diff --git a/CHANGES b/CHANGES
index 2c856be858..122422befb 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,11 @@
+8.0.0-dev.423 | 2025-06-11 11:12:18 -0700
+
+  * Remove some unused #includes from spicy code (Tim Wojtulewicz, Corelight)
+
+  * Remove using util.h in various headers in favor of util-types.h (Tim Wojtulewicz, Corelight)
+
+  * Move type definitions/aliases from util.h to a separate file (Tim Wojtulewicz, Corelight)
+
 8.0.0-dev.419 | 2025-06-11 09:00:46 -0700
 
   * Bugfix: AsString() on an EnumVal will segfault (Christian Kreibich, Corelight)
diff --git a/VERSION b/VERSION
index c5b6ef66b4..fc4fae5043 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-8.0.0-dev.419
+8.0.0-dev.423
diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
index 8b2d2fb8f8..f8c5a42f51 100644
--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
@@ -318,6 +318,7 @@ set(MAIN_SRCS
     digest.cc
     net_util.cc
     util.cc
+    util-types.cc
     module_util.cc
     zeek-affinity.cc
     zeek-setup.cc
diff --git a/src/Desc.h b/src/Desc.h
index b2f4bb56fa..de09e37ad8 100644
--- a/src/Desc.h
+++ b/src/Desc.h
@@ -9,7 +9,7 @@
 
 #include "zeek/IntrusivePtr.h"
 #include "zeek/ZeekString.h" // for byte_vec
-#include "zeek/util.h"       // for zeek_int_t
+#include "zeek/util-types.h"
 
 namespace zeek {
 
diff --git a/src/Event.h b/src/Event.h
index 82804ca58d..7fd5db7fcf 100644
--- a/src/Event.h
+++ b/src/Event.h
@@ -9,7 +9,7 @@
 #include "zeek/ZeekArgs.h"
 #include "zeek/analyzer/Analyzer.h"
 #include "zeek/iosource/IOSource.h"
-#include "zeek/util.h"
+#include "zeek/util-types.h"
 
 namespace zeek {
 
diff --git a/src/Frag.h b/src/Frag.h
index e705b4304c..62ba30ea3f 100644
--- a/src/Frag.h
+++ b/src/Frag.h
@@ -8,7 +8,7 @@
 #include "zeek/IPAddr.h"
 #include "zeek/Reassem.h"
 #include "zeek/Timer.h"
-#include "zeek/util.h" // for zeek_uint_t
+#include "zeek/util-types.h"
 
 namespace zeek {
 
diff --git a/src/Hash.h b/src/Hash.h
index aaee8d3df3..7d72957c03 100644
--- a/src/Hash.h
+++ b/src/Hash.h
@@ -22,7 +22,7 @@
 #include <unistd.h>
 #include <cstdlib>
 
-#include "zeek/util.h" // for zeek_int_t
+#include "zeek/util-types.h" // for zeek_int_t
 
 // to allow md5_hmac_bif access to the hmac seed
 #include "zeek/ZeekArgs.h"
diff --git a/src/Overflow.h b/src/Overflow.h
index 0eba5e9237..2ba86b6fc5 100644
--- a/src/Overflow.h
+++ b/src/Overflow.h
@@ -2,9 +2,14 @@
 
 #pragma once
 
-#include "zeek/Type.h"
+#include "zeek/util-types.h"
 
-namespace zeek::detail {
+namespace zeek {
+
+class Type;
+class Val;
+
+namespace detail {
 
 inline bool double_to_count_would_overflow(double v) { return v < 0.0 || v > static_cast<double>(UINT64_MAX); }
 
@@ -18,4 +23,5 @@ inline bool count_to_int_would_overflow(zeek_uint_t v) { return v > INT64_MAX; }
 
 extern bool would_overflow(const zeek::Type* from_type, const zeek::Type* to_type, const Val* val);
 
-} // namespace zeek::detail
+} // namespace detail
+} // namespace zeek
diff --git a/src/UID.h b/src/UID.h
index 35e49bc5fa..aeccc03684 100644
--- a/src/UID.h
+++ b/src/UID.h
@@ -5,7 +5,7 @@
 #include <cstring>
 #include <string>
 
-#include "zeek/util.h" // for zeek_int_t
+#include "zeek/util-types.h"
 
 namespace zeek {
 
diff --git a/src/analyzer/Component.h b/src/analyzer/Component.h
index 9f5e645e1b..f9ca753c88 100644
--- a/src/analyzer/Component.h
+++ b/src/analyzer/Component.h
@@ -4,7 +4,6 @@
 
 #include "zeek/Tag.h"
 #include "zeek/plugin/Component.h"
-#include "zeek/util.h"
 
 namespace zeek {
 
diff --git a/src/binpac_zeek-lib.pac b/src/binpac_zeek-lib.pac
index 2b32edccd9..0e91f31438 100644
--- a/src/binpac_zeek-lib.pac
+++ b/src/binpac_zeek-lib.pac
@@ -1,7 +1,7 @@
 %extern{
 #include "zeek/3rdparty/ConvertUTF.h"
 #include "zeek/binpac_zeek.h"
-#include "zeek/util.h"
+#include "zeek/util-types.h"
 #include "zeek/Reporter.h"
 #include "zeek/Val.h"
 #include "zeek/RunState.h"
diff --git a/src/digest.h b/src/digest.h
index e846257451..07ee1c776b 100644
--- a/src/digest.h
+++ b/src/digest.h
@@ -10,7 +10,7 @@
 #include <cstdint>
 #include <cstdio>
 
-#include "zeek/util.h"
+#include "zeek/util.h" // for util::bytetohex
 
 // Required buffer size for an MD5 digest.
 #define ZEEK_MD5_DIGEST_LENGTH 16
diff --git a/src/iosource/BPF_Program.h b/src/iosource/BPF_Program.h
index 3e562921f2..68370a040c 100644
--- a/src/iosource/BPF_Program.h
+++ b/src/iosource/BPF_Program.h
@@ -5,7 +5,7 @@
 #include <cstdint>
 #include <string>
 
-#include "zeek/util.h"
+#include "zeek/util-types.h"
 
 extern "C" {
 #include <pcap.h>
diff --git a/src/packet_analysis/Component.h b/src/packet_analysis/Component.h
index 1d176939cb..0e9ec2a0e5 100644
--- a/src/packet_analysis/Component.h
+++ b/src/packet_analysis/Component.h
@@ -6,7 +6,6 @@
 
 #include "zeek/Tag.h"
 #include "zeek/plugin/Component.h"
-#include "zeek/util.h"
 
 namespace zeek::packet_analysis {
 
diff --git a/src/script_opt/ZAM/Frame.h b/src/script_opt/ZAM/Frame.h
index a2ea9e0a7b..35fd0edc21 100644
--- a/src/script_opt/ZAM/Frame.h
+++ b/src/script_opt/ZAM/Frame.h
@@ -8,7 +8,7 @@
 
 #include "zeek/Attr.h"
 #include "zeek/ID.h"
-#include "zeek/util.h"
+#include "zeek/util-types.h"
 
 namespace zeek::detail {
 
diff --git a/src/script_opt/ZAM/Support.h b/src/script_opt/ZAM/Support.h
index 2edec3de4a..b3b1236c78 100644
--- a/src/script_opt/ZAM/Support.h
+++ b/src/script_opt/ZAM/Support.h
@@ -9,11 +9,13 @@
 
 #pragma once
 
+#include <memory>
+#include <string>
 #include <vector>
 
 #include "zeek/IntrusivePtr.h"
 #include "zeek/script_opt/ZAM/Profile.h"
-#include "zeek/util.h"
+#include "zeek/util-types.h"
 
 namespace zeek {
 
diff --git a/src/spicy/runtime-support.h b/src/spicy/runtime-support.h
index 33af128296..3766e5b904 100644
--- a/src/spicy/runtime-support.h
+++ b/src/spicy/runtime-support.h
@@ -6,7 +6,6 @@
 
 #pragma once
 
-#include <limits>
 #include <optional>
 #include <ostream>
 #include <string>
diff --git a/src/spicy/spicyz/glue-compiler.h b/src/spicy/spicyz/glue-compiler.h
index 58e42909f3..95f56b2feb 100644
--- a/src/spicy/spicyz/glue-compiler.h
+++ b/src/spicy/spicyz/glue-compiler.h
@@ -6,7 +6,6 @@
 #include <memory>
 #include <set>
 #include <string>
-#include <tuple>
 #include <utility>
 #include <vector>
 
diff --git a/src/telemetry/MetricFamily.h b/src/telemetry/MetricFamily.h
index e10ac608e0..aa2c8da339 100644
--- a/src/telemetry/MetricFamily.h
+++ b/src/telemetry/MetricFamily.h
@@ -6,7 +6,7 @@
 #include <vector>
 
 #include "zeek/Span.h"
-#include "zeek/util.h"
+#include "zeek/util-types.h"
 
 namespace zeek::telemetry {
 
diff --git a/src/util-types.cc b/src/util-types.cc
new file mode 100644
index 0000000000..f67e4a9c4b
--- /dev/null
+++ b/src/util-types.cc
@@ -0,0 +1,78 @@
+// See the file "COPYING" in the main distribution directory for copyright.
+
+#include "zeek/util-types.h"
+
+#include "zeek/Reporter.h"
+
+#include "zeek/3rdparty/doctest.h"
+
+namespace zeek::util {
+
+namespace detail {
+
+void SafePathOp::CheckValid(const char* op_result, const char* path, bool error_aborts) {
+    if ( op_result ) {
+        result = op_result;
+        error = false;
+    }
+    else {
+        if ( error_aborts )
+            reporter->InternalError("Path operation failed on %s: %s", path ? path : "<null>", strerror(errno));
+        else
+            error = true;
+    }
+}
+
+
+TEST_CASE("util path ops") {
+#ifdef _MSC_VER
+// TODO: adapt these tests to Windows paths
+#else
+    SUBCASE("SafeDirname") {
+        SafeDirname d("/this/is/a/path", false);
+        CHECK(d.result == "/this/is/a");
+
+        SafeDirname d2("invalid", false);
+        CHECK(d2.result == ".");
+
+        SafeDirname d3("./filename", false);
+        CHECK(d2.result == ".");
+    }
+
+    SUBCASE("SafeBasename") {
+        SafeBasename b("/this/is/a/path", false);
+        CHECK(b.result == "path");
+        CHECK(! b.error);
+
+        SafeBasename b2("justafile", false);
+        CHECK(b2.result == "justafile");
+        CHECK(! b2.error);
+    }
+#endif
+}
+
+} // namespace detail
+
+SafeDirname::SafeDirname(const char* path, bool error_aborts) : SafePathOp() { DoFunc(path ? path : "", error_aborts); }
+
+SafeDirname::SafeDirname(const std::string& path, bool error_aborts) : SafePathOp() { DoFunc(path, error_aborts); }
+
+void SafeDirname::DoFunc(const std::string& path, bool error_aborts) {
+    char* tmp = copy_string(path.c_str());
+    CheckValid(dirname(tmp), tmp, error_aborts);
+    delete[] tmp;
+}
+
+SafeBasename::SafeBasename(const char* path, bool error_aborts) : SafePathOp() {
+    DoFunc(path ? path : "", error_aborts);
+}
+
+SafeBasename::SafeBasename(const std::string& path, bool error_aborts) : SafePathOp() { DoFunc(path, error_aborts); }
+
+void SafeBasename::DoFunc(const std::string& path, bool error_aborts) {
+    char* tmp = copy_string(path.c_str());
+    CheckValid(basename(tmp), tmp, error_aborts);
+    delete[] tmp;
+}
+
+} // namespace zeek::util
diff --git a/src/util-types.h b/src/util-types.h
new file mode 100644
index 0000000000..da66c2fb3c
--- /dev/null
+++ b/src/util-types.h
@@ -0,0 +1,66 @@
+// See the file "COPYING" in the main distribution directory for copyright.
+
+#pragma once
+
+#include <cstdint>
+#include <string>
+
+#include "zeek/3rdparty/nonstd/expected.hpp"
+#include "zeek/Span.h"
+
+// These two types are not namespaced intentionally.
+using zeek_int_t = int64_t;
+using zeek_uint_t = uint64_t;
+
+namespace zeek {
+
+// Type aliases for nonstd::expected/nonstd::unexpected. These should be switched to use
+// the std:: versions once we switch to C++20.
+template<typename T, typename E>
+using expected = nonstd::expected<T, E>;
+
+template<typename E>
+using unexpected = nonstd::unexpected<E>;
+
+// Byte buffer types used by serialization code in storage and cluster.
+using byte_buffer = std::vector<std::byte>;
+using byte_buffer_span = Span<const std::byte>;
+
+namespace util {
+namespace detail {
+
+/**
+ * Wrapper class for functions like dirname(3) or basename(3) that won't
+ * modify the path argument and may optionally abort execution on error.
+ */
+class SafePathOp {
+public:
+    std::string result;
+    bool error = false;
+
+protected:
+    void CheckValid(const char* result, const char* path, bool error_aborts);
+};
+
+} // namespace detail
+
+class SafeDirname : public detail::SafePathOp {
+public:
+    explicit SafeDirname(const char* path, bool error_aborts = true);
+    explicit SafeDirname(const std::string& path, bool error_aborts = true);
+
+private:
+    void DoFunc(const std::string& path, bool error_aborts = true);
+};
+
+class SafeBasename : public detail::SafePathOp {
+public:
+    explicit SafeBasename(const char* path, bool error_aborts = true);
+    explicit SafeBasename(const std::string& path, bool error_aborts = true);
+
+private:
+    void DoFunc(const std::string& path, bool error_aborts = true);
+};
+
+} // namespace util
+} // namespace zeek
diff --git a/src/util.cc b/src/util.cc
index 19551b6d60..2a59ea8a2a 100644
--- a/src/util.cc
+++ b/src/util.cc
@@ -531,19 +531,6 @@ FILE* open_package(string& path, const string& mode) {
     return nullptr;
 }
 
-void SafePathOp::CheckValid(const char* op_result, const char* path, bool error_aborts) {
-    if ( op_result ) {
-        result = op_result;
-        error = false;
-    }
-    else {
-        if ( error_aborts )
-            reporter->InternalError("Path operation failed on %s: %s", path ? path : "<null>", strerror(errno));
-        else
-            error = true;
-    }
-}
-
 TEST_CASE("util flatten_script_name") {
     CHECK(flatten_script_name("script", "some/path") == "some.path.script");
 #ifndef _MSC_VER
@@ -1647,55 +1634,6 @@ FILE* open_file(const string& path, const string& mode) {
     return rval;
 }
 
-TEST_CASE("util path ops") {
-#ifdef _MSC_VER
-// TODO: adapt these tests to Windows paths
-#else
-    SUBCASE("SafeDirname") {
-        SafeDirname d("/this/is/a/path", false);
-        CHECK(d.result == "/this/is/a");
-
-        SafeDirname d2("invalid", false);
-        CHECK(d2.result == ".");
-
-        SafeDirname d3("./filename", false);
-        CHECK(d2.result == ".");
-    }
-
-    SUBCASE("SafeBasename") {
-        SafeBasename b("/this/is/a/path", false);
-        CHECK(b.result == "path");
-        CHECK(! b.error);
-
-        SafeBasename b2("justafile", false);
-        CHECK(b2.result == "justafile");
-        CHECK(! b2.error);
-    }
-#endif
-}
-
-SafeDirname::SafeDirname(const char* path, bool error_aborts) : SafePathOp() { DoFunc(path ? path : "", error_aborts); }
-
-SafeDirname::SafeDirname(const string& path, bool error_aborts) : SafePathOp() { DoFunc(path, error_aborts); }
-
-void SafeDirname::DoFunc(const string& path, bool error_aborts) {
-    char* tmp = copy_string(path.c_str());
-    CheckValid(dirname(tmp), tmp, error_aborts);
-    delete[] tmp;
-}
-
-SafeBasename::SafeBasename(const char* path, bool error_aborts) : SafePathOp() {
-    DoFunc(path ? path : "", error_aborts);
-}
-
-SafeBasename::SafeBasename(const string& path, bool error_aborts) : SafePathOp() { DoFunc(path, error_aborts); }
-
-void SafeBasename::DoFunc(const string& path, bool error_aborts) {
-    char* tmp = copy_string(path.c_str());
-    CheckValid(basename(tmp), tmp, error_aborts);
-    delete[] tmp;
-}
-
 TEST_CASE("util implode_string_vector") {
     std::vector<std::string> v = {"a", "b", "c"};
     CHECK(implode_string_vector(v, ",") == "a,b,c");
diff --git a/src/util.h b/src/util.h
index 4f50d3474c..314f99bf37 100644
--- a/src/util.h
+++ b/src/util.h
@@ -92,19 +92,7 @@ namespace filesystem = ghc::filesystem;
 inline constexpr std::string_view path_list_separator = ":";
 #endif
 
-#include "zeek/3rdparty/nonstd/expected.hpp"
-namespace zeek {
-template<typename T, typename E>
-using expected = nonstd::expected<T, E>;
-
-template<typename E>
-using unexpected = nonstd::unexpected<E>;
-} // namespace zeek
-
-#include "zeek/Span.h"
-
-using zeek_int_t = int64_t;
-using zeek_uint_t = uint64_t;
+#include "zeek/util-types.h"
 
 #ifndef HAVE_STRCASESTR
 extern char* strcasestr(const char* s, const char* find);
@@ -118,10 +106,6 @@ namespace zeek {
 class ODesc;
 class RecordVal;
 
-// Byte buffer types used by serialization code in storage and cluster.
-using byte_buffer = std::vector<std::byte>;
-using byte_buffer_span = Span<const std::byte>;
-
 namespace util {
 namespace detail {
 
@@ -220,21 +204,6 @@ bool is_package_loader(const std::string& path);
 
 extern void add_to_zeek_path(const std::string& dir);
 
-/**
- * Wrapper class for functions like dirname(3) or basename(3) that won't
- * modify the path argument and may optionally abort execution on error.
- */
-class SafePathOp {
-public:
-    std::string result;
-    bool error;
-
-protected:
-    SafePathOp() : result(), error() {}
-
-    void CheckValid(const char* result, const char* path, bool error_aborts);
-};
-
 /**
  * Flatten a script name by replacing '/' path separators with '.'.
  * @param file A path to a Zeek script.  If it is a __load__.zeek, that part
@@ -398,24 +367,6 @@ extern const char* zeek_plugin_path();
 extern const char* zeek_plugin_activate();
 extern std::string zeek_prefixes();
 
-class SafeDirname : public detail::SafePathOp {
-public:
-    explicit SafeDirname(const char* path, bool error_aborts = true);
-    explicit SafeDirname(const std::string& path, bool error_aborts = true);
-
-private:
-    void DoFunc(const std::string& path, bool error_aborts = true);
-};
-
-class SafeBasename : public detail::SafePathOp {
-public:
-    explicit SafeBasename(const char* path, bool error_aborts = true);
-    explicit SafeBasename(const std::string& path, bool error_aborts = true);
-
-private:
-    void DoFunc(const std::string& path, bool error_aborts = true);
-};
-
 std::string implode_string_vector(const std::vector<std::string>& v, const std::string& delim = "\n");
 
 /**