diff --git a/Cargo.toml b/Cargo.toml
index 24c48bb..4b64510 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -60,6 +60,36 @@ wasm-metadata = "0.254"
 wit-component = "0.254"
 wit-parser = "0.254"
 
+[workspace.lints.rustdoc]
+# Detects URLs that are not hyperlinks
+bare_urls = "warn"
+# Failures in resolving intra-doc link targets
+broken_intra_doc_links = "warn"
+# Codeblock attribute looks a lot like a known one
+invalid_codeblock_attributes = "warn"
+# Detects invalid HTML tags in doc comments
+invalid_html_tags = "warn"
+# Codeblock could not be parsed as valid Rust or is empty
+invalid_rust_codeblocks = "warn"
+# Detects crates with no crate-level documentation
+missing_crate_level_docs = "warn"
+# Linking from a public item to a private one
+private_intra_doc_links = "warn"
+# Detects redundant explicit links in doc comments
+redundant_explicit_links = "warn"
+# Detects unescaped backticks in doc comments
+unescaped_backticks = "warn"
+
+[workspace.lints.rust]
+# `pub` items not reachable from crate root
+unreachable_pub = "warn"
+# Non-standard naming conventions (includes non-camel-case types, non-snake-case, non-upper-case globals)
+bad_style = "warn"
+
+[workspace.lints.clippy]
+unnested_or_patterns = "warn"
+unused_async = "warn"
+
 # https://github.com/crate-ci/typos/blob/master/docs/reference.md
 [workspace.metadata.typos.default]
 extend-ignore-re = ["\\d\\w{4,}\\d"]
diff --git a/crates/wasm-pkg-client/Cargo.toml b/crates/wasm-pkg-client/Cargo.toml
index 29a63f2..8b6bdaa 100644
--- a/crates/wasm-pkg-client/Cargo.toml
+++ b/crates/wasm-pkg-client/Cargo.toml
@@ -46,3 +46,6 @@ tempfile = { workspace = true }
 rcgen = { workspace = true }
 rstest = { workspace = true }
 testcontainers = { workspace = true }
+
+[lints]
+workspace = true
diff --git a/crates/wasm-pkg-client/src/lib.rs b/crates/wasm-pkg-client/src/lib.rs
index 5808600..cf8d68c 100644
--- a/crates/wasm-pkg-client/src/lib.rs
+++ b/crates/wasm-pkg-client/src/lib.rs
@@ -27,7 +27,7 @@
 //! ```
 
 pub mod caching;
-mod decoded_component;
+pub mod decoded_component;
 mod loader;
 pub mod local;
 pub mod metadata;
diff --git a/crates/wasm-pkg-client/src/local.rs b/crates/wasm-pkg-client/src/local.rs
index f6d87e3..92a592a 100644
--- a/crates/wasm-pkg-client/src/local.rs
+++ b/crates/wasm-pkg-client/src/local.rs
@@ -64,7 +64,7 @@ fn registry_path_context(err: io::Error, path: &Path) -> Error {
 }
 
 impl LocalBackend {
-    pub fn new(registry_config: RegistryConfig) -> Result<Self, Error> {
+    pub(crate) fn new(registry_config: RegistryConfig) -> Result<Self, Error> {
         let config = registry_config
             .backend_config::<LocalConfig>(LOCAL_PROTOCOL)?
             .ok_or_else(|| {
diff --git a/crates/wasm-pkg-client/src/oci/mod.rs b/crates/wasm-pkg-client/src/oci/mod.rs
index 4c5cd65..3ce1406 100644
--- a/crates/wasm-pkg-client/src/oci/mod.rs
+++ b/crates/wasm-pkg-client/src/oci/mod.rs
@@ -46,7 +46,7 @@ pub(crate) struct OciBackend {
 }
 
 impl OciBackend {
-    pub fn new(
+    pub(crate) fn new(
         registry: &Registry,
         registry_config: &RegistryConfig,
         registry_meta: &RegistryMetadata,
diff --git a/crates/wasm-pkg-common/Cargo.toml b/crates/wasm-pkg-common/Cargo.toml
index ae0fd7e..95de1b7 100644
--- a/crates/wasm-pkg-common/Cargo.toml
+++ b/crates/wasm-pkg-common/Cargo.toml
@@ -41,3 +41,6 @@ tracing.workspace = true
 
 [dev-dependencies]
 tokio = { workspace = true, features = ["macros", "rt"] }
+
+[lints]
+workspace = true
diff --git a/crates/wasm-pkg-common/src/lib.rs b/crates/wasm-pkg-common/src/lib.rs
index 9c49102..ca12e4c 100644
--- a/crates/wasm-pkg-common/src/lib.rs
+++ b/crates/wasm-pkg-common/src/lib.rs
@@ -1,3 +1,6 @@
+//! Types shared across the `wasm-pkg-*` crates,
+//! references, content digests, registry metadata, and the common [`Error`] type.
+
 use http::uri::InvalidUri;
 use label::Label;
 
diff --git a/crates/wasm-pkg-core/Cargo.toml b/crates/wasm-pkg-core/Cargo.toml
index 6670563..839b861 100644
--- a/crates/wasm-pkg-core/Cargo.toml
+++ b/crates/wasm-pkg-core/Cargo.toml
@@ -46,3 +46,6 @@ sha2 = { workspace = true }
 rstest = { workspace = true }
 glob = { workspace = true }
 tokio = { workspace = true, features = ["rt", "macros", "process"] }
+
+[lints]
+workspace = true
diff --git a/crates/wasm-pkg-core/src/lock.rs b/crates/wasm-pkg-core/src/lock.rs
index 143bef6..85f90f9 100644
--- a/crates/wasm-pkg-core/src/lock.rs
+++ b/crates/wasm-pkg-core/src/lock.rs
@@ -388,7 +388,7 @@ impl Locker {
     ///
     /// The returned file can be accessed to look at the path and also has
     /// read/write access to the underlying file.
-    pub async fn try_open_rw(path: impl Into<PathBuf>) -> Result<Option<Self>> {
+    pub(crate) async fn try_open_rw(path: impl Into<PathBuf>) -> Result<Option<Self>> {
         Self::open(
             path.into(),
             OpenOptions::new().read(true).write(true).create(true),
@@ -410,7 +410,7 @@ impl Locker {
     ///
     /// The returned file can be accessed to look at the path and also has
     /// read/write access to the underlying file.
-    pub async fn open_rw(path: impl Into<PathBuf>) -> Result<Self> {
+    pub(crate) async fn open_rw(path: impl Into<PathBuf>) -> Result<Self> {
         Ok(Self::open(
             path.into(),
             OpenOptions::new().read(true).write(true).create(true),
@@ -433,7 +433,7 @@ impl Locker {
     /// The returned file can be accessed to look at the path and also has read
     /// access to the underlying file. Any writes to the file will return an
     /// error.
-    pub async fn try_open_ro(path: impl Into<PathBuf>) -> Result<Option<Self>> {
+    pub(crate) async fn try_open_ro(path: impl Into<PathBuf>) -> Result<Option<Self>> {
         Self::open(
             path.into(),
             OpenOptions::new().read(true),
@@ -454,7 +454,7 @@ impl Locker {
     /// The returned file can be accessed to look at the path and also has read
     /// access to the underlying file. Any writes to the file will return an
     /// error.
-    pub async fn open_ro(path: impl Into<PathBuf>) -> Result<Self> {
+    pub(crate) async fn open_ro(path: impl Into<PathBuf>) -> Result<Self> {
         Ok(Self::open(
             path.into(),
             OpenOptions::new().read(true),
diff --git a/crates/wasm-pkg-core/src/manifest.rs b/crates/wasm-pkg-core/src/manifest.rs
index 78dd347..af8b16d 100644
--- a/crates/wasm-pkg-core/src/manifest.rs
+++ b/crates/wasm-pkg-core/src/manifest.rs
@@ -49,7 +49,7 @@ impl Manifest {
     }
 
     /// Loads a manifest file from the given path.
-    pub async fn load_from_path(path: impl AsRef<Path>) -> Result<Manifest> {
+    pub fn load_from_path(path: impl AsRef<Path>) -> Result<Manifest> {
         let path = path.as_ref();
         tracing::info!(path = %path.display(), "loading wkg manifest file");
         let contents = std::fs::read_to_string(path)
@@ -114,20 +114,20 @@ impl Manifest {
         if !tokio::fs::try_exists(&manifest_path).await? {
             return Ok(Manifest::default());
         }
-        Self::load_from_path(manifest_path).await
+        Self::load_from_path(manifest_path)
     }
 
     /// Tries to find the root workspace config
     /// Returns `Ok(None)` when there is no `wkg.toml` ancestor that can be [`WorkspaceRootConfig`]
     // TODO(maktychev): reconcile load_from_path and load_root_workspace
-    pub async fn load_root_workspace(cwd: &Path) -> Result<Option<WorkspaceRootConfig>> {
+    pub fn load_root_workspace(cwd: &Path) -> Result<Option<WorkspaceRootConfig>> {
         let Some(manifest_file) = find_root_manifest_for_wd(cwd) else {
             return Ok(None);
         };
         let manifest_dir = manifest_file
             .parent()
             .context("unexpectedly missing directory containing manifest")?;
-        let manifest = Self::load_from_path(&manifest_file).await?;
+        let manifest = Self::load_from_path(&manifest_file)?;
 
         if let Some(root) = manifest.root() {
             return Ok(Some(root.clone()));
@@ -135,7 +135,7 @@ impl Manifest {
 
         // keep walking up if we have not found root
         for file in find_root_iter(&manifest_file) {
-            let manifest = Self::load_from_path(&file).await?;
+            let manifest = Self::load_from_path(&file)?;
             if let Some(WorkspaceConfig::Root(root)) = manifest.workspace
                 && root.is_explicitly_listed_member(manifest_dir)
             {
@@ -233,9 +233,8 @@ mod tests {
             .write(&manifest_path)
             .await
             .expect("unable to write manifest");
-        let loaded_manifest = Manifest::load_from_path(manifest_path)
-            .await
-            .expect("unable to load manifest");
+        let loaded_manifest =
+            Manifest::load_from_path(manifest_path).expect("unable to load manifest");
         assert_eq!(
             manifest, loaded_manifest,
             "manifest loaded from file does not match original manifest"
diff --git a/crates/wasm-pkg-core/src/manifest/workspace.rs b/crates/wasm-pkg-core/src/manifest/workspace.rs
index f56cb06..aba533b 100644
--- a/crates/wasm-pkg-core/src/manifest/workspace.rs
+++ b/crates/wasm-pkg-core/src/manifest/workspace.rs
@@ -268,14 +268,10 @@ members = ["pkg-a"]
         fs::create_dir_all(root_dir.join("pkg-a/wit")).unwrap();
 
         let expected = root_dir.canonicalize().unwrap();
-        let from_root = Manifest::load_root_workspace(root_dir)
-            .await
-            .unwrap()
-            .unwrap();
+        let from_root = Manifest::load_root_workspace(root_dir).unwrap().unwrap();
         assert_eq!(from_root.root_dir.canonicalize().unwrap(), expected);
 
         let from_member = Manifest::load_root_workspace(&root_dir.join("pkg-a/wit"))
-            .await
             .unwrap()
             .unwrap();
         assert_eq!(from_member.root_dir.canonicalize().unwrap(), expected);
@@ -293,11 +289,6 @@ members = ["pkg-a"]
 authors = "Webster Assembler"
 "#,
         );
-        assert!(
-            Manifest::load_root_workspace(root_dir)
-                .await
-                .unwrap()
-                .is_none()
-        );
+        assert!(Manifest::load_root_workspace(root_dir).unwrap().is_none());
     }
 }
diff --git a/crates/wasm-pkg-core/tests/common.rs b/crates/wasm-pkg-core/tests/common/mod.rs
similarity index 85%
rename from crates/wasm-pkg-core/tests/common.rs
rename to crates/wasm-pkg-core/tests/common/mod.rs
index 45bc81b..cafa1c3 100644
--- a/crates/wasm-pkg-core/tests/common.rs
+++ b/crates/wasm-pkg-core/tests/common/mod.rs
@@ -1,3 +1,5 @@
+// NOTE: test "lib" code needs to be under ./tests/common/mod.rs otherwise there will
+// be false clippy positives since ./tests/common.rs will be treated as a runnable test target
 use std::path::{Path, PathBuf};
 
 use tempfile::TempDir;
@@ -7,13 +9,13 @@ use wasm_pkg_client::{
 };
 use wasm_pkg_core::wit::WIT_DEPS_DIR;
 
-pub fn fixture_dir() -> PathBuf {
+pub(crate) fn fixture_dir() -> PathBuf {
     PathBuf::from(env!("CARGO_MANIFEST_DIR"))
         .join("tests")
         .join("fixtures")
 }
 
-pub async fn get_client() -> anyhow::Result<(TempDir, CachingClient<FileCache>)> {
+pub(crate) async fn get_client() -> anyhow::Result<(TempDir, CachingClient<FileCache>)> {
     // NOTE: `Client::with_global_defaults()` may pick up a user's redirect of `wasi` to a private registry
     let client = Client::new(Config::default());
     let cache_temp_dir = tempfile::tempdir()?;
@@ -23,7 +25,7 @@ pub async fn get_client() -> anyhow::Result<(TempDir, CachingClient<FileCache>)>
 }
 
 /// Loads the fixture with the given name into a temporary directory. This will copy the fixture from the tests/fixtures directory into a temporary directory and return the tempdir containing that directory (and its path)
-pub async fn load_fixture(fixture: &str) -> anyhow::Result<(TempDir, PathBuf)> {
+pub(crate) async fn load_fixture(fixture: &str) -> anyhow::Result<(TempDir, PathBuf)> {
     let temp_dir = tempfile::tempdir()?;
     let fixture_path = fixture_dir().join(fixture);
     // This will error if it doesn't exist, which is what we want
diff --git a/crates/wkg/Cargo.toml b/crates/wkg/Cargo.toml
index dc01ac1..b8212c8 100644
--- a/crates/wkg/Cargo.toml
+++ b/crates/wkg/Cargo.toml
@@ -43,3 +43,6 @@ base64 = { workspace = true }
 serde_json = { workspace = true }
 tempfile = { workspace = true }
 testcontainers = { workspace = true }
+
+[lints]
+workspace = true
diff --git a/crates/wkg/src/main.rs b/crates/wkg/src/main.rs
index c0ff439..f0287be 100644
--- a/crates/wkg/src/main.rs
+++ b/crates/wkg/src/main.rs
@@ -1,3 +1,5 @@
+//! The `wkg` CLI: fetches and publishes WIT and Wasm Components
+
 use std::{
     io::{Cursor, Seek},
     path::PathBuf,
@@ -25,9 +27,9 @@ use wasm_pkg_core::{
 };
 use wit_component::DecodedWasm;
 
-mod oci;
+pub mod oci;
 mod overlay;
-mod wit;
+pub mod wit;
 
 use oci::OciCommands;
 use wit::{BuildArgs, FetchArgs, UpdateArgs, WitCommands};
@@ -64,7 +66,7 @@ macro_rules! helpln {
 
 #[derive(Parser, Debug)]
 #[command(version)]
-struct Cli {
+pub struct Cli {
     #[command(flatten)]
     color: colorchoice_clap::Color,
 
@@ -73,14 +75,14 @@ struct Cli {
 }
 
 #[derive(Args, Debug)]
-struct RegistryArgs {
+pub struct RegistryArgs {
     /// The registry domain to use. Overrides configuration file(s).
     #[arg(long = "registry", value_name = "REGISTRY", env = "WKG_REGISTRY")]
     registry: Option<Registry>,
 }
 
 #[derive(Args, Debug, Default)]
-struct Common {
+pub struct Common {
     /// The path to the configuration file.
     #[arg(long = "config", value_name = "CONFIG", env = "WKG_CONFIG_FILE")]
     config: Option<PathBuf>,
@@ -128,7 +130,7 @@ impl Common {
 
 #[derive(Subcommand, Debug)]
 #[allow(clippy::large_enum_variant)]
-enum Commands {
+pub enum Commands {
     /// Set registry configuration
     Config(ConfigArgs),
     /// Download a package from a registry
@@ -147,7 +149,7 @@ enum Commands {
 }
 
 #[derive(Args, Debug)]
-struct ConfigArgs {
+pub struct ConfigArgs {
     /// The default registry domain to use. Overrides configuration file(s).
     #[arg(long = "default-registry", value_name = "DEFAULT_REGISTRY")]
     default_registry: Option<Registry>,
@@ -235,10 +237,10 @@ impl ConfigArgs {
 }
 
 #[derive(Args, Debug)]
-struct GetArgs {
+pub struct GetArgs {
     /// Output path. If this ends with a '/', a filename based on the package
     /// name, version, and format will be appended, e.g.
-    /// `name-space_name@1.0.0.wasm``.
+    /// `name-space_name@1.0.0.wasm`.
     #[arg(long, short, default_value = "./")]
     output: PathBuf,
 
@@ -259,7 +261,7 @@ struct GetArgs {
     overwrite: bool,
 
     /// The package to get, specified as `<namespace>:<name>` plus optional
-    /// `@<version>`, e.g. `wasi:cli" or `wasi:http@0.2.0`.
+    /// `@<version>`, e.g. `wasi:cli` or `wasi:http@0.2.0`.
     package_spec: PackageSpec,
 
     #[command(flatten)]
@@ -270,7 +272,7 @@ struct GetArgs {
 }
 
 #[derive(Args, Debug)]
-struct PublishArgs {
+pub struct PublishArgs {
     /// The files and directories to publish.
     /// If a directory is provided, the package is built to a tempfile before publishing.
     paths: Vec<PathBuf>,
@@ -308,7 +310,7 @@ struct PublishArgs {
 impl PublishArgs {
     pub async fn run(mut self) -> anyhow::Result<()> {
         let publish_opts = self.publish_opts()?;
-        let _root = self.workspace_root().await?;
+        let _root = self.workspace_root()?;
         let path = match &self.paths[..] {
             [] => {
                 anyhow::bail!(
@@ -446,7 +448,7 @@ impl PublishArgs {
         Ok(())
     }
 
-    async fn workspace_root(&mut self) -> anyhow::Result<Option<WorkspaceRootConfig>> {
+    fn workspace_root(&mut self) -> anyhow::Result<Option<WorkspaceRootConfig>> {
         match self.workspace {
             true if !self.paths.is_empty() => anyhow::bail!(
                 "`--workspace` selects every workspace member; do not also pass explicit \
@@ -457,7 +459,7 @@ impl PublishArgs {
             false => return Ok(None),
         }
         let cwd = std::env::current_dir()?;
-        let Some(root) = Manifest::load_root_workspace(&cwd).await? else {
+        let Some(root) = Manifest::load_root_workspace(&cwd)? else {
             bail!(
                 "`--workspace` called but unable to find workspace root from {}",
                 cwd.display(),
diff --git a/crates/wkg/src/wit.rs b/crates/wkg/src/wit.rs
index 76cb811..f1e8806 100644
--- a/crates/wkg/src/wit.rs
+++ b/crates/wkg/src/wit.rs
@@ -157,7 +157,7 @@ pub async fn temp_wit_file(package: &PackageRef, bytes: &[u8]) -> anyhow::Result
 impl FetchArgs {
     pub async fn run(self) -> anyhow::Result<()> {
         let cwd = std::env::current_dir()?;
-        let mut root = Manifest::load_root_workspace(&cwd).await?;
+        let mut root = Manifest::load_root_workspace(&cwd)?;
         let manifest_path = find_root_manifest_for_wd(&cwd);
         if root.as_ref().is_some_and(|root| {
             manifest_path
@@ -178,10 +178,10 @@ impl FetchArgs {
         let manifest = match root.as_ref() {
             Some(root) => {
                 let manifest_path = root.root_dir().join(MANIFEST_FILE_NAME);
-                Manifest::load_from_path(manifest_path).await?
+                Manifest::load_from_path(manifest_path)?
             }
             None => match manifest_path.as_ref() {
-                Some(path) => Manifest::load_from_path(path).await?,
+                Some(path) => Manifest::load_from_path(path)?,
                 None => Manifest::default(),
             },
         };
diff --git a/crates/wkg/tests/common.rs b/crates/wkg/tests/common/mod.rs
similarity index 85%
rename from crates/wkg/tests/common.rs
rename to crates/wkg/tests/common/mod.rs
index 24d92dd..dd37298 100644
--- a/crates/wkg/tests/common.rs
+++ b/crates/wkg/tests/common/mod.rs
@@ -1,3 +1,7 @@
+// NOTE: test "lib" code needs to be under ./tests/common/mod.rs otherwise there will
+// be false clippy positives since ./tests/common.rs will be treated as a runnable test target
+#![cfg_attr(not(feature = "docker-tests"), allow(dead_code))]
+
 use std::{
     collections::HashMap,
     net::{Ipv4Addr, SocketAddrV4},
@@ -15,7 +19,7 @@ use wasm_pkg_client::{Config, CustomConfig, Registry, RegistryMetadata, oci::Oci
 use wasm_pkg_core::wit::WIT_DEPS_DIR;
 
 /// Returns an open port on localhost
-pub async fn find_open_port() -> u16 {
+pub(crate) async fn find_open_port() -> u16 {
     TcpListener::bind(SocketAddrV4::new(Ipv4Addr::LOCALHOST, 0))
         .await
         .expect("failed to bind random port")
@@ -27,7 +31,7 @@ pub async fn find_open_port() -> u16 {
 /// Starts a registry container on an open port, returning a [`Config`] with registry auth
 /// configured for it and the name of the registry. The container handle is also returned as it must
 /// be kept in scope
-pub async fn start_registry() -> (Config, Registry, ContainerAsync<GenericImage>) {
+pub(crate) async fn start_registry() -> (Config, Registry, ContainerAsync<GenericImage>) {
     let port = find_open_port().await;
     let container = GenericImage::new("registry", "2")
         .with_wait_for(WaitFor::message_on_stderr("listening on [::]:5000"))
@@ -61,11 +65,11 @@ pub async fn start_registry() -> (Config, Registry, ContainerAsync<GenericImage>
     (config, registry, container)
 }
 
-pub const TRANSITIVE_LOCAL_NAMESPACES: &[&str] =
+pub(crate) const TRANSITIVE_LOCAL_NAMESPACES: &[&str] =
     &["example-a", "example-b", "example-c", "example-d"];
 
 /// Maps every namespace in [`TRANSITIVE_LOCAL_NAMESPACES`] to `registry`.
-pub fn map_transitive_local_namespaces(config: &Config, registry: &Registry) -> Config {
+pub(crate) fn map_transitive_local_namespaces(config: &Config, registry: &Registry) -> Config {
     let mut mapped = config.clone();
     for ns in TRANSITIVE_LOCAL_NAMESPACES {
         mapped = map_namespace(&mapped, ns, registry);
@@ -74,7 +78,7 @@ pub fn map_transitive_local_namespaces(config: &Config, registry: &Registry) ->
 }
 
 /// runs `wkg publish --workspace` for [`TRANSITIVE_LOCAL_NAMESPACES`] packages
-pub async fn publish_transitive_local(config: &Config) -> Fixture {
+pub(crate) async fn publish_transitive_local(config: &Config) -> Fixture {
     let fixture = load_fixture_from(transitive_local_fixture()).await;
     let status = fixture
         .command_with_config(config)
@@ -88,7 +92,7 @@ pub async fn publish_transitive_local(config: &Config) -> Fixture {
 }
 
 /// Clones the given config, mapping the namespace to the given registry at the top level
-pub fn map_namespace(config: &Config, namespace: &str, registry: &Registry) -> Config {
+pub(crate) fn map_namespace(config: &Config, namespace: &str, registry: &Registry) -> Config {
     let mut config = config.clone();
     let mut metadata = RegistryMetadata::default();
     metadata.preferred_protocol = Some("oci".to_string());
@@ -106,7 +110,7 @@ pub fn map_namespace(config: &Config, namespace: &str, registry: &Registry) -> C
 }
 
 /// A loaded fixture with helpers for running wkg tests
-pub struct Fixture {
+pub(crate) struct Fixture {
     pub temp_dir: tempfile::TempDir,
     pub fixture_path: PathBuf,
 }
@@ -114,7 +118,7 @@ pub struct Fixture {
 impl Fixture {
     /// Returns a base `wkg` command for running tests with the current directory set to the loaded
     /// fixture and with a separate wkg cache dir
-    pub fn command(&self) -> Command {
+    pub(crate) fn command(&self) -> Command {
         let mut cmd = Command::new(env!("CARGO_BIN_EXE_wkg"));
         cmd.current_dir(&self.fixture_path);
         cmd.env("WKG_CACHE_DIR", self.temp_dir.path().join("cache"));
@@ -123,7 +127,7 @@ impl Fixture {
 
     /// Same as [`Fixture::command`] but also writes the given config to disk and sets the
     /// `WKG_CONFIG` environment variable to the path of the config
-    pub async fn command_with_config(&self, config: &Config) -> Command {
+    pub(crate) async fn command_with_config(&self, config: &Config) -> Command {
         let config_path = self.temp_dir.path().join("config.toml");
         config
             .to_file(&config_path)
@@ -136,13 +140,13 @@ impl Fixture {
 }
 
 /// Gets the path to the fixture
-pub fn fixture_dir() -> PathBuf {
+pub(crate) fn fixture_dir() -> PathBuf {
     PathBuf::from(env!("CARGO_MANIFEST_DIR"))
         .join("tests")
         .join("fixtures")
 }
 
-pub fn transitive_local_fixture() -> PathBuf {
+pub(crate) fn transitive_local_fixture() -> PathBuf {
     PathBuf::from(env!("CARGO_MANIFEST_DIR"))
         .join("../wasm-pkg-core/tests/fixtures/transitive-local")
 }
@@ -150,11 +154,11 @@ pub fn transitive_local_fixture() -> PathBuf {
 /// Loads the fixture with the given name into a temporary directory. This will copy the fixture
 /// from the tests/fixtures directory into a temporary directory and return the tempdir containing
 /// that directory (and its path)
-pub async fn load_fixture(fixture: &str) -> Fixture {
+pub(crate) async fn load_fixture(fixture: &str) -> Fixture {
     load_fixture_from(fixture_dir().join(fixture)).await
 }
 
-pub async fn load_fixture_from(src: impl AsRef<Path>) -> Fixture {
+async fn load_fixture_from(src: impl AsRef<Path>) -> Fixture {
     let src = src.as_ref();
     let temp_dir = tempfile::tempdir().expect("Failed to create tempdir");
     // This will error if it doesn't exist, which is what we want
@@ -171,7 +175,7 @@ pub async fn load_fixture_from(src: impl AsRef<Path>) -> Fixture {
     }
 }
 
-pub async fn copy_dir(
+pub(crate) async fn copy_dir(
     source: impl AsRef<Path>,
     destination: impl AsRef<Path>,
 ) -> anyhow::Result<()> {
diff --git a/crates/wkg/tests/e2e.rs b/crates/wkg/tests/e2e.rs
index 0b9b30d..2c48de3 100644
--- a/crates/wkg/tests/e2e.rs
+++ b/crates/wkg/tests/e2e.rs
@@ -1,3 +1,4 @@
+#[cfg(feature = "docker-tests")]
 use wasm_pkg_client::{Version, VersionInfo};
 
 #[cfg(feature = "docker-tests")]
@@ -73,7 +74,6 @@ async fn build_and_publish_with_metadata() {
         .expect("OciManifest should have annotations");
 
     let manifest = Manifest::load_from_path(fixture.fixture_path.join(MANIFEST_FILE_NAME))
-        .await
         .expect("Should be able to load wkg manifest");
     let meta = manifest.metadata.expect("Should have metadata");
 
@@ -126,7 +126,7 @@ async fn oci_push_sets_layer_title() {
     let image_ref = format!("{registry}/wasi/http:0.2.0");
     let status = fixture
         .command()
-        .args(["oci", "push", "--insecure", &registry.to_string()])
+        .args(["oci", "push", "--insecure", registry.as_ref()])
         .arg(&image_ref)
         .arg(&wasm_file)
         .status()