diff --git a/cluster/tools/BUILD b/cluster/tools/BUILD
new file mode 100644
index 0000000..974463d
--- /dev/null
+++ b/cluster/tools/BUILD
@@ -0,0 +1,45 @@
+load("@bazel_tools//tools/build_defs/pkg:pkg.bzl", "pkg_tar", "pkg_deb")
+load("//bzl:rules.bzl", "copy_go_binary")
+
+copy_go_binary(
+    name = "kubectl",
+    src = "@io_k8s_kubernetes//cmd/kubectl:kubectl",
+    visibility = ["//visibility:public"],
+)
+
+copy_go_binary(
+    name = "kubecfg",
+    src = "@com_github_ksonnet_kubecfg//:kubecfg",
+    visibility = ["//visibility:public"],
+)
+
+copy_go_binary(
+    name = "calicoctl.bin",
+    src = "@com_github_projectcalico_calicoctl//calicoctl:calicoctl",
+    visibility = ["//visibility:public"],
+)
+
+sh_binary(
+    name = "calicoctl",
+    srcs = ["calicoctl.sh"],
+    data = [":calicoctl.bin", "//tools:secretstore"],
+)
+
+copy_go_binary(
+    name = "cfssl",
+    src = "@com_github_cloudflare_cfssl//cmd/cfssl:cfssl",
+    visibility = ["//visibility:public"],
+)
+
+copy_go_binary(
+	name = "nixops.bin",
+    src = "@nixops//:bin",
+    visibility = ["//visibility:public"],
+)
+
+sh_binary(
+    name = "nixops",
+    srcs = ["nixops.sh"],
+    data = [":nixops.bin", "//tools:secretstore"],
+)
+
diff --git a/tools/calicoctl.sh b/cluster/tools/calicoctl.sh
similarity index 100%
rename from tools/calicoctl.sh
rename to cluster/tools/calicoctl.sh
diff --git a/cluster/tools/install.sh b/cluster/tools/install.sh
new file mode 100755
index 0000000..d2084ae
--- /dev/null
+++ b/cluster/tools/install.sh
@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+
+set -e -o pipefail
+
+if [ -z "$hscloud_root" ]; then
+    echo 2>&1 "Please first source env.sh"
+    exit 1
+fi
+
+cd "${hscloud_root}"
+
+bazel build //cluster/tools/...
+
+if [ ! -e /nix ] ; then
+    echo "WARNING: No Nix installation detected. nix-dependent tools (nixops) will not be built or available." 
+else
+    bazel build \
+            //cluster/tools:nixops
+fi
diff --git a/tools/nixops.sh b/cluster/tools/nixops.sh
similarity index 100%
rename from tools/nixops.sh
rename to cluster/tools/nixops.sh
diff --git a/tools/rook-s3cmd-config b/cluster/tools/rook-s3cmd-config
similarity index 100%
rename from tools/rook-s3cmd-config
rename to cluster/tools/rook-s3cmd-config
diff --git a/env.sh b/env.sh
index d058ea5..9b40724 100644
--- a/env.sh
+++ b/env.sh
@@ -12,7 +12,7 @@
     exit 1
 fi
 
-hscloud_path="$hscloud_root/bazel-bin/tools"
+hscloud_path="$hscloud_root/bazel-bin/tools:$hscloud_root/bazel-bin/cluster/tools"
 
 [[ ":$PATH:" != *":$hscloud_path:"* ]] && PATH="$hscloud_path:${PATH}"
 
diff --git a/tools/BUILD b/tools/BUILD
index e9a1322..e21744a 100644
--- a/tools/BUILD
+++ b/tools/BUILD
@@ -20,46 +20,3 @@
     srcs = ["pass.py"],
     visibility = ["//visibility:public"],
 )
-
-copy_go_binary(
-    name = "kubectl",
-    src = "@io_k8s_kubernetes//cmd/kubectl:kubectl",
-    visibility = ["//visibility:public"],
-)
-
-copy_go_binary(
-    name = "kubecfg",
-    src = "@com_github_ksonnet_kubecfg//:kubecfg",
-    visibility = ["//visibility:public"],
-)
-
-copy_go_binary(
-    name = "calicoctl.bin",
-    src = "@com_github_projectcalico_calicoctl//calicoctl:calicoctl",
-    visibility = ["//visibility:public"],
-)
-
-sh_binary(
-    name = "calicoctl",
-    srcs = ["calicoctl.sh"],
-    data = [":calicoctl.bin", ":secretstore"],
-)
-
-copy_go_binary(
-    name = "cfssl",
-    src = "@com_github_cloudflare_cfssl//cmd/cfssl:cfssl",
-    visibility = ["//visibility:public"],
-)
-
-copy_go_binary(
-	name = "nixops.bin",
-    src = "@nixops//:bin",
-    visibility = ["//visibility:public"],
-)
-
-sh_binary(
-    name = "nixops",
-    srcs = ["nixops.sh"],
-    data = [":nixops.bin", ":secretstore"],
-)
-
diff --git a/tools/install.sh b/tools/install.sh
index b93f10d..6151a38 100755
--- a/tools/install.sh
+++ b/tools/install.sh
@@ -1,5 +1,7 @@
 #!/usr/bin/env bash
 
+set -e -o pipefail
+
 if [ -z "$hscloud_root" ]; then
     echo 2>&1 "Please first source env.sh"
     exit 1
@@ -7,13 +9,6 @@
 
 cd "${hscloud_root}"
 
-bazel build \
-        //tools:kubectl //tools:kubecfg //tools:secretstore \
-        //tools:pass //tools:calicoctl.bin //tools:cfssl
+bazel build //tools/...
 
-if [ ! -e /nix ] ; then
-    echo "WARNING: No Nix installation detected. nix-dependent tools (nixops) will not be built or available." 
-else
-    bazel build \
-            //tools:nixops
-fi
+cluster/tools/install.sh