diff --git a/cmd/spinifex/cmd/admin.go b/cmd/spinifex/cmd/admin.go
index e415fcd9b..cde2891e8 100644
--- a/cmd/spinifex/cmd/admin.go
+++ b/cmd/spinifex/cmd/admin.go
@@ -31,8 +31,8 @@ import (
 	"github.com/mulgadc/bluebottle/pkg/safecast"
 	"github.com/mulgadc/spinifex/spinifex/admin"
 	"github.com/mulgadc/spinifex/spinifex/bootstrap/config"
-	"github.com/mulgadc/spinifex/spinifex/foundation/state/clustersize"
 	"github.com/mulgadc/spinifex/spinifex/domains/ec2/ebs/metadata"
+	"github.com/mulgadc/spinifex/spinifex/foundation/state/clustersize"
 	handlers_ec2_vpc "github.com/mulgadc/spinifex/spinifex/handlers/ec2/vpc"
 	handlers_iam "github.com/mulgadc/spinifex/spinifex/handlers/iam"
 	"github.com/mulgadc/spinifex/spinifex/network/host"
@@ -40,6 +40,7 @@ import (
 	"github.com/mulgadc/spinifex/spinifex/providers/objectstore"
 	"github.com/mulgadc/spinifex/spinifex/runtime/compute/gpu"
 	"github.com/mulgadc/spinifex/spinifex/runtime/formation"
+	hostcommand "github.com/mulgadc/spinifex/spinifex/runtime/host/command"
 	"github.com/mulgadc/spinifex/spinifex/runtime/host/dns"
 	"github.com/mulgadc/spinifex/spinifex/services/viperblockd/vbwire"
 	"github.com/mulgadc/spinifex/spinifex/utils"
@@ -3533,7 +3534,7 @@ type dnsDetectionSources struct {
 func detectDNSServers(iface string, excludedIPs ...string) []string {
 	return detectDNSServersWithSources(iface, excludedIPs, dnsDetectionSources{
 		queryResolvectl: func(args ...string) (string, error) {
-			return utils.RunCommandWithTimeout(dnsDetectionCommandTimeout, "resolvectl", args...)
+			return hostcommand.RunCommandWithTimeout(dnsDetectionCommandTimeout, "resolvectl", args...)
 		},
 		readResolvConf: func() (string, error) {
 			data, err := os.ReadFile("/etc/resolv.conf")
diff --git a/spinifex/utils/command.go b/spinifex/runtime/host/command/command.go
similarity index 96%
rename from spinifex/utils/command.go
rename to spinifex/runtime/host/command/command.go
index dd6bffa24..72ee8c553 100644
--- a/spinifex/utils/command.go
+++ b/spinifex/runtime/host/command/command.go
@@ -1,4 +1,5 @@
-package utils
+// Package command runs bounded host commands for node-local runtime work.
+package command
 
 import (
 	"bytes"
diff --git a/spinifex/utils/command_test.go b/spinifex/runtime/host/command/command_test.go
similarity index 94%
rename from spinifex/utils/command_test.go
rename to spinifex/runtime/host/command/command_test.go
index e9430ace7..c8ca9f942 100644
--- a/spinifex/utils/command_test.go
+++ b/spinifex/runtime/host/command/command_test.go
@@ -1,4 +1,4 @@
-package utils
+package command
 
 import (
 	"context"
@@ -77,8 +77,6 @@ func childPIDFromOutput(t *testing.T, output string) int {
 	return 0
 }
 
-// processExitsWithin polls until pid is gone. One not-running observation is
-// final: a re-check can catch a reaped task's brief "X" state and misreport it.
 func processExitsWithin(pid int, timeout time.Duration) bool {
 	deadline := time.Now().Add(timeout)
 	for processRunning(pid) {
diff --git a/spinifex/runtime/host/dns/hostdns.go b/spinifex/runtime/host/dns/hostdns.go
index 9020b6e8b..784b4f518 100644
--- a/spinifex/runtime/host/dns/hostdns.go
+++ b/spinifex/runtime/host/dns/hostdns.go
@@ -24,7 +24,7 @@ import (
 	"strings"
 	"time"
 
-	"github.com/mulgadc/spinifex/spinifex/utils"
+	hostcommand "github.com/mulgadc/spinifex/spinifex/runtime/host/command"
 )
 
 // Host paths the resolver managers read. Joined onto configurator.root, which is
@@ -97,7 +97,7 @@ type configurator struct {
 func newConfigurator() *configurator {
 	return &configurator{
 		resolvedActive: func() bool {
-			_, err := utils.RunCommandWithTimeout(resolverCommandTimeout, "systemctl", "is-active", "--quiet", "systemd-resolved")
+			_, err := hostcommand.RunCommandWithTimeout(resolverCommandTimeout, "systemctl", "is-active", "--quiet", "systemd-resolved")
 			return err == nil
 		},
 		hasResolvconf: func() bool {
@@ -105,15 +105,15 @@ func newConfigurator() *configurator {
 			return err == nil
 		},
 		restartResolved: func() error {
-			_, err := utils.RunCommandWithTimeout(resolverCommandTimeout, "systemctl", "restart", "systemd-resolved")
+			_, err := hostcommand.RunCommandWithTimeout(resolverCommandTimeout, "systemctl", "restart", "systemd-resolved")
 			return err
 		},
 		updateResolvconf: func() error {
-			_, err := utils.RunCommandWithTimeout(resolverCommandTimeout, "resolvconf", "-u")
+			_, err := hostcommand.RunCommandWithTimeout(resolverCommandTimeout, "resolvconf", "-u")
 			return err
 		},
 		resolvedStatus: func() (string, error) {
-			return utils.RunCommandWithTimeout(resolverCommandTimeout, "resolvectl", "status")
+			return hostcommand.RunCommandWithTimeout(resolverCommandTimeout, "resolvectl", "status")
 		},
 	}
 }