diff --git a/.github/actions/e2e_attestationconfigapi/action.yml b/.github/actions/e2e_attestationconfigapi/action.yml
index 39a3a613d..272b61197 100644
--- a/.github/actions/e2e_attestationconfigapi/action.yml
+++ b/.github/actions/e2e_attestationconfigapi/action.yml
@@ -33,4 +33,4 @@ runs:
         COSIGN_PRIVATE_KEY: ${{ inputs.cosignPrivateKey }}
         COSIGN_PASSWORD: ${{ inputs.cosignPassword }}
       run: |
-        bazel run //hack/configapi:configapi_e2e_test
+        bazel run //internal/api/attestationconfigapi/cli:cli_e2e_test
diff --git a/hack/configapi/BUILD.bazel b/internal/api/attestationconfigapi/cli/BUILD.bazel
similarity index 72%
rename from hack/configapi/BUILD.bazel
rename to internal/api/attestationconfigapi/cli/BUILD.bazel
index 7892a5b12..e293131bd 100644
--- a/hack/configapi/BUILD.bazel
+++ b/internal/api/attestationconfigapi/cli/BUILD.bazel
@@ -2,13 +2,19 @@ load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
 load("//bazel/go:go_test.bzl", "go_test")
 load("//bazel/sh:def.bzl", "sh_template")
 
+go_binary(
+    name = "cli",
+    embed = [":cli_lib"],
+    visibility = ["//visibility:public"],
+)
+
 go_library(
-    name = "configapi_lib",
+    name = "cli_lib",
     srcs = [
         "delete.go",
         "main.go",
     ],
-    importpath = "github.com/edgelesssys/constellation/v2/hack/configapi",
+    importpath = "github.com/edgelesssys/constellation/v2/internal/api/attestationconfigapi/cli",
     visibility = ["//visibility:private"],
     deps = [
         "//internal/api/attestationconfigapi",
@@ -20,19 +26,13 @@ go_library(
     ],
 )
 
-go_binary(
-    name = "configapi",
-    embed = [":configapi_lib"],
-    visibility = ["//visibility:public"],
-)
-
 go_test(
-    name = "configapi_test",
+    name = "cli_test",
     srcs = [
         "delete_test.go",
         "main_test.go",
     ],
-    embed = [":configapi_lib"],
+    embed = [":cli_lib"],
     deps = [
         "//internal/api/attestationconfigapi",
         "@com_github_stretchr_testify//assert",
@@ -41,10 +41,10 @@ go_test(
 )
 
 sh_template(
-    name = "configapi_e2e_test",
-    data = [":configapi"],
+    name = "cli_e2e_test",
+    data = [":cli"],
     substitutions = {
-        "@@CONFIGAPI_CLI@@": "$(rootpath :configapi)",
+        "@@CONFIGAPI_CLI@@": "$(rootpath :cli)",
     },
     template = "e2e/test.sh.in",
 )
diff --git a/hack/configapi/delete.go b/internal/api/attestationconfigapi/cli/delete.go
similarity index 100%
rename from hack/configapi/delete.go
rename to internal/api/attestationconfigapi/cli/delete.go
diff --git a/hack/configapi/delete_test.go b/internal/api/attestationconfigapi/cli/delete_test.go
similarity index 100%
rename from hack/configapi/delete_test.go
rename to internal/api/attestationconfigapi/cli/delete_test.go
diff --git a/hack/configapi/e2e/test.sh.in b/internal/api/attestationconfigapi/cli/e2e/test.sh.in
similarity index 96%
rename from hack/configapi/e2e/test.sh.in
rename to internal/api/attestationconfigapi/cli/e2e/test.sh.in
index 7e7f0162b..d132780fe 100755
--- a/hack/configapi/e2e/test.sh.in
+++ b/internal/api/attestationconfigapi/cli/e2e/test.sh.in
@@ -9,7 +9,7 @@
 lib=$(realpath @@BASE_LIB@@) || exit 1
 stat "${lib}" >> /dev/null || exit 1
 
-# shellcheck source=../../../bazel/sh/lib.bash
+# shellcheck source=../../../../../bazel/sh/lib.bash
 if ! source "${lib}"; then
   echo "Error: could not find import"
   exit 1
@@ -28,7 +28,7 @@ tmpdir=$(mktemp -d)
 readonly tmpdir
 registerExitHandler "rm -rf $tmpdir"
 
-readonly claim_path="'$tmpdir'/maaClaim.json"
+readonly claim_path="$tmpdir/maaClaim.json"
 cat << EOF > "$claim_path"
 {
   "x-ms-isolation-tee": {
diff --git a/hack/configapi/main.go b/internal/api/attestationconfigapi/cli/main.go
similarity index 96%
rename from hack/configapi/main.go
rename to internal/api/attestationconfigapi/cli/main.go
index 1429b52c3..d360d2571 100644
--- a/hack/configapi/main.go
+++ b/internal/api/attestationconfigapi/cli/main.go
@@ -5,10 +5,11 @@ SPDX-License-Identifier: AGPL-3.0-only
 */
 
 /*
-# configapi CLI
+This package provides a CLI to interact with the Attestationconfig API, a sub API of the Resource API.
 
-A CLI to interact with the Attestationconfig API, a sub API of the Resource API.
 You can execute an e2e test by running: `bazel run //hack/configapi:configapi_e2e_test`.
+The CLI is used in the CI pipeline. Actions that change the bucket's data shouldn't be executed manually.
+Notice that there is no synchronization on API operations.
 */
 package main
 
diff --git a/hack/configapi/main_test.go b/internal/api/attestationconfigapi/cli/main_test.go
similarity index 100%
rename from hack/configapi/main_test.go
rename to internal/api/attestationconfigapi/cli/main_test.go