diff --git a/src/analyze/analyze-condition.c b/src/analyze/analyze-condition.c
index 111f24f8d9..f96a8c2b40 100644
--- a/src/analyze/analyze-condition.c
+++ b/src/analyze/analyze-condition.c
@@ -61,7 +61,6 @@ static int parse_condition(Unit *u, const char *line) {
 _printf_(7, 8)
 static int log_helper(void *userdata, int level, int error, const char *file, int line, const char *func, const char *format, ...) {
         Unit *u = ASSERT_PTR(userdata);
-        Manager *m = ASSERT_PTR(u->manager);
         va_list ap;
         int r;
 
@@ -70,7 +69,7 @@ static int log_helper(void *userdata, int level, int error, const char *file, in
 
         va_start(ap, format);
         r = log_object_internalv(level, error, file, line, func,
-                                 /* object_field = */ m->unit_log_field,
+                                 /* object_field = */ unit_log_field(u),
                                  /* object = */ u->id,
                                  /* extra_field = */ NULL,
                                  /* extra = */ NULL,
diff --git a/src/analyze/analyze-image-policy.c b/src/analyze/analyze-image-policy.c
index df4f62f6b8..d18200a062 100644
--- a/src/analyze/analyze-image-policy.c
+++ b/src/analyze/analyze-image-policy.c
@@ -3,6 +3,7 @@
 #include "analyze-image-policy.h"
 #include "analyze.h"
 #include "format-table.h"
+#include "image-policy.h"
 #include "terminal-util.h"
 
 static int table_add_designator_line(Table *table, PartitionDesignator d, PartitionPolicyFlags f) {
diff --git a/src/analyze/analyze.c b/src/analyze/analyze.c
index d1619dbb63..03abbc241d 100644
--- a/src/analyze/analyze.c
+++ b/src/analyze/analyze.c
@@ -65,6 +65,7 @@
 #include "format-table.h"
 #include "glob-util.h"
 #include "hashmap.h"
+#include "image-policy.h"
 #include "locale-util.h"
 #include "log.h"
 #include "main-func.h"
diff --git a/src/basic/iovec-wrapper.h b/src/basic/iovec-wrapper.h
index 4778fa6b27..f45dd87b7e 100644
--- a/src/basic/iovec-wrapper.h
+++ b/src/basic/iovec-wrapper.h
@@ -5,6 +5,7 @@
 #include <sys/uio.h>
 
 #include "macro.h"
+#include "memory-util.h"
 
 struct iovec_wrapper {
         struct iovec *iovec;
diff --git a/src/basic/missing_audit.h b/src/basic/missing_audit.h
index e14599ebe6..3aaec1ee24 100644
--- a/src/basic/missing_audit.h
+++ b/src/basic/missing_audit.h
@@ -7,20 +7,25 @@
 #  include <libaudit.h>
 #endif
 
+/* We use _Static_assert() directly here instead of assert_cc()
+ * because if we include macro.h in this header, the invocation
+ * of generate-audit_type-list.sh becomes more complex.
+ */
+
 #ifndef AUDIT_SERVICE_START
 #  define AUDIT_SERVICE_START 1130 /* Service (daemon) start */
 #else
-assert_cc(AUDIT_SERVICE_START == 1130);
+_Static_assert(AUDIT_SERVICE_START == 1130, "");
 #endif
 
 #ifndef AUDIT_SERVICE_STOP
 #  define AUDIT_SERVICE_STOP 1131 /* Service (daemon) stop */
 #else
-assert_cc(AUDIT_SERVICE_STOP == 1131);
+_Static_assert(AUDIT_SERVICE_STOP == 1131, "");
 #endif
 
 #ifndef MAX_AUDIT_MESSAGE_LENGTH
 #  define MAX_AUDIT_MESSAGE_LENGTH 8970
 #else
-assert_cc(MAX_AUDIT_MESSAGE_LENGTH == 8970);
+_Static_assert(MAX_AUDIT_MESSAGE_LENGTH == 8970, "");
 #endif
diff --git a/src/basic/missing_xfs.h b/src/basic/missing_xfs.h
index ba5fe81288..67c4cefb87 100644
--- a/src/basic/missing_xfs.h
+++ b/src/basic/missing_xfs.h
@@ -1,6 +1,8 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
+#include <stdint.h>
+
 /* This is currently not exported in the public kernel headers, but the libxfs library code part of xfsprogs
  * defines it as public header */
 
diff --git a/src/basic/pcapng.h b/src/basic/pcapng.h
index 57c3af501a..28ad076877 100644
--- a/src/basic/pcapng.h
+++ b/src/basic/pcapng.h
@@ -1,6 +1,8 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
+#include <stdint.h>
+
 /*
  * For details about the file format see RFC:
  *   https://www.ietf.org/id/draft-tuexen-opsawg-pcapng-03.html
diff --git a/src/basic/pthread-util.h b/src/basic/pthread-util.h
index 113485d044..4707f5503a 100644
--- a/src/basic/pthread-util.h
+++ b/src/basic/pthread-util.h
@@ -3,7 +3,7 @@
 
 #include <pthread.h>
 
-#include "macro.h"
+#include "assert-util.h"
 
 static inline pthread_mutex_t* pthread_mutex_lock_assert(pthread_mutex_t *mutex) {
         assert_se(pthread_mutex_lock(mutex) == 0);
diff --git a/src/basic/raw-reboot.h b/src/basic/raw-reboot.h
index e6bff300a5..d72ae1e955 100644
--- a/src/basic/raw-reboot.h
+++ b/src/basic/raw-reboot.h
@@ -4,6 +4,7 @@
 #include <linux/reboot.h>
 #include <sys/reboot.h>
 #include <sys/syscall.h>
+#include <unistd.h>
 
 /* glibc defines the reboot() API call, which is a wrapper around the system call of the same name, but without the
  * extra "arg" parameter. Since we need that parameter for some calls, let's add a "raw" wrapper that is defined the
diff --git a/src/basic/strbuf.h b/src/basic/strbuf.h
index 405b34717e..143e39f0f0 100644
--- a/src/basic/strbuf.h
+++ b/src/basic/strbuf.h
@@ -5,7 +5,7 @@
 #include <stdint.h>
 #include <sys/types.h>
 
-#include "macro.h"
+#include "memory-util.h"
 
 struct strbuf {
         char *buf;
diff --git a/src/basic/sysctl-util.h b/src/basic/sysctl-util.h
index bbfc4ce1ea..f3ae6fe7cf 100644
--- a/src/basic/sysctl-util.h
+++ b/src/basic/sysctl-util.h
@@ -4,6 +4,7 @@
 #include <stdbool.h>
 #include <stdint.h>
 
+#include "hashmap.h"
 #include "macro.h"
 #include "stdio-util.h"
 #include "string-util.h"
diff --git a/src/basic/uid-classification.h b/src/basic/uid-classification.h
index 2d76be5f04..c60daf5dcc 100644
--- a/src/basic/uid-classification.h
+++ b/src/basic/uid-classification.h
@@ -4,6 +4,8 @@
 #include <stdbool.h>
 #include <sys/types.h>
 
+#include "macro.h"
+
 /* The container base should have the last 16 bit set to zero */
 assert_cc((CONTAINER_UID_BASE_MIN & 0xFFFFU) == 0);
 assert_cc((CONTAINER_UID_BASE_MAX & 0xFFFFU) == 0);
diff --git a/src/basic/uid-range.h b/src/basic/uid-range.h
index 21e5c7a17b..197085a60b 100644
--- a/src/basic/uid-range.h
+++ b/src/basic/uid-range.h
@@ -4,7 +4,7 @@
 #include <stdbool.h>
 #include <sys/types.h>
 
-#include "macro.h"
+#include "memory-util.h"
 
 typedef struct UIDRangeEntry {
         uid_t start, nr;
diff --git a/src/boot/url-discovery.h b/src/boot/url-discovery.h
index e4e50c387c..aed48b432c 100644
--- a/src/boot/url-discovery.h
+++ b/src/boot/url-discovery.h
@@ -1,4 +1,6 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
+#include "efi.h"
+
 char16_t *disk_get_url(EFI_HANDLE *handle);
diff --git a/src/core/all-units.h b/src/core/all-units.h
index fad814bf20..cb2563d2c8 100644
--- a/src/core/all-units.h
+++ b/src/core/all-units.h
@@ -5,6 +5,7 @@
 
 #include "automount.h"
 #include "device.h"
+#include "mount.h"
 #include "path.h"
 #include "scope.h"
 #include "service.h"
diff --git a/src/core/automount.c b/src/core/automount.c
index b4611981f2..ef5db87a7e 100644
--- a/src/core/automount.c
+++ b/src/core/automount.c
@@ -22,6 +22,7 @@
 #include "io-util.h"
 #include "label-util.h"
 #include "mkdir-label.h"
+#include "manager.h"
 #include "mount-util.h"
 #include "mount.h"
 #include "mountpoint-util.h"
diff --git a/src/core/automount.h b/src/core/automount.h
index e413f237ca..6f2ca7657b 100644
--- a/src/core/automount.h
+++ b/src/core/automount.h
@@ -1,8 +1,6 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-typedef struct Automount Automount;
-
 #include "unit.h"
 
 typedef enum AutomountResult {
@@ -15,7 +13,7 @@ typedef enum AutomountResult {
         _AUTOMOUNT_RESULT_INVALID = -EINVAL,
 } AutomountResult;
 
-struct Automount {
+typedef struct Automount {
         Unit meta;
 
         AutomountState state, deserialized_state;
@@ -35,7 +33,7 @@ struct Automount {
         sd_event_source *expire_event_source;
 
         AutomountResult result;
-};
+} Automount;
 
 extern const UnitVTable automount_vtable;
 
diff --git a/src/core/bpf-firewall.c b/src/core/bpf-firewall.c
index 69000c1389..85fce6f32a 100644
--- a/src/core/bpf-firewall.c
+++ b/src/core/bpf-firewall.c
@@ -20,6 +20,7 @@
 #include "bpf-program.h"
 #include "fd-util.h"
 #include "in-addr-prefix-util.h"
+#include "manager.h"
 #include "memory-util.h"
 #include "missing_syscall.h"
 #include "unit.h"
diff --git a/src/core/bpf-restrict-ifaces.c b/src/core/bpf-restrict-ifaces.c
index af49abd677..a9066ee2a9 100644
--- a/src/core/bpf-restrict-ifaces.c
+++ b/src/core/bpf-restrict-ifaces.c
@@ -3,6 +3,7 @@
 #include "fd-util.h"
 #include "bpf-restrict-ifaces.h"
 #include "netlink-util.h"
+#include "unit.h"
 
 #if BPF_FRAMEWORK
 /* libbpf, clang and llc compile time dependencies are satisfied */
diff --git a/src/core/bpf-restrict-ifaces.h b/src/core/bpf-restrict-ifaces.h
index 28f74279f5..80af1f3e5b 100644
--- a/src/core/bpf-restrict-ifaces.h
+++ b/src/core/bpf-restrict-ifaces.h
@@ -2,7 +2,6 @@
 #pragma once
 
 #include "fdset.h"
-#include "unit.h"
 
 typedef struct Unit Unit;
 
diff --git a/src/core/bpf-socket-bind.c b/src/core/bpf-socket-bind.c
index 8853f3eecc..437b084392 100644
--- a/src/core/bpf-socket-bind.c
+++ b/src/core/bpf-socket-bind.c
@@ -6,6 +6,7 @@
 
 #include "fd-util.h"
 #include "bpf-socket-bind.h"
+#include "unit.h"
 
 #if BPF_FRAMEWORK
 /* libbpf, clang, llvm and bpftool compile time dependencies are satisfied */
diff --git a/src/core/bpf-socket-bind.h b/src/core/bpf-socket-bind.h
index 28b25f6872..13a0fc1521 100644
--- a/src/core/bpf-socket-bind.h
+++ b/src/core/bpf-socket-bind.h
@@ -2,7 +2,8 @@
 #pragma once
 
 #include "fdset.h"
-#include "unit.h"
+
+typedef struct Unit Unit;
 
 int bpf_socket_bind_supported(void);
 
diff --git a/src/core/cgroup.c b/src/core/cgroup.c
index 7e4f7efa5e..27d81b0b85 100644
--- a/src/core/cgroup.c
+++ b/src/core/cgroup.c
@@ -27,6 +27,7 @@
 #include "io-util.h"
 #include "ip-protocol-list.h"
 #include "limits-util.h"
+#include "manager.h"
 #include "nulstr-util.h"
 #include "parse-util.h"
 #include "path-util.h"
diff --git a/src/core/core-varlink.c b/src/core/core-varlink.c
index c5735d0eaa..0dee43c01b 100644
--- a/src/core/core-varlink.c
+++ b/src/core/core-varlink.c
@@ -3,9 +3,12 @@
 #include "sd-varlink.h"
 
 #include "core-varlink.h"
+#include "dynamic-user.h"
 #include "json-util.h"
+#include "manager.h"
 #include "mkdir-label.h"
 #include "strv.h"
+#include "unit.h"
 #include "user-util.h"
 #include "varlink-internal.h"
 #include "varlink-io.systemd.UserDatabase.h"
diff --git a/src/core/core-varlink.h b/src/core/core-varlink.h
index 4b77620028..e4996f01ad 100644
--- a/src/core/core-varlink.h
+++ b/src/core/core-varlink.h
@@ -1,7 +1,8 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include "manager.h"
+typedef struct Manager Manager;
+typedef struct Unit Unit;
 
 int manager_setup_varlink_server(Manager *m);
 
diff --git a/src/core/dbus-cgroup.c b/src/core/dbus-cgroup.c
index 882c916c10..09692a93ec 100644
--- a/src/core/dbus-cgroup.c
+++ b/src/core/dbus-cgroup.c
@@ -22,6 +22,7 @@
 #include "in-addr-prefix-util.h"
 #include "ip-protocol-list.h"
 #include "limits-util.h"
+#include "manager.h"
 #include "memstream-util.h"
 #include "parse-util.h"
 #include "path-util.h"
diff --git a/src/core/dbus-execute.c b/src/core/dbus-execute.c
index 2e1527811c..3953e775ec 100644
--- a/src/core/dbus-execute.c
+++ b/src/core/dbus-execute.c
@@ -22,6 +22,7 @@
 #include "fileio.h"
 #include "hexdecoct.h"
 #include "hostname-util.h"
+#include "image-policy.h"
 #include "ioprio-util.h"
 #include "iovec-util.h"
 #include "journal-file.h"
diff --git a/src/core/dbus-execute.h b/src/core/dbus-execute.h
index 4b7cb86d3e..4ad7dd27a9 100644
--- a/src/core/dbus-execute.h
+++ b/src/core/dbus-execute.h
@@ -5,6 +5,7 @@
 #include "sd-bus-vtable.h"
 
 #include "execute.h"
+#include "unit.h"
 
 #define BUS_EXEC_STATUS_VTABLE(prefix, offset, flags)                   \
         BUS_PROPERTY_DUAL_TIMESTAMP(prefix "StartTimestamp", (offset) + offsetof(ExecStatus, start_timestamp), flags), \
diff --git a/src/core/dbus-job.h b/src/core/dbus-job.h
index 6f005811cb..50957303de 100644
--- a/src/core/dbus-job.h
+++ b/src/core/dbus-job.h
@@ -3,9 +3,10 @@
 
 #include "sd-bus.h"
 
-#include "unit.h"
 #include "bus-object.h"
 
+typedef struct Job Job;
+
 extern const sd_bus_vtable bus_job_vtable[];
 extern const BusObjectImplementation job_object;
 
diff --git a/src/core/dbus-manager.c b/src/core/dbus-manager.c
index 6320e267a1..903f45d102 100644
--- a/src/core/dbus-manager.c
+++ b/src/core/dbus-manager.c
@@ -25,6 +25,7 @@
 #include "dbus-unit.h"
 #include "dbus-util.h"
 #include "dbus.h"
+#include "dynamic-user.h"
 #include "env-util.h"
 #include "fd-util.h"
 #include "fileio.h"
diff --git a/src/core/dbus-manager.h b/src/core/dbus-manager.h
index 9b050801a7..fcabca57c9 100644
--- a/src/core/dbus-manager.h
+++ b/src/core/dbus-manager.h
@@ -3,7 +3,9 @@
 
 #include "sd-bus-vtable.h"
 
-#include "manager.h"
+#include "time-util.h"
+
+typedef struct Manager Manager;
 
 extern const sd_bus_vtable bus_manager_vtable[];
 extern const sd_bus_vtable bus_manager_log_control_vtable[];
diff --git a/src/core/dbus-scope.h b/src/core/dbus-scope.h
index 8f1bc02e31..fb7467a0f5 100644
--- a/src/core/dbus-scope.h
+++ b/src/core/dbus-scope.h
@@ -4,9 +4,10 @@
 #include "sd-bus.h"
 #include "sd-bus-vtable.h"
 
-#include "scope.h"
 #include "unit.h"
 
+typedef struct Scope Scope;
+
 extern const sd_bus_vtable bus_scope_vtable[];
 
 int bus_scope_set_property(Unit *u, const char *name, sd_bus_message *i, UnitWriteFlags flags, sd_bus_error *error);
diff --git a/src/core/dbus-util.c b/src/core/dbus-util.c
index b44afc4258..e1a4cf0bdc 100644
--- a/src/core/dbus-util.c
+++ b/src/core/dbus-util.c
@@ -4,6 +4,7 @@
 #include "bus-util.h"
 #include "dbus-util.h"
 #include "escape.h"
+#include "manager.h"
 #include "parse-util.h"
 #include "path-util.h"
 #include "reboot-util.h"
diff --git a/src/core/dbus.h b/src/core/dbus.h
index bfd4c8ea4e..a362a652af 100644
--- a/src/core/dbus.h
+++ b/src/core/dbus.h
@@ -3,7 +3,9 @@
 
 #include "sd-bus.h"
 
-#include "manager.h"
+#include "fdset.h"
+
+typedef struct Manager Manager;
 
 void bus_send_pending_reload_message(Manager *m);
 
diff --git a/src/core/device.c b/src/core/device.c
index b6cdee73d4..08235caa42 100644
--- a/src/core/device.c
+++ b/src/core/device.c
@@ -13,6 +13,7 @@
 #include "device-util.h"
 #include "device.h"
 #include "log.h"
+#include "manager.h"
 #include "parse-util.h"
 #include "path-util.h"
 #include "ratelimit.h"
diff --git a/src/core/device.h b/src/core/device.h
index 631f45d45e..6f42cfa93a 100644
--- a/src/core/device.h
+++ b/src/core/device.h
@@ -3,8 +3,6 @@
 
 #include "unit.h"
 
-typedef struct Device Device;
-
 /* A mask specifying where we have seen the device currently. This is a bitmask because the device might show up
  * asynchronously from each other at various places. For example, in very common case a device might already be mounted
  * before udev finished probing it (think: a script setting up a loopback block device, formatting it and mounting it
@@ -17,7 +15,7 @@ typedef enum DeviceFound {
         _DEVICE_FOUND_MASK = DEVICE_FOUND_UDEV|DEVICE_FOUND_MOUNT|DEVICE_FOUND_SWAP,
 } DeviceFound;
 
-struct Device {
+typedef struct Device {
         Unit meta;
 
         char *sysfs, *deserialized_sysfs;
@@ -36,7 +34,7 @@ struct Device {
 
         /* The SYSTEMD_WANTS udev property for this device the last time we saw it */
         char **wants_property;
-};
+} Device;
 
 extern const UnitVTable device_vtable;
 
diff --git a/src/core/dynamic-user.c b/src/core/dynamic-user.c
index acfa1f52af..d21c709de7 100644
--- a/src/core/dynamic-user.c
+++ b/src/core/dynamic-user.c
@@ -12,6 +12,7 @@
 #include "fs-util.h"
 #include "iovec-util.h"
 #include "lock-util.h"
+#include "manager.h"
 #include "parse-util.h"
 #include "random-util.h"
 #include "serialize.h"
diff --git a/src/core/dynamic-user.h b/src/core/dynamic-user.h
index 303a7d081c..3e0074defb 100644
--- a/src/core/dynamic-user.h
+++ b/src/core/dynamic-user.h
@@ -1,7 +1,15 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
+#include <stdbool.h>
+#include <stdio.h>
+#include <sys/types.h>
+
+#include "fdset.h"
+#include "memory-util.h"
+
 typedef struct DynamicUser DynamicUser;
+typedef struct Manager Manager;
 
 typedef struct DynamicCreds {
         /* A combination of a dynamic user and group */
@@ -9,8 +17,6 @@ typedef struct DynamicCreds {
         DynamicUser *group;
 } DynamicCreds;
 
-#include "manager.h"
-
 /* Note that this object always allocates a pair of user and group under the same name, even if one of them isn't
  * used. This means, if you want to allocate a group and user pair, and they might have two different names, then you
  * need to allocated two of these objects. DynamicCreds below makes that easy. */
diff --git a/src/core/emergency-action.c b/src/core/emergency-action.c
index 2d756b306c..6752926bd9 100644
--- a/src/core/emergency-action.c
+++ b/src/core/emergency-action.c
@@ -6,6 +6,7 @@
 #include "bus-error.h"
 #include "bus-util.h"
 #include "emergency-action.h"
+#include "manager.h"
 #include "raw-reboot.h"
 #include "reboot-util.h"
 #include "special.h"
diff --git a/src/core/emergency-action.h b/src/core/emergency-action.h
index 5f7b0b4bc9..d0f1898a60 100644
--- a/src/core/emergency-action.h
+++ b/src/core/emergency-action.h
@@ -3,8 +3,11 @@
 
 #include <errno.h>
 
+#include "macro.h"
 #include "runtime-scope.h"
 
+typedef struct Manager Manager;
+
 typedef enum EmergencyAction {
         EMERGENCY_ACTION_NONE,
         EMERGENCY_ACTION_EXIT,
@@ -34,9 +37,6 @@ typedef enum EmergencyActionFlags {
         _EMERGENCY_ACTION_FLAGS_MAX  = (1 << 3) - 1,
 } EmergencyActionFlags;
 
-#include "macro.h"
-#include "manager.h"
-
 void emergency_action(
                 Manager *m,
                 EmergencyAction action,
diff --git a/src/core/exec-credential.c b/src/core/exec-credential.c
index 95ff1e45bb..bed7ff3672 100644
--- a/src/core/exec-credential.c
+++ b/src/core/exec-credential.c
@@ -11,6 +11,7 @@
 #include "io-util.h"
 #include "iovec-util.h"
 #include "label-util.h"
+#include "log.h"
 #include "mkdir-label.h"
 #include "mount-util.h"
 #include "mountpoint-util.h"
diff --git a/src/core/exec-invoke.c b/src/core/exec-invoke.c
index 7b283eb485..fcbd62744b 100644
--- a/src/core/exec-invoke.c
+++ b/src/core/exec-invoke.c
@@ -24,11 +24,13 @@
 #include "bpf-restrict-fs.h"
 #include "btrfs-util.h"
 #include "capability-util.h"
+#include "cgroup.h"
 #include "cgroup-setup.h"
 #include "chase.h"
 #include "chattr-util.h"
 #include "chown-recursive.h"
 #include "copy.h"
+#include "dynamic-user.h"
 #include "env-util.h"
 #include "escape.h"
 #include "exec-credential.h"
@@ -38,14 +40,17 @@
 #include "fd-util.h"
 #include "hexdecoct.h"
 #include "hostname-setup.h"
+#include "image-policy.h"
 #include "io-util.h"
 #include "ioprio-util.h"
 #include "iovec-util.h"
 #include "journal-send.h"
+#include "manager.h"
 #include "memfd-util.h"
 #include "missing_sched.h"
 #include "missing_syscall.h"
 #include "mkdir-label.h"
+#include "mount-util.h"
 #include "osc-context.h"
 #include "proc-cmdline.h"
 #include "process-util.h"
diff --git a/src/core/execute-serialize.c b/src/core/execute-serialize.c
index 380d6fa6bb..0aea6fe804 100644
--- a/src/core/execute-serialize.c
+++ b/src/core/execute-serialize.c
@@ -2,7 +2,9 @@
 
 #include "af-list.h"
 #include "capability-util.h"
+#include "cgroup.h"
 #include "cgroup-setup.h"
+#include "dynamic-user.h"
 #include "escape.h"
 #include "exec-credential.h"
 #include "execute-serialize.h"
diff --git a/src/core/execute.c b/src/core/execute.c
index 76ad7345ca..4aef0ad819 100644
--- a/src/core/execute.c
+++ b/src/core/execute.c
@@ -25,6 +25,7 @@
 #include "cgroup-setup.h"
 #include "constants.h"
 #include "cpu-set-util.h"
+#include "dynamic-user.h"
 #include "env-file.h"
 #include "env-util.h"
 #include "errno-list.h"
diff --git a/src/core/execute.h b/src/core/execute.h
index 63d5b448de..9b449012b2 100644
--- a/src/core/execute.h
+++ b/src/core/execute.h
@@ -1,19 +1,11 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-typedef struct ExecStatus ExecStatus;
-typedef struct ExecCommand ExecCommand;
-typedef struct ExecContext ExecContext;
-typedef struct ExecSharedRuntime ExecSharedRuntime;
-typedef struct DynamicCreds DynamicCreds;
-typedef struct ExecRuntime ExecRuntime;
-typedef struct ExecParameters ExecParameters;
-typedef struct Manager Manager;
-
 #include <sched.h>
 #include <stdbool.h>
 #include <stdio.h>
 #include <sys/capability.h>
+#include <sys/socket.h>
 
 #include "bus-unit-util.h"
 #include "cgroup-util.h"
@@ -22,6 +14,7 @@ typedef struct Manager Manager;
 #include "exec-util.h"
 #include "fdset.h"
 #include "list.h"
+#include "log-context.h"
 #include "namespace.h"
 #include "nsflags.h"
 #include "numa-util.h"
@@ -34,6 +27,17 @@ typedef struct Manager Manager;
 #include "set.h"
 #include "time-util.h"
 
+typedef struct CGroupContext CGroupContext;
+typedef struct ExecStatus ExecStatus;
+typedef struct ExecCommand ExecCommand;
+typedef struct ExecContext ExecContext;
+typedef struct ExecSharedRuntime ExecSharedRuntime;
+typedef struct DynamicCreds DynamicCreds;
+typedef struct ExecRuntime ExecRuntime;
+typedef struct ExecParameters ExecParameters;
+typedef struct Manager Manager;
+typedef struct Unit Unit;
+
 #define EXEC_STDIN_DATA_MAX (64U*1024U*1024U)
 
 typedef enum ExecUtmpMode {
@@ -494,9 +498,6 @@ struct ExecParameters {
                 .pidref_transport_fd    = -EBADF, \
         }
 
-#include "unit.h"
-#include "dynamic-user.h"
-
 int exec_spawn(
                 Unit *unit,
                 ExecCommand *command,
diff --git a/src/core/executor.c b/src/core/executor.c
index bc3566a9fc..daee9ea955 100644
--- a/src/core/executor.c
+++ b/src/core/executor.c
@@ -9,6 +9,8 @@
 #include "argv-util.h"
 #include "build.h"
 #include "capability-util.h"
+#include "cgroup.h"
+#include "dynamic-user.h"
 #include "exec-invoke.h"
 #include "execute-serialize.h"
 #include "execute.h"
diff --git a/src/core/fuzz-execute-serialize.c b/src/core/fuzz-execute-serialize.c
index 05abee5a4e..67437549ea 100644
--- a/src/core/fuzz-execute-serialize.c
+++ b/src/core/fuzz-execute-serialize.c
@@ -20,6 +20,7 @@
 #include <stdio.h>
 
 #include "alloc-util.h"
+#include "dynamic-user.h"
 #include "execute-serialize.h"
 #include "fd-util.h"
 #include "fuzz.h"
diff --git a/src/core/fuzz-unit-file.c b/src/core/fuzz-unit-file.c
index 57480cf766..d8987c9648 100644
--- a/src/core/fuzz-unit-file.c
+++ b/src/core/fuzz-unit-file.c
@@ -5,6 +5,7 @@
 #include "fuzz.h"
 #include "install.h"
 #include "load-fragment.h"
+#include "manager.h"
 #include "manager-dump.h"
 #include "memstream-util.h"
 #include "string-util.h"
diff --git a/src/core/job.c b/src/core/job.c
index 4209a7c8d4..d051b3db6d 100644
--- a/src/core/job.c
+++ b/src/core/job.c
@@ -16,6 +16,7 @@
 #include "job.h"
 #include "log.h"
 #include "macro.h"
+#include "manager.h"
 #include "parse-util.h"
 #include "serialize.h"
 #include "set.h"
diff --git a/src/core/job.h b/src/core/job.h
index 388890e368..3c1e861bbc 100644
--- a/src/core/job.h
+++ b/src/core/job.h
@@ -7,6 +7,8 @@
 #include "sd-event.h"
 
 #include "list.h"
+#include "memory-util.h"
+#include "time-util.h"
 #include "unit-dependency-atom.h"
 
 typedef struct ActivationDetails ActivationDetails;
diff --git a/src/core/kill.h b/src/core/kill.h
index 3add663d71..97a295e1e5 100644
--- a/src/core/kill.h
+++ b/src/core/kill.h
@@ -1,8 +1,6 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-typedef struct KillContext KillContext;
-
 #include <stdbool.h>
 #include <stdio.h>
 
@@ -18,7 +16,7 @@ typedef enum KillMode {
         _KILL_MODE_INVALID = -EINVAL,
 } KillMode;
 
-struct KillContext {
+typedef struct KillContext {
         KillMode kill_mode;
         int kill_signal;
         int restart_kill_signal;
@@ -26,7 +24,7 @@ struct KillContext {
         int watchdog_signal;
         bool send_sigkill;
         bool send_sighup;
-};
+} KillContext;
 
 typedef enum KillWhom {
         /* Kill whom is a property of an operation */
diff --git a/src/core/load-dropin.c b/src/core/load-dropin.c
index 5c1ccc966f..0256f70635 100644
--- a/src/core/load-dropin.c
+++ b/src/core/load-dropin.c
@@ -1,16 +1,29 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
 #include "conf-parser.h"
+#include "dropin.h"
 #include "fs-util.h"
 #include "load-dropin.h"
 #include "load-fragment.h"
 #include "log.h"
+#include "manager.h"
 #include "stat-util.h"
 #include "string-util.h"
 #include "strv.h"
 #include "unit-name.h"
 #include "unit.h"
 
+int unit_find_dropin_paths(Unit *u, bool use_unit_path_cache, char ***paths) {
+        assert(u);
+
+        return unit_file_find_dropin_paths(NULL,
+                                           u->manager->lookup_paths.search_path,
+                                           use_unit_path_cache ? u->manager->unit_path_cache : NULL,
+                                           ".d", ".conf",
+                                           u->id, u->aliases,
+                                           paths);
+}
+
 static int process_deps(Unit *u, UnitDependency dependency, const char *dir_suffix) {
         _cleanup_strv_free_ char **paths = NULL;
         int r;
diff --git a/src/core/load-dropin.h b/src/core/load-dropin.h
index 141bc7dd0f..864ea4f083 100644
--- a/src/core/load-dropin.h
+++ b/src/core/load-dropin.h
@@ -1,20 +1,12 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include "dropin.h"
-#include "unit.h"
+#include <stdbool.h>
+
+typedef struct Unit Unit;
 
 /* Read service data supplementary drop-in directories */
 
-static inline int unit_find_dropin_paths(Unit *u, bool use_unit_path_cache, char ***paths) {
-        assert(u);
-
-        return unit_file_find_dropin_paths(NULL,
-                                           u->manager->lookup_paths.search_path,
-                                           use_unit_path_cache ? u->manager->unit_path_cache : NULL,
-                                           ".d", ".conf",
-                                           u->id, u->aliases,
-                                           paths);
-}
+int unit_find_dropin_paths(Unit *u, bool use_unit_path_cache, char ***paths);
 
 int unit_load_dropin(Unit *u);
diff --git a/src/core/load-fragment.h b/src/core/load-fragment.h
index 0e68d1bb84..6aa8f479f5 100644
--- a/src/core/load-fragment.h
+++ b/src/core/load-fragment.h
@@ -2,7 +2,8 @@
 #pragma once
 
 #include "conf-parser.h"
-#include "unit.h"
+
+typedef struct Unit Unit;
 
 /* These functions are declared in the header to make them accessible to unit tests. */
 bool contains_instance_specifier_superset(const char *s);
diff --git a/src/core/main.h b/src/core/main.h
index 3b770b5a3f..f637cbad7a 100644
--- a/src/core/main.h
+++ b/src/core/main.h
@@ -3,6 +3,8 @@
 
 #include <stdbool.h>
 
+#include "crash-handler.h"
+
 extern bool arg_dump_core;
 extern int arg_crash_chvt;
 extern bool arg_crash_shell;
diff --git a/src/core/manager-dump.c b/src/core/manager-dump.c
index 7e678fa03e..9cb184b4d2 100644
--- a/src/core/manager-dump.c
+++ b/src/core/manager-dump.c
@@ -4,6 +4,7 @@
 #include "fd-util.h"
 #include "fileio.h"
 #include "hashmap.h"
+#include "manager.h"
 #include "manager-dump.h"
 #include "memstream-util.h"
 #include "unit-serialize.h"
diff --git a/src/core/manager-dump.h b/src/core/manager-dump.h
index 5b96f26f54..a02c29ad68 100644
--- a/src/core/manager-dump.h
+++ b/src/core/manager-dump.h
@@ -3,7 +3,7 @@
 
 #include <stdio.h>
 
-#include "manager.h"
+typedef struct Manager Manager;
 
 void manager_dump_jobs(Manager *s, FILE *f, char **patterns, const char *prefix);
 int manager_get_dump_jobs_string(Manager *m, char **patterns, const char *prefix, char **ret);
diff --git a/src/core/manager-serialize.c b/src/core/manager-serialize.c
index c5cb82e8d5..ae4472b38b 100644
--- a/src/core/manager-serialize.c
+++ b/src/core/manager-serialize.c
@@ -5,6 +5,7 @@
 #include "clean-ipc.h"
 #include "core-varlink.h"
 #include "dbus.h"
+#include "dynamic-user.h"
 #include "fd-util.h"
 #include "fileio.h"
 #include "format-util.h"
diff --git a/src/core/manager-serialize.h b/src/core/manager-serialize.h
index c52261e378..7d4e8effb2 100644
--- a/src/core/manager-serialize.h
+++ b/src/core/manager-serialize.h
@@ -2,10 +2,12 @@
 #pragma once
 
 #include <stdbool.h>
+#include <stdio.h>
 
-#include "manager.h"
 #include "fdset.h"
 
+typedef struct Manager Manager;
+
 #define DESTROY_IPC_FLAG (UINT32_C(1) << 31)
 
 int manager_open_serialization(Manager *m, FILE **ret_f);
diff --git a/src/core/manager.c b/src/core/manager.c
index 3b34f0494e..15c8f2b90d 100644
--- a/src/core/manager.c
+++ b/src/core/manager.c
@@ -42,6 +42,7 @@
 #include "dbus-unit.h"
 #include "dbus.h"
 #include "dirent-util.h"
+#include "dynamic-user.h"
 #include "env-util.h"
 #include "escape.h"
 #include "event-util.h"
@@ -928,15 +929,6 @@ int manager_new(RuntimeScope runtime_scope, ManagerTestRunFlags test_run_flags,
                                 m->timestamps + MANAGER_TIMESTAMP_LOADER);
 #endif
 
-        /* Prepare log fields we can use for structured logging */
-        if (MANAGER_IS_SYSTEM(m)) {
-                m->unit_log_field = "UNIT=";
-                m->invocation_log_field = "INVOCATION_ID=";
-        } else {
-                m->unit_log_field = "USER_UNIT=";
-                m->invocation_log_field = "USER_INVOCATION_ID=";
-        }
-
         /* Reboot immediately if the user hits C-A-D more often than 7x per 2s */
         m->ctrl_alt_del_ratelimit = (const RateLimit) { .interval = 2 * USEC_PER_SEC, .burst = 7 };
 
@@ -5191,11 +5183,3 @@ static const char* const manager_timestamp_table[_MANAGER_TIMESTAMP_MAX] = {
 };
 
 DEFINE_STRING_TABLE_LOOKUP(manager_timestamp, ManagerTimestamp);
-
-static const char* const oom_policy_table[_OOM_POLICY_MAX] = {
-        [OOM_CONTINUE] = "continue",
-        [OOM_STOP]     = "stop",
-        [OOM_KILL]     = "kill",
-};
-
-DEFINE_STRING_TABLE_LOOKUP(oom_policy, OOMPolicy);
diff --git a/src/core/manager.h b/src/core/manager.h
index 6fef909350..cbad223d1b 100644
--- a/src/core/manager.h
+++ b/src/core/manager.h
@@ -9,14 +9,22 @@
 #include "sd-event.h"
 #include "sd-varlink.h"
 
-#include "common-signal.h"
 #include "cgroup-util.h"
 #include "cgroup.h"
+#include "common-signal.h"
+#include "emergency-action.h"
+#include "execute.h"
 #include "fdset.h"
 #include "hashmap.h"
+#include "job.h"
 #include "list.h"
+#include "path-lookup.h"
 #include "prioq.h"
 #include "ratelimit.h"
+#include "show-status.h"
+#include "transaction.h"
+#include "unit-name.h"
+#include "unit.h"
 
 struct libmnt_monitor;
 typedef struct Unit Unit;
@@ -62,21 +70,6 @@ typedef enum ManagerObjective {
         _MANAGER_OBJECTIVE_INVALID = -EINVAL,
 } ManagerObjective;
 
-typedef enum StatusType {
-        STATUS_TYPE_EPHEMERAL,
-        STATUS_TYPE_NORMAL,
-        STATUS_TYPE_NOTICE,
-        STATUS_TYPE_EMERGENCY,
-} StatusType;
-
-typedef enum OOMPolicy {
-        OOM_CONTINUE,          /* The kernel or systemd-oomd kills the process it wants to kill, and that's it */
-        OOM_STOP,              /* The kernel or systemd-oomd kills the process it wants to kill, and we stop the unit */
-        OOM_KILL,              /* The kernel or systemd-oomd kills the process it wants to kill, and all others in the unit, and we stop the unit */
-        _OOM_POLICY_MAX,
-        _OOM_POLICY_INVALID = -EINVAL,
-} OOMPolicy;
-
 /* Notes:
  * 1. TIMESTAMP_FIRMWARE, TIMESTAMP_LOADER, TIMESTAMP_KERNEL, TIMESTAMP_INITRD,
  *    TIMESTAMP_SECURITY_START, and TIMESTAMP_SECURITY_FINISH are set only when
@@ -135,14 +128,6 @@ typedef enum WatchdogType {
         _WATCHDOG_TYPE_MAX,
 } WatchdogType;
 
-#include "execute.h"
-#include "job.h"
-#include "path-lookup.h"
-#include "show-status.h"
-#include "transaction.h"
-#include "unit-name.h"
-#include "unit.h"
-
 typedef enum ManagerTestRunFlags {
         MANAGER_TEST_NORMAL                  = 0,       /* run normally */
         MANAGER_TEST_RUN_MINIMAL             = 1 << 0,  /* create basic data structures */
@@ -472,9 +457,6 @@ struct Manager {
         RateLimit ctrl_alt_del_ratelimit;
         EmergencyAction cad_burst_action;
 
-        const char *unit_log_field;
-        const char *invocation_log_field;
-
         int first_boot; /* tri-state */
 
         /* Prefixes of e.g. RuntimeDirectory= */
@@ -673,9 +655,6 @@ LogTarget manager_get_executor_log_target(Manager *m);
 
 int manager_allocate_idle_pipe(Manager *m);
 
-const char* oom_policy_to_string(OOMPolicy i) _const_;
-OOMPolicy oom_policy_from_string(const char *s) _pure_;
-
 void unit_defaults_init(UnitDefaults *defaults, RuntimeScope scope);
 void unit_defaults_done(UnitDefaults *defaults);
 
diff --git a/src/core/mount.h b/src/core/mount.h
index 7fd643f6fa..c754ae7933 100644
--- a/src/core/mount.h
+++ b/src/core/mount.h
@@ -1,9 +1,6 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-typedef struct Mount Mount;
-
-#include "dynamic-user.h"
 #include "kill.h"
 #include "pidref.h"
 #include "unit.h"
@@ -42,7 +39,7 @@ typedef enum MountProcFlags {
         MOUNT_PROC_JUST_CHANGED = 1 << 2,
 } MountProcFlags;
 
-struct Mount {
+typedef struct Mount {
         Unit meta;
 
         char *where;
@@ -88,7 +85,7 @@ struct Mount {
         sd_event_source *timer_event_source;
 
         unsigned n_retry_umount;
-};
+} Mount;
 
 extern const UnitVTable mount_vtable;
 
diff --git a/src/core/namespace.c b/src/core/namespace.c
index efdd93ddf9..207f3a2d66 100644
--- a/src/core/namespace.c
+++ b/src/core/namespace.c
@@ -22,6 +22,7 @@
 #include "label-util.h"
 #include "list.h"
 #include "lock-util.h"
+#include "log.h"
 #include "loop-util.h"
 #include "loopback-setup.h"
 #include "missing_syscall.h"
diff --git a/src/core/path.c b/src/core/path.c
index 4556dbfc71..364d94f528 100644
--- a/src/core/path.c
+++ b/src/core/path.c
@@ -16,6 +16,7 @@
 #include "glob-util.h"
 #include "inotify-util.h"
 #include "macro.h"
+#include "manager.h"
 #include "mkdir-label.h"
 #include "path.h"
 #include "path-util.h"
diff --git a/src/core/path.h b/src/core/path.h
index cb5b662911..8a3b8b3592 100644
--- a/src/core/path.h
+++ b/src/core/path.h
@@ -1,10 +1,6 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-typedef struct Path Path;
-typedef struct PathSpec PathSpec;
-typedef struct ActivationDetailsPath ActivationDetailsPath;
-
 #include "unit.h"
 
 typedef enum PathType {
@@ -52,7 +48,7 @@ typedef enum PathResult {
         _PATH_RESULT_INVALID = -EINVAL,
 } PathResult;
 
-struct Path {
+typedef struct Path {
         Unit meta;
 
         LIST_HEAD(PathSpec, specs);
@@ -67,12 +63,12 @@ struct Path {
         RateLimit trigger_limit;
 
         sd_event_source *trigger_notify_event_source;
-};
+} Path;
 
-struct ActivationDetailsPath {
+typedef struct ActivationDetailsPath {
         ActivationDetails meta;
         char *trigger_path_filename;
-};
+} ActivationDetailsPath;
 
 void path_free_specs(Path *p);
 
diff --git a/src/core/scope.c b/src/core/scope.c
index 208716ea07..caeadd7e23 100644
--- a/src/core/scope.c
+++ b/src/core/scope.c
@@ -10,6 +10,7 @@
 #include "exit-status.h"
 #include "load-dropin.h"
 #include "log.h"
+#include "manager.h"
 #include "process-util.h"
 #include "random-util.h"
 #include "scope.h"
diff --git a/src/core/scope.h b/src/core/scope.h
index 1090431c13..27f2c83b23 100644
--- a/src/core/scope.h
+++ b/src/core/scope.h
@@ -1,8 +1,6 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-typedef struct Scope Scope;
-
 #include "cgroup.h"
 #include "kill.h"
 #include "unit.h"
@@ -16,7 +14,7 @@ typedef enum ScopeResult {
         _SCOPE_RESULT_INVALID = -EINVAL,
 } ScopeResult;
 
-struct Scope {
+typedef struct Scope {
         Unit meta;
 
         CGroupContext cgroup_context;
@@ -41,7 +39,7 @@ struct Scope {
         char *group;
 
         OOMPolicy oom_policy;
-};
+} Scope;
 
 extern const UnitVTable scope_vtable;
 
diff --git a/src/core/service.h b/src/core/service.h
index 68be9075c1..a542c0fb11 100644
--- a/src/core/service.h
+++ b/src/core/service.h
@@ -1,12 +1,9 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-typedef struct Service Service;
-typedef struct ServiceFDStore ServiceFDStore;
-typedef struct ServiceExtraFD ServiceExtraFD;
-
 #include "exit-status.h"
 #include "kill.h"
+#include "manager.h"
 #include "open-file.h"
 #include "path.h"
 #include "pidref.h"
@@ -14,6 +11,8 @@ typedef struct ServiceExtraFD ServiceExtraFD;
 #include "socket.h"
 #include "unit.h"
 
+typedef struct Service Service;
+
 typedef enum ServiceRestart {
         SERVICE_RESTART_NO,
         SERVICE_RESTART_ON_SUCCESS,
@@ -101,7 +100,7 @@ typedef enum ServiceRestartMode {
         _SERVICE_RESTART_MODE_INVALID = -EINVAL,
 } ServiceRestartMode;
 
-struct ServiceFDStore {
+typedef struct ServiceFDStore {
         Service *service;
 
         int fd;
@@ -109,13 +108,13 @@ struct ServiceFDStore {
         sd_event_source *event_source;
         bool do_poll;
 
-        LIST_FIELDS(ServiceFDStore, fd_store);
-};
+        LIST_FIELDS(struct ServiceFDStore, fd_store);
+} ServiceFDStore;
 
-struct ServiceExtraFD {
+typedef struct ServiceExtraFD {
         int fd;
         char *fdname;
-};
+} ServiceExtraFD;
 
 struct Service {
         Unit meta;
diff --git a/src/core/show-status.h b/src/core/show-status.h
index f441223dff..a51616f75a 100644
--- a/src/core/show-status.h
+++ b/src/core/show-status.h
@@ -1,6 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
+#include <stdarg.h>
 #include <stdbool.h>
 
 #include "macro.h"
diff --git a/src/core/slice.c b/src/core/slice.c
index ba6f2fb9c5..4a9ff98ee9 100644
--- a/src/core/slice.c
+++ b/src/core/slice.c
@@ -7,6 +7,7 @@
 #include "dbus-unit.h"
 #include "fd-util.h"
 #include "log.h"
+#include "manager.h"
 #include "serialize.h"
 #include "slice.h"
 #include "special.h"
diff --git a/src/core/slice.h b/src/core/slice.h
index 37e1f700f8..46faecc030 100644
--- a/src/core/slice.h
+++ b/src/core/slice.h
@@ -3,9 +3,7 @@
 
 #include "unit.h"
 
-typedef struct Slice Slice;
-
-struct Slice {
+typedef struct Slice {
         Unit meta;
 
         SliceState state, deserialized_state;
@@ -16,7 +14,7 @@ struct Slice {
         CGroupContext cgroup_context;
 
         CGroupRuntime *cgroup_runtime;
-};
+} Slice;
 
 extern const UnitVTable slice_vtable;
 
diff --git a/src/core/smack-setup.h b/src/core/smack-setup.h
index d29370d1e9..6758f07cef 100644
--- a/src/core/smack-setup.h
+++ b/src/core/smack-setup.h
@@ -7,4 +7,6 @@
         Nathaniel Chen <nathaniel.chen@intel.com>
 ***/
 
+#include <stdbool.h>
+
 int mac_smack_setup(bool *loaded_policy);
diff --git a/src/core/socket.c b/src/core/socket.c
index 861aaba3d4..bb1db8e90e 100644
--- a/src/core/socket.c
+++ b/src/core/socket.c
@@ -28,6 +28,7 @@
 #include "ip-protocol-list.h"
 #include "label-util.h"
 #include "log.h"
+#include "manager.h"
 #include "mkdir-label.h"
 #include "parse-util.h"
 #include "path-util.h"
diff --git a/src/core/socket.h b/src/core/socket.h
index 51fc96280b..240a9ac965 100644
--- a/src/core/socket.h
+++ b/src/core/socket.h
@@ -1,14 +1,13 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-typedef struct Socket Socket;
-typedef struct SocketPeer SocketPeer;
-
-#include "mount.h"
 #include "pidref.h"
 #include "socket-util.h"
 #include "unit.h"
 
+typedef struct Socket Socket;
+typedef struct SocketPeer SocketPeer;
+
 typedef enum SocketExecCommand {
         SOCKET_EXEC_START_PRE,
         SOCKET_EXEC_START_CHOWN,
diff --git a/src/core/swap.c b/src/core/swap.c
index cc5a21ee78..a8549699ff 100644
--- a/src/core/swap.c
+++ b/src/core/swap.c
@@ -17,6 +17,7 @@
 #include "fd-util.h"
 #include "format-util.h"
 #include "fstab-util.h"
+#include "manager.h"
 #include "parse-util.h"
 #include "path-util.h"
 #include "process-util.h"
diff --git a/src/core/swap.h b/src/core/swap.h
index d9bbd377f0..fce7ea5e56 100644
--- a/src/core/swap.h
+++ b/src/core/swap.h
@@ -10,8 +10,6 @@
 #include "pidref.h"
 #include "unit.h"
 
-typedef struct Swap Swap;
-
 typedef enum SwapExecCommand {
         SWAP_EXEC_ACTIVATE,
         SWAP_EXEC_DEACTIVATE,
@@ -38,7 +36,7 @@ typedef struct SwapParameters {
         bool priority_set;
 } SwapParameters;
 
-struct Swap {
+typedef struct Swap {
         Unit meta;
 
         char *what;
@@ -85,7 +83,7 @@ struct Swap {
         devices for the same swap. We chain them up here. */
 
         LIST_FIELDS(struct Swap, same_devnode);
-};
+} Swap;
 
 extern const UnitVTable swap_vtable;
 
diff --git a/src/core/target.h b/src/core/target.h
index bb909d664f..9e7c77c027 100644
--- a/src/core/target.h
+++ b/src/core/target.h
@@ -3,13 +3,11 @@
 
 #include "unit.h"
 
-typedef struct Target Target;
-
-struct Target {
+typedef struct Target {
         Unit meta;
 
         TargetState state, deserialized_state;
-};
+} Target;
 
 extern const UnitVTable target_vtable;
 
diff --git a/src/core/timer.c b/src/core/timer.c
index b37a67f310..d69e229922 100644
--- a/src/core/timer.c
+++ b/src/core/timer.c
@@ -12,6 +12,7 @@
 #include "dbus-timer.h"
 #include "dbus-unit.h"
 #include "fs-util.h"
+#include "manager.h"
 #include "parse-util.h"
 #include "random-util.h"
 #include "serialize.h"
diff --git a/src/core/timer.h b/src/core/timer.h
index 14a9931dff..90f19a7cf4 100644
--- a/src/core/timer.h
+++ b/src/core/timer.h
@@ -1,9 +1,6 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-typedef struct Timer Timer;
-typedef struct ActivationDetailsTimer ActivationDetailsTimer;
-
 #include "calendarspec.h"
 #include "unit.h"
 
@@ -37,7 +34,7 @@ typedef enum TimerResult {
         _TIMER_RESULT_INVALID = -EINVAL,
 } TimerResult;
 
-struct Timer {
+typedef struct Timer {
         Unit meta;
 
         usec_t accuracy_usec;
@@ -64,12 +61,12 @@ struct Timer {
         bool defer_reactivation;
 
         char *stamp_path;
-};
+} Timer;
 
-struct ActivationDetailsTimer {
+typedef struct ActivationDetailsTimer {
         ActivationDetails meta;
         dual_timestamp last_trigger;
-};
+} ActivationDetailsTimer;
 
 #define TIMER_MONOTONIC_CLOCK(t) ((t)->wake_system ? CLOCK_BOOTTIME_ALARM : CLOCK_MONOTONIC)
 
diff --git a/src/core/transaction.c b/src/core/transaction.c
index 2c4eef965d..6d0d7e73be 100644
--- a/src/core/transaction.c
+++ b/src/core/transaction.c
@@ -8,6 +8,7 @@
 #include "bus-common-errors.h"
 #include "bus-error.h"
 #include "dbus-unit.h"
+#include "manager.h"
 #include "slice.h"
 #include "strv.h"
 #include "terminal-util.h"
@@ -393,7 +394,7 @@ static int transaction_verify_order_one(Transaction *tr, Job *j, Job *from, unsi
                                 break;
                 }
 
-                unit_ids = merge_unit_ids(j->manager->unit_log_field, array); /* ignore error */
+                unit_ids = merge_unit_ids(unit_log_field(j->unit), array); /* ignore error */
 
                 STRV_FOREACH_PAIR(unit_id, job_type, array)
                         /* logging for j not k here to provide a consistent narrative */
diff --git a/src/core/transaction.h b/src/core/transaction.h
index b6728a35d7..1f58fcebcc 100644
--- a/src/core/transaction.h
+++ b/src/core/transaction.h
@@ -1,20 +1,15 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-typedef struct Transaction Transaction;
-typedef enum TransactionAddFlags TransactionAddFlags;
-
 #include "hashmap.h"
 #include "job.h"
-#include "manager.h"
-#include "unit.h"
 
-struct Transaction {
+typedef struct Transaction {
         /* Jobs to be added */
         Hashmap *jobs;        /* Unit object => Job object list 1:1 */
         Job *anchor_job;      /* The job the user asked for */
         bool irreversible;
-};
+} Transaction;
 
 Transaction* transaction_new(bool irreversible);
 Transaction* transaction_free(Transaction *tr);
diff --git a/src/core/unit-printf.c b/src/core/unit-printf.c
index f25e2e3986..0bdacfc3c0 100644
--- a/src/core/unit-printf.c
+++ b/src/core/unit-printf.c
@@ -4,6 +4,7 @@
 #include "cgroup-util.h"
 #include "format-util.h"
 #include "macro.h"
+#include "manager.h"
 #include "sd-path.h"
 #include "specifier.h"
 #include "string-util.h"
diff --git a/src/core/unit-serialize.c b/src/core/unit-serialize.c
index 13aea615dd..a38b38590a 100644
--- a/src/core/unit-serialize.c
+++ b/src/core/unit-serialize.c
@@ -10,6 +10,7 @@
 #include "parse-util.h"
 #include "serialize.h"
 #include "string-table.h"
+#include "unit.h"
 #include "unit-serialize.h"
 #include "user-util.h"
 
diff --git a/src/core/unit-serialize.h b/src/core/unit-serialize.h
index ab8a8e3be9..a7ac03cf82 100644
--- a/src/core/unit-serialize.h
+++ b/src/core/unit-serialize.h
@@ -1,11 +1,13 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
+#include <stdbool.h>
 #include <stdio.h>
 
-#include "unit.h"
 #include "fdset.h"
 
+typedef struct Unit Unit;
+
 /* These functions serialize state for our own usage, i.e.: across a reload/reexec, rather than for being
  * passed to a child process. */
 
diff --git a/src/core/unit.c b/src/core/unit.c
index ac0528511d..db14297622 100644
--- a/src/core/unit.c
+++ b/src/core/unit.c
@@ -24,6 +24,7 @@
 #include "dbus-unit.h"
 #include "dbus.h"
 #include "dropin.h"
+#include "dynamic-user.h"
 #include "env-util.h"
 #include "escape.h"
 #include "exec-credential.h"
@@ -1727,9 +1728,9 @@ static int log_unit_internal(void *userdata, int level, int error, const char *f
         va_start(ap, format);
         if (u)
                 r = log_object_internalv(level, error, file, line, func,
-                                         u->manager->unit_log_field,
+                                         unit_log_field(u),
                                          u->id,
-                                         u->manager->invocation_log_field,
+                                         unit_invocation_log_field(u),
                                          u->invocation_id_string,
                                          format, ap);
         else
@@ -2491,10 +2492,10 @@ static int unit_log_resources(Unit *u) {
         if (!set_iovec_string_field(iovec, &n_iovec, "MESSAGE_ID=", SD_MESSAGE_UNIT_RESOURCES_STR))
                 return log_oom();
 
-        if (!set_iovec_string_field(iovec, &n_iovec, u->manager->unit_log_field, u->id))
+        if (!set_iovec_string_field(iovec, &n_iovec, unit_log_field(u), u->id))
                 return log_oom();
 
-        if (!set_iovec_string_field(iovec, &n_iovec, u->manager->invocation_log_field, u->invocation_id_string))
+        if (!set_iovec_string_field(iovec, &n_iovec, unit_invocation_log_field(u), u->invocation_id_string))
                 return log_oom();
 
         log_unit_struct_iovec(u, log_level, iovec, n_iovec);
@@ -6642,6 +6643,14 @@ int unit_compare_priority(Unit *a, Unit *b) {
         return strcmp(a->id, b->id);
 }
 
+const char* unit_log_field(const Unit *u) {
+        return MANAGER_IS_SYSTEM(ASSERT_PTR(u)->manager) ? "UNIT=" : "USER_UNIT=";
+}
+
+const char* unit_invocation_log_field(const Unit *u) {
+        return MANAGER_IS_SYSTEM(ASSERT_PTR(u)->manager) ? "INVOCATION_ID=" : "USER_INVOCATION_ID=";
+}
+
 const ActivationDetailsVTable * const activation_details_vtable[_UNIT_TYPE_MAX] = {
         [UNIT_PATH]  = &activation_details_path_vtable,
         [UNIT_TIMER] = &activation_details_timer_vtable,
@@ -6802,6 +6811,14 @@ static const char* const unit_mount_dependency_type_table[_UNIT_MOUNT_DEPENDENCY
 
 DEFINE_STRING_TABLE_LOOKUP(unit_mount_dependency_type, UnitMountDependencyType);
 
+static const char* const oom_policy_table[_OOM_POLICY_MAX] = {
+        [OOM_CONTINUE] = "continue",
+        [OOM_STOP]     = "stop",
+        [OOM_KILL]     = "kill",
+};
+
+DEFINE_STRING_TABLE_LOOKUP(oom_policy, OOMPolicy);
+
 UnitDependency unit_mount_dependency_type_to_dependency_type(UnitMountDependencyType t) {
         switch (t) {
 
diff --git a/src/core/unit.h b/src/core/unit.h
index 7e59443415..5bf52f5f6d 100644
--- a/src/core/unit.h
+++ b/src/core/unit.h
@@ -9,7 +9,21 @@
 
 #include "sd-id128.h"
 
-/* Circular dependency with manager.h, needs to be defined before local includes */
+#include "cgroup.h"
+#include "condition.h"
+#include "emergency-action.h"
+#include "execute.h"
+#include "install.h"
+#include "job.h"
+#include "list.h"
+#include "log-context.h"
+#include "mount-util.h"
+#include "pidref.h"
+#include "ratelimit.h"
+#include "unit-file.h"
+
+typedef struct UnitRef UnitRef;
+
 typedef enum UnitMountDependencyType {
         UNIT_MOUNT_WANTS,
         UNIT_MOUNT_REQUIRES,
@@ -17,18 +31,6 @@ typedef enum UnitMountDependencyType {
         _UNIT_MOUNT_DEPENDENCY_TYPE_INVALID = -EINVAL,
 } UnitMountDependencyType;
 
-#include "cgroup.h"
-#include "condition.h"
-#include "emergency-action.h"
-#include "install.h"
-#include "list.h"
-#include "log-context.h"
-#include "mount-util.h"
-#include "pidref.h"
-#include "unit-file.h"
-
-typedef struct UnitRef UnitRef;
-
 typedef enum KillOperation {
         KILL_TERMINATE,
         KILL_TERMINATE_AND_LOG,
@@ -46,6 +48,21 @@ typedef enum CollectMode {
         _COLLECT_MODE_INVALID = -EINVAL,
 } CollectMode;
 
+typedef enum OOMPolicy {
+        OOM_CONTINUE,          /* The kernel or systemd-oomd kills the process it wants to kill, and that's it */
+        OOM_STOP,              /* The kernel or systemd-oomd kills the process it wants to kill, and we stop the unit */
+        OOM_KILL,              /* The kernel or systemd-oomd kills the process it wants to kill, and all others in the unit, and we stop the unit */
+        _OOM_POLICY_MAX,
+        _OOM_POLICY_INVALID = -EINVAL,
+} OOMPolicy;
+
+typedef enum StatusType {
+        STATUS_TYPE_EPHEMERAL,
+        STATUS_TYPE_NORMAL,
+        STATUS_TYPE_NOTICE,
+        STATUS_TYPE_EMERGENCY,
+} StatusType;
+
 static inline bool UNIT_IS_ACTIVE_OR_RELOADING(UnitActiveState t) {
         return IN_SET(t, UNIT_ACTIVE, UNIT_RELOADING, UNIT_REFRESHING);
 }
@@ -200,8 +217,6 @@ static inline void* UNIT_DEPENDENCY_TO_PTR(UnitDependency d) {
         return INT_TO_PTR(d);
 }
 
-#include "job.h"
-
 struct UnitRef {
         /* Keeps tracks of references to a unit. This is useful so
          * that we can merge two units if necessary and correct all
@@ -1054,10 +1069,16 @@ bool unit_passes_filter(Unit *u, char * const *states, char * const *patterns);
 
 int unit_compare_priority(Unit *a, Unit *b);
 
+const char* unit_log_field(const Unit *u);
+const char* unit_invocation_log_field(const Unit *u);
+
 UnitMountDependencyType unit_mount_dependency_type_from_string(const char *s) _const_;
 const char* unit_mount_dependency_type_to_string(UnitMountDependencyType t) _const_;
 UnitDependency unit_mount_dependency_type_to_dependency_type(UnitMountDependencyType t) _pure_;
 
+const char* oom_policy_to_string(OOMPolicy i) _const_;
+OOMPolicy oom_policy_from_string(const char *s) _pure_;
+
 /* Macros which append UNIT= or USER_UNIT= to the message */
 
 #define log_unit_full_errno_zerook(unit, level, error, ...)             \
@@ -1071,7 +1092,7 @@ UnitDependency unit_mount_dependency_type_to_dependency_type(UnitMountDependency
                 LOG_CONTEXT_PUSH_IOV(_c ? _c->log_extra_fields : NULL,  \
                                      _c ? _c->n_log_extra_fields : 0);  \
                 !_do_log ? -ERRNO_VALUE(error) :                        \
-                        _u ? log_object_internal(_l, error, PROJECT_FILE, __LINE__, __func__, _u->manager->unit_log_field, _u->id, _u->manager->invocation_log_field, _u->invocation_id_string, ##__VA_ARGS__) : \
+                        _u ? log_object_internal(_l, error, PROJECT_FILE, __LINE__, __func__, unit_log_field(_u), _u->id, unit_invocation_log_field(_u), _u->invocation_id_string, ##__VA_ARGS__) : \
                                 log_internal(_l, error, PROJECT_FILE, __LINE__, __func__, ##__VA_ARGS__); \
         })
 
@@ -1138,8 +1159,8 @@ UnitDependency unit_mount_dependency_type_to_dependency_type(UnitMountDependency
 
 /* Like LOG_MESSAGE(), but with the unit name prefixed. */
 #define LOG_UNIT_MESSAGE(unit, fmt, ...) LOG_MESSAGE("%s: " fmt, (unit)->id, ##__VA_ARGS__)
-#define LOG_UNIT_ID(unit) LOG_ITEM("%s%s", (unit)->manager->unit_log_field, (unit)->id)
-#define LOG_UNIT_INVOCATION_ID(unit) LOG_ITEM("%s%s", (unit)->manager->invocation_log_field, (unit)->invocation_id_string)
+#define LOG_UNIT_ID(unit) LOG_ITEM("%s%s", unit_log_field((unit)), (unit)->id)
+#define LOG_UNIT_INVOCATION_ID(unit) LOG_ITEM("%s%s", unit_invocation_log_field((unit)), (unit)->invocation_id_string)
 
 const char* collect_mode_to_string(CollectMode m) _const_;
 CollectMode collect_mode_from_string(const char *s) _pure_;
@@ -1198,8 +1219,8 @@ typedef struct UnitForEachDependencyData {
 #define _LOG_CONTEXT_PUSH_UNIT(unit, u, c)                                                              \
         const Unit *u = (unit);                                                                         \
         const ExecContext *c = unit_get_exec_context(u);                                                \
-        LOG_CONTEXT_PUSH_KEY_VALUE(u->manager->unit_log_field, u->id);                                  \
-        LOG_CONTEXT_PUSH_KEY_VALUE(u->manager->invocation_log_field, u->invocation_id_string);          \
+        LOG_CONTEXT_PUSH_KEY_VALUE(unit_log_field(u), u->id);                                           \
+        LOG_CONTEXT_PUSH_KEY_VALUE(unit_invocation_log_field(u), u->invocation_id_string);              \
         LOG_CONTEXT_PUSH_IOV(c ? c->log_extra_fields : NULL, c ? c->n_log_extra_fields : 0);            \
         LOG_CONTEXT_SET_LOG_LEVEL(c->log_level_max >= 0 ? c->log_level_max : log_get_max_level())
 
diff --git a/src/coredump/coredumpctl.c b/src/coredump/coredumpctl.c
index f01db21f88..f44fc706b2 100644
--- a/src/coredump/coredumpctl.c
+++ b/src/coredump/coredumpctl.c
@@ -25,6 +25,7 @@
 #include "format-table.h"
 #include "fs-util.h"
 #include "glob-util.h"
+#include "image-policy.h"
 #include "journal-internal.h"
 #include "journal-util.h"
 #include "json-util.h"
diff --git a/src/cryptsetup/cryptsetup-pkcs11.h b/src/cryptsetup/cryptsetup-pkcs11.h
index 83a2b54be3..98fd3bcb3d 100644
--- a/src/cryptsetup/cryptsetup-pkcs11.h
+++ b/src/cryptsetup/cryptsetup-pkcs11.h
@@ -3,6 +3,7 @@
 
 #include <sys/types.h>
 
+#include "ask-password-api.h"
 #include "cryptsetup-util.h"
 #include "log.h"
 #include "time-util.h"
diff --git a/src/cryptsetup/cryptsetup-tokens/cryptsetup-token.h b/src/cryptsetup/cryptsetup-tokens/cryptsetup-token.h
index effd9d887c..c1ccb5ed31 100644
--- a/src/cryptsetup/cryptsetup-tokens/cryptsetup-token.h
+++ b/src/cryptsetup/cryptsetup-tokens/cryptsetup-token.h
@@ -1,6 +1,10 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
+#include <stddef.h>
+
+struct crypt_device;
+
 /* for more information see libcryptsetup.h crypt-tokens section */
 
 const char* cryptsetup_token_version(void);
diff --git a/src/cryptsetup/cryptsetup-tokens/luks2-pkcs11.h b/src/cryptsetup/cryptsetup-tokens/luks2-pkcs11.h
index 41ce9f0608..640685ce6f 100644
--- a/src/cryptsetup/cryptsetup-tokens/luks2-pkcs11.h
+++ b/src/cryptsetup/cryptsetup-tokens/luks2-pkcs11.h
@@ -2,6 +2,8 @@
 
 #pragma once
 
+#include <stddef.h>
+
 struct crypt_device;
 
 int acquire_luks2_key(
diff --git a/src/firstboot/firstboot.c b/src/firstboot/firstboot.c
index e324af8cfc..279b62bfd4 100644
--- a/src/firstboot/firstboot.c
+++ b/src/firstboot/firstboot.c
@@ -26,6 +26,7 @@
 #include "fs-util.h"
 #include "glyph-util.h"
 #include "hostname-util.h"
+#include "image-policy.h"
 #include "kbd-util.h"
 #include "libcrypt-util.h"
 #include "locale-util.h"
diff --git a/src/fundamental/iovec-util-fundamental.h b/src/fundamental/iovec-util-fundamental.h
index 4214afea9a..6b658c8958 100644
--- a/src/fundamental/iovec-util-fundamental.h
+++ b/src/fundamental/iovec-util-fundamental.h
@@ -1,7 +1,13 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
+#if !SD_BOOT
+#include <stdlib.h>
+#include <sys/uio.h>
+#endif
+
 #include "assert-fundamental.h"
+#include "macro-fundamental.h"
 
 #if SD_BOOT
 /* struct iovec is a POSIX userspace construct. Let's introduce it also in EFI mode, it's just so useful */
diff --git a/src/home/homed-home-bus.c b/src/home/homed-home-bus.c
index 2214496dc0..903644ffd2 100644
--- a/src/home/homed-home-bus.c
+++ b/src/home/homed-home-bus.c
@@ -10,6 +10,7 @@
 #include "homed-bus.h"
 #include "homed-home-bus.h"
 #include "homed-home.h"
+#include "homed-manager.h"
 #include "log.h"
 #include "strv.h"
 #include "user-record-util.h"
diff --git a/src/home/homed-home.c b/src/home/homed-home.c
index 0b61b08abf..6f0bcc65c3 100644
--- a/src/home/homed-home.c
+++ b/src/home/homed-home.c
@@ -21,6 +21,7 @@
 #include "home-util.h"
 #include "homed-home.h"
 #include "homed-home-bus.h"
+#include "homed-manager.h"
 #include "json-util.h"
 #include "log.h"
 #include "memfd-util.h"
diff --git a/src/home/homed-home.h b/src/home/homed-home.h
index dfd64461fc..7d29e554a3 100644
--- a/src/home/homed-home.h
+++ b/src/home/homed-home.h
@@ -1,10 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-typedef struct Home Home;
-
 #include "hashmap.h"
-#include "homed-manager.h"
 #include "homed-operation.h"
 #include "list.h"
 #include "ordered-set.h"
@@ -12,6 +9,8 @@ typedef struct Home Home;
 #include "stat-util.h"
 #include "user-record.h"
 
+typedef struct Manager Manager;
+
 typedef enum HomeState {
         HOME_UNFIXATED,               /* home exists, but local record does not */
         HOME_ABSENT,                  /* local record exists, but home does not */
@@ -108,7 +107,7 @@ static inline bool HOME_STATE_MAY_RETRY_DEACTIVATE(HomeState state) {
                       HOME_AUTHENTICATING_FOR_ACQUIRE);
 }
 
-struct Home {
+typedef struct Home {
         Manager *manager;
 
         /* The fields this record can be looked up by. This is kinda redundant, as the same information is
@@ -180,7 +179,7 @@ struct Home {
 
         /* Whether a rebalance operation is pending */
         bool rebalance_pending;
-};
+} Home;
 
 int home_new(Manager *m, UserRecord *hr, const char *sysfs, Home **ret);
 Home *home_free(Home *h);
diff --git a/src/home/homed-manager-bus.h b/src/home/homed-manager-bus.h
index 7db29fa88f..56aca18b7d 100644
--- a/src/home/homed-manager-bus.h
+++ b/src/home/homed-manager-bus.h
@@ -1,6 +1,6 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include "bus-util.h"
+#include "bus-object.h"
 
 extern const BusObjectImplementation manager_object;
diff --git a/src/home/homed-manager.h b/src/home/homed-manager.h
index 2b4bd38adb..f8490a5639 100644
--- a/src/home/homed-manager.h
+++ b/src/home/homed-manager.h
@@ -8,8 +8,6 @@
 #include "sd-event.h"
 #include "sd-varlink.h"
 
-typedef struct Manager Manager;
-
 #include "hashmap.h"
 #include "homed-home.h"
 
@@ -25,7 +23,7 @@ typedef enum RebalanceState {
         _REBALANCE_STATE_INVALID = -1,
 } RebalanceState;
 
-struct Manager {
+typedef struct Manager {
         sd_event *event;
         sd_bus *bus;
 
@@ -68,7 +66,7 @@ struct Manager {
          * running a rebalancing operation for. 'rebalance_queued_method_calls' are the method calls that
          * have been queued since then and that we'll operate on once we complete the current run. */
         Set *rebalance_pending_method_calls, *rebalance_queued_method_calls;
-};
+} Manager;
 
 int manager_new(Manager **ret);
 Manager* manager_free(Manager *m);
diff --git a/src/home/homework-cifs.c b/src/home/homework-cifs.c
index e10ef9ccdd..0cdf89f768 100644
--- a/src/home/homework-cifs.c
+++ b/src/home/homework-cifs.c
@@ -9,6 +9,7 @@
 #include "fs-util.h"
 #include "homework-cifs.h"
 #include "homework-mount.h"
+#include "log.h"
 #include "memfd-util.h"
 #include "mkdir.h"
 #include "mount-util.h"
diff --git a/src/home/homework-directory.c b/src/home/homework-directory.c
index 37bdba30a3..e471a4a92a 100644
--- a/src/home/homework-directory.c
+++ b/src/home/homework-directory.c
@@ -8,6 +8,7 @@
 #include "homework-directory.h"
 #include "homework-mount.h"
 #include "homework-quota.h"
+#include "log.h"
 #include "mkdir.h"
 #include "mount-util.h"
 #include "path-util.h"
diff --git a/src/home/homework-fscrypt.c b/src/home/homework-fscrypt.c
index 7574b5f942..663138988a 100644
--- a/src/home/homework-fscrypt.c
+++ b/src/home/homework-fscrypt.c
@@ -12,6 +12,7 @@
 #include "homework-mount.h"
 #include "homework-quota.h"
 #include "keyring-util.h"
+#include "log.h"
 #include "memory-util.h"
 #include "missing_fs.h"
 #include "missing_keyctl.h"
diff --git a/src/home/homework-mount.c b/src/home/homework-mount.c
index 52115d86be..7f027895c8 100644
--- a/src/home/homework-mount.c
+++ b/src/home/homework-mount.c
@@ -10,6 +10,7 @@
 #include "home-util.h"
 #include "homework-mount.h"
 #include "homework.h"
+#include "log.h"
 #include "missing_syscall.h"
 #include "mkdir.h"
 #include "mount-util.h"
diff --git a/src/home/homework-mount.h b/src/home/homework-mount.h
index 255df26c9a..615b7d36e7 100644
--- a/src/home/homework-mount.h
+++ b/src/home/homework-mount.h
@@ -2,6 +2,7 @@
 #pragma once
 
 #include <stdbool.h>
+#include <sys/types.h>
 
 int home_mount_node(const char *node, const char *fstype, bool discard, unsigned long flags, const char *extra_mount_options);
 int home_unshare_and_mkdir(void);
diff --git a/src/import/export-raw.h b/src/import/export-raw.h
index 27009e4e35..7c95262647 100644
--- a/src/import/export-raw.h
+++ b/src/import/export-raw.h
@@ -4,7 +4,7 @@
 #include "sd-event.h"
 
 #include "import-compress.h"
-#include "macro.h"
+#include "memory-util.h"
 
 typedef struct RawExport RawExport;
 
diff --git a/src/import/export-tar.h b/src/import/export-tar.h
index 3b55d12c1f..729b9ef736 100644
--- a/src/import/export-tar.h
+++ b/src/import/export-tar.h
@@ -4,7 +4,7 @@
 #include "sd-event.h"
 
 #include "import-compress.h"
-#include "macro.h"
+#include "memory-util.h"
 
 typedef struct TarExport TarExport;
 
diff --git a/src/import/import-common.h b/src/import/import-common.h
index 219802492d..d7fb77a070 100644
--- a/src/import/import-common.h
+++ b/src/import/import-common.h
@@ -1,6 +1,8 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
+#include <errno.h>
+#include <stdbool.h>
 #include <sys/types.h>
 
 #include "sd-event.h"
diff --git a/src/import/import-raw.c b/src/import/import-raw.c
index 033f5aeb65..3685904e03 100644
--- a/src/import/import-raw.c
+++ b/src/import/import-raw.c
@@ -13,6 +13,7 @@
 #include "import-common.h"
 #include "import-compress.h"
 #include "import-raw.h"
+#include "import-util.h"
 #include "install-file.h"
 #include "io-util.h"
 #include "log.h"
diff --git a/src/import/import-raw.h b/src/import/import-raw.h
index 63384eb171..1feed79a53 100644
--- a/src/import/import-raw.h
+++ b/src/import/import-raw.h
@@ -4,8 +4,7 @@
 #include "sd-event.h"
 
 #include "import-common.h"
-#include "import-util.h"
-#include "macro.h"
+#include "memory-util.h"
 
 typedef struct RawImport RawImport;
 
diff --git a/src/import/import-tar.c b/src/import/import-tar.c
index 7cad83ff00..a2e7eda51b 100644
--- a/src/import/import-tar.c
+++ b/src/import/import-tar.c
@@ -13,6 +13,7 @@
 #include "import-common.h"
 #include "import-compress.h"
 #include "import-tar.h"
+#include "import-util.h"
 #include "install-file.h"
 #include "io-util.h"
 #include "log.h"
diff --git a/src/import/import-tar.h b/src/import/import-tar.h
index 63b0bd4da6..d90ba1199a 100644
--- a/src/import/import-tar.h
+++ b/src/import/import-tar.h
@@ -4,8 +4,7 @@
 #include "sd-event.h"
 
 #include "import-common.h"
-#include "import-util.h"
-#include "macro.h"
+#include "memory-util.h"
 
 typedef struct TarImport TarImport;
 
diff --git a/src/import/pull-job.h b/src/import/pull-job.h
index 0bbac0ca8a..6e471ffc1f 100644
--- a/src/import/pull-job.h
+++ b/src/import/pull-job.h
@@ -5,9 +5,7 @@
 
 #include "curl-util.h"
 #include "import-compress.h"
-#include "macro.h"
 #include "openssl-util.h"
-#include "pull-common.h"
 
 typedef struct PullJob PullJob;
 
diff --git a/src/journal-remote/journal-upload.c b/src/journal-remote/journal-upload.c
index 7e866aea0a..7bf10f4de9 100644
--- a/src/journal-remote/journal-upload.c
+++ b/src/journal-remote/journal-upload.c
@@ -1,6 +1,5 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include <curl/curl.h>
 #include <fcntl.h>
 #include <getopt.h>
 #include <stdio.h>
diff --git a/src/journal-remote/journal-upload.h b/src/journal-remote/journal-upload.h
index 67cec92dfe..cd3c7a7fbe 100644
--- a/src/journal-remote/journal-upload.h
+++ b/src/journal-remote/journal-upload.h
@@ -2,6 +2,7 @@
 
 #pragma once
 
+#include <curl/curl.h>
 #include <inttypes.h>
 
 #include "sd-event.h"
diff --git a/src/journal-remote/microhttpd-util.h b/src/journal-remote/microhttpd-util.h
index bb888e8aed..57396ad9b6 100644
--- a/src/journal-remote/microhttpd-util.h
+++ b/src/journal-remote/microhttpd-util.h
@@ -4,7 +4,7 @@
 #include <microhttpd.h>
 #include <stdarg.h>
 
-#include "macro.h"
+#include "memory-util.h"
 
 /* Those defines are added when options are renamed. If the old names
  * are not '#define'd, then they are not deprecated yet and there are
diff --git a/src/journal/journalctl.c b/src/journal/journalctl.c
index 37cda77554..400894e2a2 100644
--- a/src/journal/journalctl.c
+++ b/src/journal/journalctl.c
@@ -7,6 +7,7 @@
 #include "build.h"
 #include "glob-util.h"
 #include "id128-print.h"
+#include "image-policy.h"
 #include "journalctl.h"
 #include "journalctl-authenticate.h"
 #include "journalctl-catalog.h"
diff --git a/src/journal/journald-audit.c b/src/journal/journald-audit.c
index 55f8ce7140..05c40a7885 100644
--- a/src/journal/journald-audit.c
+++ b/src/journal/journald-audit.c
@@ -10,6 +10,7 @@
 #include "iovec-util.h"
 #include "journal-internal.h"
 #include "journald-audit.h"
+#include "journald-server.h"
 #include "missing_audit.h"
 #include "string-util.h"
 
diff --git a/src/journal/journald-audit.h b/src/journal/journald-audit.h
index 79f3da90c1..49223dbf4a 100644
--- a/src/journal/journald-audit.h
+++ b/src/journal/journald-audit.h
@@ -1,9 +1,10 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include "journald-server.h"
 #include "socket-util.h"
 
+typedef struct Server Server;
+
 void server_process_audit_message(Server *s, const void *buffer, size_t buffer_size, const struct ucred *ucred, const union sockaddr_union *sa, socklen_t salen);
 
 void process_audit_string(Server *s, int type, const char *data, size_t size);
diff --git a/src/journal/journald-client.c b/src/journal/journald-client.c
index fdba70c3d5..771b51b9c1 100644
--- a/src/journal/journald-client.c
+++ b/src/journal/journald-client.c
@@ -3,6 +3,8 @@
 #include "cgroup-util.h"
 #include "errno-util.h"
 #include "journald-client.h"
+#include "journald-context.h"
+#include "log.h"
 #include "nulstr-util.h"
 #include "pcre2-util.h"
 #include "strv.h"
diff --git a/src/journal/journald-client.h b/src/journal/journald-client.h
index 629cd41c7d..700b43db7d 100644
--- a/src/journal/journald-client.h
+++ b/src/journal/journald-client.h
@@ -1,7 +1,9 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include "journald-context.h"
+#include <stddef.h>
+
+typedef struct ClientContext ClientContext;
 
 int client_context_read_log_filter_patterns(ClientContext *c, const char *cgroup);
 int client_context_check_keep_log(ClientContext *c, const char *message, size_t len);
diff --git a/src/journal/journald-console.h b/src/journal/journald-console.h
index 0a26f9c876..a4894ce4a5 100644
--- a/src/journal/journald-console.h
+++ b/src/journal/journald-console.h
@@ -1,6 +1,8 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include "journald-server.h"
+#include <sys/socket.h>
+
+typedef struct Server Server;
 
 void server_forward_console(Server *s, int priority, const char *identifier, const char *message, const struct ucred *ucred);
diff --git a/src/journal/journald-context.c b/src/journal/journald-context.c
index 1d5aca1d87..79e52be279 100644
--- a/src/journal/journald-context.c
+++ b/src/journal/journald-context.c
@@ -16,6 +16,7 @@
 #include "journal-util.h"
 #include "journald-client.h"
 #include "journald-context.h"
+#include "journald-server.h"
 #include "parse-util.h"
 #include "path-util.h"
 #include "process-util.h"
diff --git a/src/journal/journald-context.h b/src/journal/journald-context.h
index 34637f85e4..e908540eb4 100644
--- a/src/journal/journald-context.h
+++ b/src/journal/journald-context.h
@@ -4,6 +4,7 @@
 #include <inttypes.h>
 #include <sys/socket.h>
 #include <sys/types.h>
+#include <syslog.h>
 
 #include "sd-id128.h"
 
@@ -11,11 +12,9 @@
 #include "set.h"
 #include "time-util.h"
 
-typedef struct ClientContext ClientContext;
+typedef struct Server Server;
 
-#include "journald-server.h"
-
-struct ClientContext {
+typedef struct ClientContext {
         unsigned n_ref;
         unsigned lru_index;
         usec_t timestamp;
@@ -60,7 +59,7 @@ struct ClientContext {
 
         Set *log_filter_allowed_patterns;
         Set *log_filter_denied_patterns;
-};
+} ClientContext;
 
 int client_context_get(
                 Server *s,
diff --git a/src/journal/journald-kmsg.h b/src/journal/journald-kmsg.h
index bd288c57a2..dcbe0b510c 100644
--- a/src/journal/journald-kmsg.h
+++ b/src/journal/journald-kmsg.h
@@ -1,7 +1,10 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include "journald-server.h"
+#include <stddef.h>
+#include <sys/socket.h>
+
+typedef struct Server Server;
 
 int server_open_dev_kmsg(Server *s);
 int server_flush_dev_kmsg(Server *s);
diff --git a/src/journal/journald-native.h b/src/journal/journald-native.h
index 10db267966..3807b2ca97 100644
--- a/src/journal/journald-native.h
+++ b/src/journal/journald-native.h
@@ -1,7 +1,10 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include "journald-server.h"
+#include <stddef.h>
+#include <sys/socket.h>
+
+typedef struct Server Server;
 
 void server_process_native_message(
                 Server *s,
diff --git a/src/journal/journald-server.c b/src/journal/journald-server.c
index 4397ef6e3f..6a8c850540 100644
--- a/src/journal/journald-server.c
+++ b/src/journal/journald-server.c
@@ -23,6 +23,7 @@
 #include "event-util.h"
 #include "extract-word.h"
 #include "fd-util.h"
+#include "fdset.h"
 #include "fileio.h"
 #include "format-util.h"
 #include "fs-util.h"
diff --git a/src/journal/journald-server.h b/src/journal/journald-server.h
index ea3bf8b3f0..e565769779 100644
--- a/src/journal/journald-server.h
+++ b/src/journal/journald-server.h
@@ -7,8 +7,6 @@
 #include "sd-event.h"
 #include "sd-varlink.h"
 
-typedef struct Server Server;
-
 #include "common-signal.h"
 #include "conf-parser.h"
 #include "hashmap.h"
@@ -68,7 +66,7 @@ typedef struct SeqnumData {
         uint64_t seqnum;
 } SeqnumData;
 
-struct Server {
+typedef struct Server {
         char *namespace;
 
         int syslog_fd;
@@ -185,7 +183,7 @@ struct Server {
         ClientContext *pid1_context; /* the context of PID 1 */
 
         sd_varlink_server *varlink_server;
-};
+} Server;
 
 #define SERVER_MACHINE_ID(s) ((s)->machine_id_field + STRLEN("_MACHINE_ID="))
 
diff --git a/src/journal/journald-socket.c b/src/journal/journald-socket.c
index a079624f3c..9f419d393a 100644
--- a/src/journal/journald-socket.c
+++ b/src/journal/journald-socket.c
@@ -6,6 +6,7 @@
 
 #include "fd-util.h"
 #include "iovec-util.h"
+#include "journald-server.h"
 #include "journald-socket.h"
 #include "log.h"
 #include "macro.h"
diff --git a/src/journal/journald-socket.h b/src/journal/journald-socket.h
index 23739538c8..3cddace166 100644
--- a/src/journal/journald-socket.h
+++ b/src/journal/journald-socket.h
@@ -1,7 +1,10 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include "journald-server.h"
-#include "socket-util.h"
+#include <sys/socket.h>
+
+#include "time-util.h"
+
+typedef struct Server Server;
 
 int server_forward_socket(Server *s, const struct iovec *iovec, size_t n, const dual_timestamp *ts, int priority);
diff --git a/src/journal/journald-stream.c b/src/journal/journald-stream.c
index e45765df0c..71b0db639d 100644
--- a/src/journal/journald-stream.c
+++ b/src/journal/journald-stream.c
@@ -16,6 +16,7 @@
 #include "errno-util.h"
 #include "escape.h"
 #include "fd-util.h"
+#include "fdset.h"
 #include "fileio.h"
 #include "fs-util.h"
 #include "iovec-util.h"
diff --git a/src/journal/journald-stream.h b/src/journal/journald-stream.h
index 71d3394ed9..4bb4cbbe2f 100644
--- a/src/journal/journald-stream.h
+++ b/src/journal/journald-stream.h
@@ -1,10 +1,10 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-typedef struct StdoutStream StdoutStream;
-
 #include "fdset.h"
-#include "journald-server.h"
+
+typedef struct Server Server;
+typedef struct StdoutStream StdoutStream;
 
 int server_open_stdout_socket(Server *s, const char *stdout_socket);
 int server_restore_streams(Server *s, FDSet *fds);
diff --git a/src/journal/journald-syslog.h b/src/journal/journald-syslog.h
index 3bc3ffddb8..ccb913d2ca 100644
--- a/src/journal/journald-syslog.h
+++ b/src/journal/journald-syslog.h
@@ -1,7 +1,11 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include "journald-server.h"
+#include <sys/socket.h>
+
+#include "macro.h"
+
+typedef struct Server Server;
 
 int syslog_fixup_facility(int priority) _const_;
 
diff --git a/src/journal/journald-varlink.c b/src/journal/journald-varlink.c
index 5e98b5e5b8..d2ba34c747 100644
--- a/src/journal/journald-varlink.c
+++ b/src/journal/journald-varlink.c
@@ -1,5 +1,6 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
+#include "journald-server.h"
 #include "journald-varlink.h"
 #include "varlink-io.systemd.Journal.h"
 #include "varlink-io.systemd.service.h"
diff --git a/src/journal/journald-varlink.h b/src/journal/journald-varlink.h
index 55c7405af1..ab34e01117 100644
--- a/src/journal/journald-varlink.h
+++ b/src/journal/journald-varlink.h
@@ -1,6 +1,6 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include "journald-server.h"
+typedef struct Server Server;
 
 int server_open_varlink(Server *s, const char *socket, int fd);
diff --git a/src/journal/journald-wall.h b/src/journal/journald-wall.h
index 3f98c35bde..8c19e496f4 100644
--- a/src/journal/journald-wall.h
+++ b/src/journal/journald-wall.h
@@ -3,6 +3,6 @@
 
 #include <sys/socket.h>
 
-#include "journald-server.h"
+typedef struct Server Server;
 
 void server_forward_wall(Server *s, int priority, const char *identifier, const char *message, const struct ucred *ucred);
diff --git a/src/libsystemd/sd-bus/bus-signature.h b/src/libsystemd/sd-bus/bus-signature.h
index 314fcc27c5..0fea750744 100644
--- a/src/libsystemd/sd-bus/bus-signature.h
+++ b/src/libsystemd/sd-bus/bus-signature.h
@@ -2,6 +2,7 @@
 #pragma once
 
 #include <stdbool.h>
+#include <stddef.h>
 
 bool signature_is_single(const char *s, bool allow_dict_entry);
 bool signature_is_pair(const char *s);
diff --git a/src/libsystemd/sd-bus/bus-socket.h b/src/libsystemd/sd-bus/bus-socket.h
index 52bc404625..fc8c1eda09 100644
--- a/src/libsystemd/sd-bus/bus-socket.h
+++ b/src/libsystemd/sd-bus/bus-socket.h
@@ -1,6 +1,8 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
+#include <stdbool.h>
+
 #include "sd-bus.h"
 
 void bus_socket_setup(sd_bus *b);
diff --git a/src/libsystemd/sd-bus/bus-track.h b/src/libsystemd/sd-bus/bus-track.h
index 8dae1f3902..6868cda1e2 100644
--- a/src/libsystemd/sd-bus/bus-track.h
+++ b/src/libsystemd/sd-bus/bus-track.h
@@ -1,5 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
+typedef struct sd_bus_track sd_bus_track;
+
 void bus_track_dispatch(sd_bus_track *track);
 void bus_track_close(sd_bus_track *track);
diff --git a/src/libsystemd/sd-bus/test-bus-vtable.c b/src/libsystemd/sd-bus/test-bus-vtable.c
index 8a23f28931..bc6be901ad 100644
--- a/src/libsystemd/sd-bus/test-bus-vtable.c
+++ b/src/libsystemd/sd-bus/test-bus-vtable.c
@@ -9,6 +9,7 @@
 #include <errno.h>
 #include <stdio.h>
 
+#include "sd-bus.h"
 #include "sd-bus-vtable.h"
 
 #ifndef __cplusplus
diff --git a/src/libsystemd/sd-bus/test-vtable-data.h b/src/libsystemd/sd-bus/test-vtable-data.h
index 7269a49945..0bb1ae7343 100644
--- a/src/libsystemd/sd-bus/test-vtable-data.h
+++ b/src/libsystemd/sd-bus/test-vtable-data.h
@@ -1,6 +1,8 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-/* This is meant to be included in other files, hence no headers */
+#include <stdbool.h>
+
+#include "sd-bus-vtable.h"
 
 struct context {
         bool quit;
diff --git a/src/libsystemd/sd-journal/mmap-cache.h b/src/libsystemd/sd-journal/mmap-cache.h
index 1fbc236bda..3e088ef8ef 100644
--- a/src/libsystemd/sd-journal/mmap-cache.h
+++ b/src/libsystemd/sd-journal/mmap-cache.h
@@ -6,6 +6,7 @@
 #include <sys/stat.h>
 
 #include "journal-def.h"
+#include "memory-util.h"
 
 typedef struct MMapCache MMapCache;
 typedef struct MMapFileDescriptor MMapFileDescriptor;
diff --git a/src/libsystemd/sd-json/json-internal.h b/src/libsystemd/sd-json/json-internal.h
index 5117b39f45..9ecdd6bb1a 100644
--- a/src/libsystemd/sd-json/json-internal.h
+++ b/src/libsystemd/sd-json/json-internal.h
@@ -2,8 +2,12 @@
 
 #pragma once
 
+#include <stdbool.h>
+
 #include "sd-json.h"
 
+#include "macro.h"
+
 /* This header should include all prototypes only the JSON parser itself and
  * its tests need access to. Normal code consuming the JSON parser should not
  * interface with this. */
diff --git a/src/libsystemd/sd-netlink/netlink-slot.h b/src/libsystemd/sd-netlink/netlink-slot.h
index 79de817262..4098061d31 100644
--- a/src/libsystemd/sd-netlink/netlink-slot.h
+++ b/src/libsystemd/sd-netlink/netlink-slot.h
@@ -1,8 +1,12 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
+#include <stdbool.h>
+
 #include "sd-netlink.h"
 
+#include "netlink-internal.h"
+
 int netlink_slot_allocate(
                 sd_netlink *nl,
                 bool floating,
diff --git a/src/libsystemd/sd-varlink/varlink-idl-util.h b/src/libsystemd/sd-varlink/varlink-idl-util.h
index 8c9274eefa..9c5df26d12 100644
--- a/src/libsystemd/sd-varlink/varlink-idl-util.h
+++ b/src/libsystemd/sd-varlink/varlink-idl-util.h
@@ -4,7 +4,7 @@
 #include "sd-varlink.h"
 #include "sd-varlink-idl.h"
 
-#include "macro.h"
+#include "memory-util.h"
 
 int varlink_idl_parse(const char *text, unsigned *ret_line, unsigned *ret_column, sd_varlink_interface **ret);
 sd_varlink_interface* varlink_interface_free(sd_varlink_interface *interface);
diff --git a/src/libudev/libudev-list-internal.h b/src/libudev/libudev-list-internal.h
index 00c1d40763..dd4fcbc771 100644
--- a/src/libudev/libudev-list-internal.h
+++ b/src/libudev/libudev-list-internal.h
@@ -3,7 +3,7 @@
 
 #include "libudev.h"
 
-#include "macro.h"
+#include "memory-util.h"
 
 struct udev_list;
 
diff --git a/src/login/logind-action.c b/src/login/logind-action.c
index c663d2493d..9d1e392d7b 100644
--- a/src/login/logind-action.c
+++ b/src/login/logind-action.c
@@ -11,6 +11,7 @@
 #include "bus-util.h"
 #include "conf-parser.h"
 #include "format-util.h"
+#include "logind.h"
 #include "logind-action.h"
 #include "logind-dbus.h"
 #include "logind-seat-dbus.h"
diff --git a/src/login/logind-action.h b/src/login/logind-action.h
index 800f4e8309..e251701a8d 100644
--- a/src/login/logind-action.h
+++ b/src/login/logind-action.h
@@ -2,6 +2,8 @@
 #pragma once
 
 #include "conf-parser.h"
+#include "logind-inhibit.h"
+#include "sleep-config.h"
 
 typedef enum HandleAction {
         HANDLE_IGNORE,
@@ -41,10 +43,6 @@ typedef enum HandleActionSleepMask {
 
 #define HANDLE_ACTION_SLEEP_MASK_DEFAULT (HANDLE_SLEEP_SUSPEND_THEN_HIBERNATE_MASK|HANDLE_SLEEP_SUSPEND_MASK|HANDLE_SLEEP_HIBERNATE_MASK)
 
-#include "logind-inhibit.h"
-#include "logind.h"
-#include "sleep-config.h"
-
 static inline bool handle_action_valid(HandleAction a) {
         return a >= 0 && a < _HANDLE_ACTION_MAX;
 }
diff --git a/src/login/logind-brightness.h b/src/login/logind-brightness.h
index f1c77757a8..d0e8580032 100644
--- a/src/login/logind-brightness.h
+++ b/src/login/logind-brightness.h
@@ -4,6 +4,6 @@
 #include "sd-bus.h"
 #include "sd-device.h"
 
-#include "logind.h"
+typedef struct Manager Manager;
 
 int manager_write_brightness(Manager *m, sd_device *device, uint32_t brightness, sd_bus_message *message);
diff --git a/src/login/logind-button.c b/src/login/logind-button.c
index 2b6b1dc463..4d4853b570 100644
--- a/src/login/logind-button.c
+++ b/src/login/logind-button.c
@@ -11,6 +11,7 @@
 #include "alloc-util.h"
 #include "async.h"
 #include "fd-util.h"
+#include "logind.h"
 #include "logind-button.h"
 #include "logind-dbus.h"
 #include "string-util.h"
diff --git a/src/login/logind-button.h b/src/login/logind-button.h
index 125e49dd08..4af54cb33d 100644
--- a/src/login/logind-button.h
+++ b/src/login/logind-button.h
@@ -1,9 +1,11 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-typedef struct Button Button;
+#include <stdbool.h>
 
-#include "logind.h"
+#include "sd-event.h"
+
+typedef struct Manager Manager;
 
 typedef enum ButtonModifierMask {
         BUTTON_MODIFIER_NONE        = 0,
@@ -19,7 +21,7 @@ typedef enum ButtonModifierMask {
 #define BUTTON_MODIFIER_HAS_CTRL(modifier) (((modifier) & (BUTTON_MODIFIER_LEFT_CTRL|BUTTON_MODIFIER_RIGHT_CTRL)) != 0)
 #define BUTTON_MODIFIER_HAS_ALT(modifier) (((modifier) & (BUTTON_MODIFIER_LEFT_ALT|BUTTON_MODIFIER_RIGHT_ALT)) != 0)
 
-struct Button {
+typedef struct Button {
         Manager *manager;
 
         sd_event_source *io_event_source;
@@ -33,7 +35,7 @@ struct Button {
 
         bool lid_closed;
         bool docked;
-};
+} Button;
 
 Button* button_new(Manager *m, const char *name);
 Button *button_free(Button *b);
diff --git a/src/login/logind-core.c b/src/login/logind-core.c
index 1619276520..80e777b505 100644
--- a/src/login/logind-core.c
+++ b/src/login/logind-core.c
@@ -20,6 +20,11 @@
 #include "fd-util.h"
 #include "limits-util.h"
 #include "logind.h"
+#include "logind-button.h"
+#include "logind-device.h"
+#include "logind-seat.h"
+#include "logind-session.h"
+#include "logind-user.h"
 #include "logind-utmp.h"
 #include "parse-util.h"
 #include "path-util.h"
diff --git a/src/login/logind-dbus.c b/src/login/logind-dbus.c
index 37eb842e20..c6eac67c0a 100644
--- a/src/login/logind-dbus.c
+++ b/src/login/logind-dbus.c
@@ -32,12 +32,15 @@
 #include "fileio.h"
 #include "format-util.h"
 #include "fs-util.h"
+#include "login-util.h"
 #include "logind.h"
 #include "logind-action.h"
 #include "logind-dbus.h"
 #include "logind-polkit.h"
+#include "logind-seat.h"
 #include "logind-seat-dbus.h"
 #include "logind-session-dbus.h"
+#include "logind-user.h"
 #include "logind-user-dbus.h"
 #include "logind-utmp.h"
 #include "mkdir-label.h"
diff --git a/src/login/logind-dbus.h b/src/login/logind-dbus.h
index afbf523ede..0cf39c4ae5 100644
--- a/src/login/logind-dbus.h
+++ b/src/login/logind-dbus.h
@@ -4,10 +4,13 @@
 #include "sd-bus.h"
 
 #include "bus-object.h"
-#include "logind-action.h"
 #include "logind-session.h"
-#include "logind-user.h"
-#include "logind.h"
+#include "macro.h"
+
+typedef struct Manager Manager;
+typedef struct User User;
+typedef struct Seat Seat;
+typedef struct HandleActionData HandleActionData;
 
 int manager_get_session_from_creds(Manager *m, sd_bus_message *message, const char *name, sd_bus_error *error, Session **ret);
 int manager_get_user_from_creds(Manager *m, sd_bus_message *message, uid_t uid, sd_bus_error *error, User **ret);
diff --git a/src/login/logind-device.c b/src/login/logind-device.c
index 376cd0d42f..5f6b58b840 100644
--- a/src/login/logind-device.c
+++ b/src/login/logind-device.c
@@ -3,8 +3,11 @@
 #include <string.h>
 
 #include "alloc-util.h"
+#include "logind.h"
 #include "logind-device.h"
+#include "logind-seat.h"
 #include "logind-seat-dbus.h"
+#include "logind-session-device.h"
 
 Device* device_new(Manager *m, const char *sysfs, bool master) {
         Device *d;
diff --git a/src/login/logind-device.h b/src/login/logind-device.h
index f96c4dbfb6..e6afe378a2 100644
--- a/src/login/logind-device.h
+++ b/src/login/logind-device.h
@@ -1,11 +1,13 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-typedef struct Device Device;
-
 #include "list.h"
-#include "logind-seat.h"
-#include "logind-session-device.h"
+#include "time-util.h"
+
+typedef struct Device Device;
+typedef struct Manager Manager;
+typedef struct Seat Seat;
+typedef struct SessionDevice SessionDevice;
 
 struct Device {
         Manager *manager;
diff --git a/src/login/logind-gperf.gperf b/src/login/logind-gperf.gperf
index f09387e6a8..bd64b8352e 100644
--- a/src/login/logind-gperf.gperf
+++ b/src/login/logind-gperf.gperf
@@ -7,6 +7,7 @@ _Pragma("GCC diagnostic ignored \"-Wzero-as-null-pointer-constant\"")
 #include <stddef.h>
 #include "conf-parser.h"
 #include "logind.h"
+#include "logind-user.h"
 %}
 struct ConfigPerfItem;
 %null_strings
diff --git a/src/login/logind-inhibit.c b/src/login/logind-inhibit.c
index c0ae173783..86bae8f0b7 100644
--- a/src/login/logind-inhibit.c
+++ b/src/login/logind-inhibit.c
@@ -17,6 +17,7 @@
 #include "format-util.h"
 #include "fs-util.h"
 #include "io-util.h"
+#include "logind.h"
 #include "logind-dbus.h"
 #include "logind-inhibit.h"
 #include "mkdir-label.h"
diff --git a/src/login/logind-inhibit.h b/src/login/logind-inhibit.h
index ae91e2d402..1f115410f1 100644
--- a/src/login/logind-inhibit.h
+++ b/src/login/logind-inhibit.h
@@ -1,9 +1,13 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
+#include "sd-event.h"
+
 #include "pidref.h"
+#include "time-util.h"
 
 typedef struct Inhibitor Inhibitor;
+typedef struct Manager Manager;
 
 typedef enum InhibitWhat {
         INHIBIT_SHUTDOWN             = 1 << 0,
@@ -26,8 +30,6 @@ typedef enum InhibitMode {
         _INHIBIT_MODE_INVALID = -EINVAL,
 } InhibitMode;
 
-#include "logind.h"
-
 struct Inhibitor {
         Manager *manager;
 
diff --git a/src/login/logind-polkit.c b/src/login/logind-polkit.c
index 5b6c256a08..1aa76e225d 100644
--- a/src/login/logind-polkit.c
+++ b/src/login/logind-polkit.c
@@ -1,6 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
 #include "bus-polkit.h"
+#include "logind.h"
 #include "logind-polkit.h"
 #include "user-util.h"
 
diff --git a/src/login/logind-polkit.h b/src/login/logind-polkit.h
index 9ec01a3c45..7619ce2d90 100644
--- a/src/login/logind-polkit.h
+++ b/src/login/logind-polkit.h
@@ -4,6 +4,7 @@
 #include "sd-bus.h"
 
 #include "bus-object.h"
-#include "logind.h"
+
+typedef struct Manager Manager;
 
 int check_polkit_chvt(sd_bus_message *message, Manager *manager, sd_bus_error *error);
diff --git a/src/login/logind-seat-dbus.c b/src/login/logind-seat-dbus.c
index 18acbf25b4..3c027e8fe1 100644
--- a/src/login/logind-seat-dbus.c
+++ b/src/login/logind-seat-dbus.c
@@ -13,6 +13,7 @@
 #include "logind-seat-dbus.h"
 #include "logind-seat.h"
 #include "logind-session-dbus.h"
+#include "logind-user.h"
 #include "logind.h"
 #include "strv.h"
 #include "user-util.h"
diff --git a/src/login/logind-seat-dbus.h b/src/login/logind-seat-dbus.h
index f4bd78e24b..782ee01c60 100644
--- a/src/login/logind-seat-dbus.h
+++ b/src/login/logind-seat-dbus.h
@@ -4,7 +4,9 @@
 #include "sd-bus.h"
 
 #include "bus-object.h"
-#include "logind-seat.h"
+#include "macro.h"
+
+typedef struct Seat Seat;
 
 extern const BusObjectImplementation seat_object;
 
diff --git a/src/login/logind-seat.c b/src/login/logind-seat.c
index 50c2b21b47..06f32ecec5 100644
--- a/src/login/logind-seat.c
+++ b/src/login/logind-seat.c
@@ -14,9 +14,14 @@
 #include "fileio.h"
 #include "format-util.h"
 #include "fs-util.h"
+#include "logind.h"
+#include "logind-device.h"
 #include "logind-seat-dbus.h"
 #include "logind-seat.h"
+#include "logind-session.h"
 #include "logind-session-dbus.h"
+#include "logind-session-device.h"
+#include "logind-user.h"
 #include "mkdir-label.h"
 #include "parse-util.h"
 #include "path-util.h"
diff --git a/src/login/logind-seat.h b/src/login/logind-seat.h
index 76a69e6517..4c4a6fa6bd 100644
--- a/src/login/logind-seat.h
+++ b/src/login/logind-seat.h
@@ -1,10 +1,15 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-typedef struct Seat Seat;
-
 #include "list.h"
-#include "logind-session.h"
+#include "memory-util.h"
+#include "string-util.h"
+#include "time-util.h"
+
+typedef struct Device Device;
+typedef struct Manager Manager;
+typedef struct Seat Seat;
+typedef struct Session Session;
 
 struct Seat {
         Manager *manager;
diff --git a/src/login/logind-session-dbus.c b/src/login/logind-session-dbus.c
index dbbadfedf7..af5e04bce4 100644
--- a/src/login/logind-session-dbus.c
+++ b/src/login/logind-session-dbus.c
@@ -15,10 +15,12 @@
 #include "logind-brightness.h"
 #include "logind-dbus.h"
 #include "logind-polkit.h"
+#include "logind-seat.h"
 #include "logind-seat-dbus.h"
 #include "logind-session-dbus.h"
 #include "logind-session-device.h"
 #include "logind-session.h"
+#include "logind-user.h"
 #include "logind-user-dbus.h"
 #include "logind.h"
 #include "path-util.h"
diff --git a/src/login/logind-session-dbus.h b/src/login/logind-session-dbus.h
index 091ad26292..175e29a93f 100644
--- a/src/login/logind-session-dbus.h
+++ b/src/login/logind-session-dbus.h
@@ -4,7 +4,10 @@
 #include "sd-bus.h"
 
 #include "bus-object.h"
-#include "logind-session.h"
+#include "macro.h"
+
+typedef struct Manager Manager;
+typedef struct Session Session;
 
 extern const BusObjectImplementation session_object;
 
diff --git a/src/login/logind-session-device.c b/src/login/logind-session-device.c
index 1a22a77e8e..984c1c1eeb 100644
--- a/src/login/logind-session-device.c
+++ b/src/login/logind-session-device.c
@@ -15,6 +15,10 @@
 #include "daemon-util.h"
 #include "device-util.h"
 #include "fd-util.h"
+#include "logind.h"
+#include "logind-device.h"
+#include "logind-seat.h"
+#include "logind-session.h"
 #include "logind-session-dbus.h"
 #include "logind-session-device.h"
 #include "missing_drm.h"
diff --git a/src/login/logind-session-device.h b/src/login/logind-session-device.h
index 1c6f12f21b..52cea0f74c 100644
--- a/src/login/logind-session-device.h
+++ b/src/login/logind-session-device.h
@@ -1,18 +1,19 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-typedef enum DeviceType DeviceType;
+#include "list.h"
+#include "memory-util.h"
+
+typedef struct Device Device;
+typedef struct Session Session;
 typedef struct SessionDevice SessionDevice;
 
-#include "list.h"
-#include "logind.h"
-
-enum DeviceType {
+typedef enum DeviceType {
         DEVICE_TYPE_UNKNOWN,
         DEVICE_TYPE_DRM,
         DEVICE_TYPE_EVDEV,
         DEVICE_TYPE_HIDRAW,
-};
+} DeviceType;
 
 struct SessionDevice {
         Session *session;
diff --git a/src/login/logind-session.c b/src/login/logind-session.c
index 7def723723..75ceb650a4 100644
--- a/src/login/logind-session.c
+++ b/src/login/logind-session.c
@@ -24,10 +24,15 @@
 #include "format-util.h"
 #include "fs-util.h"
 #include "io-util.h"
+#include "login-util.h"
+#include "logind.h"
 #include "logind-dbus.h"
+#include "logind-seat.h"
 #include "logind-seat-dbus.h"
 #include "logind-session-dbus.h"
+#include "logind-session-device.h"
 #include "logind-session.h"
+#include "logind-user.h"
 #include "logind-user-dbus.h"
 #include "logind-varlink.h"
 #include "mkdir-label.h"
diff --git a/src/login/logind-session.h b/src/login/logind-session.h
index 56ca70da84..923723479c 100644
--- a/src/login/logind-session.h
+++ b/src/login/logind-session.h
@@ -1,14 +1,20 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-typedef struct Session Session;
-typedef enum KillWhom KillWhom;
+#include "sd-bus.h"
+#include "sd-event.h"
+#include "sd-varlink.h"
 
+#include "hashmap.h"
 #include "list.h"
-#include "login-util.h"
-#include "logind-user.h"
 #include "pidref.h"
 #include "string-util.h"
+#include "time-util.h"
+
+typedef struct Manager Manager;
+typedef struct Seat Seat;
+typedef struct Session Session;
+typedef struct User User;
 
 typedef enum SessionState {
         SESSION_OPENING,  /* Session scope is being created */
@@ -85,12 +91,12 @@ typedef enum SessionType {
 
 #define SESSION_TYPE_IS_GRAPHICAL(type) IN_SET(type, SESSION_X11, SESSION_WAYLAND, SESSION_MIR)
 
-enum KillWhom {
+typedef enum KillWhom {
         KILL_LEADER,
         KILL_ALL,
         _KILL_WHOM_MAX,
         _KILL_WHOM_INVALID = -EINVAL,
-};
+} KillWhom;
 
 typedef enum TTYValidity {
         TTY_FROM_PAM,
diff --git a/src/login/logind-user-dbus.h b/src/login/logind-user-dbus.h
index ba530bede2..33f810f7f5 100644
--- a/src/login/logind-user-dbus.h
+++ b/src/login/logind-user-dbus.h
@@ -3,7 +3,10 @@
 
 #include "sd-bus.h"
 
-#include "logind-user.h"
+#include "bus-object.h"
+#include "macro.h"
+
+typedef struct User User;
 
 extern const BusObjectImplementation user_object;
 
diff --git a/src/login/logind-user.c b/src/login/logind-user.c
index 276d5b86f5..1ef3218826 100644
--- a/src/login/logind-user.c
+++ b/src/login/logind-user.c
@@ -19,7 +19,9 @@
 #include "hashmap.h"
 #include "label-util.h"
 #include "limits-util.h"
+#include "logind.h"
 #include "logind-dbus.h"
+#include "logind-seat.h"
 #include "logind-user-dbus.h"
 #include "logind-user.h"
 #include "mkdir-label.h"
diff --git a/src/login/logind-user.h b/src/login/logind-user.h
index 5c82f490f2..88b5d06bdf 100644
--- a/src/login/logind-user.h
+++ b/src/login/logind-user.h
@@ -1,13 +1,16 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-typedef struct User User;
+#include "sd-event.h"
 
 #include "conf-parser.h"
 #include "list.h"
-#include "logind.h"
 #include "user-record.h"
 
+typedef struct Manager Manager;
+typedef struct Session Session;
+typedef struct User User;
+
 typedef enum UserState {
         USER_OFFLINE,    /* Not logged in at all */
         USER_OPENING,    /* Is logging in */
diff --git a/src/login/logind-utmp.c b/src/login/logind-utmp.c
index 47a293914b..228bcf97d1 100644
--- a/src/login/logind-utmp.c
+++ b/src/login/logind-utmp.c
@@ -1,5 +1,8 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
+#include "log.h"
+#include "logind.h"
+#include "logind-session.h"
 #include "logind-utmp.h"
 #include "path-util.h"
 #include "process-util.h"
diff --git a/src/login/logind-utmp.h b/src/login/logind-utmp.h
index 1358e27840..5309132c77 100644
--- a/src/login/logind-utmp.h
+++ b/src/login/logind-utmp.h
@@ -1,7 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include "logind.h"
+typedef struct Manager Manager;
 
 int manager_read_utmp(Manager *m);
 void manager_connect_utmp(Manager *m);
diff --git a/src/login/logind-varlink.c b/src/login/logind-varlink.c
index ce2b48cdc1..b8181c76f9 100644
--- a/src/login/logind-varlink.c
+++ b/src/login/logind-varlink.c
@@ -6,7 +6,9 @@
 #include "json-util.h"
 #include "logind.h"
 #include "logind-dbus.h"
+#include "logind-seat.h"
 #include "logind-session-dbus.h"
+#include "logind-user.h"
 #include "logind-varlink.h"
 #include "terminal-util.h"
 #include "user-util.h"
diff --git a/src/login/logind-varlink.h b/src/login/logind-varlink.h
index bcf2af4fed..3a8e43d9d9 100644
--- a/src/login/logind-varlink.h
+++ b/src/login/logind-varlink.h
@@ -3,8 +3,8 @@
 
 #include "sd-bus.h"
 
-#include "logind.h"
-#include "logind-session.h"
+typedef struct Manager Manager;
+typedef struct Session Session;
 
 int manager_varlink_init(Manager *m);
 void manager_varlink_done(Manager *m);
diff --git a/src/login/logind.c b/src/login/logind.c
index f1e2ea3c46..e07b9e5296 100644
--- a/src/login/logind.c
+++ b/src/login/logind.c
@@ -25,9 +25,14 @@
 #include "format-util.h"
 #include "fs-util.h"
 #include "logind.h"
+#include "logind-button.h"
 #include "logind-dbus.h"
+#include "logind-device.h"
+#include "logind-seat.h"
 #include "logind-seat-dbus.h"
 #include "logind-session-dbus.h"
+#include "logind-session-device.h"
+#include "logind-user.h"
 #include "logind-user-dbus.h"
 #include "logind-utmp.h"
 #include "logind-varlink.h"
diff --git a/src/login/logind.h b/src/login/logind.h
index 35d4e9c257..7ae30c5b63 100644
--- a/src/login/logind.h
+++ b/src/login/logind.h
@@ -13,18 +13,18 @@
 #include "conf-parser.h"
 #include "hashmap.h"
 #include "list.h"
+#include "logind-action.h"
 #include "set.h"
 #include "time-util.h"
 #include "user-record.h"
 
-typedef struct Manager Manager;
+typedef struct Button Button;
+typedef struct Device Device;
+typedef struct Seat Seat;
+typedef struct Session Session;
+typedef struct User User;
 
-#include "logind-action.h"
-#include "logind-button.h"
-#include "logind-device.h"
-#include "logind-inhibit.h"
-
-struct Manager {
+typedef struct Manager {
         sd_event *event;
         sd_bus *bus;
 
@@ -150,7 +150,7 @@ struct Manager {
         dual_timestamp init_ts;
 
         sd_varlink_server *varlink_server;
-};
+} Manager;
 
 void manager_reset_config(Manager *m);
 int manager_parse_config_file(Manager *m);
diff --git a/src/login/test-login-tables.c b/src/login/test-login-tables.c
index 9be781ce2d..76b62aa621 100644
--- a/src/login/test-login-tables.c
+++ b/src/login/test-login-tables.c
@@ -2,6 +2,7 @@
 
 #include "logind-action.h"
 #include "logind-session.h"
+#include "logind-user.h"
 #include "sleep-config.h"
 #include "test-tables.h"
 #include "tests.h"
diff --git a/src/machine-id-setup/machine-id-setup-main.c b/src/machine-id-setup/machine-id-setup-main.c
index fa4ba6a037..956a538a75 100644
--- a/src/machine-id-setup/machine-id-setup-main.c
+++ b/src/machine-id-setup/machine-id-setup-main.c
@@ -9,6 +9,7 @@
 #include "build.h"
 #include "dissect-image.h"
 #include "id128-util.h"
+#include "image-policy.h"
 #include "log.h"
 #include "machine-id-setup.h"
 #include "main-func.h"
diff --git a/src/machine/image-dbus.c b/src/machine/image-dbus.c
index 0e96127a05..5ad765237c 100644
--- a/src/machine/image-dbus.c
+++ b/src/machine/image-dbus.c
@@ -7,6 +7,7 @@
 #include "bus-get-properties.h"
 #include "bus-label.h"
 #include "bus-polkit.h"
+#include "bus-util.h"
 #include "copy.h"
 #include "discover-image.h"
 #include "dissect-image.h"
@@ -16,7 +17,9 @@
 #include "image-dbus.h"
 #include "io-util.h"
 #include "loop-util.h"
+#include "machined.h"
 #include "mount-util.h"
+#include "operation.h"
 #include "os-util.h"
 #include "process-util.h"
 #include "raw-clone.h"
diff --git a/src/machine/image-dbus.h b/src/machine/image-dbus.h
index 0a7975bc52..38626cffe2 100644
--- a/src/machine/image-dbus.h
+++ b/src/machine/image-dbus.h
@@ -2,8 +2,6 @@
 #pragma once
 
 #include "bus-object.h"
-#include "discover-image.h"
-#include "machined.h"
 
 extern const BusObjectImplementation image_object;
 
diff --git a/src/machine/image-varlink.c b/src/machine/image-varlink.c
index fc05edf8e1..4749487541 100644
--- a/src/machine/image-varlink.c
+++ b/src/machine/image-varlink.c
@@ -5,6 +5,7 @@
 
 #include "bus-polkit.h"
 #include "btrfs-util.h"
+#include "discover-image.h"
 #include "fd-util.h"
 #include "fileio.h"
 #include "image.h"
@@ -12,7 +13,9 @@
 #include "io-util.h"
 #include "json-util.h"
 #include "machine.h"
+#include "machined.h"
 #include "machine-pool.h"
+#include "operation.h"
 #include "process-util.h"
 #include "string-util.h"
 
diff --git a/src/machine/image.c b/src/machine/image.c
index de4fba0856..f30c29e9dd 100644
--- a/src/machine/image.c
+++ b/src/machine/image.c
@@ -7,6 +7,7 @@
 #include "fileio.h"
 #include "image.h"
 #include "io-util.h"
+#include "machined.h"
 #include "operation.h"
 #include "process-util.h"
 #include "string-table.h"
diff --git a/src/machine/image.h b/src/machine/image.h
index 522b7459e4..fc8de564e8 100644
--- a/src/machine/image.h
+++ b/src/machine/image.h
@@ -1,8 +1,14 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include "machined.h"
-#include "operation.h"
+#include <errno.h>
+
+#include "sd-bus.h"
+
+#include "macro.h"
+
+typedef struct Manager Manager;
+typedef struct Operation Operation;
 
 typedef enum ImageCleanPoolMode {
         IMAGE_CLEAN_POOL_REMOVE_ALL,
diff --git a/src/machine/machine-dbus.c b/src/machine/machine-dbus.c
index 657b9e9193..fc48d44a6e 100644
--- a/src/machine/machine-dbus.c
+++ b/src/machine/machine-dbus.c
@@ -11,6 +11,7 @@
 #include "bus-label.h"
 #include "bus-locator.h"
 #include "bus-polkit.h"
+#include "bus-util.h"
 #include "copy.h"
 #include "env-file.h"
 #include "env-util.h"
@@ -22,10 +23,12 @@
 #include "local-addresses.h"
 #include "machine-dbus.h"
 #include "machine.h"
+#include "machined.h"
 #include "mkdir.h"
 #include "mount-util.h"
 #include "mountpoint-util.h"
 #include "namespace-util.h"
+#include "operation.h"
 #include "os-util.h"
 #include "path-util.h"
 #include "process-util.h"
diff --git a/src/machine/machine-dbus.h b/src/machine/machine-dbus.h
index fc9ec68087..72b6984660 100644
--- a/src/machine/machine-dbus.h
+++ b/src/machine/machine-dbus.h
@@ -3,8 +3,9 @@
 
 #include "sd-bus.h"
 
-#include "bus-util.h"
-#include "machine.h"
+#include "bus-object.h"
+
+typedef struct Machine Machine;
 
 typedef enum {
         MACHINE_COPY_REPLACE = 1 << 0, /* Public API via DBUS, do not change */
diff --git a/src/machine/machine-varlink.c b/src/machine/machine-varlink.c
index 038aa411ff..e59cb85155 100644
--- a/src/machine/machine-varlink.c
+++ b/src/machine/machine-varlink.c
@@ -13,7 +13,9 @@
 #include "json-util.h"
 #include "machine-varlink.h"
 #include "machine.h"
+#include "machined.h"
 #include "mount-util.h"
+#include "operation.h"
 #include "path-util.h"
 #include "pidref.h"
 #include "process-util.h"
diff --git a/src/machine/machine-varlink.h b/src/machine/machine-varlink.h
index 1c089bc7bc..83f396d708 100644
--- a/src/machine/machine-varlink.h
+++ b/src/machine/machine-varlink.h
@@ -3,7 +3,10 @@
 
 #include "sd-varlink.h"
 
-#include "machine.h"
+#include "pidref.h"
+
+typedef struct Machine Machine;
+typedef struct Manager Manager;
 
 #define VARLINK_ERROR_MACHINE_NO_SUCH_MACHINE           "io.systemd.Machine.NoSuchMachine"
 #define VARLINK_ERROR_MACHINE_EXISTS                    "io.systemd.Machine.MachineExists"
diff --git a/src/machine/machine.c b/src/machine/machine.c
index 0568b22c46..36fc2a1476 100644
--- a/src/machine/machine.c
+++ b/src/machine/machine.c
@@ -23,8 +23,10 @@
 #include "hashmap.h"
 #include "machine-dbus.h"
 #include "machine.h"
+#include "machined.h"
 #include "mkdir-label.h"
 #include "namespace-util.h"
+#include "operation.h"
 #include "parse-util.h"
 #include "path-util.h"
 #include "process-util.h"
diff --git a/src/machine/machine.h b/src/machine/machine.h
index 520c2fcade..a4b375ca32 100644
--- a/src/machine/machine.h
+++ b/src/machine/machine.h
@@ -1,16 +1,19 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-typedef struct Machine Machine;
-typedef enum KillWhom KillWhom;
+#include "sd-bus.h"
+#include "sd-event.h"
+#include "sd-id128.h"
 
 #include "copy.h"
 #include "list.h"
-#include "machined.h"
-#include "operation.h"
 #include "pidref.h"
 #include "time-util.h"
 
+typedef struct Machine Machine;
+typedef struct Manager Manager;
+typedef struct Operation Operation;
+
 typedef enum MachineState {
         MACHINE_OPENING,    /* Machine is being registered */
         MACHINE_RUNNING,    /* Machine is running */
@@ -27,12 +30,12 @@ typedef enum MachineClass {
         _MACHINE_CLASS_INVALID = -EINVAL,
 } MachineClass;
 
-enum KillWhom {
+typedef enum KillWhom {
         KILL_LEADER,
         KILL_ALL,
         _KILL_WHOM_MAX,
         _KILL_WHOM_INVALID = -EINVAL,
-};
+} KillWhom;
 
 struct Machine {
         Manager *manager;
diff --git a/src/machine/machined-core.c b/src/machine/machined-core.c
index 5c6d225051..d5804b54ab 100644
--- a/src/machine/machined-core.c
+++ b/src/machine/machined-core.c
@@ -2,12 +2,16 @@
 
 #include "cgroup-util.h"
 #include "copy.h"
+#include "discover-image.h"
 #include "env-file.h"
 #include "fd-util.h"
 #include "fileio.h"
 #include "iovec-util.h"
+#include "log.h"
+#include "machine.h"
 #include "machined.h"
 #include "namespace-util.h"
+#include "os-util.h"
 #include "process-util.h"
 #include "socket-util.h"
 #include "strv.h"
diff --git a/src/machine/machined-dbus.c b/src/machine/machined-dbus.c
index e1969d69d8..f50ce90170 100644
--- a/src/machine/machined-dbus.c
+++ b/src/machine/machined-dbus.c
@@ -12,6 +12,7 @@
 #include "bus-locator.h"
 #include "bus-message-util.h"
 #include "bus-polkit.h"
+#include "bus-util.h"
 #include "cgroup-util.h"
 #include "discover-image.h"
 #include "errno-util.h"
@@ -24,7 +25,9 @@
 #include "io-util.h"
 #include "machine-dbus.h"
 #include "machine-pool.h"
+#include "machine.h"
 #include "machined.h"
+#include "operation.h"
 #include "os-util.h"
 #include "path-util.h"
 #include "process-util.h"
diff --git a/src/machine/machined-varlink.c b/src/machine/machined-varlink.c
index 7c1210209b..e331ccba66 100644
--- a/src/machine/machined-varlink.c
+++ b/src/machine/machined-varlink.c
@@ -9,6 +9,8 @@
 #include "image-varlink.h"
 #include "json-util.h"
 #include "machine-varlink.h"
+#include "machine.h"
+#include "machined.h"
 #include "machined-varlink.h"
 #include "mkdir.h"
 #include "process-util.h"
diff --git a/src/machine/machined-varlink.h b/src/machine/machined-varlink.h
index f26bbe588c..b96700719b 100644
--- a/src/machine/machined-varlink.h
+++ b/src/machine/machined-varlink.h
@@ -1,7 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include "machined.h"
+typedef struct Manager Manager;
 
 int manager_varlink_init(Manager *m);
 void manager_varlink_done(Manager *m);
diff --git a/src/machine/machined.c b/src/machine/machined.c
index 3a235aa0d4..253561e435 100644
--- a/src/machine/machined.c
+++ b/src/machine/machined.c
@@ -19,10 +19,12 @@
 #include "fd-util.h"
 #include "format-util.h"
 #include "hostname-util.h"
+#include "machine.h"
 #include "machined-varlink.h"
 #include "machined.h"
 #include "main-func.h"
 #include "mkdir-label.h"
+#include "operation.h"
 #include "process-util.h"
 #include "service-util.h"
 #include "signal-util.h"
diff --git a/src/machine/machined.h b/src/machine/machined.h
index 758678a205..10de674e7f 100644
--- a/src/machine/machined.h
+++ b/src/machine/machined.h
@@ -7,18 +7,18 @@
 #include "sd-event.h"
 #include "sd-varlink.h"
 
-typedef struct Manager Manager;
-
+#include "bus-object.h"
 #include "hashmap.h"
-#include "image-dbus.h"
 #include "list.h"
 #include "local-addresses.h"
-#include "machine-dbus.h"
-#include "machine.h"
-#include "operation.h"
 #include "pidref.h"
+#include "runtime-scope.h"
 
-struct Manager {
+typedef struct Image Image;
+typedef struct Machine Machine;
+typedef struct Operation Operation;
+
+typedef struct Manager {
         sd_event *event;
         sd_bus *bus;
 
@@ -44,7 +44,7 @@ struct Manager {
         sd_varlink_server *varlink_machine_server;
 
         RuntimeScope runtime_scope; /* for now: always RUNTIME_SCOPE_SYSTEM */
-};
+} Manager;
 
 int manager_add_machine(Manager *m, const char *name, Machine **ret);
 int manager_get_machine_by_pidref(Manager *m, const PidRef *pidref, Machine **ret);
diff --git a/src/machine/operation.c b/src/machine/operation.c
index ef4e178a8c..22168a3670 100644
--- a/src/machine/operation.c
+++ b/src/machine/operation.c
@@ -5,6 +5,9 @@
 
 #include "alloc-util.h"
 #include "fd-util.h"
+#include "log.h"
+#include "machine.h"
+#include "machined.h"
 #include "operation.h"
 #include "process-util.h"
 
diff --git a/src/machine/operation.h b/src/machine/operation.h
index 1a92847b80..1fd8d42a2e 100644
--- a/src/machine/operation.h
+++ b/src/machine/operation.h
@@ -5,13 +5,14 @@
 
 #include "sd-bus.h"
 #include "sd-event.h"
+#include "sd-varlink.h"
 
 #include "list.h"
 
+typedef struct Machine Machine;
+typedef struct Manager Manager;
 typedef struct Operation Operation;
 
-#include "machined.h"
-
 #define OPERATIONS_MAX 64
 
 struct Operation {
diff --git a/src/network/netdev/netdev.h b/src/network/netdev/netdev.h
index 8ab546d1ed..52c1c21198 100644
--- a/src/network/netdev/netdev.h
+++ b/src/network/netdev/netdev.h
@@ -9,7 +9,6 @@
 #include "list.h"
 #include "log-link.h"
 #include "netdev-util.h"
-#include "networkd-link.h"
 #include "time-util.h"
 
 /* Special hardware address value to suppress generating persistent hardware address for the netdev. */
diff --git a/src/network/netdev/vxlan.c b/src/network/netdev/vxlan.c
index ca0b4f4720..5961c28422 100644
--- a/src/network/netdev/vxlan.c
+++ b/src/network/netdev/vxlan.c
@@ -8,6 +8,7 @@
 #include "conf-parser.h"
 #include "alloc-util.h"
 #include "extract-word.h"
+#include "networkd-link.h"
 #include "string-table.h"
 #include "string-util.h"
 #include "strv.h"
diff --git a/src/network/netdev/xfrm.c b/src/network/netdev/xfrm.c
index 905bfc0bdf..4a91ab4158 100644
--- a/src/network/netdev/xfrm.c
+++ b/src/network/netdev/xfrm.c
@@ -3,6 +3,7 @@
 #include <linux/if_arp.h>
 
 #include "missing_network.h"
+#include "networkd-link.h"
 #include "xfrm.h"
 
 static int xfrm_fill_message_create(NetDev *netdev, Link *link, sd_netlink_message *message) {
diff --git a/src/network/networkd-bridge-mdb.h b/src/network/networkd-bridge-mdb.h
index 3b565d7f67..89c70fb68f 100644
--- a/src/network/networkd-bridge-mdb.h
+++ b/src/network/networkd-bridge-mdb.h
@@ -2,6 +2,7 @@
 #pragma once
 
 #include <inttypes.h>
+#include <net/ethernet.h>
 
 #include "conf-parser.h"
 #include "in-addr-util.h"
diff --git a/src/network/networkd-ipv4acd.h b/src/network/networkd-ipv4acd.h
index fc9f92d4f4..75b4c97a05 100644
--- a/src/network/networkd-ipv4acd.h
+++ b/src/network/networkd-ipv4acd.h
@@ -1,6 +1,8 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
+#include <stdbool.h>
+
 typedef struct Address Address;
 typedef struct Link Link;
 
diff --git a/src/network/networkd-manager-varlink.c b/src/network/networkd-manager-varlink.c
index 3182c0094e..0169dcfea0 100644
--- a/src/network/networkd-manager-varlink.c
+++ b/src/network/networkd-manager-varlink.c
@@ -8,7 +8,9 @@
 #include "fd-util.h"
 #include "json-util.h"
 #include "lldp-rx-internal.h"
+#include "network-util.h"
 #include "networkd-dhcp-server.h"
+#include "networkd-manager.h"
 #include "networkd-manager-varlink.h"
 #include "stat-util.h"
 #include "varlink-io.systemd.Network.h"
diff --git a/src/network/networkd-manager-varlink.h b/src/network/networkd-manager-varlink.h
index 46078a81d9..31afc43335 100644
--- a/src/network/networkd-manager-varlink.h
+++ b/src/network/networkd-manager-varlink.h
@@ -1,7 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include "networkd-manager.h"
+typedef struct Manager Manager;
 
 int manager_connect_varlink(Manager *m);
 void manager_varlink_done(Manager *m);
diff --git a/src/network/networkd-netlabel.h b/src/network/networkd-netlabel.h
index 2f30b8feda..f18ad5aa14 100644
--- a/src/network/networkd-netlabel.h
+++ b/src/network/networkd-netlabel.h
@@ -1,5 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
+typedef struct Address Address;
+
 void address_add_netlabel(const Address *address);
 void address_del_netlabel(const Address *address);
diff --git a/src/network/networkd-network-gperf.gperf b/src/network/networkd-network-gperf.gperf
index c1aff5c02d..a788186ea6 100644
--- a/src/network/networkd-network-gperf.gperf
+++ b/src/network/networkd-network-gperf.gperf
@@ -41,6 +41,27 @@ _Pragma("GCC diagnostic ignored \"-Wzero-as-null-pointer-constant\"")
 #include "qdisc.h"
 #include "tclass.h"
 #include "vlan-util.h"
+
+#include "cake.h"
+#include "codel.h"
+#include "ets.h"
+#include "fifo.h"
+#include "fq-codel.h"
+#include "fq-pie.h"
+#include "fq.h"
+#include "gred.h"
+#include "hhf.h"
+#include "htb.h"
+#include "mq.h"
+#include "multiq.h"
+#include "pie.h"
+#include "qfq.h"
+#include "netem.h"
+#include "drr.h"
+#include "sfb.h"
+#include "sfq.h"
+#include "tbf.h"
+#include "teql.h"
 %}
 struct ConfigPerfItem;
 %null_strings
diff --git a/src/network/networkd-nexthop.h b/src/network/networkd-nexthop.h
index 00120d04af..1b0679fc37 100644
--- a/src/network/networkd-nexthop.h
+++ b/src/network/networkd-nexthop.h
@@ -17,6 +17,7 @@ typedef struct Link Link;
 typedef struct Manager Manager;
 typedef struct Network Network;
 typedef struct NextHop NextHop;
+typedef struct Request Request;
 typedef int (*nexthop_netlink_handler_t)(
                 sd_netlink *rtnl,
                 sd_netlink_message *m,
diff --git a/src/network/networkd-radv.h b/src/network/networkd-radv.h
index ed8ee216de..23af8a2ba5 100644
--- a/src/network/networkd-radv.h
+++ b/src/network/networkd-radv.h
@@ -15,6 +15,7 @@
 #include "ndisc-option.h"
 #include "networkd-util.h"
 
+typedef struct Address Address;
 typedef struct Link Link;
 typedef struct Network Network;
 
diff --git a/src/network/networkd-route-util.h b/src/network/networkd-route-util.h
index 2905a4913b..dfa3bf3c6f 100644
--- a/src/network/networkd-route-util.h
+++ b/src/network/networkd-route-util.h
@@ -5,6 +5,7 @@
 #include <stdbool.h>
 
 #include "conf-parser.h"
+#include "in-addr-util.h"
 
 typedef struct Link Link;
 typedef struct Manager Manager;
diff --git a/src/network/networkd-state-file.h b/src/network/networkd-state-file.h
index 7efd1578da..c45bd53083 100644
--- a/src/network/networkd-state-file.h
+++ b/src/network/networkd-state-file.h
@@ -1,6 +1,8 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
+#include <stdbool.h>
+
 typedef struct Link Link;
 typedef struct Manager Manager;
 
diff --git a/src/network/networkd-wiphy.h b/src/network/networkd-wiphy.h
index 8f92112148..9a42b26be6 100644
--- a/src/network/networkd-wiphy.h
+++ b/src/network/networkd-wiphy.h
@@ -4,6 +4,7 @@
 #include <inttypes.h>
 
 #include "sd-device.h"
+#include "sd-netlink.h"
 
 #include "macro.h"
 
diff --git a/src/network/tc/codel.c b/src/network/tc/codel.c
index 53ccf66e41..2bba46f2e9 100644
--- a/src/network/tc/codel.c
+++ b/src/network/tc/codel.c
@@ -4,10 +4,10 @@
 #include <linux/pkt_sched.h>
 
 #include "alloc-util.h"
+#include "codel.h"
 #include "conf-parser.h"
 #include "netlink-util.h"
 #include "parse-util.h"
-#include "qdisc.h"
 #include "string-util.h"
 
 static int controlled_delay_init(QDisc *qdisc) {
diff --git a/src/network/tc/drr.h b/src/network/tc/drr.h
index c96cc4db00..4719bf6c4f 100644
--- a/src/network/tc/drr.h
+++ b/src/network/tc/drr.h
@@ -3,6 +3,7 @@
 #pragma once
 
 #include "qdisc.h"
+#include "tclass.h"
 
 typedef struct DeficitRoundRobinScheduler {
         QDisc meta;
diff --git a/src/network/tc/fq-codel.c b/src/network/tc/fq-codel.c
index 9255cde465..4f5f09dfe5 100644
--- a/src/network/tc/fq-codel.c
+++ b/src/network/tc/fq-codel.c
@@ -5,9 +5,9 @@
 
 #include "alloc-util.h"
 #include "conf-parser.h"
+#include "fq-codel.h"
 #include "netlink-util.h"
 #include "parse-util.h"
-#include "qdisc.h"
 #include "string-util.h"
 #include "strv.h"
 
diff --git a/src/network/tc/gred.c b/src/network/tc/gred.c
index 198905a152..550c2da0f4 100644
--- a/src/network/tc/gred.c
+++ b/src/network/tc/gred.c
@@ -5,9 +5,9 @@
 
 #include "alloc-util.h"
 #include "conf-parser.h"
+#include "gred.h"
 #include "netlink-util.h"
 #include "parse-util.h"
-#include "qdisc.h"
 #include "string-util.h"
 
 static int generic_random_early_detection_init(QDisc *qdisc) {
diff --git a/src/network/tc/multiq.c b/src/network/tc/multiq.c
index c70d8c5906..5e637e9e51 100644
--- a/src/network/tc/multiq.c
+++ b/src/network/tc/multiq.c
@@ -1,5 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
+#include <linux/pkt_sched.h>
+
 #include "multiq.h"
 
 static int multi_queueing_fill_message(Link *link, QDisc *qdisc, sd_netlink_message *req) {
diff --git a/src/network/tc/qdisc.c b/src/network/tc/qdisc.c
index 3bcc393066..3b7bcfd48a 100644
--- a/src/network/tc/qdisc.c
+++ b/src/network/tc/qdisc.c
@@ -18,6 +18,27 @@
 #include "strv.h"
 #include "tc-util.h"
 
+#include "cake.h"
+#include "codel.h"
+#include "ets.h"
+#include "fifo.h"
+#include "fq-codel.h"
+#include "fq-pie.h"
+#include "fq.h"
+#include "gred.h"
+#include "hhf.h"
+#include "htb.h"
+#include "mq.h"
+#include "multiq.h"
+#include "pie.h"
+#include "qfq.h"
+#include "netem.h"
+#include "drr.h"
+#include "sfb.h"
+#include "sfq.h"
+#include "tbf.h"
+#include "teql.h"
+
 const QDiscVTable * const qdisc_vtable[_QDISC_KIND_MAX] = {
         [QDISC_KIND_BFIFO]           = &bfifo_vtable,
         [QDISC_KIND_CAKE]            = &cake_vtable,
diff --git a/src/network/tc/qdisc.h b/src/network/tc/qdisc.h
index 80b95c2aab..5a2b1be5f4 100644
--- a/src/network/tc/qdisc.h
+++ b/src/network/tc/qdisc.h
@@ -97,24 +97,3 @@ DEFINE_SECTION_CLEANUP_FUNCTIONS(QDisc, qdisc_unref);
 
 CONFIG_PARSER_PROTOTYPE(config_parse_qdisc_parent);
 CONFIG_PARSER_PROTOTYPE(config_parse_qdisc_handle);
-
-#include "cake.h"
-#include "codel.h"
-#include "ets.h"
-#include "fifo.h"
-#include "fq-codel.h"
-#include "fq-pie.h"
-#include "fq.h"
-#include "gred.h"
-#include "hhf.h"
-#include "htb.h"
-#include "mq.h"
-#include "multiq.h"
-#include "pie.h"
-#include "qfq.h"
-#include "netem.h"
-#include "drr.h"
-#include "sfb.h"
-#include "sfq.h"
-#include "tbf.h"
-#include "teql.h"
diff --git a/src/network/tc/qfq.h b/src/network/tc/qfq.h
index 0f013a9863..2e6599391a 100644
--- a/src/network/tc/qfq.h
+++ b/src/network/tc/qfq.h
@@ -4,6 +4,7 @@
 
 #include "conf-parser.h"
 #include "qdisc.h"
+#include "tclass.h"
 
 typedef struct QuickFairQueueing {
         QDisc meta;
diff --git a/src/network/tc/tbf.c b/src/network/tc/tbf.c
index 3e7a3098da..85ecbe39be 100644
--- a/src/network/tc/tbf.c
+++ b/src/network/tc/tbf.c
@@ -10,9 +10,9 @@
 #include "netlink-util.h"
 #include "networkd-manager.h"
 #include "parse-util.h"
-#include "qdisc.h"
 #include "string-util.h"
 #include "strv.h"
+#include "tbf.h"
 #include "tc-util.h"
 
 static int token_bucket_filter_fill_message(Link *link, QDisc *qdisc, sd_netlink_message *req) {
diff --git a/src/network/tc/tclass.c b/src/network/tc/tclass.c
index 684f917c50..e156a7f1cf 100644
--- a/src/network/tc/tclass.c
+++ b/src/network/tc/tclass.c
@@ -18,6 +18,10 @@
 #include "tc-util.h"
 #include "tclass.h"
 
+#include "drr.h"
+#include "htb.h"
+#include "qfq.h"
+
 const TClassVTable * const tclass_vtable[_TCLASS_KIND_MAX] = {
         [TCLASS_KIND_DRR] = &drr_tclass_vtable,
         [TCLASS_KIND_HTB] = &htb_tclass_vtable,
diff --git a/src/network/tc/tclass.h b/src/network/tc/tclass.h
index 31374d6da8..b5dc5c8c3c 100644
--- a/src/network/tc/tclass.h
+++ b/src/network/tc/tclass.h
@@ -77,7 +77,3 @@ DEFINE_SECTION_CLEANUP_FUNCTIONS(TClass, tclass_unref);
 
 CONFIG_PARSER_PROTOTYPE(config_parse_tclass_parent);
 CONFIG_PARSER_PROTOTYPE(config_parse_tclass_classid);
-
-#include "drr.h"
-#include "htb.h"
-#include "qfq.h"
diff --git a/src/nspawn/nspawn-mount.c b/src/nspawn/nspawn-mount.c
index 3e69781572..a6c99c83c6 100644
--- a/src/nspawn/nspawn-mount.c
+++ b/src/nspawn/nspawn-mount.c
@@ -10,6 +10,7 @@
 #include "format-util.h"
 #include "fs-util.h"
 #include "label-util.h"
+#include "log.h"
 #include "mkdir-label.h"
 #include "mount-util.h"
 #include "mountpoint-util.h"
diff --git a/src/nspawn/nspawn-mount.h b/src/nspawn/nspawn-mount.h
index 2efcd110fc..a1819f0837 100644
--- a/src/nspawn/nspawn-mount.h
+++ b/src/nspawn/nspawn-mount.h
@@ -2,6 +2,8 @@
 #pragma once
 
 #include <stdbool.h>
+#include <stddef.h>
+#include <sys/types.h>
 
 #include "volatile-util.h"
 
diff --git a/src/nspawn/nspawn-seccomp.h b/src/nspawn/nspawn-seccomp.h
index 2690fba686..a2fa9a61c6 100644
--- a/src/nspawn/nspawn-seccomp.h
+++ b/src/nspawn/nspawn-seccomp.h
@@ -1,6 +1,6 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include <sys/types.h>
+#include <stdint.h>
 
 int setup_seccomp(uint64_t cap_list_retain, char **syscall_allow_list, char **syscall_deny_list);
diff --git a/src/nspawn/nspawn-setuid.h b/src/nspawn/nspawn-setuid.h
index 192471143f..2dc9a69606 100644
--- a/src/nspawn/nspawn-setuid.h
+++ b/src/nspawn/nspawn-setuid.h
@@ -1,5 +1,8 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
+#include <stdbool.h>
+#include <sys/types.h>
+
 int change_uid_gid_raw(uid_t uid, gid_t gid, const gid_t *supplementary_gids, size_t n_supplementary_gids, bool chown_stdio);
 int change_uid_gid(const char *user, bool chown_stdio, char **ret_home);
diff --git a/src/nsresourced/userns-registry.h b/src/nsresourced/userns-registry.h
index 72fe990079..e25b402e88 100644
--- a/src/nsresourced/userns-registry.h
+++ b/src/nsresourced/userns-registry.h
@@ -1,7 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include "macro.h"
+#include "memory-util.h"
 
 #define USER_NAMESPACE_CGROUPS_DELEGATE_MAX 16U
 #define USER_NAMESPACE_NETIFS_DELEGATE_MAX 16U
diff --git a/src/nss-systemd/nss-systemd.h b/src/nss-systemd/nss-systemd.h
index e97b801575..2b46044e14 100644
--- a/src/nss-systemd/nss-systemd.h
+++ b/src/nss-systemd/nss-systemd.h
@@ -3,6 +3,8 @@
 
 #include <stdbool.h>
 
+#include "assert-util.h"
+
 int _nss_systemd_block(bool b);
 bool _nss_systemd_is_blocked(void);
 
diff --git a/src/portable/portabled-bus.h b/src/portable/portabled-bus.h
index 7da366c1c3..c216c3aa75 100644
--- a/src/portable/portabled-bus.h
+++ b/src/portable/portabled-bus.h
@@ -3,7 +3,7 @@
 
 #include "sd-bus.h"
 
-#include "portable.h"
+typedef struct PortableChange PortableChange;
 
 extern const sd_bus_vtable manager_vtable[];
 
diff --git a/src/portable/portabled-image-bus.h b/src/portable/portabled-image-bus.h
index 763a0890f9..d37c244315 100644
--- a/src/portable/portabled-image-bus.h
+++ b/src/portable/portabled-image-bus.h
@@ -3,8 +3,10 @@
 
 #include "sd-bus.h"
 
+#include "bus-object.h"
 #include "discover-image.h"
-#include "portabled.h"
+
+typedef struct Manager Manager;
 
 int bus_image_common_get_os_release(Manager *m, sd_bus_message *message, const char *name_or_path, Image *image, sd_bus_error *error);
 int bus_image_common_get_metadata(Manager *m, sd_bus_message *message, const char *name_or_path, Image *image, sd_bus_error *error);
diff --git a/src/portable/portabled-image.h b/src/portable/portabled-image.h
index 753f389f80..424694b3fd 100644
--- a/src/portable/portabled-image.h
+++ b/src/portable/portabled-image.h
@@ -1,9 +1,12 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
+#include "sd-bus.h"
+
 #include "discover-image.h"
 #include "hashmap.h"
-#include "portabled.h"
+
+typedef struct Manager Manager;
 
 Image *manager_image_cache_get(Manager *m, const char *name_or_path);
 
diff --git a/src/portable/portabled-operation.c b/src/portable/portabled-operation.c
index a694e5e64d..0e4a6e4629 100644
--- a/src/portable/portabled-operation.c
+++ b/src/portable/portabled-operation.c
@@ -5,6 +5,7 @@
 #include "alloc-util.h"
 #include "fd-util.h"
 #include "log.h"
+#include "portabled.h"
 #include "portabled-operation.h"
 #include "process-util.h"
 
diff --git a/src/portable/portabled-operation.h b/src/portable/portabled-operation.h
index f64740e9b8..efbadc4620 100644
--- a/src/portable/portabled-operation.h
+++ b/src/portable/portabled-operation.h
@@ -8,10 +8,9 @@
 
 #include "list.h"
 
+typedef struct Manager Manager;
 typedef struct Operation Operation;
 
-#include "portabled.h"
-
 #define OPERATIONS_MAX 64
 
 struct Operation {
diff --git a/src/portable/portabled.h b/src/portable/portabled.h
index 8503451ccc..418c1040da 100644
--- a/src/portable/portabled.h
+++ b/src/portable/portabled.h
@@ -7,13 +7,10 @@
 #include "bus-object.h"
 #include "hashmap.h"
 #include "list.h"
+#include "portabled-operation.h"
 #include "runtime-scope.h"
 
-typedef struct Manager Manager;
-
-#include "portabled-operation.h"
-
-struct Manager {
+typedef struct Manager {
         sd_event *event;
         sd_bus *bus;
 
@@ -26,6 +23,6 @@ struct Manager {
         unsigned n_operations;
 
         RuntimeScope runtime_scope; /* for now always RUNTIME_SCOPE_SYSTEM */
-};
+} Manager;
 
 extern const BusObjectImplementation manager_object;
diff --git a/src/repart/repart.c b/src/repart/repart.c
index f9aa9ac43c..c0fd1cc7bc 100644
--- a/src/repart/repart.c
+++ b/src/repart/repart.c
@@ -45,6 +45,7 @@
 #include "hexdecoct.h"
 #include "hmac.h"
 #include "id128-util.h"
+#include "image-policy.h"
 #include "initrd-util.h"
 #include "io-util.h"
 #include "json-util.h"
diff --git a/src/resolve/fuzz-resource-record.c b/src/resolve/fuzz-resource-record.c
index b1ff0d87e9..378308cee8 100644
--- a/src/resolve/fuzz-resource-record.c
+++ b/src/resolve/fuzz-resource-record.c
@@ -1,10 +1,13 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
+#include "sd-json.h"
+
 #include "fd-util.h"
 #include "fuzz.h"
 #include "memory-util.h"
 #include "memstream-util.h"
 #include "resolved-dns-packet.h"
+#include "resolved-dns-rr.h"
 
 int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
         _cleanup_(dns_resource_record_unrefp) DnsResourceRecord *rr = NULL, *copy = NULL;
diff --git a/src/resolve/resolvectl.c b/src/resolve/resolvectl.c
index b6278f111b..98eadb3943 100644
--- a/src/resolve/resolvectl.c
+++ b/src/resolve/resolvectl.c
@@ -38,6 +38,7 @@
 #include "resolvectl.h"
 #include "resolved-def.h"
 #include "resolved-dns-packet.h"
+#include "resolved-dns-rr.h"
 #include "resolved-util.h"
 #include "socket-netlink.h"
 #include "sort-util.h"
diff --git a/src/resolve/resolved-bus.c b/src/resolve/resolved-bus.c
index 1f06a7d57d..3824401918 100644
--- a/src/resolve/resolved-bus.c
+++ b/src/resolve/resolved-bus.c
@@ -7,17 +7,33 @@
 #include "bus-log-control-api.h"
 #include "bus-message-util.h"
 #include "bus-polkit.h"
+#include "bus-util.h"
 #include "dns-domain.h"
 #include "format-util.h"
 #include "memory-util.h"
 #include "path-util.h"
+#include "resolve-util.h"
 #include "resolved-bus.h"
 #include "resolved-def.h"
+#include "resolved-dns-answer.h"
+#include "resolved-dns-dnssec.h"
+#include "resolved-dns-packet.h"
+#include "resolved-dns-query.h"
+#include "resolved-dns-question.h"
+#include "resolved-dns-rr.h"
+#include "resolved-dns-scope.h"
+#include "resolved-dns-search-domain.h"
+#include "resolved-dns-server.h"
 #include "resolved-dns-stream.h"
+#include "resolved-dns-stub.h"
 #include "resolved-dns-synthesize.h"
+#include "resolved-dns-transaction.h"
+#include "resolved-dns-trust-anchor.h"
 #include "resolved-dnssd-bus.h"
 #include "resolved-dnssd.h"
+#include "resolved-link.h"
 #include "resolved-link-bus.h"
+#include "resolved-manager.h"
 #include "resolved-resolv-conf.h"
 #include "socket-netlink.h"
 #include "stdio-util.h"
diff --git a/src/resolve/resolved-bus.h b/src/resolve/resolved-bus.h
index 6c2bd26680..073ff1eb5a 100644
--- a/src/resolve/resolved-bus.h
+++ b/src/resolve/resolved-bus.h
@@ -2,7 +2,10 @@
 #pragma once
 
 #include "bus-object.h"
-#include "resolved-manager.h"
+#include "macro.h"
+
+typedef struct DnsServer DnsServer;
+typedef struct Manager Manager;
 
 extern const BusObjectImplementation manager_object;
 
diff --git a/src/resolve/resolved-conf.c b/src/resolve/resolved-conf.c
index a09e222dab..415c46d856 100644
--- a/src/resolve/resolved-conf.c
+++ b/src/resolve/resolved-conf.c
@@ -5,12 +5,14 @@
 #include "constants.h"
 #include "creds-util.h"
 #include "dns-domain.h"
+#include "dns-type.h"
 #include "extract-word.h"
 #include "hexdecoct.h"
 #include "parse-util.h"
 #include "proc-cmdline.h"
 #include "resolved-conf.h"
 #include "resolved-dns-search-domain.h"
+#include "resolved-dns-server.h"
 #include "resolved-dns-stub.h"
 #include "resolved-dnssd.h"
 #include "resolved-manager.h"
@@ -23,111 +25,6 @@
 
 DEFINE_CONFIG_PARSE_ENUM(config_parse_dns_stub_listener_mode, dns_stub_listener_mode, DnsStubListenerMode);
 
-static int manager_add_dns_server_by_string(Manager *m, DnsServerType type, const char *word) {
-        _cleanup_free_ char *server_name = NULL;
-        union in_addr_union address;
-        int family, r, ifindex = 0;
-        uint16_t port;
-        DnsServer *s;
-
-        assert(m);
-        assert(word);
-
-        r = in_addr_port_ifindex_name_from_string_auto(word, &family, &address, &port, &ifindex, &server_name);
-        if (r < 0)
-                return r;
-
-        /* Silently filter out 0.0.0.0, 127.0.0.53, 127.0.0.54 (our own stub DNS listener) */
-        if (!dns_server_address_valid(family, &address))
-                return 0;
-
-        /* By default, the port number is determined with the transaction feature level.
-         * See dns_transaction_port() and dns_server_port(). */
-        if (IN_SET(port, 53, 853))
-                port = 0;
-
-        /* Filter out duplicates */
-        s = dns_server_find(manager_get_first_dns_server(m, type), family, &address, port, ifindex, server_name);
-        if (s) {
-                /* Drop the marker. This is used to find the servers that ceased to exist, see
-                 * manager_mark_dns_servers() and manager_flush_marked_dns_servers(). */
-                dns_server_move_back_and_unmark(s);
-                return 0;
-        }
-
-        return dns_server_new(m, NULL, type, NULL, family, &address, port, ifindex, server_name, RESOLVE_CONFIG_SOURCE_FILE);
-}
-
-int manager_parse_dns_server_string_and_warn(Manager *m, DnsServerType type, const char *string) {
-        int r;
-
-        assert(m);
-        assert(string);
-
-        for (;;) {
-                _cleanup_free_ char *word = NULL;
-
-                r = extract_first_word(&string, &word, NULL, 0);
-                if (r <= 0)
-                        return r;
-
-                r = manager_add_dns_server_by_string(m, type, word);
-                if (r < 0)
-                        log_warning_errno(r, "Failed to add DNS server address '%s', ignoring: %m", word);
-        }
-}
-
-static int manager_add_search_domain_by_string(Manager *m, const char *domain) {
-        DnsSearchDomain *d;
-        bool route_only;
-        int r;
-
-        assert(m);
-        assert(domain);
-
-        route_only = *domain == '~';
-        if (route_only)
-                domain++;
-
-        if (dns_name_is_root(domain) || streq(domain, "*")) {
-                route_only = true;
-                domain = ".";
-        }
-
-        r = dns_search_domain_find(m->search_domains, domain, &d);
-        if (r < 0)
-                return r;
-        if (r > 0)
-                dns_search_domain_move_back_and_unmark(d);
-        else {
-                r = dns_search_domain_new(m, &d, DNS_SEARCH_DOMAIN_SYSTEM, NULL, domain);
-                if (r < 0)
-                        return r;
-        }
-
-        d->route_only = route_only;
-        return 0;
-}
-
-int manager_parse_search_domains_and_warn(Manager *m, const char *string) {
-        int r;
-
-        assert(m);
-        assert(string);
-
-        for (;;) {
-                _cleanup_free_ char *word = NULL;
-
-                r = extract_first_word(&string, &word, NULL, EXTRACT_UNQUOTE);
-                if (r <= 0)
-                        return r;
-
-                r = manager_add_search_domain_by_string(m, word);
-                if (r < 0)
-                        log_warning_errno(r, "Failed to add search domain '%s', ignoring: %m", word);
-        }
-}
-
 int config_parse_dns_servers(
                 const char *unit,
                 const char *filename,
diff --git a/src/resolve/resolved-conf.h b/src/resolve/resolved-conf.h
index 069ae7d78f..4499f3b956 100644
--- a/src/resolve/resolved-conf.h
+++ b/src/resolve/resolved-conf.h
@@ -3,6 +3,8 @@
 
 #include "conf-parser.h"
 
+typedef struct Manager Manager;
+
 typedef enum ResolveConfigSource {
         RESOLVE_CONFIG_SOURCE_FILE,
         RESOLVE_CONFIG_SOURCE_NETWORKD,
@@ -11,13 +13,8 @@ typedef enum ResolveConfigSource {
         _RESOLVE_CONFIG_SOURCE_INVALID = -EINVAL,
 } ResolveConfigSource;
 
-#include "resolved-dns-server.h"
-
 int manager_parse_config_file(Manager *m);
 
-int manager_parse_search_domains_and_warn(Manager *m, const char *string);
-int manager_parse_dns_server_string_and_warn(Manager *m, DnsServerType type, const char *string);
-
 const struct ConfigPerfItem* resolved_gperf_lookup(const char *key, GPERF_LEN_TYPE length);
 
 CONFIG_PARSER_PROTOTYPE(config_parse_dns_servers);
diff --git a/src/resolve/resolved-dns-answer.c b/src/resolve/resolved-dns-answer.c
index fd88a863f8..2b9e750010 100644
--- a/src/resolve/resolved-dns-answer.c
+++ b/src/resolve/resolved-dns-answer.c
@@ -8,6 +8,7 @@
 #include "random-util.h"
 #include "resolved-dns-answer.h"
 #include "resolved-dns-dnssec.h"
+#include "resolved-dns-rr.h"
 #include "string-util.h"
 
 static DnsAnswerItem *dns_answer_item_free(DnsAnswerItem *item) {
diff --git a/src/resolve/resolved-dns-answer.h b/src/resolve/resolved-dns-answer.h
index 068803c6cb..0707a9a6c0 100644
--- a/src/resolve/resolved-dns-answer.h
+++ b/src/resolve/resolved-dns-answer.h
@@ -1,12 +1,11 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-typedef struct DnsAnswer DnsAnswer;
-typedef struct DnsAnswerItem DnsAnswerItem;
-
 #include "macro.h"
 #include "ordered-set.h"
-#include "resolved-dns-rr.h"
+
+typedef struct DnsResourceKey DnsResourceKey;
+typedef struct DnsResourceRecord DnsResourceRecord;
 
 /* A simple array of resource records. We keep track of the originating ifindex for each RR where that makes
  * sense, so that we can qualify A and AAAA RRs referring to a local link with the right ifindex.
@@ -29,18 +28,18 @@ typedef enum DnsAnswerFlags {
                                         DNS_ANSWER_SECTION_ADDITIONAL,
 } DnsAnswerFlags;
 
-struct DnsAnswerItem {
+typedef struct DnsAnswerItem {
         unsigned n_ref;
         DnsResourceRecord *rr;
         DnsResourceRecord *rrsig; /* Optionally, also store RRSIG RR that successfully validates this item */
         int ifindex;
         DnsAnswerFlags flags;
-};
+} DnsAnswerItem;
 
-struct DnsAnswer {
+typedef struct DnsAnswer {
         unsigned n_ref;
         OrderedSet *items;
-};
+} DnsAnswer;
 
 DnsAnswer *dns_answer_new(size_t n);
 DnsAnswer *dns_answer_ref(DnsAnswer *a);
diff --git a/src/resolve/resolved-dns-cache.c b/src/resolve/resolved-dns-cache.c
index c7b51c0224..f14ddd19ab 100644
--- a/src/resolve/resolved-dns-cache.c
+++ b/src/resolve/resolved-dns-cache.c
@@ -8,7 +8,9 @@
 #include "format-ifname.h"
 #include "resolved-dns-answer.h"
 #include "resolved-dns-cache.h"
+#include "resolved-dns-dnssec.h"
 #include "resolved-dns-packet.h"
+#include "resolved-dns-rr.h"
 #include "string-util.h"
 
 /* Never cache more than 4K entries. RFC 1536, Section 5 suggests to
diff --git a/src/resolve/resolved-dns-cache.h b/src/resolve/resolved-dns-cache.h
index d8b71a3c2a..c764971373 100644
--- a/src/resolve/resolved-dns-cache.h
+++ b/src/resolve/resolved-dns-cache.h
@@ -1,13 +1,23 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
+#include "sd-json.h"
+
 #include "hashmap.h"
+#include "in-addr-util.h"
 #include "list.h"
 #include "prioq.h"
 #include "resolve-util.h"
-#include "resolved-dns-dnssec.h"
 #include "time-util.h"
 
+typedef enum DnsProtocol DnsProtocol;
+typedef enum DnssecResult DnssecResult;
+
+typedef struct DnsAnswer DnsAnswer;
+typedef struct DnsPacket DnsPacket;
+typedef struct DnsResourceKey DnsResourceKey;
+typedef struct DnsResourceRecord DnsResourceRecord;
+
 typedef struct DnsCache {
         Hashmap *by_key;
         Prioq *by_expiry;
@@ -15,11 +25,6 @@ typedef struct DnsCache {
         unsigned n_miss;
 } DnsCache;
 
-#include "resolved-dns-answer.h"
-#include "resolved-dns-packet.h"
-#include "resolved-dns-question.h"
-#include "resolved-dns-rr.h"
-
 void dns_cache_flush(DnsCache *c);
 void dns_cache_prune(DnsCache *c);
 
diff --git a/src/resolve/resolved-dns-dnssec.c b/src/resolve/resolved-dns-dnssec.c
index ccd4ff9196..221cd8548d 100644
--- a/src/resolve/resolved-dns-dnssec.c
+++ b/src/resolve/resolved-dns-dnssec.c
@@ -2,6 +2,7 @@
 
 #include "alloc-util.h"
 #include "dns-domain.h"
+#include "dns-type.h"
 #include "fd-util.h"
 #include "fileio.h"
 #include "hexdecoct.h"
@@ -9,8 +10,10 @@
 #include "memory-util.h"
 #include "memstream-util.h"
 #include "openssl-util.h"
+#include "resolved-dns-answer.h"
 #include "resolved-dns-dnssec.h"
 #include "resolved-dns-packet.h"
+#include "resolved-dns-rr.h"
 #include "sort-util.h"
 #include "string-table.h"
 
diff --git a/src/resolve/resolved-dns-dnssec.h b/src/resolve/resolved-dns-dnssec.h
index d8ff3bada9..21a9bd54af 100644
--- a/src/resolve/resolved-dns-dnssec.h
+++ b/src/resolve/resolved-dns-dnssec.h
@@ -1,14 +1,17 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-typedef enum DnssecResult DnssecResult;
-typedef enum DnssecVerdict DnssecVerdict;
+#include <errno.h>
+#include <stdbool.h>
+#include <stdint.h>
 
-#include "dns-domain.h"
-#include "resolved-dns-answer.h"
-#include "resolved-dns-rr.h"
+#include "time-util.h"
 
-enum DnssecResult {
+typedef struct DnsAnswer DnsAnswer;
+typedef struct DnsResourceKey DnsResourceKey;
+typedef struct DnsResourceRecord DnsResourceRecord;
+
+typedef enum DnssecResult {
         /* These six are returned by dnssec_verify_rrset() */
         DNSSEC_VALIDATED,
         DNSSEC_VALIDATED_WILDCARD, /* Validated via a wildcard RRSIG, further NSEC/NSEC3 checks necessary */
@@ -30,9 +33,9 @@ enum DnssecResult {
 
         _DNSSEC_RESULT_MAX,
         _DNSSEC_RESULT_INVALID = -EINVAL,
-};
+} DnssecResult;
 
-enum DnssecVerdict {
+typedef enum DnssecVerdict {
         DNSSEC_SECURE,
         DNSSEC_INSECURE,
         DNSSEC_BOGUS,
@@ -40,7 +43,7 @@ enum DnssecVerdict {
 
         _DNSSEC_VERDICT_MAX,
         _DNSSEC_VERDICT_INVALID = -EINVAL,
-};
+} DnssecVerdict;
 
 #define DNSSEC_CANONICAL_HOSTNAME_MAX (DNS_HOSTNAME_MAX + 2)
 
diff --git a/src/resolve/resolved-dns-packet.c b/src/resolve/resolved-dns-packet.c
index a627a06c04..9b22573508 100644
--- a/src/resolve/resolved-dns-packet.c
+++ b/src/resolve/resolved-dns-packet.c
@@ -5,7 +5,10 @@
 #include "escape.h"
 #include "log.h"
 #include "memory-util.h"
+#include "resolved-dns-answer.h"
 #include "resolved-dns-packet.h"
+#include "resolved-dns-question.h"
+#include "resolved-dns-rr.h"
 #include "set.h"
 #include "stdio-util.h"
 #include "string-table.h"
@@ -33,6 +36,54 @@ static void rewind_dns_packet(DnsPacketRewinder *rewinder) {
         }
 #define CANCEL_REWINDER(rewinder) do { (rewinder).packet = NULL; } while (0)
 
+uint16_t dns_packet_rcode(DnsPacket *p) {
+        uint16_t rcode;
+
+        assert(p);
+
+        if (p->opt)
+                rcode = (uint16_t) ((p->opt->ttl >> 20) & 0xFF0);
+        else
+                rcode = 0;
+
+        return rcode | (be16toh(DNS_PACKET_HEADER(p)->flags) & 0xF);
+};
+
+uint16_t dns_packet_payload_size_max(DnsPacket *p) {
+        assert(p);
+
+        /* Returns the advertised maximum size for replies, or the DNS default if there's nothing defined. */
+
+        if (p->ipproto == IPPROTO_TCP) /* we ignore EDNS(0) size data on TCP, like everybody else */
+                return DNS_PACKET_SIZE_MAX;
+
+        if (p->opt)
+                return MAX(DNS_PACKET_UNICAST_SIZE_MAX, p->opt->key->class);
+
+        return DNS_PACKET_UNICAST_SIZE_MAX;
+}
+
+bool dns_packet_do(DnsPacket *p) {
+        assert(p);
+
+        if (!p->opt)
+                return false;
+
+        return !!(p->opt->ttl & (1U << 15));
+}
+
+bool dns_packet_version_supported(DnsPacket *p) {
+        assert(p);
+
+        /* Returns true if this packet is in a version we support. Which means either non-EDNS or EDNS(0), but not EDNS
+         * of any newer versions */
+
+        if (!p->opt)
+                return true;
+
+        return DNS_RESOURCE_RECORD_OPT_VERSION_SUPPORTED(p->opt);
+}
+
 int dns_packet_new(
                 DnsPacket **ret,
                 DnsProtocol protocol,
@@ -278,7 +329,7 @@ int dns_packet_validate_reply(DnsPacket *p) {
 
         case DNS_PROTOCOL_MDNS:
                 /* RFC 6762, Section 18 */
-                if (DNS_PACKET_RCODE(p) != 0)
+                if (dns_packet_rcode(p) != 0)
                         return -EBADMSG;
 
                 break;
@@ -347,7 +398,7 @@ int dns_packet_validate_query(DnsPacket *p) {
                 /* RFC 6762, Section 18 specifies that messages with non-zero RCODE
                  * must be silently ignored, and that we must ignore the values of
                  * AA, RD, RA, AD, and CD bits. */
-                if (DNS_PACKET_RCODE(p) != 0)
+                if (dns_packet_rcode(p) != 0)
                         return -EBADMSG;
 
                 break;
diff --git a/src/resolve/resolved-dns-packet.h b/src/resolve/resolved-dns-packet.h
index 0001d1e237..6e93980d36 100644
--- a/src/resolve/resolved-dns-packet.h
+++ b/src/resolve/resolved-dns-packet.h
@@ -8,15 +8,15 @@
 #include "hashmap.h"
 #include "in-addr-util.h"
 #include "macro.h"
-#include "sparse-endian.h"
-
-typedef struct DnsPacketHeader DnsPacketHeader;
-typedef struct DnsPacket DnsPacket;
-
 #include "resolved-def.h"
 #include "resolved-dns-answer.h"
-#include "resolved-dns-question.h"
-#include "resolved-dns-rr.h"
+#include "sparse-endian.h"
+
+typedef struct DnsAnswer DnsAnswer;
+typedef struct DnsPacket DnsPacket;
+typedef struct DnsQuestion DnsQuestion;
+typedef struct DnsResourceKey DnsResourceKey;
+typedef struct DnsResourceRecord DnsResourceRecord;
 
 typedef enum DnsProtocol {
         DNS_PROTOCOL_DNS,
@@ -26,14 +26,14 @@ typedef enum DnsProtocol {
         _DNS_PROTOCOL_INVALID = -EINVAL,
 } DnsProtocol;
 
-struct DnsPacketHeader {
+typedef struct DnsPacketHeader {
         uint16_t id;
         be16_t flags;
         be16_t qdcount;
         be16_t ancount;
         be16_t nscount;
         be16_t arcount;
-} _packed_;
+} _packed_ DnsPacketHeader;
 
 #define DNS_PACKET_HEADER_SIZE sizeof(DnsPacketHeader)
 #define UDP4_PACKET_HEADER_SIZE (sizeof(struct iphdr) + sizeof(struct udphdr))
@@ -115,46 +115,10 @@ static inline uint8_t* DNS_PACKET_DATA(const DnsPacket *p) {
 #define DNS_PACKET_FLAG_AD (UINT16_C(1) << 5)
 #define DNS_PACKET_FLAG_TC (UINT16_C(1) << 9)
 
-static inline uint16_t DNS_PACKET_RCODE(DnsPacket *p) {
-        uint16_t rcode;
-
-        if (p->opt)
-                rcode = (uint16_t) ((p->opt->ttl >> 20) & 0xFF0);
-        else
-                rcode = 0;
-
-        return rcode | (be16toh(DNS_PACKET_HEADER(p)->flags) & 0xF);
-}
-
-static inline uint16_t DNS_PACKET_PAYLOAD_SIZE_MAX(DnsPacket *p) {
-
-        /* Returns the advertised maximum size for replies, or the DNS default if there's nothing defined. */
-
-        if (p->ipproto == IPPROTO_TCP) /* we ignore EDNS(0) size data on TCP, like everybody else */
-                return DNS_PACKET_SIZE_MAX;
-
-        if (p->opt)
-                return MAX(DNS_PACKET_UNICAST_SIZE_MAX, p->opt->key->class);
-
-        return DNS_PACKET_UNICAST_SIZE_MAX;
-}
-
-static inline bool DNS_PACKET_DO(DnsPacket *p) {
-        if (!p->opt)
-                return false;
-
-        return !!(p->opt->ttl & (1U << 15));
-}
-
-static inline bool DNS_PACKET_VERSION_SUPPORTED(DnsPacket *p) {
-        /* Returns true if this packet is in a version we support. Which means either non-EDNS or EDNS(0), but not EDNS
-         * of any newer versions */
-
-        if (!p->opt)
-                return true;
-
-        return DNS_RESOURCE_RECORD_OPT_VERSION_SUPPORTED(p->opt);
-}
+uint16_t dns_packet_rcode(DnsPacket *p);
+uint16_t dns_packet_payload_size_max(DnsPacket *p);
+bool dns_packet_do(DnsPacket *p);
+bool dns_packet_version_supported(DnsPacket *p);
 
 static inline bool DNS_PACKET_IS_FRAGMENTED(DnsPacket *p) {
         assert(p);
diff --git a/src/resolve/resolved-dns-query.c b/src/resolve/resolved-dns-query.c
index f000467153..f7c2e8eec4 100644
--- a/src/resolve/resolved-dns-query.c
+++ b/src/resolve/resolved-dns-query.c
@@ -7,9 +7,18 @@
 #include "glyph-util.h"
 #include "hostname-util.h"
 #include "local-addresses.h"
+#include "resolved-dns-answer.h"
+#include "resolved-dns-packet.h"
 #include "resolved-dns-query.h"
+#include "resolved-dns-question.h"
+#include "resolved-dns-rr.h"
+#include "resolved-dns-scope.h"
+#include "resolved-dns-search-domain.h"
+#include "resolved-dns-stub.h"
 #include "resolved-dns-synthesize.h"
+#include "resolved-dns-transaction.h"
 #include "resolved-etc-hosts.h"
+#include "resolved-manager.h"
 #include "resolved-timeouts.h"
 #include "string-util.h"
 
@@ -1493,3 +1502,13 @@ int validate_and_mangle_query_flags(
 
         return 0;
 }
+
+uint64_t dns_query_reply_flags_make(DnsQuery *q) {
+        assert(q);
+
+        return SD_RESOLVED_FLAGS_MAKE(q->answer_protocol,
+                                      q->answer_family,
+                                      dns_query_fully_authenticated(q),
+                                      dns_query_fully_confidential(q)) |
+                (q->answer_query_flags & (SD_RESOLVED_FROM_MASK|SD_RESOLVED_SYNTHETIC));
+}
diff --git a/src/resolve/resolved-dns-query.h b/src/resolve/resolved-dns-query.h
index 3a93ff7f1a..9433ed9126 100644
--- a/src/resolve/resolved-dns-query.h
+++ b/src/resolve/resolved-dns-query.h
@@ -4,16 +4,24 @@
 #include "sd-bus.h"
 #include "sd-varlink.h"
 
+#include "in-addr-util.h"
+#include "list.h"
+#include "resolved-def.h"
+#include "resolved-dns-dnssec.h"
+#include "resolved-dns-packet.h"
+#include "resolved-dns-transaction.h"
 #include "set.h"
 
+typedef struct DnsAnswer DnsAnswer;
+typedef struct DnsPacket DnsPacket;
 typedef struct DnsQueryCandidate DnsQueryCandidate;
 typedef struct DnsQuery DnsQuery;
+typedef struct DnsQuestion DnsQuestion;
+typedef struct DnsScope DnsScope;
+typedef struct DnsSearchDomain DnsSearchDomain;
+typedef struct DnsStream DnsStream;
 typedef struct DnsStubListenerExtra DnsStubListenerExtra;
-
-#include "resolved-dns-answer.h"
-#include "resolved-dns-question.h"
-#include "resolved-dns-search-domain.h"
-#include "resolved-dns-transaction.h"
+typedef struct Manager Manager;
 
 struct DnsQueryCandidate {
         unsigned n_ref;
@@ -160,12 +168,4 @@ bool dns_query_fully_authoritative(DnsQuery *q);
 
 int validate_and_mangle_query_flags(Manager *manager, uint64_t *flags, const char *name, uint64_t ok);
 
-static inline uint64_t dns_query_reply_flags_make(DnsQuery *q) {
-        assert(q);
-
-        return SD_RESOLVED_FLAGS_MAKE(q->answer_protocol,
-                                      q->answer_family,
-                                      dns_query_fully_authenticated(q),
-                                      dns_query_fully_confidential(q)) |
-                (q->answer_query_flags & (SD_RESOLVED_FROM_MASK|SD_RESOLVED_SYNTHETIC));
-}
+uint64_t dns_query_reply_flags_make(DnsQuery *q);
diff --git a/src/resolve/resolved-dns-question.c b/src/resolve/resolved-dns-question.c
index 6fb778860c..7d8f483293 100644
--- a/src/resolve/resolved-dns-question.c
+++ b/src/resolve/resolved-dns-question.c
@@ -5,6 +5,7 @@
 #include "dns-type.h"
 #include "log.h"
 #include "resolved-dns-question.h"
+#include "resolved-dns-rr.h"
 #include "socket-util.h"
 
 DnsQuestion *dns_question_new(size_t n) {
diff --git a/src/resolve/resolved-dns-question.h b/src/resolve/resolved-dns-question.h
index b986c42997..33997963c1 100644
--- a/src/resolve/resolved-dns-question.h
+++ b/src/resolve/resolved-dns-question.h
@@ -1,11 +1,13 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-typedef struct DnsQuestion DnsQuestion;
-typedef struct DnsQuestionItem DnsQuestionItem;
+#include <stdio.h>
 
-#include "macro.h"
-#include "resolved-dns-rr.h"
+#include "in-addr-util.h"
+#include "memory-util.h"
+
+typedef struct DnsResourceKey DnsResourceKey;
+typedef struct DnsResourceRecord DnsResourceRecord;
 
 /* A simple array of resource keys */
 
@@ -13,16 +15,16 @@ typedef enum DnsQuestionFlags {
         DNS_QUESTION_WANTS_UNICAST_REPLY = 1 << 0, /* For mDNS: sender is willing to accept unicast replies */
 } DnsQuestionFlags;
 
-struct DnsQuestionItem {
+typedef struct DnsQuestionItem {
         DnsResourceKey *key;
         DnsQuestionFlags flags;
-};
+} DnsQuestionItem;
 
-struct DnsQuestion {
+typedef struct DnsQuestion {
         unsigned n_ref;
         size_t n_keys, n_allocated;
         DnsQuestionItem items[];
-};
+} DnsQuestion;
 
 DnsQuestion *dns_question_new(size_t n);
 DnsQuestion *dns_question_ref(DnsQuestion *q);
diff --git a/src/resolve/resolved-dns-scope.c b/src/resolve/resolved-dns-scope.c
index 78fa6015d2..c9ea2d31d5 100644
--- a/src/resolve/resolved-dns-scope.c
+++ b/src/resolve/resolved-dns-scope.c
@@ -5,16 +5,27 @@
 #include "af-list.h"
 #include "alloc-util.h"
 #include "dns-domain.h"
+#include "dns-type.h"
 #include "errno-util.h"
 #include "fd-util.h"
 #include "hostname-util.h"
 #include "missing_network.h"
 #include "random-util.h"
 #include "resolved-dnssd.h"
+#include "resolved-dns-answer.h"
+#include "resolved-dns-packet.h"
+#include "resolved-dns-query.h"
+#include "resolved-dns-question.h"
+#include "resolved-dns-rr.h"
 #include "resolved-dns-scope.h"
+#include "resolved-dns-search-domain.h"
+#include "resolved-dns-server.h"
 #include "resolved-dns-synthesize.h"
+#include "resolved-dns-transaction.h"
 #include "resolved-dns-zone.h"
+#include "resolved-link.h"
 #include "resolved-llmnr.h"
+#include "resolved-manager.h"
 #include "resolved-mdns.h"
 #include "resolved-timeouts.h"
 #include "socket-util.h"
diff --git a/src/resolve/resolved-dns-scope.h b/src/resolve/resolved-dns-scope.h
index aefddb9a80..834bc91885 100644
--- a/src/resolve/resolved-dns-scope.h
+++ b/src/resolve/resolved-dns-scope.h
@@ -1,20 +1,25 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
+#include "sd-event.h"
+
+#include "dns-def.h"
 #include "list.h"
 #include "ratelimit.h"
-
-typedef struct DnsQueryCandidate DnsQueryCandidate;
-typedef struct DnsScope DnsScope;
-
+#include "resolve-util.h"
 #include "resolved-dns-cache.h"
-#include "resolved-dns-dnssec.h"
 #include "resolved-dns-packet.h"
-#include "resolved-dns-query.h"
-#include "resolved-dns-search-domain.h"
-#include "resolved-dns-server.h"
-#include "resolved-dns-stream.h"
 #include "resolved-dns-zone.h"
+#include "socket-util.h"
+
+typedef struct DnsQuery DnsQuery;
+typedef struct DnsQueryCandidate DnsQueryCandidate;
+typedef struct DnsQuestion DnsQuestion;
+typedef struct DnsSearchDomain DnsSearchDomain;
+typedef struct DnsServer DnsServer;
+typedef struct DnsStream DnsStream;
+typedef struct Link Link;
+typedef struct Manager Manager;
 
 typedef enum DnsScopeMatch {
         DNS_SCOPE_NO,
diff --git a/src/resolve/resolved-dns-server.c b/src/resolve/resolved-dns-server.c
index fbdd886254..36b7f74813 100644
--- a/src/resolve/resolved-dns-server.c
+++ b/src/resolve/resolved-dns-server.c
@@ -5,15 +5,22 @@
 #include "sd-messages.h"
 
 #include "alloc-util.h"
+#include "dns-domain.h"
 #include "errno-util.h"
 #include "fd-util.h"
 #include "json-util.h"
 #include "resolved-bus.h"
+#include "resolved-dns-cache.h"
+#include "resolved-dns-packet.h"
+#include "resolved-dns-scope.h"
+#include "resolved-dns-search-domain.h"
 #include "resolved-dns-server.h"
 #include "resolved-dns-stub.h"
+#include "resolved-link.h"
 #include "resolved-manager.h"
 #include "resolved-resolv-conf.h"
 #include "siphash24.h"
+#include "socket-netlink.h"
 #include "socket-util.h"
 #include "string-table.h"
 #include "string-util.h"
@@ -847,6 +854,111 @@ DnsServer *dns_server_find(DnsServer *first, int family, const union in_addr_uni
         return NULL;
 }
 
+static int manager_add_dns_server_by_string(Manager *m, DnsServerType type, const char *word) {
+        _cleanup_free_ char *server_name = NULL;
+        union in_addr_union address;
+        int family, r, ifindex = 0;
+        uint16_t port;
+        DnsServer *s;
+
+        assert(m);
+        assert(word);
+
+        r = in_addr_port_ifindex_name_from_string_auto(word, &family, &address, &port, &ifindex, &server_name);
+        if (r < 0)
+                return r;
+
+        /* Silently filter out 0.0.0.0, 127.0.0.53, 127.0.0.54 (our own stub DNS listener) */
+        if (!dns_server_address_valid(family, &address))
+                return 0;
+
+        /* By default, the port number is determined with the transaction feature level.
+         * See dns_transaction_port() and dns_server_port(). */
+        if (IN_SET(port, 53, 853))
+                port = 0;
+
+        /* Filter out duplicates */
+        s = dns_server_find(manager_get_first_dns_server(m, type), family, &address, port, ifindex, server_name);
+        if (s) {
+                /* Drop the marker. This is used to find the servers that ceased to exist, see
+                 * manager_mark_dns_servers() and manager_flush_marked_dns_servers(). */
+                dns_server_move_back_and_unmark(s);
+                return 0;
+        }
+
+        return dns_server_new(m, NULL, type, NULL, family, &address, port, ifindex, server_name, RESOLVE_CONFIG_SOURCE_FILE);
+}
+
+int manager_parse_dns_server_string_and_warn(Manager *m, DnsServerType type, const char *string) {
+        int r;
+
+        assert(m);
+        assert(string);
+
+        for (;;) {
+                _cleanup_free_ char *word = NULL;
+
+                r = extract_first_word(&string, &word, NULL, 0);
+                if (r <= 0)
+                        return r;
+
+                r = manager_add_dns_server_by_string(m, type, word);
+                if (r < 0)
+                        log_warning_errno(r, "Failed to add DNS server address '%s', ignoring: %m", word);
+        }
+}
+
+static int manager_add_search_domain_by_string(Manager *m, const char *domain) {
+        DnsSearchDomain *d;
+        bool route_only;
+        int r;
+
+        assert(m);
+        assert(domain);
+
+        route_only = *domain == '~';
+        if (route_only)
+                domain++;
+
+        if (dns_name_is_root(domain) || streq(domain, "*")) {
+                route_only = true;
+                domain = ".";
+        }
+
+        r = dns_search_domain_find(m->search_domains, domain, &d);
+        if (r < 0)
+                return r;
+        if (r > 0)
+                dns_search_domain_move_back_and_unmark(d);
+        else {
+                r = dns_search_domain_new(m, &d, DNS_SEARCH_DOMAIN_SYSTEM, NULL, domain);
+                if (r < 0)
+                        return r;
+        }
+
+        d->route_only = route_only;
+        return 0;
+}
+
+int manager_parse_search_domains_and_warn(Manager *m, const char *string) {
+        int r;
+
+        assert(m);
+        assert(string);
+
+        for (;;) {
+                _cleanup_free_ char *word = NULL;
+
+                r = extract_first_word(&string, &word, NULL, EXTRACT_UNQUOTE);
+                if (r <= 0)
+                        return r;
+
+                r = manager_add_search_domain_by_string(m, word);
+                if (r < 0)
+                        log_warning_errno(r, "Failed to add search domain '%s', ignoring: %m", word);
+        }
+}
+
 DnsServer *manager_get_first_dns_server(Manager *m, DnsServerType t) {
         assert(m);
 
diff --git a/src/resolve/resolved-dns-server.h b/src/resolve/resolved-dns-server.h
index 0f066b15b9..bb3c0e109f 100644
--- a/src/resolve/resolved-dns-server.h
+++ b/src/resolve/resolved-dns-server.h
@@ -6,6 +6,8 @@
 #include "in-addr-util.h"
 #include "list.h"
 #include "resolve-util.h"
+#include "resolved-conf.h"
+#include "resolved-dnstls.h"
 #include "time-util.h"
 
 typedef struct DnsScope DnsScope;
@@ -15,8 +17,6 @@ typedef struct DnsPacket DnsPacket;
 typedef struct Link Link;
 typedef struct Manager Manager;
 
-#include "resolved-dnstls.h"
-
 typedef enum DnsServerType {
         DNS_SERVER_SYSTEM,
         DNS_SERVER_FALLBACK,
@@ -25,8 +25,6 @@ typedef enum DnsServerType {
         _DNS_SERVER_TYPE_INVALID = -EINVAL,
 } DnsServerType;
 
-#include "resolved-conf.h"
-
 const char* dns_server_type_to_string(DnsServerType i) _const_;
 DnsServerType dns_server_type_from_string(const char *s) _pure_;
 
@@ -159,6 +157,9 @@ void dns_server_unlink_on_reload(DnsServer *server);
 bool dns_server_unlink_marked(DnsServer *first);
 void dns_server_mark_all(DnsServer *first);
 
+int manager_parse_search_domains_and_warn(Manager *m, const char *string);
+int manager_parse_dns_server_string_and_warn(Manager *m, DnsServerType type, const char *string);
+
 DnsServer *manager_get_first_dns_server(Manager *m, DnsServerType t);
 
 DnsServer *manager_set_dns_server(Manager *m, DnsServer *s);
diff --git a/src/resolve/resolved-dns-stream.c b/src/resolve/resolved-dns-stream.c
index 7545065bae..41c31c5a41 100644
--- a/src/resolve/resolved-dns-stream.c
+++ b/src/resolve/resolved-dns-stream.c
@@ -9,6 +9,8 @@
 #include "iovec-util.h"
 #include "macro.h"
 #include "missing_network.h"
+#include "resolved-dns-packet.h"
+#include "resolved-dns-server.h"
 #include "resolved-dns-stream.h"
 #include "resolved-manager.h"
 
diff --git a/src/resolve/resolved-dns-stream.h b/src/resolve/resolved-dns-stream.h
index d3de4ebf3d..8098e994bc 100644
--- a/src/resolve/resolved-dns-stream.h
+++ b/src/resolve/resolved-dns-stream.h
@@ -3,18 +3,19 @@
 
 #include "sd-event.h"
 
+#include "list.h"
 #include "ordered-set.h"
+#include "resolved-dnstls.h"
+#include "resolved-dns-packet.h"
 #include "socket-util.h"
 
+typedef struct DnsPacket DnsPacket;
 typedef struct DnsServer DnsServer;
 typedef struct DnsStream DnsStream;
 typedef struct DnsTransaction DnsTransaction;
 typedef struct Manager Manager;
 typedef struct DnsStubListenerExtra DnsStubListenerExtra;
 
-#include "resolved-dns-packet.h"
-#include "resolved-dnstls.h"
-
 /* Various timeouts for establishing TCP connections. First the default timeout for that. */
 #define DNS_STREAM_DEFAULT_TIMEOUT_USEC (10 * USEC_PER_SEC)
 
diff --git a/src/resolve/resolved-dns-stub.c b/src/resolve/resolved-dns-stub.c
index 7acfffbb66..08b35690ba 100644
--- a/src/resolve/resolved-dns-stub.c
+++ b/src/resolve/resolved-dns-stub.c
@@ -4,11 +4,22 @@
 #include <netinet/tcp.h>
 
 #include "capability-util.h"
+#include "dns-type.h"
 #include "errno-util.h"
 #include "fd-util.h"
+#include "log.h"
 #include "missing_network.h"
 #include "missing_socket.h"
+#include "resolve-util.h"
+#include "resolved-dns-answer.h"
+#include "resolved-dns-packet.h"
+#include "resolved-dns-query.h"
+#include "resolved-dns-question.h"
+#include "resolved-dns-rr.h"
+#include "resolved-dns-stream.h"
 #include "resolved-dns-stub.h"
+#include "resolved-dns-transaction.h"
+#include "resolved-manager.h"
 #include "socket-netlink.h"
 #include "socket-util.h"
 #include "stdio-util.h"
@@ -561,7 +572,7 @@ static int dns_stub_reply_with_edns0_do(DnsQuery *q) {
          * ourselves, or consider the data fully authenticated because we generated it locally, or the client
          * set cd */
 
-         return DNS_PACKET_DO(q->request_packet) &&
+         return dns_packet_do(q->request_packet) &&
                  (q->answer_dnssec_result >= 0 ||        /* we did proper DNSSEC validation … */
                   dns_query_fully_authenticated(q) ||    /* … or we considered it authentic otherwise … */
                   DNS_PACKET_CD(q->request_packet));     /* … or client set CD */
@@ -599,7 +610,7 @@ static int dns_stub_send_reply(
 
         r = dns_stub_make_reply_packet(
                         &reply,
-                        DNS_PACKET_PAYLOAD_SIZE_MAX(q->request_packet),
+                        dns_packet_payload_size_max(q->request_packet),
                         q->request_packet->question,
                         &truncated);
         if (r < 0)
@@ -626,7 +637,7 @@ static int dns_stub_send_reply(
                         DNS_PACKET_RD(q->request_packet),
                         !!q->request_packet->opt,
                         edns0_do,
-                        (DNS_PACKET_AD(q->request_packet) || DNS_PACKET_DO(q->request_packet)) && dns_query_fully_authenticated(q),
+                        (DNS_PACKET_AD(q->request_packet) || dns_packet_do(q->request_packet)) && dns_query_fully_authenticated(q),
                         FLAGS_SET(q->flags, SD_RESOLVED_NO_VALIDATE),
                         q->stub_listener_extra ? ADVERTISE_EXTRA_DATAGRAM_SIZE_MAX : ADVERTISE_DATAGRAM_SIZE_MAX,
                         dns_packet_has_nsid_request(q->request_packet) > 0 && !q->stub_listener_extra);
@@ -653,7 +664,7 @@ static int dns_stub_send_failure(
 
         r = dns_stub_make_reply_packet(
                         &reply,
-                        DNS_PACKET_PAYLOAD_SIZE_MAX(p),
+                        dns_packet_payload_size_max(p),
                         p->question,
                         &truncated);
         if (r < 0)
@@ -667,8 +678,8 @@ static int dns_stub_send_failure(
                         false,
                         DNS_PACKET_RD(p),
                         !!p->opt,
-                        DNS_PACKET_DO(p),
-                        (DNS_PACKET_AD(p) || DNS_PACKET_DO(p)) && authenticated,
+                        dns_packet_do(p),
+                        (DNS_PACKET_AD(p) || dns_packet_do(p)) && authenticated,
                         DNS_PACKET_CD(p),
                         l ? ADVERTISE_EXTRA_DATAGRAM_SIZE_MAX : ADVERTISE_DATAGRAM_SIZE_MAX,
                         dns_packet_has_nsid_request(p) > 0 && !l);
@@ -717,9 +728,9 @@ static int dns_stub_patch_bypass_reply_packet(
 
         /* Our upstream connection might have supported larger DNS requests than our downstream one, hence
          * set the TC bit if our reply is larger than what the client supports, and truncate. */
-        if (c->size > DNS_PACKET_PAYLOAD_SIZE_MAX(request)) {
+        if (c->size > dns_packet_payload_size_max(request)) {
                 log_debug("Artificially truncating stub response, as advertised size of client is smaller than upstream one.");
-                dns_packet_truncate(c, DNS_PACKET_PAYLOAD_SIZE_MAX(request));
+                dns_packet_truncate(c, dns_packet_payload_size_max(request));
                 DNS_PACKET_HEADER(c)->flags = htobe16(be16toh(DNS_PACKET_HEADER(c)->flags) | DNS_PACKET_FLAG_TC);
         }
 
@@ -934,7 +945,7 @@ static void dns_stub_process_query(Manager *m, DnsStubListenerExtra *l, DnsStrea
                 return;
         }
 
-        if (!DNS_PACKET_VERSION_SUPPORTED(p)) {
+        if (!dns_packet_version_supported(p)) {
                 log_debug("Got EDNS OPT field with unsupported version number.");
                 dns_stub_send_failure(m, l, s, p, DNS_RCODE_BADVERS, false);
                 return;
@@ -975,7 +986,7 @@ static void dns_stub_process_query(Manager *m, DnsStubListenerExtra *l, DnsStrea
                 log_debug("Got request to DNS proxy address 127.0.0.54, enabling bypass logic.");
                 bypass = true;
                 protocol_flags = SD_RESOLVED_DNS|SD_RESOLVED_NO_ZONE; /* Turn off mDNS/LLMNR for proxy stub. */
-        } else if (DNS_PACKET_DO(p)) {
+        } else if (dns_packet_do(p)) {
                 log_debug("Got request with DNSSEC enabled, enabling bypass logic.");
                 bypass = true;
         }
@@ -994,7 +1005,7 @@ static void dns_stub_process_query(Manager *m, DnsStubListenerExtra *l, DnsStrea
                                   protocol_flags|
                                   SD_RESOLVED_NO_SEARCH|
                                   (DNS_PACKET_CD(p) ? SD_RESOLVED_NO_VALIDATE | SD_RESOLVED_NO_CACHE : 0)|
-                                  (DNS_PACKET_DO(p) ? SD_RESOLVED_REQUIRE_PRIMARY : 0)|
+                                  (dns_packet_do(p) ? SD_RESOLVED_REQUIRE_PRIMARY : 0)|
                                   SD_RESOLVED_CLAMP_TTL);
         if (r == -ENOANO) /* Refuse query if there is -ENOANO */
                 return (void) dns_stub_send_failure(m, l, s, p, DNS_RCODE_REFUSED, false);
diff --git a/src/resolve/resolved-dns-stub.h b/src/resolve/resolved-dns-stub.h
index 3b9bf65b21..bfde108026 100644
--- a/src/resolve/resolved-dns-stub.h
+++ b/src/resolve/resolved-dns-stub.h
@@ -1,9 +1,13 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include "hash-funcs.h"
+#include "sd-event.h"
+
+#include "hashmap.h"
+#include "in-addr-util.h"
 
 typedef struct DnsStubListenerExtra DnsStubListenerExtra;
+typedef struct Manager Manager;
 
 typedef enum DnsStubListenerMode {
         DNS_STUB_LISTENER_NO,
@@ -14,8 +18,6 @@ typedef enum DnsStubListenerMode {
         _DNS_STUB_LISTENER_MODE_INVALID = -EINVAL,
 } DnsStubListenerMode;
 
-#include "resolved-manager.h"
-
 struct DnsStubListenerExtra {
         Manager *manager;
 
diff --git a/src/resolve/resolved-dns-synthesize.c b/src/resolve/resolved-dns-synthesize.c
index cccea54f02..0f19fa51c3 100644
--- a/src/resolve/resolved-dns-synthesize.c
+++ b/src/resolve/resolved-dns-synthesize.c
@@ -1,11 +1,20 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
 #include "alloc-util.h"
+#include "dns-domain.h"
+#include "dns-type.h"
 #include "env-util.h"
 #include "hostname-util.h"
 #include "local-addresses.h"
 #include "missing_network.h"
+#include "resolved-def.h"
+#include "resolved-dns-answer.h"
+#include "resolved-dns-packet.h"
+#include "resolved-dns-question.h"
+#include "resolved-dns-rr.h"
 #include "resolved-dns-synthesize.h"
+#include "resolved-manager.h"
+#include "socket-util.h"
 
 int dns_synthesize_family(uint64_t flags) {
 
diff --git a/src/resolve/resolved-dns-synthesize.h b/src/resolve/resolved-dns-synthesize.h
index ca39e682b4..f121eb442a 100644
--- a/src/resolve/resolved-dns-synthesize.h
+++ b/src/resolve/resolved-dns-synthesize.h
@@ -1,9 +1,14 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include "resolved-dns-answer.h"
-#include "resolved-dns-question.h"
-#include "resolved-manager.h"
+#include <stdbool.h>
+#include <stdint.h>
+
+typedef enum DnsProtocol DnsProtocol;
+
+typedef struct DnsAnswer DnsAnswer;
+typedef struct DnsQuestion DnsQuestion;
+typedef struct Manager Manager;
 
 int dns_synthesize_family(uint64_t flags);
 DnsProtocol dns_synthesize_protocol(uint64_t flags);
diff --git a/src/resolve/resolved-dns-transaction.c b/src/resolve/resolved-dns-transaction.c
index 7b7bd05871..3cf92da1f5 100644
--- a/src/resolve/resolved-dns-transaction.c
+++ b/src/resolve/resolved-dns-transaction.c
@@ -10,10 +10,19 @@
 #include "fd-util.h"
 #include "glyph-util.h"
 #include "random-util.h"
+#include "resolved-dns-answer.h"
 #include "resolved-dns-cache.h"
+#include "resolved-dns-packet.h"
+#include "resolved-dns-query.h"
+#include "resolved-dns-question.h"
+#include "resolved-dns-rr.h"
+#include "resolved-dns-scope.h"
+#include "resolved-dns-server.h"
 #include "resolved-dns-transaction.h"
 #include "resolved-dnstls.h"
+#include "resolved-link.h"
 #include "resolved-llmnr.h"
+#include "resolved-socket-graveyard.h"
 #include "resolved-timeouts.h"
 #include "string-table.h"
 
@@ -838,7 +847,7 @@ static void dns_transaction_cache_answer(DnsTransaction *t) {
                       t->answer_rcode,
                       t->answer,
                       /* If neither DO nor EDE is set, the full packet isn't useful to cache */
-                      DNS_PACKET_DO(t->received) || t->answer_ede_rcode > 0 || t->answer_ede_msg ? t->received : NULL,
+                      dns_packet_do(t->received) || t->answer_ede_rcode > 0 || t->answer_ede_msg ? t->received : NULL,
                       t->answer_query_flags,
                       t->answer_dnssec_result,
                       t->answer_nsec_ttl,
@@ -1080,7 +1089,7 @@ void dns_transaction_process_reply(DnsTransaction *t, DnsPacket *p, bool encrypt
          * server returns a failure response code. This ensures a more accurate count of the number of queries
          * that received a failure response code, as it doesn't consider retries. */
 
-        if (t->n_attempts == 1 && !IN_SET(DNS_PACKET_RCODE(p), DNS_RCODE_SUCCESS, DNS_RCODE_NXDOMAIN))
+        if (t->n_attempts == 1 && !IN_SET(dns_packet_rcode(p), DNS_RCODE_SUCCESS, DNS_RCODE_NXDOMAIN))
                 t->scope->manager->n_failure_responses_total++;
 
         /* Note that this call might invalidate the query. Callers
@@ -1089,7 +1098,7 @@ void dns_transaction_process_reply(DnsTransaction *t, DnsPacket *p, bool encrypt
 
         log_debug("Processing incoming packet of size %zu on transaction %" PRIu16" (rcode=%s).",
                   p->size,
-                  t->id, FORMAT_DNS_RCODE(DNS_PACKET_RCODE(p)));
+                  t->id, FORMAT_DNS_RCODE(dns_packet_rcode(p)));
 
         switch (t->scope->protocol) {
 
@@ -1239,16 +1248,16 @@ void dns_transaction_process_reply(DnsTransaction *t, DnsPacket *p, bool encrypt
                 (void) dns_packet_ede_rcode(p, &t->answer_ede_rcode, &t->answer_ede_msg);
 
                 if (!t->bypass &&
-                    IN_SET(DNS_PACKET_RCODE(p), DNS_RCODE_FORMERR, DNS_RCODE_SERVFAIL, DNS_RCODE_NOTIMP)) {
+                    IN_SET(dns_packet_rcode(p), DNS_RCODE_FORMERR, DNS_RCODE_SERVFAIL, DNS_RCODE_NOTIMP)) {
                         /* If the server has replied with detailed error data, using a degraded feature set
                          * will likely not help anyone. Examine the detailed error to determine the best
                          * course of action. */
-                        if (t->answer_ede_rcode >= 0 && DNS_PACKET_RCODE(p) == DNS_RCODE_SERVFAIL) {
+                        if (t->answer_ede_rcode >= 0 && dns_packet_rcode(p) == DNS_RCODE_SERVFAIL) {
                                 /* These codes are related to DNSSEC configuration errors. If accurate,
                                  * this is the domain operator's problem, and retrying won't help. */
                                 if (dns_ede_rcode_is_dnssec(t->answer_ede_rcode)) {
                                         log_debug("Server returned error: %s (%s%s%s). Lookup failed.",
-                                                  FORMAT_DNS_RCODE(DNS_PACKET_RCODE(p)),
+                                                  FORMAT_DNS_RCODE(dns_packet_rcode(p)),
                                                   FORMAT_DNS_EDE_RCODE(t->answer_ede_rcode),
                                                   isempty(t->answer_ede_msg) ? "" : ": ",
                                                   strempty(t->answer_ede_msg));
@@ -1261,7 +1270,7 @@ void dns_transaction_process_reply(DnsTransaction *t, DnsPacket *p, bool encrypt
                                 /* These codes probably indicate a transient error. Let's try again. */
                                 if (t->answer_ede_rcode == DNS_EDE_RCODE_NOT_READY) {
                                         log_debug("Server returned error: %s (%s%s%s), retrying transaction.",
-                                                  FORMAT_DNS_RCODE(DNS_PACKET_RCODE(p)),
+                                                  FORMAT_DNS_RCODE(dns_packet_rcode(p)),
                                                   FORMAT_DNS_EDE_RCODE(t->answer_ede_rcode),
                                                   isempty(t->answer_ede_msg) ? "" : ": ",
                                                   strempty(t->answer_ede_msg));
@@ -1272,7 +1281,7 @@ void dns_transaction_process_reply(DnsTransaction *t, DnsPacket *p, bool encrypt
                                 /* OK, the query failed, but we still shouldn't degrade the feature set for
                                  * this server. */
                                 log_debug("Server returned error: %s (%s%s%s)",
-                                          FORMAT_DNS_RCODE(DNS_PACKET_RCODE(p)),
+                                          FORMAT_DNS_RCODE(dns_packet_rcode(p)),
                                           FORMAT_DNS_EDE_RCODE(t->answer_ede_rcode),
                                           isempty(t->answer_ede_msg) ? "" : ": ",
                                           strempty(t->answer_ede_msg));
@@ -1294,7 +1303,7 @@ void dns_transaction_process_reply(DnsTransaction *t, DnsPacket *p, bool encrypt
                                         return;
 
                                 /* Give up, accept the rcode */
-                                log_debug("Server returned error: %s", FORMAT_DNS_RCODE(DNS_PACKET_RCODE(p)));
+                                log_debug("Server returned error: %s", FORMAT_DNS_RCODE(dns_packet_rcode(p)));
                                 break;
                         }
 
@@ -1304,11 +1313,11 @@ void dns_transaction_process_reply(DnsTransaction *t, DnsPacket *p, bool encrypt
                          * first attempt to downgrade. If so, clamp to the current value so that the transaction
                          * is retried without actually downgrading. If the next try also fails we will downgrade by
                          * hitting the else branch below. */
-                        if (DNS_PACKET_RCODE(p) == DNS_RCODE_SERVFAIL &&
+                        if (dns_packet_rcode(p) == DNS_RCODE_SERVFAIL &&
                             t->clamp_feature_level_servfail < 0) {
                                 t->clamp_feature_level_servfail = t->current_feature_level;
                                 log_debug("Server returned error %s, retrying transaction.",
-                                          FORMAT_DNS_RCODE(DNS_PACKET_RCODE(p)));
+                                          FORMAT_DNS_RCODE(dns_packet_rcode(p)));
                         } else {
                                 /* Reduce this feature level by one and try again. */
                                 switch (t->current_feature_level) {
@@ -1324,7 +1333,7 @@ void dns_transaction_process_reply(DnsTransaction *t, DnsPacket *p, bool encrypt
                                 }
 
                                 log_debug("Server returned error %s, retrying transaction with reduced feature level %s.",
-                                          FORMAT_DNS_RCODE(DNS_PACKET_RCODE(p)),
+                                          FORMAT_DNS_RCODE(dns_packet_rcode(p)),
                                           dns_server_feature_level_to_string(t->clamp_feature_level_servfail));
                         }
 
@@ -1332,7 +1341,7 @@ void dns_transaction_process_reply(DnsTransaction *t, DnsPacket *p, bool encrypt
                         return;
                 }
 
-                if (DNS_PACKET_RCODE(p) == DNS_RCODE_REFUSED) {
+                if (dns_packet_rcode(p) == DNS_RCODE_REFUSED) {
                         /* This server refused our request? If so, try again, use a different server */
                         if (t->answer_ede_rcode >= 0)
                                 log_debug("Server returned REFUSED (%s), switching servers, and retrying.",
@@ -1365,7 +1374,7 @@ void dns_transaction_process_reply(DnsTransaction *t, DnsPacket *p, bool encrypt
                 /* Report that we successfully received a valid packet with a good rcode after we initially got a bad
                  * rcode and subsequently downgraded the protocol */
 
-                if (IN_SET(DNS_PACKET_RCODE(p), DNS_RCODE_SUCCESS, DNS_RCODE_NXDOMAIN) &&
+                if (IN_SET(dns_packet_rcode(p), DNS_RCODE_SUCCESS, DNS_RCODE_NXDOMAIN) &&
                     t->clamp_feature_level_servfail != _DNS_SERVER_FEATURE_LEVEL_INVALID)
                         dns_server_packet_rcode_downgrade(t->server, t->clamp_feature_level_servfail);
 
@@ -1374,7 +1383,7 @@ void dns_transaction_process_reply(DnsTransaction *t, DnsPacket *p, bool encrypt
                         dns_server_packet_bad_opt(t->server, t->current_feature_level);
 
                 /* Report that the server didn't copy our query DO bit from request to response */
-                if (DNS_PACKET_DO(t->sent) && !DNS_PACKET_DO(t->received))
+                if (dns_packet_do(t->sent) && !dns_packet_do(t->received))
                         dns_server_packet_do_off(t->server, t->current_feature_level);
 
                 /* Report that we successfully received a packet. We keep track of the largest packet
@@ -1408,7 +1417,7 @@ void dns_transaction_process_reply(DnsTransaction *t, DnsPacket *p, bool encrypt
          * original complete record set, including RRSIG and friends. We use this when passing data to
          * clients that ask for DNSSEC metadata. */
         DNS_ANSWER_REPLACE(t->answer, dns_answer_ref(p->answer));
-        t->answer_rcode = DNS_PACKET_RCODE(p);
+        t->answer_rcode = dns_packet_rcode(p);
         t->answer_dnssec_result = _DNSSEC_RESULT_INVALID;
         SET_FLAG(t->answer_query_flags, SD_RESOLVED_AUTHENTICATED, false);
         SET_FLAG(t->answer_query_flags, SD_RESOLVED_CONFIDENTIAL, encrypted);
@@ -2788,6 +2797,20 @@ int dns_transaction_request_dnssec_keys(DnsTransaction *t) {
         return dns_transaction_dnssec_is_live(t);
 }
 
+DnsResourceKey* dns_transaction_key(DnsTransaction *t) {
+        assert(t);
+
+        /* Return the lookup key of this transaction. Either takes the lookup key from the bypass packet if
+         * we are a bypass transaction. Or take the configured key for regular transactions. */
+
+        if (t->key)
+                return t->key;
+
+        assert(t->bypass);
+
+        return dns_question_first_key(t->bypass->question);
+}
+
 void dns_transaction_notify(DnsTransaction *t, DnsTransaction *source) {
         assert(t);
         assert(source);
diff --git a/src/resolve/resolved-dns-transaction.h b/src/resolve/resolved-dns-transaction.h
index cea0a890db..85feffb0d0 100644
--- a/src/resolve/resolved-dns-transaction.h
+++ b/src/resolve/resolved-dns-transaction.h
@@ -2,20 +2,23 @@
 #pragma once
 
 #include "sd-event.h"
+
 #include "in-addr-util.h"
-
-typedef struct DnsTransaction DnsTransaction;
-typedef struct DnsTransactionFinder DnsTransactionFinder;
-typedef enum DnsTransactionState DnsTransactionState;
-typedef enum DnsTransactionSource DnsTransactionSource;
-
-#include "resolved-dns-answer.h"
+#include "list.h"
+#include "resolved-def.h"
 #include "resolved-dns-dnssec.h"
-#include "resolved-dns-packet.h"
-#include "resolved-dns-question.h"
 #include "resolved-dns-server.h"
+#include "set.h"
 
-enum DnsTransactionState {
+typedef struct DnsAnswer DnsAnswer;
+typedef struct DnsPacket DnsPacket;
+typedef struct DnsResourceKey DnsResourceKey;
+typedef struct DnsScope DnsScope;
+typedef struct DnsServer DnsServer;
+typedef struct DnsStream DnsStream;
+typedef struct DnsTransaction DnsTransaction;
+
+typedef enum DnsTransactionState {
         DNS_TRANSACTION_NULL,
         DNS_TRANSACTION_PENDING,
         DNS_TRANSACTION_VALIDATING,
@@ -36,18 +39,18 @@ enum DnsTransactionState {
         DNS_TRANSACTION_STUB_LOOP,
         _DNS_TRANSACTION_STATE_MAX,
         _DNS_TRANSACTION_STATE_INVALID = -EINVAL,
-};
+} DnsTransactionState;
 
 #define DNS_TRANSACTION_IS_LIVE(state) IN_SET((state), DNS_TRANSACTION_NULL, DNS_TRANSACTION_PENDING, DNS_TRANSACTION_VALIDATING)
 
-enum DnsTransactionSource {
+typedef enum DnsTransactionSource {
         DNS_TRANSACTION_NETWORK,
         DNS_TRANSACTION_CACHE,
         DNS_TRANSACTION_ZONE,
         DNS_TRANSACTION_TRUST_ANCHOR,
         _DNS_TRANSACTION_SOURCE_MAX,
         _DNS_TRANSACTION_SOURCE_INVALID = -EINVAL,
-};
+} DnsTransactionSource;
 
 struct DnsTransaction {
         DnsScope *scope;
@@ -163,19 +166,7 @@ void dns_transaction_notify(DnsTransaction *t, DnsTransaction *source);
 int dns_transaction_validate_dnssec(DnsTransaction *t);
 int dns_transaction_request_dnssec_keys(DnsTransaction *t);
 
-static inline DnsResourceKey *dns_transaction_key(DnsTransaction *t) {
-        assert(t);
-
-        /* Return the lookup key of this transaction. Either takes the lookup key from the bypass packet if
-         * we are a bypass transaction. Or take the configured key for regular transactions. */
-
-        if (t->key)
-                return t->key;
-
-        assert(t->bypass);
-
-        return dns_question_first_key(t->bypass->question);
-}
+DnsResourceKey* dns_transaction_key(DnsTransaction *t);
 
 static inline uint64_t dns_transaction_source_to_query_flags(DnsTransactionSource s) {
 
diff --git a/src/resolve/resolved-dns-trust-anchor.c b/src/resolve/resolved-dns-trust-anchor.c
index 1384363717..8cc495c898 100644
--- a/src/resolve/resolved-dns-trust-anchor.c
+++ b/src/resolve/resolved-dns-trust-anchor.c
@@ -12,7 +12,9 @@
 #include "log.h"
 #include "nulstr-util.h"
 #include "parse-util.h"
+#include "resolved-dns-answer.h"
 #include "resolved-dns-dnssec.h"
+#include "resolved-dns-rr.h"
 #include "resolved-dns-trust-anchor.h"
 #include "set.h"
 #include "string-util.h"
diff --git a/src/resolve/resolved-dns-trust-anchor.h b/src/resolve/resolved-dns-trust-anchor.h
index 14047ec7eb..969e648957 100644
--- a/src/resolve/resolved-dns-trust-anchor.h
+++ b/src/resolve/resolved-dns-trust-anchor.h
@@ -1,19 +1,19 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-typedef struct DnsTrustAnchor DnsTrustAnchor;
-
 #include "hashmap.h"
-#include "resolved-dns-answer.h"
-#include "resolved-dns-rr.h"
+
+typedef struct DnsAnswer DnsAnswer;
+typedef struct DnsResourceKey DnsResourceKey;
+typedef struct DnsResourceRecord DnsResourceRecord;
 
 /* This contains a fixed database mapping domain names to DS or DNSKEY records. */
 
-struct DnsTrustAnchor {
+typedef struct DnsTrustAnchor {
         Hashmap *positive_by_key;
         Set *negative_by_name;
         Set *revoked_by_rr;
-};
+} DnsTrustAnchor;
 
 int dns_trust_anchor_load(DnsTrustAnchor *d);
 void dns_trust_anchor_flush(DnsTrustAnchor *d);
diff --git a/src/resolve/resolved-dns-zone.c b/src/resolve/resolved-dns-zone.c
index d4ede46459..a471de7696 100644
--- a/src/resolve/resolved-dns-zone.c
+++ b/src/resolve/resolved-dns-zone.c
@@ -3,7 +3,11 @@
 #include "alloc-util.h"
 #include "dns-domain.h"
 #include "list.h"
+#include "resolved-dns-answer.h"
 #include "resolved-dns-packet.h"
+#include "resolved-dns-rr.h"
+#include "resolved-dns-scope.h"
+#include "resolved-dns-transaction.h"
 #include "resolved-dns-zone.h"
 #include "resolved-dnssd.h"
 #include "resolved-manager.h"
diff --git a/src/resolve/resolved-dns-zone.h b/src/resolve/resolved-dns-zone.h
index 1f5a6e0571..a4c0da5a7b 100644
--- a/src/resolve/resolved-dns-zone.h
+++ b/src/resolve/resolved-dns-zone.h
@@ -2,32 +2,32 @@
 #pragma once
 
 #include "hashmap.h"
+#include "list.h"
+
+typedef struct DnsAnswer DnsAnswer;
+typedef struct DnsResourceKey DnsResourceKey;
+typedef struct DnsResourceRecord DnsResourceRecord;
+typedef struct DnsScope DnsScope;
+typedef struct DnsTransaction DnsTransaction;
+typedef struct DnsZoneItem DnsZoneItem;
 
 typedef struct DnsZone {
         Hashmap *by_key;
         Hashmap *by_name;
 } DnsZone;
 
-typedef struct DnsZoneItem DnsZoneItem;
-typedef enum DnsZoneItemState DnsZoneItemState;
-
-#include "resolved-dns-answer.h"
-#include "resolved-dns-question.h"
-#include "resolved-dns-rr.h"
-#include "resolved-dns-transaction.h"
-
 /* RFC 4795 Section 2.8. suggests a TTL of 30s by default */
 #define LLMNR_DEFAULT_TTL (30)
 
 /* RFC 6762 Section 10. suggests a TTL of 120s by default */
 #define MDNS_DEFAULT_TTL (120)
 
-enum DnsZoneItemState {
+typedef enum DnsZoneItemState {
         DNS_ZONE_ITEM_PROBING,
         DNS_ZONE_ITEM_ESTABLISHED,
         DNS_ZONE_ITEM_VERIFYING,
         DNS_ZONE_ITEM_WITHDRAWN,
-};
+} DnsZoneItemState;
 
 struct DnsZoneItem {
         DnsScope *scope;
diff --git a/src/resolve/resolved-dnssd-bus.c b/src/resolve/resolved-dnssd-bus.c
index 1843382d9b..844b85ce0a 100644
--- a/src/resolve/resolved-dnssd-bus.c
+++ b/src/resolve/resolved-dnssd-bus.c
@@ -2,6 +2,7 @@
 
 #include "alloc-util.h"
 #include "bus-polkit.h"
+#include "resolved-dns-scope.h"
 #include "resolved-dnssd-bus.h"
 #include "resolved-dnssd.h"
 #include "resolved-link.h"
diff --git a/src/resolve/resolved-dnssd.c b/src/resolve/resolved-dnssd.c
index 00fd725044..55cbfcef7f 100644
--- a/src/resolve/resolved-dnssd.c
+++ b/src/resolve/resolved-dnssd.c
@@ -3,10 +3,12 @@
 #include "conf-files.h"
 #include "conf-parser.h"
 #include "constants.h"
+#include "dns-domain.h"
 #include "hexdecoct.h"
 #include "path-util.h"
 #include "resolved-conf.h"
 #include "resolved-dns-rr.h"
+#include "resolved-dns-zone.h"
 #include "resolved-dnssd.h"
 #include "resolved-manager.h"
 #include "specifier.h"
diff --git a/src/resolve/resolved-dnstls.c b/src/resolve/resolved-dnstls.c
index 5b259fa1b6..c56f62e1e3 100644
--- a/src/resolve/resolved-dnstls.c
+++ b/src/resolve/resolved-dnstls.c
@@ -10,6 +10,7 @@
 
 #include "io-util.h"
 #include "openssl-util.h"
+#include "resolved-dns-server.h"
 #include "resolved-dns-stream.h"
 #include "resolved-dnstls.h"
 #include "resolved-manager.h"
diff --git a/src/resolve/resolved-etc-hosts.c b/src/resolve/resolved-etc-hosts.c
index 0044cd4d95..14580cb9be 100644
--- a/src/resolve/resolved-etc-hosts.c
+++ b/src/resolve/resolved-etc-hosts.c
@@ -4,11 +4,16 @@
 #include <sys/types.h>
 #include <unistd.h>
 
+#include "dns-domain.h"
 #include "fd-util.h"
 #include "fileio.h"
 #include "hostname-util.h"
+#include "resolved-dns-answer.h"
+#include "resolved-dns-question.h"
+#include "resolved-dns-rr.h"
 #include "resolved-dns-synthesize.h"
 #include "resolved-etc-hosts.h"
+#include "resolved-manager.h"
 #include "socket-netlink.h"
 #include "stat-util.h"
 #include "string-util.h"
diff --git a/src/resolve/resolved-etc-hosts.h b/src/resolve/resolved-etc-hosts.h
index 805a09bb6d..032654fcad 100644
--- a/src/resolve/resolved-etc-hosts.h
+++ b/src/resolve/resolved-etc-hosts.h
@@ -1,9 +1,19 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include "resolved-manager.h"
-#include "resolved-dns-question.h"
-#include "resolved-dns-answer.h"
+#include "in-addr-util.h"
+#include "set.h"
+
+typedef struct DnsAnswer DnsAnswer;
+typedef struct DnsQuestion DnsQuestion;
+typedef struct EtcHosts EtcHosts;
+typedef struct Manager Manager;
+
+typedef struct EtcHosts {
+        Hashmap *by_address;
+        Hashmap *by_name;
+        Set *no_address;
+} EtcHosts;
 
 typedef struct EtcHostsItemByAddress {
         struct in_addr_data address;
diff --git a/src/resolve/resolved-gperf.gperf b/src/resolve/resolved-gperf.gperf
index 0124ef4208..c548320449 100644
--- a/src/resolve/resolved-gperf.gperf
+++ b/src/resolve/resolved-gperf.gperf
@@ -7,6 +7,7 @@ _Pragma("GCC diagnostic ignored \"-Wzero-as-null-pointer-constant\"")
 #include <stddef.h>
 #include "conf-parser.h"
 #include "resolved-conf.h"
+#include "resolved-dns-server.h"
 #include "resolved-manager.h"
 %}
 struct ConfigPerfItem;
diff --git a/src/resolve/resolved-link-bus.c b/src/resolve/resolved-link-bus.c
index c5c986bd53..8b4e492e88 100644
--- a/src/resolve/resolved-link-bus.c
+++ b/src/resolve/resolved-link-bus.c
@@ -9,10 +9,15 @@
 #include "bus-get-properties.h"
 #include "bus-message-util.h"
 #include "bus-polkit.h"
+#include "dns-domain.h"
 #include "log-link.h"
 #include "parse-util.h"
 #include "resolve-util.h"
 #include "resolved-bus.h"
+#include "resolved-def.h"
+#include "resolved-dns-search-domain.h"
+#include "resolved-dns-server.h"
+#include "resolved-link.h"
 #include "resolved-link-bus.h"
 #include "resolved-llmnr.h"
 #include "resolved-mdns.h"
diff --git a/src/resolve/resolved-link-bus.h b/src/resolve/resolved-link-bus.h
index a450c51e56..e798aae74a 100644
--- a/src/resolve/resolved-link-bus.h
+++ b/src/resolve/resolved-link-bus.h
@@ -3,8 +3,9 @@
 
 #include "sd-bus.h"
 
-#include "bus-util.h"
-#include "resolved-link.h"
+#include "bus-object.h"
+
+typedef struct Link Link;
 
 extern const BusObjectImplementation link_object;
 
diff --git a/src/resolve/resolved-link.c b/src/resolve/resolved-link.c
index d6cd902a37..2a9d606bb4 100644
--- a/src/resolve/resolved-link.c
+++ b/src/resolve/resolved-link.c
@@ -6,6 +6,7 @@
 #include "sd-network.h"
 
 #include "alloc-util.h"
+#include "dns-domain.h"
 #include "env-file.h"
 #include "fd-util.h"
 #include "fileio.h"
@@ -14,7 +15,11 @@
 #include "mkdir.h"
 #include "netif-util.h"
 #include "parse-util.h"
+#include "resolved-dns-packet.h"
+#include "resolved-dns-rr.h"
 #include "resolved-dns-scope.h"
+#include "resolved-dns-search-domain.h"
+#include "resolved-dns-server.h"
 #include "resolved-link.h"
 #include "resolved-llmnr.h"
 #include "resolved-mdns.h"
diff --git a/src/resolve/resolved-link.h b/src/resolve/resolved-link.h
index 04c11bc412..3ae0c20925 100644
--- a/src/resolve/resolved-link.h
+++ b/src/resolve/resolved-link.h
@@ -6,17 +6,18 @@
 #include "sd-netlink.h"
 
 #include "in-addr-util.h"
+#include "list.h"
 #include "network-util.h"
 #include "ratelimit.h"
 #include "resolve-util.h"
 
+typedef struct DnsResourceRecord DnsResourceRecord;
+typedef struct DnsScope DnsScope;
+typedef struct DnsSearchDomain DnsSearchDomain;
+typedef struct DnsServer DnsServer;
 typedef struct Link Link;
 typedef struct LinkAddress LinkAddress;
-
-#include "resolved-dns-rr.h"
-#include "resolved-dns-scope.h"
-#include "resolved-dns-search-domain.h"
-#include "resolved-dns-server.h"
+typedef struct Manager Manager;
 
 #define LINK_SEARCH_DOMAINS_MAX 256
 #define LINK_DNS_SERVERS_MAX 256
diff --git a/src/resolve/resolved-llmnr.c b/src/resolve/resolved-llmnr.c
index abb9c46960..5fdecc97eb 100644
--- a/src/resolve/resolved-llmnr.c
+++ b/src/resolve/resolved-llmnr.c
@@ -6,6 +6,10 @@
 
 #include "errno-util.h"
 #include "fd-util.h"
+#include "resolved-dns-packet.h"
+#include "resolved-dns-scope.h"
+#include "resolved-dns-transaction.h"
+#include "resolved-link.h"
 #include "resolved-llmnr.h"
 #include "resolved-manager.h"
 
diff --git a/src/resolve/resolved-manager.c b/src/resolve/resolved-manager.c
index 12d6db3347..174db4dcc5 100644
--- a/src/resolve/resolved-manager.c
+++ b/src/resolve/resolved-manager.c
@@ -33,16 +33,28 @@
 #include "random-util.h"
 #include "resolved-bus.h"
 #include "resolved-conf.h"
+#include "resolved-dns-answer.h"
+#include "resolved-dns-packet.h"
+#include "resolved-dns-query.h"
+#include "resolved-dns-question.h"
+#include "resolved-dns-rr.h"
+#include "resolved-dns-scope.h"
+#include "resolved-dns-search-domain.h"
+#include "resolved-dns-server.h"
 #include "resolved-dns-stub.h"
+#include "resolved-dns-transaction.h"
 #include "resolved-dnssd.h"
 #include "resolved-etc-hosts.h"
+#include "resolved-link.h"
 #include "resolved-llmnr.h"
 #include "resolved-manager.h"
 #include "resolved-mdns.h"
 #include "resolved-resolv-conf.h"
+#include "resolved-socket-graveyard.h"
 #include "resolved-util.h"
 #include "resolved-varlink.h"
 #include "socket-util.h"
+#include "socket-netlink.h"
 #include "string-table.h"
 #include "string-util.h"
 #include "utf8.h"
diff --git a/src/resolve/resolved-manager.h b/src/resolve/resolved-manager.h
index 7aac4afe10..e3f98be33d 100644
--- a/src/resolve/resolved-manager.h
+++ b/src/resolve/resolved-manager.h
@@ -3,6 +3,7 @@
 
 #include <sys/stat.h>
 
+#include "sd-bus.h"
 #include "sd-event.h"
 #include "sd-netlink.h"
 #include "sd-network.h"
@@ -13,27 +14,28 @@
 #include "list.h"
 #include "ordered-set.h"
 #include "resolve-util.h"
-
-typedef struct Manager Manager;
-
-#include "resolved-dns-query.h"
-#include "resolved-dns-search-domain.h"
+#include "resolved-dns-dnssec.h"
 #include "resolved-dns-stream.h"
 #include "resolved-dns-stub.h"
 #include "resolved-dns-trust-anchor.h"
-#include "resolved-link.h"
-#include "resolved-socket-graveyard.h"
+#include "resolved-dnstls.h"
+#include "resolved-etc-hosts.h"
+
+typedef enum DnsServerType DnsServerType;
+
+typedef struct DnsQuery DnsQuery;
+typedef struct DnsResourceKey DnsResourceKey;
+typedef struct DnsSearchDomain DnsSearchDomain;
+typedef struct DnsScope DnsScope;
+typedef struct DnsServer DnsServer;
+typedef struct Link Link;
+typedef struct LinkAddress LinkAddress;
+typedef struct SocketGraveyard SocketGraveyard;
 
 #define MANAGER_SEARCH_DOMAINS_MAX 256
 #define MANAGER_DNS_SERVERS_MAX 256
 
-typedef struct EtcHosts {
-        Hashmap *by_address;
-        Hashmap *by_name;
-        Set *no_address;
-} EtcHosts;
-
-struct Manager {
+typedef struct Manager {
         sd_event *event;
 
         ResolveSupport llmnr_support;
@@ -170,7 +172,7 @@ struct Manager {
         size_t n_socket_graveyard;
 
         struct sigrtmin18_info sigrtmin18_info;
-};
+} Manager;
 
 /* Manager */
 
diff --git a/src/resolve/resolved-mdns.c b/src/resolve/resolved-mdns.c
index 4e6aade726..19275d9d34 100644
--- a/src/resolve/resolved-mdns.c
+++ b/src/resolve/resolved-mdns.c
@@ -5,7 +5,15 @@
 #include <arpa/inet.h>
 
 #include "alloc-util.h"
+#include "dns-domain.h"
 #include "fd-util.h"
+#include "resolved-dns-answer.h"
+#include "resolved-dns-packet.h"
+#include "resolved-dns-question.h"
+#include "resolved-dns-rr.h"
+#include "resolved-dns-scope.h"
+#include "resolved-dns-transaction.h"
+#include "resolved-link.h"
 #include "resolved-manager.h"
 #include "resolved-mdns.h"
 #include "sort-util.h"
@@ -497,7 +505,7 @@ static int on_mdns_packet(sd_event_source *s, int fd, uint32_t revents, void *us
                         scope->manager->enable_cache,
                         DNS_PROTOCOL_MDNS,
                         NULL,
-                        DNS_PACKET_RCODE(p),
+                        dns_packet_rcode(p),
                         p->answer,
                         NULL,
                         false,
diff --git a/src/resolve/resolved-mdns.h b/src/resolve/resolved-mdns.h
index c52bce1069..319fa53703 100644
--- a/src/resolve/resolved-mdns.h
+++ b/src/resolve/resolved-mdns.h
@@ -1,7 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include "resolved-manager.h"
+typedef struct Manager Manager;
 
 #define MDNS_PORT 5353
 #define MDNS_ANNOUNCE_DELAY (1 * USEC_PER_SEC)
diff --git a/src/resolve/resolved-resolv-conf.c b/src/resolve/resolved-resolv-conf.c
index 2071e0810c..3f4c67ecbc 100644
--- a/src/resolve/resolved-resolv-conf.c
+++ b/src/resolve/resolved-resolv-conf.c
@@ -14,7 +14,12 @@
 #include "ordered-set.h"
 #include "path-util.h"
 #include "resolved-conf.h"
+#include "resolved-dns-cache.h"
+#include "resolved-dns-scope.h"
+#include "resolved-dns-search-domain.h"
 #include "resolved-dns-server.h"
+#include "resolved-dns-stub.h"
+#include "resolved-manager.h"
 #include "resolved-resolv-conf.h"
 #include "stat-util.h"
 #include "string-table.h"
diff --git a/src/resolve/resolved-resolv-conf.h b/src/resolve/resolved-resolv-conf.h
index 8c0dee876b..6738af6199 100644
--- a/src/resolve/resolved-resolv-conf.h
+++ b/src/resolve/resolved-resolv-conf.h
@@ -1,7 +1,11 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include "resolved-manager.h"
+#include <errno.h>
+
+#include "macro.h"
+
+typedef struct Manager Manager;
 
 int manager_check_resolv_conf(const Manager *m);
 int manager_read_resolv_conf(Manager *m);
diff --git a/src/resolve/resolved-socket-graveyard.c b/src/resolve/resolved-socket-graveyard.c
index 9605d725ba..0b04002baf 100644
--- a/src/resolve/resolved-socket-graveyard.c
+++ b/src/resolve/resolved-socket-graveyard.c
@@ -1,5 +1,6 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
+#include "resolved-manager.h"
 #include "resolved-socket-graveyard.h"
 
 #define SOCKET_GRAVEYARD_USEC (5 * USEC_PER_SEC)
diff --git a/src/resolve/resolved-socket-graveyard.h b/src/resolve/resolved-socket-graveyard.h
index 50c6aad544..90417313fb 100644
--- a/src/resolve/resolved-socket-graveyard.h
+++ b/src/resolve/resolved-socket-graveyard.h
@@ -1,9 +1,13 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-typedef struct SocketGraveyard SocketGraveyard;
+#include "sd-event.h"
 
-#include "resolved-manager.h"
+#include "list.h"
+#include "time-util.h"
+
+typedef struct Manager Manager;
+typedef struct SocketGraveyard SocketGraveyard;
 
 struct SocketGraveyard {
         Manager *manager;
diff --git a/src/resolve/resolved-varlink.c b/src/resolve/resolved-varlink.c
index a69cfb7f2d..dd4c137c75 100644
--- a/src/resolve/resolved-varlink.c
+++ b/src/resolve/resolved-varlink.c
@@ -1,10 +1,24 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
 #include "bus-polkit.h"
+#include "dns-domain.h"
+#include "dns-type.h"
 #include "glyph-util.h"
 #include "in-addr-util.h"
 #include "json-util.h"
+#include "resolved-dns-answer.h"
+#include "resolved-dns-dnssec.h"
+#include "resolved-dns-packet.h"
+#include "resolved-dns-query.h"
+#include "resolved-dns-question.h"
+#include "resolved-dns-rr.h"
+#include "resolved-dns-scope.h"
+#include "resolved-dns-search-domain.h"
+#include "resolved-dns-server.h"
 #include "resolved-dns-synthesize.h"
+#include "resolved-dns-transaction.h"
+#include "resolved-link.h"
+#include "resolved-manager.h"
 #include "resolved-varlink.h"
 #include "socket-netlink.h"
 #include "varlink-io.systemd.Resolve.h"
diff --git a/src/resolve/resolved-varlink.h b/src/resolve/resolved-varlink.h
index 57fdfe909b..b96700719b 100644
--- a/src/resolve/resolved-varlink.h
+++ b/src/resolve/resolved-varlink.h
@@ -1,7 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include "resolved-manager.h"
+typedef struct Manager Manager;
 
 int manager_varlink_init(Manager *m);
 void manager_varlink_done(Manager *m);
diff --git a/src/resolve/test-dns-packet-append.c b/src/resolve/test-dns-packet-append.c
index 8942050927..df311286a3 100644
--- a/src/resolve/test-dns-packet-append.c
+++ b/src/resolve/test-dns-packet-append.c
@@ -1,7 +1,9 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
 #include "dns-type.h"
+#include "resolved-dns-answer.h"
 #include "resolved-dns-packet.h"
+#include "resolved-dns-question.h"
 #include "resolved-dns-rr.h"
 
 #include "list.h"
@@ -37,7 +39,7 @@ TEST(packet_set_flags_dns_checking_enabled) {
         ASSERT_EQ(DNS_PACKET_RA(packet), 0);
         ASSERT_EQ(DNS_PACKET_AD(packet), 0);
         ASSERT_EQ(DNS_PACKET_CD(packet), 0);
-        ASSERT_EQ(DNS_PACKET_RCODE(packet), 0);
+        ASSERT_EQ(dns_packet_rcode(packet), 0);
 }
 
 TEST(packet_set_flags_dns_checking_disabled) {
@@ -56,7 +58,7 @@ TEST(packet_set_flags_dns_checking_disabled) {
         ASSERT_EQ(DNS_PACKET_RA(packet), 0);
         ASSERT_EQ(DNS_PACKET_AD(packet), 0);
         ASSERT_EQ(DNS_PACKET_CD(packet), 1);
-        ASSERT_EQ(DNS_PACKET_RCODE(packet), 0);
+        ASSERT_EQ(dns_packet_rcode(packet), 0);
 }
 
 TEST(packet_set_flags_llmnr) {
@@ -75,7 +77,7 @@ TEST(packet_set_flags_llmnr) {
         ASSERT_EQ(DNS_PACKET_RA(packet), 0);
         ASSERT_EQ(DNS_PACKET_AD(packet), 0);
         ASSERT_EQ(DNS_PACKET_CD(packet), 0);
-        ASSERT_EQ(DNS_PACKET_RCODE(packet), 0);
+        ASSERT_EQ(dns_packet_rcode(packet), 0);
 }
 
 TEST(packet_set_flags_mdns_not_truncated) {
@@ -94,7 +96,7 @@ TEST(packet_set_flags_mdns_not_truncated) {
         ASSERT_EQ(DNS_PACKET_RA(packet), 0);
         ASSERT_EQ(DNS_PACKET_AD(packet), 0);
         ASSERT_EQ(DNS_PACKET_CD(packet), 0);
-        ASSERT_EQ(DNS_PACKET_RCODE(packet), 0);
+        ASSERT_EQ(dns_packet_rcode(packet), 0);
 }
 
 TEST(packet_set_flags_mdns_truncated) {
@@ -113,7 +115,7 @@ TEST(packet_set_flags_mdns_truncated) {
         ASSERT_EQ(DNS_PACKET_RA(packet), 0);
         ASSERT_EQ(DNS_PACKET_AD(packet), 0);
         ASSERT_EQ(DNS_PACKET_CD(packet), 0);
-        ASSERT_EQ(DNS_PACKET_RCODE(packet), 0);
+        ASSERT_EQ(dns_packet_rcode(packet), 0);
 }
 
 /* ================================================================
diff --git a/src/resolve/test-dns-packet-extract.c b/src/resolve/test-dns-packet-extract.c
index 0bded09077..c63484578b 100644
--- a/src/resolve/test-dns-packet-extract.c
+++ b/src/resolve/test-dns-packet-extract.c
@@ -1,7 +1,9 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
 #include "dns-type.h"
+#include "resolved-dns-answer.h"
 #include "resolved-dns-packet.h"
+#include "resolved-dns-question.h"
 #include "resolved-dns-rr.h"
 
 #include "log.h"
@@ -45,7 +47,7 @@ TEST(packet_header_query_basic) {
         ASSERT_EQ(DNS_PACKET_RA(packet), 0);
         ASSERT_EQ(DNS_PACKET_AD(packet), 0);
         ASSERT_EQ(DNS_PACKET_CD(packet), 0);
-        ASSERT_EQ(DNS_PACKET_RCODE(packet), 0);
+        ASSERT_EQ(dns_packet_rcode(packet), 0);
 
         ASSERT_EQ(DNS_PACKET_QDCOUNT(packet), 1);
         ASSERT_EQ(DNS_PACKET_ANCOUNT(packet), 0);
@@ -78,7 +80,7 @@ TEST(packet_header_query_status_recursion_desired) {
         ASSERT_EQ(DNS_PACKET_RA(packet), 0);
         ASSERT_EQ(DNS_PACKET_AD(packet), 0);
         ASSERT_EQ(DNS_PACKET_CD(packet), 0);
-        ASSERT_EQ(DNS_PACKET_RCODE(packet), 0);
+        ASSERT_EQ(dns_packet_rcode(packet), 0);
 
         ASSERT_EQ(DNS_PACKET_QDCOUNT(packet), 339);
         ASSERT_EQ(DNS_PACKET_ANCOUNT(packet), 0);
@@ -111,7 +113,7 @@ TEST(packet_header_reply_authoritative) {
         ASSERT_EQ(DNS_PACKET_RA(packet), 0);
         ASSERT_EQ(DNS_PACKET_AD(packet), 0);
         ASSERT_EQ(DNS_PACKET_CD(packet), 0);
-        ASSERT_EQ(DNS_PACKET_RCODE(packet), DNS_RCODE_SUCCESS);
+        ASSERT_EQ(dns_packet_rcode(packet), DNS_RCODE_SUCCESS);
 
         ASSERT_EQ(DNS_PACKET_QDCOUNT(packet), 3);
         ASSERT_EQ(DNS_PACKET_ANCOUNT(packet), 4);
@@ -144,7 +146,7 @@ TEST(packet_header_reply_nxdomain) {
         ASSERT_EQ(DNS_PACKET_RA(packet), 0);
         ASSERT_EQ(DNS_PACKET_AD(packet), 0);
         ASSERT_EQ(DNS_PACKET_CD(packet), 0);
-        ASSERT_EQ(DNS_PACKET_RCODE(packet), DNS_RCODE_NXDOMAIN);
+        ASSERT_EQ(dns_packet_rcode(packet), DNS_RCODE_NXDOMAIN);
 
         ASSERT_EQ(DNS_PACKET_QDCOUNT(packet), 1);
         ASSERT_EQ(DNS_PACKET_ANCOUNT(packet), 0);
@@ -177,7 +179,7 @@ TEST(packet_header_reply_recursive_non_authoritative) {
         ASSERT_EQ(DNS_PACKET_RA(packet), 1);
         ASSERT_EQ(DNS_PACKET_AD(packet), 0);
         ASSERT_EQ(DNS_PACKET_CD(packet), 0);
-        ASSERT_EQ(DNS_PACKET_RCODE(packet), DNS_RCODE_SUCCESS);
+        ASSERT_EQ(dns_packet_rcode(packet), DNS_RCODE_SUCCESS);
 
         ASSERT_EQ(DNS_PACKET_QDCOUNT(packet), 1283);
         ASSERT_EQ(DNS_PACKET_ANCOUNT(packet), 3588);
@@ -210,7 +212,7 @@ TEST(packet_header_reply_delegate) {
         ASSERT_EQ(DNS_PACKET_RA(packet), 0);
         ASSERT_EQ(DNS_PACKET_AD(packet), 0);
         ASSERT_EQ(DNS_PACKET_CD(packet), 0);
-        ASSERT_EQ(DNS_PACKET_RCODE(packet), DNS_RCODE_SUCCESS);
+        ASSERT_EQ(dns_packet_rcode(packet), DNS_RCODE_SUCCESS);
 
         ASSERT_EQ(DNS_PACKET_QDCOUNT(packet), 1);
         ASSERT_EQ(DNS_PACKET_ANCOUNT(packet), 0);
@@ -243,7 +245,7 @@ TEST(packet_header_reply_dnssec_bits) {
         ASSERT_EQ(DNS_PACKET_RA(packet), 0);
         ASSERT_EQ(DNS_PACKET_AD(packet), 1);
         ASSERT_EQ(DNS_PACKET_CD(packet), 1);
-        ASSERT_EQ(DNS_PACKET_RCODE(packet), DNS_RCODE_SUCCESS);
+        ASSERT_EQ(dns_packet_rcode(packet), DNS_RCODE_SUCCESS);
 
         ASSERT_EQ(DNS_PACKET_QDCOUNT(packet), 3);
         ASSERT_EQ(DNS_PACKET_ANCOUNT(packet), 4);
@@ -2984,9 +2986,9 @@ TEST(packet_reply_opt_no_do_empty) {
         ASSERT_TRUE(dns_resource_record_equal(packet->opt, rr));
         dns_resource_record_unref(rr);
 
-        ASSERT_EQ(DNS_PACKET_PAYLOAD_SIZE_MAX(packet), 513u);
-        ASSERT_EQ(DNS_PACKET_RCODE(packet), 2467u);
-        ASSERT_EQ(DNS_PACKET_DO(packet), 0u);
+        ASSERT_EQ(dns_packet_payload_size_max(packet), 513u);
+        ASSERT_EQ(dns_packet_rcode(packet), 2467u);
+        ASSERT_EQ(dns_packet_do(packet), 0u);
 }
 
 TEST(packet_reply_opt_multiple) {
@@ -3116,8 +3118,8 @@ TEST(packet_query_opt_version_ok) {
         ASSERT_TRUE(dns_resource_record_equal(packet->opt, rr));
         dns_resource_record_unref(rr);
 
-        ASSERT_EQ(DNS_PACKET_PAYLOAD_SIZE_MAX(packet), 513u);
-        ASSERT_EQ(DNS_PACKET_DO(packet), 0u);
+        ASSERT_EQ(dns_packet_payload_size_max(packet), 513u);
+        ASSERT_EQ(dns_packet_do(packet), 0u);
 }
 
 TEST(packet_reply_opt_version_bad) {
@@ -3182,8 +3184,8 @@ TEST(packet_reply_opt_with_do) {
         ASSERT_TRUE(dns_resource_record_equal(packet->opt, rr));
         dns_resource_record_unref(rr);
 
-        ASSERT_EQ(DNS_PACKET_PAYLOAD_SIZE_MAX(packet), 4097u);
-        ASSERT_EQ(DNS_PACKET_DO(packet), 1u);
+        ASSERT_EQ(dns_packet_payload_size_max(packet), 4097u);
+        ASSERT_EQ(dns_packet_do(packet), 1u);
 }
 
 TEST(packet_reply_opt_with_data) {
diff --git a/src/resolve/test-dns-query.c b/src/resolve/test-dns-query.c
index 53c4588474..6ae6b9e09e 100644
--- a/src/resolve/test-dns-query.c
+++ b/src/resolve/test-dns-query.c
@@ -1,10 +1,15 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
 #include "log.h"
+#include "resolved-dns-answer.h"
+#include "resolved-dns-packet.h"
 #include "resolved-dns-query.h"
+#include "resolved-dns-question.h"
 #include "resolved-dns-rr.h"
 #include "resolved-dns-scope.h"
+#include "resolved-dns-search-domain.h"
 #include "resolved-dns-server.h"
+#include "resolved-dns-transaction.h"
 #include "resolved-link.h"
 #include "resolved-manager.h"
 #include "tests.h"
diff --git a/src/resolve/test-dns-synthesize.c b/src/resolve/test-dns-synthesize.c
index 64523f4854..eb25a7fbe7 100644
--- a/src/resolve/test-dns-synthesize.c
+++ b/src/resolve/test-dns-synthesize.c
@@ -2,6 +2,7 @@
 
 #include "log.h"
 #include "resolved-dns-answer.h"
+#include "resolved-dns-packet.h"
 #include "resolved-dns-question.h"
 #include "resolved-dns-rr.h"
 #include "resolved-dns-synthesize.h"
diff --git a/src/resolve/test-dns-zone.c b/src/resolve/test-dns-zone.c
index e2d46248b1..b1cfbb697a 100644
--- a/src/resolve/test-dns-zone.c
+++ b/src/resolve/test-dns-zone.c
@@ -1,6 +1,8 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
 #include "dns-type.h"
+#include "resolved-dns-answer.h"
+#include "resolved-dns-packet.h"
 #include "resolved-dns-rr.h"
 #include "resolved-dns-scope.h"
 #include "resolved-dns-zone.h"
diff --git a/src/resolve/test-dnssec.c b/src/resolve/test-dnssec.c
index 59ce0c7b2d..dc2e3f076c 100644
--- a/src/resolve/test-dnssec.c
+++ b/src/resolve/test-dnssec.c
@@ -6,6 +6,7 @@
 
 #include "alloc-util.h"
 #include "hexdecoct.h"
+#include "resolved-dns-answer.h"
 #include "resolved-dns-dnssec.h"
 #include "resolved-dns-rr.h"
 #include "string-util.h"
diff --git a/src/resolve/test-resolved-dummy-server.c b/src/resolve/test-resolved-dummy-server.c
index a47fafa2a6..705965f30e 100644
--- a/src/resolve/test-resolved-dummy-server.c
+++ b/src/resolve/test-resolved-dummy-server.c
@@ -2,11 +2,13 @@
 
 #include "sd-daemon.h"
 
+#include "dns-type.h"
 #include "fd-util.h"
 #include "iovec-util.h"
 #include "log.h"
 #include "main-func.h"
 #include "resolved-dns-packet.h"
+#include "resolved-dns-question.h"
 #include "resolved-manager.h"
 #include "socket-netlink.h"
 #include "socket-util.h"
@@ -176,7 +178,7 @@ static int make_reply_packet(DnsPacket *packet, DnsPacket **ret) {
         assert(packet);
         assert(ret);
 
-        r = dns_packet_new(&p, DNS_PROTOCOL_DNS, 0, DNS_PACKET_PAYLOAD_SIZE_MAX(packet));
+        r = dns_packet_new(&p, DNS_PROTOCOL_DNS, 0, dns_packet_payload_size_max(packet));
         if (r < 0)
                 return r;
 
diff --git a/src/resolve/test-resolved-link.c b/src/resolve/test-resolved-link.c
index 54de7f7ce2..3f6af5d324 100644
--- a/src/resolve/test-resolved-link.c
+++ b/src/resolve/test-resolved-link.c
@@ -4,6 +4,9 @@
 #include <linux/if.h>
 
 #include "netlink-internal.h"
+#include "resolved-dns-packet.h"
+#include "resolved-dns-scope.h"
+#include "resolved-dns-server.h"
 #include "resolved-link.h"
 #include "resolved-manager.h"
 
diff --git a/src/resolve/test-resolved-packet.c b/src/resolve/test-resolved-packet.c
index cccbf54d46..af1332bb54 100644
--- a/src/resolve/test-resolved-packet.c
+++ b/src/resolve/test-resolved-packet.c
@@ -1,8 +1,12 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
+#include "sd-json.h"
+
 #include "hexdecoct.h"
 #include "log.h"
+#include "resolved-dns-answer.h"
 #include "resolved-dns-packet.h"
+#include "resolved-dns-rr.h"
 #include "tests.h"
 
 TEST(dns_packet_new) {
diff --git a/src/sbsign/authenticode.h b/src/sbsign/authenticode.h
index 98a8374805..04bd336e0c 100644
--- a/src/sbsign/authenticode.h
+++ b/src/sbsign/authenticode.h
@@ -3,7 +3,7 @@
 
 #include <openssl/asn1t.h>
 
-#include "macro.h"
+#include "memory-util.h"
 
 #define SPC_INDIRECT_DATA_OBJID "1.3.6.1.4.1.311.2.1.4"
 #define SPC_PE_IMAGE_DATA_OBJID "1.3.6.1.4.1.311.2.1.15"
diff --git a/src/shared/bpf-compat.h b/src/shared/bpf-compat.h
index 3d94bf2e05..27857e9d72 100644
--- a/src/shared/bpf-compat.h
+++ b/src/shared/bpf-compat.h
@@ -1,6 +1,8 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
+#include <bpf/libbpf.h>
+
 /* libbpf has been moving quickly.
  * They added new symbols in the 0.x versions and shortly after removed
  * deprecated symbols in 1.0.
diff --git a/src/shared/cpu-set-util.h b/src/shared/cpu-set-util.h
index 2c477d8a01..d62b2d60e6 100644
--- a/src/shared/cpu-set-util.h
+++ b/src/shared/cpu-set-util.h
@@ -3,7 +3,7 @@
 
 #include <sched.h>
 
-#include "macro.h"
+#include "memory-util.h"
 #include "missing_syscall.h"
 
 /* This wraps the libc interface with a variable to keep the allocated size. */
diff --git a/src/shared/cryptsetup-fido2.h b/src/shared/cryptsetup-fido2.h
index 86ac30c766..3e08b79f7a 100644
--- a/src/shared/cryptsetup-fido2.h
+++ b/src/shared/cryptsetup-fido2.h
@@ -3,6 +3,7 @@
 
 #include <sys/types.h>
 
+#include "ask-password-api.h"
 #include "cryptsetup-util.h"
 #include "libfido2-util.h"
 #include "log.h"
diff --git a/src/shared/dissect-image.h b/src/shared/dissect-image.h
index 3313d14921..cae63969e5 100644
--- a/src/shared/dissect-image.h
+++ b/src/shared/dissect-image.h
@@ -20,6 +20,7 @@ typedef struct DecryptedImage DecryptedImage;
 typedef struct MountOptions MountOptions;
 typedef struct VeritySettings VeritySettings;
 typedef struct ImageFilter ImageFilter;
+typedef struct ImagePolicy ImagePolicy;
 typedef struct ExtensionReleaseData ExtensionReleaseData;
 
 struct DissectedPartition {
@@ -163,9 +164,6 @@ struct ExtensionReleaseData {
         char *os_release_extension_scope;
 };
 
-/* We include image-policy.h down here, since ImagePolicy wants a complete definition of PartitionDesignator first. */
-#include "image-policy.h"
-
 MountOptions* mount_options_free_all(MountOptions *options);
 DEFINE_TRIVIAL_CLEANUP_FUNC(MountOptions*, mount_options_free_all);
 const char* mount_options_from_designator(const MountOptions *options, PartitionDesignator designator);
diff --git a/src/shared/edit-util.h b/src/shared/edit-util.h
index 2affa7eab1..89b30fe199 100644
--- a/src/shared/edit-util.h
+++ b/src/shared/edit-util.h
@@ -2,6 +2,7 @@
 #pragma once
 
 #include <stdbool.h>
+#include <stddef.h>
 
 #define DROPIN_MARKER_START "### Anything between here and the comment below will become the contents of the drop-in file"
 #define DROPIN_MARKER_END "### Edits below this comment will be discarded"
diff --git a/src/shared/fdisk-util.c b/src/shared/fdisk-util.c
index 368bec2b8b..3414572c31 100644
--- a/src/shared/fdisk-util.c
+++ b/src/shared/fdisk-util.c
@@ -5,6 +5,7 @@
 #include "extract-word.h"
 #include "fd-util.h"
 #include "fdisk-util.h"
+#include "log.h"
 #include "parse-util.h"
 
 #if HAVE_LIBFDISK
diff --git a/src/shared/fdisk-util.h b/src/shared/fdisk-util.h
index a72a596f47..316a763b0d 100644
--- a/src/shared/fdisk-util.h
+++ b/src/shared/fdisk-util.h
@@ -7,7 +7,7 @@
 
 #include "sd-id128.h"
 
-#include "macro.h"
+#include "memory-util.h"
 
 DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(struct fdisk_context*, fdisk_unref_context, NULL);
 DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(struct fdisk_partition*, fdisk_unref_partition, NULL);
diff --git a/src/shared/hibernate-util.h b/src/shared/hibernate-util.h
index 394d0b4176..966cc39f1d 100644
--- a/src/shared/hibernate-util.h
+++ b/src/shared/hibernate-util.h
@@ -2,8 +2,11 @@
 #pragma once
 
 #include <linux/fiemap.h>
+#include <stdint.h>
 #include <sys/types.h>
 
+#include "assert-util.h"
+
 /* represents values for /sys/power/resume & /sys/power/resume_offset and the corresponding path */
 typedef struct HibernationDevice {
         dev_t devno;
diff --git a/src/shared/hostname-setup.h b/src/shared/hostname-setup.h
index bc602acbfc..e3601b8590 100644
--- a/src/shared/hostname-setup.h
+++ b/src/shared/hostname-setup.h
@@ -1,9 +1,12 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
+#include <errno.h>
 #include <stdbool.h>
 #include <stdio.h>
 
+#include "macro.h"
+
 typedef enum HostnameSource {
         HOSTNAME_STATIC,     /* from /etc/hostname */
         HOSTNAME_TRANSIENT,  /* a transient hostname set through systemd, hostnamed, the container manager, or otherwise */
diff --git a/src/shared/id128-print.h b/src/shared/id128-print.h
index 7b2e593f16..4e3b9ba4d1 100644
--- a/src/shared/id128-print.h
+++ b/src/shared/id128-print.h
@@ -2,6 +2,7 @@
 
 #pragma once
 
+#include <errno.h>
 #include <stdbool.h>
 
 #include "sd-id128.h"
diff --git a/src/shared/image-policy.h b/src/shared/image-policy.h
index f61f55fd60..afb0d4fe9e 100644
--- a/src/shared/image-policy.h
+++ b/src/shared/image-policy.h
@@ -1,8 +1,6 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-typedef struct ImagePolicy ImagePolicy;
-
 #include "conf-parser.h"
 #include "dissect-image.h"
 #include "errno-list.h"
@@ -48,11 +46,11 @@ typedef struct PartitionPolicy {
         PartitionPolicyFlags flags;
 } PartitionPolicy;
 
-struct ImagePolicy {
+typedef struct ImagePolicy {
         PartitionPolicyFlags default_flags;  /* for any designator not listed in the list below */
         size_t n_policies;
         PartitionPolicy policies[];          /* sorted by designator, hence suitable for binary search */
-};
+} ImagePolicy;
 
 /* Default policies for various use cases */
 extern const ImagePolicy image_policy_allow;
diff --git a/src/shared/libcrypt-util.h b/src/shared/libcrypt-util.h
index 5b9b945629..8abaec2112 100644
--- a/src/shared/libcrypt-util.h
+++ b/src/shared/libcrypt-util.h
@@ -2,6 +2,7 @@
 #pragma once
 
 #include <stdbool.h>
+#include <stddef.h>
 
 int make_salt(char **ret);
 int hash_password_full(const char *password, void **cd_data, int *cd_size, char **ret);
diff --git a/src/shared/loop-util.h b/src/shared/loop-util.h
index 4f563172b6..0f9b76e91e 100644
--- a/src/shared/loop-util.h
+++ b/src/shared/loop-util.h
@@ -5,7 +5,7 @@
 
 #include "sd-device.h"
 
-#include "macro.h"
+#include "memory-util.h"
 #include "time-util.h"
 
 typedef struct LoopDevice LoopDevice;
diff --git a/src/shared/machine-credential.h b/src/shared/machine-credential.h
index 182f077fe7..f223586450 100644
--- a/src/shared/machine-credential.h
+++ b/src/shared/machine-credential.h
@@ -1,6 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
+#include <stdbool.h>
 #include <sys/types.h>
 
 typedef struct MachineCredential {
diff --git a/src/shared/machine-id-setup.h b/src/shared/machine-id-setup.h
index e733471afc..595b1d1570 100644
--- a/src/shared/machine-id-setup.h
+++ b/src/shared/machine-id-setup.h
@@ -3,6 +3,8 @@
 
 #include <stdbool.h>
 
+#include "sd-id128.h"
+
 typedef enum MachineIdSetupFlags {
         MACHINE_ID_SETUP_FORCE_TRANSIENT = 1 << 0,
         MACHINE_ID_SETUP_FORCE_FIRMWARE  = 1 << 1,
diff --git a/src/shared/machine-pool.h b/src/shared/machine-pool.h
index c57e47878f..dfc553f8b6 100644
--- a/src/shared/machine-pool.h
+++ b/src/shared/machine-pool.h
@@ -1,6 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
+#include <stdbool.h>
 #include <stdint.h>
 
 #include "sd-bus.h"
diff --git a/src/shared/macvlan-util.h b/src/shared/macvlan-util.h
index b61630b789..c8d7c77cc4 100644
--- a/src/shared/macvlan-util.h
+++ b/src/shared/macvlan-util.h
@@ -1,8 +1,11 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
+#include <errno.h>
 #include <linux/if_link.h>
 
+#include "macro.h"
+
 typedef enum MacVlanMode {
         NETDEV_MACVLAN_MODE_PRIVATE = MACVLAN_MODE_PRIVATE,
         NETDEV_MACVLAN_MODE_VEPA = MACVLAN_MODE_VEPA,
diff --git a/src/shared/mkfs-util.c b/src/shared/mkfs-util.c
index 46fa685b0d..c7385dac9a 100644
--- a/src/shared/mkfs-util.c
+++ b/src/shared/mkfs-util.c
@@ -8,6 +8,7 @@
 #include "fileio.h"
 #include "fs-util.h"
 #include "id128-util.h"
+#include "log.h"
 #include "mkfs-util.h"
 #include "mount-util.h"
 #include "mountpoint-util.h"
diff --git a/src/shared/mount-util.c b/src/shared/mount-util.c
index b836cebdde..25219e56ed 100644
--- a/src/shared/mount-util.c
+++ b/src/shared/mount-util.c
@@ -22,6 +22,7 @@
 #include "initrd-util.h"
 #include "label-util.h"
 #include "libmount-util.h"
+#include "log.h"
 #include "missing_syscall.h"
 #include "mkdir-label.h"
 #include "mount-util.h"
diff --git a/src/shared/netif-sriov.h b/src/shared/netif-sriov.h
index 4e0b19bf3b..cd79980b4e 100644
--- a/src/shared/netif-sriov.h
+++ b/src/shared/netif-sriov.h
@@ -4,6 +4,7 @@
 #include <linux/if_link.h>
 
 #include "sd-device.h"
+#include "sd-netlink.h"
 
 #include "conf-parser.h"
 #include "ether-addr-util.h"
diff --git a/src/shared/pam-util.h b/src/shared/pam-util.h
index 7dae9dd31d..c6df968c47 100644
--- a/src/shared/pam-util.h
+++ b/src/shared/pam-util.h
@@ -2,7 +2,9 @@
 #pragma once
 
 #include <security/pam_modules.h>
+#include <syslog.h>
 
+#include "macro.h"
 #include "sd-bus.h"
 
 void pam_log_setup(void);
diff --git a/src/shared/password-quality-util-pwquality.h b/src/shared/password-quality-util-pwquality.h
index 35051f7c2d..9e3509b991 100644
--- a/src/shared/password-quality-util-pwquality.h
+++ b/src/shared/password-quality-util-pwquality.h
@@ -9,6 +9,7 @@
 #include <pwquality.h>
 
 #include "dlfcn-util.h"
+#include "memory-util.h"
 
 extern DLSYM_PROTOTYPE(pwquality_check);
 extern DLSYM_PROTOTYPE(pwquality_default_settings);
diff --git a/src/shared/pkcs11-util.h b/src/shared/pkcs11-util.h
index 8e54756675..386031ca54 100644
--- a/src/shared/pkcs11-util.h
+++ b/src/shared/pkcs11-util.h
@@ -15,7 +15,7 @@
 #include "ask-password-api.h"
 #include "dlfcn-util.h"
 #include "log.h"
-#include "macro.h"
+#include "memory-util.h"
 #include "time-util.h"
 
 bool pkcs11_uri_valid(const char *uri);
diff --git a/src/shared/ptyfwd.h b/src/shared/ptyfwd.h
index b276cb15c5..1f1b771a39 100644
--- a/src/shared/ptyfwd.h
+++ b/src/shared/ptyfwd.h
@@ -5,7 +5,7 @@
 
 #include "sd-event.h"
 
-#include "macro.h"
+#include "memory-util.h"
 
 typedef struct PTYForward PTYForward;
 
diff --git a/src/shared/securebits-util.h b/src/shared/securebits-util.h
index a8f108e0f9..ee25c9330c 100644
--- a/src/shared/securebits-util.h
+++ b/src/shared/securebits-util.h
@@ -1,9 +1,9 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include <stdbool.h>
-
+#include <errno.h>
 #include <linux/securebits.h>
+#include <stdbool.h>
 
 int secure_bits_to_string_alloc(int i, char **s);
 int secure_bits_from_string(const char *s);
diff --git a/src/shared/volatile-util.h b/src/shared/volatile-util.h
index 6e0206d3a0..ba3073b913 100644
--- a/src/shared/volatile-util.h
+++ b/src/shared/volatile-util.h
@@ -1,6 +1,8 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
+#include <errno.h>
+
 typedef enum VolatileMode {
         VOLATILE_NO,
         VOLATILE_YES,
diff --git a/src/shared/vpick.h b/src/shared/vpick.h
index 38251c84e8..8373821dfa 100644
--- a/src/shared/vpick.h
+++ b/src/shared/vpick.h
@@ -1,6 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
+#include <sys/stat.h>
 #include <sys/types.h>
 
 #include "architecture.h"
diff --git a/src/shutdown/umount.c b/src/shutdown/umount.c
index 6d7c78a97a..ba87a992bc 100644
--- a/src/shutdown/umount.c
+++ b/src/shutdown/umount.c
@@ -18,6 +18,7 @@
 #include "fs-util.h"
 #include "fstab-util.h"
 #include "libmount-util.h"
+#include "log.h"
 #include "mkdir.h"
 #include "mount-setup.h"
 #include "mount-util.h"
diff --git a/src/systemctl/systemctl-list-units.h b/src/systemctl/systemctl-list-units.h
index cb190545e3..74bf9cda16 100644
--- a/src/systemctl/systemctl-list-units.h
+++ b/src/systemctl/systemctl-list-units.h
@@ -1,6 +1,8 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
+#include "time-util.h"
+
 int verb_list_units(int argc, char *argv[], void *userdata);
 int verb_list_sockets(int argc, char *argv[], void *userdata);
 int verb_list_timers(int argc, char *argv[], void *userdata);
diff --git a/src/systemd/sd-bus-protocol.h b/src/systemd/sd-bus-protocol.h
index 25c9ab3358..45e5f2e317 100644
--- a/src/systemd/sd-bus-protocol.h
+++ b/src/systemd/sd-bus-protocol.h
@@ -103,6 +103,93 @@ enum {
 /* https://dbus.freedesktop.org/doc/dbus-specification.html#message-protocol-names */
 #define SD_BUS_MAXIMUM_NAME_LENGTH 255
 
+#define SD_BUS_DEFAULT ((sd_bus *) 1)
+#define SD_BUS_DEFAULT_USER ((sd_bus *) 2)
+#define SD_BUS_DEFAULT_SYSTEM ((sd_bus *) 3)
+
+/* Types */
+
+typedef struct sd_bus sd_bus;
+typedef struct sd_bus_message sd_bus_message;
+typedef struct sd_bus_slot sd_bus_slot;
+typedef struct sd_bus_creds sd_bus_creds;
+typedef struct sd_bus_track sd_bus_track;
+
+typedef struct {
+        const char *name;
+        const char *message;
+        int _need_free;
+} sd_bus_error;
+
+typedef struct {
+        const char *name;
+        int code;
+} sd_bus_error_map;
+
+/* Flags */
+
+__extension__ enum {
+        SD_BUS_CREDS_PID                = 1ULL << 0,
+        SD_BUS_CREDS_TID                = 1ULL << 1,
+        SD_BUS_CREDS_PPID               = 1ULL << 2,
+        SD_BUS_CREDS_UID                = 1ULL << 3,
+        SD_BUS_CREDS_EUID               = 1ULL << 4,
+        SD_BUS_CREDS_SUID               = 1ULL << 5,
+        SD_BUS_CREDS_FSUID              = 1ULL << 6,
+        SD_BUS_CREDS_GID                = 1ULL << 7,
+        SD_BUS_CREDS_EGID               = 1ULL << 8,
+        SD_BUS_CREDS_SGID               = 1ULL << 9,
+        SD_BUS_CREDS_FSGID              = 1ULL << 10,
+        SD_BUS_CREDS_SUPPLEMENTARY_GIDS = 1ULL << 11,
+        SD_BUS_CREDS_COMM               = 1ULL << 12,
+        SD_BUS_CREDS_TID_COMM           = 1ULL << 13,
+        SD_BUS_CREDS_EXE                = 1ULL << 14,
+        SD_BUS_CREDS_CMDLINE            = 1ULL << 15,
+        SD_BUS_CREDS_CGROUP             = 1ULL << 16,
+        SD_BUS_CREDS_UNIT               = 1ULL << 17,
+        SD_BUS_CREDS_SLICE              = 1ULL << 18,
+        SD_BUS_CREDS_USER_UNIT          = 1ULL << 19,
+        SD_BUS_CREDS_USER_SLICE         = 1ULL << 20,
+        SD_BUS_CREDS_SESSION            = 1ULL << 21,
+        SD_BUS_CREDS_OWNER_UID          = 1ULL << 22,
+        SD_BUS_CREDS_EFFECTIVE_CAPS     = 1ULL << 23,
+        SD_BUS_CREDS_PERMITTED_CAPS     = 1ULL << 24,
+        SD_BUS_CREDS_INHERITABLE_CAPS   = 1ULL << 25,
+        SD_BUS_CREDS_BOUNDING_CAPS      = 1ULL << 26,
+        SD_BUS_CREDS_SELINUX_CONTEXT    = 1ULL << 27,
+        SD_BUS_CREDS_AUDIT_SESSION_ID   = 1ULL << 28,
+        SD_BUS_CREDS_AUDIT_LOGIN_UID    = 1ULL << 29,
+        SD_BUS_CREDS_TTY                = 1ULL << 30,
+        SD_BUS_CREDS_UNIQUE_NAME        = 1ULL << 31,
+        SD_BUS_CREDS_WELL_KNOWN_NAMES   = 1ULL << 32,
+        SD_BUS_CREDS_DESCRIPTION        = 1ULL << 33,
+        SD_BUS_CREDS_PIDFD              = 1ULL << 34,
+        SD_BUS_CREDS_AUGMENT            = 1ULL << 63, /* special flag, if on sd-bus will augment creds struct, in a potentially race-full way. */
+        _SD_BUS_CREDS_ALL               = (1ULL << 35) -1
+};
+
+__extension__ enum {
+        SD_BUS_NAME_REPLACE_EXISTING  = 1ULL << 0,
+        SD_BUS_NAME_ALLOW_REPLACEMENT = 1ULL << 1,
+        SD_BUS_NAME_QUEUE             = 1ULL << 2
+};
+
+__extension__ enum {
+        SD_BUS_MESSAGE_DUMP_WITH_HEADER  = 1ULL << 0,
+        SD_BUS_MESSAGE_DUMP_SUBTREE_ONLY = 1ULL << 1,
+        _SD_BUS_MESSAGE_DUMP_KNOWN_FLAGS = SD_BUS_MESSAGE_DUMP_WITH_HEADER | SD_BUS_MESSAGE_DUMP_SUBTREE_ONLY
+};
+
+/* Callbacks */
+
+typedef int (*sd_bus_message_handler_t)(sd_bus_message *m, void *userdata, sd_bus_error *ret_error);
+typedef int (*sd_bus_property_get_t) (sd_bus *bus, const char *path, const char *interface, const char *property, sd_bus_message *reply, void *userdata, sd_bus_error *ret_error);
+typedef int (*sd_bus_property_set_t) (sd_bus *bus, const char *path, const char *interface, const char *property, sd_bus_message *value, void *userdata, sd_bus_error *ret_error);
+typedef int (*sd_bus_object_find_t) (sd_bus *bus, const char *path, const char *interface, void *userdata, void **ret_found, sd_bus_error *ret_error);
+typedef int (*sd_bus_node_enumerator_t) (sd_bus *bus, const char *prefix, void *userdata, char ***ret_nodes, sd_bus_error *ret_error);
+typedef int (*sd_bus_track_handler_t) (sd_bus_track *track, void *userdata);
+typedef _sd_destroy_t sd_bus_destroy_t;
+
 _SD_END_DECLARATIONS;
 
 #endif
diff --git a/src/systemd/sd-bus-vtable.h b/src/systemd/sd-bus-vtable.h
index d06c5c3015..4ab5cf674f 100644
--- a/src/systemd/sd-bus-vtable.h
+++ b/src/systemd/sd-bus-vtable.h
@@ -17,14 +17,16 @@
   along with systemd; If not, see <https://www.gnu.org/licenses/>.
 ***/
 
+#include <stddef.h>
+#include <stdint.h>
+
 #include "_sd-common.h"
+#include "sd-bus-protocol.h"
 
 _SD_BEGIN_DECLARATIONS;
 
 typedef struct sd_bus_vtable sd_bus_vtable;
 
-#include "sd-bus.h"
-
 enum {
         _SD_BUS_VTABLE_START             = '<',
         _SD_BUS_VTABLE_END               = '>',
diff --git a/src/systemd/sd-bus.h b/src/systemd/sd-bus.h
index 2d8efe5c7e..cf07029217 100644
--- a/src/systemd/sd-bus.h
+++ b/src/systemd/sd-bus.h
@@ -27,99 +27,11 @@
 #include "sd-id128.h"
 
 #include "_sd-common.h"
-
-_SD_BEGIN_DECLARATIONS;
-
-#define SD_BUS_DEFAULT ((sd_bus *) 1)
-#define SD_BUS_DEFAULT_USER ((sd_bus *) 2)
-#define SD_BUS_DEFAULT_SYSTEM ((sd_bus *) 3)
-
-/* Types */
-
-typedef struct sd_bus sd_bus;
-typedef struct sd_bus_message sd_bus_message;
-typedef struct sd_bus_slot sd_bus_slot;
-typedef struct sd_bus_creds sd_bus_creds;
-typedef struct sd_bus_track sd_bus_track;
-
-typedef struct {
-        const char *name;
-        const char *message;
-        int _need_free;
-} sd_bus_error;
-
-typedef struct {
-        const char *name;
-        int code;
-} sd_bus_error_map;
-
-/* Flags */
-
-__extension__ enum {
-        SD_BUS_CREDS_PID                = 1ULL << 0,
-        SD_BUS_CREDS_TID                = 1ULL << 1,
-        SD_BUS_CREDS_PPID               = 1ULL << 2,
-        SD_BUS_CREDS_UID                = 1ULL << 3,
-        SD_BUS_CREDS_EUID               = 1ULL << 4,
-        SD_BUS_CREDS_SUID               = 1ULL << 5,
-        SD_BUS_CREDS_FSUID              = 1ULL << 6,
-        SD_BUS_CREDS_GID                = 1ULL << 7,
-        SD_BUS_CREDS_EGID               = 1ULL << 8,
-        SD_BUS_CREDS_SGID               = 1ULL << 9,
-        SD_BUS_CREDS_FSGID              = 1ULL << 10,
-        SD_BUS_CREDS_SUPPLEMENTARY_GIDS = 1ULL << 11,
-        SD_BUS_CREDS_COMM               = 1ULL << 12,
-        SD_BUS_CREDS_TID_COMM           = 1ULL << 13,
-        SD_BUS_CREDS_EXE                = 1ULL << 14,
-        SD_BUS_CREDS_CMDLINE            = 1ULL << 15,
-        SD_BUS_CREDS_CGROUP             = 1ULL << 16,
-        SD_BUS_CREDS_UNIT               = 1ULL << 17,
-        SD_BUS_CREDS_SLICE              = 1ULL << 18,
-        SD_BUS_CREDS_USER_UNIT          = 1ULL << 19,
-        SD_BUS_CREDS_USER_SLICE         = 1ULL << 20,
-        SD_BUS_CREDS_SESSION            = 1ULL << 21,
-        SD_BUS_CREDS_OWNER_UID          = 1ULL << 22,
-        SD_BUS_CREDS_EFFECTIVE_CAPS     = 1ULL << 23,
-        SD_BUS_CREDS_PERMITTED_CAPS     = 1ULL << 24,
-        SD_BUS_CREDS_INHERITABLE_CAPS   = 1ULL << 25,
-        SD_BUS_CREDS_BOUNDING_CAPS      = 1ULL << 26,
-        SD_BUS_CREDS_SELINUX_CONTEXT    = 1ULL << 27,
-        SD_BUS_CREDS_AUDIT_SESSION_ID   = 1ULL << 28,
-        SD_BUS_CREDS_AUDIT_LOGIN_UID    = 1ULL << 29,
-        SD_BUS_CREDS_TTY                = 1ULL << 30,
-        SD_BUS_CREDS_UNIQUE_NAME        = 1ULL << 31,
-        SD_BUS_CREDS_WELL_KNOWN_NAMES   = 1ULL << 32,
-        SD_BUS_CREDS_DESCRIPTION        = 1ULL << 33,
-        SD_BUS_CREDS_PIDFD              = 1ULL << 34,
-        SD_BUS_CREDS_AUGMENT            = 1ULL << 63, /* special flag, if on sd-bus will augment creds struct, in a potentially race-full way. */
-        _SD_BUS_CREDS_ALL               = (1ULL << 35) -1
-};
-
-__extension__ enum {
-        SD_BUS_NAME_REPLACE_EXISTING  = 1ULL << 0,
-        SD_BUS_NAME_ALLOW_REPLACEMENT = 1ULL << 1,
-        SD_BUS_NAME_QUEUE             = 1ULL << 2
-};
-
-__extension__ enum {
-        SD_BUS_MESSAGE_DUMP_WITH_HEADER  = 1ULL << 0,
-        SD_BUS_MESSAGE_DUMP_SUBTREE_ONLY = 1ULL << 1,
-        _SD_BUS_MESSAGE_DUMP_KNOWN_FLAGS = SD_BUS_MESSAGE_DUMP_WITH_HEADER | SD_BUS_MESSAGE_DUMP_SUBTREE_ONLY
-};
-
-/* Callbacks */
-
-typedef int (*sd_bus_message_handler_t)(sd_bus_message *m, void *userdata, sd_bus_error *ret_error);
-typedef int (*sd_bus_property_get_t) (sd_bus *bus, const char *path, const char *interface, const char *property, sd_bus_message *reply, void *userdata, sd_bus_error *ret_error);
-typedef int (*sd_bus_property_set_t) (sd_bus *bus, const char *path, const char *interface, const char *property, sd_bus_message *value, void *userdata, sd_bus_error *ret_error);
-typedef int (*sd_bus_object_find_t) (sd_bus *bus, const char *path, const char *interface, void *userdata, void **ret_found, sd_bus_error *ret_error);
-typedef int (*sd_bus_node_enumerator_t) (sd_bus *bus, const char *prefix, void *userdata, char ***ret_nodes, sd_bus_error *ret_error);
-typedef int (*sd_bus_track_handler_t) (sd_bus_track *track, void *userdata);
-typedef _sd_destroy_t sd_bus_destroy_t;
-
 #include "sd-bus-protocol.h"
 #include "sd-bus-vtable.h"
 
+_SD_BEGIN_DECLARATIONS;
+
 /* Naming */
 
 int sd_bus_interface_name_is_valid(const char *p);
diff --git a/src/sysupdate/sysupdate-feature.h b/src/sysupdate/sysupdate-feature.h
index 4b52b0a447..c66e9084d0 100644
--- a/src/sysupdate/sysupdate-feature.h
+++ b/src/sysupdate/sysupdate-feature.h
@@ -1,8 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
 #include "hash-funcs.h"
-#include "macro.h"
-#include "sysupdate-transfer.h"
+#include "memory-util.h"
 
 typedef struct Feature {
         unsigned n_ref;
diff --git a/src/sysupdate/sysupdate-instance.h b/src/sysupdate/sysupdate-instance.h
index 2860d295da..f39db617d3 100644
--- a/src/sysupdate/sysupdate-instance.h
+++ b/src/sysupdate/sysupdate-instance.h
@@ -10,13 +10,12 @@
 #include "fs-util.h"
 #include "time-util.h"
 
-typedef struct InstanceMetadata InstanceMetadata;
-typedef struct Instance Instance;
-
-#include "sysupdate-resource.h"
 #include "sysupdate-partition.h"
 
-struct InstanceMetadata {
+typedef struct Resource Resource;
+typedef struct Instance Instance;
+
+typedef struct InstanceMetadata {
         /* Various bits of metadata for each instance, that is either derived from the filename/GPT label or
          * from metadata of the file/partition itself */
         char *version;
@@ -33,7 +32,7 @@ struct InstanceMetadata {
         int growfs;
         uint8_t sha256sum[32];             /* SHA256 sum of the download (i.e. compressed) file */
         bool sha256sum_set;
-};
+} InstanceMetadata;
 
 #define INSTANCE_METADATA_NULL                  \
         {                                       \
diff --git a/src/sysupdate/sysupdate-pattern.c b/src/sysupdate/sysupdate-pattern.c
index ff099c8edd..1266bc7295 100644
--- a/src/sysupdate/sysupdate-pattern.c
+++ b/src/sysupdate/sysupdate-pattern.c
@@ -8,6 +8,7 @@
 #include "path-util.h"
 #include "stdio-util.h"
 #include "string-util.h"
+#include "sysupdate-instance.h"
 #include "sysupdate-pattern.h"
 
 typedef enum PatternElementType {
diff --git a/src/sysupdate/sysupdate-pattern.h b/src/sysupdate/sysupdate-pattern.h
index e8ea104623..0bfb515fd4 100644
--- a/src/sysupdate/sysupdate-pattern.h
+++ b/src/sysupdate/sysupdate-pattern.h
@@ -3,9 +3,10 @@
 
 #include <stdbool.h>
 
-#include "sysupdate-instance.h"
 #include "time-util.h"
 
+typedef struct InstanceMetadata InstanceMetadata;
+
 enum {
         PATTERN_MATCH_NO,
         PATTERN_MATCH_YES,
diff --git a/src/sysupdate/sysupdate-resource.h b/src/sysupdate/sysupdate-resource.h
index 1bcbe0f8e5..1e1f16ac34 100644
--- a/src/sysupdate/sysupdate-resource.h
+++ b/src/sysupdate/sysupdate-resource.h
@@ -9,10 +9,8 @@
 #include "hashmap.h"
 #include "macro.h"
 
-/* Forward declare this type so that the headers below can use it */
 typedef struct Resource Resource;
-
-#include "sysupdate-instance.h"
+typedef struct Instance Instance;
 
 typedef enum ResourceType {
         RESOURCE_URL_FILE,
diff --git a/src/sysupdate/sysupdate-transfer.c b/src/sysupdate/sysupdate-transfer.c
index 2bdf8c6c3a..bd54c398eb 100644
--- a/src/sysupdate/sysupdate-transfer.c
+++ b/src/sysupdate/sysupdate-transfer.c
@@ -31,6 +31,7 @@
 #include "sync-util.h"
 #include "sysupdate.h"
 #include "sysupdate-feature.h"
+#include "sysupdate-instance.h"
 #include "sysupdate-pattern.h"
 #include "sysupdate-resource.h"
 #include "sysupdate-transfer.h"
diff --git a/src/sysupdate/sysupdate-transfer.h b/src/sysupdate/sysupdate-transfer.h
index 505c573d63..6c80f05581 100644
--- a/src/sysupdate/sysupdate-transfer.h
+++ b/src/sysupdate/sysupdate-transfer.h
@@ -7,14 +7,12 @@
 
 #include "sd-id128.h"
 
-/* Forward declare this type so that the headers below can use it */
-typedef struct Transfer Transfer;
-
 #include "sysupdate-partition.h"
 #include "sysupdate-resource.h"
-#include "sysupdate.h"
 
-struct Transfer {
+typedef struct Context Context;
+
+typedef struct Transfer {
         char *id;
 
         char *min_version;
@@ -55,7 +53,7 @@ struct Transfer {
         PartitionChange partition_change;
 
         Context *context;
-};
+} Transfer;
 
 typedef int (*TransferProgress)(const Transfer *t, const Instance *inst, unsigned percentage);
 
diff --git a/src/sysupdate/sysupdate-update-set.h b/src/sysupdate/sysupdate-update-set.h
index ed01202581..18b9ef9fc7 100644
--- a/src/sysupdate/sysupdate-update-set.h
+++ b/src/sysupdate/sysupdate-update-set.h
@@ -5,11 +5,11 @@
 #include <stdbool.h>
 #include <sys/types.h>
 
-typedef struct UpdateSet UpdateSet;
-
-#include "sysupdate-instance.h"
 #include "sysupdate-update-set-flags.h"
 
+typedef struct Instance Instance;
+typedef struct UpdateSet UpdateSet;
+
 struct UpdateSet {
         UpdateSetFlags flags;
         char *version;
diff --git a/src/sysupdate/sysupdate.c b/src/sysupdate/sysupdate.c
index bdd663a094..3bd91ac022 100644
--- a/src/sysupdate/sysupdate.c
+++ b/src/sysupdate/sysupdate.c
@@ -13,6 +13,7 @@
 #include "format-table.h"
 #include "glyph-util.h"
 #include "hexdecoct.h"
+#include "image-policy.h"
 #include "json-util.h"
 #include "main-func.h"
 #include "mount-util.h"
@@ -30,6 +31,7 @@
 #include "strv.h"
 #include "sysupdate.h"
 #include "sysupdate-feature.h"
+#include "sysupdate-instance.h"
 #include "sysupdate-transfer.h"
 #include "sysupdate-update-set.h"
 #include "sysupdate-util.h"
diff --git a/src/sysusers/sysusers.c b/src/sysusers/sysusers.c
index bb14c6c43b..bef806015e 100644
--- a/src/sysusers/sysusers.c
+++ b/src/sysusers/sysusers.c
@@ -17,6 +17,7 @@
 #include "format-util.h"
 #include "fs-util.h"
 #include "hashmap.h"
+#include "image-policy.h"
 #include "libcrypt-util.h"
 #include "main-func.h"
 #include "memory-util.h"
diff --git a/src/timesync/test-timesync.c b/src/timesync/test-timesync.c
index 7993e4c12b..160685b6d4 100644
--- a/src/timesync/test-timesync.c
+++ b/src/timesync/test-timesync.c
@@ -5,6 +5,8 @@
 #include "log.h"
 #include "macro.h"
 #include "timesyncd-conf.h"
+#include "timesyncd-manager.h"
+#include "timesyncd-server.h"
 #include "tests.h"
 
 TEST(manager_parse_string) {
diff --git a/src/timesync/timesyncd-bus.c b/src/timesync/timesyncd-bus.c
index a3be1e2ef9..2c780f1d17 100644
--- a/src/timesync/timesyncd-bus.c
+++ b/src/timesync/timesyncd-bus.c
@@ -18,6 +18,8 @@
 #include "strv.h"
 #include "time-util.h"
 #include "timesyncd-bus.h"
+#include "timesyncd-manager.h"
+#include "timesyncd-server.h"
 #include "user-util.h"
 
 static int property_get_servers(
diff --git a/src/timesync/timesyncd-bus.h b/src/timesync/timesyncd-bus.h
index b2b5a2b30e..4ad25a0a6a 100644
--- a/src/timesync/timesyncd-bus.h
+++ b/src/timesync/timesyncd-bus.h
@@ -2,7 +2,8 @@
 #pragma once
 
 #include "bus-object.h"
-#include "timesyncd-manager.h"
+
+typedef struct Manager Manager;
 
 extern const BusObjectImplementation manager_object;
 
diff --git a/src/timesync/timesyncd-conf.h b/src/timesync/timesyncd-conf.h
index d6b9060401..f0f1ab5cdf 100644
--- a/src/timesync/timesyncd-conf.h
+++ b/src/timesync/timesyncd-conf.h
@@ -2,7 +2,9 @@
 #pragma once
 
 #include "conf-parser.h"
-#include "timesyncd-manager.h"
+#include "timesyncd-server.h"
+
+typedef struct Manager Manager;
 
 const struct ConfigPerfItem* timesyncd_gperf_lookup(const char *key, GPERF_LEN_TYPE length);
 
diff --git a/src/timesync/timesyncd-gperf.gperf b/src/timesync/timesyncd-gperf.gperf
index 5543813f2d..d1f18e9b6f 100644
--- a/src/timesync/timesyncd-gperf.gperf
+++ b/src/timesync/timesyncd-gperf.gperf
@@ -7,6 +7,8 @@ _Pragma("GCC diagnostic ignored \"-Wzero-as-null-pointer-constant\"")
 #include <stddef.h>
 #include "conf-parser.h"
 #include "timesyncd-conf.h"
+#include "timesyncd-manager.h"
+#include "timesyncd-server.h"
 %}
 struct ConfigPerfItem;
 %null_strings
diff --git a/src/timesync/timesyncd-manager.c b/src/timesync/timesyncd-manager.c
index e7b962bc30..4410b1626d 100644
--- a/src/timesync/timesyncd-manager.c
+++ b/src/timesync/timesyncd-manager.c
@@ -35,6 +35,7 @@
 #include "time-util.h"
 #include "timesyncd-conf.h"
 #include "timesyncd-manager.h"
+#include "timesyncd-server.h"
 #include "user-util.h"
 
 #ifndef ADJ_SETOFFSET
diff --git a/src/timesync/timesyncd-manager.h b/src/timesync/timesyncd-manager.h
index 43dbef9417..371a7ca111 100644
--- a/src/timesync/timesyncd-manager.h
+++ b/src/timesync/timesyncd-manager.h
@@ -14,9 +14,9 @@
 #include "time-util.h"
 #include "timesyncd-ntp-message.h"
 
-typedef struct Manager Manager;
-
-#include "timesyncd-server.h"
+typedef enum ServerType ServerType;
+typedef struct ServerAddress ServerAddress;
+typedef struct ServerName ServerName;
 
 /*
  * "A client MUST NOT under any conditions use a poll interval less
@@ -32,7 +32,7 @@ typedef struct Manager Manager;
 
 #define DEFAULT_SAVE_TIME_INTERVAL_USEC (60 * USEC_PER_SEC)
 
-struct Manager {
+typedef struct Manager {
         sd_bus *bus;
         sd_event *event;
         sd_resolve *resolve;
@@ -116,7 +116,7 @@ struct Manager {
         /* Used to coalesce bus PropertiesChanged events */
         sd_event_source *deferred_ntp_server_event_source;
         unsigned ntp_server_change_mask;
-};
+} Manager;
 
 int manager_new(Manager **ret);
 Manager* manager_free(Manager *m);
diff --git a/src/timesync/timesyncd-ntp-message.h b/src/timesync/timesyncd-ntp-message.h
index 76ed9ecac6..fc122cbb9a 100644
--- a/src/timesync/timesyncd-ntp-message.h
+++ b/src/timesync/timesyncd-ntp-message.h
@@ -1,6 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
+#include "macro.h"
 #include "sparse-endian.h"
 
 /* NTP protocol, packet header */
diff --git a/src/timesync/timesyncd-server.c b/src/timesync/timesyncd-server.c
index ccaac3d32d..431c749c0f 100644
--- a/src/timesync/timesyncd-server.c
+++ b/src/timesync/timesyncd-server.c
@@ -3,6 +3,7 @@
 #include "alloc-util.h"
 #include "log.h"
 #include "string-table.h"
+#include "timesyncd-manager.h"
 #include "timesyncd-server.h"
 
 static const char * const server_type_table[_SERVER_TYPE_MAX] = {
diff --git a/src/timesync/timesyncd-server.h b/src/timesync/timesyncd-server.h
index a4b5637731..dac74199ff 100644
--- a/src/timesync/timesyncd-server.h
+++ b/src/timesync/timesyncd-server.h
@@ -4,6 +4,7 @@
 #include "list.h"
 #include "socket-util.h"
 
+typedef struct Manager Manager;
 typedef struct ServerAddress ServerAddress;
 typedef struct ServerName ServerName;
 
@@ -16,8 +17,6 @@ typedef enum ServerType {
         _SERVER_TYPE_INVALID = -EINVAL,
 } ServerType;
 
-#include "timesyncd-manager.h"
-
 struct ServerAddress {
         ServerName *name;
 
diff --git a/src/tmpfiles/tmpfiles.c b/src/tmpfiles/tmpfiles.c
index 98b524831c..8ac320469a 100644
--- a/src/tmpfiles/tmpfiles.c
+++ b/src/tmpfiles/tmpfiles.c
@@ -39,6 +39,7 @@
 #include "fs-util.h"
 #include "glob-util.h"
 #include "hexdecoct.h"
+#include "image-policy.h"
 #include "io-util.h"
 #include "label-util.h"
 #include "log.h"
diff --git a/src/udev/scsi_id/scsi.h b/src/udev/scsi_id/scsi.h
index ebb8ae9008..1b535ea3fe 100644
--- a/src/udev/scsi_id/scsi.h
+++ b/src/udev/scsi_id/scsi.h
@@ -4,6 +4,7 @@
 /* Copyright (C) IBM Corp. 2003 */
 
 #include <scsi/scsi.h>
+#include <sys/types.h>
 
 struct scsi_ioctl_command {
         unsigned inlen;        /* excluding scsi command length */
diff --git a/src/udev/udevadm-util.h b/src/udev/udevadm-util.h
index cd0dcacf3c..f9a3b99fd7 100644
--- a/src/udev/udevadm-util.h
+++ b/src/udev/udevadm-util.h
@@ -3,6 +3,7 @@
 
 #include "sd-device.h"
 
+#include "time-util.h"
 #include "udev-def.h"
 
 int find_device(const char *id, const char *prefix, sd_device **ret);
diff --git a/src/vmspawn/vmspawn-register.h b/src/vmspawn/vmspawn-register.h
index d46e28c792..c785b162ba 100644
--- a/src/vmspawn/vmspawn-register.h
+++ b/src/vmspawn/vmspawn-register.h
@@ -1,5 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
+#include <stdbool.h>
+
 #include "sd-bus.h"
 #include "sd-id128.h"
 
diff --git a/src/vmspawn/vmspawn-util.h b/src/vmspawn/vmspawn-util.h
index 66c1397ceb..b3d72ede72 100644
--- a/src/vmspawn/vmspawn-util.h
+++ b/src/vmspawn/vmspawn-util.h
@@ -2,7 +2,9 @@
 #pragma once
 
 #include <stdbool.h>
-#include "macro.h"
+
+#include "assert-util.h"
+#include "memory-util.h"
 
 #if defined(__x86_64__) || defined(__i386__) || defined(__arm__) || defined(__aarch64__)
 #  define ARCHITECTURE_SUPPORTS_SMBIOS 1