diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 4685948..bd53855 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -98,7 +98,6 @@
                      --known-failure controller/ExamplePersistentStorage.cpp \
                      --known-failure controller/ExamplePersistentStorage.h \
                      --known-failure app/AttributeAccessToken.h \
-                     --known-failure app/CommandHandler.h \
                      --known-failure app/CommandHandlerInterface.h \
                      --known-failure app/CommandResponseSender.h \
                      --known-failure app/CommandSenderLegacyCallback.h \
diff --git a/src/app/BUILD.gn b/src/app/BUILD.gn
index 4bb4a05..f49a40f 100644
--- a/src/app/BUILD.gn
+++ b/src/app/BUILD.gn
@@ -179,9 +179,6 @@
     "ReadClient.h",  # TODO: cpp is only included conditionally. Needs logic
                      # fixing
     "ReadPrepareParams.h",
-    "RequiredPrivilege.h",
-    "StatusResponse.cpp",
-    "StatusResponse.h",
     "SubscriptionResumptionStorage.h",
     "TimedHandler.cpp",
     "TimedHandler.h",
@@ -210,6 +207,7 @@
 
   public_deps = [
     ":app_config",
+    ":command-handler",
     ":constants",
     ":paths",
     ":subscription-info-provider",
@@ -248,8 +246,6 @@
       "dynamic_server/AccessControl.cpp",
       "dynamic_server/AccessControl.h",
       "dynamic_server/DynamicDispatcher.cpp",
-      "util/privilege-storage.cpp",
-      "util/privilege-storage.h",
     ]
 
     public_deps += [
@@ -301,6 +297,62 @@
   ]
 }
 
+source_set("required-privileges") {
+  sources = [ "RequiredPrivilege.h" ]
+
+  public_deps = [
+    ":paths",
+    "${chip_root}/src/access:types",
+  ]
+
+  if (chip_build_controller_dynamic_server) {
+    sources += [
+      "util/privilege-storage.cpp",
+      "util/privilege-storage.h",
+    ]
+
+    public_deps += [
+      ":global-attributes",
+      "${chip_root}/src/access",
+      "${chip_root}/src/app/dynamic_server:mock-codegen-includes",
+    ]
+
+    public_configs = [ ":config-controller-dynamic-server" ]
+  }
+}
+
+source_set("status-response") {
+  sources = [
+    "StatusResponse.cpp",
+    "StatusResponse.h",
+  ]
+  public_deps = [
+    ":constants",
+    "${chip_root}/src/app/MessageDef",
+    "${chip_root}/src/messaging",
+  ]
+}
+
+source_set("command-handler") {
+  sources = [
+    "CommandHandler.cpp",
+    "CommandHandler.h",
+    "CommandHandlerExchangeInterface.h",
+  ]
+
+  public_deps = [
+    ":paths",
+    ":required-privileges",
+    ":status-response",
+    "${chip_root}/src/access:types",
+    "${chip_root}/src/app/MessageDef",
+    "${chip_root}/src/app/data-model",
+    "${chip_root}/src/app/util:callbacks",
+    "${chip_root}/src/lib/support",
+    "${chip_root}/src/messaging",
+  ]
+}
+
 # Note to developpers, instead of continuously adding files in the app librabry, it is recommand to create smaller source_sets that app can depend on.
 # This way, we can have a better understanding of dependencies and other componenets can depend on the different source_sets without needing to depend on the entire app library.
 static_library("app") {
@@ -312,8 +364,6 @@
     "AttributePersistenceProvider.h",
     "ChunkedWriteCallback.cpp",
     "ChunkedWriteCallback.h",
-    "CommandHandler.cpp",
-    "CommandHandlerExchangeInterface.h",
     "CommandResponseHelper.h",
     "CommandResponseSender.cpp",
     "DefaultAttributePersistenceProvider.cpp",
@@ -338,7 +388,6 @@
     #       (app depending on im and im including these headers):
     #       Name with _ so that linter does not recognize it
     # "CommandResponseSender._h"
-    # "CommandHandler._h"
     # "ReadHandler._h",
     # "WriteHandler._h"
   ]
diff --git a/src/app/CommandHandler.cpp b/src/app/CommandHandler.cpp
index 86ef22a..6077e09 100644
--- a/src/app/CommandHandler.cpp
+++ b/src/app/CommandHandler.cpp
@@ -15,21 +15,12 @@
  *    See the License for the specific language governing permissions and
  *    limitations under the License.
  */
-
-/**
- *    @file
- *      This file defines object for a CHIP IM Invoke Command Handler
- *
- */
-
-#include "CommandHandler.h"
-#include "InteractionModelEngine.h"
-#include "RequiredPrivilege.h"
-#include "messaging/ExchangeContext.h"
+#include <app/CommandHandler.h>
 
 #include <access/AccessControl.h>
 #include <app-common/zap-generated/cluster-objects.h>
 #include <app/RequiredPrivilege.h>
+#include <app/StatusResponse.h>
 #include <app/util/MatterCallbacks.h>
 #include <credentials/GroupDataProvider.h>
 #include <lib/core/CHIPConfig.h>
@@ -37,6 +28,7 @@
 #include <lib/core/TLVUtilities.h>
 #include <lib/support/IntrusiveList.h>
 #include <lib/support/TypeTraits.h>
+#include <messaging/ExchangeContext.h>
 #include <platform/LockTracker.h>
 #include <protocols/secure_channel/Constants.h>
 
diff --git a/src/app/CommandHandler.h b/src/app/CommandHandler.h
index 96b7af8..b06064c 100644
--- a/src/app/CommandHandler.h
+++ b/src/app/CommandHandler.h
@@ -30,9 +30,8 @@
 
 #pragma once
 
-#include "CommandPathRegistry.h"
-
 #include <app/CommandHandlerExchangeInterface.h>
+#include <app/CommandPathRegistry.h>
 #include <app/ConcreteCommandPath.h>
 #include <app/data-model/Encode.h>
 #include <lib/core/CHIPCore.h>