diff --git a/.gitignore b/.gitignore
index cb2f9ee..e17df32 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,5 +2,7 @@
 /dist/
 *.rpm
 *.zip
-encapi
-encapi-cli
+# Root-level dev binaries only — anchored so cmd/encapi and cmd/encapi-cli
+# (the source packages) are NOT ignored.
+/encapi
+/encapi-cli
diff --git a/cmd/encapi-cli/main.go b/cmd/encapi-cli/main.go
new file mode 100644
index 0000000..8f04643
--- /dev/null
+++ b/cmd/encapi-cli/main.go
@@ -0,0 +1,13 @@
+// Command encapi-cli manages the Puppet ENC via the encapi HTTP API. Puppet's
+// exec node_terminus calls `encapi-cli classify <certname>`.
+package main
+
+import (
+	"os"
+
+	"git.unkin.net/unkin/encapi/internal/cli"
+)
+
+func main() {
+	os.Exit(cli.Run(os.Args[1:], cli.LoadEnv(), os.Stdout, os.Stderr))
+}
diff --git a/cmd/encapi/main.go b/cmd/encapi/main.go
new file mode 100644
index 0000000..a927eac
--- /dev/null
+++ b/cmd/encapi/main.go
@@ -0,0 +1,50 @@
+// Command encapi is the ENC HTTP server: it serves Puppet's node classification
+// documents and the read/write API backing the CLI and Terraform provider.
+package main
+
+import (
+	"context"
+	"log/slog"
+	"os"
+	"os/signal"
+	"syscall"
+
+	"git.unkin.net/unkin/encapi/internal/config"
+	"git.unkin.net/unkin/encapi/internal/database"
+	"git.unkin.net/unkin/encapi/internal/distro"
+	"git.unkin.net/unkin/encapi/internal/server"
+)
+
+var version = "dev"
+
+func main() {
+	slog.SetDefault(slog.New(slog.NewJSONHandler(os.Stdout, nil)))
+	slog.Info("starting encapi", "version", version)
+
+	cfg, err := config.Load()
+	if err != nil {
+		slog.Error("load config", "err", err)
+		os.Exit(1)
+	}
+
+	db, err := database.New(cfg.DatabaseDSN())
+	if err != nil {
+		slog.Error("connect database", "err", err)
+		os.Exit(1)
+	}
+	defer db.Close()
+
+	if cfg.WriteToken == "" {
+		slog.Warn("ENCAPI_WRITE_TOKEN is not set; write endpoints are disabled")
+	}
+
+	srv := server.New(db, distro.New(cfg.DistroAPIURL), cfg.WriteToken)
+
+	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
+	defer stop()
+
+	if err := srv.ListenAndServe(ctx, cfg.ListenAddr); err != nil {
+		slog.Error("server", "err", err)
+		os.Exit(1)
+	}
+}