diff --git a/.gitignore b/.gitignore
index fdb66e87ec..4b110041a9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -190,7 +190,7 @@ temp/
 e2e/gpu/images/.build/
 
 # Ansible Galaxy roles
-/tests/ansible/.roles/
+/tests/tmachine/ansible/.roles/
 
 # Secrets/credentials (should never be committed)
 *.pem
diff --git a/TESTING.md b/TESTING.md
index 27a7634de0..f9580de0f9 100644
--- a/TESTING.md
+++ b/TESTING.md
@@ -371,7 +371,7 @@ Podman user-namespace mappings for the default, `auto`, `keep-id`, and private
 profiles. The E2E archive excludes binaries that still depend on wrapper-owned
 gateway controls, SPIFFE fixtures, the caller driver-config setting, or other
 guest setup. The `driver-podman` suite replaces the removed `podman_userns` E2E
-binary. `tests/artifacts.nix` keeps the follow-up exclusions explicit and uses
+binary. `tests/tmachine/artifacts.nix` keeps the follow-up exclusions explicit and uses
 the same filter for the generated inventory, so excluded binaries cannot appear
 as false passes or silently re-enter the archive.
 
diff --git a/flake.nix b/flake.nix
index bed12b5521..7fac354cac 100644
--- a/flake.nix
+++ b/flake.nix
@@ -126,12 +126,12 @@
           qemuPkgs = testGuestPkgs;
           firmwarePkgs = testGuestPkgs;
         };
-        testMachines = import ./tests/config.nix {
+        testMachines = import ./tests/tmachine/config.nix {
           inherit pkgs toolchains;
           qemuPkgs = tmachineRuntimePkgs;
           firmwarePkgs = tmachineRuntimePkgs;
         };
-        artifacts = pkgs.callPackage ./tests/artifacts.nix { inherit rustToolchain toolchains; };
+        artifacts = pkgs.callPackage ./tests/tmachine/artifacts.nix { inherit rustToolchain toolchains; };
         checkProtobufCompatibility = pkgs.writeShellApplication {
           name = "check-protobuf-compatibility";
           runtimeInputs = [
@@ -219,7 +219,7 @@
               ];
 
               shellHook = ''
-                export ANSIBLE_CONFIG="$(git rev-parse --show-toplevel)/tests/ansible/ansible.cfg"
+                export ANSIBLE_CONFIG="$(git rev-parse --show-toplevel)/tests/tmachine/ansible/ansible.cfg"
               '';
             }
           );
diff --git a/tasks/scripts/test-packaging-assets.sh b/tasks/scripts/test-packaging-assets.sh
index cd21e103ee..e056d3121e 100755
--- a/tasks/scripts/test-packaging-assets.sh
+++ b/tasks/scripts/test-packaging-assets.sh
@@ -40,10 +40,10 @@ assert_file_exists() {
 service="${ROOT}/deploy/deb/openshell-gateway.service"
 control="${ROOT}/deploy/deb/control.in"
 spec="${ROOT}/openshell.spec"
-package_qualification="${ROOT}/tests/ansible/roles/openshell_packaged_gateway/tasks/main.yaml"
-tmachine_gateway_service="${ROOT}/tests/ansible/roles/openshell_gateway/templates/gateway.service.j2"
-tmachine_docker_config="${ROOT}/tests/ansible/roles/openshell_gateway/templates/gateway-docker.toml.j2"
-tmachine_podman_config="${ROOT}/tests/ansible/roles/openshell_gateway/templates/gateway-podman.toml.j2"
+package_qualification="${ROOT}/tests/tmachine/ansible/roles/openshell_packaged_gateway/tasks/main.yaml"
+tmachine_gateway_service="${ROOT}/tests/tmachine/ansible/roles/openshell_gateway/templates/gateway.service.j2"
+tmachine_docker_config="${ROOT}/tests/tmachine/ansible/roles/openshell_gateway/templates/gateway-docker.toml.j2"
+tmachine_podman_config="${ROOT}/tests/tmachine/ansible/roles/openshell_gateway/templates/gateway-podman.toml.j2"
 development_gateway="${ROOT}/nix/test-guest/provisioners/roles/gateway-podman/tasks/development-gateway.yml"
 
 assert_file_exists "$service"
diff --git a/tests/ansible/ansible.cfg b/tests/tmachine/ansible/ansible.cfg
similarity index 100%
rename from tests/ansible/ansible.cfg
rename to tests/tmachine/ansible/ansible.cfg
diff --git a/tests/ansible/inventory.ini b/tests/tmachine/ansible/inventory.ini
similarity index 100%
rename from tests/ansible/inventory.ini
rename to tests/tmachine/ansible/inventory.ini
diff --git a/tests/ansible/playbooks/conformance/cli.yaml b/tests/tmachine/ansible/playbooks/conformance/cli.yaml
similarity index 100%
rename from tests/ansible/playbooks/conformance/cli.yaml
rename to tests/tmachine/ansible/playbooks/conformance/cli.yaml
diff --git a/tests/ansible/playbooks/conformance/k3s-ready.yaml b/tests/tmachine/ansible/playbooks/conformance/k3s-ready.yaml
similarity index 100%
rename from tests/ansible/playbooks/conformance/k3s-ready.yaml
rename to tests/tmachine/ansible/playbooks/conformance/k3s-ready.yaml
diff --git a/tests/ansible/playbooks/conformance/policy-advisor.yaml b/tests/tmachine/ansible/playbooks/conformance/policy-advisor.yaml
similarity index 100%
rename from tests/ansible/playbooks/conformance/policy-advisor.yaml
rename to tests/tmachine/ansible/playbooks/conformance/policy-advisor.yaml
diff --git a/tests/ansible/playbooks/docker.yaml b/tests/tmachine/ansible/playbooks/docker.yaml
similarity index 100%
rename from tests/ansible/playbooks/docker.yaml
rename to tests/tmachine/ansible/playbooks/docker.yaml
diff --git a/tests/ansible/playbooks/drivers/podman/default-userns-baseline.yaml b/tests/tmachine/ansible/playbooks/drivers/podman/default-userns-baseline.yaml
similarity index 100%
rename from tests/ansible/playbooks/drivers/podman/default-userns-baseline.yaml
rename to tests/tmachine/ansible/playbooks/drivers/podman/default-userns-baseline.yaml
diff --git a/tests/ansible/playbooks/drivers/podman/e2e.yaml b/tests/tmachine/ansible/playbooks/drivers/podman/e2e.yaml
similarity index 100%
rename from tests/ansible/playbooks/drivers/podman/e2e.yaml
rename to tests/tmachine/ansible/playbooks/drivers/podman/e2e.yaml
diff --git a/tests/ansible/playbooks/drivers/podman/tests.yaml b/tests/tmachine/ansible/playbooks/drivers/podman/tests.yaml
similarity index 100%
rename from tests/ansible/playbooks/drivers/podman/tests.yaml
rename to tests/tmachine/ansible/playbooks/drivers/podman/tests.yaml
diff --git a/tests/ansible/playbooks/drivers/podman/userns-auto.yaml b/tests/tmachine/ansible/playbooks/drivers/podman/userns-auto.yaml
similarity index 100%
rename from tests/ansible/playbooks/drivers/podman/userns-auto.yaml
rename to tests/tmachine/ansible/playbooks/drivers/podman/userns-auto.yaml
diff --git a/tests/ansible/playbooks/drivers/podman/userns-keep-id.yaml b/tests/tmachine/ansible/playbooks/drivers/podman/userns-keep-id.yaml
similarity index 100%
rename from tests/ansible/playbooks/drivers/podman/userns-keep-id.yaml
rename to tests/tmachine/ansible/playbooks/drivers/podman/userns-keep-id.yaml
diff --git a/tests/ansible/playbooks/drivers/podman/userns-private.yaml b/tests/tmachine/ansible/playbooks/drivers/podman/userns-private.yaml
similarity index 100%
rename from tests/ansible/playbooks/drivers/podman/userns-private.yaml
rename to tests/tmachine/ansible/playbooks/drivers/podman/userns-private.yaml
diff --git a/tests/ansible/playbooks/drivers/podman/userns-profile.yaml b/tests/tmachine/ansible/playbooks/drivers/podman/userns-profile.yaml
similarity index 100%
rename from tests/ansible/playbooks/drivers/podman/userns-profile.yaml
rename to tests/tmachine/ansible/playbooks/drivers/podman/userns-profile.yaml
diff --git a/tests/ansible/playbooks/features/oci-image.yaml b/tests/tmachine/ansible/playbooks/features/oci-image.yaml
similarity index 100%
rename from tests/ansible/playbooks/features/oci-image.yaml
rename to tests/tmachine/ansible/playbooks/features/oci-image.yaml
diff --git a/tests/ansible/playbooks/features/provider-refresh/keycloak.yaml b/tests/tmachine/ansible/playbooks/features/provider-refresh/keycloak.yaml
similarity index 100%
rename from tests/ansible/playbooks/features/provider-refresh/keycloak.yaml
rename to tests/tmachine/ansible/playbooks/features/provider-refresh/keycloak.yaml
diff --git a/tests/ansible/playbooks/gateway.yaml b/tests/tmachine/ansible/playbooks/gateway.yaml
similarity index 100%
rename from tests/ansible/playbooks/gateway.yaml
rename to tests/tmachine/ansible/playbooks/gateway.yaml
diff --git a/tests/ansible/playbooks/k3s.yaml b/tests/tmachine/ansible/playbooks/k3s.yaml
similarity index 100%
rename from tests/ansible/playbooks/k3s.yaml
rename to tests/tmachine/ansible/playbooks/k3s.yaml
diff --git a/tests/ansible/playbooks/nextest.yaml b/tests/tmachine/ansible/playbooks/nextest.yaml
similarity index 100%
rename from tests/ansible/playbooks/nextest.yaml
rename to tests/tmachine/ansible/playbooks/nextest.yaml
diff --git a/tests/ansible/playbooks/openshell-deb.yaml b/tests/tmachine/ansible/playbooks/openshell-deb.yaml
similarity index 100%
rename from tests/ansible/playbooks/openshell-deb.yaml
rename to tests/tmachine/ansible/playbooks/openshell-deb.yaml
diff --git a/tests/ansible/playbooks/openshell-k3s-ha.yaml b/tests/tmachine/ansible/playbooks/openshell-k3s-ha.yaml
similarity index 100%
rename from tests/ansible/playbooks/openshell-k3s-ha.yaml
rename to tests/tmachine/ansible/playbooks/openshell-k3s-ha.yaml
diff --git a/tests/ansible/playbooks/openshell-k3s.yaml b/tests/tmachine/ansible/playbooks/openshell-k3s.yaml
similarity index 100%
rename from tests/ansible/playbooks/openshell-k3s.yaml
rename to tests/tmachine/ansible/playbooks/openshell-k3s.yaml
diff --git a/tests/ansible/playbooks/openshell-rpm.yaml b/tests/tmachine/ansible/playbooks/openshell-rpm.yaml
similarity index 100%
rename from tests/ansible/playbooks/openshell-rpm.yaml
rename to tests/tmachine/ansible/playbooks/openshell-rpm.yaml
diff --git a/tests/ansible/playbooks/openshell.yaml b/tests/tmachine/ansible/playbooks/openshell.yaml
similarity index 100%
rename from tests/ansible/playbooks/openshell.yaml
rename to tests/tmachine/ansible/playbooks/openshell.yaml
diff --git a/tests/ansible/playbooks/podman-rootful.yaml b/tests/tmachine/ansible/playbooks/podman-rootful.yaml
similarity index 100%
rename from tests/ansible/playbooks/podman-rootful.yaml
rename to tests/tmachine/ansible/playbooks/podman-rootful.yaml
diff --git a/tests/ansible/playbooks/podman-rootless.yaml b/tests/tmachine/ansible/playbooks/podman-rootless.yaml
similarity index 100%
rename from tests/ansible/playbooks/podman-rootless.yaml
rename to tests/tmachine/ansible/playbooks/podman-rootless.yaml
diff --git a/tests/ansible/playbooks/selinux.yaml b/tests/tmachine/ansible/playbooks/selinux.yaml
similarity index 100%
rename from tests/ansible/playbooks/selinux.yaml
rename to tests/tmachine/ansible/playbooks/selinux.yaml
diff --git a/tests/ansible/playbooks/shell.yaml b/tests/tmachine/ansible/playbooks/shell.yaml
similarity index 100%
rename from tests/ansible/playbooks/shell.yaml
rename to tests/tmachine/ansible/playbooks/shell.yaml
diff --git a/tests/ansible/requirements.yaml b/tests/tmachine/ansible/requirements.yaml
similarity index 100%
rename from tests/ansible/requirements.yaml
rename to tests/tmachine/ansible/requirements.yaml
diff --git a/tests/ansible/roles/keycloak/defaults/main.yaml b/tests/tmachine/ansible/roles/keycloak/defaults/main.yaml
similarity index 100%
rename from tests/ansible/roles/keycloak/defaults/main.yaml
rename to tests/tmachine/ansible/roles/keycloak/defaults/main.yaml
diff --git a/tests/ansible/roles/keycloak/tasks/main.yaml b/tests/tmachine/ansible/roles/keycloak/tasks/main.yaml
similarity index 100%
rename from tests/ansible/roles/keycloak/tasks/main.yaml
rename to tests/tmachine/ansible/roles/keycloak/tasks/main.yaml
diff --git a/tests/ansible/roles/openshell_client/tasks/main.yaml b/tests/tmachine/ansible/roles/openshell_client/tasks/main.yaml
similarity index 100%
rename from tests/ansible/roles/openshell_client/tasks/main.yaml
rename to tests/tmachine/ansible/roles/openshell_client/tasks/main.yaml
diff --git a/tests/ansible/roles/openshell_diagnostics/files/collect-k3s.sh b/tests/tmachine/ansible/roles/openshell_diagnostics/files/collect-k3s.sh
similarity index 100%
rename from tests/ansible/roles/openshell_diagnostics/files/collect-k3s.sh
rename to tests/tmachine/ansible/roles/openshell_diagnostics/files/collect-k3s.sh
diff --git a/tests/ansible/roles/openshell_diagnostics/tasks/main.yaml b/tests/tmachine/ansible/roles/openshell_diagnostics/tasks/main.yaml
similarity index 92%
rename from tests/ansible/roles/openshell_diagnostics/tasks/main.yaml
rename to tests/tmachine/ansible/roles/openshell_diagnostics/tasks/main.yaml
index 74a204ab96..ba0f268abf 100644
--- a/tests/ansible/roles/openshell_diagnostics/tasks/main.yaml
+++ b/tests/tmachine/ansible/roles/openshell_diagnostics/tasks/main.yaml
@@ -46,6 +46,6 @@
     - name: Fetch K3s diagnostics
       ansible.builtin.fetch:
         src: /var/lib/openshell/diagnostics/k3s.txt
-        dest: "{{ role_path }}/../../../../artifacts/tmachine-diagnostics/{{ inventory_hostname }}/k3s.txt"
+        dest: "{{ role_path }}/../../../../../artifacts/tmachine-diagnostics/{{ inventory_hostname }}/k3s.txt"
         flat: true
       failed_when: false
diff --git a/tests/ansible/roles/openshell_gateway/tasks/detect.yaml b/tests/tmachine/ansible/roles/openshell_gateway/tasks/detect.yaml
similarity index 100%
rename from tests/ansible/roles/openshell_gateway/tasks/detect.yaml
rename to tests/tmachine/ansible/roles/openshell_gateway/tasks/detect.yaml
diff --git a/tests/ansible/roles/openshell_gateway/tasks/docker.yaml b/tests/tmachine/ansible/roles/openshell_gateway/tasks/docker.yaml
similarity index 100%
rename from tests/ansible/roles/openshell_gateway/tasks/docker.yaml
rename to tests/tmachine/ansible/roles/openshell_gateway/tasks/docker.yaml
diff --git a/tests/ansible/roles/openshell_gateway/tasks/main.yaml b/tests/tmachine/ansible/roles/openshell_gateway/tasks/main.yaml
similarity index 100%
rename from tests/ansible/roles/openshell_gateway/tasks/main.yaml
rename to tests/tmachine/ansible/roles/openshell_gateway/tasks/main.yaml
diff --git a/tests/ansible/roles/openshell_gateway/tasks/podman.yaml b/tests/tmachine/ansible/roles/openshell_gateway/tasks/podman.yaml
similarity index 100%
rename from tests/ansible/roles/openshell_gateway/tasks/podman.yaml
rename to tests/tmachine/ansible/roles/openshell_gateway/tasks/podman.yaml
diff --git a/tests/ansible/roles/openshell_gateway/templates/gateway-docker.service.j2 b/tests/tmachine/ansible/roles/openshell_gateway/templates/gateway-docker.service.j2
similarity index 100%
rename from tests/ansible/roles/openshell_gateway/templates/gateway-docker.service.j2
rename to tests/tmachine/ansible/roles/openshell_gateway/templates/gateway-docker.service.j2
diff --git a/tests/ansible/roles/openshell_gateway/templates/gateway-docker.toml.j2 b/tests/tmachine/ansible/roles/openshell_gateway/templates/gateway-docker.toml.j2
similarity index 100%
rename from tests/ansible/roles/openshell_gateway/templates/gateway-docker.toml.j2
rename to tests/tmachine/ansible/roles/openshell_gateway/templates/gateway-docker.toml.j2
diff --git a/tests/ansible/roles/openshell_gateway/templates/gateway-podman.service.j2 b/tests/tmachine/ansible/roles/openshell_gateway/templates/gateway-podman.service.j2
similarity index 100%
rename from tests/ansible/roles/openshell_gateway/templates/gateway-podman.service.j2
rename to tests/tmachine/ansible/roles/openshell_gateway/templates/gateway-podman.service.j2
diff --git a/tests/ansible/roles/openshell_gateway/templates/gateway-podman.toml.j2 b/tests/tmachine/ansible/roles/openshell_gateway/templates/gateway-podman.toml.j2
similarity index 100%
rename from tests/ansible/roles/openshell_gateway/templates/gateway-podman.toml.j2
rename to tests/tmachine/ansible/roles/openshell_gateway/templates/gateway-podman.toml.j2
diff --git a/tests/ansible/roles/openshell_gateway/templates/gateway.service.j2 b/tests/tmachine/ansible/roles/openshell_gateway/templates/gateway.service.j2
similarity index 100%
rename from tests/ansible/roles/openshell_gateway/templates/gateway.service.j2
rename to tests/tmachine/ansible/roles/openshell_gateway/templates/gateway.service.j2
diff --git a/tests/ansible/roles/openshell_gateway/templates/gateway.toml.j2 b/tests/tmachine/ansible/roles/openshell_gateway/templates/gateway.toml.j2
similarity index 100%
rename from tests/ansible/roles/openshell_gateway/templates/gateway.toml.j2
rename to tests/tmachine/ansible/roles/openshell_gateway/templates/gateway.toml.j2
diff --git a/tests/ansible/roles/openshell_packaged_gateway/tasks/main.yaml b/tests/tmachine/ansible/roles/openshell_packaged_gateway/tasks/main.yaml
similarity index 100%
rename from tests/ansible/roles/openshell_packaged_gateway/tasks/main.yaml
rename to tests/tmachine/ansible/roles/openshell_packaged_gateway/tasks/main.yaml
diff --git a/tests/ansible/roles/tmachine_container_runtime/tasks/main.yaml b/tests/tmachine/ansible/roles/tmachine_container_runtime/tasks/main.yaml
similarity index 100%
rename from tests/ansible/roles/tmachine_container_runtime/tasks/main.yaml
rename to tests/tmachine/ansible/roles/tmachine_container_runtime/tasks/main.yaml
diff --git a/tests/ansible/roles/tmachine_user_manager/tasks/main.yaml b/tests/tmachine/ansible/roles/tmachine_user_manager/tasks/main.yaml
similarity index 100%
rename from tests/ansible/roles/tmachine_user_manager/tasks/main.yaml
rename to tests/tmachine/ansible/roles/tmachine_user_manager/tasks/main.yaml
diff --git a/tests/artifacts.nix b/tests/tmachine/artifacts.nix
similarity index 99%
rename from tests/artifacts.nix
rename to tests/tmachine/artifacts.nix
index 33d2831ef0..05102f1568 100644
--- a/tests/artifacts.nix
+++ b/tests/tmachine/artifacts.nix
@@ -12,7 +12,7 @@ let
   gnuToolchain = toolchains.${if isAarch64 then "aarch64-gnu" else "x86_64-gnu"};
   muslToolchain = toolchains.${if isAarch64 then "aarch64-musl" else "x86_64-musl"};
   dockerArch = if isAarch64 then "arm64" else "amd64";
-  linuxVmRuntime = pkgs.callPackage ../nix/pkgs/vm-runtime.nix {
+  linuxVmRuntime = pkgs.callPackage ../../nix/pkgs/vm-runtime.nix {
     stdenv = gnuToolchain.stdenv;
   };
   toolchainEnv = pkgs.lib.foldl' (env: toolchain: env // toolchain.env) { } (
diff --git a/tests/cloud-init/meta-data b/tests/tmachine/cloud-init/meta-data
similarity index 100%
rename from tests/cloud-init/meta-data
rename to tests/tmachine/cloud-init/meta-data
diff --git a/tests/cloud-init/user-data b/tests/tmachine/cloud-init/user-data
similarity index 100%
rename from tests/cloud-init/user-data
rename to tests/tmachine/cloud-init/user-data
diff --git a/tests/config.nix b/tests/tmachine/config.nix
similarity index 65%
rename from tests/config.nix
rename to tests/tmachine/config.nix
index a5318cb875..8f048e16af 100644
--- a/tests/config.nix
+++ b/tests/tmachine/config.nix
@@ -15,17 +15,17 @@ let
   images = import ./images.nix {
     inherit pkgs qemuPkgs firmwarePkgs;
   };
-  tmachine = pkgs.callPackage ./tmachine {
+  tmachine = pkgs.callPackage ./. {
     OVMF = firmwarePkgs.OVMF;
   };
   qemu = qemuPkgs.qemu.override { hostCpuOnly = true; };
   k3sInputs = {
     agent_sandbox_version = "0.5.0";
-    openshell_cli_binary = "../artifacts/binaries/${muslTarget}/openshell";
-    openshell_gateway_image = "../artifacts/images/openshell-gateway-tmachine.tar";
-    openshell_helm_chart = "../artifacts/helm/helm-chart-0.0.0.tgz";
-    openshell_sandbox_image = "../artifacts/images/openshell-sandbox-tmachine.tar";
-    openshell_supervisor_image = "../artifacts/images/openshell-supervisor-tmachine.tar";
+    openshell_cli_binary = "../../artifacts/binaries/${muslTarget}/openshell";
+    openshell_gateway_image = "../../artifacts/images/openshell-gateway-tmachine.tar";
+    openshell_helm_chart = "../../artifacts/helm/helm-chart-0.0.0.tgz";
+    openshell_sandbox_image = "../../artifacts/images/openshell-sandbox-tmachine.tar";
+    openshell_supervisor_image = "../../artifacts/images/openshell-supervisor-tmachine.tar";
   };
   config = (pkgs.formats.yaml { }).generate "tmachine-config.yaml" {
     machines = [
@@ -100,7 +100,7 @@ let
         use_galaxy = false;
         playbooks = [ "ansible/playbooks/openshell-k3s-ha.yaml" ];
         inputs = k3sInputs // {
-          openshell_postgres_fixture = "../e2e/kubernetes/postgres-fixture.yaml";
+          openshell_postgres_fixture = "../../e2e/kubernetes/postgres-fixture.yaml";
         };
       }
       {
@@ -117,10 +117,10 @@ let
           "ansible/playbooks/gateway.yaml"
         ];
         inputs = {
-          openshell_cli_binary = "../artifacts/binaries/${muslTarget}/openshell";
-          openshell_gateway_binary = "../artifacts/binaries/${gnuTarget}/openshell-gateway";
-          openshell_supervisor_image = "../artifacts/images/openshell-supervisor-tmachine.tar";
-          openshell_sandbox_image = "../artifacts/images/openshell-sandbox-tmachine.tar";
+          openshell_cli_binary = "../../artifacts/binaries/${muslTarget}/openshell";
+          openshell_gateway_binary = "../../artifacts/binaries/${gnuTarget}/openshell-gateway";
+          openshell_supervisor_image = "../../artifacts/images/openshell-supervisor-tmachine.tar";
+          openshell_sandbox_image = "../../artifacts/images/openshell-sandbox-tmachine.tar";
         };
       }
       {
@@ -130,9 +130,9 @@ let
           "ansible/playbooks/openshell-deb.yaml"
         ];
         inputs = {
-          openshell_deb = "../artifacts/packages/openshell.deb";
-          openshell_supervisor_image = "../artifacts/images/openshell-supervisor-tmachine.tar";
-          openshell_sandbox_image = "../artifacts/images/openshell-sandbox-tmachine.tar";
+          openshell_deb = "../../artifacts/packages/openshell.deb";
+          openshell_supervisor_image = "../../artifacts/images/openshell-supervisor-tmachine.tar";
+          openshell_sandbox_image = "../../artifacts/images/openshell-sandbox-tmachine.tar";
         };
       }
       {
@@ -140,10 +140,10 @@ let
         use_galaxy = false;
         playbooks = [ "ansible/playbooks/openshell-rpm.yaml" ];
         inputs = {
-          openshell_rpm = "../artifacts/packages/rpm/openshell.rpm";
-          openshell_gateway_rpm = "../artifacts/packages/rpm/openshell-gateway.rpm";
-          openshell_supervisor_image = "../artifacts/images/openshell-supervisor-tmachine.tar";
-          openshell_sandbox_image = "../artifacts/images/openshell-sandbox-tmachine.tar";
+          openshell_rpm = "../../artifacts/packages/rpm/openshell.rpm";
+          openshell_gateway_rpm = "../../artifacts/packages/rpm/openshell-gateway.rpm";
+          openshell_supervisor_image = "../../artifacts/images/openshell-supervisor-tmachine.tar";
+          openshell_sandbox_image = "../../artifacts/images/openshell-sandbox-tmachine.tar";
         };
       }
     ];
@@ -159,37 +159,37 @@ let
         name = "conformance";
         playbooks = [ "ansible/playbooks/conformance/cli.yaml" ];
         inputs = {
-          openshell_conformance_test_bundle = "../artifacts/test-archives/${muslTarget}/openshell-conformance-tests.tar";
+          openshell_conformance_test_bundle = "../../artifacts/test-archives/${muslTarget}/openshell-conformance-tests.tar";
         };
       }
       {
         name = "policy-advisor";
         playbooks = [ "ansible/playbooks/conformance/policy-advisor.yaml" ];
         inputs = {
-          openshell_conformance_test_bundle = "../artifacts/test-archives/${muslTarget}/openshell-conformance-tests.tar";
+          openshell_conformance_test_bundle = "../../artifacts/test-archives/${muslTarget}/openshell-conformance-tests.tar";
         };
       }
       {
         name = "provider-refresh";
         playbooks = [ "ansible/playbooks/features/provider-refresh/keycloak.yaml" ];
         inputs = {
-          keycloak_realm_file = "../scripts/keycloak-realm.json";
-          provider_refresh_keycloak_test_bundle = "../artifacts/test-archives/${muslTarget}/provider-refresh-keycloak-tests.tar";
+          keycloak_realm_file = "../../scripts/keycloak-realm.json";
+          provider_refresh_keycloak_test_bundle = "../../artifacts/test-archives/${muslTarget}/provider-refresh-keycloak-tests.tar";
         };
       }
       {
         name = "oci-image";
         playbooks = [ "ansible/playbooks/features/oci-image.yaml" ];
         inputs = {
-          oci_image_test_bundle = "../artifacts/test-archives/${muslTarget}/oci-image-tests.tar";
+          oci_image_test_bundle = "../../artifacts/test-archives/${muslTarget}/oci-image-tests.tar";
         };
       }
       {
         name = "e2e-podman";
         playbooks = [ "ansible/playbooks/drivers/podman/e2e.yaml" ];
         inputs = {
-          openshell_podman_e2e_test_bundle = "../artifacts/test-archives/${muslTarget}/openshell-podman-e2e-tests.tar";
-          openshell_podman_e2e_workload_image = "../artifacts/images/openshell-e2e-python-dev.tar";
+          openshell_podman_e2e_test_bundle = "../../artifacts/test-archives/${muslTarget}/openshell-podman-e2e-tests.tar";
+          openshell_podman_e2e_workload_image = "../../artifacts/images/openshell-e2e-python-dev.tar";
         };
       }
       {
@@ -205,13 +205,13 @@ let
           "ansible/playbooks/drivers/podman/tests.yaml"
         ];
         inputs = {
-          openshell_podman_test_bundle = "../artifacts/test-archives/${muslTarget}/openshell-podman-tests.tar";
+          openshell_podman_test_bundle = "../../artifacts/test-archives/${muslTarget}/openshell-podman-tests.tar";
           # Match OpenShell's compiled-in default so direct Podman and
           # OpenShell containers resolve the same workload image metadata.
           openshell_podman_reference_image = "nvcr.io/nvidia/base/ubuntu:24.04";
-          openshell_podman_userns_auto_config = "suites/drivers/podman/fixtures/userns-auto.toml";
-          openshell_podman_userns_keep_id_config = "suites/drivers/podman/fixtures/userns-keep-id.toml";
-          openshell_podman_userns_private_config = "suites/drivers/podman/fixtures/userns-private.toml";
+          openshell_podman_userns_auto_config = "../suites/drivers/podman/fixtures/userns-auto.toml";
+          openshell_podman_userns_keep_id_config = "../suites/drivers/podman/fixtures/userns-keep-id.toml";
+          openshell_podman_userns_private_config = "../suites/drivers/podman/fixtures/userns-private.toml";
         };
       }
     ];
@@ -227,7 +227,7 @@ let
     ];
     text = ''
       root=$(git rev-parse --show-toplevel)
-      cd "$root/tests"
+      cd "$root/tests/tmachine"
       export ANSIBLE_CONFIG="$PWD/ansible/ansible.cfg"
       exec ${tmachine}/bin/tmachine --config ${config} "$@"
     '';
diff --git a/tests/tmachine/default.nix b/tests/tmachine/default.nix
index f42e063d2b..7534d8a82b 100644
--- a/tests/tmachine/default.nix
+++ b/tests/tmachine/default.nix
@@ -12,7 +12,16 @@ rustPlatform.buildRustPackage {
   pname = "tmachine";
   version = "0.1.0";
 
-  src = lib.cleanSource ./.;
+  # Only the crate files, so edits to the Ansible and Nix config beside it
+  # do not rebuild tmachine.
+  src = lib.fileset.toSource {
+    root = ./.;
+    fileset = lib.fileset.unions [
+      ./Cargo.toml
+      ./Cargo.lock
+      ./src
+    ];
+  };
   cargoLock.lockFile = ./Cargo.lock;
 
   env = lib.optionalAttrs stdenv.hostPlatform.isAarch64 {
diff --git a/tests/images.nix b/tests/tmachine/images.nix
similarity index 100%
rename from tests/images.nix
rename to tests/tmachine/images.nix