diff --git a/include/openssl/bio.h b/include/nwssl/openssl/bio.h
similarity index 90%
rename from include/openssl/bio.h
rename to include/nwssl/openssl/bio.h
index 28887c0..dfe6b15 100644
--- a/include/openssl/bio.h
+++ b/include/nwssl/openssl/bio.h
@@ -1,5 +1,5 @@
-#ifndef MARS_MATRIXSSL_OPENSSL_BIO_H
-#define MARS_MATRIXSSL_OPENSSL_BIO_H
+#ifndef MARS_NWSSL_OPENSSL_BIO_H
+#define MARS_NWSSL_OPENSSL_BIO_H
 #include <openssl/ssl.h>
 #ifdef __cplusplus
 extern "C" {
diff --git a/include/nwssl/openssl/err.h b/include/nwssl/openssl/err.h
new file mode 100644
index 0000000..764cb67
--- /dev/null
+++ b/include/nwssl/openssl/err.h
@@ -0,0 +1,4 @@
+#ifndef MARS_NWSSL_OPENSSL_ERR_H
+#define MARS_NWSSL_OPENSSL_ERR_H
+#include <openssl/ssl.h>
+#endif
diff --git a/include/openssl/md5.h b/include/nwssl/openssl/md5.h
similarity index 100%
rename from include/openssl/md5.h
rename to include/nwssl/openssl/md5.h
diff --git a/include/nwssl/openssl/pem.h b/include/nwssl/openssl/pem.h
new file mode 100644
index 0000000..7330099
--- /dev/null
+++ b/include/nwssl/openssl/pem.h
@@ -0,0 +1,4 @@
+#ifndef MARS_NWSSL_OPENSSL_PEM_H
+#define MARS_NWSSL_OPENSSL_PEM_H
+#include <openssl/bio.h>
+#endif
diff --git a/include/openssl/ssl.h b/include/nwssl/openssl/ssl.h
similarity index 97%
rename from include/openssl/ssl.h
rename to include/nwssl/openssl/ssl.h
index b8019de..c77d032 100644
--- a/include/openssl/ssl.h
+++ b/include/nwssl/openssl/ssl.h
@@ -1,5 +1,5 @@
-#ifndef MARS_MATRIXSSL_OPENSSL_SSL_H
-#define MARS_MATRIXSSL_OPENSSL_SSL_H
+#ifndef MARS_NWSSL_OPENSSL_SSL_H
+#define MARS_NWSSL_OPENSSL_SSL_H
 
 #include <stdio.h>
 #include <stddef.h>
diff --git a/include/nwssl/openssl/x509.h b/include/nwssl/openssl/x509.h
new file mode 100644
index 0000000..3b69544
--- /dev/null
+++ b/include/nwssl/openssl/x509.h
@@ -0,0 +1,4 @@
+#ifndef MARS_NWSSL_OPENSSL_X509_H
+#define MARS_NWSSL_OPENSSL_X509_H
+#include <openssl/ssl.h>
+#endif
diff --git a/include/openssl/err.h b/include/openssl/err.h
deleted file mode 100644
index a0bec13..0000000
--- a/include/openssl/err.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef MARS_MATRIXSSL_OPENSSL_ERR_H
-#define MARS_MATRIXSSL_OPENSSL_ERR_H
-#include <openssl/ssl.h>
-#endif
diff --git a/include/openssl/pem.h b/include/openssl/pem.h
deleted file mode 100644
index 48550bc..0000000
--- a/include/openssl/pem.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef MARS_MATRIXSSL_OPENSSL_PEM_H
-#define MARS_MATRIXSSL_OPENSSL_PEM_H
-#include <openssl/bio.h>
-#endif
diff --git a/include/openssl/x509.h b/include/openssl/x509.h
deleted file mode 100644
index 8ed97e9..0000000
--- a/include/openssl/x509.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef MARS_MATRIXSSL_OPENSSL_X509_H
-#define MARS_MATRIXSSL_OPENSSL_X509_H
-#include <openssl/ssl.h>
-#endif
diff --git a/src/ssl/CMakeLists.txt b/src/ssl/CMakeLists.txt
index f11c459..49f7a44 100644
--- a/src/ssl/CMakeLists.txt
+++ b/src/ssl/CMakeLists.txt
@@ -1,6 +1,10 @@
 set(NWSSL_BUILD_INCLUDE_DIR "${CMAKE_BINARY_DIR}/include/nwssl")
-set(NWSSL_OPENSSL_COMPAT_INCLUDE_DIR "${CMAKE_BINARY_DIR}/include/openssl")
-file(MAKE_DIRECTORY "${NWSSL_BUILD_INCLUDE_DIR}" "${NWSSL_OPENSSL_COMPAT_INCLUDE_DIR}")
+set(NWSSL_OPENSSL_COMPAT_INCLUDE_DIR "${NWSSL_BUILD_INCLUDE_DIR}/openssl")
+set(NWSSL_PRIVATE_INCLUDE_DIR "${NWSSL_BUILD_INCLUDE_DIR}/private")
+file(MAKE_DIRECTORY
+    "${NWSSL_BUILD_INCLUDE_DIR}"
+    "${NWSSL_OPENSSL_COMPAT_INCLUDE_DIR}"
+    "${NWSSL_PRIVATE_INCLUDE_DIR}")
 
 configure_file(
     "${CMAKE_SOURCE_DIR}/include/nwssl/nwssl.h"
@@ -9,9 +13,12 @@ configure_file(
 
 # nwssl owns the reduced OpenSSL compatibility surface used by legacy mars-nwe
 # code.  MatrixSSL stays a native TLS/crypto provider underneath this wrapper.
-file(COPY "${CMAKE_SOURCE_DIR}/include/openssl/"
+file(COPY "${CMAKE_SOURCE_DIR}/include/nwssl/openssl/"
     DESTINATION "${NWSSL_OPENSSL_COMPAT_INCLUDE_DIR}"
     FILES_MATCHING PATTERN "*.h")
+file(COPY "${CMAKE_SOURCE_DIR}/include/nwssl/private/"
+    DESTINATION "${NWSSL_PRIVATE_INCLUDE_DIR}"
+    FILES_MATCHING PATTERN "*.h")
 
 add_library(nwssl SHARED
     nwssl.c
@@ -31,9 +38,12 @@ target_compile_definitions(nwssl PRIVATE
 target_include_directories(nwssl
     PUBLIC
         "$<BUILD_INTERFACE:${CMAKE_BINARY_DIR}/include>"
+        "$<BUILD_INTERFACE:${CMAKE_BINARY_DIR}/include/nwssl>"
         "$<INSTALL_INTERFACE:${CMAKE_INSTALL_INCLUDEDIR}>"
+        "$<INSTALL_INTERFACE:${CMAKE_INSTALL_INCLUDEDIR}/nwssl>"
     PRIVATE
-        "${CMAKE_SOURCE_DIR}/include")
+        "${CMAKE_SOURCE_DIR}/include"
+        "${CMAKE_SOURCE_DIR}/include/nwssl")
 
 target_link_libraries(nwssl
     PUBLIC
@@ -54,8 +64,6 @@ install(TARGETS nwssl
 
 install(DIRECTORY "${NWSSL_BUILD_INCLUDE_DIR}/"
     DESTINATION "${CMAKE_INSTALL_INCLUDEDIR}/nwssl")
-install(DIRECTORY "${NWSSL_OPENSSL_COMPAT_INCLUDE_DIR}/"
-    DESTINATION "${CMAKE_INSTALL_INCLUDEDIR}/openssl")
 
 install(EXPORT mars-nwe-ssl-targets
     NAMESPACE mars_nwe::