diff --git a/Dockerfile b/Dockerfile
index a9b200f9..c73b70d1 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -23,8 +23,8 @@ RUN --mount=type=cache,target=/go \
 FROM gcr.io/distroless/static:nonroot
 COPY certs /etc/ssl/certs/ngrok
 WORKDIR /
-COPY --from=builder /workspace/bin/api-manager /workspace/bin/agent-manager /workspace/bin/bindings-forwarder-manager ./
+COPY --from=builder /workspace/bin/ngrok-operator ./
 USER 65532:65532
 
 
-ENTRYPOINT ["/api-manager"]
+ENTRYPOINT ["/ngrok-operator"]
diff --git a/cmd/agent/main.go b/cmd/agent-manager.go
similarity index 94%
rename from cmd/agent/main.go
rename to cmd/agent-manager.go
index ee53d68f..1366afb8 100644
--- a/cmd/agent/main.go
+++ b/cmd/agent-manager.go
@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package main
+package cmd
 
 import (
 	"context"
@@ -26,10 +26,12 @@ import (
 	// Import all Kubernetes client auth plugins (e.g. Azure, GCP, OIDC, etc.)
 	// to ensure that exec-entrypoint and run can make use of them.
 
+	// typically only use blank imports in main
+	// but we treat each of these cmd's as their own
+	// "main", they are all subcommands
 	_ "k8s.io/client-go/plugin/pkg/client/auth"
 
 	"github.com/spf13/cobra"
-	"k8s.io/apimachinery/pkg/runtime"
 	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
 	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
 	ctrl "sigs.k8s.io/controller-runtime"
@@ -48,12 +50,9 @@ import (
 	// +kubebuilder:scaffold:imports
 )
 
-var (
-	scheme   = runtime.NewScheme()
-	setupLog = ctrl.Log.WithName("setup")
-)
-
 func init() {
+	rootCmd.AddCommand(agentCmd())
+
 	utilruntime.Must(clientgoscheme.AddToScheme(scheme))
 	utilruntime.Must(gatewayv1.Install(scheme))
 	utilruntime.Must(ingressv1alpha1.AddToScheme(scheme))
@@ -62,14 +61,7 @@ func init() {
 	// +kubebuilder:scaffold:scheme
 }
 
-func main() {
-	if err := cmd().Execute(); err != nil {
-		setupLog.Error(err, "error running agent-manager")
-		os.Exit(1)
-	}
-}
-
-type managerOpts struct {
+type agentManagerOpts struct {
 	// flags
 	metricsAddr string
 	probeAddr   string
@@ -89,12 +81,12 @@ type managerOpts struct {
 	rootCAs string
 }
 
-func cmd() *cobra.Command {
-	var opts managerOpts
+func agentCmd() *cobra.Command {
+	var opts agentManagerOpts
 	c := &cobra.Command{
 		Use: "agent-manager",
 		RunE: func(c *cobra.Command, _ []string) error {
-			return runController(c.Context(), opts)
+			return runAgentController(c.Context(), opts)
 		},
 	}
 
@@ -123,7 +115,7 @@ func cmd() *cobra.Command {
 	return c
 }
 
-func runController(ctx context.Context, opts managerOpts) error {
+func runAgentController(ctx context.Context, opts agentManagerOpts) error {
 	ctrl.SetLogger(zap.New(zap.UseFlagOptions(opts.zapOpts)))
 
 	buildInfo := version.Get()
diff --git a/cmd/api/main.go b/cmd/api-manager.go
similarity index 95%
rename from cmd/api/main.go
rename to cmd/api-manager.go
index db436b3f..ff177e6c 100644
--- a/cmd/api/main.go
+++ b/cmd/api-manager.go
@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package main
+package cmd
 
 import (
 	"context"
@@ -30,12 +30,14 @@ import (
 	// to ensure that exec-entrypoint and run can make use of them.
 
 	"k8s.io/client-go/discovery"
+	// typically only use blank imports in main
+	// but we treat each of these cmd's as their own
+	// "main", they are all subcommands
 	_ "k8s.io/client-go/plugin/pkg/client/auth"
 	"k8s.io/client-go/rest"
 	"k8s.io/utils/ptr"
 
 	"github.com/spf13/cobra"
-	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/types"
 	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
 	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
@@ -72,12 +74,9 @@ import (
 	// +kubebuilder:scaffold:imports
 )
 
-var (
-	scheme   = runtime.NewScheme()
-	setupLog = ctrl.Log.WithName("setup")
-)
-
 func init() {
+	rootCmd.AddCommand(apiCmd())
+
 	utilruntime.Must(clientgoscheme.AddToScheme(scheme))
 	utilruntime.Must(gatewayv1.Install(scheme))
 	utilruntime.Must(gatewayv1beta1.Install(scheme))
@@ -88,14 +87,7 @@ func init() {
 	// +kubebuilder:scaffold:scheme
 }
 
-func main() {
-	if err := cmd().Execute(); err != nil {
-		setupLog.Error(err, "error running api-manager")
-		os.Exit(1)
-	}
-}
-
-type managerOpts struct {
+type apiManagerOpts struct {
 	// flags
 	releaseName           string
 	metricsAddr           string
@@ -140,8 +132,8 @@ type managerOpts struct {
 	region string
 }
 
-func cmd() *cobra.Command {
-	var opts managerOpts
+func apiCmd() *cobra.Command {
+	var opts apiManagerOpts
 	c := &cobra.Command{
 		Use: "api-manager",
 		RunE: func(c *cobra.Command, _ []string) error {
@@ -185,7 +177,7 @@ func cmd() *cobra.Command {
 }
 
 // startOperator starts the ngrok-op
-func startOperator(ctx context.Context, opts managerOpts) error {
+func startOperator(ctx context.Context, opts apiManagerOpts) error {
 	ctrl.SetLogger(zap.New(zap.UseFlagOptions(opts.zapOpts)))
 
 	buildInfo := version.Get()
@@ -316,7 +308,7 @@ func runOneClickDemoMode(ctx context.Context, mgr ctrl.Manager) error {
 }
 
 // runNormalMode runs the operator in normal operation mode
-func runNormalMode(ctx context.Context, opts managerOpts, k8sClient client.Client, mgr ctrl.Manager, tcpRouteCRDInstalled, tlsRouteCRDInstalled bool) error {
+func runNormalMode(ctx context.Context, opts apiManagerOpts, k8sClient client.Client, mgr ctrl.Manager, tcpRouteCRDInstalled, tlsRouteCRDInstalled bool) error {
 	ngrokClientset, err := loadNgrokClientset(ctx, opts)
 	if err != nil {
 		return fmt.Errorf("Unable to load ngrokClientSet: %w", err)
@@ -413,7 +405,7 @@ func runNormalMode(ctx context.Context, opts managerOpts, k8sClient client.Clien
 }
 
 // loadManager loads the controller-runtime manager with the provided options
-func loadManager(k8sConfig *rest.Config, opts managerOpts) (manager.Manager, error) {
+func loadManager(k8sConfig *rest.Config, opts apiManagerOpts) (manager.Manager, error) {
 	options := ctrl.Options{
 		Scheme: scheme,
 		Metrics: server.Options{
@@ -442,7 +434,7 @@ func loadManager(k8sConfig *rest.Config, opts managerOpts) (manager.Manager, err
 }
 
 // loadNgrokClientset loads the ngrok API clientset from the environment and managerOpts
-func loadNgrokClientset(ctx context.Context, opts managerOpts) (ngrokapi.Clientset, error) {
+func loadNgrokClientset(ctx context.Context, opts apiManagerOpts) (ngrokapi.Clientset, error) {
 	var ok bool
 	opts.ngrokAPIKey, ok = os.LookupEnv("NGROK_API_KEY")
 	if !ok {
@@ -478,7 +470,7 @@ func loadNgrokClientset(ctx context.Context, opts managerOpts) (ngrokapi.Clients
 }
 
 // getK8sResourceDriver returns a new Driver instance that is seeded with the current state of the cluster.
-func getK8sResourceDriver(ctx context.Context, mgr manager.Manager, options managerOpts, tcpRouteCRDInstalled, tlsRouteCRDInstalled bool) (*managerdriver.Driver, error) {
+func getK8sResourceDriver(ctx context.Context, mgr manager.Manager, options apiManagerOpts, tcpRouteCRDInstalled, tlsRouteCRDInstalled bool) (*managerdriver.Driver, error) {
 	logger := mgr.GetLogger().WithName("cache-store-driver")
 
 	driverOpts := []managerdriver.DriverOpt{
@@ -523,7 +515,7 @@ func getK8sResourceDriver(ctx context.Context, mgr manager.Manager, options mana
 }
 
 // enableIngressFeatureSet enables the Ingress feature set for the operator
-func enableIngressFeatureSet(_ context.Context, opts managerOpts, mgr ctrl.Manager, driver *managerdriver.Driver, ngrokClientset ngrokapi.Clientset) error {
+func enableIngressFeatureSet(_ context.Context, opts apiManagerOpts, mgr ctrl.Manager, driver *managerdriver.Driver, ngrokClientset ngrokapi.Clientset) error {
 	if err := (&ingresscontroller.IngressReconciler{
 		Client:               mgr.GetClient(),
 		Log:                  ctrl.Log.WithName("controllers").WithName("ingress"),
@@ -645,7 +637,7 @@ func enableIngressFeatureSet(_ context.Context, opts managerOpts, mgr ctrl.Manag
 }
 
 // enableGatewayFeatureSet enables the Gateway feature set for the operator
-func enableGatewayFeatureSet(_ context.Context, opts managerOpts, mgr ctrl.Manager, driver *managerdriver.Driver, _ ngrokapi.Clientset, tcpRouteCRDInstalled, tlsRouteCRDInstalled bool) error {
+func enableGatewayFeatureSet(_ context.Context, opts apiManagerOpts, mgr ctrl.Manager, driver *managerdriver.Driver, _ ngrokapi.Clientset, tcpRouteCRDInstalled, tlsRouteCRDInstalled bool) error {
 	if err := (&gatewaycontroller.GatewayClassReconciler{
 		Client:   mgr.GetClient(),
 		Log:      ctrl.Log.WithName("controllers").WithName("GatewayClass"),
@@ -734,7 +726,7 @@ func enableGatewayFeatureSet(_ context.Context, opts managerOpts, mgr ctrl.Manag
 }
 
 // enableBindingsFeatureSet enables the Bindings feature set for the operator
-func enableBindingsFeatureSet(_ context.Context, opts managerOpts, mgr ctrl.Manager, _ *managerdriver.Driver, ngrokClientset ngrokapi.Clientset) error {
+func enableBindingsFeatureSet(_ context.Context, opts apiManagerOpts, mgr ctrl.Manager, _ *managerdriver.Driver, ngrokClientset ngrokapi.Clientset) error {
 	targetServiceAnnotations, err := util.ParseHelmDictionary(opts.bindings.serviceAnnotations)
 	if err != nil {
 		setupLog.WithValues("serviceAnnotations", opts.bindings.serviceAnnotations).Error(err, "unable to parse service annotations")
@@ -783,7 +775,7 @@ func enableBindingsFeatureSet(_ context.Context, opts managerOpts, mgr ctrl.Mana
 	return nil
 }
 
-func createKubernetesOperator(ctx context.Context, client client.Client, opts managerOpts) error {
+func createKubernetesOperator(ctx context.Context, client client.Client, opts apiManagerOpts) error {
 	k8sOperator := &ngrokv1alpha1.KubernetesOperator{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      opts.releaseName,
diff --git a/cmd/bindings-forwarder/main.go b/cmd/bindings-forwarder-manager.go
similarity index 92%
rename from cmd/bindings-forwarder/main.go
rename to cmd/bindings-forwarder-manager.go
index bb844777..580a98f9 100644
--- a/cmd/bindings-forwarder/main.go
+++ b/cmd/bindings-forwarder-manager.go
@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package main
+package cmd
 
 import (
 	"context"
@@ -26,10 +26,12 @@ import (
 	// Import all Kubernetes client auth plugins (e.g. Azure, GCP, OIDC, etc.)
 	// to ensure that exec-entrypoint and run can make use of them.
 
+	// typically only use blank imports in main
+	// but we treat each of these cmd's as their own
+	// "main", they are all subcommands
 	_ "k8s.io/client-go/plugin/pkg/client/auth"
 
 	"github.com/spf13/cobra"
-	"k8s.io/apimachinery/pkg/runtime"
 	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
 	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
 	ctrl "sigs.k8s.io/controller-runtime"
@@ -48,25 +50,15 @@ import (
 	// +kubebuilder:scaffold:imports
 )
 
-var (
-	scheme   = runtime.NewScheme()
-	setupLog = ctrl.Log.WithName("setup")
-)
-
 func init() {
+	rootCmd.AddCommand(bindingsForwarderCmd())
+
 	utilruntime.Must(clientgoscheme.AddToScheme(scheme))
 	utilruntime.Must(bindingsv1alpha1.AddToScheme(scheme))
 	utilruntime.Must(ngrokv1alpha1.AddToScheme(scheme))
 }
 
-func main() {
-	if err := cmd().Execute(); err != nil {
-		setupLog.Error(err, "error running bindings-forwarder-manager")
-		os.Exit(1)
-	}
-}
-
-type managerOpts struct {
+type bindingsForwarderManagerOpts struct {
 	// flags
 	releaseName string
 	metricsAddr string
@@ -79,8 +71,8 @@ type managerOpts struct {
 	namespace string
 }
 
-func cmd() *cobra.Command {
-	var opts managerOpts
+func bindingsForwarderCmd() *cobra.Command {
+	var opts bindingsForwarderManagerOpts
 	c := &cobra.Command{
 		Use: "bindings-forwarder-manager",
 		RunE: func(c *cobra.Command, _ []string) error {
@@ -102,7 +94,7 @@ func cmd() *cobra.Command {
 	return c
 }
 
-func runController(_ context.Context, opts managerOpts) error {
+func runController(_ context.Context, opts bindingsForwarderManagerOpts) error {
 	ctrl.SetLogger(zap.New(zap.UseFlagOptions(opts.zapOpts)))
 
 	buildInfo := version.Get()
diff --git a/cmd/root.go b/cmd/root.go
new file mode 100644
index 00000000..b68e67f2
--- /dev/null
+++ b/cmd/root.go
@@ -0,0 +1,24 @@
+package cmd
+
+import (
+	"log"
+
+	"github.com/spf13/cobra"
+	"k8s.io/apimachinery/pkg/runtime"
+	ctrl "sigs.k8s.io/controller-runtime"
+)
+
+var (
+	scheme   = runtime.NewScheme()
+	setupLog = ctrl.Log.WithName("setup")
+)
+
+var rootCmd = &cobra.Command{
+	Use: "ngrok-operator",
+}
+
+func Execute() {
+	if err := rootCmd.Execute(); err != nil {
+		log.Fatalln(err)
+	}
+}
diff --git a/helm/ngrok-operator/templates/agent/deployment.yaml b/helm/ngrok-operator/templates/agent/deployment.yaml
index adfcd17d..53251ff7 100644
--- a/helm/ngrok-operator/templates/agent/deployment.yaml
+++ b/helm/ngrok-operator/templates/agent/deployment.yaml
@@ -69,8 +69,9 @@ spec:
         image: {{ include "ngrok-operator.image" . }}
         imagePullPolicy: {{ .Values.image.pullPolicy }}
         command:
-        - /agent-manager
+        - /ngrok-operator
         args:
+        - agent-manager
         {{- include "ngrok-operator.manager.cliFeatureFlags" . | nindent 8 }}
         {{- if .Values.description }}
         - --description={{ .Values.description | quote }}
diff --git a/helm/ngrok-operator/templates/bindings-forwarder/deployment.yaml b/helm/ngrok-operator/templates/bindings-forwarder/deployment.yaml
index c53a4a9f..179e4b94 100644
--- a/helm/ngrok-operator/templates/bindings-forwarder/deployment.yaml
+++ b/helm/ngrok-operator/templates/bindings-forwarder/deployment.yaml
@@ -69,8 +69,9 @@ spec:
         image: {{ include "ngrok-operator.image" . }}
         imagePullPolicy: {{ .Values.image.pullPolicy }}
         command:
-        - /bindings-forwarder-manager
+        - /ngrok-operator
         args:
+        - bindings-forwarder-manager
         - --release-name={{ .Release.Name }}
         {{- if .Values.description }}
         - --description={{ .Values.description | quote }}
diff --git a/helm/ngrok-operator/templates/controller-deployment.yaml b/helm/ngrok-operator/templates/controller-deployment.yaml
index 93500ea2..61bb542d 100644
--- a/helm/ngrok-operator/templates/controller-deployment.yaml
+++ b/helm/ngrok-operator/templates/controller-deployment.yaml
@@ -68,8 +68,9 @@ spec:
         image: {{ include "ngrok-operator.image" . }}
         imagePullPolicy: {{ .Values.image.pullPolicy }}
         command:
-        - /api-manager
+        - /ngrok-operator
         args:
+        - api-manager
         - --release-name={{ .Release.Name }}
         {{- include "ngrok-operator.manager.cliFeatureFlags" . | nindent 8 }}
         {{- if .Values.oneClickDemoMode }}
diff --git a/helm/ngrok-operator/tests/__snapshot__/controller-deployment_test.yaml.snap b/helm/ngrok-operator/tests/__snapshot__/controller-deployment_test.yaml.snap
index 6aecbe00..5eef9a21 100644
--- a/helm/ngrok-operator/tests/__snapshot__/controller-deployment_test.yaml.snap
+++ b/helm/ngrok-operator/tests/__snapshot__/controller-deployment_test.yaml.snap
@@ -52,6 +52,7 @@ Should match all-options snapshot:
                   weight: 1
           containers:
             - args:
+                - api-manager
                 - --release-name=RELEASE-NAME
                 - --enable-feature-ingress=true
                 - --enable-feature-gateway=true
@@ -67,7 +68,7 @@ Should match all-options snapshot:
                 - --manager-name=RELEASE-NAME-ngrok-operator-manager
                 - --cluster-domain=svc.cluster.local
               command:
-                - /api-manager
+                - /ngrok-operator
               env:
                 - name: NGROK_API_KEY
                   valueFrom:
@@ -762,6 +763,7 @@ Should match default snapshot:
                   weight: 1
           containers:
             - args:
+                - api-manager
                 - --release-name=RELEASE-NAME
                 - --enable-feature-ingress=true
                 - --enable-feature-gateway=true
@@ -777,7 +779,7 @@ Should match default snapshot:
                 - --manager-name=RELEASE-NAME-ngrok-operator-manager
                 - --cluster-domain=svc.cluster.local
               command:
-                - /api-manager
+                - /ngrok-operator
               env:
                 - name: NGROK_API_KEY
                   valueFrom:
diff --git a/helm/ngrok-operator/tests/agent/__snapshot__/deployment_test.yaml.snap b/helm/ngrok-operator/tests/agent/__snapshot__/deployment_test.yaml.snap
index 3cdb75e8..690490bf 100644
--- a/helm/ngrok-operator/tests/agent/__snapshot__/deployment_test.yaml.snap
+++ b/helm/ngrok-operator/tests/agent/__snapshot__/deployment_test.yaml.snap
@@ -49,6 +49,7 @@ Should match snapshot:
                   weight: 1
           containers:
             - args:
+                - agent-manager
                 - --enable-feature-ingress=true
                 - --enable-feature-gateway=true
                 - --disable-reference-grants=false
@@ -60,7 +61,7 @@ Should match snapshot:
                 - --metrics-bind-address=:8080
                 - --manager-name=RELEASE-NAME-ngrok-operator-agent-manager
               command:
-                - /agent-manager
+                - /ngrok-operator
               env:
                 - name: NGROK_AUTHTOKEN
                   valueFrom:
diff --git a/helm/ngrok-operator/tests/bindings-forwarder/__snapshot__/deployment_test.yaml.snap b/helm/ngrok-operator/tests/bindings-forwarder/__snapshot__/deployment_test.yaml.snap
index bff2e615..9d1329a5 100644
--- a/helm/ngrok-operator/tests/bindings-forwarder/__snapshot__/deployment_test.yaml.snap
+++ b/helm/ngrok-operator/tests/bindings-forwarder/__snapshot__/deployment_test.yaml.snap
@@ -49,6 +49,7 @@ Should match snapshot:
                   weight: 1
           containers:
             - args:
+                - bindings-forwarder-manager
                 - --release-name=RELEASE-NAME
                 - --description="The official ngrok Kubernetes Operator."
                 - --zap-log-level=info
@@ -58,7 +59,7 @@ Should match snapshot:
                 - --metrics-bind-address=:8080
                 - --manager-name=RELEASE-NAME-ngrok-operator-bindings-forwarder
               command:
-                - /bindings-forwarder-manager
+                - /ngrok-operator
               env:
                 - name: NGROK_AUTHTOKEN
                   valueFrom:
diff --git a/main.go b/main.go
new file mode 100644
index 00000000..465632a5
--- /dev/null
+++ b/main.go
@@ -0,0 +1,7 @@
+package main
+
+import "github.com/ngrok/ngrok-operator/cmd"
+
+func main() {
+	cmd.Execute()
+}
diff --git a/tools/make/build.mk b/tools/make/build.mk
index 9f27ce48..108b7fbe 100644
--- a/tools/make/build.mk
+++ b/tools/make/build.mk
@@ -10,16 +10,9 @@ build: preflight generate fmt vet _build ## Build binaries.
 
 .PHONY: _build
 _build:
-	go build -o bin/api-manager -trimpath -ldflags "-s -w \
+	go build -o bin/ngrok-operator -trimpath -ldflags "-s -w \
 		-X $(REPO_URL)/internal/version.gitCommit=$(GIT_COMMIT) \
-		-X $(REPO_URL)/internal/version.version=$(VERSION)" cmd/api/main.go
-	go build -o bin/agent-manager -trimpath -ldflags "-s -w \
-		-X $(REPO_URL)/internal/version.gitCommit=$(GIT_COMMIT) \
-		-X $(REPO_URL)/internal/version.version=$(VERSION)" cmd/agent/main.go
-	go build -o bin/bindings-forwarder-manager -trimpath -ldflags "-s -w \
-		-X $(REPO_URL)/internal/version.gitCommit=$(GIT_COMMIT) \
-		-X $(REPO_URL)/internal/version.version=$(VERSION)" cmd/bindings-forwarder/main.go
-
+		-X $(REPO_URL)/internal/version.version=$(VERSION)"
 
 .PHONY: docker-build
 docker-build: ## Build docker image with the manager.