diff --git a/cloud/agent/BUILD.bazel b/cloud/agent/BUILD.bazel
index 96e3a38..6f5ce82 100644
--- a/cloud/agent/BUILD.bazel
+++ b/cloud/agent/BUILD.bazel
@@ -1,6 +1,4 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library", "go_test")
-load("//metropolis/node/build/fwprune:def.bzl", "fsspec_linux_firmware")
-load("//metropolis/node/build:def.bzl", "node_initramfs")
 
 go_library(
     name = "agent_lib",
@@ -57,25 +55,3 @@
         "@com_github_stretchr_testify//assert",
     ],
 )
-
-fsspec_linux_firmware(
-    name = "firmware",
-    firmware_files = ["@linux-firmware//:all_files"],
-    kernel = "//third_party/linux",
-    metadata = "@linux-firmware//:metadata",
-)
-
-node_initramfs(
-    name = "initramfs",
-    files = {
-        ":agent": "/init",
-        "@com_github_coredns_coredns//:coredns": "/kubernetes/bin/coredns",
-        "//metropolis/node/core/network/dns:resolv.conf": "/etc/resolv.conf",
-        "@cacerts//file": "/etc/ssl/cert.pem",
-    },
-    fsspecs = [
-        "//metropolis/node/build:earlydev.fsspec",
-        ":firmware",
-    ],
-    visibility = ["//cloud:__subpackages__"],
-)
diff --git a/cloud/agent/e2e/BUILD.bazel b/cloud/agent/e2e/BUILD.bazel
index 16e9731..d05031b 100644
--- a/cloud/agent/e2e/BUILD.bazel
+++ b/cloud/agent/e2e/BUILD.bazel
@@ -4,7 +4,7 @@
     name = "e2e_test",
     srcs = ["main_test.go"],
     data = [
-        "//cloud/agent:initramfs",
+        "//cloud/agent/takeover:initramfs",
         "//metropolis/installer/test/testos:testos_bundle",
         "//third_party/edk2:firmware",
         "//third_party/linux",
diff --git a/cloud/agent/e2e/main_test.go b/cloud/agent/e2e/main_test.go
index a422d0e..4fd06ec 100644
--- a/cloud/agent/e2e/main_test.go
+++ b/cloud/agent/e2e/main_test.go
@@ -184,7 +184,7 @@
 	if err != nil {
 		t.Fatal(err)
 	}
-	initramfsOrigPath, err := runfiles.Rlocation("_main/cloud/agent/initramfs.cpio.zst")
+	initramfsOrigPath, err := runfiles.Rlocation("_main/cloud/agent/takeover/initramfs.cpio.zst")
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/cloud/agent/takeover/BUILD.bazel b/cloud/agent/takeover/BUILD.bazel
new file mode 100644
index 0000000..855621a
--- /dev/null
+++ b/cloud/agent/takeover/BUILD.bazel
@@ -0,0 +1,71 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
+load("//metropolis/node/build/mkucode:def.bzl", "cpio_ucode")
+load("//build/static_binary_tarball:def.bzl", "static_binary_tarball")
+load("//metropolis/node/build:def.bzl", "node_initramfs")
+load("//metropolis/node/build/fwprune:def.bzl", "fsspec_linux_firmware")
+
+go_library(
+    name = "takeover_lib",
+    srcs = ["takeover.go"],
+    embedsrcs = [
+        "//third_party/linux",  #keep
+        ":ucode",  #keep
+        ":initramfs",  #keep
+    ],
+    importpath = "source.monogon.dev/cloud/agent/takeover",
+    visibility = ["//visibility:private"],
+    deps = [
+        "//cloud/agent/api",
+        "//metropolis/pkg/bootparam",
+        "//metropolis/pkg/kexec",
+        "//net/dump",
+        "//net/proto",
+        "@com_github_cavaliergopher_cpio//:cpio",
+        "@com_github_klauspost_compress//zstd",
+        "@org_golang_google_protobuf//proto",
+        "@org_golang_x_sys//unix",
+    ],
+)
+
+node_initramfs(
+    name = "initramfs",
+    files = {
+        "//cloud/agent:agent": "/init",
+        "@com_github_coredns_coredns//:coredns": "/kubernetes/bin/coredns",
+        "//metropolis/node/core/network/dns:resolv.conf": "/etc/resolv.conf",
+        "@cacerts//file": "/etc/ssl/cert.pem",
+    },
+    fsspecs = [
+        "//metropolis/node/build:earlydev.fsspec",
+        ":firmware",
+    ],
+    visibility = ["//cloud/agent:__subpackages__"],
+)
+
+go_binary(
+    name = "takeover",
+    embed = [":takeover_lib"],
+    visibility = ["//visibility:public"],
+)
+
+cpio_ucode(
+    name = "ucode",
+    ucode = {
+        "@linux-firmware//:amd_ucode": "AuthenticAMD",
+        "@intel_ucode//:fam6h": "GenuineIntel",
+    },
+)
+
+fsspec_linux_firmware(
+    name = "firmware",
+    firmware_files = ["@linux-firmware//:all_files"],
+    kernel = "//third_party/linux",
+    metadata = "@linux-firmware//:metadata",
+)
+
+# Used by container_images, forces a static build of the test_agent.
+static_binary_tarball(
+    name = "takeover_layer",
+    executable = ":takeover",
+    visibility = ["//visibility:public"],
+)
diff --git a/cloud/takeover/e2e/BUILD.bazel b/cloud/agent/takeover/e2e/BUILD.bazel
similarity index 93%
rename from cloud/takeover/e2e/BUILD.bazel
rename to cloud/agent/takeover/e2e/BUILD.bazel
index b03e4be..1cdd840 100644
--- a/cloud/takeover/e2e/BUILD.bazel
+++ b/cloud/agent/takeover/e2e/BUILD.bazel
@@ -4,7 +4,7 @@
     name = "e2e_test",
     srcs = ["main_test.go"],
     data = [
-        "//cloud/takeover",
+        "//cloud/agent/takeover",
         "//third_party/edk2:firmware",
         "@debian_11_cloudimage//file",
     ],
diff --git a/cloud/takeover/e2e/main_test.go b/cloud/agent/takeover/e2e/main_test.go
similarity index 98%
rename from cloud/takeover/e2e/main_test.go
rename to cloud/agent/takeover/e2e/main_test.go
index 4a74633..6d489eb 100644
--- a/cloud/takeover/e2e/main_test.go
+++ b/cloud/agent/takeover/e2e/main_test.go
@@ -158,7 +158,7 @@
 	if err := takeoverFile.Chmod(0o755); err != nil {
 		t.Fatal(err)
 	}
-	takeoverPath, err := runfiles.Rlocation("_main/cloud/takeover/takeover_/takeover")
+	takeoverPath, err := runfiles.Rlocation("_main/cloud/agent/takeover/takeover_/takeover")
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/cloud/takeover/takeover.go b/cloud/agent/takeover/takeover.go
similarity index 99%
rename from cloud/takeover/takeover.go
rename to cloud/agent/takeover/takeover.go
index e265b30..d313174 100644
--- a/cloud/takeover/takeover.go
+++ b/cloud/agent/takeover/takeover.go
@@ -44,7 +44,7 @@
 //go:embed ucode.cpio
 var ucode []byte
 
-//go:embed cloud/agent/initramfs.cpio.zst
+//go:embed initramfs.cpio.zst
 var initramfs []byte
 
 // newMemfile creates a new file which is not located on a specific filesystem,
diff --git a/cloud/shepherd/mini/BUILD.bazel b/cloud/shepherd/mini/BUILD.bazel
index 5587d1e..63ad885 100644
--- a/cloud/shepherd/mini/BUILD.bazel
+++ b/cloud/shepherd/mini/BUILD.bazel
@@ -43,7 +43,7 @@
     entrypoint = ["/mini"],
     tars = [
         ":mini_layer",
-        "//cloud/takeover:takeover_layer",
+        "//cloud/agent/takeover:takeover_layer",
     ],
     visibility = ["//visibility:public"],
     workdir = "/app",
diff --git a/cloud/shepherd/provider/equinix/BUILD.bazel b/cloud/shepherd/provider/equinix/BUILD.bazel
index 2ea4ee7..727fbcf 100644
--- a/cloud/shepherd/provider/equinix/BUILD.bazel
+++ b/cloud/shepherd/provider/equinix/BUILD.bazel
@@ -72,7 +72,7 @@
     entrypoint = ["/equinix"],
     tars = [
         ":equinix_layer",
-        "//cloud/takeover:takeover_layer",
+        "//cloud/agent/takeover:takeover_layer",
     ],
     visibility = ["//visibility:public"],
     workdir = "/app",
diff --git a/cloud/takeover/BUILD.bazel b/cloud/takeover/BUILD.bazel
deleted file mode 100644
index 103ea2d..0000000
--- a/cloud/takeover/BUILD.bazel
+++ /dev/null
@@ -1,47 +0,0 @@
-load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
-load("//metropolis/node/build/mkucode:def.bzl", "cpio_ucode")
-load("//build/static_binary_tarball:def.bzl", "static_binary_tarball")
-
-go_library(
-    name = "takeover_lib",
-    srcs = ["takeover.go"],
-    embedsrcs = [
-        "//third_party/linux",  #keep
-        ":ucode",  #keep
-        "//cloud/agent:initramfs",  #keep
-    ],
-    importpath = "source.monogon.dev/cloud/takeover",
-    visibility = ["//visibility:private"],
-    deps = [
-        "//cloud/agent/api",
-        "//metropolis/pkg/bootparam",
-        "//metropolis/pkg/kexec",
-        "//net/dump",
-        "//net/proto",
-        "@com_github_cavaliergopher_cpio//:cpio",
-        "@com_github_klauspost_compress//zstd",
-        "@org_golang_google_protobuf//proto",
-        "@org_golang_x_sys//unix",
-    ],
-)
-
-go_binary(
-    name = "takeover",
-    embed = [":takeover_lib"],
-    visibility = ["//visibility:public"],
-)
-
-cpio_ucode(
-    name = "ucode",
-    ucode = {
-        "@linux-firmware//:amd_ucode": "AuthenticAMD",
-        "@intel_ucode//:fam6h": "GenuineIntel",
-    },
-)
-
-# Used by container_images, forces a static build of the test_agent.
-static_binary_tarball(
-    name = "takeover_layer",
-    executable = ":takeover",
-    visibility = ["//visibility:public"],
-)