diff --git a/containers/adguard/tools/adguard.tools.json b/containers/adguard/tools/adguard.tools.json
new file mode 100644
index 0000000..9851c91
--- /dev/null
+++ b/containers/adguard/tools/adguard.tools.json
@@ -0,0 +1,20 @@
+{
+  "tools": [
+    {
+      "id":          "reset_password",
+      "label":       "Reset Admin Password",
+      "description": "Reset the AdGuard Home admin password. Leave the field blank to generate a random one — the new password is saved to the config so you can see it after.",
+      "icon":        "🔑",
+      "fields": [
+        { "name": "password", "label": "New password (leave blank to generate)", "type": "password", "placeholder": "Leave blank for random" }
+      ]
+    },
+    {
+      "id":          "apply_dns_updater",
+      "label":       "Apply DNS Updater",
+      "description": "Rewrite this server's /etc/resolv.conf to use AdGuard as its DNS resolver right now. Same action that runs automatically when the global DNS Updater requirement is enabled.",
+      "icon":        "🌐",
+      "fields":      []
+    }
+  ]
+}
diff --git a/scripts/app/containers/adguard/adguard_apply_dns_updater.sh b/containers/adguard/tools/adguard_apply_dns_updater.sh
similarity index 100%
rename from scripts/app/containers/adguard/adguard_apply_dns_updater.sh
rename to containers/adguard/tools/adguard_apply_dns_updater.sh
diff --git a/scripts/app/containers/adguard/adguard_reset_password.sh b/containers/adguard/tools/adguard_reset_password.sh
similarity index 100%
rename from scripts/app/containers/adguard/adguard_reset_password.sh
rename to containers/adguard/tools/adguard_reset_password.sh
diff --git a/scripts/source/files/arrays/files_app.sh b/scripts/source/files/arrays/files_app.sh
index 86c143b..721b159 100755
--- a/scripts/source/files/arrays/files_app.sh
+++ b/scripts/source/files/arrays/files_app.sh
@@ -10,9 +10,7 @@ app_scripts=(
     "app/app_status.sh"
     "app/app_update_specifics.sh"
     "app/auth_adapter.sh"
-    "app/containers/adguard/adguard_apply_dns_updater.sh"
     "app/containers/adguard/adguard_auth.sh"
-    "app/containers/adguard/adguard_reset_password.sh"
     "app/containers/bookstack/bookstack_auth.sh"
     "app/containers/bookstack/bookstack_create_account.sh"
     "app/containers/bookstack/bookstack_delete_user.sh"
diff --git a/scripts/webui/data/generators/apps/webui_tools.sh b/scripts/webui/data/generators/apps/webui_tools.sh
index 1769d71..e40d4ab 100644
--- a/scripts/webui/data/generators/apps/webui_tools.sh
+++ b/scripts/webui/data/generators/apps/webui_tools.sh
@@ -54,26 +54,6 @@ webuiGenerateAppsToolsConfig() {
     cat > "$tmp" <<'JSON'
 {
   "apps": {
-    "adguard": {
-      "tools": [
-        {
-          "id":          "reset_password",
-          "label":       "Reset Admin Password",
-          "description": "Reset the AdGuard Home admin password. Leave the field blank to generate a random one — the new password is saved to the config so you can see it after.",
-          "icon":        "🔑",
-          "fields": [
-            { "name": "password", "label": "New password (leave blank to generate)", "type": "password", "placeholder": "Leave blank for random" }
-          ]
-        },
-        {
-          "id":          "apply_dns_updater",
-          "label":       "Apply DNS Updater",
-          "description": "Rewrite this server's /etc/resolv.conf to use AdGuard as its DNS resolver right now. Same action that runs automatically when the global DNS Updater requirement is enabled.",
-          "icon":        "🌐",
-          "fields":      []
-        }
-      ]
-    },
     "pihole": {
       "tools": [
         {
@@ -420,9 +400,9 @@ JSON
     # it sets .apps[<app>]. Core apps declared in the heredoc need no such file.
     if command -v jq >/dev/null 2>&1; then
         local _tj _app
-        for _tj in "${install_containers_dir}"*/*.tools.json; do
+        for _tj in "${install_containers_dir}"*/tools/*.tools.json; do
             [[ -f "$_tj" ]] || continue
-            _app="$(basename "$(dirname "$_tj")")"
+            _app="$(basename "$(dirname "$(dirname "$_tj")")")"   # …/<app>/tools/<x>.tools.json
             if jq -e . "$_tj" >/dev/null 2>&1; then
                 jq --arg app "$_app" --slurpfile t "$_tj" '.apps[$app] = $t[0]' "$tmp" > "$tmp.m" && mv "$tmp.m" "$tmp"
             else