com/ceph/ceph-csi/pkg/util"
+	"github.com/ceph/ceph-csi/internal/util"
 
 	"github.com/container-storage-interface/spec/lib/go/csi"
 	"google.golang.org/grpc/codes"
diff --git a/pkg/cephfs/volume.go b/internal/cephfs/volume.go
similarity index 99%
rename from pkg/cephfs/volume.go
rename to internal/cephfs/volume.go
index daf0e0a10..776a3a229 100644
--- a/pkg/cephfs/volume.go
+++ b/internal/cephfs/volume.go
@@ -24,7 +24,7 @@ import (
 	"strconv"
 	"strings"
 
-	"github.com/ceph/ceph-csi/pkg/util"
+	"github.com/ceph/ceph-csi/internal/util"
 
 	"k8s.io/klog"
 )
diff --git a/pkg/cephfs/volumemounter.go b/internal/cephfs/volumemounter.go
similarity index 99%
rename from pkg/cephfs/volumemounter.go
rename to internal/cephfs/volumemounter.go
index 0854004f9..4da6f0c10 100644
--- a/pkg/cephfs/volumemounter.go
+++ b/internal/cephfs/volumemounter.go
@@ -27,7 +27,7 @@ import (
 	"strings"
 	"sync"
 
-	"github.com/ceph/ceph-csi/pkg/util"
+	"github.com/ceph/ceph-csi/internal/util"
 
 	"golang.org/x/sys/unix"
 	"k8s.io/klog"
diff --git a/pkg/cephfs/volumemounter_test.go b/internal/cephfs/volumemounter_test.go
similarity index 100%
rename from pkg/cephfs/volumemounter_test.go
rename to internal/cephfs/volumemounter_test.go
diff --git a/pkg/cephfs/volumeoptions.go b/internal/cephfs/volumeoptions.go
similarity index 99%
rename from pkg/cephfs/volumeoptions.go
rename to internal/cephfs/volumeoptions.go
index 93acbac5c..1567a9034 100644
--- a/pkg/cephfs/volumeoptions.go
+++ b/internal/cephfs/volumeoptions.go
@@ -24,7 +24,7 @@ import (
 	"github.com/container-storage-interface/spec/lib/go/csi"
 	"github.com/pkg/errors"
 
-	"github.com/ceph/ceph-csi/pkg/util"
+	"github.com/ceph/ceph-csi/internal/util"
 )
 
 type volumeOptions struct {
diff --git a/pkg/csi-common/controllerserver-default.go b/internal/csi-common/controllerserver-default.go
similarity index 98%
rename from pkg/csi-common/controllerserver-default.go
rename to internal/csi-common/controllerserver-default.go
index 7423c5d93..8c5ef9b7d 100644
--- a/pkg/csi-common/controllerserver-default.go
+++ b/internal/csi-common/controllerserver-default.go
@@ -19,7 +19,7 @@ package csicommon
 import (
 	"context"
 
-	"github.com/ceph/ceph-csi/pkg/util"
+	"github.com/ceph/ceph-csi/internal/util"
 
 	"github.com/container-storage-interface/spec/lib/go/csi"
 	"google.golang.org/grpc/codes"
diff --git a/pkg/csi-common/driver.go b/internal/csi-common/driver.go
similarity index 100%
rename from pkg/csi-common/driver.go
rename to internal/csi-common/driver.go
diff --git a/pkg/csi-common/identityserver-default.go b/internal/csi-common/identityserver-default.go
similarity index 98%
rename from pkg/csi-common/identityserver-default.go
rename to internal/csi-common/identityserver-default.go
index cb83595ec..d00520ddf 100644
--- a/pkg/csi-common/identityserver-default.go
+++ b/internal/csi-common/identityserver-default.go
@@ -19,7 +19,7 @@ package csicommon
 import (
 	"context"
 
-	"github.com/ceph/ceph-csi/pkg/util"
+	"github.com/ceph/ceph-csi/internal/util"
 
 	"github.com/container-storage-interface/spec/lib/go/csi"
 	"google.golang.org/grpc/codes"
diff --git a/pkg/csi-common/nodeserver-default.go b/internal/csi-common/nodeserver-default.go
similarity index 99%
rename from pkg/csi-common/nodeserver-default.go
rename to internal/csi-common/nodeserver-default.go
index 031189360..af0159e07 100644
--- a/pkg/csi-common/nodeserver-default.go
+++ b/internal/csi-common/nodeserver-default.go
@@ -20,7 +20,7 @@ import (
 	"fmt"
 	"os"
 
-	"github.com/ceph/ceph-csi/pkg/util"
+	"github.com/ceph/ceph-csi/internal/util"
 
 	"context"
 
diff --git a/pkg/csi-common/server.go b/internal/csi-common/server.go
similarity index 100%
rename from pkg/csi-common/server.go
rename to internal/csi-common/server.go
diff --git a/pkg/csi-common/utils.go b/internal/csi-common/utils.go
similarity index 99%
rename from pkg/csi-common/utils.go
rename to internal/csi-common/utils.go
index f9b14b9c8..dea2cc891 100644
--- a/pkg/csi-common/utils.go
+++ b/internal/csi-common/utils.go
@@ -23,7 +23,7 @@ import (
 	"strings"
 	"sync/atomic"
 
-	"github.com/ceph/ceph-csi/pkg/util"
+	"github.com/ceph/ceph-csi/internal/util"
 
 	"github.com/container-storage-interface/spec/lib/go/csi"
 	"github.com/kubernetes-csi/csi-lib-utils/protosanitizer"
diff --git a/pkg/csi-common/utils_test.go b/internal/csi-common/utils_test.go
similarity index 100%
rename from pkg/csi-common/utils_test.go
rename to internal/csi-common/utils_test.go
diff --git a/pkg/liveness/liveness.go b/internal/liveness/liveness.go
similarity index 98%
rename from pkg/liveness/liveness.go
rename to internal/liveness/liveness.go
index f1e160aeb..327ca9476 100644
--- a/pkg/liveness/liveness.go
+++ b/internal/liveness/liveness.go
@@ -20,7 +20,7 @@ import (
 	"context"
 	"time"
 
-	"github.com/ceph/ceph-csi/pkg/util"
+	"github.com/ceph/ceph-csi/internal/util"
 
 	connlib "github.com/kubernetes-csi/csi-lib-utils/connection"
 	"github.com/kubernetes-csi/csi-lib-utils/metrics"
diff --git a/pkg/rbd/controllerserver.go b/internal/rbd/controllerserver.go
similarity index 99%
rename from pkg/rbd/controllerserver.go
rename to internal/rbd/controllerserver.go
index 05bc2974a..60d42b06e 100644
--- a/pkg/rbd/controllerserver.go
+++ b/internal/rbd/controllerserver.go
@@ -20,8 +20,8 @@ import (
 	"context"
 	"fmt"
 
-	csicommon "github.com/ceph/ceph-csi/pkg/csi-common"
-	"github.com/ceph/ceph-csi/pkg/util"
+	csicommon "github.com/ceph/ceph-csi/internal/csi-common"
+	"github.com/ceph/ceph-csi/internal/util"
 
 	"github.com/container-storage-interface/spec/lib/go/csi"
 	"github.com/kubernetes-csi/csi-lib-utils/protosanitizer"
diff --git a/pkg/rbd/driver.go b/internal/rbd/driver.go
similarity index 98%
rename from pkg/rbd/driver.go
rename to internal/rbd/driver.go
index 7726ae730..3109eb95d 100644
--- a/pkg/rbd/driver.go
+++ b/internal/rbd/driver.go
@@ -17,8 +17,8 @@ limitations under the License.
 package rbd
 
 import (
-	csicommon "github.com/ceph/ceph-csi/pkg/csi-common"
-	"github.com/ceph/ceph-csi/pkg/util"
+	csicommon "github.com/ceph/ceph-csi/internal/csi-common"
+	"github.com/ceph/ceph-csi/internal/util"
 
 	"github.com/container-storage-interface/spec/lib/go/csi"
 	"k8s.io/klog"
diff --git a/pkg/rbd/errors.go b/internal/rbd/errors.go
similarity index 100%
rename from pkg/rbd/errors.go
rename to internal/rbd/errors.go
diff --git a/pkg/rbd/identityserver.go b/internal/rbd/identityserver.go
similarity index 96%
rename from pkg/rbd/identityserver.go
rename to internal/rbd/identityserver.go
index aecc41c83..e00314ea1 100644
--- a/pkg/rbd/identityserver.go
+++ b/internal/rbd/identityserver.go
@@ -19,7 +19,7 @@ package rbd
 import (
 	"context"
 
-	csicommon "github.com/ceph/ceph-csi/pkg/csi-common"
+	csicommon "github.com/ceph/ceph-csi/internal/csi-common"
 
 	"github.com/container-storage-interface/spec/lib/go/csi"
 )
diff --git a/pkg/rbd/nodeserver.go b/internal/rbd/nodeserver.go
similarity index 99%
rename from pkg/rbd/nodeserver.go
rename to internal/rbd/nodeserver.go
index 8359a93a4..d018ea76c 100644
--- a/pkg/rbd/nodeserver.go
+++ b/internal/rbd/nodeserver.go
@@ -23,8 +23,8 @@ import (
 	"strconv"
 	"strings"
 
-	csicommon "github.com/ceph/ceph-csi/pkg/csi-common"
-	"github.com/ceph/ceph-csi/pkg/util"
+	csicommon "github.com/ceph/ceph-csi/internal/csi-common"
+	"github.com/ceph/ceph-csi/internal/util"
 
 	"github.com/container-storage-interface/spec/lib/go/csi"
 	"google.golang.org/grpc/codes"
diff --git a/pkg/rbd/nodeserver_test.go b/internal/rbd/nodeserver_test.go
similarity index 100%
rename from pkg/rbd/nodeserver_test.go
rename to internal/rbd/nodeserver_test.go
diff --git a/pkg/rbd/rbd_attach.go b/internal/rbd/rbd_attach.go
similarity index 99%
rename from pkg/rbd/rbd_attach.go
rename to internal/rbd/rbd_attach.go
index 33ee2dcfb..fbcacc8b6 100644
--- a/pkg/rbd/rbd_attach.go
+++ b/internal/rbd/rbd_attach.go
@@ -25,7 +25,7 @@ import (
 	"strings"
 	"time"
 
-	"github.com/ceph/ceph-csi/pkg/util"
+	"github.com/ceph/ceph-csi/internal/util"
 
 	"k8s.io/apimachinery/pkg/util/wait"
 	"k8s.io/klog"
diff --git a/pkg/rbd/rbd_journal.go b/internal/rbd/rbd_journal.go
similarity index 99%
rename from pkg/rbd/rbd_journal.go
rename to internal/rbd/rbd_journal.go
index d4cb5f126..f61062f93 100644
--- a/pkg/rbd/rbd_journal.go
+++ b/internal/rbd/rbd_journal.go
@@ -20,7 +20,7 @@ import (
 	"context"
 	"fmt"
 
-	"github.com/ceph/ceph-csi/pkg/util"
+	"github.com/ceph/ceph-csi/internal/util"
 
 	"github.com/pkg/errors"
 	"k8s.io/klog"
diff --git a/pkg/rbd/rbd_util.go b/internal/rbd/rbd_util.go
similarity index 99%
rename from pkg/rbd/rbd_util.go
rename to internal/rbd/rbd_util.go
index f2b2df179..f43741ec0 100644
--- a/pkg/rbd/rbd_util.go
+++ b/internal/rbd/rbd_util.go
@@ -28,7 +28,7 @@ import (
 	"strings"
 	"time"
 
-	"github.com/ceph/ceph-csi/pkg/util"
+	"github.com/ceph/ceph-csi/internal/util"
 
 	"github.com/ceph/go-ceph/rados"
 	librbd "github.com/ceph/go-ceph/rbd"
diff --git a/pkg/rbd/rbd_util_test.go b/internal/rbd/rbd_util_test.go
similarity index 100%
rename from pkg/rbd/rbd_util_test.go
rename to internal/rbd/rbd_util_test.go
diff --git a/pkg/util/cachepersister.go b/internal/util/cachepersister.go
similarity index 100%
rename from pkg/util/cachepersister.go
rename to internal/util/cachepersister.go
diff --git a/pkg/util/cephcmds.go b/internal/util/cephcmds.go
similarity index 100%
rename from pkg/util/cephcmds.go
rename to internal/util/cephcmds.go
diff --git a/pkg/util/cephconf.go b/internal/util/cephconf.go
similarity index 100%
rename from pkg/util/cephconf.go
rename to internal/util/cephconf.go
diff --git a/pkg/util/conn_pool.go b/internal/util/conn_pool.go
similarity index 100%
rename from pkg/util/conn_pool.go
rename to internal/util/conn_pool.go
diff --git a/pkg/util/conn_pool_test.go b/internal/util/conn_pool_test.go
similarity index 100%
rename from pkg/util/conn_pool_test.go
rename to internal/util/conn_pool_test.go
diff --git a/pkg/util/credentials.go b/internal/util/credentials.go
similarity index 100%
rename from pkg/util/credentials.go
rename to internal/util/credentials.go
diff --git a/pkg/util/crypto.go b/internal/util/crypto.go
similarity index 100%
rename from pkg/util/crypto.go
rename to internal/util/crypto.go
diff --git a/pkg/util/cryptsetup.go b/internal/util/cryptsetup.go
similarity index 100%
rename from pkg/util/cryptsetup.go
rename to internal/util/cryptsetup.go
diff --git a/pkg/util/csiconfig.go b/internal/util/csiconfig.go
similarity index 100%
rename from pkg/util/csiconfig.go
rename to internal/util/csiconfig.go
diff --git a/pkg/util/csiconfig_test.go b/internal/util/csiconfig_test.go
similarity index 100%
rename from pkg/util/csiconfig_test.go
rename to internal/util/csiconfig_test.go
diff --git a/pkg/util/errors.go b/internal/util/errors.go
similarity index 100%
rename from pkg/util/errors.go
rename to internal/util/errors.go
diff --git a/pkg/util/httpserver.go b/internal/util/httpserver.go
similarity index 100%
rename from pkg/util/httpserver.go
rename to internal/util/httpserver.go
diff --git a/pkg/util/idlocker.go b/internal/util/idlocker.go
similarity index 100%
rename from pkg/util/idlocker.go
rename to internal/util/idlocker.go
diff --git a/pkg/util/idlocker_test.go b/internal/util/idlocker_test.go
similarity index 100%
rename from pkg/util/idlocker_test.go
rename to internal/util/idlocker_test.go
diff --git a/pkg/util/k8scmcache.go b/internal/util/k8scmcache.go
similarity index 100%
rename from pkg/util/k8scmcache.go
rename to internal/util/k8scmcache.go
diff --git a/pkg/util/log.go b/internal/util/log.go
similarity index 100%
rename from pkg/util/log.go
rename to internal/util/log.go
diff --git a/pkg/util/nodecache.go b/internal/util/nodecache.go
similarity index 100%
rename from pkg/util/nodecache.go
rename to internal/util/nodecache.go
diff --git a/pkg/util/pidlimit.go b/internal/util/pidlimit.go
similarity index 100%
rename from pkg/util/pidlimit.go
rename to internal/util/pidlimit.go
diff --git a/pkg/util/pidlimit_test.go b/internal/util/pidlimit_test.go
similarity index 100%
rename from pkg/util/pidlimit_test.go
rename to internal/util/pidlimit_test.go
diff --git a/pkg/util/stripsecrets.go b/internal/util/stripsecrets.go
similarity index 100%
rename from pkg/util/stripsecrets.go
rename to internal/util/stripsecrets.go
diff --git a/pkg/util/topology.go b/internal/util/topology.go
similarity index 100%
rename from pkg/util/topology.go
rename to internal/util/topology.go
diff --git a/pkg/util/topology_test.go b/internal/util/topology_test.go
similarity index 100%
rename from pkg/util/topology_test.go
rename to internal/util/topology_test.go
diff --git a/pkg/util/util.go b/internal/util/util.go
similarity index 100%
rename from pkg/util/util.go
rename to internal/util/util.go
diff --git a/pkg/util/util_test.go b/internal/util/util_test.go
similarity index 100%
rename from pkg/util/util_test.go
rename to internal/util/util_test.go
diff --git a/pkg/util/validate.go b/internal/util/validate.go
similarity index 100%
rename from pkg/util/validate.go
rename to internal/util/validate.go
diff --git a/pkg/util/vault.go b/internal/util/vault.go
similarity index 100%
rename from pkg/util/vault.go
rename to internal/util/vault.go
diff --git a/pkg/util/volid.go b/internal/util/volid.go
similarity index 100%
rename from pkg/util/volid.go
rename to internal/util/volid.go
diff --git a/pkg/util/volid_test.go b/internal/util/volid_test.go
similarity index 100%
rename from pkg/util/volid_test.go
rename to internal/util/volid_test.go
diff --git a/pkg/util/voljournal.go b/internal/util/voljournal.go
similarity index 100%
rename from pkg/util/voljournal.go
rename to internal/util/voljournal.go
diff --git a/scripts/gosec.sh b/scripts/gosec.sh
index c3de635e9..83bd49974 100755
--- a/scripts/gosec.sh
+++ b/scripts/gosec.sh
@@ -6,7 +6,7 @@ if [[ -x "$(command -v gosec)" ]]; then
   # gosec does not support -mod=vendor, so fallback to non-module support and
   # assume all dependencies are available in ./vendor already
   export GO111MODULE=off
-  find cmd pkg -type d -print0 | xargs --null gosec
+  find cmd internal -type d -print0 | xargs --null gosec
 else
   echo "WARNING: gosec not found, skipping security tests" >&2
 fi