diff --git a/.drone/pipelines/build_images.jsonnet b/.drone/pipelines/build_images.jsonnet
index b36f5be96b..98f5ecca2a 100644
--- a/.drone/pipelines/build_images.jsonnet
+++ b/.drone/pipelines/build_images.jsonnet
@@ -4,7 +4,7 @@ local secrets = import '../util/secrets.jsonnet';
 local locals = {
   on_merge: {
     ref: ['refs/heads/main'],
-    paths: { include: ['build-image/**'] },
+    paths: { include: ['tools/build-image/**'] },
   },
   on_build_image_tag: {
     event: ['tag'],
@@ -36,7 +36,7 @@ local locals = {
         'docker login -u $DOCKER_LOGIN -p $DOCKER_PASSWORD',
         'docker run --rm --privileged multiarch/qemu-user-static --reset -p yes',
         'docker buildx create --name multiarch --driver docker-container --use',
-        'docker buildx build --build-arg="GO_RUNTIME=golang:1.22.1-bullseye" --push --platform linux/amd64,linux/arm64 -t grafana/agent-build-image:$IMAGE_TAG ./build-image',
+        'docker buildx build --build-arg="GO_RUNTIME=golang:1.22.1-bullseye" --push --platform linux/amd64,linux/arm64 -t grafana/agent-build-image:$IMAGE_TAG ./tools/build-image',
       ],
     }],
     volumes: [{
@@ -59,7 +59,7 @@ local locals = {
         'docker login -u $DOCKER_LOGIN -p $DOCKER_PASSWORD',
         'docker run --rm --privileged multiarch/qemu-user-static --reset -p yes',
         'docker buildx create --name multiarch --driver docker-container --use',
-        'docker buildx build --build-arg="GO_RUNTIME=mcr.microsoft.com/oss/go/microsoft/golang:1.22.1-bullseye" --push --platform linux/amd64,linux/arm64 -t grafana/agent-build-image:$IMAGE_TAG ./build-image',
+        'docker buildx build --build-arg="GO_RUNTIME=mcr.microsoft.com/oss/go/microsoft/golang:1.22.1-bullseye" --push --platform linux/amd64,linux/arm64 -t grafana/agent-build-image:$IMAGE_TAG ./tools/build-image',
       ],
     }],
     volumes: [{
@@ -83,7 +83,7 @@ local locals = {
         // and not by Windows (where the syntax obviously wouldn't work).
         '$IMAGE_TAG="${DRONE_TAG##build-image/v}-windows"',
         'docker login -u $Env:DOCKER_LOGIN -p $Env:DOCKER_PASSWORD',
-        'docker build -t grafana/agent-build-image:$IMAGE_TAG ./build-image/windows',
+        'docker build -t grafana/agent-build-image:$IMAGE_TAG ./tools/build-image/windows',
         'docker push grafana/agent-build-image:$IMAGE_TAG',
       ],
     }],
diff --git a/.github/workflows/check-linux-build-image.yml b/.github/workflows/check-linux-build-image.yml
index a064bffe75..cbef32a64c 100644
--- a/.github/workflows/check-linux-build-image.yml
+++ b/.github/workflows/check-linux-build-image.yml
@@ -3,7 +3,7 @@ name: Check Linux build image
 on:
   pull_request:
     paths:
-      - 'build-image/*'
+      - 'tools/build-image/*'
 
 jobs:
   check-linux-build-image:
@@ -21,7 +21,7 @@ jobs:
       - name: Create test Linux build image
         uses: docker/build-push-action@v5
         with:
-          context: ./build-image
+          context: ./tools/build-image
           push: false
           tags: grafana/alloy-build-image:latest
           build-args: |
@@ -30,7 +30,7 @@ jobs:
       - name: Create test Linux build image for boring crypto
         uses: docker/build-push-action@v5
         with:
-          context: ./build-image
+          context: ./tools/build-image
           push: false
           tags: grafana/alloy-build-image:latest
           build-args: |
diff --git a/.github/workflows/check-windows-build-image.yml b/.github/workflows/check-windows-build-image.yml
index 67cefbca79..21ae31e775 100644
--- a/.github/workflows/check-windows-build-image.yml
+++ b/.github/workflows/check-windows-build-image.yml
@@ -3,7 +3,7 @@ name: Check Windows build image
 on:
   pull_request:
     paths:
-      - 'build-image/windows/**'
+      - 'tools/build-image/windows/**'
 
 jobs:
   check-windows-build-image:
@@ -19,4 +19,4 @@ jobs:
           tags: latest
           registry: docker.io
           pushImage: false
-          dockerfile: ./build-image/windows/Dockerfile
+          dockerfile: ./tools/build-image/windows/Dockerfile
diff --git a/Makefile b/Makefile
index de4771c88f..99ed2b2526 100644
--- a/Makefile
+++ b/Makefile
@@ -23,7 +23,7 @@
 ##
 ##   binaries                        Compiles all binaries.
 ##   alloy                           Compiles cmd/alloy to $(ALLOY_BINARY)
-##   alloy-service                   Compiles cmd/alloy-service to $(SERVICE_BINARY)
+##   alloy-service                   Compiles internal/cmd/alloy-service to $(SERVICE_BINARY)
 ##
 ## Targets for building Docker images:
 ##
@@ -166,7 +166,7 @@ alloy-service:
 ifeq ($(USE_CONTAINER),1)
 	$(RERUN_IN_CONTAINER)
 else
-	$(GO_ENV) go build $(GO_FLAGS) -o $(SERVICE_BINARY) ./cmd/alloy-service
+	$(GO_ENV) go build $(GO_FLAGS) -o $(SERVICE_BINARY) ./internal/cmd/alloy-service
 endif
 
 alloylint:
diff --git a/cmd/alloy-service/config_windows.go b/internal/cmd/alloy-service/config_windows.go
similarity index 100%
rename from cmd/alloy-service/config_windows.go
rename to internal/cmd/alloy-service/config_windows.go
diff --git a/cmd/alloy-service/doc.go b/internal/cmd/alloy-service/doc.go
similarity index 100%
rename from cmd/alloy-service/doc.go
rename to internal/cmd/alloy-service/doc.go
diff --git a/cmd/alloy-service/logger_windows.go b/internal/cmd/alloy-service/logger_windows.go
similarity index 100%
rename from cmd/alloy-service/logger_windows.go
rename to internal/cmd/alloy-service/logger_windows.go
diff --git a/cmd/alloy-service/main_windows.go b/internal/cmd/alloy-service/main_windows.go
similarity index 100%
rename from cmd/alloy-service/main_windows.go
rename to internal/cmd/alloy-service/main_windows.go
diff --git a/cmd/alloy-service/service.go b/internal/cmd/alloy-service/service.go
similarity index 100%
rename from cmd/alloy-service/service.go
rename to internal/cmd/alloy-service/service.go
diff --git a/cmd/alloy-service/service_test.go b/internal/cmd/alloy-service/service_test.go
similarity index 100%
rename from cmd/alloy-service/service_test.go
rename to internal/cmd/alloy-service/service_test.go
diff --git a/cmd/alloy-service/testdata/example_service.go b/internal/cmd/alloy-service/testdata/example_service.go
similarity index 100%
rename from cmd/alloy-service/testdata/example_service.go
rename to internal/cmd/alloy-service/testdata/example_service.go
diff --git a/internal/cmd/rivereval/example.river b/internal/cmd/rivereval/example.river
deleted file mode 100644
index 06f273c707..0000000000
--- a/internal/cmd/rivereval/example.river
+++ /dev/null
@@ -1 +0,0 @@
-env("HOME")
diff --git a/internal/cmd/rivereval/main.go b/internal/cmd/rivereval/main.go
deleted file mode 100644
index 1a7fe8cc9c..0000000000
--- a/internal/cmd/rivereval/main.go
+++ /dev/null
@@ -1,52 +0,0 @@
-// Command rivereval reads a River file from disk, evaluates it as an
-// expression, and prints the result as a River value.
-package main
-
-import (
-	"fmt"
-	"os"
-
-	"github.com/grafana/alloy/syntax/parser"
-	"github.com/grafana/alloy/syntax/token/builder"
-	"github.com/grafana/alloy/syntax/vm"
-)
-
-func main() {
-	if err := run(); err != nil {
-		fmt.Fprintln(os.Stderr, err)
-	}
-}
-
-func run() error {
-	args := os.Args[1:]
-
-	if len(args) != 1 {
-		return fmt.Errorf("usage: rivereval [file]")
-	}
-
-	contents, err := os.ReadFile(args[0])
-	if err != nil {
-		return err
-	}
-
-	// We currently can't support parsing entire files since eval.Evaluate
-	// assumes you'll pass a block with a struct schema to it. This might be a
-	// restriction we can loosen in the future.
-	node, err := parser.ParseExpression(string(contents))
-	if err != nil {
-		return err
-	}
-	eval := vm.New(node)
-
-	var v interface{}
-	if err := eval.Evaluate(nil, &v); err != nil {
-		return err
-	}
-
-	expr := builder.NewExpr()
-	expr.SetValue(v)
-
-	_, _ = expr.WriteTo(os.Stdout)
-	fmt.Println() // Write an extra newline at the end
-	return nil
-}
diff --git a/packaging/alloy/windows/install_script.nsis b/packaging/alloy/windows/install_script.nsis
index 099eace2d3..7ab4da21dc 100644
--- a/packaging/alloy/windows/install_script.nsis
+++ b/packaging/alloy/windows/install_script.nsis
@@ -70,7 +70,7 @@ Section "install"
   Exists:
     SetOutPath "$INSTDIR"
 
-  File "..\..\..\dist.temp\alloy-windows-amd64.exe"
+  File "..\..\..\dist\alloy-windows-amd64.exe"
   File "..\..\..\dist.temp\alloy-service-windows-amd64.exe"
   File "logo.ico"
 
diff --git a/build-image/Dockerfile b/tools/build-image/Dockerfile
similarity index 100%
rename from build-image/Dockerfile
rename to tools/build-image/Dockerfile
diff --git a/build-image/README.md b/tools/build-image/README.md
similarity index 100%
rename from build-image/README.md
rename to tools/build-image/README.md
diff --git a/build-image/windows/Dockerfile b/tools/build-image/windows/Dockerfile
similarity index 100%
rename from build-image/windows/Dockerfile
rename to tools/build-image/windows/Dockerfile