diff --git a/src/CompHash.cc b/src/CompHash.cc
index 58d18a9da6..b13d013d25 100644
--- a/src/CompHash.cc
+++ b/src/CompHash.cc
@@ -15,6 +15,8 @@
 #include "Func.h"
 #include "IPAddr.h"
 
+namespace zeek::detail {
+
 CompositeHash::CompositeHash(zeek::TypeListPtr composite_type)
 	: type(std::move(composite_type))
 	{
@@ -212,7 +214,7 @@ char* CompositeHash::SingleValHash(bool type_check, char* kp0,
 			auto lv = zeek::make_intrusive<zeek::ListVal>(zeek::TYPE_ANY);
 
 			struct HashKeyComparer {
-				bool operator()(const HashKey* a, const HashKey* b) const
+				bool operator()(const zeek::detail::HashKey* a, const zeek::detail::HashKey* b) const
 					{
 					if ( a->Hash() != b->Hash() )
 						return a->Hash() < b->Hash();
@@ -224,8 +226,8 @@ char* CompositeHash::SingleValHash(bool type_check, char* kp0,
 					}
 			};
 
-			std::map<HashKey*, int, HashKeyComparer> hashkeys;
-			HashKey* k;
+			std::map<zeek::detail::HashKey*, int, HashKeyComparer> hashkeys;
+			zeek::detail::HashKey* k;
 			auto idx = 0;
 
 			while ( tbl->NextEntry(k, it) )
@@ -336,7 +338,7 @@ char* CompositeHash::SingleValHash(bool type_check, char* kp0,
 	}
 
 
-std::unique_ptr<HashKey> CompositeHash::MakeHashKey(const zeek::Val& argv, bool type_check) const
+std::unique_ptr<zeek::detail::HashKey> CompositeHash::MakeHashKey(const zeek::Val& argv, bool type_check) const
 	{
 	auto v = &argv;
 
@@ -385,10 +387,10 @@ std::unique_ptr<HashKey> CompositeHash::MakeHashKey(const zeek::Val& argv, bool
 			return nullptr;
 		}
 
-	return std::make_unique<HashKey>((k == key), (void*) k, kp - k);
+	return std::make_unique<zeek::detail::HashKey>((k == key), (void*) k, kp - k);
 	}
 
-std::unique_ptr<HashKey> CompositeHash::ComputeSingletonHash(const zeek::Val* v, bool type_check) const
+std::unique_ptr<zeek::detail::HashKey> CompositeHash::ComputeSingletonHash(const zeek::Val* v, bool type_check) const
 	{
 	if ( v->GetType()->Tag() == zeek::TYPE_LIST )
 		{
@@ -406,7 +408,7 @@ std::unique_ptr<HashKey> CompositeHash::ComputeSingletonHash(const zeek::Val* v,
 	switch ( singleton_tag ) {
 	case zeek::TYPE_INTERNAL_INT:
 	case zeek::TYPE_INTERNAL_UNSIGNED:
-		return std::make_unique<HashKey>(v->ForceAsInt());
+		return std::make_unique<zeek::detail::HashKey>(v->ForceAsInt());
 
 	case zeek::TYPE_INTERNAL_ADDR:
 		return v->AsAddr().MakeHashKey();
@@ -415,12 +417,12 @@ std::unique_ptr<HashKey> CompositeHash::ComputeSingletonHash(const zeek::Val* v,
 		return v->AsSubNet().MakeHashKey();
 
 	case zeek::TYPE_INTERNAL_DOUBLE:
-		return std::make_unique<HashKey>(v->InternalDouble());
+		return std::make_unique<zeek::detail::HashKey>(v->InternalDouble());
 
 	case zeek::TYPE_INTERNAL_VOID:
 	case zeek::TYPE_INTERNAL_OTHER:
 		if ( v->GetType()->Tag() == zeek::TYPE_FUNC )
-			return std::make_unique<HashKey>(v->AsFunc()->GetUniqueFuncID());
+			return std::make_unique<zeek::detail::HashKey>(v->AsFunc()->GetUniqueFuncID());
 
 		if ( v->GetType()->Tag() == zeek::TYPE_PATTERN )
 			{
@@ -432,14 +434,14 @@ std::unique_ptr<HashKey> CompositeHash::ComputeSingletonHash(const zeek::Val* v,
 			char* key = new char[n];
 			std::memcpy(key, texts[0], strlen(texts[0]) + 1);
 			std::memcpy(key + strlen(texts[0]) + 1, texts[1], strlen(texts[1]) + 1);
-			return std::make_unique<HashKey>(false, key, n);
+			return std::make_unique<zeek::detail::HashKey>(false, key, n);
 			}
 
 		zeek::reporter->InternalError("bad index type in CompositeHash::ComputeSingletonHash");
 		return nullptr;
 
 	case zeek::TYPE_INTERNAL_STRING:
-		return std::make_unique<HashKey>(v->AsString());
+		return std::make_unique<zeek::detail::HashKey>(v->AsString());
 
 	case zeek::TYPE_INTERNAL_ERROR:
 		return nullptr;
@@ -709,7 +711,7 @@ int CompositeHash::SizeAlign(int offset, unsigned int size) const
 	return offset;
 	}
 
-zeek::ListValPtr CompositeHash::RecoverVals(const HashKey& k) const
+zeek::ListValPtr CompositeHash::RecoverVals(const zeek::detail::HashKey& k) const
 	{
 	auto l = zeek::make_intrusive<zeek::ListVal>(zeek::TYPE_ANY);
 	const auto& tl = type->GetTypes();
@@ -731,7 +733,7 @@ zeek::ListValPtr CompositeHash::RecoverVals(const HashKey& k) const
 	}
 
 const char* CompositeHash::RecoverOneVal(
-	const HashKey& k, const char* kp0,
+	const zeek::detail::HashKey& k, const char* kp0,
 	const char* const k_end, zeek::Type* t,
 	zeek::ValPtr* pval, bool optional) const
 	{
@@ -1058,3 +1060,5 @@ const char* CompositeHash::RecoverOneVal(
 
 	return kp1;
 	}
+
+} // namespace zeek::detail
diff --git a/src/CompHash.h b/src/CompHash.h
index a779c6bf2c..b46fff9bf1 100644
--- a/src/CompHash.h
+++ b/src/CompHash.h
@@ -8,12 +8,14 @@
 #include "IntrusivePtr.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(ListVal, zeek);
-class HashKey;
+ZEEK_FORWARD_DECLARE_NAMESPACED(HashKey, zeek::detail);
 
 namespace zeek {
 using ListValPtr = zeek::IntrusivePtr<ListVal>;
 }
 
+namespace zeek::detail {
+
 class CompositeHash {
 public:
 	explicit CompositeHash(zeek::TypeListPtr composite_type);
@@ -21,23 +23,23 @@ public:
 
 	// Compute the hash corresponding to the given index val,
 	// or nullptr if it fails to typecheck.
-	std::unique_ptr<HashKey> MakeHashKey(const zeek::Val& v, bool type_check) const;
+	std::unique_ptr<zeek::detail::HashKey> MakeHashKey(const zeek::Val& v, bool type_check) const;
 
 	[[deprecated("Remove in v4.1.  Use MakeHashKey().")]]
-	HashKey* ComputeHash(const zeek::Val* v, bool type_check) const
+	zeek::detail::HashKey* ComputeHash(const zeek::Val* v, bool type_check) const
 		{ return MakeHashKey(*v, type_check).release(); }
 
 	// Given a hash key, recover the values used to create it.
-	zeek::ListValPtr RecoverVals(const HashKey& k) const;
+	zeek::ListValPtr RecoverVals(const zeek::detail::HashKey& k) const;
 
-	[[deprecated("Remove in v4.1.  Pass in HashKey& instead.")]]
-	zeek::ListValPtr RecoverVals(const HashKey* k) const
+	[[deprecated("Remove in v4.1.  Pass in zeek::detail::HashKey& instead.")]]
+	zeek::ListValPtr RecoverVals(const zeek::detail::HashKey* k) const
 		{ return RecoverVals(*k); }
 
 	unsigned int MemoryAllocation() const { return padded_sizeof(*this) + pad_size(size); }
 
 protected:
-	std::unique_ptr<HashKey> ComputeSingletonHash(const zeek::Val* v, bool type_check) const;
+	std::unique_ptr<zeek::detail::HashKey> ComputeSingletonHash(const zeek::Val* v, bool type_check) const;
 
 	// Computes the piece of the hash for Val*, returning the new kp.
 	// Used as a helper for ComputeHash in the non-singleton case.
@@ -49,7 +51,7 @@ protected:
 	// Returns and updated kp for the next Val.  Calls reporter->InternalError()
 	// upon errors, so there is no return value for invalid input.
 	const char* RecoverOneVal(
-		const HashKey& k, const char* kp, const char* const k_end,
+		const zeek::detail::HashKey& k, const char* kp, const char* const k_end,
 		zeek::Type* t, zeek::ValPtr* pval, bool optional) const;
 
 	// Rounds the given pointer up to the nearest multiple of the
@@ -103,3 +105,7 @@ protected:
 
 	zeek::InternalTypeTag singleton_tag;
 };
+
+} // namespace zeek::detail
+
+using CompositeHash [[deprecated("Remove in v4.1. Use zeek::detail::CompositeHash.")]] = zeek::detail::CompositeHash;
diff --git a/src/Dict.cc b/src/Dict.cc
index 4019563e81..441aab467e 100644
--- a/src/Dict.cc
+++ b/src/Dict.cc
@@ -28,7 +28,7 @@ namespace detail {
 
 class DictEntry {
 public:
-	DictEntry(void* k, int l, hash_t h, void* val) : key(k), len(l), hash(h), value(val) {}
+	DictEntry(void* k, int l, zeek::detail::hash_t h, void* val) : key(k), len(l), hash(h), value(val) {}
 
 	~DictEntry()
 		{
@@ -37,7 +37,7 @@ public:
 
 	void* key;
 	int len;
-	hash_t hash;
+	zeek::detail::hash_t hash;
 	void* value;
 };
 
@@ -77,11 +77,11 @@ TEST_CASE("dict operation")
 	uint32_t val = 10;
 	uint32_t key_val = 5;
 
-	HashKey* key = new HashKey(key_val);
+	zeek::detail::HashKey* key = new zeek::detail::HashKey(key_val);
 	dict.Insert(key, &val);
 	CHECK(dict.Length() == 1);
 
-	HashKey* key2 = new HashKey(key_val);
+	zeek::detail::HashKey* key2 = new zeek::detail::HashKey(key_val);
 	uint32_t* lookup = dict.Lookup(key2);
 	CHECK(*lookup == val);
 
@@ -102,7 +102,7 @@ TEST_CASE("dict operation")
 
 	uint32_t val2 = 15;
 	uint32_t key_val2 = 25;
-	key2 = new HashKey(key_val2);
+	key2 = new zeek::detail::HashKey(key_val2);
 
 	dict.Insert(key, &val);
 	dict.Insert(key2, &val2);
@@ -123,13 +123,13 @@ TEST_CASE("dict nthentry")
 
 	uint32_t val = 15;
 	uint32_t key_val = 5;
-	HashKey* okey = new HashKey(key_val);
-	HashKey* ukey = new HashKey(key_val);
+	zeek::detail::HashKey* okey = new zeek::detail::HashKey(key_val);
+	zeek::detail::HashKey* ukey = new zeek::detail::HashKey(key_val);
 
 	uint32_t val2 = 10;
 	uint32_t key_val2 = 25;
-	HashKey* okey2 = new HashKey(key_val2);
-	HashKey* ukey2 = new HashKey(key_val2);
+	zeek::detail::HashKey* okey2 = new zeek::detail::HashKey(key_val2);
+	zeek::detail::HashKey* ukey2 = new zeek::detail::HashKey(key_val2);
 
 	unordered.Insert(ukey, &val);
 	unordered.Insert(ukey2, &val2);
@@ -158,16 +158,16 @@ TEST_CASE("dict iteration")
 
 	uint32_t val = 15;
 	uint32_t key_val = 5;
-	HashKey* key = new HashKey(key_val);
+	zeek::detail::HashKey* key = new zeek::detail::HashKey(key_val);
 
 	uint32_t val2 = 10;
 	uint32_t key_val2 = 25;
-	HashKey* key2 = new HashKey(key_val2);
+	zeek::detail::HashKey* key2 = new zeek::detail::HashKey(key_val2);
 
 	dict.Insert(key, &val);
 	dict.Insert(key2, &val2);
 
-	HashKey* it_key;
+	zeek::detail::HashKey* it_key;
 	zeek::IterCookie* it = dict.InitForIteration();
 	CHECK(it != nullptr);
 	int count = 0;
@@ -264,12 +264,12 @@ void Dictionary::DeInit()
 	tbl2 = nullptr;
 	}
 
-void* Dictionary::Lookup(const void* key, int key_size, hash_t hash) const
+void* Dictionary::Lookup(const void* key, int key_size, zeek::detail::hash_t hash) const
 	{
 	if ( ! tbl && ! tbl2 )
 		return nullptr;
 
-	hash_t h;
+	zeek::detail::hash_t h;
 	zeek::PList<detail::DictEntry>* chain;
 
 	// Figure out which hash table to look in.
@@ -292,7 +292,7 @@ void* Dictionary::Lookup(const void* key, int key_size, hash_t hash) const
 	return nullptr;
 	}
 
-void* Dictionary::Insert(void* key, int key_size, hash_t hash, void* val,
+void* Dictionary::Insert(void* key, int key_size, zeek::detail::hash_t hash, void* val,
 				bool copy_key)
 	{
 	if ( ! tbl )
@@ -319,13 +319,13 @@ void* Dictionary::Insert(void* key, int key_size, hash_t hash, void* val,
 	return old_val;
 	}
 
-void* Dictionary::Remove(const void* key, int key_size, hash_t hash,
+void* Dictionary::Remove(const void* key, int key_size, zeek::detail::hash_t hash,
 				bool dont_delete)
 	{
 	if ( ! tbl && ! tbl2 )
 		return nullptr;
 
-	hash_t h;
+	zeek::detail::hash_t h;
 	zeek::PList<detail::DictEntry>* chain;
 	int* num_entries_ptr;
 
@@ -368,7 +368,7 @@ void* Dictionary::Remove(const void* key, int key_size, hash_t hash,
 	return nullptr;
 	}
 
-void* Dictionary::DoRemove(detail::DictEntry* entry, hash_t h,
+void* Dictionary::DoRemove(detail::DictEntry* entry, zeek::detail::hash_t h,
 				zeek::PList<detail::DictEntry>* chain, int chain_offset)
 	{
 	void* entry_value = entry->value;
@@ -424,7 +424,7 @@ void Dictionary::StopIteration(IterCookie* cookie) const
 	delete cookie;
 	}
 
-void* Dictionary::NextEntry(HashKey*& h, IterCookie*& cookie, int return_hash) const
+void* Dictionary::NextEntry(zeek::detail::HashKey*& h, IterCookie*& cookie, int return_hash) const
 	{
 	if ( ! tbl && ! tbl2 )
 		{
@@ -446,7 +446,7 @@ void* Dictionary::NextEntry(HashKey*& h, IterCookie*& cookie, int return_hash) c
 		// and removing from the tail is cheaper.
 		entry = cookie->inserted.remove_nth(cookie->inserted.length()-1);
 		if ( return_hash )
-			h = new HashKey(entry->key, entry->len, entry->hash);
+			h = new zeek::detail::HashKey(entry->key, entry->len, entry->hash);
 
 		return entry->value;
 		}
@@ -471,7 +471,7 @@ void* Dictionary::NextEntry(HashKey*& h, IterCookie*& cookie, int return_hash) c
 		entry = (*ttbl[b])[o];
 		++cookie->offset;
 		if ( return_hash )
-			h = new HashKey(entry->key, entry->len, entry->hash);
+			h = new zeek::detail::HashKey(entry->key, entry->len, entry->hash);
 		return entry->value;
 		}
 
@@ -503,7 +503,7 @@ void* Dictionary::NextEntry(HashKey*& h, IterCookie*& cookie, int return_hash) c
 
 	entry = (*ttbl[b])[0];
 	if ( return_hash )
-		h = new HashKey(entry->key, entry->len, entry->hash);
+		h = new zeek::detail::HashKey(entry->key, entry->len, entry->hash);
 
 	cookie->bucket = b;
 	cookie->offset = 1;
@@ -543,7 +543,7 @@ void* Dictionary::Insert(detail::DictEntry* new_entry, bool copy_key)
 	zeek::PList<detail::DictEntry>** ttbl;
 	int* num_entries_ptr;
 	int* max_num_entries_ptr;
-	hash_t h = new_entry->hash % num_buckets;
+	zeek::detail::hash_t h = new_entry->hash % num_buckets;
 
 	// We must be careful when we are in the middle of resizing.
 	// If the new entry hashes to a bucket in the old table we
diff --git a/src/Dict.h b/src/Dict.h
index 3210605944..b1e049a318 100644
--- a/src/Dict.h
+++ b/src/Dict.h
@@ -33,27 +33,27 @@ public:
 	// contents, and deleting it.  These come in two flavors: one
 	// which takes a HashKey, and the other which takes a raw key,
 	// its size, and its (unmodulated) hash.
-	void* Lookup(const HashKey* key) const
+	void* Lookup(const zeek::detail::HashKey* key) const
 		{ return Lookup(key->Key(), key->Size(), key->Hash()); }
-	void* Lookup(const void* key, int key_size, hash_t hash) const;
+	void* Lookup(const void* key, int key_size, zeek::detail::hash_t hash) const;
 
 	// Returns previous value, or 0 if none.
-	void* Insert(HashKey* key, void* val)
+	void* Insert(zeek::detail::HashKey* key, void* val)
 		{
 		return Insert(key->TakeKey(), key->Size(), key->Hash(), val, 0);
 		}
 	// If copy_key is true, then the key is copied, otherwise it's assumed
 	// that it's a heap pointer that now belongs to the Dictionary to
 	// manage as needed.
-	void* Insert(void* key, int key_size, hash_t hash, void* val,
+	void* Insert(void* key, int key_size, zeek::detail::hash_t hash, void* val,
 			bool copy_key);
 
 	// Removes the given element.  Returns a pointer to the element in
 	// case it needs to be deleted.  Returns 0 if no such element exists.
 	// If dontdelete is true, the key's bytes will not be deleted.
-	void* Remove(const HashKey* key)
+	void* Remove(const zeek::detail::HashKey* key)
 		{ return Remove(key->Key(), key->Size(), key->Hash()); }
-	void* Remove(const void* key, int key_size, hash_t hash,
+	void* Remove(const void* key, int key_size, zeek::detail::hash_t hash,
 				bool dont_delete = false);
 
 	// Number of entries.
@@ -104,7 +104,7 @@ public:
 	// If return_hash is true, a HashKey for the entry is returned in h,
 	// which should be delete'd when no longer needed.
 	IterCookie* InitForIteration() const;
-	void* NextEntry(HashKey*& h, IterCookie*& cookie, int return_hash) const;
+	void* NextEntry(zeek::detail::HashKey*& h, IterCookie*& cookie, int return_hash) const;
 	void StopIteration(IterCookie* cookie) const;
 
 	void SetDeleteFunc(dict_delete_func f)		{ delete_func = f; }
@@ -131,7 +131,7 @@ private:
 	// Internal version of Insert().
 	void* Insert(zeek::detail::DictEntry* entry, bool copy_key);
 
-	void* DoRemove(zeek::detail::DictEntry* entry, hash_t h,
+	void* DoRemove(zeek::detail::DictEntry* entry, zeek::detail::hash_t h,
 	               zeek::PList<zeek::detail::DictEntry>* chain, int chain_offset);
 
 	int NextPrime(int n) const;
@@ -179,7 +179,7 @@ private:
 	int thresh_entries2 = 0;
 	double den_thresh2 = 0;
 
-	hash_t tbl_next_ind = 0;
+	zeek::detail::hash_t tbl_next_ind = 0;
 
 	zeek::PList<zeek::detail::DictEntry>* order = nullptr;
 	dict_delete_func delete_func = nullptr;
@@ -194,17 +194,17 @@ public:
 		Dictionary(ordering, initial_size) {}
 	T* Lookup(const char* key) const
 		{
-		HashKey h(key);
+		zeek::detail::HashKey h(key);
 		return (T*) Dictionary::Lookup(&h);
 		}
-	T* Lookup(const HashKey* key) const
+	T* Lookup(const zeek::detail::HashKey* key) const
 		{ return (T*) Dictionary::Lookup(key); }
 	T* Insert(const char* key, T* val)
 		{
-		HashKey h(key);
+		zeek::detail::HashKey h(key);
 		return (T*) Dictionary::Insert(&h, (void*) val);
 		}
-	T* Insert(HashKey* key, T* val)
+	T* Insert(zeek::detail::HashKey* key, T* val)
 		{ return (T*) Dictionary::Insert(key, (void*) val); }
 	T* NthEntry(int n) const
 		{ return (T*) Dictionary::NthEntry(n); }
@@ -215,14 +215,14 @@ public:
 		}
 	T* NextEntry(IterCookie*& cookie) const
 		{
-		HashKey* h;
+		zeek::detail::HashKey* h;
 		return (T*) Dictionary::NextEntry(h, cookie, 0);
 		}
-	T* NextEntry(HashKey*& h, IterCookie*& cookie) const
+	T* NextEntry(zeek::detail::HashKey*& h, IterCookie*& cookie) const
 		{ return (T*) Dictionary::NextEntry(h, cookie, 1); }
-	T* RemoveEntry(const HashKey* key)
+	T* RemoveEntry(const zeek::detail::HashKey* key)
 		{ return (T*) Remove(key->Key(), key->Size(), key->Hash()); }
-	T* RemoveEntry(const HashKey& key)
+	T* RemoveEntry(const zeek::detail::HashKey& key)
 		{ return (T*) Remove(key.Key(), key.Size(), key.Hash()); }
 };
 
diff --git a/src/Frag.h b/src/Frag.h
index 3ece8632b3..7b324395ff 100644
--- a/src/Frag.h
+++ b/src/Frag.h
@@ -11,7 +11,6 @@
 
 #include <sys/types.h> // for u_char
 
-class HashKey;
 class NetSessions;
 ZEEK_FORWARD_DECLARE_NAMESPACED(IP_Hdr, zeek);
 
diff --git a/src/Hash.cc b/src/Hash.cc
index 35eee50f28..58541ef56d 100644
--- a/src/Hash.cc
+++ b/src/Hash.cc
@@ -13,6 +13,8 @@
 #include "highwayhash/highwayhash_target.h"
 #include "highwayhash/instruction_sets.h"
 
+namespace zeek::detail {
+
 alignas(32) uint64_t KeyedHash::shared_highwayhash_key[4];
 alignas(32) uint64_t KeyedHash::cluster_highwayhash_key[4];
 alignas(16) unsigned long long KeyedHash::shared_siphash_key[2];
@@ -214,3 +216,5 @@ hash_t HashKey::HashBytes(const void* bytes, int size)
 	{
 	return KeyedHash::Hash64(bytes, size);
 	}
+
+} // namespace zeek::detail
diff --git a/src/Hash.h b/src/Hash.h
index 3456eb0573..16c0e60b8a 100644
--- a/src/Hash.h
+++ b/src/Hash.h
@@ -36,6 +36,8 @@ namespace zeek::BifFunc {
 	extern BifReturnVal md5_hmac_bif(zeek::detail::Frame* frame, const zeek::Args*);
 }
 
+namespace zeek::detail {
+
 typedef uint64_t hash_t;
 typedef uint64_t hash64_t;
 typedef uint64_t hash128_t[2];
@@ -197,7 +199,7 @@ private:
 	inline static uint8_t shared_hmac_md5_key[16];
 	inline static bool seeds_initialized = false;
 
-	friend void hmac_md5(size_t size, const unsigned char* bytes, unsigned char digest[16]);
+	friend void ::hmac_md5(size_t size, const unsigned char* bytes, unsigned char digest[16]);
 	friend BifReturnVal zeek::BifFunc::md5_hmac_bif(zeek::detail::Frame* frame, const zeek::Args*);
 };
 
@@ -205,7 +207,7 @@ typedef enum {
 	HASH_KEY_INT,
 	HASH_KEY_DOUBLE,
 	HASH_KEY_STRING
-#define NUM_HASH_KEYS (int(HASH_KEY_STRING) + 1)
+#define NUM_HASH_KEYS (int(zeek::detail::HASH_KEY_STRING) + 1)
 } HashKeyTag;
 
 class HashKey {
@@ -276,3 +278,20 @@ protected:
 };
 
 extern void init_hash_function();
+
+} // namespace zeek::detail
+
+using hash_t [[deprecated("Remove in v4.1. Use zeek::detail::hash_t.")]] = zeek::detail::hash_t;
+using hash64_t [[deprecated("Remove in v4.1. Use zeek::detail::hash64_t.")]] = zeek::detail::hash64_t;
+using hash128_t [[deprecated("Remove in v4.1. Use zeek::detail::hash128_t.")]] = zeek::detail::hash128_t;
+using hash256_t [[deprecated("Remove in v4.1. Use zeek::detail::hash256_t.")]] = zeek::detail::hash256_t;
+
+using KeyedHash [[deprecated("Remove in v4.1. Use zeek::detail::KeyedHash.")]] = zeek::detail::KeyedHash;
+using HashKeyTag [[deprecated("Remove in v4.1. Use zeek::detail::HashKeyTag.")]] = zeek::detail::HashKeyTag;
+using HashKey [[deprecated("Remove in v4.1. Use zeek::detail::HashKey.")]] = zeek::detail::HashKey;
+
+constexpr auto HASH_KEY_INT [[deprecated("Remove in v4.1. Use zeek::detail::HASH_KEY_INT.")]] = zeek::detail::HASH_KEY_INT;
+constexpr auto HASH_KEY_DOUBLE [[deprecated("Remove in v4.1. Use zeek::detail::HASH_KEY_DOUBLE.")]] = zeek::detail::HASH_KEY_DOUBLE;
+constexpr auto HASH_KEY_STRING [[deprecated("Remove in v4.1. Use zeek::detail::HASH_KEY_STRING.")]] = zeek::detail::HASH_KEY_STRING;
+
+constexpr auto init_hash_function [[deprecated("Remove in v4.1. Use zeek::detail::init_hash_function.")]] = zeek::detail::init_hash_function;
diff --git a/src/IPAddr.cc b/src/IPAddr.cc
index 2232f6a468..4bc73a7ab2 100644
--- a/src/IPAddr.cc
+++ b/src/IPAddr.cc
@@ -54,12 +54,12 @@ IPAddr::IPAddr(const zeek::String& s)
 	Init(s.CheckString());
 	}
 
-HashKey* IPAddr::GetHashKey() const
+zeek::detail::HashKey* IPAddr::GetHashKey() const
 	{ return MakeHashKey().release(); }
 
-std::unique_ptr<HashKey> IPAddr::MakeHashKey() const
+std::unique_ptr<zeek::detail::HashKey> IPAddr::MakeHashKey() const
 	{
-	return std::make_unique<HashKey>((void*)in6.s6_addr, sizeof(in6.s6_addr));
+	return std::make_unique<zeek::detail::HashKey>((void*)in6.s6_addr, sizeof(in6.s6_addr));
 	}
 
 static inline uint32_t bit_mask32(int bottom_bits)
@@ -307,10 +307,10 @@ std::string IPPrefix::AsString() const
 	return prefix.AsString() +"/" + l;
 	}
 
-HashKey* IPPrefix::GetHashKey() const
+zeek::detail::HashKey* IPPrefix::GetHashKey() const
 	{ return MakeHashKey().release(); }
 
-std::unique_ptr<HashKey> IPPrefix::MakeHashKey() const
+std::unique_ptr<zeek::detail::HashKey> IPPrefix::MakeHashKey() const
 	{
 	struct {
 		in6_addr ip;
@@ -320,7 +320,7 @@ std::unique_ptr<HashKey> IPPrefix::MakeHashKey() const
 	key.ip = prefix.in6;
 	key.len = Length();
 
-	return std::make_unique<HashKey>(&key, sizeof(key));
+	return std::make_unique<zeek::detail::HashKey>(&key, sizeof(key));
 	}
 
 bool IPPrefix::ConvertString(const char* text, IPPrefix* result)
diff --git a/src/IPAddr.h b/src/IPAddr.h
index bfcac4aa01..80aa879cf4 100644
--- a/src/IPAddr.h
+++ b/src/IPAddr.h
@@ -14,7 +14,7 @@ namespace zeek { class String; }
 using BroString [[deprecated("Remove in v4.1. Use zeek::String instead.")]] = zeek::String;
 
 struct ConnID;
-class HashKey;
+ZEEK_FORWARD_DECLARE_NAMESPACED(HashKey, zeek::detail);
 namespace analyzer { class ExpectedConn; }
 
 typedef in_addr in4_addr;
@@ -260,10 +260,10 @@ public:
 	/**
 	 * Returns a key that can be used to lookup the IP Address in a hash table.
 	 */
-	std::unique_ptr<HashKey> MakeHashKey() const;
+	std::unique_ptr<zeek::detail::HashKey> MakeHashKey() const;
 
 	[[deprecated("Remove in v4.1.  Use MakeHashKey().")]]
-	HashKey* GetHashKey() const;
+	zeek::detail::HashKey* GetHashKey() const;
 
 	/**
 	 * Masks out lower bits of the address.
@@ -639,10 +639,10 @@ public:
 	/**
 	 * Returns a key that can be used to lookup the IP Prefix in a hash table.
 	 */
-	std::unique_ptr<HashKey> MakeHashKey() const;
+	std::unique_ptr<zeek::detail::HashKey> MakeHashKey() const;
 
 	[[deprecated("Remove in v4.1.  Use MakeHashKey().")]]
-	HashKey* GetHashKey() const;
+	zeek::detail::HashKey* GetHashKey() const;
 
 	/** Converts the prefix into the type used internally by the
 	  * inter-thread communication.
diff --git a/src/OpaqueVal.cc b/src/OpaqueVal.cc
index c30478f600..5f141fe92a 100644
--- a/src/OpaqueVal.cc
+++ b/src/OpaqueVal.cc
@@ -231,13 +231,13 @@ void HashVal::digest_one(EVP_MD_CTX* h, const Val* v)
 	if ( v->GetType()->Tag() == zeek::TYPE_STRING )
 		{
 		const String* str = v->AsString();
-		hash_update(h, str->Bytes(), str->Len());
+		zeek::detail::hash_update(h, str->Bytes(), str->Len());
 		}
 	else
 		{
 		ODesc d(DESC_BINARY);
 		v->Describe(&d);
-		hash_update(h, (const u_char *) d.Bytes(), d.Len());
+		zeek::detail::hash_update(h, (const u_char *) d.Bytes(), d.Len());
 		}
 	}
 
@@ -264,7 +264,7 @@ ValPtr MD5Val::DoClone(CloneState* state)
 bool MD5Val::DoInit()
 	{
 	assert(! IsValid());
-	ctx = hash_init(Hash_MD5);
+	ctx = zeek::detail::hash_init(zeek::detail::Hash_MD5);
 	return true;
 	}
 
@@ -273,7 +273,7 @@ bool MD5Val::DoFeed(const void* data, size_t size)
 	if ( ! IsValid() )
 		return false;
 
-	hash_update(ctx, data, size);
+	zeek::detail::hash_update(ctx, data, size);
 	return true;
 	}
 
@@ -283,8 +283,8 @@ StringValPtr MD5Val::DoGet()
 		return zeek::val_mgr->EmptyString();
 
 	u_char digest[MD5_DIGEST_LENGTH];
-	hash_final(ctx, digest);
-	return zeek::make_intrusive<StringVal>(md5_digest_print(digest));
+	zeek::detail::hash_final(ctx, digest);
+	return zeek::make_intrusive<StringVal>(zeek::detail::md5_digest_print(digest));
 	}
 
 IMPLEMENT_OPAQUE_VALUE(MD5Val)
@@ -384,7 +384,7 @@ ValPtr SHA1Val::DoClone(CloneState* state)
 bool SHA1Val::DoInit()
 	{
 	assert(! IsValid());
-	ctx = hash_init(Hash_SHA1);
+	ctx = zeek::detail::hash_init(zeek::detail::Hash_SHA1);
 	return true;
 	}
 
@@ -393,7 +393,7 @@ bool SHA1Val::DoFeed(const void* data, size_t size)
 	if ( ! IsValid() )
 		return false;
 
-	hash_update(ctx, data, size);
+	zeek::detail::hash_update(ctx, data, size);
 	return true;
 	}
 
@@ -403,8 +403,8 @@ StringValPtr SHA1Val::DoGet()
 		return zeek::val_mgr->EmptyString();
 
 	u_char digest[SHA_DIGEST_LENGTH];
-	hash_final(ctx, digest);
-	return zeek::make_intrusive<StringVal>(sha1_digest_print(digest));
+	zeek::detail::hash_final(ctx, digest);
+	return zeek::make_intrusive<StringVal>(zeek::detail::sha1_digest_print(digest));
 	}
 
 IMPLEMENT_OPAQUE_VALUE(SHA1Val)
@@ -507,7 +507,7 @@ ValPtr SHA256Val::DoClone(CloneState* state)
 bool SHA256Val::DoInit()
 	{
 	assert( ! IsValid() );
-	ctx = hash_init(Hash_SHA256);
+	ctx = zeek::detail::hash_init(zeek::detail::Hash_SHA256);
 	return true;
 	}
 
@@ -516,7 +516,7 @@ bool SHA256Val::DoFeed(const void* data, size_t size)
 	if ( ! IsValid() )
 		return false;
 
-	hash_update(ctx, data, size);
+	zeek::detail::hash_update(ctx, data, size);
 	return true;
 	}
 
@@ -526,8 +526,8 @@ StringValPtr SHA256Val::DoGet()
 		return zeek::val_mgr->EmptyString();
 
 	u_char digest[SHA256_DIGEST_LENGTH];
-	hash_final(ctx, digest);
-	return zeek::make_intrusive<StringVal>(sha256_digest_print(digest));
+	zeek::detail::hash_final(ctx, digest);
+	return zeek::make_intrusive<StringVal>(zeek::detail::sha256_digest_print(digest));
 	}
 
 IMPLEMENT_OPAQUE_VALUE(SHA256Val)
@@ -734,7 +734,7 @@ bool BloomFilterVal::Typify(zeek::TypePtr arg_type)
 
 	auto tl = zeek::make_intrusive<zeek::TypeList>(type);
 	tl->Append(type);
-	hash = new CompositeHash(std::move(tl));
+	hash = new zeek::detail::CompositeHash(std::move(tl));
 
 	return true;
 	}
@@ -893,7 +893,7 @@ bool CardinalityVal::Typify(zeek::TypePtr arg_type)
 
 	auto tl = zeek::make_intrusive<zeek::TypeList>(type);
 	tl->Append(type);
-	hash = new CompositeHash(std::move(tl));
+	hash = new zeek::detail::CompositeHash(std::move(tl));
 
 	return true;
 	}
diff --git a/src/OpaqueVal.h b/src/OpaqueVal.h
index edfa7b6714..12d3ce2482 100644
--- a/src/OpaqueVal.h
+++ b/src/OpaqueVal.h
@@ -172,14 +172,14 @@ protected:
 class HashVal : public OpaqueVal {
 public:
 	template <class T>
-	static void digest_all(HashAlgorithm alg, const T& vlist, u_char* result)
+	static void digest_all(zeek::detail::HashAlgorithm alg, const T& vlist, u_char* result)
 		{
-		auto h = hash_init(alg);
+		auto h = zeek::detail::hash_init(alg);
 
 		for ( const auto& v : vlist )
 			digest_one(h, v);
 
-		hash_final(h, result);
+		zeek::detail::hash_final(h, result);
 		}
 
 	bool IsValid() const;
@@ -210,7 +210,7 @@ class MD5Val : public HashVal {
 public:
 	template <class T>
 	static void digest(const T& vlist, u_char result[MD5_DIGEST_LENGTH])
-		{ digest_all(Hash_MD5, vlist, result); }
+		{ digest_all(zeek::detail::Hash_MD5, vlist, result); }
 
 	template <class T>
 	static void hmac(const T& vlist,
@@ -222,7 +222,7 @@ public:
 		for ( int i = 0; i < MD5_DIGEST_LENGTH; ++i )
 			result[i] ^= key[i];
 
-		internal_md5(result, MD5_DIGEST_LENGTH, result);
+		zeek::detail::internal_md5(result, MD5_DIGEST_LENGTH, result);
 		}
 
 	MD5Val();
@@ -246,7 +246,7 @@ class SHA1Val : public HashVal {
 public:
 	template <class T>
 	static void digest(const T& vlist, u_char result[SHA_DIGEST_LENGTH])
-		{ digest_all(Hash_SHA1, vlist, result); }
+		{ digest_all(zeek::detail::Hash_SHA1, vlist, result); }
 
 	SHA1Val();
 	~SHA1Val();
@@ -269,7 +269,7 @@ class SHA256Val : public HashVal {
 public:
 	template <class T>
 	static void digest(const T& vlist, u_char result[SHA256_DIGEST_LENGTH])
-		{ digest_all(Hash_SHA256, vlist, result); }
+		{ digest_all(zeek::detail::Hash_SHA256, vlist, result); }
 
 	SHA256Val();
 	~SHA256Val();
@@ -336,7 +336,7 @@ private:
 	BloomFilterVal& operator=(const BloomFilterVal&);
 
 	zeek::TypePtr type;
-	CompositeHash* hash;
+	zeek::detail::CompositeHash* hash;
 	probabilistic::BloomFilter* bloom_filter;
 };
 
@@ -363,7 +363,7 @@ protected:
 	DECLARE_OPAQUE_VALUE(CardinalityVal)
 private:
 	zeek::TypePtr type;
-	CompositeHash* hash;
+	zeek::detail::CompositeHash* hash;
 	probabilistic::CardinalityCounter* c;
 };
 
diff --git a/src/Reporter.cc b/src/Reporter.cc
index 7802acb031..7e2ce20c2b 100644
--- a/src/Reporter.cc
+++ b/src/Reporter.cc
@@ -75,7 +75,7 @@ void Reporter::InitOptions()
 	auto wl_val = zeek::id::find_val("Weird::sampling_whitelist")->AsTableVal();
 	auto wl_table = wl_val->AsTable();
 
-	HashKey* k;
+	zeek::detail::HashKey* k;
 	zeek::IterCookie* c = wl_table->InitForIteration();
 	zeek::TableEntryVal* v;
 
diff --git a/src/Stmt.h b/src/Stmt.h
index f2886846c6..b784b995e4 100644
--- a/src/Stmt.h
+++ b/src/Stmt.h
@@ -13,8 +13,7 @@
 
 #include "TraverseTypes.h"
 
-class CompositeHash;
-
+ZEEK_FORWARD_DECLARE_NAMESPACED(CompositeHash, zeek::detail);
 ZEEK_FORWARD_DECLARE_NAMESPACED(Frame, zeek::detail);
 
 namespace zeek::detail {
diff --git a/src/Val.cc b/src/Val.cc
index 020cf70fa5..ac04f7f3cd 100644
--- a/src/Val.cc
+++ b/src/Val.cc
@@ -575,7 +575,7 @@ static void BuildJSON(threading::formatter::JSON::NullDoubleWriter& writer, Val*
 			else
 				writer.StartObject();
 
-			HashKey* k;
+			zeek::detail::HashKey* k;
 			TableEntryVal* entry;
 			auto c = table->InitForIteration();
 			while ( (entry = table->NextEntry(k, c)) )
@@ -1444,7 +1444,7 @@ void TableVal::Init(TableTypePtr t)
 	else
 		subnets = nullptr;
 
-	table_hash = new CompositeHash(table_type->GetIndices());
+	table_hash = new zeek::detail::CompositeHash(table_type->GetIndices());
 	val.table_val = new PDict<zeek::TableEntryVal>;
 	val.table_val->SetDeleteFunc(table_entry_val_delete_func);
 	}
@@ -1569,7 +1569,7 @@ bool TableVal::Assign(Val* index, Val* new_val)
 	return Assign({NewRef{}, index}, {AdoptRef{}, new_val});
 	}
 
-bool TableVal::Assign(ValPtr index, std::unique_ptr<HashKey> k,
+bool TableVal::Assign(ValPtr index, std::unique_ptr<zeek::detail::HashKey> k,
                       ValPtr new_val, bool broker_forward)
 	{
 	bool is_set = table_type->IsSet();
@@ -1578,7 +1578,7 @@ bool TableVal::Assign(ValPtr index, std::unique_ptr<HashKey> k,
 		InternalWarning("bad set/table in TableVal::Assign");
 
 	TableEntryVal* new_entry_val = new TableEntryVal(std::move(new_val));
-	HashKey k_copy(k->Key(), k->Size(), k->Hash());
+	zeek::detail::HashKey k_copy(k->Key(), k->Size(), k->Hash());
 	TableEntryVal* old_entry_val = AsNonConstTable()->Insert(k.get(), new_entry_val);
 
 	// If the dictionary index already existed, the insert may free up the
@@ -1623,9 +1623,9 @@ bool TableVal::Assign(ValPtr index, std::unique_ptr<HashKey> k,
 	return true;
 	}
 
-bool TableVal::Assign(Val* index, HashKey* k, Val* new_val)
+bool TableVal::Assign(Val* index, zeek::detail::HashKey* k, Val* new_val)
 	{
-	return Assign({NewRef{}, index}, std::unique_ptr<HashKey>{k}, {AdoptRef{}, new_val});
+	return Assign({NewRef{}, index}, std::unique_ptr<zeek::detail::HashKey>{k}, {AdoptRef{}, new_val});
 	}
 
 ValPtr TableVal::SizeVal() const
@@ -1657,11 +1657,11 @@ bool TableVal::AddTo(Val* val, bool is_first_init, bool propagate_ops) const
 	const PDict<zeek::TableEntryVal>* tbl = AsTable();
 	IterCookie* c = tbl->InitForIteration();
 
-	HashKey* k;
+	zeek::detail::HashKey* k;
 	TableEntryVal* v;
 	while ( (v = tbl->NextEntry(k, c)) )
 		{
-		std::unique_ptr<HashKey> hk{k};
+		std::unique_ptr<zeek::detail::HashKey> hk{k};
 
 		if ( is_first_init && t->AsTable()->Lookup(k) )
 			{
@@ -1705,7 +1705,7 @@ bool TableVal::RemoveFrom(Val* val) const
 	const PDict<zeek::TableEntryVal>* tbl = AsTable();
 	IterCookie* c = tbl->InitForIteration();
 
-	HashKey* k;
+	zeek::detail::HashKey* k;
 	while ( tbl->NextEntry(k, c) )
 		{
 		// Not sure that this is 100% sound, since the HashKey
@@ -1737,7 +1737,7 @@ TableValPtr TableVal::Intersection(const TableVal& tv) const
 		}
 
 	IterCookie* c = t1->InitForIteration();
-	HashKey* k;
+	zeek::detail::HashKey* k;
 	while ( t1->NextEntry(k, c) )
 		{
 		// Here we leverage the same assumption about consistent
@@ -1760,7 +1760,7 @@ bool TableVal::EqualTo(const TableVal& tv) const
 		return false;
 
 	IterCookie* c = t0->InitForIteration();
-	HashKey* k;
+	zeek::detail::HashKey* k;
 	while ( t0->NextEntry(k, c) )
 		{
 		// Here we leverage the same assumption about consistent
@@ -1787,7 +1787,7 @@ bool TableVal::IsSubsetOf(const TableVal& tv) const
 		return false;
 
 	IterCookie* c = t0->InitForIteration();
-	HashKey* k;
+	zeek::detail::HashKey* k;
 	while ( t0->NextEntry(k, c) )
 		{
 		// Here we leverage the same assumption about consistent
@@ -2076,7 +2076,7 @@ bool TableVal::UpdateTimestamp(Val* index)
 	return true;
 	}
 
-ListValPtr TableVal::RecreateIndex(const HashKey& k) const
+ListValPtr TableVal::RecreateIndex(const zeek::detail::HashKey& k) const
 	{
 	return table_hash->RecoverVals(k);
 	}
@@ -2287,7 +2287,7 @@ ValPtr TableVal::Remove(const Val& index, bool broker_forward)
 	return va;
 	}
 
-ValPtr TableVal::Remove(const HashKey& k)
+ValPtr TableVal::Remove(const zeek::detail::HashKey& k)
 	{
 	TableEntryVal* v = AsNonConstTable()->RemoveEntry(k);
 	ValPtr va;
@@ -2327,7 +2327,7 @@ ListValPtr TableVal::ToListVal(TypeTag t) const
 	const PDict<zeek::TableEntryVal>* tbl = AsTable();
 	IterCookie* c = tbl->InitForIteration();
 
-	HashKey* k;
+	zeek::detail::HashKey* k;
 	while ( tbl->NextEntry(k, c) )
 		{
 		auto index = table_hash->RecoverVals(*k);
@@ -2399,7 +2399,7 @@ void TableVal::Describe(ODesc* d) const
 
 	for ( int i = 0; i < n; ++i )
 		{
-		HashKey* k;
+		zeek::detail::HashKey* k;
 		TableEntryVal* v = tbl->NextEntry(k, c);
 
 		if ( ! v )
@@ -2555,7 +2555,7 @@ void TableVal::DoExpire(double t)
 		tbl->MakeRobustCookie(expire_cookie);
 		}
 
-	HashKey* k = nullptr;
+	zeek::detail::HashKey* k = nullptr;
 	TableEntryVal* v = nullptr;
 	TableEntryVal* v_saved = nullptr;
 	bool modified = false;
@@ -2740,7 +2740,7 @@ ValPtr TableVal::DoClone(CloneState* state)
 	const PDict<zeek::TableEntryVal>* tbl = AsTable();
 	IterCookie* cookie = tbl->InitForIteration();
 
-	HashKey* key;
+	zeek::detail::HashKey* key;
 	TableEntryVal* val;
 	while ( (val = tbl->NextEntry(key, cookie)) )
 		{
@@ -2796,10 +2796,10 @@ unsigned int TableVal::MemoryAllocation() const
 		+ table_hash->MemoryAllocation();
 	}
 
-HashKey* TableVal::ComputeHash(const Val* index) const
+zeek::detail::HashKey* TableVal::ComputeHash(const Val* index) const
 	{ return MakeHashKey(*index).release(); }
 
-std::unique_ptr<HashKey> TableVal::MakeHashKey(const Val& index) const
+std::unique_ptr<zeek::detail::HashKey> TableVal::MakeHashKey(const Val& index) const
 	{
 	return table_hash->MakeHashKey(index, true);
 	}
@@ -2835,7 +2835,7 @@ TableVal::ParseTimeTableState TableVal::DumpTableState()
 	const PDict<zeek::TableEntryVal>* tbl = AsTable();
 	IterCookie* cookie = tbl->InitForIteration();
 
-	HashKey* key;
+	zeek::detail::HashKey* key;
 	TableEntryVal* val;
 
 	ParseTimeTableState rval;
@@ -2853,7 +2853,7 @@ TableVal::ParseTimeTableState TableVal::DumpTableState()
 void TableVal::RebuildTable(ParseTimeTableState ptts)
 	{
 	delete table_hash;
-	table_hash = new CompositeHash(table_type->GetIndices());
+	table_hash = new zeek::detail::CompositeHash(table_type->GetIndices());
 
 	for ( auto& [key, val] : ptts )
 		Assign(std::move(key), std::move(val));
diff --git a/src/Val.h b/src/Val.h
index 6779d8f51c..d4fc51f0ed 100644
--- a/src/Val.h
+++ b/src/Val.h
@@ -51,8 +51,8 @@ class PrefixTable;
 class StateAccess;
 ZEEK_FORWARD_DECLARE_NAMESPACED(RE_Matcher, zeek);
 
-class CompositeHash;
-class HashKey;
+ZEEK_FORWARD_DECLARE_NAMESPACED(CompositeHash, zeek::detail);
+ZEEK_FORWARD_DECLARE_NAMESPACED(HashKey, zeek::detail);
 
 extern double bro_start_network_time;
 
@@ -807,7 +807,7 @@ public:
 	 *        Broker stores.
 	 * @return  True if the assignment type-checked.
 	 */
-	bool Assign(ValPtr index, std::unique_ptr<HashKey> k,
+	bool Assign(ValPtr index, std::unique_ptr<zeek::detail::HashKey> k,
 	            ValPtr new_val, bool broker_forward = true);
 
 	// Returns true if the assignment typechecked, false if not. The
@@ -816,10 +816,10 @@ public:
 	[[deprecated("Remove in v4.1.  Use IntrusivePtr overload instead.")]]
 	bool Assign(Val* index, Val* new_val);
 
-	// Same as other Assign() method, but takes a precomuted HashKey and
+	// Same as other Assign() method, but takes a precomuted zeek::detail::HashKey and
 	// deletes it when done.
 	[[deprecated("Remove in v4.1.  Use IntrusivePtr overload instead.")]]
-	bool Assign(Val* index, HashKey* k, Val* new_val);
+	bool Assign(Val* index, zeek::detail::HashKey* k, Val* new_val);
 
 	ValPtr SizeVal() const override;
 
@@ -921,10 +921,10 @@ public:
 	/**
 	 * @return  The index corresponding to the given HashKey.
 	 */
-	ListValPtr RecreateIndex(const HashKey& k) const;
+	ListValPtr RecreateIndex(const zeek::detail::HashKey& k) const;
 
 	[[deprecated("Remove in v4.1.  Use RecreateIndex().")]]
-	ListVal* RecoverIndex(const HashKey* k) const
+	ListVal* RecoverIndex(const zeek::detail::HashKey* k) const
 		{ return RecreateIndex(*k).release(); }
 
 	/**
@@ -944,14 +944,14 @@ public:
 	 * @param k  The hash key to lookup.
 	 * @return  Same as Remove(const Val&).
 	 */
-	ValPtr Remove(const HashKey& k);
+	ValPtr Remove(const zeek::detail::HashKey& k);
 
 	[[deprecated("Remove in v4.1.  Use Remove().")]]
 	Val* Delete(const Val* index)
 		{ return Remove(*index).release(); }
 
 	[[deprecated("Remove in v4.1.  Use Remove().")]]
-	Val* Delete(const HashKey* k)
+	Val* Delete(const zeek::detail::HashKey* k)
 		{ return Remove(*k).release(); }
 
 	// Returns a ListVal representation of the table (which must be a set).
@@ -1008,10 +1008,10 @@ public:
 	 * @return  The hash of the index value or nullptr if
 	 * type-checking failed.
 	 */
-	std::unique_ptr<HashKey> MakeHashKey(const Val& index) const;
+	std::unique_ptr<zeek::detail::HashKey> MakeHashKey(const Val& index) const;
 
 	[[deprecated("Remove in v4.1.  Use MakeHashKey().")]]
-	HashKey* ComputeHash(const Val* index) const;
+	zeek::detail::HashKey* ComputeHash(const Val* index) const;
 
 	notifier::Modifiable* Modifiable() override	{ return this; }
 
@@ -1086,7 +1086,7 @@ protected:
 	ValPtr DoClone(CloneState* state) override;
 
 	zeek::TableTypePtr table_type;
-	CompositeHash* table_hash;
+	zeek::detail::CompositeHash* table_hash;
 	zeek::detail::AttributesPtr attrs;
 	zeek::detail::ExprPtr expire_time;
 	zeek::detail::ExprPtr expire_func;
diff --git a/src/analyzer/protocol/mime/MIME.cc b/src/analyzer/protocol/mime/MIME.cc
index 03f82bd7ed..6986cb6b15 100644
--- a/src/analyzer/protocol/mime/MIME.cc
+++ b/src/analyzer/protocol/mime/MIME.cc
@@ -1355,7 +1355,7 @@ MIME_Mail::MIME_Mail(zeek::analyzer::Analyzer* mail_analyzer, bool orig, int buf
 	if ( mime_content_hash )
 		{
 		compute_content_hash = 1;
-		md5_hash = hash_init(Hash_MD5);
+		md5_hash = zeek::detail::hash_init(zeek::detail::Hash_MD5);
 		}
 	else
 		compute_content_hash = 0;
@@ -1375,7 +1375,7 @@ void MIME_Mail::Done()
 	if ( compute_content_hash && mime_content_hash )
 		{
 		u_char* digest = new u_char[16];
-		hash_final(md5_hash, digest);
+		zeek::detail::hash_final(md5_hash, digest);
 		md5_hash = nullptr;
 
 		analyzer->EnqueueConnEvent(mime_content_hash,
@@ -1467,7 +1467,7 @@ void MIME_Mail::SubmitData(int len, const char* buf)
 	if ( compute_content_hash )
 		{
 		content_hash_length += len;
-		hash_update(md5_hash, (const u_char*) buf, len);
+		zeek::detail::hash_update(md5_hash, (const u_char*) buf, len);
 		}
 
 	if ( mime_entity_data || mime_all_data )
diff --git a/src/broker/Data.cc b/src/broker/Data.cc
index 61655fc09d..ffa101e7da 100644
--- a/src/broker/Data.cc
+++ b/src/broker/Data.cc
@@ -890,7 +890,7 @@ broker::expected<broker::data> bro_broker::val_to_data(const zeek::Val* v)
 		else
 			rval = broker::table();
 
-		HashKey* hk;
+		zeek::detail::HashKey* hk;
 		zeek::TableEntryVal* entry;
 		auto c = table->InitForIteration();
 
diff --git a/src/broker/messaging.bif b/src/broker/messaging.bif
index bae4ad625c..da95cdb988 100644
--- a/src/broker/messaging.bif
+++ b/src/broker/messaging.bif
@@ -34,7 +34,7 @@ std::set<std::string> val_to_topic_set(zeek::Val* val)
 			return rval;
 
 		zeek::IterCookie* c = tbl->InitForIteration();
-		HashKey* k;
+		zeek::detail::HashKey* k;
 
 		while ( tbl->NextEntry(k, c) )
 			{
diff --git a/src/digest.cc b/src/digest.cc
index 651338bf96..4c3919bf8c 100644
--- a/src/digest.cc
+++ b/src/digest.cc
@@ -8,6 +8,8 @@
 
 #include "Reporter.h"
 
+namespace zeek::detail {
+
 EVP_MD_CTX* hash_init(HashAlgorithm alg)
 	{
 	EVP_MD_CTX* c = EVP_MD_CTX_new();
@@ -79,3 +81,5 @@ unsigned char* calculate_digest(HashAlgorithm alg, const unsigned char* data, ui
 	hash_final(c, out);
 	return out;
 	}
+
+} // namespace zeek::detail
diff --git a/src/digest.h b/src/digest.h
index 8c3f7b0dce..b708144e9a 100644
--- a/src/digest.h
+++ b/src/digest.h
@@ -23,6 +23,8 @@ inline void* EVP_MD_CTX_md_data(const EVP_MD_CTX* ctx)
 	}
 #endif
 
+namespace zeek::detail {
+
 // if you add something here, note that you might have to make sure that the
 // static_out member in calculate_digest is still long enough.
 enum HashAlgorithm { Hash_MD5, Hash_SHA1, Hash_SHA224, Hash_SHA256, Hash_SHA384, Hash_SHA512 };
@@ -67,3 +69,23 @@ unsigned char* internal_md5(const unsigned char* data, unsigned long len, unsign
  * @return Buffer that the hash was written to. Length is deoendent on the chosen hash function.
  */
 unsigned char* calculate_digest(HashAlgorithm Alg, const unsigned char* data, uint64_t len, unsigned char* out);
+
+} // namespace zeek::detail
+
+using HashAlgorithm [[deprecated("Remove in v4.1. Use zeek::detail::HashAlgorithm.")]] = zeek::detail::HashAlgorithm;
+constexpr auto Hash_MD5 [[deprecated("Remove in v4.1. Use zeek::detail::Hash_MD5.")]] = zeek::detail::Hash_MD5;
+constexpr auto Hash_SHA1 [[deprecated("Remove in v4.1. Use zeek::detail::Hash_SHA1.")]] = zeek::detail::Hash_SHA1;
+constexpr auto Hash_SHA224 [[deprecated("Remove in v4.1. Use zeek::detail::Hash_SHA224.")]] = zeek::detail::Hash_SHA224;
+constexpr auto Hash_SHA256 [[deprecated("Remove in v4.1. Use zeek::detail::Hash_SHA256.")]] = zeek::detail::Hash_SHA256;
+constexpr auto Hash_SHA384 [[deprecated("Remove in v4.1. Use zeek::detail::Hash_SHA384.")]] = zeek::detail::Hash_SHA384;
+constexpr auto Hash_SHA512 [[deprecated("Remove in v4.1. Use zeek::detail::Hash_SHA512.")]] = zeek::detail::Hash_SHA512;
+
+constexpr auto digest_print [[deprecated("Remove in v4.1. Use zeek::detail::digest_print.")]] = zeek::detail::digest_print;
+constexpr auto md5_digest_print [[deprecated("Remove in v4.1. Use zeek::detail::md5_digest_print.")]] = zeek::detail::md5_digest_print;
+constexpr auto sha1_digest_print [[deprecated("Remove in v4.1. Use zeek::detail::sha1_digest_print.")]] = zeek::detail::sha1_digest_print;
+constexpr auto sha256_digest_print [[deprecated("Remove in v4.1. Use zeek::detail::sha256_digest_print.")]] = zeek::detail::sha256_digest_print;
+constexpr auto hash_init [[deprecated("Remove in v4.1. Use zeek::detail::hash_init.")]] = zeek::detail::hash_init;
+constexpr auto hash_update [[deprecated("Remove in v4.1. Use zeek::detail::hash_update.")]] = zeek::detail::hash_update;
+constexpr auto hash_final [[deprecated("Remove in v4.1. Use zeek::detail::hash_final.")]] = zeek::detail::hash_final;
+constexpr auto internal_md5 [[deprecated("Remove in v4.1. Use zeek::detail::internal_md5.")]] = zeek::detail::internal_md5;
+constexpr auto calculate_digest [[deprecated("Remove in v4.1. Use zeek::detail::calculate_digest.")]] = zeek::detail::calculate_digest;
diff --git a/src/file_analysis/AnalyzerSet.cc b/src/file_analysis/AnalyzerSet.cc
index 4b2bb43358..f3ca03f733 100644
--- a/src/file_analysis/AnalyzerSet.cc
+++ b/src/file_analysis/AnalyzerSet.cc
@@ -23,7 +23,7 @@ AnalyzerSet::AnalyzerSet(File* arg_file) : file(arg_file)
 	auto t = zeek::make_intrusive<zeek::TypeList>();
 	t->Append(file_mgr->GetTagType());
 	t->Append(zeek::BifType::Record::Files::AnalyzerArgs);
-	analyzer_hash = new CompositeHash(std::move(t));
+	analyzer_hash = new zeek::detail::CompositeHash(std::move(t));
 	analyzer_map.SetDeleteFunc(analyzer_del_func);
 	}
 
@@ -114,7 +114,7 @@ bool AnalyzerSet::Remove(const file_analysis::Tag& tag,
 	}
 
 bool AnalyzerSet::Remove(const file_analysis::Tag& tag,
-                         std::unique_ptr<HashKey> key)
+                         std::unique_ptr<zeek::detail::HashKey> key)
 	{
 	auto a = (file_analysis::Analyzer*) analyzer_map.Remove(key.get());
 
@@ -153,8 +153,8 @@ bool AnalyzerSet::RemoveMod::Perform(AnalyzerSet* set)
 	return set->Remove(tag, std::move(key));
 	}
 
-std::unique_ptr<HashKey> AnalyzerSet::GetKey(const file_analysis::Tag& t,
-                                             zeek::RecordValPtr args) const
+std::unique_ptr<zeek::detail::HashKey> AnalyzerSet::GetKey(const file_analysis::Tag& t,
+                                                           zeek::RecordValPtr args) const
 	{
 	auto lv = zeek::make_intrusive<zeek::ListVal>(zeek::TYPE_ANY);
 	lv->Append(t.AsVal());
@@ -184,7 +184,7 @@ file_analysis::Analyzer* AnalyzerSet::InstantiateAnalyzer(const Tag& tag,
 	}
 
 void AnalyzerSet::Insert(file_analysis::Analyzer* a,
-                         std::unique_ptr<HashKey> key)
+                         std::unique_ptr<zeek::detail::HashKey> key)
 	{
 	DBG_LOG(DBG_FILE_ANALYSIS, "[%s] Add analyzer %s",
 	        file->GetID().c_str(), file_mgr->GetComponentName(a->Tag()).c_str());
diff --git a/src/file_analysis/AnalyzerSet.h b/src/file_analysis/AnalyzerSet.h
index 0860d35989..f1ae1dad61 100644
--- a/src/file_analysis/AnalyzerSet.h
+++ b/src/file_analysis/AnalyzerSet.h
@@ -8,8 +8,7 @@
 #include "Dict.h"
 #include "Tag.h"
 
-class CompositeHash;
-
+ZEEK_FORWARD_DECLARE_NAMESPACED(CompositeHash, zeek::detail);
 ZEEK_FORWARD_DECLARE_NAMESPACED(RecordVal, zeek);
 namespace zeek {
 using RecordValPtr = zeek::IntrusivePtr<RecordVal>;
@@ -114,8 +113,8 @@ protected:
 	 * @param args an \c AnalyzerArgs value which specifies an analyzer.
 	 * @return the hash key calculated from \a args
 	 */
-	std::unique_ptr<HashKey> GetKey(const file_analysis::Tag& tag,
-	                                zeek::RecordValPtr args) const;
+	std::unique_ptr<zeek::detail::HashKey> GetKey(const file_analysis::Tag& tag,
+	                                              zeek::RecordValPtr args) const;
 
 	/**
 	 * Create an instance of a file analyzer.
@@ -131,7 +130,7 @@ protected:
 	 * @param a an analyzer instance.
 	 * @param key the hash key which represents the analyzer's \c AnalyzerArgs.
 	 */
-	void Insert(file_analysis::Analyzer* a, std::unique_ptr<HashKey> key);
+	void Insert(file_analysis::Analyzer* a, std::unique_ptr<zeek::detail::HashKey> key);
 
 	/**
 	 * Remove an analyzer instance from the set.
@@ -139,12 +138,12 @@ protected:
 	 *        just used for debugging messages.
 	 * @param key the hash key which represents the analyzer's \c AnalyzerArgs.
 	 */
-	bool Remove(const file_analysis::Tag& tag, std::unique_ptr<HashKey> key);
+	bool Remove(const file_analysis::Tag& tag, std::unique_ptr<zeek::detail::HashKey> key);
 
 private:
 
 	File* file;                                  /**< File which owns the set */
-	CompositeHash* analyzer_hash;                /**< AnalyzerArgs hashes. */
+	zeek::detail::CompositeHash* analyzer_hash;  /**< AnalyzerArgs hashes. */
 	zeek::PDict<file_analysis::Analyzer> analyzer_map; /**< Indexed by AnalyzerArgs. */
 
 	/**
@@ -177,7 +176,7 @@ private:
 		 * @param arg_a an analyzer instance to add to an analyzer set.
 		 * @param arg_key hash key representing the analyzer's \c AnalyzerArgs.
 		 */
-		AddMod(file_analysis::Analyzer* arg_a, std::unique_ptr<HashKey> arg_key)
+		AddMod(file_analysis::Analyzer* arg_a, std::unique_ptr<zeek::detail::HashKey> arg_key)
 			: Modification(), a(arg_a), key(std::move(arg_key)) {}
 		~AddMod() override {}
 		bool Perform(AnalyzerSet* set) override;
@@ -185,7 +184,7 @@ private:
 
 	protected:
 		file_analysis::Analyzer* a;
-		std::unique_ptr<HashKey> key;
+		std::unique_ptr<zeek::detail::HashKey> key;
 	};
 
 	/**
@@ -198,7 +197,7 @@ private:
 		 * @param arg_a an analyzer instance to add to an analyzer set.
 		 * @param arg_key hash key representing the analyzer's \c AnalyzerArgs.
 		 */
-		RemoveMod(const file_analysis::Tag& arg_tag, std::unique_ptr<HashKey> arg_key)
+		RemoveMod(const file_analysis::Tag& arg_tag, std::unique_ptr<zeek::detail::HashKey> arg_key)
 			: Modification(), tag(arg_tag), key(std::move(arg_key)) {}
 		~RemoveMod() override {}
 		bool Perform(AnalyzerSet* set) override;
@@ -206,7 +205,7 @@ private:
 
 	protected:
 		file_analysis::Tag tag;
-		std::unique_ptr<HashKey> key;
+		std::unique_ptr<zeek::detail::HashKey> key;
 	};
 
 	using ModQueue = std::queue<Modification*>;
diff --git a/src/file_analysis/Manager.cc b/src/file_analysis/Manager.cc
index 4087839256..1be5e43be5 100644
--- a/src/file_analysis/Manager.cc
+++ b/src/file_analysis/Manager.cc
@@ -66,8 +66,8 @@ void Manager::Terminate()
 
 string Manager::HashHandle(const string& handle) const
 	{
-	hash128_t hash;
-	KeyedHash::StaticHash128(handle.data(), handle.size(), &hash);
+	zeek::detail::hash128_t hash;
+	zeek::detail::KeyedHash::StaticHash128(handle.data(), handle.size(), &hash);
 
 	return Bro::UID(bits_per_uid, hash, 2).Base62("F");
 	}
diff --git a/src/file_analysis/analyzer/x509/X509.cc b/src/file_analysis/analyzer/x509/X509.cc
index 0f09bdf47e..ac3c293f4c 100644
--- a/src/file_analysis/analyzer/x509/X509.cc
+++ b/src/file_analysis/analyzer/x509/X509.cc
@@ -49,10 +49,10 @@ bool file_analysis::X509::EndOfFile()
 		{
 		// first step - let's see if the certificate has been cached.
 		unsigned char buf[SHA256_DIGEST_LENGTH];
-		auto ctx = hash_init(Hash_SHA256);
-		hash_update(ctx, cert_char, cert_data.size());
-		hash_final(ctx, buf);
-		std::string cert_sha256 = sha256_digest_print(buf);
+		auto ctx = zeek::detail::hash_init(zeek::detail::Hash_SHA256);
+		zeek::detail::hash_update(ctx, cert_char, cert_data.size());
+		zeek::detail::hash_final(ctx, buf);
+		std::string cert_sha256 = zeek::detail::sha256_digest_print(buf);
 		auto index = zeek::make_intrusive<zeek::StringVal>(cert_sha256);
 		const auto& entry = certificate_cache->Find(index);
 
diff --git a/src/input/Manager.cc b/src/input/Manager.cc
index 14ebc13583..b4cbaf0bb0 100644
--- a/src/input/Manager.cc
+++ b/src/input/Manager.cc
@@ -35,8 +35,8 @@ using threading::Field;
  * the hash_t value and compare it directly with "=="
  */
 struct InputHash {
-	hash_t valhash;
-	HashKey* idxkey;
+	zeek::detail::hash_t valhash;
+	zeek::detail::HashKey* idxkey;
 	~InputHash();
 };
 
@@ -272,7 +272,7 @@ bool Manager::CreateStream(Stream* info, zeek::RecordVal* description)
 
 		{
 		// create config mapping in ReaderInfo. Has to be done before the construction of reader_obj.
-		HashKey* k;
+		zeek::detail::HashKey* k;
 		zeek::IterCookie* c = info->config->AsTable()->InitForIteration();
 
 		zeek::TableEntryVal* v;
@@ -1120,7 +1120,7 @@ int Manager::SendEntryTable(Stream* i, const Value* const *vals)
 	assert(i->stream_type == TABLE_STREAM);
 	TableStream* stream = (TableStream*) i;
 
-	HashKey* idxhash = HashValues(stream->num_idx_fields, vals);
+	zeek::detail::HashKey* idxhash = HashValues(stream->num_idx_fields, vals);
 
 	if ( idxhash == nullptr )
 		{
@@ -1128,10 +1128,10 @@ int Manager::SendEntryTable(Stream* i, const Value* const *vals)
 		return stream->num_val_fields + stream->num_idx_fields;
 		}
 
-	hash_t valhash = 0;
+	zeek::detail::hash_t valhash = 0;
 	if ( stream->num_val_fields > 0 )
 		{
-		if ( HashKey* valhashkey = HashValues(stream->num_val_fields, vals+stream->num_idx_fields) )
+		if ( zeek::detail::HashKey* valhashkey = HashValues(stream->num_val_fields, vals+stream->num_idx_fields) )
 			{
 			valhash = valhashkey->Hash();
 			delete(valhashkey);
@@ -1271,7 +1271,7 @@ int Manager::SendEntryTable(Stream* i, const Value* const *vals)
 		zeek::reporter->InternalError("could not hash");
 
 	InputHash* ih = new InputHash();
-	ih->idxkey = new HashKey(k->Key(), k->Size(), k->Hash());
+	ih->idxkey = new zeek::detail::HashKey(k->Key(), k->Size(), k->Hash());
 	ih->valhash = valhash;
 
 	stream->tab->Assign({zeek::AdoptRef{}, idxval}, std::move(k), {zeek::AdoptRef{}, valval});
@@ -1346,7 +1346,7 @@ void Manager::EndCurrentSend(ReaderFrontend* reader)
 	zeek::IterCookie *c = stream->lastDict->InitForIteration();
 	stream->lastDict->MakeRobustCookie(c);
 	InputHash* ih;
-	HashKey *lastDictIdxKey;
+	zeek::detail::HashKey *lastDictIdxKey;
 
 	while ( ( ih = stream->lastDict->NextEntry(lastDictIdxKey, c) ) )
 		{
@@ -2146,7 +2146,7 @@ int Manager::CopyValue(char *data, const int startpos, const Value* val) const
 	}
 
 // Hash num_elements threading values and return the HashKey for them. At least one of the vals has to be ->present.
-HashKey* Manager::HashValues(const int num_elements, const Value* const *vals) const
+zeek::detail::HashKey* Manager::HashValues(const int num_elements, const Value* const *vals) const
 	{
 	int length = 0;
 
@@ -2181,7 +2181,7 @@ HashKey* Manager::HashValues(const int num_elements, const Value* const *vals) c
 
 		}
 
-	HashKey *key = new HashKey(data, length);
+	auto key = new zeek::detail::HashKey(data, length);
 	delete [] data;
 
 	assert(position == length);
diff --git a/src/input/Manager.h b/src/input/Manager.h
index e9da369d4f..64aa050f5e 100644
--- a/src/input/Manager.h
+++ b/src/input/Manager.h
@@ -212,7 +212,7 @@ private:
 	bool CallPred(zeek::Func* pred_func, const int numvals, ...) const;
 
 	// Get a hashkey for a set of threading::Values.
-	HashKey* HashValues(const int num_elements, const threading::Value* const *vals) const;
+	zeek::detail::HashKey* HashValues(const int num_elements, const threading::Value* const *vals) const;
 
 	// Get the memory used by a specific value.
 	int GetValueLength(const threading::Value* val) const;
diff --git a/src/logging/Manager.cc b/src/logging/Manager.cc
index 08a58c2767..7aad7753c3 100644
--- a/src/logging/Manager.cc
+++ b/src/logging/Manager.cc
@@ -864,7 +864,7 @@ bool Manager::Write(zeek::EnumVal* id, zeek::RecordVal* columns_arg)
 			info->path = copy_string(path.c_str());
 			info->network_time = network_time;
 
-			HashKey* k;
+			zeek::detail::HashKey* k;
 			zeek::IterCookie* c = filter->config->AsTable()->InitForIteration();
 
 			zeek::TableEntryVal* v;
diff --git a/src/probabilistic/BitVector.cc b/src/probabilistic/BitVector.cc
index 5b3139388a..c37a57b69a 100644
--- a/src/probabilistic/BitVector.cc
+++ b/src/probabilistic/BitVector.cc
@@ -498,12 +498,12 @@ uint64_t BitVector::Hash() const
 	{
 	u_char buf[SHA256_DIGEST_LENGTH];
 	uint64_t digest;
-	EVP_MD_CTX* ctx = hash_init(Hash_SHA256);
+	EVP_MD_CTX* ctx = zeek::detail::hash_init(zeek::detail::Hash_SHA256);
 
 	for ( size_type i = 0; i < Blocks(); ++i )
-		hash_update(ctx, &bits[i], sizeof(bits[i]));
+		zeek::detail::hash_update(ctx, &bits[i], sizeof(bits[i]));
 
-	hash_final(ctx, buf);
+	zeek::detail::hash_final(ctx, buf);
 	memcpy(&digest, buf, sizeof(digest)); // Use the first bytes as digest
 	return digest;
 	}
@@ -581,4 +581,3 @@ BitVector::size_type BitVector::find_from(size_type i) const
 
 	return i * bits_per_block + lowest_bit(bits[i]);
 	}
-
diff --git a/src/probabilistic/BloomFilter.cc b/src/probabilistic/BloomFilter.cc
index 1517801356..ce175c5283 100644
--- a/src/probabilistic/BloomFilter.cc
+++ b/src/probabilistic/BloomFilter.cc
@@ -156,7 +156,7 @@ BasicBloomFilter::~BasicBloomFilter()
 	delete bits;
 	}
 
-void BasicBloomFilter::Add(const HashKey* key)
+void BasicBloomFilter::Add(const zeek::detail::HashKey* key)
 	{
 	Hasher::digest_vector h = hasher->Hash(key);
 
@@ -164,7 +164,7 @@ void BasicBloomFilter::Add(const HashKey* key)
 		bits->Set(h[i] % bits->Size());
 	}
 
-size_t BasicBloomFilter::Count(const HashKey* key) const
+size_t BasicBloomFilter::Count(const zeek::detail::HashKey* key) const
 	{
 	Hasher::digest_vector h = hasher->Hash(key);
 
@@ -260,7 +260,7 @@ std::string CountingBloomFilter::InternalState() const
 	}
 
 // TODO: Use partitioning in add/count to allow for reusing CMS bounds.
-void CountingBloomFilter::Add(const HashKey* key)
+void CountingBloomFilter::Add(const zeek::detail::HashKey* key)
 	{
 	Hasher::digest_vector h = hasher->Hash(key);
 
@@ -268,7 +268,7 @@ void CountingBloomFilter::Add(const HashKey* key)
 		cells->Increment(h[i] % cells->Size());
 	}
 
-size_t CountingBloomFilter::Count(const HashKey* key) const
+size_t CountingBloomFilter::Count(const zeek::detail::HashKey* key) const
 	{
 	Hasher::digest_vector h = hasher->Hash(key);
 
diff --git a/src/probabilistic/BloomFilter.h b/src/probabilistic/BloomFilter.h
index cc3a4a8e72..409d369569 100644
--- a/src/probabilistic/BloomFilter.h
+++ b/src/probabilistic/BloomFilter.h
@@ -35,7 +35,7 @@ public:
 	 *
 	 * @param key The key associated with the element to add.
 	 */
-	virtual void Add(const HashKey* key) = 0;
+	virtual void Add(const zeek::detail::HashKey* key) = 0;
 
 	/**
 	 * Retrieves the associated count of a given value.
@@ -44,7 +44,7 @@ public:
 	 *
 	 * @return The counter associated with *key*.
 	 */
-	virtual size_t Count(const HashKey* key) const = 0;
+	virtual size_t Count(const zeek::detail::HashKey* key) const = 0;
 
 	/**
 	 * Checks whether the Bloom filter is empty.
@@ -168,8 +168,8 @@ protected:
 	BasicBloomFilter();
 
 	// Overridden from BloomFilter.
-	void Add(const HashKey* key) override;
-	size_t Count(const HashKey* key) const override;
+	void Add(const zeek::detail::HashKey* key) override;
+	size_t Count(const zeek::detail::HashKey* key) const override;
 	broker::expected<broker::data> DoSerialize() const override;
 	bool DoUnserialize(const broker::data& data) override;
 	BloomFilterType Type() const override
@@ -217,8 +217,8 @@ protected:
 	CountingBloomFilter();
 
 	// Overridden from BloomFilter.
-	void Add(const HashKey* key) override;
-	size_t Count(const HashKey* key) const override;
+	void Add(const zeek::detail::HashKey* key) override;
+	size_t Count(const zeek::detail::HashKey* key) const override;
 	broker::expected<broker::data> DoSerialize() const override;
 	bool DoUnserialize(const broker::data& data) override;
 	BloomFilterType Type() const override
diff --git a/src/probabilistic/Hasher.cc b/src/probabilistic/Hasher.cc
index cfe5f3244b..f24ddecca0 100644
--- a/src/probabilistic/Hasher.cc
+++ b/src/probabilistic/Hasher.cc
@@ -19,30 +19,30 @@ Hasher::seed_t Hasher::MakeSeed(const void* data, size_t size)
 	{
 	u_char buf[SHA256_DIGEST_LENGTH];
 	seed_t tmpseed;
-	EVP_MD_CTX* ctx = hash_init(Hash_SHA256);
+	EVP_MD_CTX* ctx = zeek::detail::hash_init(zeek::detail::Hash_SHA256);
 
 	assert(sizeof(tmpseed) == 16);
 
 	static auto global_hash_seed = zeek::id::find_val<zeek::StringVal>("global_hash_seed");
 
 	if ( data )
-		hash_update(ctx, data, size);
+		zeek::detail::hash_update(ctx, data, size);
 
 	else if ( global_hash_seed->Len() > 0 )
-		hash_update(ctx, global_hash_seed->Bytes(), global_hash_seed->Len());
+		zeek::detail::hash_update(ctx, global_hash_seed->Bytes(), global_hash_seed->Len());
 
 	else
 		{
 		unsigned int first_seed = initial_seed();
-		hash_update(ctx, &first_seed, sizeof(first_seed));
+		zeek::detail::hash_update(ctx, &first_seed, sizeof(first_seed));
 		}
 
-	hash_final(ctx, buf);
+	zeek::detail::hash_final(ctx, buf);
 	memcpy(&tmpseed, buf, sizeof(tmpseed)); // Use the first bytes as seed.
 	return tmpseed;
 	}
 
-Hasher::digest_vector Hasher::Hash(const HashKey* key) const
+Hasher::digest_vector Hasher::Hash(const zeek::detail::HashKey* key) const
 	{
 	return Hash(key->Key(), key->Size());
 	}
diff --git a/src/probabilistic/Hasher.h b/src/probabilistic/Hasher.h
index e59737e09e..8154a0dcb2 100644
--- a/src/probabilistic/Hasher.h
+++ b/src/probabilistic/Hasher.h
@@ -21,7 +21,7 @@ enum HasherType { Default, Double };
  */
 class Hasher {
 public:
-	typedef hash_t digest;
+	typedef zeek::detail::hash_t digest;
 	typedef std::vector<digest> digest_vector;
 	struct seed_t {
 		// actually HH_U64, which has the same type
@@ -72,7 +72,7 @@ public:
 	 *
 	 * @return Vector of *k* hash values.
 	 */
-	digest_vector Hash(const HashKey* key) const;
+	digest_vector Hash(const zeek::detail::HashKey* key) const;
 
 	/**
 	 * Computes the hashes for a set of bytes.
diff --git a/src/probabilistic/Topk.cc b/src/probabilistic/Topk.cc
index ce5b370ca4..06a1543209 100644
--- a/src/probabilistic/Topk.cc
+++ b/src/probabilistic/Topk.cc
@@ -23,10 +23,10 @@ void TopkVal::Typify(zeek::TypePtr t)
 	type = std::move(t);
 	auto tl = zeek::make_intrusive<zeek::TypeList>(type);
 	tl->Append(type);
-	hash = new CompositeHash(std::move(tl));
+	hash = new zeek::detail::CompositeHash(std::move(tl));
 	}
 
-HashKey* TopkVal::GetHash(Val* v) const
+zeek::detail::HashKey* TopkVal::GetHash(Val* v) const
 	{
 	auto key = hash->MakeHashKey(*v, true);
 	assert(key);
@@ -103,7 +103,7 @@ void TopkVal::Merge(const TopkVal* value, bool doPrune)
 			{
 			Element* e = *eit;
 			// lookup if we already know this one...
-			HashKey* key = GetHash(e->value);
+			zeek::detail::HashKey* key = GetHash(e->value);
 			Element* olde = (Element*) elementDict->Lookup(key);
 
 			if ( olde == nullptr )
@@ -158,7 +158,7 @@ void TopkVal::Merge(const TopkVal* value, bool doPrune)
 		assert(b->elements.size() > 0);
 
 		Element* e = b->elements.front();
-		HashKey* key = GetHash(e->value);
+		zeek::detail::HashKey* key = GetHash(e->value);
 		elementDict->RemoveEntry(key);
 		delete key;
 		delete e;
@@ -222,7 +222,7 @@ zeek::VectorValPtr TopkVal::GetTopK(int k) const // returns vector
 
 uint64_t TopkVal::GetCount(Val* value) const
 	{
-	HashKey* key = GetHash(value);
+	zeek::detail::HashKey* key = GetHash(value);
 	Element* e = (Element*) elementDict->Lookup(key);
 	delete key;
 
@@ -237,7 +237,7 @@ uint64_t TopkVal::GetCount(Val* value) const
 
 uint64_t TopkVal::GetEpsilon(Val* value) const
 	{
-	HashKey* key = GetHash(value);
+	zeek::detail::HashKey* key = GetHash(value);
 	Element* e = (Element*) elementDict->Lookup(key);
 	delete key;
 
@@ -282,7 +282,7 @@ void TopkVal::Encountered(zeek::ValPtr encountered)
 			}
 
 	// Step 1 - get the hash.
-	HashKey* key = GetHash(encountered);
+	zeek::detail::HashKey* key = GetHash(encountered);
 	Element* e = (Element*) elementDict->Lookup(key);
 
 	if ( e == nullptr )
@@ -326,7 +326,7 @@ void TopkVal::Encountered(zeek::ValPtr encountered)
 
 			// evict oldest element with least hits.
 			assert(b->elements.size() > 0);
-			HashKey* deleteKey = GetHash((*(b->elements.begin()))->value);
+			zeek::detail::HashKey* deleteKey = GetHash((*(b->elements.begin()))->value);
 			b->elements.erase(b->elements.begin());
 			Element* deleteElement = (Element*) elementDict->RemoveEntry(deleteKey);
 			assert(deleteElement); // there has to have been a minimal element...
@@ -506,7 +506,7 @@ bool TopkVal::DoUnserialize(const broker::data& data)
 
 			b->elements.insert(b->elements.end(), e);
 
-			HashKey* key = GetHash(e->value);
+			zeek::detail::HashKey* key = GetHash(e->value);
 			assert (elementDict->Lookup(key) == nullptr);
 
 			elementDict->Insert(key, e);
diff --git a/src/probabilistic/Topk.h b/src/probabilistic/Topk.h
index c3b47277e1..f776eada29 100644
--- a/src/probabilistic/Topk.h
+++ b/src/probabilistic/Topk.h
@@ -9,7 +9,7 @@
 // This class implements the top-k algorithm. Or - to be more precise - an
 // interpretation of it.
 
-class CompositeHash;
+ZEEK_FORWARD_DECLARE_NAMESPACED(CompositeHash, zeek::detail);
 
 namespace probabilistic {
 
@@ -152,8 +152,8 @@ private:
 	 *
 	 * @returns HashKey for value
 	 */
-	HashKey* GetHash(Val* v) const; // this probably should go somewhere else.
-	HashKey* GetHash(const zeek::ValPtr& v) const
+	zeek::detail::HashKey* GetHash(Val* v) const; // this probably should go somewhere else.
+	zeek::detail::HashKey* GetHash(const zeek::ValPtr& v) const
 		{ return GetHash(v.get()); }
 
 	/**
@@ -164,7 +164,7 @@ private:
 	void Typify(zeek::TypePtr t);
 
 	zeek::TypePtr type;
-	CompositeHash* hash;
+	zeek::detail::CompositeHash* hash;
 	std::list<Bucket*> buckets;
 	zeek::PDict<Element>* elementDict;
 	uint64_t size; // how many elements are we tracking?
diff --git a/src/reporter.bif b/src/reporter.bif
index 00f9d5ad11..d557f6364c 100644
--- a/src/reporter.bif
+++ b/src/reporter.bif
@@ -183,7 +183,7 @@ function Reporter::set_weird_sampling_whitelist%(weird_sampling_whitelist: strin
 	auto wl_table = wl_val->AsTable();
 	std::unordered_set<std::string> whitelist_set;
 
-	HashKey* k;
+	zeek::detail::HashKey* k;
 	IterCookie* c = wl_table->InitForIteration();
 	TableEntryVal* v;
 
diff --git a/src/scan.l b/src/scan.l
index a9ae381404..b171ed85c2 100644
--- a/src/scan.l
+++ b/src/scan.l
@@ -639,7 +639,7 @@ static int load_files(const char* orig_file)
 		{
 		// Add the filename to the file mapping table (Debug.h).
 		zeek::detail::Filemap* map = new zeek::detail::Filemap;
-		HashKey* key = new HashKey(file_path.c_str());
+		zeek::detail::HashKey* key = new zeek::detail::HashKey(file_path.c_str());
 		zeek::detail::g_dbgfilemaps.emplace(file_path, map);
 		LoadPolicyFileText(file_path.c_str());
 		}
diff --git a/src/supervisor/Supervisor.cc b/src/supervisor/Supervisor.cc
index 4d6fbe0ff2..c6f0b16ed8 100644
--- a/src/supervisor/Supervisor.cc
+++ b/src/supervisor/Supervisor.cc
@@ -1262,7 +1262,7 @@ Supervisor::NodeConfig Supervisor::NodeConfig::FromRecord(const RecordVal* node)
 	auto cluster_table_val = node->GetField("cluster")->AsTableVal();
 	auto cluster_table = cluster_table_val->AsTable();
 	auto c = cluster_table->InitForIteration();
-	HashKey* k;
+	zeek::detail::HashKey* k;
 	TableEntryVal* v;
 
 	while ( (v = cluster_table->NextEntry(k, c)) )
diff --git a/src/util.cc b/src/util.cc
index ce1ff6f6ab..3fafe41d66 100644
--- a/src/util.cc
+++ b/src/util.cc
@@ -997,19 +997,19 @@ std::string strstrip(std::string s)
 
 void hmac_md5(size_t size, const unsigned char* bytes, unsigned char digest[16])
 	{
-	if ( ! KeyedHash::seeds_initialized )
+	if ( ! zeek::detail::KeyedHash::seeds_initialized )
 		zeek::reporter->InternalError("HMAC-MD5 invoked before the HMAC key is set");
 
-	internal_md5(bytes, size, digest);
+	zeek::detail::internal_md5(bytes, size, digest);
 
 	for ( int i = 0; i < 16; ++i )
-		digest[i] ^= KeyedHash::shared_hmac_md5_key[i];
+		digest[i] ^= zeek::detail::KeyedHash::shared_hmac_md5_key[i];
 
-	internal_md5(digest, 16, digest);
+	zeek::detail::internal_md5(digest, 16, digest);
 	}
 
 static bool read_random_seeds(const char* read_file, uint32_t* seed,
-				std::array<uint32_t, KeyedHash::SEED_INIT_SIZE>& buf)
+				std::array<uint32_t, zeek::detail::KeyedHash::SEED_INIT_SIZE>& buf)
 	{
 	FILE* f = nullptr;
 
@@ -1045,7 +1045,7 @@ static bool read_random_seeds(const char* read_file, uint32_t* seed,
 	}
 
 static bool write_random_seeds(const char* write_file, uint32_t seed,
-				std::array<uint32_t, KeyedHash::SEED_INIT_SIZE>& buf)
+				std::array<uint32_t, zeek::detail::KeyedHash::SEED_INIT_SIZE>& buf)
 	{
 	FILE* f = nullptr;
 
@@ -1094,7 +1094,7 @@ void bro_srandom(unsigned int seed)
 void init_random_seed(const char* read_file, const char* write_file,
                       bool use_empty_seeds)
 	{
-	std::array<uint32_t, KeyedHash::SEED_INIT_SIZE> buf = {};
+	std::array<uint32_t, zeek::detail::KeyedHash::SEED_INIT_SIZE> buf = {};
 	size_t pos = 0;	// accumulates entropy
 	bool seeds_done = false;
 	uint32_t seed = 0;
@@ -1135,7 +1135,7 @@ void init_random_seed(const char* read_file, const char* write_file,
 		if ( fd >= 0 )
 			{
 			int amt = read(fd, buf.data() + pos,
-					sizeof(uint32_t) * (KeyedHash::SEED_INIT_SIZE - pos));
+					sizeof(uint32_t) * (zeek::detail::KeyedHash::SEED_INIT_SIZE - pos));
 			safe_close(fd);
 
 			if ( amt > 0 )
@@ -1147,8 +1147,8 @@ void init_random_seed(const char* read_file, const char* write_file,
 			}
 #endif
 
-		if ( pos < KeyedHash::SEED_INIT_SIZE )
-			zeek::reporter->FatalError("Could not read enough random data. Wanted %d, got %lu", KeyedHash::SEED_INIT_SIZE, pos);
+		if ( pos < zeek::detail::KeyedHash::SEED_INIT_SIZE )
+			zeek::reporter->FatalError("Could not read enough random data. Wanted %d, got %lu", zeek::detail::KeyedHash::SEED_INIT_SIZE, pos);
 
 		if ( ! seed )
 			{
@@ -1170,8 +1170,8 @@ void init_random_seed(const char* read_file, const char* write_file,
 		first_seed_saved = true;
 		}
 
-	if ( ! KeyedHash::IsInitialized() )
-		KeyedHash::InitializeSeeds(buf);
+	if ( ! zeek::detail::KeyedHash::IsInitialized() )
+		zeek::detail::KeyedHash::InitializeSeeds(buf);
 
 	if ( write_file && ! write_random_seeds(write_file, seed, buf) )
 		zeek::reporter->Error("Could not write seeds to file '%s'.\n",
@@ -2118,7 +2118,7 @@ uint64_t calculate_unique_id(size_t pool)
 			unique.pid = getpid();
 			unique.rnd = static_cast<int>(zeek::random_number());
 
-			uid_instance = HashKey::HashBytes(&unique, sizeof(unique));
+			uid_instance = zeek::detail::HashKey::HashBytes(&unique, sizeof(unique));
 			++uid_instance; // Now it's larger than zero.
 			}
 		else
@@ -2133,7 +2133,7 @@ uint64_t calculate_unique_id(size_t pool)
 	assert(uid_pool[pool].key.instance != 0);
 
 	++uid_pool[pool].key.counter;
-	return HashKey::HashBytes(&(uid_pool[pool].key), sizeof(uid_pool[pool].key));
+	return zeek::detail::HashKey::HashBytes(&(uid_pool[pool].key), sizeof(uid_pool[pool].key));
 	}
 
 bool safe_write(int fd, const char* data, int len)
diff --git a/src/util.h b/src/util.h
index d848a43078..97c6041c28 100644
--- a/src/util.h
+++ b/src/util.h
@@ -200,7 +200,7 @@ extern std::string strreplace(const std::string& s, const std::string& o, const
 extern std::string strstrip(std::string s);
 
 extern void hmac_md5(size_t size, const unsigned char* bytes,
-			unsigned char digest[16]);
+                     unsigned char digest[16]);
 
 // Initializes RNGs for zeek::random_number() and MD5 usage.  If load_file is given,
 // the seeds (both random & MD5) are loaded from that file.  This takes
diff --git a/src/zeek.bif b/src/zeek.bif
index a1b01669b0..c1b8e6c574 100644
--- a/src/zeek.bif
+++ b/src/zeek.bif
@@ -561,7 +561,7 @@ function md5_hash%(...%): string
 	%{
 	unsigned char digest[MD5_DIGEST_LENGTH];
 	MD5Val::digest(@ARG@, digest);
-	return zeek::make_intrusive<zeek::StringVal>(md5_digest_print(digest));
+	return zeek::make_intrusive<zeek::StringVal>(zeek::detail::md5_digest_print(digest));
 	%}
 
 ## Computes the SHA1 hash value of the provided list of arguments.
@@ -581,7 +581,7 @@ function sha1_hash%(...%): string
 	%{
 	unsigned char digest[SHA_DIGEST_LENGTH];
 	SHA1Val::digest(@ARG@, digest);
-	return zeek::make_intrusive<zeek::StringVal>(sha1_digest_print(digest));
+	return zeek::make_intrusive<zeek::StringVal>(zeek::detail::sha1_digest_print(digest));
 	%}
 
 ## Computes the SHA256 hash value of the provided list of arguments.
@@ -601,7 +601,7 @@ function sha256_hash%(...%): string
 	%{
 	unsigned char digest[SHA256_DIGEST_LENGTH];
 	SHA256Val::digest(@ARG@, digest);
-	return zeek::make_intrusive<zeek::StringVal>(sha256_digest_print(digest));
+	return zeek::make_intrusive<zeek::StringVal>(zeek::detail::sha256_digest_print(digest));
 	%}
 
 ## Computes an HMAC-MD5 hash value of the provided list of arguments. The HMAC
@@ -616,8 +616,8 @@ function sha256_hash%(...%): string
 function md5_hmac%(...%): string
 	%{
 	unsigned char hmac[MD5_DIGEST_LENGTH];
-	MD5Val::hmac(@ARG@, KeyedHash::shared_hmac_md5_key, hmac);
-	return zeek::make_intrusive<zeek::StringVal>(md5_digest_print(hmac));
+	MD5Val::hmac(@ARG@, zeek::detail::KeyedHash::shared_hmac_md5_key, hmac);
+	return zeek::make_intrusive<zeek::StringVal>(zeek::detail::md5_digest_print(hmac));
 	%}
 
 ## Constructs an MD5 handle to enable incremental hash computation. You can