diff --git a/lib/hcrypto/aes.c b/lib/hcrypto/aes.c
index 77847e460..2e15d5d0e 100644
--- a/lib/hcrypto/aes.c
+++ b/lib/hcrypto/aes.c
@@ -31,15 +31,13 @@
  * SUCH DAMAGE.
  */
 
-#include "config.h"
-
+#include <config.h>
+#include <roken.h>
 
 #ifdef KRB5
 #include <krb5-types.h>
 #endif
 
-#include <string.h>
-
 #include "rijndael-alg-fst.h"
 #include "aes.h"
 
diff --git a/lib/hcrypto/bn.c b/lib/hcrypto/bn.c
index 17c1ec79b..e7d5b0473 100644
--- a/lib/hcrypto/bn.c
+++ b/lib/hcrypto/bn.c
@@ -32,15 +32,9 @@
  */
 
 #include <config.h>
-
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <limits.h>
+#include <roken.h>
 
 #include <krb5-types.h>
-#include <roken.h>
 #include <rfc2459_asn1.h> /* XXX */
 #include <der.h>
 
diff --git a/lib/hcrypto/camellia-ntt.c b/lib/hcrypto/camellia-ntt.c
index 4a27a94aa..2555003cb 100644
--- a/lib/hcrypto/camellia-ntt.c
+++ b/lib/hcrypto/camellia-ntt.c
@@ -30,16 +30,12 @@
  *  http://info.isl.ntt.co.jp/crypt/eng/camellia/specifications.html
  */
 
-#include "config.h"
-
-#include <string.h>
-#include <stdlib.h>
+#include <config.h>
+#include <roken.h>
 
 #include <krb5-types.h>
 #include "camellia-ntt.h"
 
-#include <roken.h>
-
 /* key constants */
 
 #define CAMELLIA_SIGMA1L (0xA09E667FL)
diff --git a/lib/hcrypto/camellia.c b/lib/hcrypto/camellia.c
index c88822db5..bc861a07d 100644
--- a/lib/hcrypto/camellia.c
+++ b/lib/hcrypto/camellia.c
@@ -31,19 +31,16 @@
  * SUCH DAMAGE.
  */
 
-#include "config.h"
+#include <config.h>
+#include <roken.h>
 
 #ifdef KRB5
 #include <krb5-types.h>
 #endif
 
-#include <string.h>
-
 #include "camellia-ntt.h"
 #include "camellia.h"
 
-#include <roken.h>
-
 int
 CAMELLIA_set_key(const unsigned char *userkey,
 		 const int bits, CAMELLIA_KEY *key)
diff --git a/lib/hcrypto/common.c b/lib/hcrypto/common.c
index 136bf1db1..cf30304c4 100644
--- a/lib/hcrypto/common.c
+++ b/lib/hcrypto/common.c
@@ -34,11 +34,7 @@
  */
 
 #include <config.h>
-
-#include <errno.h>
-
-#include <stdio.h>
-#include <stdlib.h>
+#include <roken.h>
 
 #include <krb5-types.h>
 #include <rfc2459_asn1.h>
diff --git a/lib/hcrypto/des.c b/lib/hcrypto/des.c
index 2e3192bff..c16f33ba2 100644
--- a/lib/hcrypto/des.c
+++ b/lib/hcrypto/des.c
@@ -83,17 +83,12 @@
  */
 
 #include <config.h>
+#include <roken.h>
 
 #define HC_DEPRECATED
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
 #include <krb5-types.h>
 #include <assert.h>
 
-#include <roken.h>
-
 #include "des.h"
 #include "ui.h"
 
diff --git a/lib/hcrypto/destest.c b/lib/hcrypto/destest.c
index 2f70d8bee..0761ded96 100644
--- a/lib/hcrypto/destest.c
+++ b/lib/hcrypto/destest.c
@@ -31,15 +31,13 @@
  * SUCH DAMAGE.
  */
 
-#include "config.h"
+#include <config.h>
+#include <roken.h>
 
 #ifdef KRB5
 #include <krb5-types.h>
 #endif
 
-#include <string.h>
-#include <stdio.h>
-#include <stdlib.h>
 #ifdef HAVE_UNISTD_H
 #include <unistd.h>
 #endif
diff --git a/lib/hcrypto/dh-ltm.c b/lib/hcrypto/dh-ltm.c
index f4e03139f..774f0e117 100644
--- a/lib/hcrypto/dh-ltm.c
+++ b/lib/hcrypto/dh-ltm.c
@@ -34,13 +34,10 @@
 #ifdef HAVE_CONFIG_H
 #include <config.h>
 #endif
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <dh.h>
-
 #include <roken.h>
 
+#include <dh.h>
+
 #include "tommath.h"
 
 static void
diff --git a/lib/hcrypto/dh-tfm.c b/lib/hcrypto/dh-tfm.c
index 0ebba6ffe..dce8a9fb2 100644
--- a/lib/hcrypto/dh-tfm.c
+++ b/lib/hcrypto/dh-tfm.c
@@ -32,13 +32,10 @@
  */
 
 #include <config.h>
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <dh.h>
-
 #include <roken.h>
 
+#include <dh.h>
+
 #ifdef USE_HCRYPTO_TFM
 
 #include "tfm.h"
diff --git a/lib/hcrypto/dh.c b/lib/hcrypto/dh.c
index e1f82bfd3..ef717d50c 100644
--- a/lib/hcrypto/dh.c
+++ b/lib/hcrypto/dh.c
@@ -34,16 +34,13 @@
 #ifdef HAVE_CONFIG_H
 #include <config.h>
 #endif
+#include <roken.h>
 
-#include <stdio.h>
-#include <stdlib.h>
 #include <krb5-types.h>
 #include <rfc2459_asn1.h>
 
 #include <dh.h>
 
-#include <roken.h>
-
 /**
  * @page page_dh DH - Diffie-Hellman key exchange
  *
diff --git a/lib/hcrypto/dsa.c b/lib/hcrypto/dsa.c
index 07414c233..bbb34601c 100644
--- a/lib/hcrypto/dsa.c
+++ b/lib/hcrypto/dsa.c
@@ -32,13 +32,10 @@
  */
 
 #include <config.h>
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <dsa.h>
-
 #include <roken.h>
 
+#include <dsa.h>
+
 /*
  *
  */
diff --git a/lib/hcrypto/ec.c b/lib/hcrypto/ec.c
index a41efdb68..405981984 100644
--- a/lib/hcrypto/ec.c
+++ b/lib/hcrypto/ec.c
@@ -31,6 +31,9 @@
  * SUCH DAMAGE.
  */
 
+#include <config.h>
+#include <roken.h>
+
 #include "ec.h"
 
 struct EC_POINT {
diff --git a/lib/hcrypto/engine.c b/lib/hcrypto/engine.c
index 2f34d6e56..04ba6b645 100644
--- a/lib/hcrypto/engine.c
+++ b/lib/hcrypto/engine.c
@@ -32,10 +32,7 @@
  */
 
 #include <config.h>
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
+#include <roken.h>
 
 #include <engine.h>
 
diff --git a/lib/hcrypto/evp-cc.c b/lib/hcrypto/evp-cc.c
index 774305337..8f317a670 100644
--- a/lib/hcrypto/evp-cc.c
+++ b/lib/hcrypto/evp-cc.c
@@ -37,12 +37,9 @@
 
 #ifdef __APPLE__
 
-#include "config.h"
+#include <config.h>
+#include <roken.h>
 
-#include <sys/types.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
 #include <assert.h>
 
 #ifdef HAVE_COMMONCRYPTO_COMMONDIGEST_H
diff --git a/lib/hcrypto/evp-crypt.c b/lib/hcrypto/evp-crypt.c
index 6b1611b63..4e8489ebc 100644
--- a/lib/hcrypto/evp-crypt.c
+++ b/lib/hcrypto/evp-crypt.c
@@ -34,13 +34,10 @@
 /* Windows crypto provider plugin, sample */
 
 #include <config.h>
+#include <roken.h>
 
 #define HC_DEPRECATED
 
-#include <sys/types.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
 #include <assert.h>
 
 #include <evp.h>
diff --git a/lib/hcrypto/evp-hcrypto.c b/lib/hcrypto/evp-hcrypto.c
index 64f028490..321efb08c 100644
--- a/lib/hcrypto/evp-hcrypto.c
+++ b/lib/hcrypto/evp-hcrypto.c
@@ -32,13 +32,10 @@
  */
 
 #include <config.h>
+#include <roken.h>
 
 #define HC_DEPRECATED
 
-#include <sys/types.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
 #include <assert.h>
 
 #include <evp.h>
diff --git a/lib/hcrypto/evp-pkcs11.c b/lib/hcrypto/evp-pkcs11.c
index 08f258475..46f37613e 100644
--- a/lib/hcrypto/evp-pkcs11.c
+++ b/lib/hcrypto/evp-pkcs11.c
@@ -30,9 +30,8 @@
 
 /* PKCS#11 provider */
 
-#include "config.h"
+#include <config.h>
 #include <roken.h>
-
 #include <assert.h>
 #ifdef HAVE_DLFCN_H
 #include <dlfcn.h>
diff --git a/lib/hcrypto/evp-w32.c b/lib/hcrypto/evp-w32.c
index 8557a5f51..e58273353 100644
--- a/lib/hcrypto/evp-w32.c
+++ b/lib/hcrypto/evp-w32.c
@@ -35,9 +35,9 @@
  * crypto APIs from Vista onwards).
  */
 
-#include "config.h"
+#include <config.h>
+#include <roken.h>
 
-#include <windows.h>
 #include <assert.h>
 
 #include <evp.h>
diff --git a/lib/hcrypto/evp-wincng.c b/lib/hcrypto/evp-wincng.c
index e887d79c7..8a8b91cb1 100644
--- a/lib/hcrypto/evp-wincng.c
+++ b/lib/hcrypto/evp-wincng.c
@@ -30,9 +30,8 @@
 
 /* Windows CNG provider */
 
-#include "config.h"
-
-#include <windows.h>
+#include <config.h>
+#include <roken.h>
 #include <assert.h>
 
 #include <evp.h>
diff --git a/lib/hcrypto/evp.c b/lib/hcrypto/evp.c
index cb8ba7602..c1f930f5d 100644
--- a/lib/hcrypto/evp.c
+++ b/lib/hcrypto/evp.c
@@ -34,14 +34,11 @@
 #ifdef HAVE_CONFIG_H
 #include <config.h>
 #endif
+#include <roken.h>
 
 #define HC_DEPRECATED
 #define HC_DEPRECATED_CRYPTO
 
-#include <sys/types.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
 #include <assert.h>
 
 #include <evp.h>
@@ -51,7 +48,6 @@
 #include <evp-pkcs11.h>
 
 #include <krb5-types.h>
-#include <roken.h>
 
 #ifndef HCRYPTO_DEF_PROVIDER
 # ifdef __APPLE__
diff --git a/lib/hcrypto/example_evp_cipher.c b/lib/hcrypto/example_evp_cipher.c
index f07ba8f99..ba941c391 100644
--- a/lib/hcrypto/example_evp_cipher.c
+++ b/lib/hcrypto/example_evp_cipher.c
@@ -31,17 +31,15 @@
  * SUCH DAMAGE.
  */
 
+#include <config.h>
+#include <roken.h>
+
 #include <krb5-types.h> /* should really be stdint.h */
 #include <hcrypto/evp.h>
 
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
 #include <err.h>
 #include <assert.h>
 
-#include "roken.h"
-
 /* key and initial vector */
 static char key[16] =
     "\xaa\xbb\x45\xd4\xaa\xbb\x45\xd4"
diff --git a/lib/hcrypto/hmac.c b/lib/hcrypto/hmac.c
index d11bd9876..29e6af479 100644
--- a/lib/hcrypto/hmac.c
+++ b/lib/hcrypto/hmac.c
@@ -31,10 +31,9 @@
  * SUCH DAMAGE.
  */
 
-#include <sys/types.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
+#include <config.h>
+#include <roken.h>
+
 #include <hmac.h>
 
 void
diff --git a/lib/hcrypto/md2.c b/lib/hcrypto/md2.c
index 58075765e..25341a93b 100644
--- a/lib/hcrypto/md2.c
+++ b/lib/hcrypto/md2.c
@@ -31,7 +31,8 @@
  * SUCH DAMAGE.
  */
 
-#include "config.h"
+#include <config.h>
+#include <roken.h>
 
 #include "hash.h"
 #include "md2.h"
diff --git a/lib/hcrypto/md4.c b/lib/hcrypto/md4.c
index 7617d9af5..2a803ce0d 100644
--- a/lib/hcrypto/md4.c
+++ b/lib/hcrypto/md4.c
@@ -31,7 +31,8 @@
  * SUCH DAMAGE.
  */
 
-#include "config.h"
+#include <config.h>
+#include <roken.h>
 
 #include "hash.h"
 #include "md4.h"
diff --git a/lib/hcrypto/md5.c b/lib/hcrypto/md5.c
index cf8219dcd..ca5d16041 100644
--- a/lib/hcrypto/md5.c
+++ b/lib/hcrypto/md5.c
@@ -31,7 +31,8 @@
  * SUCH DAMAGE.
  */
 
-#include "config.h"
+#include <config.h>
+#include <roken.h>
 
 #include "hash.h"
 #include "md5.h"
diff --git a/lib/hcrypto/md5crypt_test.c b/lib/hcrypto/md5crypt_test.c
index a0c2df411..f57c3ed14 100644
--- a/lib/hcrypto/md5crypt_test.c
+++ b/lib/hcrypto/md5crypt_test.c
@@ -32,9 +32,7 @@
  */
 
 #include <config.h>
-
-#include <stdio.h>
-#include <string.h>
+#include <roken.h>
 #include <des.h>
 
 struct test {
diff --git a/lib/hcrypto/mdtest.c b/lib/hcrypto/mdtest.c
index b3559c756..afde93820 100644
--- a/lib/hcrypto/mdtest.c
+++ b/lib/hcrypto/mdtest.c
@@ -32,14 +32,10 @@
  */
 
 #include <config.h>
+#include <roken.h>
 
 #define HC_DEPRECATED_CRYPTO
 
-#include <stdio.h>
-#ifdef HAVE_STDLIB_H
-#include <stdlib.h>
-#endif
-#include <string.h>
 #ifdef KRB5
 #include <krb5-types.h>
 #endif
diff --git a/lib/hcrypto/passwd_dlg.c b/lib/hcrypto/passwd_dlg.c
index c16f28327..037fa7436 100644
--- a/lib/hcrypto/passwd_dlg.c
+++ b/lib/hcrypto/passwd_dlg.c
@@ -37,9 +37,9 @@
  */
 
 #include <config.h>
+#include <roken.h>
 
 #ifdef WIN32	/* Visual C++ 4.0 (Windows95/NT) */
-#include <Windows.h>
 #include "passwd_dlg.h"
 #include "Resource.h"
 #define passwdBufSZ 64
diff --git a/lib/hcrypto/pkcs12.c b/lib/hcrypto/pkcs12.c
index ff0f77644..5f0791fee 100644
--- a/lib/hcrypto/pkcs12.c
+++ b/lib/hcrypto/pkcs12.c
@@ -32,16 +32,12 @@
  */
 
 #include <config.h>
-
-#include <stdio.h>
-#include <stdlib.h>
+#include <roken.h>
 #include <assert.h>
 
 #include <pkcs12.h>
 #include <bn.h>
 
-#include <roken.h>
-
 int
 PKCS12_key_gen(const void *key, size_t keylen,
 	       const void *salt, size_t saltlen,
diff --git a/lib/hcrypto/pkcs5.c b/lib/hcrypto/pkcs5.c
index 18045e236..5b5d0cc70 100644
--- a/lib/hcrypto/pkcs5.c
+++ b/lib/hcrypto/pkcs5.c
@@ -32,19 +32,15 @@
  */
 
 #include <config.h>
+#include <roken.h>
 
 #ifdef KRB5
 #include <krb5-types.h>
 #endif
 
-#include <stdio.h>
-#include <stdlib.h>
-
 #include <evp.h>
 #include <hmac.h>
 
-#include <roken.h>
-
 /**
  * As descriped in PKCS5, convert a password, salt, and iteration counter into a crypto key.
  *
diff --git a/lib/hcrypto/rand-fortuna.c b/lib/hcrypto/rand-fortuna.c
index a4c388584..bca124303 100644
--- a/lib/hcrypto/rand-fortuna.c
+++ b/lib/hcrypto/rand-fortuna.c
@@ -30,16 +30,13 @@
  */
 
 #include <config.h>
-
-#include <stdio.h>
-#include <stdlib.h>
+#include <roken.h>
 #include <rand.h>
 #include <heim_threads.h>
 
 #ifdef KRB5
 #include <krb5-types.h>
 #endif
-#include <roken.h>
 
 #include "randi.h"
 #include "aes.h"
diff --git a/lib/hcrypto/rand-timer.c b/lib/hcrypto/rand-timer.c
index 994c3210e..dd3b542a8 100644
--- a/lib/hcrypto/rand-timer.c
+++ b/lib/hcrypto/rand-timer.c
@@ -32,13 +32,10 @@
  */
 
 #include <config.h>
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <rand.h>
-
 #include <roken.h>
 
+#include <rand.h>
+
 #include "randi.h"
 
 #ifndef WIN32 /* don't bother with this on windows */
diff --git a/lib/hcrypto/rand-unix.c b/lib/hcrypto/rand-unix.c
index 72715077c..001ef606c 100644
--- a/lib/hcrypto/rand-unix.c
+++ b/lib/hcrypto/rand-unix.c
@@ -32,14 +32,11 @@
  */
 
 #include <config.h>
+#include <roken.h>
 
-#include <stdio.h>
-#include <stdlib.h>
 #include <rand.h>
 #include <heim_threads.h>
 
-#include <roken.h>
-
 #include "randi.h"
 
 /*
diff --git a/lib/hcrypto/rand-w32.c b/lib/hcrypto/rand-w32.c
index 49f52b18c..f36903ae3 100644
--- a/lib/hcrypto/rand-w32.c
+++ b/lib/hcrypto/rand-w32.c
@@ -36,8 +36,6 @@
 
 #include <wincrypt.h>
 
-#include <stdio.h>
-#include <stdlib.h>
 #include <rand.h>
 #include <heim_threads.h>
 
diff --git a/lib/hcrypto/rand.c b/lib/hcrypto/rand.c
index d5c1f687b..3b34b61d2 100644
--- a/lib/hcrypto/rand.c
+++ b/lib/hcrypto/rand.c
@@ -34,14 +34,11 @@
  */
 
 #include <config.h>
+#include <roken.h>
 
-#include <stdio.h>
-#include <stdlib.h>
 #include <rand.h>
 #include <randi.h>
 
-#include <roken.h>
-
 #ifndef O_BINARY
 #define O_BINARY 0
 #endif
diff --git a/lib/hcrypto/rc2.c b/lib/hcrypto/rc2.c
index 63bd3daa0..02b684cbd 100644
--- a/lib/hcrypto/rc2.c
+++ b/lib/hcrypto/rc2.c
@@ -32,11 +32,9 @@
  */
 
 #include <config.h>
+#include <roken.h>
 
 #include "rc2.h"
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
 
 /*
  * Implemented from Peter Gutmann's "Specification for Ron Rivests Cipher No.2"
diff --git a/lib/hcrypto/rc2test.c b/lib/hcrypto/rc2test.c
index 01701adf7..553bed33f 100644
--- a/lib/hcrypto/rc2test.c
+++ b/lib/hcrypto/rc2test.c
@@ -32,11 +32,9 @@
  */
 
 #include <config.h>
+#include <roken.h>
 
 #include <rc2.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
 
 struct {
     const void *key;
diff --git a/lib/hcrypto/rc4.c b/lib/hcrypto/rc4.c
index 988c42424..cc7882d29 100644
--- a/lib/hcrypto/rc4.c
+++ b/lib/hcrypto/rc4.c
@@ -33,7 +33,8 @@
 
 /* implemented from description in draft-kaukonen-cipher-arcfour-03.txt */
 
-#include "config.h"
+#include <config.h>
+#include <roken.h>
 
 #include <rc4.h>
 
diff --git a/lib/hcrypto/rctest.c b/lib/hcrypto/rctest.c
index b952fcc9d..031d8cd57 100644
--- a/lib/hcrypto/rctest.c
+++ b/lib/hcrypto/rctest.c
@@ -32,9 +32,7 @@
  */
 
 #include <config.h>
-
-#include <stdio.h>
-#include <string.h>
+#include <roken.h>
 #include <rc4.h>
 
 static unsigned char plain1[8] =
diff --git a/lib/hcrypto/rijndael-alg-fst.c b/lib/hcrypto/rijndael-alg-fst.c
index bf335afd9..be05cdd13 100644
--- a/lib/hcrypto/rijndael-alg-fst.c
+++ b/lib/hcrypto/rijndael-alg-fst.c
@@ -28,10 +28,9 @@
 
 /* "$NetBSD: rijndael-alg-fst.c,v 1.5 2001/11/13 01:40:10 lukem Exp $" */
 
-#include "config.h"
+#include <config.h>
+#include <roken.h>
 
-
-#include <stdlib.h>
 #ifdef KRB5
 #include <krb5-types.h>
 #endif
diff --git a/lib/hcrypto/rnd_keys.c b/lib/hcrypto/rnd_keys.c
index 49c7634c3..ec35021dc 100644
--- a/lib/hcrypto/rnd_keys.c
+++ b/lib/hcrypto/rnd_keys.c
@@ -31,15 +31,14 @@
  * SUCH DAMAGE.
  */
 
-#include "config.h"
-
+#include <config.h>
+#include <roken.h>
 
 #define HC_DEPRECATED
 
 #ifdef KRB5
 #include <krb5-types.h>
 #endif
-#include <stdlib.h>
 
 #include <des.h>
 #include <rand.h>
diff --git a/lib/hcrypto/rsa-gmp.c b/lib/hcrypto/rsa-gmp.c
index b3a994b80..8fb28edff 100644
--- a/lib/hcrypto/rsa-gmp.c
+++ b/lib/hcrypto/rsa-gmp.c
@@ -32,16 +32,12 @@
  */
 
 #include <config.h>
-
-#include <stdio.h>
-#include <stdlib.h>
+#include <roken.h>
 #include <krb5-types.h>
 #include <assert.h>
 
 #include <rsa.h>
 
-#include <roken.h>
-
 #ifdef HAVE_GMP
 
 #include <gmp.h>
diff --git a/lib/hcrypto/rsa-ltm.c b/lib/hcrypto/rsa-ltm.c
index d1207603c..4ac5617cb 100644
--- a/lib/hcrypto/rsa-ltm.c
+++ b/lib/hcrypto/rsa-ltm.c
@@ -32,16 +32,12 @@
  */
 
 #include <config.h>
-
-#include <stdio.h>
-#include <stdlib.h>
+#include <roken.h>
 #include <krb5-types.h>
 #include <assert.h>
 
 #include <rsa.h>
 
-#include <roken.h>
-
 #include "tommath.h"
 
 static int
diff --git a/lib/hcrypto/rsa-tfm.c b/lib/hcrypto/rsa-tfm.c
index 5bf19429b..41b0fc18a 100644
--- a/lib/hcrypto/rsa-tfm.c
+++ b/lib/hcrypto/rsa-tfm.c
@@ -32,16 +32,12 @@
  */
 
 #include <config.h>
-
-#include <stdio.h>
-#include <stdlib.h>
+#include <roken.h>
 #include <krb5-types.h>
 #include <assert.h>
 
 #include <rsa.h>
 
-#include <roken.h>
-
 #ifdef USE_HCRYPTO_TFM
 
 #include "tfm.h"
diff --git a/lib/hcrypto/rsa.c b/lib/hcrypto/rsa.c
index 209df13d3..c99b2b6cb 100644
--- a/lib/hcrypto/rsa.c
+++ b/lib/hcrypto/rsa.c
@@ -32,9 +32,7 @@
  */
 
 #include <config.h>
-
-#include <stdio.h>
-#include <stdlib.h>
+#include <roken.h>
 #include <krb5-types.h>
 #include <rfc2459_asn1.h>
 
@@ -44,8 +42,6 @@
 
 #include "common.h"
 
-#include <roken.h>
-
 /**
  * @page page_rsa RSA - public-key cryptography
  *
diff --git a/lib/hcrypto/sha.c b/lib/hcrypto/sha.c
index 0f8f53a33..8eae9b416 100644
--- a/lib/hcrypto/sha.c
+++ b/lib/hcrypto/sha.c
@@ -31,7 +31,8 @@
  * SUCH DAMAGE.
  */
 
-#include "config.h"
+#include <config.h>
+#include <roken.h>
 
 #include "hash.h"
 #include "sha.h"
diff --git a/lib/hcrypto/sha256.c b/lib/hcrypto/sha256.c
index 221e832c2..1b62ba20c 100644
--- a/lib/hcrypto/sha256.c
+++ b/lib/hcrypto/sha256.c
@@ -31,7 +31,8 @@
  * SUCH DAMAGE.
  */
 
-#include "config.h"
+#include <config.h>
+#include <roken.h>
 
 #include "hash.h"
 #include "sha.h"
diff --git a/lib/hcrypto/sha512.c b/lib/hcrypto/sha512.c
index bf079b39a..98c418e1e 100644
--- a/lib/hcrypto/sha512.c
+++ b/lib/hcrypto/sha512.c
@@ -31,7 +31,8 @@
  * SUCH DAMAGE.
  */
 
-#include "config.h"
+#include <config.h>
+#include <roken.h>
 
 #include "hash.h"
 #include "sha.h"
diff --git a/lib/hcrypto/test_bn.c b/lib/hcrypto/test_bn.c
index 03db89128..74709fe23 100644
--- a/lib/hcrypto/test_bn.c
+++ b/lib/hcrypto/test_bn.c
@@ -32,12 +32,7 @@
  */
 
 #include <config.h>
-
-#include <sys/types.h>
-#include <limits.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
+#include <roken.h>
 
 #include <bn.h>
 #include <rand.h>
diff --git a/lib/hcrypto/test_bulk.c b/lib/hcrypto/test_bulk.c
index 14f468867..fa087f379 100644
--- a/lib/hcrypto/test_bulk.c
+++ b/lib/hcrypto/test_bulk.c
@@ -32,15 +32,9 @@
  */
 
 #include <config.h>
-
-#include <sys/types.h>
-#include <assert.h>
-#include <limits.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <getarg.h>
 #include <roken.h>
+#include <assert.h>
+#include <getarg.h>
 
 #include <evp.h>
 #include <evp-hcrypto.h>
diff --git a/lib/hcrypto/test_cipher.c b/lib/hcrypto/test_cipher.c
index e73570ed4..717e50b17 100644
--- a/lib/hcrypto/test_cipher.c
+++ b/lib/hcrypto/test_cipher.c
@@ -32,16 +32,11 @@
  */
 
 #include <config.h>
+#include <roken.h>
 
 #define HC_DEPRECATED_CRYPTO
 
-#include <sys/types.h>
-#include <limits.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
 #include <getarg.h>
-#include <roken.h>
 
 #include <evp.h>
 #include <evp-hcrypto.h>
diff --git a/lib/hcrypto/test_dh.c b/lib/hcrypto/test_dh.c
index 7a6c8c09a..638d25f70 100644
--- a/lib/hcrypto/test_dh.c
+++ b/lib/hcrypto/test_dh.c
@@ -38,11 +38,9 @@
  */
 
 #include <config.h>
-
-#include <stdio.h>
-#include <ctype.h>
-
 #include <roken.h>
+
+#include <ctype.h>
 #include <getarg.h>
 
 #include <dh.h>
diff --git a/lib/hcrypto/test_engine_dso.c b/lib/hcrypto/test_engine_dso.c
index f6a38effd..00a672e63 100644
--- a/lib/hcrypto/test_engine_dso.c
+++ b/lib/hcrypto/test_engine_dso.c
@@ -32,9 +32,6 @@
  */
 
 #include <config.h>
-
-#include <stdio.h>
-
 #include <roken.h>
 #include <getarg.h>
 
diff --git a/lib/hcrypto/test_hmac.c b/lib/hcrypto/test_hmac.c
index d8c3e69cd..063a461cc 100644
--- a/lib/hcrypto/test_hmac.c
+++ b/lib/hcrypto/test_hmac.c
@@ -32,16 +32,10 @@
  */
 
 #include <config.h>
-
-#include <sys/types.h>
-#include <limits.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
+#include <roken.h>
 
 #include <hmac.h>
 #include <evp.h>
-#include <roken.h>
 
 int
 main(int argc, char **argv)
diff --git a/lib/hcrypto/test_pkcs12.c b/lib/hcrypto/test_pkcs12.c
index aa27af0e6..3c7f5da13 100644
--- a/lib/hcrypto/test_pkcs12.c
+++ b/lib/hcrypto/test_pkcs12.c
@@ -32,12 +32,7 @@
  */
 
 #include <config.h>
-
-#include <sys/types.h>
-#include <limits.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
+#include <roken.h>
 
 #include <pkcs12.h>
 #include <evp.h>
diff --git a/lib/hcrypto/test_pkcs5.c b/lib/hcrypto/test_pkcs5.c
index 46ca52ac7..ece3461ca 100644
--- a/lib/hcrypto/test_pkcs5.c
+++ b/lib/hcrypto/test_pkcs5.c
@@ -32,12 +32,7 @@
  */
 
 #include <config.h>
-
-#include <sys/types.h>
-#include <limits.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
+#include <roken.h>
 #include <err.h>
 
 #include <evp.h>
diff --git a/lib/hcrypto/test_rand.c b/lib/hcrypto/test_rand.c
index 9548a7700..335b35a9f 100644
--- a/lib/hcrypto/test_rand.c
+++ b/lib/hcrypto/test_rand.c
@@ -34,12 +34,9 @@
  */
 
 #include <config.h>
-
-#include <stdio.h>
-#include <stdlib.h>
+#include <roken.h>
 #include <math.h>
 
-#include <roken.h>
 #include <getarg.h>
 
 #include "rand.h"
diff --git a/lib/hcrypto/test_rsa.c b/lib/hcrypto/test_rsa.c
index 43bb6d4db..54b7a66c5 100644
--- a/lib/hcrypto/test_rsa.c
+++ b/lib/hcrypto/test_rsa.c
@@ -32,9 +32,6 @@
  */
 
 #include <config.h>
-
-#include <stdio.h>
-
 #include <roken.h>
 #include <getarg.h>
 
diff --git a/lib/hcrypto/ui.c b/lib/hcrypto/ui.c
index d0714fe6d..40f47a21d 100644
--- a/lib/hcrypto/ui.c
+++ b/lib/hcrypto/ui.c
@@ -32,15 +32,11 @@
  */
 
 #include <config.h>
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
+#include <roken.h>
 #include <signal.h>
 #ifdef HAVE_TERMIOS_H
 #include <termios.h>
 #endif
-#include <roken.h>
 
 #include <ui.h>
 #ifdef HAVE_CONIO_H
diff --git a/lib/hcrypto/validate.c b/lib/hcrypto/validate.c
index 6f61cc53b..c76245062 100644
--- a/lib/hcrypto/validate.c
+++ b/lib/hcrypto/validate.c
@@ -32,12 +32,6 @@
  */
 
 #include <config.h>
-
-#include <sys/types.h>
-#include <limits.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
 #include <roken.h>
 
 #include <evp.h>