diff --git a/tests/fail2ban-caddy.nix b/tests/fail2ban/caddy.nix
similarity index 99%
rename from tests/fail2ban-caddy.nix
rename to tests/fail2ban/caddy.nix
index 3eb5296..d71de41 100644
--- a/tests/fail2ban-caddy.nix
+++ b/tests/fail2ban/caddy.nix
@@ -17,7 +17,7 @@ pkgs.testers.runNixOSTest {
       }:
       {
         imports = [
-          ../modules/server-security.nix
+          ../../modules/server-security.nix
         ];
 
         # Set up Caddy with basic auth (minimal config, no production stuff)
diff --git a/tests/fail2ban-gitea.nix b/tests/fail2ban/gitea.nix
similarity index 95%
rename from tests/fail2ban-gitea.nix
rename to tests/fail2ban/gitea.nix
index 6de98b0..0f69106 100644
--- a/tests/fail2ban-gitea.nix
+++ b/tests/fail2ban/gitea.nix
@@ -5,7 +5,7 @@
   ...
 }:
 let
-  baseServiceConfigs = import ../hosts/muffin/service-configs.nix;
+  baseServiceConfigs = import ../../hosts/muffin/service-configs.nix;
   testServiceConfigs = lib.recursiveUpdate baseServiceConfigs {
     zpool_ssds = "";
     gitea = {
@@ -32,7 +32,7 @@ let
     { config, pkgs, ... }:
     {
       imports = [
-        (import ../services/gitea/gitea.nix {
+        (import ../../services/gitea/gitea.nix {
           inherit config pkgs;
           lib = testLib;
           service_configs = testServiceConfigs;
@@ -53,7 +53,7 @@ pkgs.testers.runNixOSTest {
       }:
       {
         imports = [
-          ../modules/server-security.nix
+          ../../modules/server-security.nix
           giteaModule
         ];
 
diff --git a/tests/fail2ban-immich.nix b/tests/fail2ban/immich.nix
similarity index 95%
rename from tests/fail2ban-immich.nix
rename to tests/fail2ban/immich.nix
index c6f9668..29f08b9 100644
--- a/tests/fail2ban-immich.nix
+++ b/tests/fail2ban/immich.nix
@@ -5,7 +5,7 @@
   ...
 }:
 let
-  baseServiceConfigs = import ../hosts/muffin/service-configs.nix;
+  baseServiceConfigs = import ../../hosts/muffin/service-configs.nix;
   testServiceConfigs = lib.recursiveUpdate baseServiceConfigs {
     zpool_ssds = "";
     https.domain = "test.local";
@@ -30,7 +30,7 @@ let
     { config, pkgs, ... }:
     {
       imports = [
-        (import ../services/immich.nix {
+        (import ../../services/immich.nix {
           inherit config pkgs;
           lib = testLib;
           service_configs = testServiceConfigs;
@@ -51,7 +51,7 @@ pkgs.testers.runNixOSTest {
       }:
       {
         imports = [
-          ../modules/server-security.nix
+          ../../modules/server-security.nix
           immichModule
         ];
 
diff --git a/tests/fail2ban-jellyfin.nix b/tests/fail2ban/jellyfin.nix
similarity index 96%
rename from tests/fail2ban-jellyfin.nix
rename to tests/fail2ban/jellyfin.nix
index 16dcf5c..98a509d 100644
--- a/tests/fail2ban-jellyfin.nix
+++ b/tests/fail2ban/jellyfin.nix
@@ -5,7 +5,7 @@
   ...
 }:
 let
-  baseServiceConfigs = import ../hosts/muffin/service-configs.nix;
+  baseServiceConfigs = import ../../hosts/muffin/service-configs.nix;
   testServiceConfigs = lib.recursiveUpdate baseServiceConfigs {
     zpool_ssds = "";
     https.domain = "test.local";
@@ -30,7 +30,7 @@ let
     { config, pkgs, ... }:
     {
       imports = [
-        (import ../services/jellyfin/jellyfin.nix {
+        (import ../../services/jellyfin/jellyfin.nix {
           inherit config pkgs;
           lib = testLib;
           service_configs = testServiceConfigs;
@@ -51,7 +51,7 @@ pkgs.testers.runNixOSTest {
       }:
       {
         imports = [
-          ../modules/server-security.nix
+          ../../modules/server-security.nix
           jellyfinModule
         ];
 
diff --git a/tests/fail2ban-llama-cpp.nix b/tests/fail2ban/llama-cpp.nix
similarity index 98%
rename from tests/fail2ban-llama-cpp.nix
rename to tests/fail2ban/llama-cpp.nix
index 33f65b4..0e2a80f 100644
--- a/tests/fail2ban-llama-cpp.nix
+++ b/tests/fail2ban/llama-cpp.nix
@@ -17,7 +17,7 @@ pkgs.testers.runNixOSTest {
       }:
       {
         imports = [
-          ../modules/server-security.nix
+          ../../modules/server-security.nix
         ];
 
         # Minimal Caddy that stands in for the llama-cpp reverse_proxy.
diff --git a/tests/fail2ban-ssh.nix b/tests/fail2ban/ssh.nix
similarity index 96%
rename from tests/fail2ban-ssh.nix
rename to tests/fail2ban/ssh.nix
index 417e3c2..2d3ff03 100644
--- a/tests/fail2ban-ssh.nix
+++ b/tests/fail2ban/ssh.nix
@@ -5,7 +5,7 @@
   ...
 }:
 let
-  securityModule = import ../modules/server-security.nix;
+  securityModule = import ../../modules/server-security.nix;
 
   sshModule =
     {
@@ -16,7 +16,7 @@ let
     }:
     {
       imports = [
-        (import ../services/ssh.nix {
+        (import ../../services/ssh.nix {
           inherit config lib pkgs;
           username = "testuser";
         })
diff --git a/tests/fail2ban-vaultwarden.nix b/tests/fail2ban/vaultwarden.nix
similarity index 95%
rename from tests/fail2ban-vaultwarden.nix
rename to tests/fail2ban/vaultwarden.nix
index c5d4a83..2d49522 100644
--- a/tests/fail2ban-vaultwarden.nix
+++ b/tests/fail2ban/vaultwarden.nix
@@ -5,7 +5,7 @@
   ...
 }:
 let
-  baseServiceConfigs = import ../hosts/muffin/service-configs.nix;
+  baseServiceConfigs = import ../../hosts/muffin/service-configs.nix;
   testServiceConfigs = lib.recursiveUpdate baseServiceConfigs {
     zpool_ssds = "";
     https.domain = "test.local";
@@ -25,7 +25,7 @@ let
     { config, pkgs, ... }:
     {
       imports = [
-        (import ../services/bitwarden.nix {
+        (import ../../services/bitwarden.nix {
           inherit config pkgs;
           lib = testLib;
           service_configs = testServiceConfigs;
@@ -46,7 +46,7 @@ pkgs.testers.runNixOSTest {
       }:
       {
         imports = [
-          ../modules/server-security.nix
+          ../../modules/server-security.nix
           vaultwardenModule
         ];
 
diff --git a/tests/tests.nix b/tests/tests.nix
index dda877a..2266825 100644
--- a/tests/tests.nix
+++ b/tests/tests.nix
@@ -15,13 +15,13 @@ in
   filePermsTest = handleTest ./file-perms.nix;
 
   # fail2ban tests
-  fail2banSshTest = handleTest ./fail2ban-ssh.nix;
-  fail2banCaddyTest = handleTest ./fail2ban-caddy.nix;
-  fail2banGiteaTest = handleTest ./fail2ban-gitea.nix;
-  fail2banVaultwardenTest = handleTest ./fail2ban-vaultwarden.nix;
-  fail2banImmichTest = handleTest ./fail2ban-immich.nix;
-  fail2banJellyfinTest = handleTest ./fail2ban-jellyfin.nix;
-  fail2banLlamaCppTest = handleTest ./fail2ban-llama-cpp.nix;
+  fail2banSshTest = handleTest ./fail2ban/ssh.nix;
+  fail2banCaddyTest = handleTest ./fail2ban/caddy.nix;
+  fail2banGiteaTest = handleTest ./fail2ban/gitea.nix;
+  fail2banVaultwardenTest = handleTest ./fail2ban/vaultwarden.nix;
+  fail2banImmichTest = handleTest ./fail2ban/immich.nix;
+  fail2banJellyfinTest = handleTest ./fail2ban/jellyfin.nix;
+  fail2banLlamaCppTest = handleTest ./fail2ban/llama-cpp.nix;
 
   # jellyfin annotation service test
   jellyfinAnnotationsTest = handleTest ./jellyfin-annotations.nix;