diff --git a/internal/imgcache/service.go b/internal/imgcache/service.go
index d44e8a2..65975c8 100644
--- a/internal/imgcache/service.go
+++ b/internal/imgcache/service.go
@@ -12,6 +12,7 @@ import (
 
 	"github.com/dustin/go-humanize"
 	"sneak.berlin/go/pixa/internal/imageprocessor"
+	"sneak.berlin/go/pixa/internal/whitelist"
 )
 
 // Service implements the ImageCache interface, orchestrating cache, fetcher, and processor.
@@ -20,7 +21,7 @@ type Service struct {
 	fetcher         Fetcher
 	processor       *imageprocessor.ImageProcessor
 	signer          *Signer
-	whitelist       *HostWhitelist
+	whitelist       *whitelist.HostWhitelist
 	log             *slog.Logger
 	allowHTTP       bool
 	maxResponseSize int64
@@ -85,7 +86,7 @@ func NewService(cfg *ServiceConfig) (*Service, error) {
 		fetcher:         fetcher,
 		processor:       imageprocessor.New(imageprocessor.Params{MaxInputBytes: maxResponseSize}),
 		signer:          signer,
-		whitelist:       NewHostWhitelist(cfg.Whitelist),
+		whitelist:       whitelist.NewHostWhitelist(cfg.Whitelist),
 		log:             log,
 		allowHTTP:       allowHTTP,
 		maxResponseSize: maxResponseSize,
diff --git a/internal/imgcache/whitelist.go b/internal/whitelist/whitelist.go
similarity index 95%
rename from internal/imgcache/whitelist.go
rename to internal/whitelist/whitelist.go
index df24be2..ed403b8 100644
--- a/internal/imgcache/whitelist.go
+++ b/internal/whitelist/whitelist.go
@@ -1,4 +1,5 @@
-package imgcache
+// Package whitelist provides host-based URL whitelisting for the image proxy.
+package whitelist
 
 import (
 	"net/url"
diff --git a/internal/imgcache/whitelist_test.go b/internal/whitelist/whitelist_test.go
similarity index 94%
rename from internal/imgcache/whitelist_test.go
rename to internal/whitelist/whitelist_test.go
index 3e33b66..960c601 100644
--- a/internal/imgcache/whitelist_test.go
+++ b/internal/whitelist/whitelist_test.go
@@ -1,8 +1,10 @@
-package imgcache
+package whitelist_test
 
 import (
 	"net/url"
 	"testing"
+
+	"sneak.berlin/go/pixa/internal/whitelist"
 )
 
 func TestHostWhitelist_IsWhitelisted(t *testing.T) {
@@ -94,7 +96,7 @@ func TestHostWhitelist_IsWhitelisted(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			w := NewHostWhitelist(tt.patterns)
+			w := whitelist.NewHostWhitelist(tt.patterns)
 
 			var u *url.URL
 			if tt.testURL != "" {
@@ -143,7 +145,7 @@ func TestHostWhitelist_IsEmpty(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			w := NewHostWhitelist(tt.patterns)
+			w := whitelist.NewHostWhitelist(tt.patterns)
 			if got := w.IsEmpty(); got != tt.want {
 				t.Errorf("IsEmpty() = %v, want %v", got, tt.want)
 			}
@@ -181,7 +183,7 @@ func TestHostWhitelist_Count(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			w := NewHostWhitelist(tt.patterns)
+			w := whitelist.NewHostWhitelist(tt.patterns)
 			if got := w.Count(); got != tt.want {
 				t.Errorf("Count() = %v, want %v", got, tt.want)
 			}