diff --git a/.github/workflows/copybara_pixie_oss.yaml b/.github/workflows/copybara_pixie_oss.yaml
index 5fe7ad9183c..29df21d186c 100644
--- a/.github/workflows/copybara_pixie_oss.yaml
+++ b/.github/workflows/copybara_pixie_oss.yaml
@@ -26,4 +26,4 @@ jobs:
       # This is only needed for the first copybara run (supplied via --last-rev ${sha} flag)
       run: >
         GIT_SSH_COMMAND='ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i /tmp/sshkey'
-        ./ci/run_copybara.sh tools/copybara/upstream_sync/copy.bara.sky
+        ./ci/private/run_copybara.sh tools/private/copybara/copy.bara.sky
diff --git a/ci/run_copybara.sh b/ci/private/run_copybara.sh
similarity index 100%
rename from ci/run_copybara.sh
rename to ci/private/run_copybara.sh
diff --git a/tools/copybara/upstream_sync/copy.bara.sky b/tools/private/copybara/copy.bara.sky
similarity index 99%
rename from tools/copybara/upstream_sync/copy.bara.sky
rename to tools/private/copybara/copy.bara.sky
index c0267db09a1..21e59869d1c 100644
--- a/tools/copybara/upstream_sync/copy.bara.sky
+++ b/tools/private/copybara/copy.bara.sky
@@ -96,7 +96,6 @@ ignored_dirs = [
     "src/api/go/pxapi/vizier.go", # mutation support
     "src/vizier/services/query_broker/**", # mutation and clickhouse changes to upstream
     "src/pixie_cli/BUILD.bazel", # fork customizations, see if this can be parameterized
-    "tools/**",
     "WORKSPACE", # upstream misspelling
 ]
 
@@ -107,13 +106,14 @@ fork_only_files = [
     ".github/workflows/perf_soc_attack.yaml",
     "PLATFORM.md",
     "bazel/external/rules_docker_pusher_cfg.patch",
-    "ci/run_copybara.sh",
+    "ci/private/**",
     "k8s/vizier/bootstrap/adaptive_export_*",
     "k8s/vizier/bootstrap/kustomization.yaml",
     "src/carnot/planner/ir/clickhouse_*",
     "src/vizier/services/adaptive_export/**",
     "src/vizier/services/metadata/local/**",
     "tools/licenses/BUILD.bazel",
+    "tools/private/**",
 ]
 
 core.workflow(