diff --git a/cmd/spinifex/cmd/admin_acm.go b/cmd/spinifex/cmd/admin_acm.go
index ad3772850..eae8d41a6 100644
--- a/cmd/spinifex/cmd/admin_acm.go
+++ b/cmd/spinifex/cmd/admin_acm.go
@@ -107,8 +107,8 @@ func runCertCreateTenantCA(cmd *cobra.Command, _ []string) {
 	yes, _ := cmd.Flags().GetBool("yes")
 
 	configDir, _ := cmd.Root().Flags().GetString("config-dir")
-	certPath := admin.TenantCACertPath(configDir)
-	keyPath := admin.TenantCAKeyPath(configDir)
+	certPath := acmdomain.TenantCACertPath(configDir)
+	keyPath := acmdomain.TenantCAKeyPath(configDir)
 
 	existed := admin.FileExists(certPath) && admin.FileExists(keyPath)
 
diff --git a/spinifex/admin/admin.go b/spinifex/admin/admin.go
index c321e637d..b7828cc69 100644
--- a/spinifex/admin/admin.go
+++ b/spinifex/admin/admin.go
@@ -262,32 +262,6 @@ func GenerateCertificatesIfNeeded(configDir string, force bool, bindIP string, a
 	return caCertPath
 }
 
-// tenantCACertFilename and tenantCAKeyFilename name the ACM tenant private
-// CA's files on disk. Colocated with the platform CA (ca.pem/ca.key) and
-// master.key under the same config directory, but a distinct "tenant-ca"
-// basename keeps the two roots from ever being confused: they are
-// independent, and the platform CA (trusted by every node, ipsec, EKS/ECS
-// guests, ALB microvms and baked catalog images) must never be read, written
-// or reused as the tenant CA, or vice versa.
-const (
-	tenantCACertFilename = "tenant-ca.pem"
-	tenantCAKeyFilename  = "tenant-ca.key"
-)
-
-// TenantCACertPath and TenantCAKeyPath return the on-disk paths for the ACM
-// tenant private CA under configDir, mirroring how GenerateCertificatesIfNeeded
-// derives the platform CA's paths (filepath.Join(configDir, "ca.pem"/"ca.key"))
-// rather than threading them through ConfigSettings: like the platform CA,
-// these paths are computed on demand by whoever needs them (the tenant-CA admin
-// command, the daemon at startup), not rendered into a config file.
-func TenantCACertPath(configDir string) string {
-	return filepath.Join(configDir, tenantCACertFilename)
-}
-
-func TenantCAKeyPath(configDir string) string {
-	return filepath.Join(configDir, tenantCAKeyFilename)
-}
-
 // GenerateServerCertOnly generates a server certificate signed by an existing CA.
 // Used by joining nodes that receive the CA from the leader. awsRegion and
 // servicesDomain add the AWS-parity ECR SANs; empty values omit them.
diff --git a/spinifex/daemon/daemon.go b/spinifex/daemon/daemon.go
index 309dd9f70..bf9f1e315 100644
--- a/spinifex/daemon/daemon.go
+++ b/spinifex/daemon/daemon.go
@@ -2137,7 +2137,7 @@ func (d *Daemon) startCluster() error {
 	// operator can tell at a glance, from daemon startup logs alone, which one
 	// they are in.
 	configDir := filepath.Dir(d.configPath)
-	tenantCA, tenantCAErr := acmdomain.LoadTenantCA(admin.TenantCACertPath(configDir), admin.TenantCAKeyPath(configDir))
+	tenantCA, tenantCAErr := acmdomain.LoadTenantCA(acmdomain.TenantCACertPath(configDir), acmdomain.TenantCAKeyPath(configDir))
 	if tenantCAErr != nil {
 		slog.Warn("ACM: tenant private CA not found; PRIVATE_CA certificate requests will fail until one is created",
 			"err", tenantCAErr)
diff --git a/spinifex/domains/acm/tenant_ca_paths.go b/spinifex/domains/acm/tenant_ca_paths.go
new file mode 100644
index 000000000..db0980617
--- /dev/null
+++ b/spinifex/domains/acm/tenant_ca_paths.go
@@ -0,0 +1,29 @@
+package acm
+
+import "path/filepath"
+
+// tenantCACertFilename and tenantCAKeyFilename name the ACM tenant private
+// CA's files on disk. Colocated with the platform CA (ca.pem/ca.key) and
+// master.key under the same config directory, but a distinct "tenant-ca"
+// basename keeps the two roots from ever being confused: they are
+// independent, and the platform CA (trusted by every node, ipsec, EKS/ECS
+// guests, ALB microvms and baked catalog images) must never be read, written
+// or reused as the tenant CA, or vice versa.
+const (
+	tenantCACertFilename = "tenant-ca.pem"
+	tenantCAKeyFilename  = "tenant-ca.key"
+)
+
+// TenantCACertPath and TenantCAKeyPath return the on-disk paths for the ACM
+// tenant private CA under configDir, mirroring how admin.GenerateCertificatesIfNeeded
+// derives the platform CA's paths (filepath.Join(configDir, "ca.pem"/"ca.key"))
+// rather than threading them through ConfigSettings: like the platform CA,
+// these paths are computed on demand by whoever needs them (the tenant-CA admin
+// command, the daemon at startup), not rendered into a config file.
+func TenantCACertPath(configDir string) string {
+	return filepath.Join(configDir, tenantCACertFilename)
+}
+
+func TenantCAKeyPath(configDir string) string {
+	return filepath.Join(configDir, tenantCAKeyFilename)
+}