diff --git a/src/gateway/node-pending-work.ts b/src/gateway/node-pending-work.ts
index eddf4c9b9a4..ad81ab1f346 100644
--- a/src/gateway/node-pending-work.ts
+++ b/src/gateway/node-pending-work.ts
@@ -1,12 +1,12 @@
 import { randomUUID } from "node:crypto";
 
-export const NODE_PENDING_WORK_TYPES = ["status.request", "location.request"] as const;
+const NODE_PENDING_WORK_TYPES = ["status.request", "location.request"] as const;
 export type NodePendingWorkType = (typeof NODE_PENDING_WORK_TYPES)[number];
 
-export const NODE_PENDING_WORK_PRIORITIES = ["default", "normal", "high"] as const;
+const NODE_PENDING_WORK_PRIORITIES = ["default", "normal", "high"] as const;
 export type NodePendingWorkPriority = (typeof NODE_PENDING_WORK_PRIORITIES)[number];
 
-export type NodePendingWorkItem = {
+type NodePendingWorkItem = {
   id: string;
   type: NodePendingWorkType;
   priority: NodePendingWorkPriority;
diff --git a/src/gateway/node-registry.ts b/src/gateway/node-registry.ts
index fbb9ce1502a..67fdaaf5fb0 100644
--- a/src/gateway/node-registry.ts
+++ b/src/gateway/node-registry.ts
@@ -30,7 +30,7 @@ type PendingInvoke = {
   timer: ReturnType<typeof setTimeout>;
 };
 
-export type NodeInvokeResult = {
+type NodeInvokeResult = {
   ok: boolean;
   payload?: unknown;
   payloadJSON?: string | null;
diff --git a/src/gateway/operator-scopes.ts b/src/gateway/operator-scopes.ts
index 45fcf68e8ca..4e301d6f17b 100644
--- a/src/gateway/operator-scopes.ts
+++ b/src/gateway/operator-scopes.ts
@@ -22,9 +22,7 @@ const KNOWN_OPERATOR_SCOPE_VALUES: readonly OperatorScope[] = [
   TALK_SECRETS_SCOPE,
 ];
 
-export const KNOWN_OPERATOR_SCOPES: ReadonlySet<OperatorScope> = new Set(
-  KNOWN_OPERATOR_SCOPE_VALUES,
-);
+const KNOWN_OPERATOR_SCOPES: ReadonlySet<OperatorScope> = new Set(KNOWN_OPERATOR_SCOPE_VALUES);
 
 export function isOperatorScope(value: unknown): value is OperatorScope {
   return typeof value === "string" && KNOWN_OPERATOR_SCOPES.has(value as OperatorScope);
diff --git a/src/gateway/resolve-configured-secret-input-string.ts b/src/gateway/resolve-configured-secret-input-string.ts
index 929955607ba..0842fa240ed 100644
--- a/src/gateway/resolve-configured-secret-input-string.ts
+++ b/src/gateway/resolve-configured-secret-input-string.ts
@@ -5,7 +5,7 @@ import { resolveSecretRefValues } from "../secrets/resolve.js";
 import { normalizeOptionalString } from "../shared/string-coerce.js";
 
 export type SecretInputUnresolvedReasonStyle = "generic" | "detailed"; // pragma: allowlist secret
-export type ConfiguredSecretInputSource =
+type ConfiguredSecretInputSource =
   | "config"
   | "secretRef" // pragma: allowlist secret
   | "fallback";
diff --git a/src/gateway/role-policy.ts b/src/gateway/role-policy.ts
index 8366cd1c6c2..2f35920b17f 100644
--- a/src/gateway/role-policy.ts
+++ b/src/gateway/role-policy.ts
@@ -1,6 +1,6 @@
 import { isNodeRoleMethod } from "./method-scopes.js";
 
-export const GATEWAY_ROLES = ["operator", "node"] as const;
+const GATEWAY_ROLES = ["operator", "node"] as const;
 
 export type GatewayRole = (typeof GATEWAY_ROLES)[number];
 
diff --git a/src/gateway/security-path.ts b/src/gateway/security-path.ts
index d369146b71c..133a3fac7bb 100644
--- a/src/gateway/security-path.ts
+++ b/src/gateway/security-path.ts
@@ -1,6 +1,6 @@
 import { normalizeLowercaseStringOrEmpty } from "../shared/string-coerce.js";
 
-export type SecurityPathCanonicalization = {
+type SecurityPathCanonicalization = {
   canonicalPath: string;
   candidates: string[];
   decodePasses: number;