diff --git a/spinifex/daemon/bedrock_deps.go b/spinifex/daemon/bedrock_deps.go
index be2e57fa0..17ac80fa2 100644
--- a/spinifex/daemon/bedrock_deps.go
+++ b/spinifex/daemon/bedrock_deps.go
@@ -3,10 +3,10 @@ package daemon
 import (
 	"log/slog"
 
+	"github.com/mulgadc/spinifex/spinifex/domains/network/systemvpc"
 	gateway_bedrock "github.com/mulgadc/spinifex/spinifex/gateway/bedrock"
 	handlers_bedrock "github.com/mulgadc/spinifex/spinifex/handlers/bedrock"
 	handlers_rds "github.com/mulgadc/spinifex/spinifex/handlers/rds"
-	handlers_systemvpc "github.com/mulgadc/spinifex/spinifex/handlers/systemvpc"
 	"github.com/mulgadc/spinifex/spinifex/network/host"
 	"github.com/mulgadc/spinifex/spinifex/runtime/compute/gpu"
 	"github.com/nats-io/nats.go/jetstream"
@@ -27,7 +27,7 @@ func (d *Daemon) buildBedrockLaunchDeps() handlers_bedrock.LaunchDeps {
 
 	return handlers_bedrock.LaunchDeps{
 		Config: d.config,
-		SystemVPC: handlers_systemvpc.Deps{
+		SystemVPC: systemvpc.Deps{
 			VPC:      d.vpcService,
 			SG:       d.vpcService,
 			IGW:      d.igwService,
diff --git a/spinifex/daemon/rds_deps.go b/spinifex/daemon/rds_deps.go
index e9bef366b..7afb8343e 100644
--- a/spinifex/daemon/rds_deps.go
+++ b/spinifex/daemon/rds_deps.go
@@ -10,9 +10,9 @@ import (
 
 	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/mulgadc/bluebottle/pkg/masterkey"
+	"github.com/mulgadc/spinifex/spinifex/domains/network/systemvpc"
 	gateway_ec2_instance "github.com/mulgadc/spinifex/spinifex/gateway/ec2/instance"
 	handlers_rds "github.com/mulgadc/spinifex/spinifex/handlers/rds"
-	handlers_systemvpc "github.com/mulgadc/spinifex/spinifex/handlers/systemvpc"
 )
 
 // A launch can only arrive over the gateway, long after service init, so unlike
@@ -20,7 +20,7 @@ import (
 func (d *Daemon) buildRDSLaunchDeps() handlers_rds.LaunchDeps {
 	return handlers_rds.LaunchDeps{
 		Config: d.config,
-		SystemVPC: handlers_systemvpc.Deps{
+		SystemVPC: systemvpc.Deps{
 			VPC:      d.vpcService,
 			SG:       d.vpcService,
 			IGW:      d.igwService,
diff --git a/spinifex/handlers/systemvpc/igw.go b/spinifex/domains/network/systemvpc/igw.go
similarity index 99%
rename from spinifex/handlers/systemvpc/igw.go
rename to spinifex/domains/network/systemvpc/igw.go
index c246f576c..9d6bd3585 100644
--- a/spinifex/handlers/systemvpc/igw.go
+++ b/spinifex/domains/network/systemvpc/igw.go
@@ -1,4 +1,4 @@
-package handlers_systemvpc
+package systemvpc
 
 import (
 	"context"
diff --git a/spinifex/handlers/systemvpc/systemvpc.go b/spinifex/domains/network/systemvpc/systemvpc.go
similarity index 99%
rename from spinifex/handlers/systemvpc/systemvpc.go
rename to spinifex/domains/network/systemvpc/systemvpc.go
index 5525c6288..1c4e9560a 100644
--- a/spinifex/handlers/systemvpc/systemvpc.go
+++ b/spinifex/domains/network/systemvpc/systemvpc.go
@@ -1,4 +1,4 @@
-// Package handlers_systemvpc builds the managed VPCs Spinifex platform
+// Package systemvpc builds the managed VPCs Spinifex platform
 // components run their own VMs in — the analogue of AWS's hidden managed-account
 // VPCs. A component asks for one by name; it is owned by the system account and
 // carries a public subnet routed to an IGW plus NAT-routed private subnets.
@@ -10,7 +10,7 @@
 // Every lookup is a describe-or-create keyed on the owner + role tags a Spec
 // carries, so two components never see each other's resources and a relaunch
 // after partial failure converges rather than duplicating.
-package handlers_systemvpc
+package systemvpc
 
 import (
 	"context"
diff --git a/spinifex/handlers/systemvpc/systemvpc_test.go b/spinifex/domains/network/systemvpc/systemvpc_test.go
similarity index 99%
rename from spinifex/handlers/systemvpc/systemvpc_test.go
rename to spinifex/domains/network/systemvpc/systemvpc_test.go
index fd7f93d2d..42dca5e2b 100644
--- a/spinifex/handlers/systemvpc/systemvpc_test.go
+++ b/spinifex/domains/network/systemvpc/systemvpc_test.go
@@ -1,4 +1,4 @@
-package handlers_systemvpc
+package systemvpc
 
 import (
 	"context"
diff --git a/spinifex/handlers/bedrock/fakes_test.go b/spinifex/handlers/bedrock/fakes_test.go
index b7af640f2..37129ceb3 100644
--- a/spinifex/handlers/bedrock/fakes_test.go
+++ b/spinifex/handlers/bedrock/fakes_test.go
@@ -12,8 +12,8 @@ import (
 	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/mulgadc/spinifex/spinifex/bootstrap/config"
 	"github.com/mulgadc/spinifex/spinifex/domains/ec2/systeminstance"
+	"github.com/mulgadc/spinifex/spinifex/domains/network/systemvpc"
 	gateway_bedrock "github.com/mulgadc/spinifex/spinifex/gateway/bedrock"
-	handlers_systemvpc "github.com/mulgadc/spinifex/spinifex/handlers/systemvpc"
 )
 
 // fakeSystemVPC is the whole EC2 VPC family as the system-VPC builder sees
@@ -29,11 +29,11 @@ type fakeSystemVPC struct {
 }
 
 var (
-	_ handlers_systemvpc.VPCProvisioner        = (*fakeSystemVPC)(nil)
-	_ handlers_systemvpc.RouteTableProvisioner = (*fakeSystemVPC)(nil)
-	_ handlers_systemvpc.NATGatewayProvisioner = (*fakeSystemVPC)(nil)
-	_ handlers_systemvpc.EIPProvisioner        = (*fakeSystemVPC)(nil)
-	_ handlers_systemvpc.IGWProvisioner        = (*fakeSystemVPC)(nil)
+	_ systemvpc.VPCProvisioner        = (*fakeSystemVPC)(nil)
+	_ systemvpc.RouteTableProvisioner = (*fakeSystemVPC)(nil)
+	_ systemvpc.NATGatewayProvisioner = (*fakeSystemVPC)(nil)
+	_ systemvpc.EIPProvisioner        = (*fakeSystemVPC)(nil)
+	_ systemvpc.IGWProvisioner        = (*fakeSystemVPC)(nil)
 )
 
 func (f *fakeSystemVPC) id(prefix string) *string {
@@ -43,8 +43,8 @@ func (f *fakeSystemVPC) id(prefix string) *string {
 	return aws.String(fmt.Sprintf("%s-%04d", prefix, f.seq))
 }
 
-func (f *fakeSystemVPC) deps() handlers_systemvpc.Deps {
-	return handlers_systemvpc.Deps{VPC: f, IGW: f, RT: f, NGW: f, EIP: f}
+func (f *fakeSystemVPC) deps() systemvpc.Deps {
+	return systemvpc.Deps{VPC: f, IGW: f, RT: f, NGW: f, EIP: f}
 }
 
 func (f *fakeSystemVPC) CreateVpc(context.Context, *ec2.CreateVpcInput, string) (*ec2.CreateVpcOutput, error) {
diff --git a/spinifex/handlers/bedrock/launch.go b/spinifex/handlers/bedrock/launch.go
index 07f815cf6..ce6e07d1a 100644
--- a/spinifex/handlers/bedrock/launch.go
+++ b/spinifex/handlers/bedrock/launch.go
@@ -15,10 +15,10 @@ import (
 	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/mulgadc/spinifex/spinifex/bootstrap/config"
 	"github.com/mulgadc/spinifex/spinifex/domains/ec2/systeminstance"
+	"github.com/mulgadc/spinifex/spinifex/domains/network/systemvpc"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/tags"
 	gateway_bedrock "github.com/mulgadc/spinifex/spinifex/gateway/bedrock"
-	handlers_systemvpc "github.com/mulgadc/spinifex/spinifex/handlers/systemvpc"
 )
 
 // vllmServePort is the vLLM OpenAI-compatible server's listen port, baked
@@ -60,7 +60,7 @@ type volumeAttacher interface {
 
 type LaunchDeps struct {
 	Config    *config.Config
-	SystemVPC handlers_systemvpc.Deps
+	SystemVPC systemvpc.Deps
 	VPC       launchVPCProvisioner
 	Instance  systeminstance.SystemInstanceLauncher
 	Image     amiResolver
diff --git a/spinifex/handlers/bedrock/vpc.go b/spinifex/handlers/bedrock/vpc.go
index bc5c9636a..ec819a156 100644
--- a/spinifex/handlers/bedrock/vpc.go
+++ b/spinifex/handlers/bedrock/vpc.go
@@ -6,8 +6,8 @@ import (
 	"fmt"
 
 	"github.com/mulgadc/spinifex/spinifex/bootstrap/config"
+	"github.com/mulgadc/spinifex/spinifex/domains/network/systemvpc"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/tags"
-	handlers_systemvpc "github.com/mulgadc/spinifex/spinifex/handlers/systemvpc"
 )
 
 // One shared Bedrock system VPC per region holds every serving VM's primary
@@ -31,7 +31,7 @@ func SystemVPCName(region string) string {
 
 // cfg supplies the operator-overridable address space and subnet count; a nil
 // or unset cfg falls back to the defaults.
-func SystemVPCSpec(cfg *config.BedrockConfig, region string) handlers_systemvpc.Spec {
+func SystemVPCSpec(cfg *config.BedrockConfig, region string) systemvpc.Spec {
 	supernet := config.BedrockDefaultSystemVPCSupernet
 	privateSubnets := 1
 	if cfg != nil {
@@ -42,8 +42,8 @@ func SystemVPCSpec(cfg *config.BedrockConfig, region string) handlers_systemvpc.
 			privateSubnets = cfg.SystemVPCPrivateSubnets
 		}
 	}
-	return handlers_systemvpc.Spec{
-		Owner: handlers_systemvpc.Owner{
+	return systemvpc.Spec{
+		Owner: systemvpc.Owner{
 			Name:        SystemVPCName(region),
 			ManagedBy:   tags.ManagedByBedrock,
 			OwnerTagKey: bedrockSystemVPCTagKey,
@@ -59,11 +59,11 @@ func SystemVPCSpec(cfg *config.BedrockConfig, region string) handlers_systemvpc.
 // EnsureSystemVPC is idempotent. The private subnet the serving VMs sit in
 // routes 0.0.0.0/0 to the VPC's NAT gateway, which is the guest's only egress
 // to fetch anything the baked AMI doesn't already carry.
-func EnsureSystemVPC(ctx context.Context, deps handlers_systemvpc.Deps, cfg *config.BedrockConfig, accountID, region string) (*handlers_systemvpc.Refs, error) {
+func EnsureSystemVPC(ctx context.Context, deps systemvpc.Deps, cfg *config.BedrockConfig, accountID, region string) (*systemvpc.Refs, error) {
 	if region == "" {
 		return nil, errors.New("bedrock: EnsureSystemVPC empty region")
 	}
-	refs, err := handlers_systemvpc.Ensure(ctx, deps, SystemVPCSpec(cfg, region), accountID)
+	refs, err := systemvpc.Ensure(ctx, deps, SystemVPCSpec(cfg, region), accountID)
 	if err != nil {
 		return nil, fmt.Errorf("bedrock: ensure system VPC for %s: %w", region, err)
 	}
diff --git a/spinifex/handlers/eks/cp_vpc.go b/spinifex/handlers/eks/cp_vpc.go
index 6603801e1..bcc8704a4 100644
--- a/spinifex/handlers/eks/cp_vpc.go
+++ b/spinifex/handlers/eks/cp_vpc.go
@@ -3,8 +3,8 @@ package handlers_eks
 import (
 	"context"
 
+	"github.com/mulgadc/spinifex/spinifex/domains/network/systemvpc"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/tags"
-	handlers_systemvpc "github.com/mulgadc/spinifex/spinifex/handlers/systemvpc"
 )
 
 // The managed control-plane VPC is the spinifex analogue of AWS EKS's hidden
@@ -33,28 +33,28 @@ const (
 const cpVPCPrivateSubnetCount = 1
 
 // cpVPCRoles are the role-tag values the managed CP VPC's resources carry.
-var cpVPCRoles = handlers_systemvpc.Spec{RolePrefix: cpVPCRolePrefix}.Roles()
+var cpVPCRoles = systemvpc.Spec{RolePrefix: cpVPCRolePrefix}.Roles()
 
 // CPVPCDeps and ManagedCPVPCRefs are the systemvpc types under the names EKS
 // callers (and ClusterMeta's projection) already use.
 type (
-	CPVPCDeps        = handlers_systemvpc.Deps
-	ManagedCPVPCRefs = handlers_systemvpc.Refs
+	CPVPCDeps        = systemvpc.Deps
+	ManagedCPVPCRefs = systemvpc.Refs
 )
 
 // The provisioner surfaces the CP VPC composes from, under their EKS-local
 // names so the service deps and their fakes read against one vocabulary.
 type (
-	vpcProvisioner        = handlers_systemvpc.VPCProvisioner
-	routeTableProvisioner = handlers_systemvpc.RouteTableProvisioner
-	natGatewayProvisioner = handlers_systemvpc.NATGatewayProvisioner
+	vpcProvisioner        = systemvpc.VPCProvisioner
+	routeTableProvisioner = systemvpc.RouteTableProvisioner
+	natGatewayProvisioner = systemvpc.NATGatewayProvisioner
 )
 
 // cpVPCOwner is the tag identity every managed CP VPC resource carries. Keyed on
 // the EKS cluster tags, so the EKS teardown and billable reapers see exactly
 // these resources and no other component's.
-func cpVPCOwner(clusterName string) handlers_systemvpc.Owner {
-	return handlers_systemvpc.Owner{
+func cpVPCOwner(clusterName string) systemvpc.Owner {
+	return systemvpc.Owner{
 		Name:        clusterName,
 		ManagedBy:   tags.ManagedByEKS,
 		OwnerTagKey: clusterEKSClusterTagKey,
@@ -63,8 +63,8 @@ func cpVPCOwner(clusterName string) handlers_systemvpc.Owner {
 }
 
 // cpVPCSpec is the full build spec for clusterName's managed control-plane VPC.
-func cpVPCSpec(clusterName, region string, privateCount int) handlers_systemvpc.Spec {
-	return handlers_systemvpc.Spec{
+func cpVPCSpec(clusterName, region string, privateCount int) systemvpc.Spec {
+	return systemvpc.Spec{
 		Owner:          cpVPCOwner(clusterName),
 		Region:         region,
 		RolePrefix:     cpVPCRolePrefix,
@@ -109,7 +109,7 @@ func (s *EKSServiceImpl) cpVPCDeps() CPVPCDeps {
 // EnsureClusterCPVPC builds (idempotently) the managed control-plane VPC under
 // accountID (the system account) for clusterName.
 func EnsureClusterCPVPC(ctx context.Context, deps CPVPCDeps, accountID, clusterName, region string, privateCount int) (*ManagedCPVPCRefs, error) {
-	return handlers_systemvpc.Ensure(ctx, deps, cpVPCSpec(clusterName, region, privateCount), accountID)
+	return systemvpc.Ensure(ctx, deps, cpVPCSpec(clusterName, region, privateCount), accountID)
 }
 
 // DeleteClusterCPVPC tears down the managed control-plane VPC for clusterName.
@@ -124,5 +124,5 @@ func DeleteClusterCPVPC(ctx context.Context, deps CPVPCDeps, accountID, clusterN
 	}
 	// Region and private-subnet count do not affect teardown: every lookup is a
 	// describe-by-tag, and the CIDRs are never re-derived.
-	return handlers_systemvpc.Delete(ctx, deps, cpVPCSpec(clusterName, "", cpVPCPrivateSubnetCount), accountID, gcFallback)
+	return systemvpc.Delete(ctx, deps, cpVPCSpec(clusterName, "", cpVPCPrivateSubnetCount), accountID, gcFallback)
 }
diff --git a/spinifex/handlers/eks/cp_vpc_test.go b/spinifex/handlers/eks/cp_vpc_test.go
index 2cd6f1586..850aaa875 100644
--- a/spinifex/handlers/eks/cp_vpc_test.go
+++ b/spinifex/handlers/eks/cp_vpc_test.go
@@ -11,8 +11,8 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/mulgadc/spinifex/spinifex/bootstrap/config"
+	"github.com/mulgadc/spinifex/spinifex/domains/network/systemvpc"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	handlers_systemvpc "github.com/mulgadc/spinifex/spinifex/handlers/systemvpc"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -411,7 +411,7 @@ func (f *fakeNatGatewayProvisioner) DeleteNatGateway(_ context.Context, input *e
 // a change to either orphans every deployed cluster from its own teardown,
 // stranding a billable NAT gateway and hanging DeleteCluster in DELETING.
 func TestCPVPCTagValuesAreFrozen(t *testing.T) {
-	assert.Equal(t, handlers_systemvpc.Roles{
+	assert.Equal(t, systemvpc.Roles{
 		VPC:           "cp-vpc",
 		PublicSubnet:  "cp-public",
 		PrivateSubnet: "cp-private",
diff --git a/spinifex/handlers/eks/igw.go b/spinifex/handlers/eks/igw.go
index 06f54a828..5b9017a5d 100644
--- a/spinifex/handlers/eks/igw.go
+++ b/spinifex/handlers/eks/igw.go
@@ -4,12 +4,12 @@ import (
 	"context"
 	"errors"
 
-	handlers_systemvpc "github.com/mulgadc/spinifex/spinifex/handlers/systemvpc"
+	"github.com/mulgadc/spinifex/spinifex/domains/network/systemvpc"
 )
 
 // igwProvisioner is the Internet Gateway surface the cluster IGW helpers need,
 // under its EKS-local name. The daemon adapts the concrete IGW service onto it.
-type igwProvisioner = handlers_systemvpc.IGWProvisioner
+type igwProvisioner = systemvpc.IGWProvisioner
 
 // EnsureClusterIGW guarantees vpcID has an attached Internet Gateway so an
 // internet-facing cluster endpoint is reachable. An already-attached IGW is
@@ -18,7 +18,7 @@ func EnsureClusterIGW(ctx context.Context, igwp igwProvisioner, accountID, vpcID
 	if clusterName == "" {
 		return errors.New("eks: EnsureClusterIGW empty cluster name")
 	}
-	return handlers_systemvpc.EnsureIGW(ctx, igwp, cpVPCOwner(clusterName), accountID, vpcID)
+	return systemvpc.EnsureIGW(ctx, igwp, cpVPCOwner(clusterName), accountID, vpcID)
 }
 
 // DeleteClusterIGW detaches and deletes the cluster-owned IGW attached to vpcID.
@@ -28,5 +28,5 @@ func DeleteClusterIGW(ctx context.Context, igwp igwProvisioner, accountID, vpcID
 	if clusterName == "" {
 		return errors.New("eks: DeleteClusterIGW empty cluster name")
 	}
-	return handlers_systemvpc.DeleteIGW(ctx, igwp, cpVPCOwner(clusterName), accountID, vpcID)
+	return systemvpc.DeleteIGW(ctx, igwp, cpVPCOwner(clusterName), accountID, vpcID)
 }
diff --git a/spinifex/handlers/rds/launch.go b/spinifex/handlers/rds/launch.go
index 13a7950a5..f3df315c0 100644
--- a/spinifex/handlers/rds/launch.go
+++ b/spinifex/handlers/rds/launch.go
@@ -16,10 +16,10 @@ import (
 	"github.com/mulgadc/spinifex/contracts/ec2/v1"
 	"github.com/mulgadc/spinifex/spinifex/bootstrap/config"
 	"github.com/mulgadc/spinifex/spinifex/domains/ec2/systeminstance"
+	"github.com/mulgadc/spinifex/spinifex/domains/network/systemvpc"
 	awsami "github.com/mulgadc/spinifex/spinifex/foundation/aws/ami"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/tags"
-	handlers_systemvpc "github.com/mulgadc/spinifex/spinifex/handlers/systemvpc"
 	"github.com/mulgadc/spinifex/spinifex/runtime/compute/vm"
 	"github.com/nats-io/nats.go"
 )
@@ -117,7 +117,7 @@ type volumeAttacher interface {
 
 type LaunchDeps struct {
 	Config    *config.Config
-	SystemVPC handlers_systemvpc.Deps
+	SystemVPC systemvpc.Deps
 	VPC       launchVPCProvisioner
 	Instance  launchInstanceLauncher
 	Image     launchAMIResolver
diff --git a/spinifex/handlers/rds/launch_test.go b/spinifex/handlers/rds/launch_test.go
index c63f48fab..6d5812905 100644
--- a/spinifex/handlers/rds/launch_test.go
+++ b/spinifex/handlers/rds/launch_test.go
@@ -14,9 +14,9 @@ import (
 	"github.com/mulgadc/spinifex/internal/testkit"
 	"github.com/mulgadc/spinifex/spinifex/bootstrap/config"
 	"github.com/mulgadc/spinifex/spinifex/domains/ec2/systeminstance"
+	"github.com/mulgadc/spinifex/spinifex/domains/network/systemvpc"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/tags"
-	handlers_systemvpc "github.com/mulgadc/spinifex/spinifex/handlers/systemvpc"
 	"github.com/mulgadc/spinifex/spinifex/runtime/compute/vm"
 	"github.com/nats-io/nats.go"
 	"github.com/stretchr/testify/assert"
@@ -55,11 +55,11 @@ type fakeSystemVPC struct {
 }
 
 var (
-	_ handlers_systemvpc.VPCProvisioner        = (*fakeSystemVPC)(nil)
-	_ handlers_systemvpc.RouteTableProvisioner = (*fakeSystemVPC)(nil)
-	_ handlers_systemvpc.NATGatewayProvisioner = (*fakeSystemVPC)(nil)
-	_ handlers_systemvpc.EIPProvisioner        = (*fakeSystemVPC)(nil)
-	_ handlers_systemvpc.IGWProvisioner        = (*fakeSystemVPC)(nil)
+	_ systemvpc.VPCProvisioner        = (*fakeSystemVPC)(nil)
+	_ systemvpc.RouteTableProvisioner = (*fakeSystemVPC)(nil)
+	_ systemvpc.NATGatewayProvisioner = (*fakeSystemVPC)(nil)
+	_ systemvpc.EIPProvisioner        = (*fakeSystemVPC)(nil)
+	_ systemvpc.IGWProvisioner        = (*fakeSystemVPC)(nil)
 )
 
 func (f *fakeSystemVPC) id(prefix string) *string {
@@ -67,8 +67,8 @@ func (f *fakeSystemVPC) id(prefix string) *string {
 	return aws.String(fmt.Sprintf("%s-%04d", prefix, f.seq))
 }
 
-func (f *fakeSystemVPC) deps() handlers_systemvpc.Deps {
-	return handlers_systemvpc.Deps{VPC: f, IGW: f, RT: f, NGW: f, EIP: f}
+func (f *fakeSystemVPC) deps() systemvpc.Deps {
+	return systemvpc.Deps{VPC: f, IGW: f, RT: f, NGW: f, EIP: f}
 }
 
 func (f *fakeSystemVPC) CreateVpc(context.Context, *ec2.CreateVpcInput, string) (*ec2.CreateVpcOutput, error) {
diff --git a/spinifex/handlers/rds/vpc.go b/spinifex/handlers/rds/vpc.go
index 1c9d901c7..c215fef85 100644
--- a/spinifex/handlers/rds/vpc.go
+++ b/spinifex/handlers/rds/vpc.go
@@ -8,8 +8,8 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/mulgadc/spinifex/spinifex/bootstrap/config"
+	"github.com/mulgadc/spinifex/spinifex/domains/network/systemvpc"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/tags"
-	handlers_systemvpc "github.com/mulgadc/spinifex/spinifex/handlers/systemvpc"
 )
 
 // The security-group surface the system ENI's group is ensured through. Narrow
@@ -45,7 +45,7 @@ func SystemSecurityGroupName(region string) string {
 
 // cfg supplies the operator-overridable address space and subnet count; a nil
 // or unset cfg falls back to the defaults.
-func SystemVPCSpec(cfg *config.RDSConfig, region string) handlers_systemvpc.Spec {
+func SystemVPCSpec(cfg *config.RDSConfig, region string) systemvpc.Spec {
 	supernet := config.RDSDefaultSystemVPCSupernet
 	privateSubnets := 1
 	if cfg != nil {
@@ -56,8 +56,8 @@ func SystemVPCSpec(cfg *config.RDSConfig, region string) handlers_systemvpc.Spec
 			privateSubnets = cfg.SystemVPCPrivateSubnets
 		}
 	}
-	return handlers_systemvpc.Spec{
-		Owner: handlers_systemvpc.Owner{
+	return systemvpc.Spec{
+		Owner: systemvpc.Owner{
 			Name:        SystemVPCName(region),
 			ManagedBy:   tags.ManagedByRDS,
 			OwnerTagKey: rdsSystemVPCTagKey,
@@ -75,11 +75,11 @@ func SystemVPCSpec(cfg *config.RDSConfig, region string) handlers_systemvpc.Spec
 // management bridge exists. On a formed deployment one always does, and the
 // agent reaches the gateway over it instead — so this path carries almost no
 // required traffic.
-func EnsureSystemVPC(ctx context.Context, deps handlers_systemvpc.Deps, cfg *config.RDSConfig, accountID, region string) (*handlers_systemvpc.Refs, error) {
+func EnsureSystemVPC(ctx context.Context, deps systemvpc.Deps, cfg *config.RDSConfig, accountID, region string) (*systemvpc.Refs, error) {
 	if region == "" {
 		return nil, errors.New("rds: EnsureSystemVPC empty region")
 	}
-	refs, err := handlers_systemvpc.Ensure(ctx, deps, SystemVPCSpec(cfg, region), accountID)
+	refs, err := systemvpc.Ensure(ctx, deps, SystemVPCSpec(cfg, region), accountID)
 	if err != nil {
 		return nil, fmt.Errorf("rds: ensure system VPC for %s: %w", region, err)
 	}
diff --git a/spinifex/handlers/rds/vpc_test.go b/spinifex/handlers/rds/vpc_test.go
index b97662a32..96371475d 100644
--- a/spinifex/handlers/rds/vpc_test.go
+++ b/spinifex/handlers/rds/vpc_test.go
@@ -5,8 +5,8 @@ import (
 	"testing"
 
 	"github.com/mulgadc/spinifex/spinifex/bootstrap/config"
+	"github.com/mulgadc/spinifex/spinifex/domains/network/systemvpc"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/tags"
-	handlers_systemvpc "github.com/mulgadc/spinifex/spinifex/handlers/systemvpc"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -22,8 +22,8 @@ func TestSystemVPCSpecDefaults(t *testing.T) {
 	t.Parallel()
 	spec := SystemVPCSpec(nil, "ap-southeast-2")
 
-	assert.Equal(t, handlers_systemvpc.Spec{
-		Owner: handlers_systemvpc.Owner{
+	assert.Equal(t, systemvpc.Spec{
+		Owner: systemvpc.Owner{
 			Name:        "rds-system-ap-southeast-2",
 			ManagedBy:   tags.ManagedByRDS,
 			OwnerTagKey: rdsSystemVPCTagKey,