diff --git a/.dockerignore b/.dockerignore
index fd1d3d8..d0f05c1 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -3,6 +3,7 @@
 chart
 config
 examples
+hack
 manager
 *.tgz
 README.md
diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 70cf09b..93169b1 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -29,18 +29,7 @@ jobs:
           go vet ./...
 
       - name: Install Helm
-        run: |
-          curl --fail --silent --show-error --location \
-            --output "${RUNNER_TEMP}/helm.tar.gz" \
-            "https://get.helm.sh/helm-${HELM_VERSION}-linux-amd64.tar.gz"
-          curl --fail --silent --show-error --location \
-            --output "${RUNNER_TEMP}/helm.tar.gz.sha256sum" \
-            "https://get.helm.sh/helm-${HELM_VERSION}-linux-amd64.tar.gz.sha256sum"
-          (cd "${RUNNER_TEMP}" && sha256sum --check helm.tar.gz.sha256sum)
-          tar --extract --gzip --file "${RUNNER_TEMP}/helm.tar.gz" \
-            --directory "${RUNNER_TEMP}" linux-amd64/helm
-          mv "${RUNNER_TEMP}/linux-amd64/helm" "${RUNNER_TEMP}/helm"
-          chmod 0700 "${RUNNER_TEMP}/helm"
+        run: bash hack/install-helm.sh
 
       - name: Lint and render chart
         run: |
@@ -71,18 +60,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Install Helm
-        run: |
-          curl --fail --silent --show-error --location \
-            --output "${RUNNER_TEMP}/helm.tar.gz" \
-            "https://get.helm.sh/helm-${HELM_VERSION}-linux-amd64.tar.gz"
-          curl --fail --silent --show-error --location \
-            --output "${RUNNER_TEMP}/helm.tar.gz.sha256sum" \
-            "https://get.helm.sh/helm-${HELM_VERSION}-linux-amd64.tar.gz.sha256sum"
-          (cd "${RUNNER_TEMP}" && sha256sum --check helm.tar.gz.sha256sum)
-          tar --extract --gzip --file "${RUNNER_TEMP}/helm.tar.gz" \
-            --directory "${RUNNER_TEMP}" linux-amd64/helm
-          mv "${RUNNER_TEMP}/linux-amd64/helm" "${RUNNER_TEMP}/helm"
-          chmod 0700 "${RUNNER_TEMP}/helm"
+        run: bash hack/install-helm.sh
 
       - name: Build and publish matched artifacts
         env:
diff --git a/cmd/manager/main.go b/cmd/manager/main.go
index 70f9eca..22151a5 100644
--- a/cmd/manager/main.go
+++ b/cmd/manager/main.go
@@ -12,8 +12,8 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/log/zap"
 	metricsserver "sigs.k8s.io/controller-runtime/pkg/metrics/server"
 
-	mikrotikv1alpha1 "github.com/feedc0de/mikrotik-operator/api/v1alpha1"
-	"github.com/feedc0de/mikrotik-operator/internal/controller"
+	mikrotikv1alpha1 "code.brunner.ninja/feedc0de/mikrotik-operator/api/v1alpha1"
+	"code.brunner.ninja/feedc0de/mikrotik-operator/internal/controller"
 )
 
 func main() {
diff --git a/go.mod b/go.mod
index c0358f0..587e310 100644
--- a/go.mod
+++ b/go.mod
@@ -1,4 +1,4 @@
-module github.com/feedc0de/mikrotik-operator
+module code.brunner.ninja/feedc0de/mikrotik-operator
 
 go 1.26.0
 
diff --git a/hack/install-helm.sh b/hack/install-helm.sh
new file mode 100644
index 0000000..10d2a58
--- /dev/null
+++ b/hack/install-helm.sh
@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+: "${HELM_VERSION:?HELM_VERSION must be set, for example v4.2.2}"
+: "${RUNNER_TEMP:?RUNNER_TEMP must be set}"
+
+archive="helm-${HELM_VERSION}-linux-amd64.tar.gz"
+checksum="${archive}.sha256sum"
+
+curl --fail --silent --show-error --location \
+  --output "${RUNNER_TEMP}/${archive}" \
+  "https://get.helm.sh/${archive}"
+curl --fail --silent --show-error --location \
+  --output "${RUNNER_TEMP}/${checksum}" \
+  "https://get.helm.sh/${checksum}"
+
+# The upstream checksum contains the upstream archive basename, so preserve
+# that basename and perform the check from its containing directory.
+(cd "${RUNNER_TEMP}" && sha256sum --check "${checksum}")
+
+tar --extract --gzip --file "${RUNNER_TEMP}/${archive}" \
+  --directory "${RUNNER_TEMP}" linux-amd64/helm
+mv "${RUNNER_TEMP}/linux-amd64/helm" "${RUNNER_TEMP}/helm"
+chmod 0700 "${RUNNER_TEMP}/helm"
diff --git a/internal/controller/router_controller.go b/internal/controller/router_controller.go
index 3604194..a63a860 100644
--- a/internal/controller/router_controller.go
+++ b/internal/controller/router_controller.go
@@ -19,8 +19,8 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/handler"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 
-	mikrotikv1alpha1 "github.com/feedc0de/mikrotik-operator/api/v1alpha1"
-	"github.com/feedc0de/mikrotik-operator/internal/routeros"
+	mikrotikv1alpha1 "code.brunner.ninja/feedc0de/mikrotik-operator/api/v1alpha1"
+	"code.brunner.ninja/feedc0de/mikrotik-operator/internal/routeros"
 )
 
 const (
diff --git a/internal/controller/service_rules.go b/internal/controller/service_rules.go
index 48c92a8..bc75ebf 100644
--- a/internal/controller/service_rules.go
+++ b/internal/controller/service_rules.go
@@ -8,8 +8,8 @@ import (
 
 	corev1 "k8s.io/api/core/v1"
 
-	mikrotikv1alpha1 "github.com/feedc0de/mikrotik-operator/api/v1alpha1"
-	"github.com/feedc0de/mikrotik-operator/internal/routeros"
+	mikrotikv1alpha1 "code.brunner.ninja/feedc0de/mikrotik-operator/api/v1alpha1"
+	"code.brunner.ninja/feedc0de/mikrotik-operator/internal/routeros"
 )
 
 const AnnotationPrefix = "mikrotik.brunner.ninja/"
diff --git a/internal/controller/service_rules_test.go b/internal/controller/service_rules_test.go
index dbf6fbe..a4af166 100644
--- a/internal/controller/service_rules_test.go
+++ b/internal/controller/service_rules_test.go
@@ -6,8 +6,8 @@ import (
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
-	mikrotikv1alpha1 "github.com/feedc0de/mikrotik-operator/api/v1alpha1"
-	"github.com/feedc0de/mikrotik-operator/internal/routeros"
+	mikrotikv1alpha1 "code.brunner.ninja/feedc0de/mikrotik-operator/api/v1alpha1"
+	"code.brunner.ninja/feedc0de/mikrotik-operator/internal/routeros"
 )
 
 func TestDesiredRules(t *testing.T) {