diff --git a/src/busctl/busctl-introspect.c b/src/busctl/busctl-introspect.c
index 92dca84b99..aa6f5cadf3 100644
--- a/src/busctl/busctl-introspect.c
+++ b/src/busctl/busctl-introspect.c
@@ -1,6 +1,6 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include "sd-bus.h"
+#include "sd-bus-vtable.h"
 
 #include "alloc-util.h"
 #include "busctl-introspect.h"
diff --git a/src/busctl/busctl-introspect.h b/src/busctl/busctl-introspect.h
index 720a0df79a..374ab53a19 100644
--- a/src/busctl/busctl-introspect.h
+++ b/src/busctl/busctl-introspect.h
@@ -1,8 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include <stdbool.h>
-#include <stdint.h>
+#include "forward.h"
 
 typedef struct XMLIntrospectOps {
         int (*on_path)(const char *path, void *userdata);
diff --git a/src/busctl/busctl.c b/src/busctl/busctl.c
index 8091a44705..8fe28ef015 100644
--- a/src/busctl/busctl.c
+++ b/src/busctl/busctl.c
@@ -1,29 +1,31 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
 #include <getopt.h>
+#include <unistd.h>
 
 #include "sd-bus.h"
 #include "sd-daemon.h"
+#include "sd-event.h"
 #include "sd-json.h"
 
 #include "alloc-util.h"
 #include "bitfield.h"
 #include "build.h"
 #include "bus-dump.h"
+#include "bus-error.h"
 #include "bus-internal.h"
-#include "bus-message.h"
 #include "bus-signature.h"
 #include "bus-type.h"
 #include "bus-util.h"
 #include "busctl-introspect.h"
 #include "capsule-util.h"
+#include "errno-util.h"
 #include "escape.h"
 #include "fd-util.h"
 #include "fdset.h"
 #include "fileio.h"
 #include "format-table.h"
 #include "glyph-util.h"
-#include "json-util.h"
 #include "log.h"
 #include "logarithm.h"
 #include "main-func.h"
@@ -36,9 +38,10 @@
 #include "pretty-print.h"
 #include "runtime-scope.h"
 #include "set.h"
-#include "sort-util.h"
+#include "string-util.h"
 #include "strv.h"
 #include "terminal-util.h"
+#include "time-util.h"
 #include "user-util.h"
 #include "verbs.h"
 #include "version.h"
diff --git a/src/busctl/test-busctl-introspect.c b/src/busctl/test-busctl-introspect.c
index 859ca71435..9f68636033 100644
--- a/src/busctl/test-busctl-introspect.c
+++ b/src/busctl/test-busctl-introspect.c
@@ -1,5 +1,6 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
+#include "alloc-util.h"
 #include "busctl-introspect.h"
 #include "set.h"
 #include "strv.h"
diff --git a/src/coredump/coredump-vacuum.c b/src/coredump/coredump-vacuum.c
index e4c5e00ead..f3e2403822 100644
--- a/src/coredump/coredump-vacuum.c
+++ b/src/coredump/coredump-vacuum.c
@@ -2,7 +2,6 @@
 
 #include <sys/stat.h>
 #include <sys/statvfs.h>
-#include <sys/types.h>
 #include <unistd.h>
 
 #include "alloc-util.h"
@@ -12,7 +11,6 @@
 #include "fs-util.h"
 #include "hashmap.h"
 #include "log.h"
-#include "macro.h"
 #include "memory-util.h"
 #include "stat-util.h"
 #include "string-util.h"
diff --git a/src/coredump/coredump-vacuum.h b/src/coredump/coredump-vacuum.h
index 8ad5bafc15..1a2d648111 100644
--- a/src/coredump/coredump-vacuum.h
+++ b/src/coredump/coredump-vacuum.h
@@ -1,7 +1,6 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include <inttypes.h>
-#include <sys/types.h>
+#include "forward.h"
 
 int coredump_vacuum(int exclude_fd, uint64_t keep_free, uint64_t max_use);
diff --git a/src/coredump/coredump.c b/src/coredump/coredump.c
index 2090dbc343..b8ba77e6ae 100644
--- a/src/coredump/coredump.c
+++ b/src/coredump/coredump.c
@@ -1,6 +1,5 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include <errno.h>
 #include <stdio.h>
 #include <sys/auxv.h>
 #include <sys/mount.h>
@@ -9,6 +8,7 @@
 #include <sys/xattr.h>
 #include <unistd.h>
 
+#include "sd-bus.h"
 #include "sd-daemon.h"
 #include "sd-journal.h"
 #include "sd-json.h"
@@ -27,24 +27,25 @@
 #include "coredump-vacuum.h"
 #include "dirent-util.h"
 #include "elf-util.h"
+#include "errno-util.h"
 #include "escape.h"
 #include "fd-util.h"
 #include "fileio.h"
 #include "fs-util.h"
+#include "io-util.h"
 #include "iovec-util.h"
 #include "journal-importer.h"
 #include "journal-send.h"
 #include "json-util.h"
 #include "log.h"
-#include "macro.h"
 #include "main-func.h"
 #include "memory-util.h"
 #include "memstream-util.h"
-#include "missing_syscall.h"
 #include "mkdir-label.h"
 #include "namespace-util.h"
 #include "parse-util.h"
 #include "path-util.h"
+#include "pidref.h"
 #include "process-util.h"
 #include "signal-util.h"
 #include "socket-util.h"
@@ -52,8 +53,6 @@
 #include "stat-util.h"
 #include "string-table.h"
 #include "string-util.h"
-#include "strv.h"
-#include "sync-util.h"
 #include "tmpfile-util.h"
 #include "uid-classification.h"
 #include "user-util.h"
diff --git a/src/coredump/coredumpctl.c b/src/coredump/coredumpctl.c
index f44fc706b2..5dbd7cfa8d 100644
--- a/src/coredump/coredumpctl.c
+++ b/src/coredump/coredumpctl.c
@@ -4,6 +4,8 @@
 #include <getopt.h>
 #include <locale.h>
 #include <stdio.h>
+#include <stdlib.h>
+#include <sys/stat.h>
 #include <unistd.h>
 
 #include "sd-bus.h"
@@ -18,11 +20,13 @@
 #include "bus-util.h"
 #include "chase.h"
 #include "compress.h"
-#include "constants.h"
 #include "dissect-image.h"
+#include "errno-util.h"
 #include "escape.h"
+#include "extract-word.h"
 #include "fd-util.h"
 #include "format-table.h"
+#include "format-util.h"
 #include "fs-util.h"
 #include "glob-util.h"
 #include "image-policy.h"
@@ -31,7 +35,7 @@
 #include "json-util.h"
 #include "log.h"
 #include "logs-show.h"
-#include "macro.h"
+#include "loop-util.h"
 #include "main-func.h"
 #include "mount-util.h"
 #include "pager.h"
@@ -40,11 +44,11 @@
 #include "path-util.h"
 #include "pretty-print.h"
 #include "process-util.h"
-#include "rlimit-util.h"
 #include "signal-util.h"
 #include "string-util.h"
 #include "strv.h"
 #include "terminal-util.h"
+#include "time-util.h"
 #include "tmpfile-util.h"
 #include "user-util.h"
 #include "verbs.h"
diff --git a/src/coredump/test-coredump-vacuum.c b/src/coredump/test-coredump-vacuum.c
index 27f8330950..454f044384 100644
--- a/src/coredump/test-coredump-vacuum.c
+++ b/src/coredump/test-coredump-vacuum.c
@@ -1,7 +1,5 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include <stdlib.h>
-
 #include "coredump-vacuum.h"
 #include "tests.h"
 
diff --git a/src/hibernate-resume/hibernate-resume-config.c b/src/hibernate-resume/hibernate-resume-config.c
index 3289fcd521..c30bfb73e1 100644
--- a/src/hibernate-resume/hibernate-resume-config.c
+++ b/src/hibernate-resume/hibernate-resume-config.c
@@ -7,6 +7,7 @@
 #include "efivars.h"
 #include "fstab-util.h"
 #include "hibernate-resume-config.h"
+#include "log.h"
 #include "os-util.h"
 #include "parse-util.h"
 #include "path-util.h"
diff --git a/src/hibernate-resume/hibernate-resume-config.h b/src/hibernate-resume/hibernate-resume-config.h
index 4bf4af6386..55f344a9e6 100644
--- a/src/hibernate-resume/hibernate-resume-config.h
+++ b/src/hibernate-resume/hibernate-resume-config.h
@@ -1,12 +1,9 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include <stdbool.h>
-
 #include "sd-id128.h"
 
-#include "macro.h"
-#include "memory-util.h"
+#include "forward.h"
 
 typedef struct KernelHibernateLocation KernelHibernateLocation;
 
diff --git a/src/hibernate-resume/hibernate-resume-generator.c b/src/hibernate-resume/hibernate-resume-generator.c
index 8d268a4805..07f6b89f6d 100644
--- a/src/hibernate-resume/hibernate-resume-generator.c
+++ b/src/hibernate-resume/hibernate-resume-generator.c
@@ -9,8 +9,6 @@
 #include "hibernate-resume-config.h"
 #include "initrd-util.h"
 #include "log.h"
-#include "main-func.h"
-#include "parse-util.h"
 #include "proc-cmdline.h"
 #include "special.h"
 #include "static-destruct.h"
diff --git a/src/hibernate-resume/hibernate-resume.c b/src/hibernate-resume/hibernate-resume.c
index 781b2faf77..e16bf825c9 100644
--- a/src/hibernate-resume/hibernate-resume.c
+++ b/src/hibernate-resume/hibernate-resume.c
@@ -1,6 +1,5 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include <errno.h>
 #include <getopt.h>
 #include <sys/stat.h>
 
@@ -15,7 +14,6 @@
 #include "parse-util.h"
 #include "pretty-print.h"
 #include "static-destruct.h"
-#include "terminal-util.h"
 
 static HibernateInfo arg_info = {};
 static bool arg_clear = false;
diff --git a/src/integritysetup/integrity-util.c b/src/integritysetup/integrity-util.c
index 754f3bf332..f421487805 100644
--- a/src/integritysetup/integrity-util.c
+++ b/src/integritysetup/integrity-util.c
@@ -1,10 +1,14 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
+
+#include "alloc-util.h"
+#include "cryptsetup-util.h"
 #include "extract-word.h"
-#include "fileio.h"
 #include "integrity-util.h"
 #include "log.h"
-#include "path-util.h"
 #include "percent-util.h"
+#include "string-util.h"
+#include "strv.h"
+#include "time-util.h"
 
 static int supported_integrity_algorithm(char *user_supplied) {
         if (!STR_IN_SET(user_supplied, "crc32", "crc32c", "xxhash64", "sha1", "sha256", "hmac-sha256"))
diff --git a/src/integritysetup/integrity-util.h b/src/integritysetup/integrity-util.h
index 359d2556a4..edc3ceac5f 100644
--- a/src/integritysetup/integrity-util.h
+++ b/src/integritysetup/integrity-util.h
@@ -1,10 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include <stdint.h>
-
-#include "cryptsetup-util.h"
-#include "time-util.h"
+#include "forward.h"
 
 int parse_integrity_options(
                 const char *options,
diff --git a/src/integritysetup/integritysetup-generator.c b/src/integritysetup/integritysetup-generator.c
index 7b0863d958..60f26b5ddc 100644
--- a/src/integritysetup/integritysetup-generator.c
+++ b/src/integritysetup/integritysetup-generator.c
@@ -1,7 +1,5 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include <errno.h>
-#include <stdbool.h>
 #include <stdlib.h>
 #include <sys/stat.h>
 #include <unistd.h>
@@ -11,14 +9,9 @@
 #include "fileio.h"
 #include "fstab-util.h"
 #include "generator.h"
-#include "hexdecoct.h"
-#include "id128-util.h"
 #include "integrity-util.h"
-#include "main-func.h"
-#include "mkdir.h"
-#include "parse-util.h"
+#include "log.h"
 #include "path-util.h"
-#include "proc-cmdline.h"
 #include "specifier.h"
 #include "string-util.h"
 #include "unit-name.h"
diff --git a/src/integritysetup/integritysetup.c b/src/integritysetup/integritysetup.c
index ece8c3c1a8..b643a48e11 100644
--- a/src/integritysetup/integritysetup.c
+++ b/src/integritysetup/integritysetup.c
@@ -1,6 +1,5 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include <errno.h>
 #include <stdio.h>
 #include <sys/stat.h>
 
@@ -8,17 +7,13 @@
 #include "argv-util.h"
 #include "cryptsetup-util.h"
 #include "fileio.h"
-#include "hexdecoct.h"
 #include "integrity-util.h"
 #include "log.h"
 #include "main-func.h"
-#include "memory-util.h"
-#include "parse-util.h"
 #include "path-util.h"
 #include "pretty-print.h"
-#include "process-util.h"
 #include "string-util.h"
-#include "terminal-util.h"
+#include "time-util.h"
 #include "verbs.h"
 
 static uint32_t arg_activate_flags;
diff --git a/src/locale/localectl.c b/src/locale/localectl.c
index 54e2ee597c..451bd19e08 100644
--- a/src/locale/localectl.c
+++ b/src/locale/localectl.c
@@ -1,7 +1,6 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
 #include <getopt.h>
-#include <stdbool.h>
 
 #include "sd-bus.h"
 
@@ -20,12 +19,11 @@
 #include "pager.h"
 #include "polkit-agent.h"
 #include "pretty-print.h"
-#include "proc-cmdline.h"
-#include "set.h"
+#include "runtime-scope.h"
+#include "string-util.h"
 #include "strv.h"
-#include "terminal-util.h"
+#include "time-util.h"
 #include "verbs.h"
-#include "virt.h"
 
 /* Enough time for locale-gen to finish server-side (in case it is in use) */
 #define LOCALE_SLOW_BUS_CALL_TIMEOUT_USEC (2*USEC_PER_MINUTE)
diff --git a/src/locale/localed-util.c b/src/locale/localed-util.c
index 067d094020..9e990443e4 100644
--- a/src/locale/localed-util.c
+++ b/src/locale/localed-util.c
@@ -1,19 +1,20 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include <errno.h>
 #include <sys/stat.h>
-#include <sys/types.h>
 #include <unistd.h>
 
+#include "sd-bus.h"
+
 #include "alloc-util.h"
 #include "copy.h"
 #include "env-file.h"
 #include "env-file-label.h"
-#include "env-util.h"
 #include "errno-util.h"
 #include "extract-word.h"
 #include "fd-util.h"
 #include "fileio.h"
+#include "fs-util.h"
+#include "hashmap.h"
 #include "kbd-util.h"
 #include "localed-util.h"
 #include "log.h"
diff --git a/src/locale/localed-util.h b/src/locale/localed-util.h
index a5bd78a4f7..888313b001 100644
--- a/src/locale/localed-util.h
+++ b/src/locale/localed-util.h
@@ -4,9 +4,7 @@
 #include <sys/stat.h>
 #include <syslog.h>
 
-#include "sd-bus.h"
-
-#include "hashmap.h"
+#include "forward.h"
 #include "locale-setup.h"
 #include "vconsole-util.h"
 
diff --git a/src/locale/localed.c b/src/locale/localed.c
index 24ec6263e5..4a62e063b1 100644
--- a/src/locale/localed.c
+++ b/src/locale/localed.c
@@ -1,34 +1,29 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include <errno.h>
 #include <sys/stat.h>
-#include <sys/types.h>
 #include <unistd.h>
 
 #include "sd-bus.h"
+#include "sd-event.h"
 
 #include "alloc-util.h"
 #include "bus-error.h"
 #include "bus-locator.h"
 #include "bus-log-control-api.h"
-#include "bus-message.h"
 #include "bus-polkit.h"
 #include "bus-unit-util.h"
 #include "bus-util.h"
 #include "constants.h"
 #include "daemon-util.h"
-#include "kbd-util.h"
+#include "hashmap.h"
+#include "label-util.h"
 #include "localed-util.h"
 #include "log.h"
-#include "macro.h"
 #include "main-func.h"
-#include "path-util.h"
-#include "selinux-util.h"
 #include "service-util.h"
-#include "signal-util.h"
 #include "string-util.h"
 #include "strv.h"
-#include "user-util.h"
+#include "time-util.h"
 
 static int vconsole_reload(sd_bus *bus) {
         _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
diff --git a/src/locale/test-localed-util.c b/src/locale/test-localed-util.c
index d6221edbaf..92fe7b0421 100644
--- a/src/locale/test-localed-util.c
+++ b/src/locale/test-localed-util.c
@@ -1,5 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
+#include <stdlib.h>
+
 #include "alloc-util.h"
 #include "localed-util.h"
 #include "log.h"
diff --git a/src/locale/xkbcommon-util.c b/src/locale/xkbcommon-util.c
index 8d0de9b431..edced7492d 100644
--- a/src/locale/xkbcommon-util.c
+++ b/src/locale/xkbcommon-util.c
@@ -1,9 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include "alloc-util.h"
 #include "dlfcn-util.h"
 #include "log.h"
-#include "macro.h"
 #include "string-util.h"
 #include "xkbcommon-util.h"
 
diff --git a/src/locale/xkbcommon-util.h b/src/locale/xkbcommon-util.h
index 6149ce392d..7d4071fd79 100644
--- a/src/locale/xkbcommon-util.h
+++ b/src/locale/xkbcommon-util.h
@@ -2,6 +2,7 @@
 #pragma once
 
 #include "dlfcn-util.h"
+#include "forward.h"
 
 #if HAVE_XKBCOMMON
 #include <xkbcommon/xkbcommon.h>
diff --git a/src/mountfsd/mountfsd-manager.c b/src/mountfsd/mountfsd-manager.c
index 0d24e2d696..fdd98d7936 100644
--- a/src/mountfsd/mountfsd-manager.c
+++ b/src/mountfsd/mountfsd-manager.c
@@ -1,22 +1,26 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
+
+#include <stdlib.h>
 #include <sys/wait.h>
 
 #include "sd-daemon.h"
 
+#include "alloc-util.h"
 #include "build-path.h"
 #include "common-signal.h"
 #include "env-util.h"
 #include "event-util.h"
 #include "fd-util.h"
-#include "fs-util.h"
+#include "format-util.h"
 #include "log.h"
-#include "mkdir.h"
 #include "mountfsd-manager.h"
 #include "process-util.h"
 #include "set.h"
 #include "signal-util.h"
 #include "socket-util.h"
 #include "stdio-util.h"
+#include "string-util.h"
+#include "time-util.h"
 #include "umask-util.h"
 
 #define LISTEN_TIMEOUT_USEC (25 * USEC_PER_SEC)
diff --git a/src/mountfsd/mountfsd-manager.h b/src/mountfsd/mountfsd-manager.h
index 6bfbddcd17..06bd15f09a 100644
--- a/src/mountfsd/mountfsd-manager.h
+++ b/src/mountfsd/mountfsd-manager.h
@@ -1,18 +1,13 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include "sd-bus.h"
-#include "sd-event.h"
-
-typedef struct Manager Manager;
-
-#include "hashmap.h"
+#include "forward.h"
 #include "ratelimit.h"
 
 #define MOUNTFS_WORKERS_MIN 3
 #define MOUNTFS_WORKERS_MAX 4096
 
-struct Manager {
+typedef struct Manager {
         sd_event *event;
 
         Set *workers_fixed;    /* Workers 0…MOUNTFS_WORKERS_MIN */
@@ -21,7 +16,7 @@ struct Manager {
         int listen_fd;
 
         RateLimit worker_ratelimit;
-};
+} Manager;
 
 int manager_new(Manager **ret);
 Manager* manager_free(Manager *m);
diff --git a/src/mountfsd/mountfsd.c b/src/mountfsd/mountfsd.c
index 87f4ab725a..6894c31b3f 100644
--- a/src/mountfsd/mountfsd.c
+++ b/src/mountfsd/mountfsd.c
@@ -1,7 +1,8 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
 #include <sys/stat.h>
-#include <sys/types.h>
+
+#include "sd-event.h"
 
 #include "daemon-util.h"
 #include "log.h"
diff --git a/src/mountfsd/mountwork.c b/src/mountfsd/mountwork.c
index 8f24d2c3de..d932169e56 100644
--- a/src/mountfsd/mountwork.c
+++ b/src/mountfsd/mountwork.c
@@ -1,9 +1,12 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
 #include <linux/loop.h>
+#include <poll.h>
+#include <stdlib.h>
 #include <sys/mount.h>
 
 #include "sd-daemon.h"
+#include "sd-event.h"
 #include "sd-varlink.h"
 
 #include "argv-util.h"
@@ -14,20 +17,28 @@
 #include "env-util.h"
 #include "errno-util.h"
 #include "fd-util.h"
+#include "format-util.h"
+#include "hashmap.h"
+#include "image-policy.h"
 #include "io-util.h"
 #include "json-util.h"
+#include "loop-util.h"
 #include "main-func.h"
+#include "memory-util.h"
 #include "missing_syscall.h"
 #include "namespace-util.h"
 #include "nsresource.h"
 #include "nulstr-util.h"
 #include "os-util.h"
-#include "process-util.h"
+#include "path-util.h"
+#include "pidref.h"
 #include "stat-util.h"
 #include "string-table.h"
+#include "string-util.h"
+#include "strv.h"
+#include "time-util.h"
 #include "uid-classification.h"
 #include "uid-range.h"
-#include "user-util.h"
 #include "varlink-io.systemd.MountFileSystem.h"
 #include "varlink-util.h"
 
diff --git a/src/nsresourced/nsresourced-manager.c b/src/nsresourced/nsresourced-manager.c
index ee52f09f84..ab3086ad76 100644
--- a/src/nsresourced/nsresourced-manager.c
+++ b/src/nsresourced/nsresourced-manager.c
@@ -1,5 +1,6 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
+#include <stdlib.h>
 #include <sys/mount.h>
 #include <sys/wait.h>
 
@@ -14,6 +15,7 @@
 #include "env-util.h"
 #include "event-util.h"
 #include "fd-util.h"
+#include "format-util.h"
 #include "fs-util.h"
 #include "log.h"
 #include "mkdir.h"
@@ -24,9 +26,10 @@
 #include "set.h"
 #include "signal-util.h"
 #include "socket-util.h"
-#include "stat-util.h"
 #include "stdio-util.h"
+#include "string-util.h"
 #include "strv.h"
+#include "time-util.h"
 #include "umask-util.h"
 #include "unaligned.h"
 #include "user-util.h"
diff --git a/src/nsresourced/nsresourced-manager.h b/src/nsresourced/nsresourced-manager.h
index 5ecf378a60..ce8d8c690a 100644
--- a/src/nsresourced/nsresourced-manager.h
+++ b/src/nsresourced/nsresourced-manager.h
@@ -1,18 +1,13 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include "sd-bus.h"
-#include "sd-event.h"
-
-typedef struct Manager Manager;
-
-#include "hashmap.h"
+#include "forward.h"
 #include "ratelimit.h"
 
 #define NSRESOURCE_WORKERS_MIN 5
 #define NSRESOURCE_WORKERS_MAX 4096
 
-struct Manager {
+typedef struct Manager {
         sd_event *event;
 
         Set *workers_fixed;    /* Workers 0…NSRESOURCE_WORKERS_MIN */
@@ -31,7 +26,7 @@ struct Manager {
 #endif
 
         int registry_fd;
-};
+} Manager;
 
 int manager_new(Manager **ret);
 Manager* manager_free(Manager *m);
diff --git a/src/nsresourced/nsresourced.c b/src/nsresourced/nsresourced.c
index ff84f766cd..455ee70705 100644
--- a/src/nsresourced/nsresourced.c
+++ b/src/nsresourced/nsresourced.c
@@ -1,7 +1,9 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
+#include <stdlib.h>
 #include <sys/stat.h>
-#include <sys/types.h>
+
+#include "sd-event.h"
 
 #include "daemon-util.h"
 #include "log.h"
diff --git a/src/nsresourced/nsresourcework.c b/src/nsresourced/nsresourcework.c
index b1c6dd86f9..e283593bf7 100644
--- a/src/nsresourced/nsresourcework.c
+++ b/src/nsresourced/nsresourcework.c
@@ -5,6 +5,7 @@
 #include <linux/nsfs.h>
 #include <linux/veth.h>
 #include <net/if.h>
+#include <poll.h>
 #include <sys/eventfd.h>
 #include <sys/mount.h>
 #include <sys/stat.h>
@@ -12,36 +13,40 @@
 #include <utmpx.h>
 
 #include "sd-daemon.h"
+#include "sd-event.h"
 #include "sd-netlink.h"
 #include "sd-varlink.h"
 
 #include "argv-util.h"
 #include "bus-polkit.h"
 #include "env-util.h"
+#include "errno-util.h"
+#include "ether-addr-util.h"
 #include "fd-util.h"
 #include "fileio.h"
-#include "fs-util.h"
-#include "group-record.h"
+#include "format-util.h"
+#include "hashmap.h"
 #include "io-util.h"
 #include "json-util.h"
-#include "lock-util.h"
 #include "main-func.h"
 #include "missing_magic.h"
+#include "missing_sched.h"
 #include "missing_syscall.h"
-#include "mount-util.h"
 #include "mountpoint-util.h"
 #include "namespace-util.h"
 #include "netlink-util.h"
+#include "pidref.h"
 #include "process-util.h"
 #include "random-util.h"
+#include "siphash24.h"
 #include "socket-util.h"
 #include "stat-util.h"
+#include "string-util.h"
 #include "strv.h"
 #include "time-util.h"
 #include "uid-classification.h"
 #include "uid-range.h"
 #include "user-record.h"
-#include "user-record-nss.h"
 #include "user-util.h"
 #include "userdb.h"
 #include "userns-registry.h"
diff --git a/src/nsresourced/test-userns-restrict.c b/src/nsresourced/test-userns-restrict.c
index 0aff1c87fb..61d4cd64bc 100644
--- a/src/nsresourced/test-userns-restrict.c
+++ b/src/nsresourced/test-userns-restrict.c
@@ -2,12 +2,13 @@
 
 #include <sys/eventfd.h>
 #include <sys/mount.h>
+#include <sys/stat.h>
 
 #include "errno-util.h"
 #include "fd-util.h"
 #include "log.h"
 #include "main-func.h"
-#include "missing_syscall.h"
+#include "missing_sched.h"
 #include "namespace-util.h"
 #include "process-util.h"
 #include "rm-rf.h"
diff --git a/src/nsresourced/userns-registry.c b/src/nsresourced/userns-registry.c
index be314231ae..464bbee55a 100644
--- a/src/nsresourced/userns-registry.c
+++ b/src/nsresourced/userns-registry.c
@@ -1,5 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
+#include <unistd.h>
+
 #include "sd-json.h"
 #include "sd-netlink.h"
 
@@ -15,6 +17,8 @@
 #include "path-util.h"
 #include "recurse-dir.h"
 #include "rm-rf.h"
+#include "stat-util.h"
+#include "string-util.h"
 #include "strv.h"
 #include "user-util.h"
 #include "userns-registry.h"
diff --git a/src/nsresourced/userns-registry.h b/src/nsresourced/userns-registry.h
index e25b402e88..c1e7c9f1f5 100644
--- a/src/nsresourced/userns-registry.h
+++ b/src/nsresourced/userns-registry.h
@@ -1,7 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include "memory-util.h"
+#include "forward.h"
 
 #define USER_NAMESPACE_CGROUPS_DELEGATE_MAX 16U
 #define USER_NAMESPACE_NETIFS_DELEGATE_MAX 16U
diff --git a/src/nsresourced/userns-restrict.c b/src/nsresourced/userns-restrict.c
index cb48ffbe79..e082dce243 100644
--- a/src/nsresourced/userns-restrict.c
+++ b/src/nsresourced/userns-restrict.c
@@ -1,10 +1,6 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include "log.h"
-#include "userns-restrict.h"
-
-#if HAVE_VMLINUX_H
-
+#include <sys/stat.h>
 #include <sched.h>
 #include <sys/mount.h>
 
@@ -12,12 +8,14 @@
 #include "bpf-link.h"
 #include "fd-util.h"
 #include "fs-util.h"
+#include "log.h"
 #include "lsm-util.h"
 #include "mkdir.h"
-#include "mount-util.h"
 #include "mountpoint-util.h"
 #include "namespace-util.h"
 #include "path-util.h"
+#include "string-util.h"
+#include "userns-restrict.h"
 
 #define USERNS_MAX (16U*1024U)
 #define MOUNTS_MAX 4096U
@@ -26,10 +24,14 @@
 #define MAP_LINK_PREFIX "/sys/fs/bpf/systemd/userns-restrict/maps"
 
 struct userns_restrict_bpf *userns_restrict_bpf_free(struct userns_restrict_bpf *obj) {
+#if HAVE_VMLINUX_H
         (void) userns_restrict_bpf__destroy(obj); /* this call is fine with NULL */
+#endif
         return NULL;
+
 }
 
+#if HAVE_VMLINUX_H
 static int make_inner_hash_map(void) {
         int fd;
 
@@ -45,11 +47,13 @@ static int make_inner_hash_map(void) {
 
         return fd;
 }
+#endif
 
 int userns_restrict_install(
                 bool pin,
                 struct userns_restrict_bpf **ret) {
 
+#if HAVE_VMLINUX_H
         _cleanup_(userns_restrict_bpf_freep) struct userns_restrict_bpf *obj = NULL;
         _cleanup_close_ int dummy_mnt_id_hash_fd = -EBADF;
         int r;
@@ -176,6 +180,9 @@ int userns_restrict_install(
                 *ret = TAKE_PTR(obj);
 
         return 0;
+#else
+        return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "User Namespace Restriction BPF support disabled.");
+#endif
 }
 
 int userns_restrict_put_by_inode(
@@ -185,6 +192,7 @@ int userns_restrict_put_by_inode(
                 const int mount_fds[],
                 size_t n_mount_fds) {
 
+#if HAVE_VMLINUX_H
         _cleanup_close_ int inner_map_fd = -EBADF;
         _cleanup_free_ int *mnt_ids = NULL;
         uint64_t ino = userns_inode;
@@ -268,6 +276,9 @@ int userns_restrict_put_by_inode(
         }
 
         return 0;
+#else
+        return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "User Namespace Restriction BPF support disabled.");
+#endif
 }
 
 int userns_restrict_put_by_fd(
@@ -277,6 +288,7 @@ int userns_restrict_put_by_fd(
                 const int mount_fds[],
                 size_t n_mount_fds) {
 
+#if HAVE_VMLINUX_H
         struct stat st;
         int r;
 
@@ -299,12 +311,16 @@ int userns_restrict_put_by_fd(
                         replace,
                         mount_fds,
                         n_mount_fds);
+#else
+        return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "User Namespace Restriction BPF support disabled.");
+#endif
 }
 
 int userns_restrict_reset_by_inode(
                 struct userns_restrict_bpf *obj,
                 uint64_t ino) {
 
+#if HAVE_VMLINUX_H
         int r, outer_map_fd;
         unsigned u;
 
@@ -325,26 +341,7 @@ int userns_restrict_reset_by_inode(
                 return log_debug_errno(r, "Failed to remove entry for inode %" PRIu64 " from outer map: %m", ino);
 
         return 0;
-}
-
 #else
-int userns_restrict_install(bool pin, struct userns_restrict_bpf **ret) {
         return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "User Namespace Restriction BPF support disabled.");
-}
-
-struct userns_restrict_bpf *userns_restrict_bpf_free(struct userns_restrict_bpf *obj) {
-        return NULL;
-}
-
-int userns_restrict_put_by_fd(struct userns_restrict_bpf *obj, int userns_fd, bool replace, const int mount_fds[], size_t n_mount_fds) {
-        return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "User Namespace Restriction BPF support disabled.");
-}
-
-int userns_restrict_put_by_inode(struct userns_restrict_bpf *obj, uint64_t userns_inode, bool replace, const int mount_fds[], size_t n_mount_fds) {
-        return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "User Namespace Restriction BPF support disabled.");
-}
-
-int userns_restrict_reset_by_inode(struct userns_restrict_bpf *obj, uint64_t userns_inode) {
-        return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "User Namespace Restriction BPF support disabled.");
-}
 #endif
+}
diff --git a/src/nsresourced/userns-restrict.h b/src/nsresourced/userns-restrict.h
index 92c8c9f211..d9c0f611ef 100644
--- a/src/nsresourced/userns-restrict.h
+++ b/src/nsresourced/userns-restrict.h
@@ -1,10 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include <stdbool.h>
-
-#include "macro.h"
-#include "memory-util.h"
+#include "forward.h"
 
 #if HAVE_VMLINUX_H
 #include "bpf/userns_restrict/userns-restrict-skel.h"
diff --git a/src/nss-myhostname/nss-myhostname.c b/src/nss-myhostname/nss-myhostname.c
index a19a362896..b1a4cfebb8 100644
--- a/src/nss-myhostname/nss-myhostname.c
+++ b/src/nss-myhostname/nss-myhostname.c
@@ -1,17 +1,14 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include <errno.h>
 #include <net/if.h>
 #include <netdb.h>
 #include <nss.h>
-#include <stdlib.h>
 
 #include "alloc-util.h"
 #include "errno-util.h"
 #include "hostname-setup.h"
 #include "hostname-util.h"
 #include "local-addresses.h"
-#include "macro.h"
 #include "nss-util.h"
 #include "resolve-util.h"
 #include "signal-util.h"
diff --git a/src/nss-mymachines/nss-mymachines.c b/src/nss-mymachines/nss-mymachines.c
index c64e79bdff..2878ddc6b6 100644
--- a/src/nss-mymachines/nss-mymachines.c
+++ b/src/nss-mymachines/nss-mymachines.c
@@ -3,21 +3,16 @@
 #include <netdb.h>
 #include <nss.h>
 #include <pthread.h>
+#include <stdlib.h>
 
 #include "sd-bus.h"
 #include "sd-login.h"
 
 #include "alloc-util.h"
-#include "bus-common-errors.h"
 #include "bus-locator.h"
-#include "env-util.h"
 #include "errno-util.h"
-#include "format-util.h"
-#include "hostname-util.h"
 #include "in-addr-util.h"
 #include "log.h"
-#include "macro.h"
-#include "memory-util.h"
 #include "nss-util.h"
 #include "signal-util.h"
 #include "string-util.h"
diff --git a/src/nss-resolve/nss-resolve.c b/src/nss-resolve/nss-resolve.c
index efcba2543d..3a660ca8b2 100644
--- a/src/nss-resolve/nss-resolve.c
+++ b/src/nss-resolve/nss-resolve.c
@@ -1,11 +1,8 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include <errno.h>
 #include <netdb.h>
 #include <nss.h>
 #include <pthread.h>
-#include <stdlib.h>
-#include <sys/types.h>
 #include <unistd.h>
 
 #include "sd-varlink.h"
@@ -15,12 +12,12 @@
 #include "glyph-util.h"
 #include "in-addr-util.h"
 #include "json-util.h"
-#include "macro.h"
 #include "nss-util.h"
 #include "resolved-def.h"
 #include "signal-util.h"
 #include "string-util.h"
 #include "strv.h"
+#include "time-util.h"
 
 static sd_json_dispatch_flags_t json_dispatch_flags = SD_JSON_ALLOW_EXTENSIONS;
 
diff --git a/src/nss-systemd/nss-systemd.c b/src/nss-systemd/nss-systemd.c
index 7b9908b89e..3c92cc2d00 100644
--- a/src/nss-systemd/nss-systemd.c
+++ b/src/nss-systemd/nss-systemd.c
@@ -1,5 +1,6 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
+#include <gshadow.h>
 #include <nss.h>
 #include <pthread.h>
 #include <string.h>
@@ -8,13 +9,12 @@
 #include "alloc-util.h"
 #include "env-util.h"
 #include "errno-util.h"
-#include "fd-util.h"
 #include "log.h"
-#include "macro.h"
 #include "nss-systemd.h"
 #include "nss-util.h"
 #include "pthread-util.h"
 #include "signal-util.h"
+#include "string-util.h"
 #include "strv.h"
 #include "user-record-nss.h"
 #include "user-util.h"
diff --git a/src/nss-systemd/nss-systemd.h b/src/nss-systemd/nss-systemd.h
index 2b46044e14..054bd40305 100644
--- a/src/nss-systemd/nss-systemd.h
+++ b/src/nss-systemd/nss-systemd.h
@@ -1,9 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include <stdbool.h>
-
-#include "assert-util.h"
+#include "forward.h"
 
 int _nss_systemd_block(bool b);
 bool _nss_systemd_is_blocked(void);
diff --git a/src/nss-systemd/userdb-glue.c b/src/nss-systemd/userdb-glue.c
index c522c264bc..8e2d828be0 100644
--- a/src/nss-systemd/userdb-glue.c
+++ b/src/nss-systemd/userdb-glue.c
@@ -1,9 +1,12 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
+#include <gshadow.h>
+#include <string.h>
+
 #include "env-util.h"
-#include "fd-util.h"
 #include "nss-systemd.h"
 #include "strv.h"
+#include "time-util.h"
 #include "user-record.h"
 #include "user-record-nss.h"
 #include "user-util.h"
diff --git a/src/nss-systemd/userdb-glue.h b/src/nss-systemd/userdb-glue.h
index ed4c5ec546..840329312d 100644
--- a/src/nss-systemd/userdb-glue.h
+++ b/src/nss-systemd/userdb-glue.h
@@ -4,8 +4,8 @@
 #include <grp.h>
 #include <nss.h>
 #include <pwd.h>
-#include <sys/types.h>
 
+#include "forward.h"
 #include "userdb.h"
 
 UserDBFlags nss_glue_userdb_flags(void);
diff --git a/src/path/path.c b/src/path/path.c
index 97685d2bd8..c725dd76fd 100644
--- a/src/path/path.c
+++ b/src/path/path.c
@@ -1,9 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include <errno.h>
 #include <getopt.h>
 #include <stdio.h>
-#include <stdlib.h>
 
 #include "sd-path.h"
 
@@ -11,7 +9,6 @@
 #include "build.h"
 #include "errno-util.h"
 #include "log.h"
-#include "macro.h"
 #include "main-func.h"
 #include "pager.h"
 #include "pretty-print.h"
diff --git a/src/portable/portable.c b/src/portable/portable.c
index 763f283bb4..75e32abcce 100644
--- a/src/portable/portable.c
+++ b/src/portable/portable.c
@@ -2,6 +2,7 @@
 
 #include <linux/loop.h>
 
+#include "sd-bus.h"
 #include "sd-messages.h"
 
 #include "bus-common-errors.h"
@@ -9,7 +10,6 @@
 #include "bus-locator.h"
 #include "chase.h"
 #include "conf-files.h"
-#include "constants.h"
 #include "copy.h"
 #include "data-fd-util.h"
 #include "dirent-util.h"
@@ -17,19 +17,20 @@
 #include "dissect-image.h"
 #include "env-file.h"
 #include "env-util.h"
-#include "errno-list.h"
+#include "errno-util.h"
 #include "escape.h"
 #include "extension-util.h"
+#include "extract-word.h"
 #include "fd-util.h"
 #include "fileio.h"
 #include "fs-util.h"
+#include "glyph-util.h"
 #include "install.h"
 #include "iovec-util.h"
-#include "locale-util.h"
 #include "log-context.h"
+#include "log.h"
 #include "loop-util.h"
 #include "mkdir.h"
-#include "nulstr-util.h"
 #include "os-util.h"
 #include "path-lookup.h"
 #include "portable.h"
@@ -44,7 +45,7 @@
 #include "string-table.h"
 #include "strv.h"
 #include "tmpfile-util.h"
-#include "user-util.h"
+#include "unit-name.h"
 #include "vpick.h"
 
 /* Markers used in the first line of our 20-portable.conf unit file drop-in to determine, that a) the unit file was
diff --git a/src/portable/portable.h b/src/portable/portable.h
index 03977159f0..c0ce30f72d 100644
--- a/src/portable/portable.h
+++ b/src/portable/portable.h
@@ -1,13 +1,9 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include "sd-bus.h"
-
 #include "dissect-image.h"
-#include "hashmap.h"
-#include "macro.h"
+#include "forward.h"
 #include "runtime-scope.h"
-#include "set.h"
 #include "string-util.h"
 
 typedef struct PortableMetadata {
diff --git a/src/portable/portablectl.c b/src/portable/portablectl.c
index 6624f36299..ab49cf6edf 100644
--- a/src/portable/portablectl.c
+++ b/src/portable/portablectl.c
@@ -1,6 +1,5 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include <errno.h>
 #include <getopt.h>
 
 #include "sd-bus.h"
@@ -12,18 +11,15 @@
 #include "bus-unit-util.h"
 #include "bus-wait-for-jobs.h"
 #include "chase.h"
-#include "constants.h"
-#include "dirent-util.h"
 #include "env-file.h"
 #include "fd-util.h"
 #include "fileio.h"
 #include "format-table.h"
 #include "fs-util.h"
-#include "locale-util.h"
+#include "install.h"
 #include "main-func.h"
 #include "os-util.h"
 #include "pager.h"
-#include "parse-argument.h"
 #include "parse-util.h"
 #include "path-util.h"
 #include "polkit-agent.h"
@@ -31,7 +27,6 @@
 #include "pretty-print.h"
 #include "string-util.h"
 #include "strv.h"
-#include "terminal-util.h"
 #include "verbs.h"
 
 static PagerFlags arg_pager_flags = 0;
diff --git a/src/portable/portabled-bus.c b/src/portable/portabled-bus.c
index f313ce37ca..e347db5c0d 100644
--- a/src/portable/portabled-bus.c
+++ b/src/portable/portabled-bus.c
@@ -1,20 +1,23 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
+#include "sd-bus.h"
+
 #include "alloc-util.h"
 #include "btrfs-util.h"
-#include "bus-common-errors.h"
+#include "bus-error.h"
 #include "bus-object.h"
 #include "bus-polkit.h"
 #include "discover-image.h"
 #include "fd-util.h"
+#include "hashmap.h"
 #include "io-util.h"
+#include "log.h"
 #include "portable.h"
 #include "portabled.h"
 #include "portabled-bus.h"
 #include "portabled-image.h"
 #include "portabled-image-bus.h"
 #include "strv.h"
-#include "user-util.h"
 
 static int property_get_pool_path(
                 sd_bus *bus,
diff --git a/src/portable/portabled-bus.h b/src/portable/portabled-bus.h
index c216c3aa75..b95ce5c647 100644
--- a/src/portable/portabled-bus.h
+++ b/src/portable/portabled-bus.h
@@ -1,9 +1,9 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include "sd-bus.h"
+#include "sd-bus-vtable.h"
 
-typedef struct PortableChange PortableChange;
+#include "portabled-forward.h"
 
 extern const sd_bus_vtable manager_vtable[];
 
diff --git a/src/portable/portabled-forward.h b/src/portable/portabled-forward.h
new file mode 100644
index 0000000000..c4529f07fa
--- /dev/null
+++ b/src/portable/portabled-forward.h
@@ -0,0 +1,8 @@
+/* SPDX-License-Identifier: LGPL-2.1-or-later */
+#pragma once
+
+#include "forward.h" // IWYU pragma: export
+
+typedef struct Manager Manager;
+typedef struct Operation Operation;
+typedef struct PortableChange PortableChange;
diff --git a/src/portable/portabled-image-bus.c b/src/portable/portabled-image-bus.c
index 6a35262e6d..021035ab85 100644
--- a/src/portable/portabled-image-bus.c
+++ b/src/portable/portabled-image-bus.c
@@ -2,29 +2,32 @@
 
 #include <fcntl.h>
 #include <sys/stat.h>
-#include <sys/types.h>
 #include <unistd.h>
 
+#include "sd-bus.h"
+
 #include "alloc-util.h"
 #include "bus-common-errors.h"
 #include "bus-get-properties.h"
-#include "bus-label.h"
 #include "bus-object.h"
 #include "bus-polkit.h"
 #include "bus-util.h"
 #include "discover-image.h"
 #include "fd-util.h"
 #include "fileio.h"
+#include "hashmap.h"
+#include "image-policy.h"
 #include "io-util.h"
 #include "os-util.h"
+#include "path-util.h"
 #include "portable.h"
 #include "portabled.h"
 #include "portabled-bus.h"
 #include "portabled-image.h"
 #include "portabled-image-bus.h"
+#include "portabled-operation.h"
 #include "process-util.h"
 #include "strv.h"
-#include "user-util.h"
 
 static BUS_DEFINE_PROPERTY_GET_ENUM(property_get_type, image_type, ImageType);
 
diff --git a/src/portable/portabled-image-bus.h b/src/portable/portabled-image-bus.h
index d37c244315..5784d3ab15 100644
--- a/src/portable/portabled-image-bus.h
+++ b/src/portable/portabled-image-bus.h
@@ -1,12 +1,10 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include "sd-bus.h"
+#include "sd-bus-vtable.h"
 
 #include "bus-object.h"
-#include "discover-image.h"
-
-typedef struct Manager Manager;
+#include "portabled-forward.h"
 
 int bus_image_common_get_os_release(Manager *m, sd_bus_message *message, const char *name_or_path, Image *image, sd_bus_error *error);
 int bus_image_common_get_metadata(Manager *m, sd_bus_message *message, const char *name_or_path, Image *image, sd_bus_error *error);
diff --git a/src/portable/portabled-image.c b/src/portable/portabled-image.c
index f14d1a69ef..961ca4588a 100644
--- a/src/portable/portabled-image.c
+++ b/src/portable/portabled-image.c
@@ -1,6 +1,9 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include "portable.h"
+#include "sd-event.h"
+
+#include "discover-image.h"
+#include "hashmap.h"
 #include "portabled.h"
 #include "portabled-image.h"
 
diff --git a/src/portable/portabled-image.h b/src/portable/portabled-image.h
index 424694b3fd..ababa411a8 100644
--- a/src/portable/portabled-image.h
+++ b/src/portable/portabled-image.h
@@ -1,12 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include "sd-bus.h"
-
-#include "discover-image.h"
-#include "hashmap.h"
-
-typedef struct Manager Manager;
+#include "portabled-forward.h"
 
 Image *manager_image_cache_get(Manager *m, const char *name_or_path);
 
diff --git a/src/portable/portabled-operation.c b/src/portable/portabled-operation.c
index 0e4a6e4629..236904c728 100644
--- a/src/portable/portabled-operation.c
+++ b/src/portable/portabled-operation.c
@@ -1,9 +1,14 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
+#include <sys/wait.h>
 #include <unistd.h>
 
+#include "sd-bus.h"
+#include "sd-event.h"
+
 #include "alloc-util.h"
 #include "fd-util.h"
+#include "format-util.h"
 #include "log.h"
 #include "portabled.h"
 #include "portabled-operation.h"
diff --git a/src/portable/portabled-operation.h b/src/portable/portabled-operation.h
index efbadc4620..7d3210a3f3 100644
--- a/src/portable/portabled-operation.h
+++ b/src/portable/portabled-operation.h
@@ -1,19 +1,12 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include <sys/types.h>
-
-#include "sd-bus.h"
-#include "sd-event.h"
-
 #include "list.h"
-
-typedef struct Manager Manager;
-typedef struct Operation Operation;
+#include "portabled-forward.h"
 
 #define OPERATIONS_MAX 64
 
-struct Operation {
+typedef struct Operation {
         Manager *manager;
         pid_t pid;
         sd_bus_message *message;
@@ -22,7 +15,7 @@ struct Operation {
         sd_event_source *event_source;
         int (*done)(Operation *o, int ret, sd_bus_error *error);
         LIST_FIELDS(Operation, operations);
-};
+} Operation;
 
 int operation_new(Manager *manager, pid_t child, sd_bus_message *message, int errno_fd, Operation **ret);
 Operation *operation_free(Operation *o);
diff --git a/src/portable/portabled.c b/src/portable/portabled.c
index ddc9935a7d..b9c880992d 100644
--- a/src/portable/portabled.c
+++ b/src/portable/portabled.c
@@ -1,24 +1,24 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
 #include <sys/stat.h>
-#include <sys/types.h>
 
 #include "sd-bus.h"
+#include "sd-event.h"
 
 #include "alloc-util.h"
 #include "bus-log-control-api.h"
-#include "bus-polkit.h"
 #include "bus-util.h"
 #include "common-signal.h"
 #include "constants.h"
 #include "daemon-util.h"
+#include "hashmap.h"
+#include "log.h"
 #include "main-func.h"
 #include "portabled.h"
-#include "portabled-bus.h"
 #include "portabled-image-bus.h"
-#include "process-util.h"
 #include "service-util.h"
 #include "signal-util.h"
+#include "time-util.h"
 
 static Manager* manager_unref(Manager *m);
 DEFINE_TRIVIAL_CLEANUP_FUNC(Manager*, manager_unref);
diff --git a/src/portable/portabled.h b/src/portable/portabled.h
index 418c1040da..c7ce247955 100644
--- a/src/portable/portabled.h
+++ b/src/portable/portabled.h
@@ -1,13 +1,9 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include "sd-bus.h"
-#include "sd-event.h"
-
 #include "bus-object.h"
-#include "hashmap.h"
 #include "list.h"
-#include "portabled-operation.h"
+#include "portabled-forward.h"
 #include "runtime-scope.h"
 
 typedef struct Manager {
diff --git a/src/shared/user-record.h b/src/shared/user-record.h
index 32c8e38d04..fde03e5595 100644
--- a/src/shared/user-record.h
+++ b/src/shared/user-record.h
@@ -26,7 +26,7 @@ typedef enum UserDisposition {
         _USER_DISPOSITION_INVALID = -EINVAL,
 } UserDisposition;
 
-typedef enum UserHomeStorage {
+typedef enum UserStorage {
         USER_CLASSIC,
         USER_LUKS,
         USER_DIRECTORY, /* A directory, and a .identity file in it, which USER_CLASSIC lacks */
diff --git a/src/shutdown/detach-dm.h b/src/shutdown/detach-dm.h
index b5f50a3bbf..0db81350e0 100644
--- a/src/shutdown/detach-dm.h
+++ b/src/shutdown/detach-dm.h
@@ -5,6 +5,6 @@
   Copyright © 2010 ProFUSION embedded systems
 ***/
 
-#include <stdbool.h>
+#include "forward.h"
 
 int dm_detach_all(bool *changed, bool last_try);
diff --git a/src/shutdown/detach-loopback.h b/src/shutdown/detach-loopback.h
index d6d73f31af..18cb2f6cfc 100644
--- a/src/shutdown/detach-loopback.h
+++ b/src/shutdown/detach-loopback.h
@@ -5,6 +5,6 @@
   Copyright © 2010 ProFUSION embedded systems
 ***/
 
-#include <stdbool.h>
+#include "forward.h"
 
 int loopback_detach_all(bool *changed, bool last_try);
diff --git a/src/shutdown/detach-md.h b/src/shutdown/detach-md.h
index 3784598208..8965a6ab65 100644
--- a/src/shutdown/detach-md.h
+++ b/src/shutdown/detach-md.h
@@ -5,6 +5,6 @@
   Copyright © 2010 ProFUSION embedded systems
 ***/
 
-#include <stdbool.h>
+#include "forward.h"
 
 int md_detach_all(bool *changed, bool last_try);
diff --git a/src/shutdown/detach-swap.h b/src/shutdown/detach-swap.h
index 1ebf5eb908..64e89076e7 100644
--- a/src/shutdown/detach-swap.h
+++ b/src/shutdown/detach-swap.h
@@ -5,8 +5,7 @@
   Copyright © 2010 ProFUSION embedded systems
 ***/
 
-#include <stdbool.h>
-
+#include "forward.h"
 #include "list.h"
 
 int swapoff_all(bool *changed);
diff --git a/src/shutdown/shutdown.c b/src/shutdown/shutdown.c
index 9c4eb4582d..7ab4deac5e 100644
--- a/src/shutdown/shutdown.c
+++ b/src/shutdown/shutdown.c
@@ -3,10 +3,8 @@
   Copyright © 2010 ProFUSION embedded systems
 ***/
 
-#include <errno.h>
 #include <getopt.h>
 #include <linux/reboot.h>
-#include <stdbool.h>
 #include <stdlib.h>
 #include <sys/mman.h>
 #include <sys/mount.h>
@@ -30,13 +28,16 @@
 #include "detach-swap.h"
 #include "errno-util.h"
 #include "exec-util.h"
+#include "extract-word.h"
 #include "fd-util.h"
 #include "fileio.h"
+#include "format-util.h"
 #include "getopt-defs.h"
 #include "initrd-util.h"
 #include "killall.h"
 #include "log.h"
 #include "parse-util.h"
+#include "pidref.h"
 #include "process-util.h"
 #include "reboot-util.h"
 #include "rlimit-util.h"
@@ -46,6 +47,7 @@
 #include "switch-root.h"
 #include "sysctl-util.h"
 #include "terminal-util.h"
+#include "time-util.h"
 #include "umount.h"
 #include "virt.h"
 #include "watchdog.h"
diff --git a/src/shutdown/test-umount.c b/src/shutdown/test-umount.c
index 1de1fe8e11..c645b8e7b2 100644
--- a/src/shutdown/test-umount.c
+++ b/src/shutdown/test-umount.c
@@ -5,8 +5,6 @@
 #include "errno-util.h"
 #include "fd-util.h"
 #include "log.h"
-#include "path-util.h"
-#include "string-util.h"
 #include "tests.h"
 #include "umount.h"
 
diff --git a/src/shutdown/umount.c b/src/shutdown/umount.c
index 9b083d2492..2bb456e087 100644
--- a/src/shutdown/umount.c
+++ b/src/shutdown/umount.c
@@ -3,18 +3,18 @@
   Copyright © 2010 ProFUSION embedded systems
 ***/
 
-#include <errno.h>
 #include <fcntl.h>
 #include <sys/mount.h>
 #include <sys/stat.h>
-#include <sys/types.h>
 #include <unistd.h>
 
 #include "alloc-util.h"
 #include "chase.h"
 #include "dirent-util.h"
+#include "errno-util.h"
 #include "fd-util.h"
 #include "fileio.h"
+#include "format-util.h"
 #include "fs-util.h"
 #include "fstab-util.h"
 #include "libmount-util.h"
@@ -27,8 +27,10 @@
 #include "process-util.h"
 #include "random-util.h"
 #include "signal-util.h"
+#include "stat-util.h"
+#include "string-util.h"
+#include "time-util.h"
 #include "umount.h"
-#include "user-util.h"
 #include "virt.h"
 
 static void mount_point_free(MountPoint **head, MountPoint *m) {
diff --git a/src/shutdown/umount.h b/src/shutdown/umount.h
index d18795c727..5fdaf76392 100644
--- a/src/shutdown/umount.h
+++ b/src/shutdown/umount.h
@@ -5,9 +5,7 @@
   Copyright © 2010 ProFUSION embedded systems
 ***/
 
-#include <stdbool.h>
-#include <stdio.h>
-
+#include "forward.h"
 #include "list.h"
 
 int umount_all(bool *changed, bool last_try);
diff --git a/src/timedate/hwclock-util.c b/src/timedate/hwclock-util.c
index 76a10f40b2..0a0045d2e0 100644
--- a/src/timedate/hwclock-util.c
+++ b/src/timedate/hwclock-util.c
@@ -3,7 +3,7 @@
 #include <fcntl.h>
 #include <linux/rtc.h>
 #include <sys/ioctl.h>
-#include <sys/time.h>
+#include <time.h>
 
 #include "errno-util.h"
 #include "fd-util.h"
diff --git a/src/timedate/hwclock-util.h b/src/timedate/hwclock-util.h
index 1503b5cf1f..ad24dad3a7 100644
--- a/src/timedate/hwclock-util.h
+++ b/src/timedate/hwclock-util.h
@@ -1,7 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include <time.h>
+#include "forward.h"
 
 int hwclock_get(struct tm *tm);
 int hwclock_set(const struct tm *tm);
diff --git a/src/timedate/timedatectl.c b/src/timedate/timedatectl.c
index 02ee9c226e..78b4feaebe 100644
--- a/src/timedate/timedatectl.c
+++ b/src/timedate/timedatectl.c
@@ -3,10 +3,10 @@
 #include <getopt.h>
 #include <locale.h>
 #include <math.h>
-#include <stdbool.h>
 #include <stdlib.h>
 
 #include "sd-bus.h"
+#include "sd-event.h"
 
 #include "alloc-util.h"
 #include "build.h"
@@ -23,10 +23,13 @@
 #include "parse-util.h"
 #include "polkit-agent.h"
 #include "pretty-print.h"
+#include "runtime-scope.h"
 #include "sparse-endian.h"
 #include "string-table.h"
+#include "string-util.h"
 #include "strv.h"
 #include "terminal-util.h"
+#include "time-util.h"
 #include "verbs.h"
 
 static PagerFlags arg_pager_flags = 0;
diff --git a/src/timedate/timedated.c b/src/timedate/timedated.c
index 8d8495a6e2..40bba14a31 100644
--- a/src/timedate/timedated.c
+++ b/src/timedate/timedated.c
@@ -1,9 +1,8 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include <errno.h>
+#include <stdlib.h>
 #include <sys/stat.h>
 #include <sys/timex.h>
-#include <sys/types.h>
 #include <unistd.h>
 
 #include "sd-bus.h"
@@ -25,25 +24,26 @@
 #include "conf-files.h"
 #include "constants.h"
 #include "daemon-util.h"
+#include "extract-word.h"
 #include "fd-util.h"
 #include "fileio.h"
 #include "fs-util.h"
 #include "hashmap.h"
 #include "hwclock-util.h"
+#include "label-util.h"
 #include "list.h"
 #include "log.h"
 #include "log-context.h"
 #include "main-func.h"
 #include "memory-util.h"
 #include "path-util.h"
-#include "selinux-util.h"
 #include "service-util.h"
-#include "signal-util.h"
+#include "set.h"
 #include "string-util.h"
 #include "strv.h"
+#include "time-util.h"
 #include "unit-def.h"
 #include "unit-name.h"
-#include "user-util.h"
 
 #define NULL_ADJTIME_UTC "0.0 0 0\n0\nUTC\n"
 #define NULL_ADJTIME_LOCAL "0.0 0 0\n0\nLOCAL\n"
diff --git a/src/userdb/userdbctl.c b/src/userdb/userdbctl.c
index db1743ee05..2d405197dc 100644
--- a/src/userdb/userdbctl.c
+++ b/src/userdb/userdbctl.c
@@ -1,6 +1,8 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
 #include <getopt.h>
+#include <stdlib.h>
+#include <unistd.h>
 
 #include "alloc-util.h"
 #include "bitfield.h"
@@ -9,22 +11,23 @@
 #include "creds-util.h"
 #include "dirent-util.h"
 #include "errno-list.h"
+#include "errno-util.h"
 #include "escape.h"
 #include "fd-util.h"
 #include "fileio.h"
 #include "format-table.h"
 #include "format-util.h"
+#include "fs-util.h"
 #include "log.h"
 #include "main-func.h"
-#include "mkdir-label.h"
+#include "mkdir.h"
 #include "pager.h"
 #include "parse-argument.h"
-#include "parse-util.h"
 #include "pretty-print.h"
 #include "recurse-dir.h"
 #include "socket-util.h"
+#include "string-util.h"
 #include "strv.h"
-#include "terminal-util.h"
 #include "uid-classification.h"
 #include "uid-range.h"
 #include "umask-util.h"
diff --git a/src/userdb/userdbd-manager.c b/src/userdb/userdbd-manager.c
index e30ec8ed75..48bd37ef50 100644
--- a/src/userdb/userdbd-manager.c
+++ b/src/userdb/userdbd-manager.c
@@ -1,14 +1,17 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
+#include <stdlib.h>
 #include <sys/wait.h>
 
 #include "sd-daemon.h"
 
+#include "alloc-util.h"
 #include "build-path.h"
 #include "common-signal.h"
 #include "env-util.h"
 #include "event-util.h"
 #include "fd-util.h"
+#include "format-util.h"
 #include "fs-util.h"
 #include "log.h"
 #include "mkdir.h"
@@ -16,8 +19,9 @@
 #include "set.h"
 #include "signal-util.h"
 #include "socket-util.h"
-#include "stdio-util.h"
+#include "string-util.h"
 #include "strv.h"
+#include "time-util.h"
 #include "umask-util.h"
 #include "userdbd-manager.h"
 
diff --git a/src/userdb/userdbd-manager.h b/src/userdb/userdbd-manager.h
index c39f79d25c..40ff0ed121 100644
--- a/src/userdb/userdbd-manager.h
+++ b/src/userdb/userdbd-manager.h
@@ -1,18 +1,13 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include "sd-bus.h"
-#include "sd-event.h"
-
-typedef struct Manager Manager;
-
-#include "hashmap.h"
+#include "forward.h"
 #include "ratelimit.h"
 
 #define USERDB_WORKERS_MIN 3
 #define USERDB_WORKERS_MAX 4096
 
-struct Manager {
+typedef struct Manager {
         sd_event *event;
 
         Set *workers_fixed;    /* Workers 0…USERDB_WORKERS_MIN */
@@ -23,7 +18,7 @@ struct Manager {
         RateLimit worker_ratelimit;
 
         sd_event_source *deferred_start_worker_event_source;
-};
+} Manager;
 
 int manager_new(Manager **ret);
 Manager* manager_free(Manager *m);
diff --git a/src/userdb/userdbd.c b/src/userdb/userdbd.c
index 64babef1c4..f3f4d516b6 100644
--- a/src/userdb/userdbd.c
+++ b/src/userdb/userdbd.c
@@ -1,7 +1,9 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
+#include <stdlib.h>
 #include <sys/stat.h>
-#include <sys/types.h>
+
+#include "sd-event.h"
 
 #include "daemon-util.h"
 #include "log.h"
diff --git a/src/userdb/userwork.c b/src/userdb/userwork.c
index 6ce5d57ef3..d1e296081c 100644
--- a/src/userdb/userwork.c
+++ b/src/userdb/userwork.c
@@ -6,6 +6,7 @@
 #include "sd-daemon.h"
 #include "sd-varlink.h"
 
+#include "alloc-util.h"
 #include "argv-util.h"
 #include "env-util.h"
 #include "errno-util.h"
@@ -14,11 +15,10 @@
 #include "io-util.h"
 #include "json-util.h"
 #include "main-func.h"
-#include "process-util.h"
-#include "strv.h"
+#include "pidref.h"
+#include "string-util.h"
 #include "time-util.h"
 #include "user-record.h"
-#include "user-record-nss.h"
 #include "user-util.h"
 #include "userdb.h"
 #include "varlink-io.systemd.UserDatabase.h"