diff --git a/main.go b/cmd/vault-plugin-secrets-kubernetes/main.go
similarity index 81%
rename from main.go
rename to cmd/vault-plugin-secrets-kubernetes/main.go
index b8d4e54..2e4e4dc 100644
--- a/main.go
+++ b/cmd/vault-plugin-secrets-kubernetes/main.go
@@ -6,6 +6,7 @@ import (
 
 	"github.com/hashicorp/vault/helper/pluginutil"
 	"github.com/hashicorp/vault/logical/plugin"
+	"github.com/paxos-bankchain/vault-plugin-secrets-kubernetes/pkg/backend"
 )
 
 func main() {
@@ -17,7 +18,7 @@ func main() {
 	tlsProviderFunc := pluginutil.VaultPluginTLSProvider(tlsConfig)
 
 	if err := plugin.Serve(&plugin.ServeOpts{
-		BackendFactoryFunc: Factory,
+		BackendFactoryFunc: backend.Factory,
 		TLSProviderFunc:    tlsProviderFunc,
 	}); err != nil {
 		log.Fatal(err)
diff --git a/backend.go b/pkg/backend/backend.go
similarity index 98%
rename from backend.go
rename to pkg/backend/backend.go
index 3938c8b..94ea501 100644
--- a/backend.go
+++ b/pkg/backend/backend.go
@@ -1,4 +1,4 @@
-package main
+package backend
 
 import (
 	"context"
diff --git a/backend_test.go b/pkg/backend/backend_test.go
similarity index 99%
rename from backend_test.go
rename to pkg/backend/backend_test.go
index 4fd2720..cc02a1e 100644
--- a/backend_test.go
+++ b/pkg/backend/backend_test.go
@@ -1,4 +1,4 @@
-package main
+package backend
 
 import (
 	"bytes"
diff --git a/path_roles.go b/pkg/backend/path_roles.go
similarity index 99%
rename from path_roles.go
rename to pkg/backend/path_roles.go
index f294050..a65894b 100644
--- a/path_roles.go
+++ b/pkg/backend/path_roles.go
@@ -1,4 +1,4 @@
-package main
+package backend
 
 import (
 	"context"
diff --git a/path_token.go b/pkg/backend/path_token.go
similarity index 99%
rename from path_token.go
rename to pkg/backend/path_token.go
index 9be3af8..8292b82 100644
--- a/path_token.go
+++ b/pkg/backend/path_token.go
@@ -1,4 +1,4 @@
-package main
+package backend
 
 import (
 	"context"
diff --git a/path_tokenreviews.go b/pkg/backend/path_tokenreviews.go
similarity index 97%
rename from path_tokenreviews.go
rename to pkg/backend/path_tokenreviews.go
index 22e474e..2a53d6d 100644
--- a/path_tokenreviews.go
+++ b/pkg/backend/path_tokenreviews.go
@@ -1,4 +1,4 @@
-package main
+package backend
 
 import (
 	"context"
@@ -94,7 +94,7 @@ func reviewResponseErr(code int, err string) (*logical.Response, error) {
 	})
 }
 
-// reviewResponseDeny packages an error response for Kubernetes.
+// reviewResponseDeny packages a deny response for Kubernetes.
 func reviewResponseDeny(reason string) (*logical.Response, error) {
 	// Deny. HTTP code is OK, because we're not actually denying the review request -
 	// just saying that the apiserver should deny the client.
diff --git a/secret_token.go b/pkg/backend/secret_token.go
similarity index 99%
rename from secret_token.go
rename to pkg/backend/secret_token.go
index 5954776..ba13faa 100644
--- a/secret_token.go
+++ b/pkg/backend/secret_token.go
@@ -1,4 +1,4 @@
-package main
+package backend
 
 import (
 	"context"