diff --git a/src/commands/subcommands.ts b/src/commands/subcommands.ts
index 0af56164..373e7b7b 100644
--- a/src/commands/subcommands.ts
+++ b/src/commands/subcommands.ts
@@ -9,7 +9,7 @@ import { OutputFormat } from '../types';
  * @param validFormats - Array of valid format options
  * @throws Exits process with error if format is invalid
  */
-export function validateFormat(format: string, validFormats: string[]): void {
+function validateFormat(format: string, validFormats: string[]): void {
   if (!validFormats.includes(format)) {
     logger.error(`Invalid format: ${format}. Must be one of: ${validFormats.join(', ')}`);
     process.exit(1);
@@ -17,9 +17,9 @@ export function validateFormat(format: string, validFormats: string[]): void {
 }
 
 /**
- * Predownload action handler — exported for testing.
+ * Module-internal action handler for the `predownload` subcommand.
  */
-export async function handlePredownloadAction(options: {
+async function handlePredownloadAction(options: {
   imageRegistry: string;
   imageTag: string;
   agentImage: string;
diff --git a/src/config-file.ts b/src/config-file.ts
index 80ffe2c0..37902a44 100644
--- a/src/config-file.ts
+++ b/src/config-file.ts
@@ -3,7 +3,8 @@ import * as path from 'path';
 import * as yaml from 'js-yaml';
 import { validateWithSchema } from './schema-validator';
 
-export interface AwfFileConfig {
+/** @internal Used only within config-file.ts — not part of public API */
+interface AwfFileConfig {
   $schema?: string;
   network?: {
     allowDomains?: string[];
diff --git a/src/host-iptables-network.test.ts b/src/host-iptables-network.test.ts
index b06d4f33..e2187fac 100644
--- a/src/host-iptables-network.test.ts
+++ b/src/host-iptables-network.test.ts
@@ -1,8 +1,10 @@
 import { execaResult, mockedExeca, setupHostIptablesTestSuite } from './test-helpers/host-iptables-test-setup';
-import { cleanupFirewallNetwork } from './host-iptables-network';
+import { testHelpers as networkTestHelpers } from './host-iptables-network';
 import { ensureFirewallNetwork } from './host-iptables';
 import { testHelpers } from './host-iptables-shared';
 
+const { cleanupFirewallNetwork } = networkTestHelpers;
+
 describe('host-iptables (network)', () => {
   setupHostIptablesTestSuite(testHelpers.resetIpv6State);
 
diff --git a/src/host-iptables-network.ts b/src/host-iptables-network.ts
index ee27001a..6fee7b90 100644
--- a/src/host-iptables-network.ts
+++ b/src/host-iptables-network.ts
@@ -51,7 +51,7 @@ export async function ensureFirewallNetwork(): Promise<{
 /**
  * Removes the firewall network
  */
-export async function cleanupFirewallNetwork(): Promise<void> {
+async function cleanupFirewallNetwork(): Promise<void> {
   logger.debug(`Removing firewall network '${NETWORK_NAME}'...`);
 
   try {
@@ -62,3 +62,6 @@ export async function cleanupFirewallNetwork(): Promise<void> {
     // Don't throw - cleanup should be best-effort
   }
 }
+
+/** @internal Exposed for testing only */
+export const testHelpers = { cleanupFirewallNetwork };