diff --git a/Dockerfile.gateway b/Dockerfile.gateway
index 47ff584..ad7001c 100644
--- a/Dockerfile.gateway
+++ b/Dockerfile.gateway
@@ -103,7 +103,7 @@ RUN pip install --no-cache-dir /src/
 # (nothing created /app before this point).
 WORKDIR /app
 RUN printf 'from bot_bottle.gateway.egress.addon import addons\n' > /app/egress_addon.py
-COPY bot_bottle/egress_entrypoint.sh /app/egress-entrypoint.sh
+COPY bot_bottle/gateway/egress/entrypoint.sh /app/egress-entrypoint.sh
 RUN chmod +x /app/egress-entrypoint.sh
 
 # Pre-create runtime directories the compose renderer + start
diff --git a/bot_bottle/backend/firecracker/infra_artifact.py b/bot_bottle/backend/firecracker/infra_artifact.py
index 5c8ecb2..eb8396d 100644
--- a/bot_bottle/backend/firecracker/infra_artifact.py
+++ b/bot_bottle/backend/firecracker/infra_artifact.py
@@ -66,7 +66,7 @@ def infra_artifact_version(init_script: str, *, repo_root: Path = _REPO_ROOT) ->
 
     The package is `COPY bot_bottle /app/bot_bottle`'d wholesale into the image,
     so hash *every* regular file under it — not just `*.py`. Non-Python inputs
-    (e.g. `egress_entrypoint.sh`, `netpool.defaults.env`) are baked in too, and
+    (e.g. `gateway/egress/entrypoint.sh`, `netpool.defaults.env`) are baked in too, and
     a change to one must bump the version or a launch host could boot a stale
     rootfs whose code differs from its checkout. `__pycache__`/`.pyc` are the
     only exclusions — build artifacts, never copied."""
diff --git a/bot_bottle/egress_entrypoint.sh b/bot_bottle/gateway/egress/entrypoint.sh
similarity index 100%
rename from bot_bottle/egress_entrypoint.sh
rename to bot_bottle/gateway/egress/entrypoint.sh
diff --git a/tests/unit/test_egress_entrypoint.py b/tests/unit/test_egress_entrypoint.py
index fc0bb12..0c846ac 100644
--- a/tests/unit/test_egress_entrypoint.py
+++ b/tests/unit/test_egress_entrypoint.py
@@ -21,7 +21,7 @@ from pathlib import Path
 
 _SCRIPT = (
     Path(__file__).resolve().parent.parent.parent
-    / "bot_bottle" / "egress_entrypoint.sh"
+    / "bot_bottle" / "gateway" / "egress" / "entrypoint.sh"
 )