diff --git a/flake.nix b/flake.nix
index 90bb14e..d54550a 100644
--- a/flake.nix
+++ b/flake.nix
@@ -32,7 +32,6 @@
         ./profiles/base.nix
       ];
 
-      # Put modules for specific hosts here.
       hosts = nixpkgs.lib.mapAttrs'
         (filename: _: {
           name = nixpkgs.lib.nameFromURL filename ".";
@@ -40,11 +39,16 @@
         })
         (builtins.readDir ./hosts);
 
-      kubernetesModules = builtins.filter
-        (path: nixpkgs.lib.hasSuffix ".nix" path)
-        (nixpkgs.lib.mapAttrsToList
-          (filename: _: ./kubernetes/${filename})
-          (builtins.readDir ./kubernetes));
+      fs = nixpkgs.lib.fileset;
+      allNixFiles = fs.fileFilter (file: file.hasExt "nix") ./.;
+
+      kubernetesExtraModules = fs.toList
+        (fs.intersection allNixFiles ./kubernetes/extras);
+
+      kubernetesModules = fs.toList
+        (fs.intersection
+          (fs.fileFilter (file: file.hasExt "nix") ./.)
+          (fs.difference ./kubernetes ./kubernetes/extras));
 
       openApiSpec = ./kube-openapi.json;
 
@@ -92,7 +96,7 @@
       packages = forAllSystems (system: pkgs: {
         kubernetes = transpire.lib.${system}.build.cluster {
           inherit openApiSpec;
-          modules = kubernetesModules ++ [ ./kubernetes/extras/vault-secrets.nix ];
+          modules = kubernetesModules ++ kubernetesExtraModules;
         };
 
         # This is used for the `push-vault-secrets` app
diff --git a/kubernetes/argocd.nix b/kubernetes/core/argocd.nix
similarity index 100%
rename from kubernetes/argocd.nix
rename to kubernetes/core/argocd.nix
diff --git a/kubernetes/cert-manager.nix b/kubernetes/core/cert-manager.nix
similarity index 100%
rename from kubernetes/cert-manager.nix
rename to kubernetes/core/cert-manager.nix
diff --git a/kubernetes/cilium.nix b/kubernetes/core/cilium.nix
similarity index 100%
rename from kubernetes/cilium.nix
rename to kubernetes/core/cilium.nix
diff --git a/kubernetes/external-dns.nix b/kubernetes/core/external-dns.nix
similarity index 100%
rename from kubernetes/external-dns.nix
rename to kubernetes/core/external-dns.nix
diff --git a/kubernetes/ingress-nginx.nix b/kubernetes/core/ingress-nginx.nix
similarity index 100%
rename from kubernetes/ingress-nginx.nix
rename to kubernetes/core/ingress-nginx.nix
diff --git a/kubernetes/metallb.nix b/kubernetes/core/metallb.nix
similarity index 100%
rename from kubernetes/metallb.nix
rename to kubernetes/core/metallb.nix
diff --git a/kubernetes/rook-ceph.nix b/kubernetes/core/rook-ceph.nix
similarity index 100%
rename from kubernetes/rook-ceph.nix
rename to kubernetes/core/rook-ceph.nix
diff --git a/kubernetes/vault-secrets-operator.nix b/kubernetes/core/vault-secrets-operator.nix
similarity index 100%
rename from kubernetes/vault-secrets-operator.nix
rename to kubernetes/core/vault-secrets-operator.nix
diff --git a/kubernetes/vault.nix b/kubernetes/core/vault.nix
similarity index 100%
rename from kubernetes/vault.nix
rename to kubernetes/core/vault.nix