diff --git a/README.md b/README.md
index 599a38a..367eff8 100644
--- a/README.md
+++ b/README.md
@@ -96,14 +96,14 @@ Then clone and run setup:
 ```bash
 git clone http://100.120.125.113:3000/pdm/security-tools.git
 cd security-tools
-bash setup.sh
+bash package/setup.sh
 ```
 
 **Without Tailscale:**
 ```bash
 git clone https://gitea.pdmarf.co.uk/pdm/security-tools.git
 cd security-tools
-bash setup.sh
+bash package/setup.sh
 ```
 
 To clone to a specific path:
@@ -114,7 +114,7 @@ git clone http://100.120.125.113:3000/pdm/security-tools.git /path/to/destinatio
 
 ## Activating on a New VM
 
-After cloning, run `setup.sh` once. It will:
+After cloning, run `package/setup.sh` once. It will:
 - Ask for your Telegram bot token and chat ID
 - Register cron jobs to run scans daily at 08:00
 - Send a test Telegram message confirming the VM is active
@@ -127,7 +127,7 @@ When changes are pushed to this repo, update any VM by running:
 ```bash
 cd ~/security-tools
 git pull
-bash setup.sh
+bash package/setup.sh
 ```
 
 `setup.sh` is safe to re-run — it skips steps already completed.
diff --git a/README-scanner.md b/package/README-scanner.md
similarity index 100%
rename from README-scanner.md
rename to package/README-scanner.md
diff --git a/check-nextjs-rce.sh b/package/check-nextjs-rce.sh
similarity index 100%
rename from check-nextjs-rce.sh
rename to package/check-nextjs-rce.sh
diff --git a/check-npm-sudo-config.sh b/package/check-npm-sudo-config.sh
similarity index 100%
rename from check-npm-sudo-config.sh
rename to package/check-npm-sudo-config.sh
diff --git a/npm-security-check.sh b/package/npm-security-check.sh
similarity index 100%
rename from npm-security-check.sh
rename to package/npm-security-check.sh
diff --git a/setup.sh b/package/setup.sh
similarity index 100%
rename from setup.sh
rename to package/setup.sh