diff --git a/src/image-resolver.test.ts b/src/image-resolver.test.ts
index 8f92116ee..24ceb54fc 100644
--- a/src/image-resolver.test.ts
+++ b/src/image-resolver.test.ts
@@ -6,6 +6,7 @@ import {
   resolveRuntimeImage,
   validateCustomImageManifest,
 } from './image-resolver';
+import * as imageResolverExports from './image-resolver';
 import { parseImageTag } from './image-tag';
 import type { WrapperConfig } from './types';
 import { validateAwfFileConfig } from './config-file';
@@ -26,6 +27,12 @@ describe('custom runtime image manifest', () => {
     resetRuntimeImageLedger();
   });
 
+  it('keeps default image constants internal to the resolver', () => {
+    expect(imageResolverExports).not.toHaveProperty('DEFAULT_IMAGE_REGISTRY');
+    expect(imageResolverExports).not.toHaveProperty('DEFAULT_DIND_STAGING_IMAGE');
+    expect(imageResolverExports).not.toHaveProperty('DEFAULT_DOH_PROXY_IMAGE');
+  });
+
   it('resolves only the digest-pinned configured image', () => {
     const result = resolveRuntimeImage(
       config({ squid: image('squid') }),
diff --git a/src/image-resolver.ts b/src/image-resolver.ts
index a61f1071d..a9c309b89 100644
--- a/src/image-resolver.ts
+++ b/src/image-resolver.ts
@@ -33,9 +33,9 @@ const MANIFEST_KEY: Record<RuntimeImageName, ManifestKey> = {
   'doh-proxy': 'dohProxy',
 };
 
-export const DEFAULT_IMAGE_REGISTRY = 'ghcr.io/github/gh-aw-firewall';
-export const DEFAULT_DIND_STAGING_IMAGE = 'ghcr.io/github/gh-aw-firewall/agent:latest';
-export const DEFAULT_DOH_PROXY_IMAGE = 'cloudflare/cloudflared:latest';
+const DEFAULT_IMAGE_REGISTRY = 'ghcr.io/github/gh-aw-firewall';
+const DEFAULT_DIND_STAGING_IMAGE = 'ghcr.io/github/gh-aw-firewall/agent:latest';
+const DEFAULT_DOH_PROXY_IMAGE = 'cloudflare/cloudflared:latest';
 
 /**
  * Roles whose default (non-manifest) image is not published under the AWF