diff --git a/internal/service/auth_service.go b/internal/service/auth_service.go
index c75285c3..fa6d19bb 100644
--- a/internal/service/auth_service.go
+++ b/internal/service/auth_service.go
@@ -15,6 +15,7 @@ import (
 	"github.com/tinyauthapp/tinyauth/internal/repository"
 	"github.com/tinyauthapp/tinyauth/internal/utils"
 	"github.com/tinyauthapp/tinyauth/internal/utils/logger"
+	"github.com/tinyauthapp/tinyauth/pkg/cache"
 	"go.uber.org/dig"
 
 	"github.com/google/uuid"
@@ -71,9 +72,9 @@ type AuthService struct {
 	dummyHash string
 
 	caches struct {
-		login *CacheStore[LoginAttempt]
-		oauth *CacheStore[OAuthPendingSession]
-		ldap  *CacheStore[[]string]
+		login *cache.CacheStore[LoginAttempt]
+		oauth *cache.CacheStore[OAuthPendingSession]
+		ldap  *cache.CacheStore[[]string]
 	}
 }
 
@@ -115,9 +116,9 @@ func NewAuthService(i AuthServiceInput) (*AuthService, error) {
 	service.dummyHash = string(dummyHash)
 
 	// caches setup
-	oauthCache := NewCacheStore[OAuthPendingSession](256)
-	loginCache := NewCacheStore[LoginAttempt](service.calculateLockdownLimit())
-	ldapCache := NewCacheStore[[]string](1024)
+	oauthCache := cache.NewCacheStore[OAuthPendingSession](256)
+	loginCache := cache.NewCacheStore[LoginAttempt](service.calculateLockdownLimit())
+	ldapCache := cache.NewCacheStore[[]string](1024)
 
 	service.caches.oauth = oauthCache
 	service.caches.login = loginCache
@@ -279,7 +280,7 @@ func (auth *AuthService) RecordLoginAttempt(identifier string, success bool) {
 		return
 	}
 
-	auth.caches.login.WithLock(func(actions CacheStoreActions[LoginAttempt]) {
+	auth.caches.login.WithLock(func(actions cache.CacheStoreActions[LoginAttempt]) {
 		entry, ok := actions.Get(identifier)
 
 		if !ok {
diff --git a/internal/service/oidc_service.go b/internal/service/oidc_service.go
index a3a02400..a95b6bc5 100644
--- a/internal/service/oidc_service.go
+++ b/internal/service/oidc_service.go
@@ -27,6 +27,7 @@ import (
 	"github.com/tinyauthapp/tinyauth/internal/repository"
 	"github.com/tinyauthapp/tinyauth/internal/utils"
 	"github.com/tinyauthapp/tinyauth/internal/utils/logger"
+	"github.com/tinyauthapp/tinyauth/pkg/cache"
 	"go.uber.org/dig"
 )
 
@@ -158,9 +159,9 @@ type OIDCService struct {
 	issuer     string
 
 	caches struct {
-		code      *CacheStore[AuthorizeCodeEntry]
-		usedCode  *CacheStore[UsedCodeEntry]
-		authorize *CacheStore[AuthorizeRequest]
+		code      *cache.CacheStore[AuthorizeCodeEntry]
+		usedCode  *cache.CacheStore[UsedCodeEntry]
+		authorize *cache.CacheStore[AuthorizeRequest]
 	}
 }
 
@@ -339,11 +340,11 @@ func NewOIDCService(i OIDCServiceInput) (*OIDCService, error) {
 	i.Ding.Go(service.cleanupRoutine, ding.RingMinor)
 
 	// Create caches
-	codeCash := NewCacheStore[AuthorizeCodeEntry](256)
-	usedCode := NewCacheStore[UsedCodeEntry](256)
-	authorize := NewCacheStore[AuthorizeRequest](256)
+	codeCache := cache.NewCacheStore[AuthorizeCodeEntry](256)
+	usedCode := cache.NewCacheStore[UsedCodeEntry](256)
+	authorize := cache.NewCacheStore[AuthorizeRequest](256)
 
-	service.caches.code = codeCash
+	service.caches.code = codeCache
 	service.caches.usedCode = usedCode
 	service.caches.authorize = authorize
 
@@ -503,7 +504,7 @@ func (service *OIDCService) GetCodeEntry(codeHash string, clientId string) (*Aut
 	var entry AuthorizeCodeEntry
 	var ok bool
 
-	service.caches.code.WithLock(func(actions CacheStoreActions[AuthorizeCodeEntry]) {
+	service.caches.code.WithLock(func(actions cache.CacheStoreActions[AuthorizeCodeEntry]) {
 		entry, ok = actions.Get(codeHash)
 
 		if !ok {
diff --git a/internal/service/tailscale_service.go b/internal/service/tailscale_service.go
index 53cb46b0..68700ac6 100644
--- a/internal/service/tailscale_service.go
+++ b/internal/service/tailscale_service.go
@@ -10,6 +10,7 @@ import (
 	"github.com/tinyauthapp/tinyauth/internal/model"
 	"github.com/tinyauthapp/tinyauth/internal/utils"
 	"github.com/tinyauthapp/tinyauth/internal/utils/logger"
+	"github.com/tinyauthapp/tinyauth/pkg/cache"
 	"go.uber.org/dig"
 )
 
@@ -59,8 +60,8 @@ type TailscaleService struct {
 	apiToken string
 
 	caches struct {
-		devices *CacheStore[tailscaleAPIDevices]
-		users   *CacheStore[tailscaleAPIUsers]
+		devices *cache.CacheStore[tailscaleAPIDevices]
+		users   *cache.CacheStore[tailscaleAPIUsers]
 	}
 
 	urls struct {
@@ -100,8 +101,8 @@ func NewTailscaleService(i TailscaleServiceInput) (*TailscaleService, error) {
 		apiToken: apiToken,
 	}
 
-	devicesCache := NewCacheStore[tailscaleAPIDevices](0)
-	usersCache := NewCacheStore[tailscaleAPIUsers](0)
+	devicesCache := cache.NewCacheStore[tailscaleAPIDevices](0)
+	usersCache := cache.NewCacheStore[tailscaleAPIUsers](0)
 
 	s.caches.devices = devicesCache
 	s.caches.users = usersCache
diff --git a/internal/service/cache_store.go b/pkg/cache/cache_store.go
similarity index 97%
rename from internal/service/cache_store.go
rename to pkg/cache/cache_store.go
index 06e230ee..a23ca8ec 100644
--- a/internal/service/cache_store.go
+++ b/pkg/cache/cache_store.go
@@ -1,4 +1,4 @@
-package service
+package cache
 
 import (
 	"slices"
@@ -33,8 +33,8 @@ func NewCacheStore[T any](maxSize int) *CacheStore[T] {
 	}
 }
 
-// With lock allows performing multiple operations on the cache store atomically.
-// The provided mutate function receives a set of actions (Set, Get, Delete) that
+// WithLock allows performing multiple operations on a single lock.
+// The provided mutate function receives a set of actions (Set, Get, Delete, Update) that
 // can be used to manipulate the cache store within the locked context.
 func (cs *CacheStore[T]) WithLock(mutate func(actions CacheStoreActions[T])) {
 	cs.mu.Lock()
diff --git a/internal/service/cache_store_test.go b/pkg/cache/cache_store_test.go
similarity index 99%
rename from internal/service/cache_store_test.go
rename to pkg/cache/cache_store_test.go
index 780f9800..71e37bc8 100644
--- a/internal/service/cache_store_test.go
+++ b/pkg/cache/cache_store_test.go
@@ -1,4 +1,4 @@
-package service
+package cache
 
 import (
 	"strconv"