diff --git a/GOVERNANCE.md b/GOVERNANCE.md
index 3fa813173..404667b49 100644
--- a/GOVERNANCE.md
+++ b/GOVERNANCE.md
@@ -8,18 +8,47 @@ This document defines the governance structure of the Cozystack community, outli
 to building an open, inclusive, productive, and self-governing open source
 community focused on building a high-quality open source PaaS and framework for building clouds.
 
-## Code Repositories
+## Sub-projects
 
-The following code repositories are governed by the Cozystack community and
-maintained under the `cozystack` namespace:
+Cozystack is developed across several repositories in the `cozystack` GitHub organisation. They do not all carry the same weight, and the distinction that matters is whether a repository's output reaches the artifact an adopter installs.
 
-* **[Cozystack](https://github.com/cozystack/cozystack):** Main Cozystack codebase
-* **[website](https://github.com/cozystack/website):** Cozystack website and documentation sources
-* **[Talm](https://github.com/cozystack/talm):** Tool for managing Talos Linux the GitOps way
-* **[cozy-proxy](https://github.com/cozystack/cozy-proxy):** A simple kube-proxy addon for 1:1 NAT services in Kubernetes with NFT backend
-* **[cozystack-telemetry-server](https://github.com/cozystack/cozystack-telemetry-server):** Cozystack telemetry
-* **[talos-bootstrap](https://github.com/cozystack/talos-bootstrap):** An interactive Talos Linux installer
-* **[talos-meta-tool](https://github.com/cozystack/talos-meta-tool):** Tool for writing network metadata into META partition
+**Packaged sub-projects** are built or vendored into the Cozystack distribution: install Cozystack and you run their code. They are governed by this project, released under Apache-2.0, and are in scope for the same licence, security, release and maintainership expectations as the main repository.
+
+| Sub-project | What it contributes to the distribution | Status | Owners |
+|---|---|---|---|
+| [etcd-operator](https://github.com/cozystack/etcd-operator) | Operator image, CRDs and the `etcd-migrate` tool, for etcd clusters backing tenant control planes | Stable | @lllamnyp, @androndo, @sircthulhu |
+| [cozy-proxy](https://github.com/cozystack/cozy-proxy) | kube-proxy addon for 1:1 NAT services, with an NFT backend; chart vendored into the platform | Stable | @kvaps, @mattia-eleuteri |
+| [keycloak-kms-proxy](https://github.com/cozystack/keycloak-kms-proxy) | PostgreSQL wire-protocol proxy that encrypts Keycloak PII columns, keeping the key in a KMS outside the database | Stable | @sircthulhu, @kvaps |
+| [local-ccm](https://github.com/cozystack/local-ccm) | Cloud-controller manager for bare-metal clusters; chart and image | Stable | @kvaps, @IvanHunters |
+| [cozystack-scheduler](https://github.com/cozystack/cozystack-scheduler) | kube-scheduler extension with SchedulingClass-aware placement; also a compiled dependency of the main repository | Stable | @lllamnyp |
+| [ingress-nginx-with-protobuf-exporter](https://github.com/cozystack/ingress-nginx-with-protobuf-exporter) | Ingress-NGINX controller build carrying the protobuf metrics exporter | Stable | @kvaps |
+
+The Cozystack maintainers are maintainers of every sub-project by default (see [MAINTAINERS.md](./MAINTAINERS.md)). The owners named above are the people whose review is requested on changes in each repository; the same lists are recorded in each repository's `CODEOWNERS`.
+
+**Independent tooling** is governed by this project but is not part of the distribution — an adopter installs Cozystack without it, and chooses these separately: [talm](https://github.com/cozystack/talm) (managing Talos Linux the GitOps way), [cozyhr](https://github.com/cozystack/cozyhr) (a Helm and Flux CD wrapper for local development), [cozyvalues-gen](https://github.com/cozystack/cozyvalues-gen) (schema and README generation for Helm charts), [terraform-provider-cozystack](https://github.com/cozystack/terraform-provider-cozystack), [ansible-cozystack](https://github.com/cozystack/ansible-cozystack), [boot-to-talos](https://github.com/cozystack/boot-to-talos), [talos-bootstrap](https://github.com/cozystack/talos-bootstrap), [talos-meta-tool](https://github.com/cozystack/talos-meta-tool) and [blockstor](https://github.com/cozystack/blockstor) (a software-defined storage system, developed independently of the platform).
+
+**Project infrastructure** carries no shipped code: [website](https://github.com/cozystack/website), [community](https://github.com/cozystack/community) (design proposals and meeting notes), [external-apps-example](https://github.com/cozystack/external-apps-example) (the reference third-party application catalogues are built from), [ccp](https://github.com/cozystack/ccp), [.github](https://github.com/cozystack/.github) and [.project](https://github.com/cozystack/.project) (CNCF project metadata).
+
+**Forks of upstream projects** are held for contributing changes back, or were held for that purpose and have since been archived. One is load-bearing and is called out below; the rest are not built into the distribution, which takes those components from their upstreams directly.
+
+Three things about this organisation are worth stating plainly rather than leaving to be discovered.
+
+**One fork is compiled into the product.** [cozystack/apimachinery](https://github.com/cozystack/apimachinery) is a fork of `kubernetes/apimachinery` carrying a single 34-line patch to `pkg/runtime/scheme.go` on top of the released `v0.35.0` tree, applied through a `replace` directive in `go.mod`. The same fix is proposed upstream as [kubernetes/kubernetes#135537](https://github.com/kubernetes/kubernetes/pull/135537); the fork exists only until that merges, and is pinned to a branch tracking the upstream release rather than to the fork's own trunk.
+
+**Four repositories are private**, and none of them contributes to the distribution: `security-scanner` (automated CVE monitoring, private because it holds pre-disclosure vulnerability state), `infrastructure` (the organisation's own CI infrastructure-as-code, private because it holds cloud credentials and account topology), one GitHub-created security-advisory workspace, and `talos-preboot-iso`, an archived prototype. Nothing an adopter installs is built from a repository they cannot read.
+
+**Telemetry is received by a component adopters do not install.** [cozystack-telemetry-server](https://github.com/cozystack/cozystack-telemetry-server) runs as project infrastructure, but clusters report to it by default, so it is named here rather than omitted as out-of-scope. What is collected, why, and how to turn it off is documented on the [Telemetry](https://cozystack.io/docs/operations/configuration/telemetry/) page.
+
+## Third-party Dependencies
+
+Cozystack packages and ships software it does not govern. Such components remain
+under their upstream owner's namespace, are vendored by digest, and are neither
+released by this project nor mirrored under `ghcr.io/cozystack`.
+
+They are enumerated, with their licences, on the
+[Licenses](https://cozystack.io/docs/v1.6/operations/configuration/licenses/)
+page. That page lists upstreams only: what this project maintains is Apache-2.0
+and is not listed there individually.
 
 ## Community Roles