diff --git a/spinifex/daemon/daemon_handlers_password.go b/spinifex/daemon/daemon_handlers_password.go
index 8ad124d6c..f3f7d2d28 100644
--- a/spinifex/daemon/daemon_handlers_password.go
+++ b/spinifex/daemon/daemon_handlers_password.go
@@ -9,9 +9,10 @@ import (
 
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ec2"
+	ec2platform "github.com/mulgadc/spinifex/spinifex/domains/ec2/platform"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	"github.com/mulgadc/spinifex/spinifex/utils"
 	"github.com/mulgadc/spinifex/spinifex/runtime/compute/vm"
+	"github.com/mulgadc/spinifex/spinifex/utils"
 	"github.com/nats-io/nats.go"
 	"golang.org/x/crypto/ssh"
 )
@@ -44,7 +45,7 @@ func extractLastPasswordData(data []byte) string {
 // that was never stamped, is not evidence of the wrong key type, and turning a
 // lookup blip into a terminal error would be worse than the empty string.
 func (d *Daemon) launchKeyCannotEncrypt(instance *vm.VM) bool {
-	if instance.Instance == nil || aws.StringValue(instance.Instance.Platform) != utils.PlatformWindows {
+	if instance.Instance == nil || aws.StringValue(instance.Instance.Platform) != ec2platform.PlatformWindows {
 		return false
 	}
 	keyName := aws.StringValue(instance.Instance.KeyName)
diff --git a/spinifex/utils/platform.go b/spinifex/domains/ec2/platform/platform.go
similarity index 94%
rename from spinifex/utils/platform.go
rename to spinifex/domains/ec2/platform/platform.go
index ace613a39..152ea565d 100644
--- a/spinifex/utils/platform.go
+++ b/spinifex/domains/ec2/platform/platform.go
@@ -1,4 +1,5 @@
-package utils
+// Package platform defines EC2-compatible platform and billing metadata.
+package platform
 
 import "strings"
 
diff --git a/spinifex/utils/platform_test.go b/spinifex/domains/ec2/platform/platform_test.go
similarity index 99%
rename from spinifex/utils/platform_test.go
rename to spinifex/domains/ec2/platform/platform_test.go
index 8706f5384..dc0977726 100644
--- a/spinifex/utils/platform_test.go
+++ b/spinifex/domains/ec2/platform/platform_test.go
@@ -1,4 +1,4 @@
-package utils
+package platform
 
 import "testing"
 
diff --git a/spinifex/handlers/ec2/image/service_impl.go b/spinifex/handlers/ec2/image/service_impl.go
index b0868f9df..2f3a33544 100644
--- a/spinifex/handlers/ec2/image/service_impl.go
+++ b/spinifex/handlers/ec2/image/service_impl.go
@@ -16,6 +16,7 @@ import (
 	"github.com/mulgadc/bluebottle/pkg/safecast"
 	"github.com/mulgadc/spinifex/spinifex/bootstrap/config"
 	"github.com/mulgadc/spinifex/spinifex/domains/ec2/ebs/metadata"
+	ec2platform "github.com/mulgadc/spinifex/spinifex/domains/ec2/platform"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
 	awsfilters "github.com/mulgadc/spinifex/spinifex/foundation/aws/filters"
 	handlers_ec2_snapshot "github.com/mulgadc/spinifex/spinifex/handlers/ec2/snapshot"
@@ -294,8 +295,8 @@ func renderVisibleImage(amiMeta ebsmetadata.AMI, input *ec2.DescribeImagesInput,
 		Description:        aws.String(amiMeta.Description),
 		Architecture:       aws.String(amiMeta.Architecture),
 		PlatformDetails:    aws.String(amiMeta.PlatformDetails),
-		Platform:           utils.PlatformFromDetails(amiMeta.PlatformDetails),
-		UsageOperation:     utils.UsageOperationFromDetails(amiMeta.PlatformDetails),
+		Platform:           ec2platform.PlatformFromDetails(amiMeta.PlatformDetails),
+		UsageOperation:     ec2platform.UsageOperationFromDetails(amiMeta.PlatformDetails),
 		CreationDate:       aws.String(amiMeta.CreationDate.UTC().Format("2006-01-02T15:04:05.000Z")),
 		RootDeviceType:     aws.String(amiMeta.RootDeviceType),
 		VirtualizationType: aws.String(amiMeta.Virtualization),
diff --git a/spinifex/handlers/ec2/instance/metadata_options.go b/spinifex/handlers/ec2/instance/metadata_options.go
index 678c94732..8958b2fcb 100644
--- a/spinifex/handlers/ec2/instance/metadata_options.go
+++ b/spinifex/handlers/ec2/instance/metadata_options.go
@@ -5,8 +5,8 @@ import (
 
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ec2"
+	ec2platform "github.com/mulgadc/spinifex/spinifex/domains/ec2/platform"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	"github.com/mulgadc/spinifex/spinifex/utils"
 )
 
 // defaultMetadataHopLimit matches the AWS default applied when none is requested.
@@ -41,7 +41,7 @@ func buildMetadataOptions(hopLimit *int64, httpTokens string) *ec2.InstanceMetad
 // token support in any release, so a Windows image has to permit IMDSv1 or its
 // agent never reads metadata at all. Every other platform keeps "required".
 func defaultHTTPTokensForPlatform(platform *string) string {
-	if aws.StringValue(platform) == utils.PlatformWindows {
+	if aws.StringValue(platform) == ec2platform.PlatformWindows {
 		return ec2.HttpTokensStateOptional
 	}
 	return ec2.HttpTokensStateRequired
diff --git a/spinifex/handlers/ec2/instance/metadata_options_test.go b/spinifex/handlers/ec2/instance/metadata_options_test.go
index fcb55f183..adde5ed23 100644
--- a/spinifex/handlers/ec2/instance/metadata_options_test.go
+++ b/spinifex/handlers/ec2/instance/metadata_options_test.go
@@ -8,6 +8,7 @@ import (
 	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/mulgadc/spinifex/spinifex/bootstrap/config"
 	"github.com/mulgadc/spinifex/spinifex/domains/ec2/ebs/metadata"
+	ec2platform "github.com/mulgadc/spinifex/spinifex/domains/ec2/platform"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
 	"github.com/mulgadc/spinifex/spinifex/runtime/compute/vm"
 	vmmock "github.com/mulgadc/spinifex/spinifex/runtime/compute/vm/mock"
@@ -314,7 +315,7 @@ func TestDefaultHTTPTokensForPlatform(t *testing.T) {
 		in   *string
 		want string
 	}{
-		"windows":     {aws.String(utils.PlatformWindows), ec2.HttpTokensStateOptional},
+		"windows":     {aws.String(ec2platform.PlatformWindows), ec2.HttpTokensStateOptional},
 		"nil (linux)": {nil, ec2.HttpTokensStateRequired},
 		"empty":       {aws.String(""), ec2.HttpTokensStateRequired},
 		"unexpected":  {aws.String("Windows"), ec2.HttpTokensStateRequired},
@@ -330,7 +331,7 @@ func TestDefaultHTTPTokensForPlatform(t *testing.T) {
 // said nothing about, and never overrides a value the caller named — not even
 // a Windows launch that deliberately asks for the strict posture.
 func TestApplyPlatformTokenDefault(t *testing.T) {
-	windows := aws.String(utils.PlatformWindows)
+	windows := aws.String(ec2platform.PlatformWindows)
 
 	cases := map[string]struct {
 		platform  *string
@@ -355,7 +356,7 @@ func TestApplyPlatformTokenDefault(t *testing.T) {
 // than panicking; stamping one is applyMetadataOptions' job.
 func TestApplyPlatformTokenDefaultNilBlock(t *testing.T) {
 	instance := &ec2.Instance{}
-	applyPlatformTokenDefault(instance, "", aws.String(utils.PlatformWindows))
+	applyPlatformTokenDefault(instance, "", aws.String(ec2platform.PlatformWindows))
 	assert.Nil(t, instance.MetadataOptions)
 }
 
diff --git a/spinifex/handlers/ec2/instance/service_impl.go b/spinifex/handlers/ec2/instance/service_impl.go
index b1ecfc81a..8ce2e0640 100644
--- a/spinifex/handlers/ec2/instance/service_impl.go
+++ b/spinifex/handlers/ec2/instance/service_impl.go
@@ -24,6 +24,7 @@ import (
 	"github.com/mulgadc/spinifex/spinifex/domains/ec2/ebs/metadata"
 	ebspolicy "github.com/mulgadc/spinifex/spinifex/domains/ec2/ebs/policy"
 	"github.com/mulgadc/spinifex/spinifex/domains/ec2/instancetypes"
+	ec2platform "github.com/mulgadc/spinifex/spinifex/domains/ec2/platform"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
 	awsfilters "github.com/mulgadc/spinifex/spinifex/foundation/aws/filters"
 	"github.com/mulgadc/spinifex/spinifex/foundation/state/kvstore"
@@ -761,7 +762,7 @@ func (s *InstanceServiceImpl) PrepareRunInstances(ctx context.Context, input *ec
 
 		// Stamped at launch so DescribeInstances keeps reporting the AMI's platform
 		// even if the image is later deregistered.
-		ec2Instance.Platform = utils.PlatformFromDetails(amiMeta.PlatformDetails)
+		ec2Instance.Platform = ec2platform.PlatformFromDetails(amiMeta.PlatformDetails)
 
 		// RunInstance has no image in hand, so the platform-derived IMDS default
 		// lands here, where the AMI is resolved.