diff --git a/CHANGES b/CHANGES
index f75d4c63b6..e6997afb51 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,38 @@
+3.3.0-dev.524 | 2020-11-12 12:16:00 -0700
+
+  * Move 'using namespace' declaration after other includes (Tim Wojtulewicz, Corelight)
+
+  * Use binpac.h as if it was an external dependency (Tim Wojtulewicz, Corelight)
+
+  * Fix includes of bif.h and _pac.h files to use full paths inside build directory (Tim Wojtulewicz, Corelight)
+
+  * Remove unnecessary include of NetVar.h from packet analysis plugins (Tim Wojtulewicz, Corelight)
+
+  * GH-1079: Use full paths starting with zeek/ when including files (Tim Wojtulewicz, Corelight)
+
+  * Fix type clash fatal error with log filters that use $ext_func and $include/$exclude
+
+    The logging manager's Manager::TraverseRecord(), called when adding a
+    log filter to a stream, skipped any fields intoduced by a filter's
+    $ext_func when such fields weren't mentioned in a $include restriction
+    or mentioned in an $exclude restriction. This was inconsistent with
+    Manager::RecordToFilterVals, used when actually writing log entries,
+    which does include those values.
+
+    The result was that the record indices descent in Manager::RecordToFilterVals
+    expects to find only record values, when in fact only the record
+    provided by ext_func is present. This leads to type mismatches and
+    hard Zeek exits like this one:
+
+    1300475173.475401 fatal error in zeek/share/zeek//base/init-bare.zeek, line 4810: Val::CONVERTER (string/record) (zeek)
+
+    The fix makes ext_func's field additions decisive, meaning the
+    filter's include/exclude lists don't apply to it. If a user really
+    wants to override this, they can reset the filter's ext_func back to
+    our no-op default.
+
+    The included btest produces the above error when the fix is not present. (Christian Kreibich, Corelight)
+
 3.3.0-dev.516 | 2020-11-11 12:53:02 -0700
 
   * Support for additional DNS RR Type: LOC[29], SSHFP[44], NSEC3PARAM[51], custom BIND9 signaling[65534] (Fatema BW)
diff --git a/VERSION b/VERSION
index 3cfb3d45a6..5883d442bf 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-3.3.0-dev.516
+3.3.0-dev.524
diff --git a/src/Anon.cc b/src/Anon.cc
index c0c32623a6..b0a9f74243 100644
--- a/src/Anon.cc
+++ b/src/Anon.cc
@@ -1,19 +1,19 @@
-#include "Anon.h"
+#include "zeek/Anon.h"
 
 #include <stdlib.h>
 #include <unistd.h>
 #include <assert.h>
 #include <sys/time.h>
 
-#include "util.h"
-#include "net_util.h"
-#include "Val.h"
-#include "NetVar.h"
-#include "Reporter.h"
-#include "Scope.h"
-#include "ID.h"
-#include "IPAddr.h"
-#include "Event.h"
+#include "zeek/util.h"
+#include "zeek/net_util.h"
+#include "zeek/Val.h"
+#include "zeek/NetVar.h"
+#include "zeek/Reporter.h"
+#include "zeek/Scope.h"
+#include "zeek/ID.h"
+#include "zeek/IPAddr.h"
+#include "zeek/Event.h"
 
 namespace zeek::detail {
 
diff --git a/src/Attr.cc b/src/Attr.cc
index 6639879220..b9b165d076 100644
--- a/src/Attr.cc
+++ b/src/Attr.cc
@@ -2,13 +2,13 @@
 
 #include "zeek-config.h"
 
-#include "Attr.h"
-#include "Expr.h"
-#include "Desc.h"
-#include "Val.h"
-#include "IntrusivePtr.h"
-#include "input/Manager.h"
-#include "threading/SerialTypes.h"
+#include "zeek/Attr.h"
+#include "zeek/Expr.h"
+#include "zeek/Desc.h"
+#include "zeek/Val.h"
+#include "zeek/IntrusivePtr.h"
+#include "zeek/input/Manager.h"
+#include "zeek/threading/SerialTypes.h"
 
 namespace zeek::detail {
 
diff --git a/src/Attr.h b/src/Attr.h
index 13d8f26c9b..ab0197057b 100644
--- a/src/Attr.h
+++ b/src/Attr.h
@@ -5,9 +5,9 @@
 #include <vector>
 #include <string>
 
-#include "Obj.h"
-#include "ZeekList.h"
-#include "IntrusivePtr.h"
+#include "zeek/Obj.h"
+#include "zeek/ZeekList.h"
+#include "zeek/IntrusivePtr.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(Expr, zeek::detail);
 
diff --git a/src/Base64.cc b/src/Base64.cc
index 8c0e5f2c59..87edaf2cb5 100644
--- a/src/Base64.cc
+++ b/src/Base64.cc
@@ -1,11 +1,12 @@
 #include "zeek-config.h"
-#include "Base64.h"
-#include "ZeekString.h"
-#include "Reporter.h"
-#include "Conn.h"
 
 #include <math.h>
 
+#include "zeek/Base64.h"
+#include "zeek/ZeekString.h"
+#include "zeek/Reporter.h"
+#include "zeek/Conn.h"
+
 namespace zeek::detail {
 
 int Base64Converter::default_base64_table[256];
diff --git a/src/BifReturnVal.cc b/src/BifReturnVal.cc
index e8ea9facf1..597991ea44 100644
--- a/src/BifReturnVal.cc
+++ b/src/BifReturnVal.cc
@@ -1,7 +1,7 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "BifReturnVal.h"
-#include "Val.h"
+#include "zeek/BifReturnVal.h"
+#include "zeek/Val.h"
 
 namespace zeek::detail {
 
diff --git a/src/BifReturnVal.h b/src/BifReturnVal.h
index 5a49714e8e..fb4d02ff57 100644
--- a/src/BifReturnVal.h
+++ b/src/BifReturnVal.h
@@ -3,7 +3,7 @@
 #pragma once
 
 #include "zeek-config.h"
-#include "IntrusivePtr.h"
+#include "zeek/IntrusivePtr.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(Val, zeek);
 namespace zeek {
diff --git a/src/BroList.h b/src/BroList.h
index 1956e71971..770e300917 100644
--- a/src/BroList.h
+++ b/src/BroList.h
@@ -1,2 +1,2 @@
 #warning "BroList.h is deprecated and will be removed in v4.1. Use ZeekList.h instead."
-#include "ZeekList.h"
+#include "zeek/ZeekList.h"
diff --git a/src/BroString.h b/src/BroString.h
index 8d48b3acbd..3bf8b27b53 100644
--- a/src/BroString.h
+++ b/src/BroString.h
@@ -1,2 +1,2 @@
 #warning "BroString.h is deprecated and will be removed in v4.1. Use ZeekString.h instead."
-#include "ZeekString.h"
+#include "zeek/ZeekString.h"
diff --git a/src/CCL.cc b/src/CCL.cc
index a55025c8cc..46926434dd 100644
--- a/src/CCL.cc
+++ b/src/CCL.cc
@@ -1,12 +1,12 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
+#include "zeek/CCL.h"
 
 #include <algorithm>
 
-#include "CCL.h"
-#include "RE.h"
-#include "DFA.h"
+#include "zeek/RE.h"
+#include "zeek/DFA.h"
 
 namespace zeek::detail {
 
diff --git a/src/CompHash.cc b/src/CompHash.cc
index 9fcebb53f8..086d645f6a 100644
--- a/src/CompHash.cc
+++ b/src/CompHash.cc
@@ -1,19 +1,19 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
+#include "zeek/CompHash.h"
 
 #include <cstring>
 #include <vector>
 #include <map>
 
-#include "CompHash.h"
-#include "ZeekString.h"
-#include "Dict.h"
-#include "Val.h"
-#include "RE.h"
-#include "Reporter.h"
-#include "Func.h"
-#include "IPAddr.h"
+#include "zeek/ZeekString.h"
+#include "zeek/Dict.h"
+#include "zeek/Val.h"
+#include "zeek/RE.h"
+#include "zeek/Reporter.h"
+#include "zeek/Func.h"
+#include "zeek/IPAddr.h"
 
 namespace zeek::detail {
 
diff --git a/src/CompHash.h b/src/CompHash.h
index 9472987a77..2288133db3 100644
--- a/src/CompHash.h
+++ b/src/CompHash.h
@@ -4,8 +4,8 @@
 
 #include <memory>
 
-#include "Type.h"
-#include "IntrusivePtr.h"
+#include "zeek/Type.h"
+#include "zeek/IntrusivePtr.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(ListVal, zeek);
 ZEEK_FORWARD_DECLARE_NAMESPACED(HashKey, zeek::detail);
diff --git a/src/Conn.cc b/src/Conn.cc
index b0a79e4120..93a2f94520 100644
--- a/src/Conn.cc
+++ b/src/Conn.cc
@@ -1,25 +1,24 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
-
-#include "Conn.h"
+#include "zeek/Conn.h"
 
 #include <ctype.h>
+#include <binpac.h>
 
-#include "Desc.h"
-#include "RunState.h"
-#include "NetVar.h"
-#include "Event.h"
-#include "Sessions.h"
-#include "Reporter.h"
-#include "Timer.h"
-#include "iosource/IOSource.h"
-#include "analyzer/protocol/pia/PIA.h"
-#include "binpac.h"
-#include "TunnelEncapsulation.h"
-#include "analyzer/Analyzer.h"
-#include "analyzer/Manager.h"
-#include "iosource/IOSource.h"
+#include "zeek/Desc.h"
+#include "zeek/RunState.h"
+#include "zeek/NetVar.h"
+#include "zeek/Event.h"
+#include "zeek/Sessions.h"
+#include "zeek/Reporter.h"
+#include "zeek/Timer.h"
+#include "zeek/iosource/IOSource.h"
+#include "zeek/analyzer/protocol/pia/PIA.h"
+#include "zeek/TunnelEncapsulation.h"
+#include "zeek/analyzer/Analyzer.h"
+#include "zeek/analyzer/Manager.h"
+#include "zeek/iosource/IOSource.h"
 
 namespace zeek {
 namespace detail {
diff --git a/src/Conn.h b/src/Conn.h
index eaa44b5232..a99456ce33 100644
--- a/src/Conn.h
+++ b/src/Conn.h
@@ -8,18 +8,18 @@
 #include <tuple>
 #include <type_traits>
 
-#include "Dict.h"
-#include "Timer.h"
-#include "Rule.h"
-#include "IPAddr.h"
-#include "UID.h"
-#include "WeirdState.h"
-#include "ZeekArgs.h"
-#include "IntrusivePtr.h"
-#include "iosource/Packet.h"
+#include "zeek/Dict.h"
+#include "zeek/Timer.h"
+#include "zeek/Rule.h"
+#include "zeek/IPAddr.h"
+#include "zeek/UID.h"
+#include "zeek/WeirdState.h"
+#include "zeek/ZeekArgs.h"
+#include "zeek/IntrusivePtr.h"
+#include "zeek/iosource/Packet.h"
 
-#include "analyzer/Tag.h"
-#include "analyzer/Analyzer.h"
+#include "zeek/analyzer/Tag.h"
+#include "zeek/analyzer/Analyzer.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(Connection, zeek);
 ZEEK_FORWARD_DECLARE_NAMESPACED(ConnectionTimer, zeek::detail);
diff --git a/src/Continuation.h b/src/Continuation.h
index d29d353c57..6ae5427f0e 100644
--- a/src/Continuation.h
+++ b/src/Continuation.h
@@ -8,7 +8,7 @@
 
 #pragma once
 
-#include "List.h"
+#include "zeek/List.h"
 
 class Continuation {
 public:
diff --git a/src/ConvertUTF.c b/src/ConvertUTF.c
index 1a213725e5..b8acb69d27 100644
--- a/src/ConvertUTF.c
+++ b/src/ConvertUTF.c
@@ -55,9 +55,9 @@
  *===------------------------------------------------------------------------=*/
 /*
  * Copyright 2001-2004 Unicode, Inc.
- * 
+ *
  * Disclaimer
- * 
+ *
  * This source code is provided as is by Unicode, Inc. No claims are
  * made as to fitness for any particular purpose. No warranties of any
  * kind are expressed or implied. The recipient agrees to determine
@@ -65,9 +65,9 @@
  * purchased on magnetic or optical media from Unicode, Inc., the
  * sole remedy for any claim will be exchange of defective media
  * within 90 days of receipt.
- * 
+ *
  * Limitations on Rights to Redistribute This Code
- * 
+ *
  * Unicode, Inc. hereby grants the right to freely use the information
  * supplied in this file in the creation of products supporting the
  * Unicode Standard, and to make copies of this file in any form
@@ -94,7 +94,7 @@
 ------------------------------------------------------------------------ */
 
 
-#include "ConvertUTF.h"
+#include "zeek/ConvertUTF.h"
 #ifdef CVTUTF_DEBUG
 #include <stdio.h>
 #endif
@@ -137,7 +137,7 @@ static const char trailingBytesForUTF8[256] = {
  * This table contains as many values as there might be trailing bytes
  * in a UTF-8 sequence.
  */
-static const UTF32 offsetsFromUTF8[6] = { 0x00000000UL, 0x00003080UL, 0x000E2080UL, 
+static const UTF32 offsetsFromUTF8[6] = { 0x00000000UL, 0x00003080UL, 0x000E2080UL,
                      0x03C82080UL, 0xFA082080UL, 0x82082080UL };
 
 /*
@@ -163,7 +163,7 @@ static const UTF8 firstByteMark[7] = { 0x00, 0x00, 0xC0, 0xE0, 0xF0, 0xF8, 0xFC
 /* --------------------------------------------------------------------- */
 
 ConversionResult ConvertUTF32toUTF16 (
-        const UTF32** sourceStart, const UTF32* sourceEnd, 
+        const UTF32** sourceStart, const UTF32* sourceEnd,
         UTF16** targetStart, UTF16* targetEnd, ConversionFlags flags) {
     ConversionResult result = conversionOK;
     const UTF32* source = *sourceStart;
@@ -212,7 +212,7 @@ ConversionResult ConvertUTF32toUTF16 (
 /* --------------------------------------------------------------------- */
 
 ConversionResult ConvertUTF16toUTF32 (
-        const UTF16** sourceStart, const UTF16* sourceEnd, 
+        const UTF16** sourceStart, const UTF16* sourceEnd,
         UTF32** targetStart, UTF32* targetEnd, ConversionFlags flags) {
     ConversionResult result = conversionOK;
     const UTF16* source = *sourceStart;
@@ -266,7 +266,7 @@ if (result == sourceIllegal) {
     return result;
 }
 ConversionResult ConvertUTF16toUTF8 (
-        const UTF16** sourceStart, const UTF16* sourceEnd, 
+        const UTF16** sourceStart, const UTF16* sourceEnd,
         UTF8** targetStart, UTF8* targetEnd, ConversionFlags flags) {
     ConversionResult result = conversionOK;
     const UTF16* source = *sourceStart;
@@ -275,7 +275,7 @@ ConversionResult ConvertUTF16toUTF8 (
         UTF32 ch;
         unsigned short bytesToWrite = 0;
         const UTF32 byteMask = 0xBF;
-        const UTF32 byteMark = 0x80; 
+        const UTF32 byteMark = 0x80;
         const UTF16* oldSource = source; /* In case we have to back up because of target overflow. */
         ch = *source++;
         /* If we have a surrogate pair, convert to UTF32 first. */
@@ -336,7 +336,7 @@ ConversionResult ConvertUTF16toUTF8 (
 /* --------------------------------------------------------------------- */
 
 ConversionResult ConvertUTF32toUTF8 (
-        const UTF32** sourceStart, const UTF32* sourceEnd, 
+        const UTF32** sourceStart, const UTF32* sourceEnd,
         UTF8** targetStart, UTF8* targetEnd, ConversionFlags flags) {
     ConversionResult result = conversionOK;
     const UTF32* source = *sourceStart;
@@ -345,7 +345,7 @@ ConversionResult ConvertUTF32toUTF8 (
         UTF32 ch;
         unsigned short bytesToWrite = 0;
         const UTF32 byteMask = 0xBF;
-        const UTF32 byteMark = 0x80; 
+        const UTF32 byteMark = 0x80;
         ch = *source++;
         if (flags == strictConversion ) {
             /* UTF-16 surrogate values are illegal in UTF-32 */
@@ -367,7 +367,7 @@ ConversionResult ConvertUTF32toUTF8 (
                                             ch = UNI_REPLACEMENT_CHAR;
                                             result = sourceIllegal;
         }
-        
+
         target += bytesToWrite;
         if (target > targetEnd) {
             --source; /* Back up source pointer! */
@@ -560,7 +560,7 @@ Boolean isLegalUTF8String(const UTF8 **source, const UTF8 *sourceEnd) {
 /* --------------------------------------------------------------------- */
 
 ConversionResult ConvertUTF8toUTF16 (
-        const UTF8** sourceStart, const UTF8* sourceEnd, 
+        const UTF8** sourceStart, const UTF8* sourceEnd,
         UTF16** targetStart, UTF16* targetEnd, ConversionFlags flags) {
     ConversionResult result = conversionOK;
     const UTF8* source = *sourceStart;
@@ -633,7 +633,7 @@ ConversionResult ConvertUTF8toUTF16 (
 /* --------------------------------------------------------------------- */
 
 static ConversionResult ConvertUTF8toUTF32Impl(
-        const UTF8** sourceStart, const UTF8* sourceEnd, 
+        const UTF8** sourceStart, const UTF8* sourceEnd,
         UTF32** targetStart, UTF32* targetEnd, ConversionFlags flags,
         Boolean InputIsPartial) {
     ConversionResult result = conversionOK;
diff --git a/src/DFA.cc b/src/DFA.cc
index cf72f7ec80..f70c0854bc 100644
--- a/src/DFA.cc
+++ b/src/DFA.cc
@@ -2,10 +2,10 @@
 
 #include "zeek-config.h"
 
-#include "DFA.h"
-#include "EquivClass.h"
-#include "Desc.h"
-#include "Hash.h"
+#include "zeek/DFA.h"
+#include "zeek/EquivClass.h"
+#include "zeek/Desc.h"
+#include "zeek/Hash.h"
 
 namespace zeek::detail {
 
diff --git a/src/DFA.h b/src/DFA.h
index 20064794db..c2fd7555f1 100644
--- a/src/DFA.h
+++ b/src/DFA.h
@@ -3,15 +3,14 @@
 
 #pragma once
 
+#include <assert.h>
+#include <sys/types.h> // for u_char
 #include <map>
 #include <string>
 
-#include <assert.h>
-#include <sys/types.h> // for u_char
-
-#include "NFA.h"
-#include "RE.h" // for typedef AcceptingSet
-#include "Obj.h"
+#include "zeek/NFA.h"
+#include "zeek/RE.h" // for typedef AcceptingSet
+#include "zeek/Obj.h"
 
 namespace zeek::detail {
 
diff --git a/src/DNS_Mgr.cc b/src/DNS_Mgr.cc
index c3f295795e..67c7b0e264 100644
--- a/src/DNS_Mgr.cc
+++ b/src/DNS_Mgr.cc
@@ -1,8 +1,7 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
-
-#include "DNS_Mgr.h"
+#include "zeek/DNS_Mgr.h"
 
 #include <sys/types.h>
 #include <sys/socket.h>
@@ -31,24 +30,23 @@
 
 #include <algorithm>
 
-#include "ZeekString.h"
-#include "Expr.h"
-#include "Event.h"
-#include "RunState.h"
-#include "Val.h"
-#include "NetVar.h"
-#include "ID.h"
-#include "Reporter.h"
-#include "IntrusivePtr.h"
-#include "iosource/Manager.h"
-#include "Hash.h"
+#include "zeek/ZeekString.h"
+#include "zeek/Expr.h"
+#include "zeek/Event.h"
+#include "zeek/RunState.h"
+#include "zeek/Val.h"
+#include "zeek/NetVar.h"
+#include "zeek/ID.h"
+#include "zeek/Reporter.h"
+#include "zeek/IntrusivePtr.h"
+#include "zeek/iosource/Manager.h"
+#include "zeek/Hash.h"
 
 extern "C" {
 extern int select(int, fd_set *, fd_set *, fd_set *, struct timeval *);
 
 #include <netdb.h>
-
-#include "nb_dns.h"
+#include "zeek/nb_dns.h"
 }
 
 using namespace std;
diff --git a/src/DNS_Mgr.h b/src/DNS_Mgr.h
index a857b38603..226c2edc1e 100644
--- a/src/DNS_Mgr.h
+++ b/src/DNS_Mgr.h
@@ -7,11 +7,11 @@
 #include <queue>
 #include <utility>
 
-#include "List.h"
-#include "EventHandler.h"
-#include "iosource/IOSource.h"
-#include "IPAddr.h"
-#include "util.h"
+#include "zeek/List.h"
+#include "zeek/EventHandler.h"
+#include "zeek/iosource/IOSource.h"
+#include "zeek/IPAddr.h"
+#include "zeek/util.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(EventHandler, zeek);
 ZEEK_FORWARD_DECLARE_NAMESPACED(DNS_Mgr_Request, zeek::detail);
diff --git a/src/DbgBreakpoint.cc b/src/DbgBreakpoint.cc
index b76d1d6716..4f414806ae 100644
--- a/src/DbgBreakpoint.cc
+++ b/src/DbgBreakpoint.cc
@@ -2,22 +2,22 @@
 
 #include "zeek-config.h"
 
-#include "DbgBreakpoint.h"
+#include "zeek/DbgBreakpoint.h"
 
 #include <assert.h>
 
-#include "Desc.h"
-#include "ID.h"
-#include "Queue.h"
-#include "Debug.h"
-#include "Scope.h"
-#include "Frame.h"
-#include "Func.h"
-#include "Val.h"
-#include "Stmt.h"
-#include "Timer.h"
-#include "Reporter.h"
-#include "module_util.h"
+#include "zeek/Desc.h"
+#include "zeek/ID.h"
+#include "zeek/Queue.h"
+#include "zeek/Debug.h"
+#include "zeek/Scope.h"
+#include "zeek/Frame.h"
+#include "zeek/Func.h"
+#include "zeek/Val.h"
+#include "zeek/Stmt.h"
+#include "zeek/Timer.h"
+#include "zeek/Reporter.h"
+#include "zeek/module_util.h"
 
 namespace zeek::detail {
 
diff --git a/src/DbgBreakpoint.h b/src/DbgBreakpoint.h
index 22d4ae6dfb..6e1024c9ca 100644
--- a/src/DbgBreakpoint.h
+++ b/src/DbgBreakpoint.h
@@ -3,7 +3,7 @@
 #pragma once
 
 #include <string>
-#include "util.h"
+#include "zeek/util.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(Stmt, zeek::detail);
 ZEEK_FORWARD_DECLARE_NAMESPACED(ParseLocationRec, zeek::detail);
diff --git a/src/DbgHelp.cc b/src/DbgHelp.cc
index d7d11de3f0..a9c54abd24 100644
--- a/src/DbgHelp.cc
+++ b/src/DbgHelp.cc
@@ -2,4 +2,4 @@
 
 #include "zeek-config.h"
 
-#include "Debug.h"
+#include "zeek/Debug.h"
diff --git a/src/DbgWatch.cc b/src/DbgWatch.cc
index 1ea5b71163..113b556f6e 100644
--- a/src/DbgWatch.cc
+++ b/src/DbgWatch.cc
@@ -1,10 +1,10 @@
 // Implementation of watches
 
 #include "zeek-config.h"
+#include "zeek/DbgWatch.h"
 
-#include "Debug.h"
-#include "DbgWatch.h"
-#include "Reporter.h"
+#include "zeek/Debug.h"
+#include "zeek/Reporter.h"
 
 namespace zeek::detail {
 
diff --git a/src/DbgWatch.h b/src/DbgWatch.h
index d311978972..83b113a764 100644
--- a/src/DbgWatch.h
+++ b/src/DbgWatch.h
@@ -2,7 +2,7 @@
 
 #pragma once
 
-#include "util.h"
+#include "zeek/util.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(Expr, zeek::detail);
 namespace zeek { class Obj; }
diff --git a/src/Debug.cc b/src/Debug.cc
index 99a51ebf28..0c04763fa5 100644
--- a/src/Debug.cc
+++ b/src/Debug.cc
@@ -2,7 +2,7 @@
 
 #include "zeek-config.h"
 
-#include "Debug.h"
+#include "zeek/Debug.h"
 
 #include <stdio.h>
 #include <stdarg.h>
@@ -10,31 +10,32 @@
 #include <ctype.h>
 
 #include <string>
-using namespace std;
-
-#include "util.h"
-#include "DebugCmds.h"
-#include "DbgBreakpoint.h"
-#include "ID.h"
-#include "IntrusivePtr.h"
-#include "Expr.h"
-#include "Stmt.h"
-#include "Frame.h"
-#include "Func.h"
-#include "IntrusivePtr.h"
-#include "Scope.h"
-#include "PolicyFile.h"
-#include "Desc.h"
-#include "Reporter.h"
-#include "Val.h"
-#include "module_util.h"
-#include "input.h"
 
 #ifdef HAVE_READLINE
 #include <readline/readline.h>
 #include <readline/history.h>
 #endif
 
+#include "zeek/util.h"
+#include "zeek/DebugCmds.h"
+#include "zeek/DbgBreakpoint.h"
+#include "zeek/ID.h"
+#include "zeek/IntrusivePtr.h"
+#include "zeek/Expr.h"
+#include "zeek/Stmt.h"
+#include "zeek/Frame.h"
+#include "zeek/Func.h"
+#include "zeek/IntrusivePtr.h"
+#include "zeek/Scope.h"
+#include "zeek/PolicyFile.h"
+#include "zeek/Desc.h"
+#include "zeek/Reporter.h"
+#include "zeek/Val.h"
+#include "zeek/module_util.h"
+#include "zeek/input.h"
+
+using namespace std;
+
 bool zeek::detail::g_policy_debug = false;
 bool& g_policy_debug = zeek::detail::g_policy_debug;
 
diff --git a/src/Debug.h b/src/Debug.h
index e2201aab2a..4b742348ac 100644
--- a/src/Debug.h
+++ b/src/Debug.h
@@ -2,15 +2,15 @@
 
 #pragma once
 
-#include "Obj.h"
-#include "Queue.h"
-#include "StmtEnums.h"
-#include "util.h"
-
 #include <vector>
 #include <map>
 #include <string>
 
+#include "zeek/Obj.h"
+#include "zeek/Queue.h"
+#include "zeek/StmtEnums.h"
+#include "zeek/util.h"
+
 ZEEK_FORWARD_DECLARE_NAMESPACED(Frame, zeek::detail);
 ZEEK_FORWARD_DECLARE_NAMESPACED(Stmt, zeek::detail);
 ZEEK_FORWARD_DECLARE_NAMESPACED(Val, zeek);
diff --git a/src/DebugCmdInfoConstants.cc b/src/DebugCmdInfoConstants.cc
index 154601db84..f1043613d8 100644
--- a/src/DebugCmdInfoConstants.cc
+++ b/src/DebugCmdInfoConstants.cc
@@ -4,7 +4,7 @@
 // DO NOT EDIT.
 //
 
-#include "util.h"
+#include "zeek/util.h"
 namespace zeek::detail {
 
 void init_global_dbg_constants () {
@@ -280,7 +280,7 @@ void init_global_dbg_constants () {
 		                                      false);
 		g_DebugCmdInfos.push_back(info);
 	}
-	
+
 }
 
 } // namespace zeek::detail
diff --git a/src/DebugCmds.cc b/src/DebugCmds.cc
index 011fc86063..ce4c99a3d8 100644
--- a/src/DebugCmds.cc
+++ b/src/DebugCmds.cc
@@ -2,7 +2,7 @@
 // implementation of most commands.
 
 #include "zeek-config.h"
-#include "DebugCmds.h"
+#include "zeek/DebugCmds.h"
 
 #include <sys/types.h>
 
@@ -10,19 +10,19 @@
 #include <string.h>
 #include <assert.h>
 
-#include "DebugCmdInfoConstants.cc"
-#include "Debug.h"
-#include "Desc.h"
-#include "DbgBreakpoint.h"
-#include "ID.h"
-#include "Frame.h"
-#include "Func.h"
-#include "Stmt.h"
-#include "Scope.h"
-#include "Reporter.h"
-#include "PolicyFile.h"
-#include "Val.h"
-#include "util.h"
+#include "zeek/DebugCmdInfoConstants.cc"
+#include "zeek/Debug.h"
+#include "zeek/Desc.h"
+#include "zeek/DbgBreakpoint.h"
+#include "zeek/ID.h"
+#include "zeek/Frame.h"
+#include "zeek/Func.h"
+#include "zeek/Stmt.h"
+#include "zeek/Scope.h"
+#include "zeek/Reporter.h"
+#include "zeek/PolicyFile.h"
+#include "zeek/Val.h"
+#include "zeek/util.h"
 
 using namespace std;
 
diff --git a/src/DebugCmds.h b/src/DebugCmds.h
index 44b9d4574d..4051a121ef 100644
--- a/src/DebugCmds.h
+++ b/src/DebugCmds.h
@@ -7,7 +7,9 @@
 #include <string>
 #include <vector>
 
-#include "Queue.h"
+#include "zeek/Queue.h"
+
+// This file is generated during the build.
 #include "DebugCmdConstants.h"
 
 namespace zeek::detail {
diff --git a/src/DebugLogger.cc b/src/DebugLogger.cc
index f2d0f75dd6..0ad5798b08 100644
--- a/src/DebugLogger.cc
+++ b/src/DebugLogger.cc
@@ -1,11 +1,12 @@
 #ifdef DEBUG
 
+#include "zeek/DebugLogger.h"
+
 #include <stdlib.h>
 #include <unistd.h>
 
-#include "DebugLogger.h"
-#include "RunState.h"
-#include "plugin/Plugin.h"
+#include "zeek/RunState.h"
+#include "zeek/plugin/Plugin.h"
 
 zeek::detail::DebugLogger zeek::detail::debug_logger;
 zeek::detail::DebugLogger& debug_logger = zeek::detail::debug_logger;
diff --git a/src/Desc.cc b/src/Desc.cc
index 3a76bbc60c..f23c1d5e00 100644
--- a/src/Desc.cc
+++ b/src/Desc.cc
@@ -1,17 +1,17 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
-#include "Desc.h"
+#include "zeek/Desc.h"
 
 #include <stdlib.h>
 #include <string.h>
 #include <errno.h>
 #include <math.h>
 
-#include "File.h"
-#include "Reporter.h"
-#include "ConvertUTF.h"
-#include "IPAddr.h"
+#include "zeek/File.h"
+#include "zeek/Reporter.h"
+#include "zeek/ConvertUTF.h"
+#include "zeek/IPAddr.h"
 
 #define DEFAULT_SIZE 128
 #define SLOP 10
diff --git a/src/Desc.h b/src/Desc.h
index 634498f0c2..8711e2c4f9 100644
--- a/src/Desc.h
+++ b/src/Desc.h
@@ -2,14 +2,14 @@
 
 #pragma once
 
-#include "ZeekString.h" // for byte_vec
-#include "util.h" // for bro_int_t
+#include <sys/types.h> // for u_char
 
 #include <set>
 #include <utility>
 #include <string>
 
-#include <sys/types.h> // for u_char
+#include "zeek/ZeekString.h" // for byte_vec
+#include "zeek/util.h" // for bro_int_t
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(IPAddr, zeek);
 ZEEK_FORWARD_DECLARE_NAMESPACED(IPPrefix, zeek);
diff --git a/src/Dict.cc b/src/Dict.cc
index 06aa643ee0..41568a9730 100644
--- a/src/Dict.cc
+++ b/src/Dict.cc
@@ -1,8 +1,7 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "Dict.h"
-
 #include "zeek-config.h"
+#include "zeek/Dict.h"
 
 #ifdef HAVE_MEMORY_H
 #include <memory.h>
@@ -12,10 +11,10 @@
 #include <climits>
 #include <fstream>
 
-#include "Reporter.h"
-#include "util.h"
+#include "zeek/3rdparty/doctest.h"
 
-#include "3rdparty/doctest.h"
+#include "zeek/Reporter.h"
+#include "zeek/util.h"
 
 #if defined(DEBUG) && defined(ZEEK_DICT_DEBUG)
 #define ASSERT_VALID(o)	o->AssertValid()
diff --git a/src/Dict.h b/src/Dict.h
index 61280a3cdc..f51d431820 100644
--- a/src/Dict.h
+++ b/src/Dict.h
@@ -5,7 +5,7 @@
 #include <cstdint>
 #include <vector>
 
-#include "Hash.h"
+#include "zeek/Hash.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(IterCookie, zeek);
 ZEEK_FORWARD_DECLARE_NAMESPACED(DictEntry, zeek::detail);
diff --git a/src/Discard.cc b/src/Discard.cc
index 8e73dc83c5..bdaa7b942e 100644
--- a/src/Discard.cc
+++ b/src/Discard.cc
@@ -2,17 +2,17 @@
 
 #include "zeek-config.h"
 
-#include "Discard.h"
+#include "zeek/Discard.h"
 
 #include <algorithm>
 
-#include "ZeekString.h"
-#include "RunState.h"
-#include "Func.h"
-#include "Var.h"
-#include "Val.h"
-#include "IP.h"
-#include "Reporter.h" // for InterpreterException
+#include "zeek/ZeekString.h"
+#include "zeek/RunState.h"
+#include "zeek/Func.h"
+#include "zeek/Var.h"
+#include "zeek/Val.h"
+#include "zeek/IP.h"
+#include "zeek/Reporter.h" // for InterpreterException
 
 namespace zeek::detail {
 
diff --git a/src/Discard.h b/src/Discard.h
index 3009088d17..309ff96c13 100644
--- a/src/Discard.h
+++ b/src/Discard.h
@@ -5,7 +5,7 @@
 #include <sys/types.h> // for u_char
 #include <memory>
 
-#include "IntrusivePtr.h"
+#include "zeek/IntrusivePtr.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(IP_Hdr, zeek);
 ZEEK_FORWARD_DECLARE_NAMESPACED(Func, zeek);
diff --git a/src/EquivClass.cc b/src/EquivClass.cc
index 303c2b3161..af736d257c 100644
--- a/src/EquivClass.cc
+++ b/src/EquivClass.cc
@@ -2,9 +2,9 @@
 
 #include "zeek-config.h"
 
-#include "EquivClass.h"
-#include "CCL.h"
-#include "util.h"
+#include "zeek/EquivClass.h"
+#include "zeek/CCL.h"
+#include "zeek/util.h"
 
 namespace zeek::detail {
 
diff --git a/src/Event.cc b/src/Event.cc
index 9b1b7b0127..93e49b7f89 100644
--- a/src/Event.cc
+++ b/src/Event.cc
@@ -2,16 +2,16 @@
 
 #include "zeek-config.h"
 
-#include "Event.h"
-#include "Desc.h"
-#include "Func.h"
-#include "NetVar.h"
-#include "Trigger.h"
-#include "Val.h"
-#include "plugin/Manager.h"
-#include "iosource/Manager.h"
-#include "iosource/PktSrc.h"
-#include "RunState.h"
+#include "zeek/Event.h"
+#include "zeek/Desc.h"
+#include "zeek/Func.h"
+#include "zeek/NetVar.h"
+#include "zeek/Trigger.h"
+#include "zeek/Val.h"
+#include "zeek/plugin/Manager.h"
+#include "zeek/iosource/Manager.h"
+#include "zeek/iosource/PktSrc.h"
+#include "zeek/RunState.h"
 
 zeek::EventMgr zeek::event_mgr;
 zeek::EventMgr& mgr = zeek::event_mgr;
diff --git a/src/Event.h b/src/Event.h
index 76b937bf9a..e9b3ab203e 100644
--- a/src/Event.h
+++ b/src/Event.h
@@ -2,16 +2,16 @@
 
 #pragma once
 
-#include "ZeekList.h"
-#include "analyzer/Analyzer.h"
-#include "iosource/IOSource.h"
-#include "Flare.h"
-#include "ZeekArgs.h"
-#include "IntrusivePtr.h"
-
 #include <tuple>
 #include <type_traits>
 
+#include "zeek/ZeekList.h"
+#include "zeek/analyzer/Analyzer.h"
+#include "zeek/iosource/IOSource.h"
+#include "zeek/Flare.h"
+#include "zeek/ZeekArgs.h"
+#include "zeek/IntrusivePtr.h"
+
 ZEEK_FORWARD_DECLARE_NAMESPACED(EventMgr, zeek);
 
 namespace zeek {
diff --git a/src/EventHandler.cc b/src/EventHandler.cc
index 271b19a58d..a7a904f4a7 100644
--- a/src/EventHandler.cc
+++ b/src/EventHandler.cc
@@ -1,14 +1,15 @@
-#include "EventHandler.h"
-#include "Event.h"
-#include "Desc.h"
-#include "Func.h"
-#include "Scope.h"
-#include "NetVar.h"
-#include "ID.h"
-#include "Var.h"
+#include "zeek/EventHandler.h"
 
-#include "broker/Manager.h"
-#include "broker/Data.h"
+#include "zeek/Event.h"
+#include "zeek/Desc.h"
+#include "zeek/Func.h"
+#include "zeek/Scope.h"
+#include "zeek/NetVar.h"
+#include "zeek/ID.h"
+#include "zeek/Var.h"
+
+#include "zeek/broker/Manager.h"
+#include "zeek/broker/Data.h"
 
 namespace zeek {
 
diff --git a/src/EventHandler.h b/src/EventHandler.h
index b8000167aa..0f7813ef37 100644
--- a/src/EventHandler.h
+++ b/src/EventHandler.h
@@ -2,13 +2,13 @@
 
 #pragma once
 
-#include "ZeekList.h"
-#include "ZeekArgs.h"
-#include "Type.h"
-
 #include <unordered_set>
 #include <string>
 
+#include "zeek/ZeekList.h"
+#include "zeek/ZeekArgs.h"
+#include "zeek/Type.h"
+
 ZEEK_FORWARD_DECLARE_NAMESPACED(Func, zeek);
 
 namespace zeek {
diff --git a/src/EventLauncher.cc b/src/EventLauncher.cc
index 293869c0f7..817d5a4dde 100644
--- a/src/EventLauncher.cc
+++ b/src/EventLauncher.cc
@@ -1,9 +1,9 @@
-#include "Val.h"
-#include "analyzer/Analyzer.h"
-#include "EventLauncher.h"
-#include "Event.h"
-#include "NetVar.h"
-#include "Conn.h"
-#include "File.h"
+#include "zeek/Val.h"
+#include "zeek/analyzer/Analyzer.h"
+#include "zeek/EventLauncher.h"
+#include "zeek/Event.h"
+#include "zeek/NetVar.h"
+#include "zeek/Conn.h"
+#include "zeek/File.h"
 
 #include "event.bif.func_def"
diff --git a/src/EventRegistry.cc b/src/EventRegistry.cc
index 0ed355f9ff..f92f27e709 100644
--- a/src/EventRegistry.cc
+++ b/src/EventRegistry.cc
@@ -1,8 +1,8 @@
-#include "EventRegistry.h"
-#include "EventHandler.h"
-#include "Func.h"
-#include "RE.h"
-#include "Reporter.h"
+#include "zeek/EventRegistry.h"
+#include "zeek/EventHandler.h"
+#include "zeek/Func.h"
+#include "zeek/RE.h"
+#include "zeek/Reporter.h"
 
 namespace zeek {
 
diff --git a/src/Expr.cc b/src/Expr.cc
index ba8370065b..e896d68984 100644
--- a/src/Expr.cc
+++ b/src/Expr.cc
@@ -2,25 +2,25 @@
 
 #include "zeek-config.h"
 
-#include "Expr.h"
-#include "Event.h"
-#include "Desc.h"
-#include "Frame.h"
-#include "Func.h"
-#include "RE.h"
-#include "Scope.h"
-#include "Stmt.h"
-#include "EventRegistry.h"
-#include "RunState.h"
-#include "Traverse.h"
-#include "Trigger.h"
-#include "IPAddr.h"
-#include "digest.h"
-#include "module_util.h"
-#include "DebugLogger.h"
-#include "Hash.h"
+#include "zeek/Expr.h"
+#include "zeek/Event.h"
+#include "zeek/Desc.h"
+#include "zeek/Frame.h"
+#include "zeek/Func.h"
+#include "zeek/RE.h"
+#include "zeek/Scope.h"
+#include "zeek/Stmt.h"
+#include "zeek/EventRegistry.h"
+#include "zeek/RunState.h"
+#include "zeek/Traverse.h"
+#include "zeek/Trigger.h"
+#include "zeek/IPAddr.h"
+#include "zeek/digest.h"
+#include "zeek/module_util.h"
+#include "zeek/DebugLogger.h"
+#include "zeek/Hash.h"
 
-#include "broker/Data.h"
+#include "zeek/broker/Data.h"
 
 namespace zeek::detail {
 
diff --git a/src/Expr.h b/src/Expr.h
index 1c55055f82..87aa2e0dd6 100644
--- a/src/Expr.h
+++ b/src/Expr.h
@@ -8,14 +8,14 @@
 #include <utility>
 #include <optional>
 
-#include "ZeekList.h"
-#include "IntrusivePtr.h"
-#include "Timer.h"
-#include "Type.h"
-#include "EventHandler.h"
-#include "TraverseTypes.h"
-#include "Val.h"
-#include "ZeekArgs.h"
+#include "zeek/ZeekList.h"
+#include "zeek/IntrusivePtr.h"
+#include "zeek/Timer.h"
+#include "zeek/Type.h"
+#include "zeek/EventHandler.h"
+#include "zeek/TraverseTypes.h"
+#include "zeek/Val.h"
+#include "zeek/ZeekArgs.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(Frame, zeek::detail);
 ZEEK_FORWARD_DECLARE_NAMESPACED(Scope, zeek::detail);
diff --git a/src/File.cc b/src/File.cc
index b1227037aa..66b125fe16 100644
--- a/src/File.cc
+++ b/src/File.cc
@@ -1,7 +1,7 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
-#include "File.h"
+#include "zeek/File.h"
 
 #include <sys/types.h>
 #ifdef TIME_WITH_SYS_TIME
@@ -21,15 +21,15 @@
 
 #include <algorithm>
 
-#include "Attr.h"
-#include "Type.h"
-#include "Expr.h"
-#include "NetVar.h"
-#include "RunState.h"
-#include "Event.h"
-#include "Reporter.h"
-#include "Desc.h"
-#include "Var.h"
+#include "zeek/Attr.h"
+#include "zeek/Type.h"
+#include "zeek/Expr.h"
+#include "zeek/NetVar.h"
+#include "zeek/RunState.h"
+#include "zeek/Event.h"
+#include "zeek/Reporter.h"
+#include "zeek/Desc.h"
+#include "zeek/Var.h"
 
 namespace zeek {
 
diff --git a/src/File.h b/src/File.h
index 8029e94d0b..a19d1f2aa1 100644
--- a/src/File.h
+++ b/src/File.h
@@ -2,19 +2,19 @@
 
 #pragma once
 
+#include <fcntl.h>
+
 #include <list>
 #include <string>
 #include <utility>
 
-#include <fcntl.h>
-
 #ifdef NEED_KRB5_H
 #include <krb5.h>
 #endif // NEED_KRB5_H
 
-#include "Obj.h"
-#include "IntrusivePtr.h"
-#include "util.h"
+#include "zeek/Obj.h"
+#include "zeek/IntrusivePtr.h"
+#include "zeek/util.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(PrintStmt, zeek::detail);
 ZEEK_FORWARD_DECLARE_NAMESPACED(Attributes, zeek::detail);
diff --git a/src/Flare.cc b/src/Flare.cc
index 3c8013e632..9d416d7d2b 100644
--- a/src/Flare.cc
+++ b/src/Flare.cc
@@ -1,11 +1,13 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "Flare.h"
-#include "Reporter.h"
+#include "zeek/Flare.h"
+
 #include <unistd.h>
 #include <fcntl.h>
 #include <errno.h>
 
+#include "zeek/Reporter.h"
+
 namespace zeek::detail {
 
 Flare::Flare()
diff --git a/src/Flare.h b/src/Flare.h
index 3fa92a6cae..48d499b0d4 100644
--- a/src/Flare.h
+++ b/src/Flare.h
@@ -2,7 +2,7 @@
 
 #pragma once
 
-#include "Pipe.h"
+#include "zeek/Pipe.h"
 
 namespace zeek::detail {
 
diff --git a/src/Frag.cc b/src/Frag.cc
index b2a7fd7aaa..608b6041f2 100644
--- a/src/Frag.cc
+++ b/src/Frag.cc
@@ -2,13 +2,13 @@
 
 #include "zeek-config.h"
 
-#include "Frag.h"
-#include "Hash.h"
-#include "IP.h"
-#include "NetVar.h"
-#include "Sessions.h"
-#include "Reporter.h"
-#include "RunState.h"
+#include "zeek/Frag.h"
+#include "zeek/Hash.h"
+#include "zeek/IP.h"
+#include "zeek/NetVar.h"
+#include "zeek/Sessions.h"
+#include "zeek/Reporter.h"
+#include "zeek/RunState.h"
 
 constexpr uint32_t MIN_ACCEPTABLE_FRAG_SIZE = 64;
 constexpr uint32_t MAX_ACCEPTABLE_FRAG_SIZE = 64000;
diff --git a/src/Frag.h b/src/Frag.h
index 62158982b7..b9a2ad7656 100644
--- a/src/Frag.h
+++ b/src/Frag.h
@@ -2,14 +2,13 @@
 
 #pragma once
 
-#include "util.h" // for bro_uint_t
-#include "IPAddr.h"
-#include "Reassem.h"
-#include "Timer.h"
-
+#include <sys/types.h> // for u_char
 #include <tuple>
 
-#include <sys/types.h> // for u_char
+#include "zeek/util.h" // for bro_uint_t
+#include "zeek/IPAddr.h"
+#include "zeek/Reassem.h"
+#include "zeek/Timer.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(NetSessions, zeek);
 ZEEK_FORWARD_DECLARE_NAMESPACED(IP_Hdr, zeek);
diff --git a/src/Frame.cc b/src/Frame.cc
index 67a42c0163..6694b507fe 100644
--- a/src/Frame.cc
+++ b/src/Frame.cc
@@ -1,15 +1,15 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "Frame.h"
+#include "zeek/Frame.h"
 
 #include <broker/error.hh>
-#include "broker/Data.h"
 
-#include "Func.h"
-#include "Desc.h"
-#include "Trigger.h"
-#include "Val.h"
-#include "ID.h"
+#include "zeek/broker/Data.h"
+#include "zeek/Func.h"
+#include "zeek/Desc.h"
+#include "zeek/Trigger.h"
+#include "zeek/Val.h"
+#include "zeek/ID.h"
 
 std::vector<zeek::detail::Frame*> g_frame_stack;
 
diff --git a/src/Frame.h b/src/Frame.h
index 6dbe069d2e..e78bdcf492 100644
--- a/src/Frame.h
+++ b/src/Frame.h
@@ -2,11 +2,6 @@
 
 #pragma once
 
-#include "ZeekList.h" // for typedef val_list
-#include "Obj.h"
-#include "IntrusivePtr.h"
-#include "ZeekArgs.h"
-
 #include <unordered_map>
 #include <string>
 #include <utility>
@@ -16,6 +11,11 @@
 #include <broker/data.hh>
 #include <broker/expected.hh>
 
+#include "zeek/ZeekList.h" // for typedef val_list
+#include "zeek/Obj.h"
+#include "zeek/IntrusivePtr.h"
+#include "zeek/ZeekArgs.h"
+
 ZEEK_FORWARD_DECLARE_NAMESPACED(CallExpr, zeek::detail);
 ZEEK_FORWARD_DECLARE_NAMESPACED(Trigger, zeek::detail::trigger);
 
diff --git a/src/Func.cc b/src/Func.cc
index f947f176d2..0062dab5ad 100644
--- a/src/Func.cc
+++ b/src/Func.cc
@@ -2,7 +2,7 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
-#include "Func.h"
+#include "zeek/Func.h"
 
 #include <sys/types.h>
 #include <sys/stat.h>
@@ -33,27 +33,27 @@
 
 #include <broker/error.hh>
 
-#include "Base64.h"
-#include "Debug.h"
-#include "Desc.h"
-#include "Expr.h"
-#include "Stmt.h"
-#include "Scope.h"
-#include "RunState.h"
-#include "NetVar.h"
-#include "File.h"
-#include "Frame.h"
-#include "Var.h"
-#include "analyzer/protocol/login/Login.h"
-#include "Sessions.h"
-#include "RE.h"
-#include "Event.h"
-#include "Traverse.h"
-#include "Reporter.h"
-#include "plugin/Manager.h"
-#include "module_util.h"
-#include "iosource/PktSrc.h"
-#include "iosource/PktDumper.h"
+#include "zeek/Base64.h"
+#include "zeek/Debug.h"
+#include "zeek/Desc.h"
+#include "zeek/Expr.h"
+#include "zeek/Stmt.h"
+#include "zeek/Scope.h"
+#include "zeek/RunState.h"
+#include "zeek/NetVar.h"
+#include "zeek/File.h"
+#include "zeek/Frame.h"
+#include "zeek/Var.h"
+#include "zeek/analyzer/protocol/login/Login.h"
+#include "zeek/Sessions.h"
+#include "zeek/RE.h"
+#include "zeek/Event.h"
+#include "zeek/Traverse.h"
+#include "zeek/Reporter.h"
+#include "zeek/plugin/Manager.h"
+#include "zeek/module_util.h"
+#include "zeek/iosource/PktSrc.h"
+#include "zeek/iosource/PktDumper.h"
 
 #include "zeek.bif.func_h"
 #include "stats.bif.func_h"
diff --git a/src/Func.h b/src/Func.h
index 110ce6300d..72c529942e 100644
--- a/src/Func.h
+++ b/src/Func.h
@@ -9,13 +9,13 @@
 #include <tuple>
 #include <type_traits>
 
-#include "ZeekList.h"
-#include "Obj.h"
-#include "IntrusivePtr.h"
-#include "Type.h" /* for function_flavor */
-#include "TraverseTypes.h"
-#include "ZeekArgs.h"
-#include "BifReturnVal.h"
+#include "zeek/ZeekList.h"
+#include "zeek/Obj.h"
+#include "zeek/IntrusivePtr.h"
+#include "zeek/Type.h" /* for function_flavor */
+#include "zeek/TraverseTypes.h"
+#include "zeek/ZeekArgs.h"
+#include "zeek/BifReturnVal.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(Scope, zeek::detail);
 ZEEK_FORWARD_DECLARE_NAMESPACED(Val, zeek);
diff --git a/src/Hash.cc b/src/Hash.cc
index 9a80556997..1fcd320b2b 100644
--- a/src/Hash.cc
+++ b/src/Hash.cc
@@ -1,18 +1,19 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
+#include "zeek/Hash.h"
+
+#include <highwayhash/sip_hash.h>
+#include <highwayhash/highwayhash_target.h>
+#include <highwayhash/instruction_sets.h>
+
+#include "zeek/digest.h"
+#include "zeek/Reporter.h"
+#include "zeek/ZeekString.h"
+#include "zeek/Val.h" // needed for const.bif
 
-#include "Hash.h"
-#include "digest.h"
-#include "Reporter.h"
-#include "ZeekString.h"
-#include "Val.h" // needed for const.bif
 #include "const.bif.netvar_h"
 
-#include "highwayhash/sip_hash.h"
-#include "highwayhash/highwayhash_target.h"
-#include "highwayhash/instruction_sets.h"
-
 namespace zeek::detail {
 
 alignas(32) uint64_t KeyedHash::shared_highwayhash_key[4];
diff --git a/src/Hash.h b/src/Hash.h
index c2b42f9b8c..91f2bcf874 100644
--- a/src/Hash.h
+++ b/src/Hash.h
@@ -19,12 +19,12 @@
 
 #pragma once
 
-#include "util.h" // for bro_int_t
-
 #include <stdlib.h>
 
+#include "zeek/util.h" // for bro_int_t
+
 // to allow bro_md5_hmac access to the hmac seed
-#include "ZeekArgs.h"
+#include "zeek/ZeekArgs.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(Frame, zeek::detail);
 ZEEK_FORWARD_DECLARE_NAMESPACED(BifReturnVal, zeek::detail);
diff --git a/src/ID.cc b/src/ID.cc
index 9030671c2e..7341f4782b 100644
--- a/src/ID.cc
+++ b/src/ID.cc
@@ -2,23 +2,23 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
+#include "zeek/ID.h"
 
-#include "ID.h"
-#include "Attr.h"
-#include "Desc.h"
-#include "Expr.h"
-#include "Dict.h"
-#include "EventRegistry.h"
-#include "Func.h"
-#include "Scope.h"
-#include "Type.h"
-#include "File.h"
-#include "Traverse.h"
-#include "Val.h"
-#include "zeekygen/Manager.h"
-#include "zeekygen/IdentifierInfo.h"
-#include "zeekygen/ScriptInfo.h"
-#include "module_util.h"
+#include "zeek/Attr.h"
+#include "zeek/Desc.h"
+#include "zeek/Expr.h"
+#include "zeek/Dict.h"
+#include "zeek/EventRegistry.h"
+#include "zeek/Func.h"
+#include "zeek/Scope.h"
+#include "zeek/Type.h"
+#include "zeek/File.h"
+#include "zeek/Traverse.h"
+#include "zeek/Val.h"
+#include "zeek/zeekygen/Manager.h"
+#include "zeek/zeekygen/IdentifierInfo.h"
+#include "zeek/zeekygen/ScriptInfo.h"
+#include "zeek/module_util.h"
 
 namespace zeek {
 
diff --git a/src/ID.h b/src/ID.h
index e310b14116..21fbff3773 100644
--- a/src/ID.h
+++ b/src/ID.h
@@ -2,17 +2,17 @@
 
 #pragma once
 
-#include "IntrusivePtr.h"
-#include "Obj.h"
-#include "Attr.h"
-#include "Notifier.h"
-#include "TraverseTypes.h"
-
 #include <map>
 #include <string>
 #include <string_view>
 #include <vector>
 
+#include "zeek/IntrusivePtr.h"
+#include "zeek/Obj.h"
+#include "zeek/Attr.h"
+#include "zeek/Notifier.h"
+#include "zeek/TraverseTypes.h"
+
 ZEEK_FORWARD_DECLARE_NAMESPACED(Func, zeek);
 ZEEK_FORWARD_DECLARE_NAMESPACED(Val, zeek);
 ZEEK_FORWARD_DECLARE_NAMESPACED(RecordType, zeek);
diff --git a/src/IP.cc b/src/IP.cc
index 3d19bbcda1..e6fa9ad9a8 100644
--- a/src/IP.cc
+++ b/src/IP.cc
@@ -1,17 +1,17 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "IP.h"
+#include "zeek/IP.h"
 
 #include <sys/types.h>
 #include <netinet/in.h>
 #include <netinet/icmp6.h>
 
-#include "IPAddr.h"
-#include "Type.h"
-#include "Val.h"
-#include "Var.h"
-#include "ZeekString.h"
-#include "Reporter.h"
+#include "zeek/IPAddr.h"
+#include "zeek/Type.h"
+#include "zeek/Val.h"
+#include "zeek/Var.h"
+#include "zeek/ZeekString.h"
+#include "zeek/Reporter.h"
 
 namespace zeek {
 
diff --git a/src/IP.h b/src/IP.h
index cb012a434a..12704d3241 100644
--- a/src/IP.h
+++ b/src/IP.h
@@ -14,7 +14,7 @@
 
 #include <vector>
 
-#include "IntrusivePtr.h"
+#include "zeek/IntrusivePtr.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(IPAddr, zeek);
 ZEEK_FORWARD_DECLARE_NAMESPACED(RecordVal, zeek);
diff --git a/src/IPAddr.cc b/src/IPAddr.cc
index 42df210949..d269ccf944 100644
--- a/src/IPAddr.cc
+++ b/src/IPAddr.cc
@@ -3,14 +3,14 @@
 #include <cstdlib>
 #include <string>
 #include <vector>
-#include "IPAddr.h"
-#include "Reporter.h"
-#include "ZeekString.h"
-#include "Conn.h"
-#include "Hash.h"
-#include "bro_inet_ntop.h"
 
-#include "analyzer/Manager.h"
+#include "zeek/IPAddr.h"
+#include "zeek/Reporter.h"
+#include "zeek/ZeekString.h"
+#include "zeek/Conn.h"
+#include "zeek/Hash.h"
+#include "zeek/bro_inet_ntop.h"
+#include "zeek/analyzer/Manager.h"
 
 namespace zeek {
 
diff --git a/src/IPAddr.h b/src/IPAddr.h
index 73d3b5d2cd..01f6a5c847 100644
--- a/src/IPAddr.h
+++ b/src/IPAddr.h
@@ -8,7 +8,7 @@
 #include <string>
 #include <memory>
 
-#include "threading/SerialTypes.h"
+#include "zeek/threading/SerialTypes.h"
 
 namespace zeek { class String; }
 using BroString [[deprecated("Remove in v4.1. Use zeek::String instead.")]] = zeek::String;
diff --git a/src/IntSet.cc b/src/IntSet.cc
index 95167daa9d..0079fdf7b4 100644
--- a/src/IntSet.cc
+++ b/src/IntSet.cc
@@ -1,12 +1,11 @@
 #include "zeek-config.h"
+#include "zeek/IntSet.h"
 
 #ifdef HAVE_MEMORY_H
 #include <memory.h>
 #endif
 #include <stdlib.h>
 
-#include "IntSet.h"
-
 namespace zeek::detail {
 
 void IntSet::Expand(unsigned int i)
diff --git a/src/List.cc b/src/List.cc
index 375d0c21a0..f527332b7d 100644
--- a/src/List.cc
+++ b/src/List.cc
@@ -1,5 +1,5 @@
-#include <List.h>
-#include <3rdparty/doctest.h>
+#include "zeek/List.h"
+#include "zeek/3rdparty/doctest.h"
 
 TEST_CASE("list construction")
 	{
diff --git a/src/List.h b/src/List.h
index 7cbbe6a731..d8a9ec2f1b 100644
--- a/src/List.h
+++ b/src/List.h
@@ -24,7 +24,7 @@
 #include <iterator>
 #include <utility>
 #include <cassert>
-#include "util.h"
+#include "zeek/util.h"
 
 namespace zeek {
 
diff --git a/src/NFA.cc b/src/NFA.cc
index e9f1a6e5bc..6843a2cd4e 100644
--- a/src/NFA.cc
+++ b/src/NFA.cc
@@ -1,14 +1,14 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
-
-#include "NFA.h"
-#include "Desc.h"
-#include "EquivClass.h"
-#include "IntSet.h"
+#include "zeek/NFA.h"
 
 #include <algorithm>
 
+#include "zeek/Desc.h"
+#include "zeek/EquivClass.h"
+#include "zeek/IntSet.h"
+
 namespace zeek::detail {
 
 static int nfa_state_id = 0;
diff --git a/src/NFA.h b/src/NFA.h
index 1f5915ba66..d51cf60c1a 100644
--- a/src/NFA.h
+++ b/src/NFA.h
@@ -2,8 +2,8 @@
 
 #pragma once
 
-#include "Obj.h"
-#include "List.h"
+#include "zeek/Obj.h"
+#include "zeek/List.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(CCL, zeek::detail);
 ZEEK_FORWARD_DECLARE_NAMESPACED(EquivClass, zeek::detail);
diff --git a/src/Net.h b/src/Net.h
index 864ff3d757..f61aeb01d8 100644
--- a/src/Net.h
+++ b/src/Net.h
@@ -1,4 +1,4 @@
 #warning "Net.h is deprecated and will be removed in v4.1. Use RunState.h and/or ScannedFile.h instead."
 
-#include "RunState.h"
-#include "ScannedFile.h"
+#include "zeek/RunState.h"
+#include "zeek/ScannedFile.h"
diff --git a/src/NetVar.cc b/src/NetVar.cc
index 02c83eb267..ff0bcf57cd 100644
--- a/src/NetVar.cc
+++ b/src/NetVar.cc
@@ -2,11 +2,11 @@
 
 #include "zeek-config.h"
 
-#include "NetVar.h"
-#include "Var.h"
-#include "EventHandler.h"
-#include "Val.h"
-#include "ID.h"
+#include "zeek/NetVar.h"
+#include "zeek/Var.h"
+#include "zeek/EventHandler.h"
+#include "zeek/Val.h"
+#include "zeek/ID.h"
 
 zeek::RecordType* conn_id;
 zeek::RecordType* endpoint;
diff --git a/src/NetVar.h b/src/NetVar.h
index 3c9fa28626..19527fcc60 100644
--- a/src/NetVar.h
+++ b/src/NetVar.h
@@ -2,9 +2,9 @@
 
 #pragma once
 
-#include "Val.h"
-#include "EventRegistry.h"
-#include "Stats.h"
+#include "zeek/Val.h"
+#include "zeek/EventRegistry.h"
+#include "zeek/Stats.h"
 
 namespace zeek::detail {
 
diff --git a/src/Notifier.cc b/src/Notifier.cc
index 7a12e67ddc..c225fbd451 100644
--- a/src/Notifier.cc
+++ b/src/Notifier.cc
@@ -1,10 +1,10 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "Notifier.h"
-#include "DebugLogger.h"
-
 #include <set>
 
+#include "zeek/Notifier.h"
+#include "zeek/DebugLogger.h"
+
 zeek::notifier::detail::Registry zeek::notifier::detail::registry;
 zeek::notifier::detail::Registry& notifier::registry = zeek::notifier::detail::registry;
 
diff --git a/src/Obj.cc b/src/Obj.cc
index ffafae0dd1..70bdebb3a0 100644
--- a/src/Obj.cc
+++ b/src/Obj.cc
@@ -1,14 +1,14 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
-#include "Obj.h"
+#include "zeek/Obj.h"
 
 #include <stdlib.h>
 
-#include "Desc.h"
-#include "Func.h"
-#include "File.h"
-#include "plugin/Manager.h"
+#include "zeek/Desc.h"
+#include "zeek/Func.h"
+#include "zeek/File.h"
+#include "zeek/plugin/Manager.h"
 
 namespace zeek {
 namespace detail {
diff --git a/src/OpaqueVal.cc b/src/OpaqueVal.cc
index 87e23c9f11..8650235645 100644
--- a/src/OpaqueVal.cc
+++ b/src/OpaqueVal.cc
@@ -1,20 +1,21 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
+#include "zeek/OpaqueVal.h"
+
 #include <memory>
 
-#include "OpaqueVal.h"
-#include "CompHash.h"
-#include "NetVar.h"
-#include "Reporter.h"
-#include "Scope.h"
-#include "Desc.h"
-#include "Var.h"
-#include "probabilistic/BloomFilter.h"
-#include "probabilistic/CardinalityCounter.h"
-
 #include <broker/data.hh>
 #include <broker/error.hh>
 
+#include "zeek/CompHash.h"
+#include "zeek/NetVar.h"
+#include "zeek/Reporter.h"
+#include "zeek/Scope.h"
+#include "zeek/Desc.h"
+#include "zeek/Var.h"
+#include "zeek/probabilistic/BloomFilter.h"
+#include "zeek/probabilistic/CardinalityCounter.h"
+
 namespace zeek {
 
 // Helper to retrieve a broker value out of a broker::vector at a specified
diff --git a/src/OpaqueVal.h b/src/OpaqueVal.h
index 91bd0bd36f..3f9cfac2ff 100644
--- a/src/OpaqueVal.h
+++ b/src/OpaqueVal.h
@@ -2,15 +2,14 @@
 
 #pragma once
 
-#include "IntrusivePtr.h"
-#include "RandTest.h"
-#include "Val.h"
-#include "digest.h"
-#include "paraglob/paraglob.h"
-
-#include <broker/expected.hh>
-
 #include <sys/types.h> // for u_char
+#include <broker/expected.hh>
+#include <paraglob/paraglob.h>
+
+#include "zeek/IntrusivePtr.h"
+#include "zeek/RandTest.h"
+#include "zeek/Val.h"
+#include "zeek/digest.h"
 
 namespace broker { class data; }
 
diff --git a/src/Options.cc b/src/Options.cc
index 951c55831b..a81e2a8754 100644
--- a/src/Options.cc
+++ b/src/Options.cc
@@ -2,10 +2,7 @@
 
 #include "zeek-config.h"
 
-#include "Options.h"
-
-#include <algorithm>
-#include <sstream>
+#include "zeek/Options.h"
 
 #include <unistd.h>
 
@@ -13,8 +10,11 @@
 #include <getopt.h>
 #endif
 
-#include "bsd-getopt-long.h"
-#include "logging/writers/ascii/Ascii.h"
+#include <algorithm>
+#include <sstream>
+
+#include "zeek/bsd-getopt-long.h"
+#include "zeek/logging/writers/ascii/Ascii.h"
 
 namespace zeek {
 
@@ -203,7 +203,7 @@ Options parse_cmdline(int argc, char** argv)
 			if ( i < argc )
 				{
 				// If a script is invoked with Zeek as the interpreter, the arguments provided
-				// directly in the interpreter line of the script won't be broken apart in the 
+				// directly in the interpreter line of the script won't be broken apart in the
 				// argv on Linux so we split it up here.
 				if ( endsWith(argv[i], "--") && zeek_args.size() == 1 )
 					{
diff --git a/src/Options.h b/src/Options.h
index 3f949e675f..26c05104d5 100644
--- a/src/Options.h
+++ b/src/Options.h
@@ -6,7 +6,7 @@
 #include <string>
 #include <vector>
 
-#include "DNS_Mgr.h"
+#include "zeek/DNS_Mgr.h"
 
 namespace zeek {
 
diff --git a/src/PacketDumper.cc b/src/PacketDumper.cc
index 117b797d3b..a553b2613b 100644
--- a/src/PacketDumper.cc
+++ b/src/PacketDumper.cc
@@ -1,10 +1,11 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
-#include "PacketDumper.h"
-#include "Reporter.h"
-#include "util.h"
-#include "iosource/PktDumper.h"
+#include "zeek/PacketDumper.h"
+
+#include "zeek/Reporter.h"
+#include "zeek/util.h"
+#include "zeek/iosource/PktDumper.h"
 
 namespace zeek::detail {
 
diff --git a/src/PacketDumper.h b/src/PacketDumper.h
index 2065dc2ed3..edf0eb834c 100644
--- a/src/PacketDumper.h
+++ b/src/PacketDumper.h
@@ -4,9 +4,8 @@
 
 #pragma once
 
-#include <pcap.h>
-
 #include <sys/types.h> // for u_char
+#include <pcap.h>
 
 namespace zeek::detail {
 
diff --git a/src/PacketFilter.cc b/src/PacketFilter.cc
index d2b24c8ecc..d17f008200 100644
--- a/src/PacketFilter.cc
+++ b/src/PacketFilter.cc
@@ -1,5 +1,5 @@
-#include "PacketFilter.h"
-#include "IP.h"
+#include "zeek/PacketFilter.h"
+#include "zeek/IP.h"
 
 namespace zeek::detail {
 
diff --git a/src/PacketFilter.h b/src/PacketFilter.h
index 22f8e47b47..04c31fe71e 100644
--- a/src/PacketFilter.h
+++ b/src/PacketFilter.h
@@ -3,8 +3,9 @@
 #pragma once
 
 #include <memory>
-#include "IPAddr.h"
-#include "PrefixTable.h"
+
+#include "zeek/IPAddr.h"
+#include "zeek/PrefixTable.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(IP_Hdr, zeek);
 ZEEK_FORWARD_DECLARE_NAMESPACED(Val, zeek);
diff --git a/src/Pipe.cc b/src/Pipe.cc
index ae710e4603..9055cca42a 100644
--- a/src/Pipe.cc
+++ b/src/Pipe.cc
@@ -1,12 +1,14 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "Pipe.h"
-#include "Reporter.h"
+#include "zeek/Pipe.h"
+
 #include <unistd.h>
 #include <fcntl.h>
 #include <errno.h>
 #include <cstdio>
 
+#include "zeek/Reporter.h"
+
 namespace zeek::detail {
 
 static void pipe_fail(int eno)
diff --git a/src/PolicyFile.cc b/src/PolicyFile.cc
index 283ca7daf0..d1b7dba5f5 100644
--- a/src/PolicyFile.cc
+++ b/src/PolicyFile.cc
@@ -1,19 +1,19 @@
 #include "zeek-config.h"
+#include "zeek/PolicyFile.h"
 
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <assert.h>
-
-#include <map>
 #include <stdio.h>
 #include <errno.h>
+
 #include <string>
 #include <vector>
+#include <map>
 
-#include "Debug.h"
-#include "util.h"
-#include "PolicyFile.h"
-#include "Reporter.h"
+#include "zeek/Debug.h"
+#include "zeek/util.h"
+#include "zeek/Reporter.h"
 
 using namespace std;
 
diff --git a/src/PrefixTable.cc b/src/PrefixTable.cc
index 684cbce435..5e9d900603 100644
--- a/src/PrefixTable.cc
+++ b/src/PrefixTable.cc
@@ -1,6 +1,6 @@
-#include "PrefixTable.h"
-#include "Reporter.h"
-#include "Val.h"
+#include "zeek/PrefixTable.h"
+#include "zeek/Reporter.h"
+#include "zeek/Val.h"
 
 namespace zeek::detail {
 
diff --git a/src/PrefixTable.h b/src/PrefixTable.h
index c6989378f7..50f134dbe0 100644
--- a/src/PrefixTable.h
+++ b/src/PrefixTable.h
@@ -1,12 +1,12 @@
 #pragma once
 
 extern "C" {
-	#include "patricia.h"
+	#include "zeek/patricia.h"
 }
 
 #include <list>
 
-#include "IPAddr.h"
+#include "zeek/IPAddr.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(Val, zeek);
 ZEEK_FORWARD_DECLARE_NAMESPACED(SubNetVal, zeek);
diff --git a/src/PriorityQueue.cc b/src/PriorityQueue.cc
index 461989074d..87b1e60e65 100644
--- a/src/PriorityQueue.cc
+++ b/src/PriorityQueue.cc
@@ -1,13 +1,13 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
+#include "zeek/PriorityQueue.h"
 
 #include <stdio.h>
 #include <stdlib.h>
 
-#include "PriorityQueue.h"
-#include "Reporter.h"
-#include "util.h"
+#include "zeek/Reporter.h"
+#include "zeek/util.h"
 
 namespace zeek::detail {
 
diff --git a/src/RE.cc b/src/RE.cc
index be9996fd76..50d8a72f11 100644
--- a/src/RE.cc
+++ b/src/RE.cc
@@ -1,16 +1,16 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
-#include "RE.h"
+#include "zeek/RE.h"
 
 #include <stdlib.h>
 #include <utility>
 
-#include "DFA.h"
-#include "CCL.h"
-#include "EquivClass.h"
-#include "Reporter.h"
-#include "ZeekString.h"
+#include "zeek/DFA.h"
+#include "zeek/CCL.h"
+#include "zeek/EquivClass.h"
+#include "zeek/Reporter.h"
+#include "zeek/ZeekString.h"
 
 zeek::detail::CCL* zeek::detail::curr_ccl = nullptr;
 zeek::detail::CCL*& curr_ccl = zeek::detail::curr_ccl;
diff --git a/src/RE.h b/src/RE.h
index 449a9a6e42..ebc6dc6b76 100644
--- a/src/RE.h
+++ b/src/RE.h
@@ -2,16 +2,16 @@
 
 #pragma once
 
-#include "List.h"
-#include "CCL.h"
-#include "EquivClass.h"
-
+#include <sys/types.h> // for u_char
+#include <ctype.h>
 #include <set>
 #include <map>
 #include <string>
 
-#include <sys/types.h> // for u_char
-#include <ctype.h>
+#include "zeek/List.h"
+#include "zeek/CCL.h"
+#include "zeek/EquivClass.h"
+
 typedef int (*cce_func)(int);
 
 namespace zeek { class String; }
diff --git a/src/RandTest.cc b/src/RandTest.cc
index 979c7c6673..c6dab11a78 100644
--- a/src/RandTest.cc
+++ b/src/RandTest.cc
@@ -12,7 +12,7 @@
 	Modified for Bro by Seth Hall - July 2010
 */
 
-#include "RandTest.h"
+#include "zeek/RandTest.h"
 
 #include <math.h>
 
diff --git a/src/Reassem.cc b/src/Reassem.cc
index cd30d7d090..6e4abad3cb 100644
--- a/src/Reassem.cc
+++ b/src/Reassem.cc
@@ -1,11 +1,11 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
-#include "Reassem.h"
+#include "zeek/Reassem.h"
 
 #include <algorithm>
 
-#include "Desc.h"
+#include "zeek/Desc.h"
 
 using std::min;
 
diff --git a/src/Reassem.h b/src/Reassem.h
index 0c713bf60a..c318ec4888 100644
--- a/src/Reassem.h
+++ b/src/Reassem.h
@@ -2,14 +2,13 @@
 
 #pragma once
 
-#include <map>
-
-#include "Obj.h"
-
 #include <assert.h>
 #include <string.h>
 #include <sys/types.h> // for u_char
 #include <cstdint>
+#include <map>
+
+#include "zeek/Obj.h"
 
 namespace zeek {
 
diff --git a/src/Reporter.cc b/src/Reporter.cc
index 0eabf67815..abea82b3ae 100644
--- a/src/Reporter.cc
+++ b/src/Reporter.cc
@@ -3,24 +3,24 @@
 //
 
 #include "zeek-config.h"
-#include "Reporter.h"
+#include "zeek/Reporter.h"
 
 #include <unistd.h>
 #include <syslog.h>
 
-#include "Desc.h"
-#include "Event.h"
-#include "Expr.h"
-#include "NetVar.h"
-#include "RunState.h"
-#include "Conn.h"
-#include "Timer.h"
-#include "ID.h"
-#include "EventHandler.h"
-#include "plugin/Plugin.h"
-#include "plugin/Manager.h"
-#include "input.h"
-#include "file_analysis/File.h"
+#include "zeek/Desc.h"
+#include "zeek/Event.h"
+#include "zeek/Expr.h"
+#include "zeek/NetVar.h"
+#include "zeek/RunState.h"
+#include "zeek/Conn.h"
+#include "zeek/Timer.h"
+#include "zeek/ID.h"
+#include "zeek/EventHandler.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/plugin/Manager.h"
+#include "zeek/input.h"
+#include "zeek/file_analysis/File.h"
 
 #ifdef SYSLOG_INT
 extern "C" {
diff --git a/src/Reporter.h b/src/Reporter.h
index e381a7a1bb..494bed79cd 100644
--- a/src/Reporter.h
+++ b/src/Reporter.h
@@ -12,8 +12,8 @@
 #include <unordered_set>
 #include <unordered_map>
 
-#include "ZeekList.h"
-#include "net_util.h"
+#include "zeek/ZeekList.h"
+#include "zeek/net_util.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(Analyzer, zeek, analyzer);
 ZEEK_FORWARD_DECLARE_NAMESPACED(File, zeek, file_analysis);
diff --git a/src/Rule.cc b/src/Rule.cc
index 17fe5236f9..925f12df99 100644
--- a/src/Rule.cc
+++ b/src/Rule.cc
@@ -1,9 +1,9 @@
 #include "zeek-config.h"
 
-#include "Rule.h"
-#include "RuleAction.h"
-#include "RuleCondition.h"
-#include "RuleMatcher.h"
+#include "zeek/Rule.h"
+#include "zeek/RuleAction.h"
+#include "zeek/RuleCondition.h"
+#include "zeek/RuleMatcher.h"
 
 namespace zeek::detail {
 
diff --git a/src/Rule.h b/src/Rule.h
index f982722422..37b6e4be18 100644
--- a/src/Rule.h
+++ b/src/Rule.h
@@ -1,13 +1,12 @@
 #pragma once
 
-#include "List.h"
-#include "Obj.h"
-
-#include <map>
-#include <string>
-
 #include <limits.h>
 #include <stdint.h>
+#include <map>
+#include <string>
+
+#include "zeek/List.h"
+#include "zeek/Obj.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(RuleCondition, zeek::detail);
 ZEEK_FORWARD_DECLARE_NAMESPACED(RuleAction, zeek::detail);
diff --git a/src/RuleAction.cc b/src/RuleAction.cc
index 4bca69bc6d..143c626ae7 100644
--- a/src/RuleAction.cc
+++ b/src/RuleAction.cc
@@ -1,16 +1,16 @@
-#include <string>
-using std::string;
-
 #include "zeek-config.h"
+#include "zeek/RuleAction.h"
 
-#include "RuleAction.h"
-#include "RuleMatcher.h"
-#include "Conn.h"
-#include "Event.h"
-#include "NetVar.h"
-#include "analyzer/protocol/pia/PIA.h"
+#include <string>
 
-#include "analyzer/Manager.h"
+#include "zeek/RuleMatcher.h"
+#include "zeek/Conn.h"
+#include "zeek/Event.h"
+#include "zeek/NetVar.h"
+#include "zeek/analyzer/protocol/pia/PIA.h"
+#include "zeek/analyzer/Manager.h"
+
+using std::string;
 
 namespace zeek::detail {
 
diff --git a/src/RuleAction.h b/src/RuleAction.h
index aedfc6eaed..40008e1aad 100644
--- a/src/RuleAction.h
+++ b/src/RuleAction.h
@@ -1,10 +1,9 @@
 #pragma once
 
-#include "analyzer/Tag.h"
-
-#include <string>
+#include "zeek/analyzer/Tag.h"
 
 #include <sys/types.h> // for u_char
+#include <string>
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(Rule, zeek::detail);
 ZEEK_FORWARD_DECLARE_NAMESPACED(RuleEndpointState, zeek::detail);
diff --git a/src/RuleCondition.cc b/src/RuleCondition.cc
index 789c94cd88..a9b33c0ebb 100644
--- a/src/RuleCondition.cc
+++ b/src/RuleCondition.cc
@@ -1,13 +1,13 @@
 #include "zeek-config.h"
 
-#include "RuleCondition.h"
-#include "RuleMatcher.h"
-#include "analyzer/protocol/tcp/TCP.h"
-#include "Reporter.h"
-#include "Scope.h"
-#include "Func.h"
-#include "ID.h"
-#include "Val.h"
+#include "zeek/RuleCondition.h"
+#include "zeek/RuleMatcher.h"
+#include "zeek/analyzer/protocol/tcp/TCP.h"
+#include "zeek/Reporter.h"
+#include "zeek/Scope.h"
+#include "zeek/Func.h"
+#include "zeek/ID.h"
+#include "zeek/Val.h"
 
 static inline bool is_established(const zeek::analyzer::tcp::TCP_Endpoint* e)
 	{
diff --git a/src/RuleCondition.h b/src/RuleCondition.h
index 2d44816832..966573d27d 100644
--- a/src/RuleCondition.h
+++ b/src/RuleCondition.h
@@ -2,7 +2,8 @@
 
 #include <stdint.h> // for u_char
 #include <sys/types.h> // for u_char
-#include "util.h"
+
+#include "zeek/util.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(RuleEndpointState, zeek::detail);
 ZEEK_FORWARD_DECLARE_NAMESPACED(Rule, zeek::detail);
diff --git a/src/RuleMatcher.cc b/src/RuleMatcher.cc
index 194ee2b4d6..5ebcbc6221 100644
--- a/src/RuleMatcher.cc
+++ b/src/RuleMatcher.cc
@@ -1,28 +1,28 @@
 
 #include "zeek-config.h"
-#include "RuleMatcher.h"
+#include "zeek/RuleMatcher.h"
 
 #include <algorithm>
 #include <functional>
 
-#include "RuleAction.h"
-#include "RuleCondition.h"
-#include "ZeekString.h"
-#include "ID.h"
-#include "IntrusivePtr.h"
-#include "IntSet.h"
-#include "IP.h"
-#include "analyzer/Analyzer.h"
-#include "DFA.h"
-#include "DebugLogger.h"
-#include "NetVar.h"
-#include "Scope.h"
-#include "File.h"
-#include "Reporter.h"
-#include "module_util.h"
-#include "Var.h"
-#include "IPAddr.h"
-#include "RunState.h"
+#include "zeek/RuleAction.h"
+#include "zeek/RuleCondition.h"
+#include "zeek/ZeekString.h"
+#include "zeek/ID.h"
+#include "zeek/IntrusivePtr.h"
+#include "zeek/IntSet.h"
+#include "zeek/IP.h"
+#include "zeek/analyzer/Analyzer.h"
+#include "zeek/DFA.h"
+#include "zeek/DebugLogger.h"
+#include "zeek/NetVar.h"
+#include "zeek/Scope.h"
+#include "zeek/File.h"
+#include "zeek/Reporter.h"
+#include "zeek/module_util.h"
+#include "zeek/Var.h"
+#include "zeek/IPAddr.h"
+#include "zeek/RunState.h"
 
 using namespace std;
 
diff --git a/src/RuleMatcher.h b/src/RuleMatcher.h
index d606492e88..2d8564f7aa 100644
--- a/src/RuleMatcher.h
+++ b/src/RuleMatcher.h
@@ -9,9 +9,9 @@
 #include <set>
 #include <string>
 
-#include "Rule.h"
-#include "RE.h"
-#include "CCL.h"
+#include "zeek/Rule.h"
+#include "zeek/RE.h"
+#include "zeek/CCL.h"
 
 //#define MATCHER_PRINT_STATS
 
diff --git a/src/RunState.cc b/src/RunState.cc
index f4faece9ee..50f7300d70 100644
--- a/src/RunState.cc
+++ b/src/RunState.cc
@@ -1,7 +1,7 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
-#include "RunState.h"
+#include "zeek/RunState.h"
 
 #include <sys/types.h>
 #ifdef TIME_WITH_SYS_TIME
@@ -20,23 +20,23 @@
 #include <unistd.h>
 
 extern "C" {
-#include "setsignal.h"
+#include "zeek/setsignal.h"
 };
 
-#include "NetVar.h"
-#include "Sessions.h"
-#include "Event.h"
-#include "Timer.h"
-#include "ID.h"
-#include "Reporter.h"
-#include "Scope.h"
-#include "Anon.h"
-#include "iosource/Manager.h"
-#include "iosource/PktSrc.h"
-#include "iosource/PktDumper.h"
-#include "plugin/Manager.h"
-#include "broker/Manager.h"
-#include "packet_analysis/Manager.h"
+#include "zeek/NetVar.h"
+#include "zeek/Sessions.h"
+#include "zeek/Event.h"
+#include "zeek/Timer.h"
+#include "zeek/ID.h"
+#include "zeek/Reporter.h"
+#include "zeek/Scope.h"
+#include "zeek/Anon.h"
+#include "zeek/iosource/Manager.h"
+#include "zeek/iosource/PktSrc.h"
+#include "zeek/iosource/PktDumper.h"
+#include "zeek/plugin/Manager.h"
+#include "zeek/broker/Manager.h"
+#include "zeek/packet_analysis/Manager.h"
 
 extern "C" {
 extern int select(int, fd_set *, fd_set *, fd_set *, struct timeval *);
diff --git a/src/ScannedFile.cc b/src/ScannedFile.cc
index 8d69666814..6d50747888 100644
--- a/src/ScannedFile.cc
+++ b/src/ScannedFile.cc
@@ -1,10 +1,10 @@
-#include "ScannedFile.h"
+#include "zeek/ScannedFile.h"
 
 #include <sys/errno.h>
 #include <limits.h> // for PATH_MAX
 
-#include "DebugLogger.h"
-#include "Reporter.h"
+#include "zeek/DebugLogger.h"
+#include "zeek/Reporter.h"
 
 namespace zeek::detail {
 
diff --git a/src/Scope.cc b/src/Scope.cc
index ab2c7583d6..05a8d82da9 100644
--- a/src/Scope.cc
+++ b/src/Scope.cc
@@ -2,13 +2,13 @@
 
 #include "zeek-config.h"
 
-#include "Scope.h"
-#include "Desc.h"
-#include "ID.h"
-#include "IntrusivePtr.h"
-#include "Val.h"
-#include "Reporter.h"
-#include "module_util.h"
+#include "zeek/Scope.h"
+#include "zeek/Desc.h"
+#include "zeek/ID.h"
+#include "zeek/IntrusivePtr.h"
+#include "zeek/Val.h"
+#include "zeek/Reporter.h"
+#include "zeek/module_util.h"
 
 namespace zeek::detail {
 
diff --git a/src/Scope.h b/src/Scope.h
index b0ef2a7d78..2509a32a36 100644
--- a/src/Scope.h
+++ b/src/Scope.h
@@ -7,10 +7,10 @@
 #include <string_view>
 #include <map>
 
-#include "Obj.h"
-#include "ZeekList.h"
-#include "IntrusivePtr.h"
-#include "TraverseTypes.h"
+#include "zeek/Obj.h"
+#include "zeek/ZeekList.h"
+#include "zeek/IntrusivePtr.h"
+#include "zeek/TraverseTypes.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(Type, zeek);
 using BroType [[deprecated("Remove in v4.1. Use zeek::Type instead.")]] = zeek::Type;
diff --git a/src/ScriptCoverageManager.cc b/src/ScriptCoverageManager.cc
index 6bc93c00c8..17f25eee83 100644
--- a/src/ScriptCoverageManager.cc
+++ b/src/ScriptCoverageManager.cc
@@ -1,17 +1,17 @@
-#include "ScriptCoverageManager.h"
+#include "zeek/ScriptCoverageManager.h"
 
+#include <sys/stat.h>
 #include <cstdio>
 #include <cstring>
 #include <sstream>
 #include <fstream>
 #include <utility>
 #include <algorithm>
-#include <sys/stat.h>
 
-#include "Stmt.h"
-#include "Desc.h"
-#include "Reporter.h"
-#include "util.h"
+#include "zeek/Stmt.h"
+#include "zeek/Desc.h"
+#include "zeek/Reporter.h"
+#include "zeek/util.h"
 
 using namespace std;
 
diff --git a/src/ScriptCoverageManager.h b/src/ScriptCoverageManager.h
index d1c206b36a..9a30d80469 100644
--- a/src/ScriptCoverageManager.h
+++ b/src/ScriptCoverageManager.h
@@ -5,7 +5,7 @@
 #include <list>
 #include <string>
 
-#include "util.h"
+#include "zeek/util.h"
 ZEEK_FORWARD_DECLARE_NAMESPACED(Stmt, zeek::detail);
 
 namespace zeek::detail {
diff --git a/src/SerializationFormat.cc b/src/SerializationFormat.cc
index 5ea915369c..ad9e2b26d9 100644
--- a/src/SerializationFormat.cc
+++ b/src/SerializationFormat.cc
@@ -1,11 +1,11 @@
-#include "SerializationFormat.h"
+#include "zeek/SerializationFormat.h"
 
 #include <ctype.h>
 
-#include "DebugLogger.h"
-#include "Reporter.h"
-#include "net_util.h"
-#include "IPAddr.h"
+#include "zeek/DebugLogger.h"
+#include "zeek/Reporter.h"
+#include "zeek/net_util.h"
+#include "zeek/IPAddr.h"
 
 namespace zeek::detail {
 
diff --git a/src/SerializationFormat.h b/src/SerializationFormat.h
index 584fcc9aba..84ac2be6be 100644
--- a/src/SerializationFormat.h
+++ b/src/SerializationFormat.h
@@ -4,8 +4,8 @@
 
 #include "zeek-config.h"
 
-#include <string>
 #include <stdint.h>
+#include <string>
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(IPAddr, zeek);
 ZEEK_FORWARD_DECLARE_NAMESPACED(IPPrefix, zeek);
diff --git a/src/Sessions.cc b/src/Sessions.cc
index 3f4e58a0ec..ba8231d369 100644
--- a/src/Sessions.cc
+++ b/src/Sessions.cc
@@ -1,8 +1,7 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-
 #include "zeek-config.h"
-#include "Sessions.h"
+#include "zeek/Sessions.h"
 
 #include <netinet/in.h>
 #include <arpa/inet.h>
@@ -10,27 +9,26 @@
 #include <stdlib.h>
 #include <unistd.h>
 
-#include "Desc.h"
-#include "RunState.h"
-#include "Event.h"
-#include "Timer.h"
-#include "NetVar.h"
-#include "Reporter.h"
+#include <pcap.h>
 
-#include "analyzer/protocol/icmp/ICMP.h"
-#include "analyzer/protocol/udp/UDP.h"
+#include "zeek/Desc.h"
+#include "zeek/RunState.h"
+#include "zeek/Event.h"
+#include "zeek/Timer.h"
+#include "zeek/NetVar.h"
+#include "zeek/Reporter.h"
+#include "zeek/RuleMatcher.h"
+#include "zeek/TunnelEncapsulation.h"
+
+#include "zeek/analyzer/protocol/icmp/ICMP.h"
+#include "zeek/analyzer/protocol/udp/UDP.h"
+#include "zeek/analyzer/protocol/stepping-stone/SteppingStone.h"
+#include "zeek/analyzer/Manager.h"
+
+#include "zeek/iosource/IOSource.h"
+#include "zeek/packet_analysis/Manager.h"
 
-#include "analyzer/protocol/stepping-stone/SteppingStone.h"
 #include "analyzer/protocol/stepping-stone/events.bif.h"
-#include "RuleMatcher.h"
-
-#include "TunnelEncapsulation.h"
-
-#include "analyzer/Manager.h"
-#include "iosource/IOSource.h"
-#include "packet_analysis/Manager.h"
-
-#include "pcap.h"
 
 // These represent NetBIOS services on ephemeral ports.  They're numbered
 // so that we can use a single int to hold either an actual TCP/UDP server
diff --git a/src/Sessions.h b/src/Sessions.h
index ad64d85a43..740590641f 100644
--- a/src/Sessions.h
+++ b/src/Sessions.h
@@ -2,15 +2,14 @@
 
 #pragma once
 
-#include "Frag.h"
-#include "PacketFilter.h"
-#include "NetVar.h"
-#include "analyzer/protocol/tcp/Stats.h"
-
+#include <sys/types.h> // for u_char
 #include <map>
 #include <utility>
 
-#include <sys/types.h> // for u_char
+#include "zeek/Frag.h"
+#include "zeek/PacketFilter.h"
+#include "zeek/NetVar.h"
+#include "zeek/analyzer/protocol/tcp/Stats.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(EncapsulationStack, zeek);
 ZEEK_FORWARD_DECLARE_NAMESPACED(Packet, zeek);
diff --git a/src/SmithWaterman.cc b/src/SmithWaterman.cc
index 607cf1ae5e..30613ff1ab 100644
--- a/src/SmithWaterman.cc
+++ b/src/SmithWaterman.cc
@@ -2,14 +2,14 @@
 
 #include "zeek-config.h"
 
-#include <algorithm>
 #include <ctype.h>
+#include <algorithm>
 
-#include "SmithWaterman.h"
-#include "Var.h"
-#include "util.h"
-#include "Reporter.h"
-#include "Val.h"
+#include "zeek/SmithWaterman.h"
+#include "zeek/Var.h"
+#include "zeek/util.h"
+#include "zeek/Reporter.h"
+#include "zeek/Val.h"
 
 namespace zeek::detail {
 
diff --git a/src/SmithWaterman.h b/src/SmithWaterman.h
index 97cc40f3bc..60b524f938 100644
--- a/src/SmithWaterman.h
+++ b/src/SmithWaterman.h
@@ -5,7 +5,7 @@
 #include <map>
 #include <vector>
 
-#include "ZeekString.h"
+#include "zeek/ZeekString.h"
 
 namespace zeek::detail {
 
diff --git a/src/Stats.cc b/src/Stats.cc
index fde7921aad..0265eb850e 100644
--- a/src/Stats.cc
+++ b/src/Stats.cc
@@ -1,19 +1,20 @@
-#include "Stats.h"
-#include "RuleMatcher.h"
-#include "Conn.h"
-#include "File.h"
-#include "Event.h"
-#include "RunState.h"
-#include "NetVar.h"
-#include "ID.h"
-#include "Sessions.h"
-#include "Scope.h"
-#include "DNS_Mgr.h"
-#include "Trigger.h"
-#include "threading/Manager.h"
-#include "broker/Manager.h"
-#include "input.h"
-#include "Func.h"
+#include "zeek/Stats.h"
+
+#include "zeek/RuleMatcher.h"
+#include "zeek/Conn.h"
+#include "zeek/File.h"
+#include "zeek/Event.h"
+#include "zeek/RunState.h"
+#include "zeek/NetVar.h"
+#include "zeek/ID.h"
+#include "zeek/Sessions.h"
+#include "zeek/Scope.h"
+#include "zeek/DNS_Mgr.h"
+#include "zeek/Trigger.h"
+#include "zeek/threading/Manager.h"
+#include "zeek/broker/Manager.h"
+#include "zeek/input.h"
+#include "zeek/Func.h"
 
 uint64_t zeek::detail::killed_by_inactivity = 0;
 uint64_t& killed_by_inactivity = zeek::detail::killed_by_inactivity;
diff --git a/src/Stmt.cc b/src/Stmt.cc
index cb3de6d2d7..d2b554f439 100644
--- a/src/Stmt.cc
+++ b/src/Stmt.cc
@@ -2,23 +2,24 @@
 
 #include "zeek-config.h"
 
-#include "Stmt.h"
+#include "zeek/Stmt.h"
+
+#include "zeek/CompHash.h"
+#include "zeek/Expr.h"
+#include "zeek/Event.h"
+#include "zeek/Frame.h"
+#include "zeek/File.h"
+#include "zeek/Reporter.h"
+#include "zeek/NetVar.h"
+#include "zeek/Scope.h"
+#include "zeek/Var.h"
+#include "zeek/Desc.h"
+#include "zeek/Debug.h"
+#include "zeek/Traverse.h"
+#include "zeek/Trigger.h"
+#include "zeek/IntrusivePtr.h"
+#include "zeek/logging/Manager.h"
 
-#include "CompHash.h"
-#include "Expr.h"
-#include "Event.h"
-#include "Frame.h"
-#include "File.h"
-#include "Reporter.h"
-#include "NetVar.h"
-#include "Scope.h"
-#include "Var.h"
-#include "Desc.h"
-#include "Debug.h"
-#include "Traverse.h"
-#include "Trigger.h"
-#include "IntrusivePtr.h"
-#include "logging/Manager.h"
 #include "logging/logging.bif.h"
 
 namespace zeek::detail {
diff --git a/src/Stmt.h b/src/Stmt.h
index e00e645b6f..acaed89cb4 100644
--- a/src/Stmt.h
+++ b/src/Stmt.h
@@ -2,16 +2,12 @@
 
 #pragma once
 
-// BRO statements.
-
-#include "ZeekList.h"
-#include "Dict.h"
-#include "ID.h"
-#include "Obj.h"
-
-#include "StmtEnums.h"
-
-#include "TraverseTypes.h"
+#include "zeek/ZeekList.h"
+#include "zeek/Dict.h"
+#include "zeek/ID.h"
+#include "zeek/Obj.h"
+#include "zeek/StmtEnums.h"
+#include "zeek/TraverseTypes.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(CompositeHash, zeek::detail);
 ZEEK_FORWARD_DECLARE_NAMESPACED(Frame, zeek::detail);
diff --git a/src/Tag.cc b/src/Tag.cc
index 9878a903f5..bec564c2ed 100644
--- a/src/Tag.cc
+++ b/src/Tag.cc
@@ -1,7 +1,7 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "Tag.h"
-#include "Val.h"
+#include "zeek/Tag.h"
+#include "zeek/Val.h"
 
 namespace zeek {
 
diff --git a/src/Tag.h b/src/Tag.h
index a7b856eeff..0f11349dc3 100644
--- a/src/Tag.h
+++ b/src/Tag.h
@@ -7,8 +7,8 @@
 #include <stdint.h>
 #include <string>
 
-#include "IntrusivePtr.h"
-#include "util.h"
+#include "zeek/IntrusivePtr.h"
+#include "zeek/util.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(EnumVal, zeek);
 ZEEK_FORWARD_DECLARE_NAMESPACED(EnumType, zeek);
diff --git a/src/Timer.cc b/src/Timer.cc
index 9fb0376323..6706f8adc2 100644
--- a/src/Timer.cc
+++ b/src/Timer.cc
@@ -1,15 +1,15 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
+#include "zeek/Timer.h"
 
-#include "util.h"
-#include "Timer.h"
-#include "Desc.h"
-#include "RunState.h"
-#include "NetVar.h"
-#include "broker/Manager.h"
-#include "iosource/Manager.h"
-#include "iosource/PktSrc.h"
+#include "zeek/util.h"
+#include "zeek/Desc.h"
+#include "zeek/RunState.h"
+#include "zeek/NetVar.h"
+#include "zeek/broker/Manager.h"
+#include "zeek/iosource/Manager.h"
+#include "zeek/iosource/PktSrc.h"
 
 namespace zeek::detail {
 
diff --git a/src/Timer.h b/src/Timer.h
index 510102eddd..4c5739bed0 100644
--- a/src/Timer.h
+++ b/src/Timer.h
@@ -2,11 +2,11 @@
 
 #pragma once
 
-#include "PriorityQueue.h"
-#include "iosource/IOSource.h"
-
 #include <stdint.h>
 
+#include "zeek/PriorityQueue.h"
+#include "zeek/iosource/IOSource.h"
+
 ZEEK_FORWARD_DECLARE_NAMESPACED(ODesc, zeek);
 
 namespace zeek::detail {
diff --git a/src/Traverse.cc b/src/Traverse.cc
index b7c8b2592e..bb07fc1c0e 100644
--- a/src/Traverse.cc
+++ b/src/Traverse.cc
@@ -1,9 +1,9 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "Scope.h"
-#include "Traverse.h"
-#include "Stmt.h"
-#include "input.h"
+#include "zeek/Traverse.h"
+#include "zeek/Scope.h"
+#include "zeek/Stmt.h"
+#include "zeek/input.h"
 
 namespace zeek::detail {
 
diff --git a/src/Traverse.h b/src/Traverse.h
index 0cba88aa8e..e2cff0f701 100644
--- a/src/Traverse.h
+++ b/src/Traverse.h
@@ -2,7 +2,7 @@
 
 #pragma once
 
-#include "TraverseTypes.h"
+#include "zeek/TraverseTypes.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(Func, zeek);
 ZEEK_FORWARD_DECLARE_NAMESPACED(Scope, zeek::detail);
diff --git a/src/Trigger.cc b/src/Trigger.cc
index 697019670f..62355357b8 100644
--- a/src/Trigger.cc
+++ b/src/Trigger.cc
@@ -1,19 +1,18 @@
-#include "Trigger.h"
-
-#include <algorithm>
+#include "zeek/Trigger.h"
 
 #include <assert.h>
+#include <algorithm>
 
-#include "Traverse.h"
-#include "Expr.h"
-#include "Frame.h"
-#include "ID.h"
-#include "Val.h"
-#include "Stmt.h"
-#include "Reporter.h"
-#include "Desc.h"
-#include "DebugLogger.h"
-#include "iosource/Manager.h"
+#include "zeek/Traverse.h"
+#include "zeek/Expr.h"
+#include "zeek/Frame.h"
+#include "zeek/ID.h"
+#include "zeek/Val.h"
+#include "zeek/Stmt.h"
+#include "zeek/Reporter.h"
+#include "zeek/Desc.h"
+#include "zeek/DebugLogger.h"
+#include "zeek/iosource/Manager.h"
 
 using namespace zeek::detail;
 using namespace zeek::detail::trigger;
diff --git a/src/Trigger.h b/src/Trigger.h
index 5a7839a7c4..255865658b 100644
--- a/src/Trigger.h
+++ b/src/Trigger.h
@@ -4,11 +4,11 @@
 #include <vector>
 #include <map>
 
-#include "Obj.h"
-#include "Notifier.h"
-#include "iosource/IOSource.h"
-#include "util.h"
-#include "IntrusivePtr.h"
+#include "zeek/Obj.h"
+#include "zeek/Notifier.h"
+#include "zeek/iosource/IOSource.h"
+#include "zeek/util.h"
+#include "zeek/IntrusivePtr.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(ODesc, zeek);
 ZEEK_FORWARD_DECLARE_NAMESPACED(Val, zeek);
diff --git a/src/TunnelEncapsulation.cc b/src/TunnelEncapsulation.cc
index aaa744d9e3..831ea91f9f 100644
--- a/src/TunnelEncapsulation.cc
+++ b/src/TunnelEncapsulation.cc
@@ -1,8 +1,8 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "TunnelEncapsulation.h"
-#include "util.h"
-#include "Conn.h"
+#include "zeek/TunnelEncapsulation.h"
+#include "zeek/util.h"
+#include "zeek/Conn.h"
 
 namespace zeek {
 
diff --git a/src/TunnelEncapsulation.h b/src/TunnelEncapsulation.h
index 06bb774e4a..ae7bbed3d2 100644
--- a/src/TunnelEncapsulation.h
+++ b/src/TunnelEncapsulation.h
@@ -6,10 +6,10 @@
 
 #include <vector>
 
-#include "NetVar.h"
-#include "IPAddr.h"
-#include "ID.h"
-#include "UID.h"
+#include "zeek/NetVar.h"
+#include "zeek/IPAddr.h"
+#include "zeek/ID.h"
+#include "zeek/UID.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(Connection, zeek);
 
diff --git a/src/Type.cc b/src/Type.cc
index 30e05805e3..86c8caaf59 100644
--- a/src/Type.cc
+++ b/src/Type.cc
@@ -1,25 +1,25 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
-
-#include "Type.h"
-#include "Attr.h"
-#include "Desc.h"
-#include "Expr.h"
-#include "Scope.h"
-#include "Val.h"
-#include "Var.h"
-#include "Reporter.h"
-#include "zeekygen/Manager.h"
-#include "zeekygen/IdentifierInfo.h"
-#include "zeekygen/ScriptInfo.h"
-#include "zeekygen/utils.h"
-#include "module_util.h"
+#include "zeek/Type.h"
 
 #include <string>
 #include <list>
 #include <map>
 
+#include "zeek/Attr.h"
+#include "zeek/Desc.h"
+#include "zeek/Expr.h"
+#include "zeek/Scope.h"
+#include "zeek/Val.h"
+#include "zeek/Var.h"
+#include "zeek/Reporter.h"
+#include "zeek/zeekygen/Manager.h"
+#include "zeek/zeekygen/IdentifierInfo.h"
+#include "zeek/zeekygen/ScriptInfo.h"
+#include "zeek/zeekygen/utils.h"
+#include "zeek/module_util.h"
+
 using namespace std;
 
 namespace zeek {
diff --git a/src/Type.h b/src/Type.h
index 52dc2264a5..8b92bded01 100644
--- a/src/Type.h
+++ b/src/Type.h
@@ -2,11 +2,6 @@
 
 #pragma once
 
-#include "Obj.h"
-#include "Attr.h"
-#include "ZeekList.h"
-#include "IntrusivePtr.h"
-
 #include <string>
 #include <set>
 #include <unordered_map>
@@ -14,6 +9,11 @@
 #include <list>
 #include <optional>
 
+#include "zeek/Obj.h"
+#include "zeek/Attr.h"
+#include "zeek/ZeekList.h"
+#include "zeek/IntrusivePtr.h"
+
 ZEEK_FORWARD_DECLARE_NAMESPACED(Val, zeek);
 ZEEK_FORWARD_DECLARE_NAMESPACED(EnumVal, zeek);
 ZEEK_FORWARD_DECLARE_NAMESPACED(TableVal, zeek);
diff --git a/src/UID.cc b/src/UID.cc
index 4184506fc7..2e73f0f3e2 100644
--- a/src/UID.cc
+++ b/src/UID.cc
@@ -1,11 +1,12 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "UID.h"
-#include "Reporter.h"
-#include "util.h"
+#include "zeek/UID.h"
 
 #include <cstdlib>
 
+#include "zeek/Reporter.h"
+#include "zeek/util.h"
+
 using namespace std;
 
 namespace zeek {
diff --git a/src/UID.h b/src/UID.h
index 29d2600424..19a9e408f0 100644
--- a/src/UID.h
+++ b/src/UID.h
@@ -5,7 +5,7 @@
 #include <string.h>
 #include <string>
 
-#include "util.h" // for bro_int_t
+#include "zeek/util.h" // for bro_int_t
 
 #define BRO_UID_LEN 2
 
diff --git a/src/Val.cc b/src/Val.cc
index c06db2a76e..bab9e447f9 100644
--- a/src/Val.cc
+++ b/src/Val.cc
@@ -1,7 +1,7 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
-#include "Val.h"
+#include "zeek/Val.h"
 
 #include <sys/types.h>
 #include <sys/param.h>
@@ -16,31 +16,31 @@
 #include <cmath>
 #include <set>
 
-#include "Attr.h"
-#include "ZeekString.h"
-#include "CompHash.h"
-#include "Dict.h"
-#include "RunState.h"
-#include "File.h"
-#include "Func.h"
-#include "Desc.h"
-#include "IntrusivePtr.h"
-#include "ID.h"
-#include "RE.h"
-#include "Scope.h"
-#include "NetVar.h"
-#include "Expr.h"
-#include "PrefixTable.h"
-#include "Conn.h"
-#include "Reporter.h"
-#include "IPAddr.h"
-#include "ID.h"
+#include "zeek/Attr.h"
+#include "zeek/ZeekString.h"
+#include "zeek/CompHash.h"
+#include "zeek/Dict.h"
+#include "zeek/RunState.h"
+#include "zeek/File.h"
+#include "zeek/Func.h"
+#include "zeek/Desc.h"
+#include "zeek/IntrusivePtr.h"
+#include "zeek/ID.h"
+#include "zeek/RE.h"
+#include "zeek/Scope.h"
+#include "zeek/NetVar.h"
+#include "zeek/Expr.h"
+#include "zeek/PrefixTable.h"
+#include "zeek/Conn.h"
+#include "zeek/Reporter.h"
+#include "zeek/IPAddr.h"
+#include "zeek/ID.h"
 
-#include "broker/Data.h"
-#include "broker/Store.h"
-#include "broker/Manager.h"
+#include "zeek/broker/Data.h"
+#include "zeek/broker/Store.h"
+#include "zeek/broker/Manager.h"
 
-#include "threading/formatters/JSON.h"
+#include "zeek/threading/formatters/JSON.h"
 
 using namespace std;
 
diff --git a/src/Val.h b/src/Val.h
index 104bbb2e97..ac9dbfce87 100644
--- a/src/Val.h
+++ b/src/Val.h
@@ -2,18 +2,17 @@
 
 #pragma once
 
-#include "IntrusivePtr.h"
-#include "Type.h"
-#include "Timer.h"
-#include "Notifier.h"
-#include "net_util.h"
-
+#include <sys/types.h> // for u_char
 #include <vector>
 #include <list>
 #include <array>
 #include <unordered_map>
 
-#include <sys/types.h> // for u_char
+#include "zeek/IntrusivePtr.h"
+#include "zeek/Type.h"
+#include "zeek/Timer.h"
+#include "zeek/Notifier.h"
+#include "zeek/net_util.h"
 
 // We have four different port name spaces: TCP, UDP, ICMP, and UNKNOWN.
 // We distinguish between them based on the bits specified in the *_PORT_MASK
@@ -911,7 +910,7 @@ public:
 	 * given address was found in the table. Otherwise returns false.
 	 * @param addr  The address to look for.
 	 * @return  Boolean value to indicate if addr is in the table or set. If
-	 * self is not a table[subnet]/set[subnet] an internal error will be 
+	 * self is not a table[subnet]/set[subnet] an internal error will be
 	 * generated and false will be returned.
 	 */
 	bool Contains(const IPAddr& addr) const;
diff --git a/src/Var.cc b/src/Var.cc
index a0adcb8f4f..e1b9826d56 100644
--- a/src/Var.cc
+++ b/src/Var.cc
@@ -1,21 +1,21 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
-#include "Var.h"
+#include "zeek/Var.h"
 
 #include <memory>
 
-#include "Val.h"
-#include "Expr.h"
-#include "Func.h"
-#include "IntrusivePtr.h"
-#include "Stmt.h"
-#include "Scope.h"
-#include "Reporter.h"
-#include "EventRegistry.h"
-#include "Traverse.h"
-#include "module_util.h"
-#include "ID.h"
+#include "zeek/Val.h"
+#include "zeek/Expr.h"
+#include "zeek/Func.h"
+#include "zeek/IntrusivePtr.h"
+#include "zeek/Stmt.h"
+#include "zeek/Scope.h"
+#include "zeek/Reporter.h"
+#include "zeek/EventRegistry.h"
+#include "zeek/Traverse.h"
+#include "zeek/module_util.h"
+#include "zeek/ID.h"
 
 namespace zeek::detail {
 
diff --git a/src/Var.h b/src/Var.h
index c6e9e3978a..4909d3268b 100644
--- a/src/Var.h
+++ b/src/Var.h
@@ -2,9 +2,9 @@
 
 #pragma once
 
-#include "IntrusivePtr.h"
-#include "ID.h"
-#include "Type.h"
+#include "zeek/IntrusivePtr.h"
+#include "zeek/ID.h"
+#include "zeek/Type.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(EventHandlerPtr, zeek);
 ZEEK_FORWARD_DECLARE_NAMESPACED(StringVal, zeek);
diff --git a/src/WeirdState.cc b/src/WeirdState.cc
index f94665a06d..a3c97353dc 100644
--- a/src/WeirdState.cc
+++ b/src/WeirdState.cc
@@ -1,6 +1,6 @@
-#include "WeirdState.h"
-#include "RunState.h"
-#include "util.h"
+#include "zeek/WeirdState.h"
+#include "zeek/RunState.h"
+#include "zeek/util.h"
 
 namespace zeek::detail {
 
diff --git a/src/ZeekArgs.cc b/src/ZeekArgs.cc
index c2bf61dad6..ed4a28c146 100644
--- a/src/ZeekArgs.cc
+++ b/src/ZeekArgs.cc
@@ -1,8 +1,8 @@
-#include "ZeekArgs.h"
-#include "Val.h"
-#include "Type.h"
-#include "ID.h"
-#include "Desc.h"
+#include "zeek/ZeekArgs.h"
+#include "zeek/Val.h"
+#include "zeek/Type.h"
+#include "zeek/ID.h"
+#include "zeek/Desc.h"
 
 namespace zeek {
 
diff --git a/src/ZeekArgs.h b/src/ZeekArgs.h
index 56f1371715..d272936b74 100644
--- a/src/ZeekArgs.h
+++ b/src/ZeekArgs.h
@@ -3,7 +3,7 @@
 #pragma once
 
 #include <vector>
-#include "ZeekList.h"
+#include "zeek/ZeekList.h"
 
 namespace zeek {
 
diff --git a/src/ZeekList.h b/src/ZeekList.h
index ef85f0ca5c..320a00811b 100644
--- a/src/ZeekList.h
+++ b/src/ZeekList.h
@@ -2,7 +2,7 @@
 
 #pragma once
 
-#include "List.h"
+#include "zeek/List.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(Val, zeek);
 ZEEK_FORWARD_DECLARE_NAMESPACED(Expr, zeek::detail);
diff --git a/src/ZeekString.cc b/src/ZeekString.cc
index 9b41ab28b4..fef930c1d1 100644
--- a/src/ZeekString.cc
+++ b/src/ZeekString.cc
@@ -1,16 +1,16 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
-#include "ZeekString.h"
+#include "zeek/ZeekString.h"
 
+#include <ctype.h>
 #include <algorithm>
 #include <iostream>
-#include <ctype.h>
 
-#include "Val.h"
-#include "ID.h"
-#include "Reporter.h"
-#include "util.h"
+#include "zeek/Val.h"
+#include "zeek/ID.h"
+#include "zeek/Reporter.h"
+#include "zeek/util.h"
 
 #ifdef DEBUG
 #define DEBUG_STR(msg) DBG_LOG(zeek::DBG_STRING, msg)
diff --git a/src/ZeekString.h b/src/ZeekString.h
index b6344ff10f..5392847d1e 100644
--- a/src/ZeekString.h
+++ b/src/ZeekString.h
@@ -4,12 +4,12 @@
 
 #include "zeek-config.h"
 
+#include <sys/types.h>
+
 #include <vector>
 #include <string>
 #include <iosfwd>
 
-#include <sys/types.h>
-
 // Forward declaration, for helper functions that convert (sub)string vectors
 // to and from policy-level representations.
 //
diff --git a/src/analyzer/Analyzer.cc b/src/analyzer/Analyzer.cc
index 131d0cd01f..4da05a1728 100644
--- a/src/analyzer/Analyzer.cc
+++ b/src/analyzer/Analyzer.cc
@@ -1,14 +1,14 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
+#include "zeek/analyzer/Analyzer.h"
+
 #include <algorithm>
+#include <binpac.h>
 
-#include "Analyzer.h"
-#include "Manager.h"
-#include "binpac.h"
-
-#include "analyzer/protocol/pia/PIA.h"
-#include "../ZeekString.h"
-#include "../Event.h"
+#include "zeek/analyzer/Manager.h"
+#include "zeek/analyzer/protocol/pia/PIA.h"
+#include "zeek/ZeekString.h"
+#include "zeek/Event.h"
 
 namespace zeek::analyzer {
 
diff --git a/src/analyzer/Analyzer.h b/src/analyzer/Analyzer.h
index e016469ab7..34950aee75 100644
--- a/src/analyzer/Analyzer.h
+++ b/src/analyzer/Analyzer.h
@@ -9,12 +9,12 @@
 #include <tuple>
 #include <type_traits>
 
-#include "Tag.h"
+#include "zeek/analyzer/Tag.h"
 
-#include "../Obj.h"
-#include "../EventHandler.h"
-#include "../Timer.h"
-#include "../IntrusivePtr.h"
+#include "zeek/Obj.h"
+#include "zeek/EventHandler.h"
+#include "zeek/Timer.h"
+#include "zeek/IntrusivePtr.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(Connection, zeek);
 ZEEK_FORWARD_DECLARE_NAMESPACED(Rule, zeek::detail);
diff --git a/src/analyzer/Component.cc b/src/analyzer/Component.cc
index 67757c10fc..fe3a866773 100644
--- a/src/analyzer/Component.cc
+++ b/src/analyzer/Component.cc
@@ -1,10 +1,10 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "Component.h"
-#include "Manager.h"
+#include "zeek/analyzer/Component.h"
 
-#include "../Desc.h"
-#include "../util.h"
+#include "zeek/analyzer/Manager.h"
+#include "zeek/Desc.h"
+#include "zeek/util.h"
 
 namespace zeek::analyzer {
 
diff --git a/src/analyzer/Component.h b/src/analyzer/Component.h
index 2a25738993..0f5f872374 100644
--- a/src/analyzer/Component.h
+++ b/src/analyzer/Component.h
@@ -2,12 +2,13 @@
 
 #pragma once
 
-#include "Tag.h"
-#include "plugin/Component.h"
-#include "plugin/TaggedComponent.h"
+#include "zeek-config.h"
 
-#include "../zeek-config.h"
-#include "../util.h"
+#include "zeek/analyzer/Tag.h"
+#include "zeek/plugin/Component.h"
+#include "zeek/plugin/TaggedComponent.h"
+
+#include "zeek/util.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(Connection, zeek);
 ZEEK_FORWARD_DECLARE_NAMESPACED(Analyzer, zeek, analyzer);
diff --git a/src/analyzer/Manager.cc b/src/analyzer/Manager.cc
index 69bb049d3d..67f7d6373a 100644
--- a/src/analyzer/Manager.cc
+++ b/src/analyzer/Manager.cc
@@ -1,22 +1,22 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "Manager.h"
+#include "zeek/analyzer/Manager.h"
 
-#include "Hash.h"
-#include "Val.h"
-#include "IntrusivePtr.h"
-#include "RunState.h"
+#include "zeek/Hash.h"
+#include "zeek/Val.h"
+#include "zeek/IntrusivePtr.h"
+#include "zeek/RunState.h"
 
-#include "protocol/conn-size/ConnSize.h"
-#include "protocol/icmp/ICMP.h"
-#include "protocol/pia/PIA.h"
-#include "protocol/stepping-stone/SteppingStone.h"
-#include "protocol/tcp/TCP.h"
-#include "protocol/udp/UDP.h"
+#include "zeek/analyzer/protocol/conn-size/ConnSize.h"
+#include "zeek/analyzer/protocol/icmp/ICMP.h"
+#include "zeek/analyzer/protocol/pia/PIA.h"
+#include "zeek/analyzer/protocol/stepping-stone/SteppingStone.h"
+#include "zeek/analyzer/protocol/tcp/TCP.h"
+#include "zeek/analyzer/protocol/udp/UDP.h"
 
-#include "plugin/Manager.h"
+#include "zeek/plugin/Manager.h"
 
-#include "protocol/tcp/events.bif.h"
+#include "analyzer/protocol/tcp/events.bif.h"
 
 namespace zeek::analyzer {
 
diff --git a/src/analyzer/Manager.h b/src/analyzer/Manager.h
index dbc439ba78..e2d0a62fe3 100644
--- a/src/analyzer/Manager.h
+++ b/src/analyzer/Manager.h
@@ -23,14 +23,14 @@
 #include <queue>
 #include <vector>
 
-#include "Analyzer.h"
-#include "Component.h"
-#include "Tag.h"
-#include "plugin/ComponentManager.h"
+#include "zeek/analyzer/Analyzer.h"
+#include "zeek/analyzer/Component.h"
+#include "zeek/analyzer/Tag.h"
+#include "zeek/plugin/ComponentManager.h"
 
-#include "../Dict.h"
-#include "../net_util.h"
-#include "../IP.h"
+#include "zeek/Dict.h"
+#include "zeek/net_util.h"
+#include "zeek/IP.h"
 
 #include "analyzer/analyzer.bif.h"
 
diff --git a/src/analyzer/Tag.cc b/src/analyzer/Tag.cc
index c3da63504c..0f591a28ff 100644
--- a/src/analyzer/Tag.cc
+++ b/src/analyzer/Tag.cc
@@ -1,7 +1,7 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "Tag.h"
-#include "Manager.h"
+#include "zeek/analyzer/Tag.h"
+#include "zeek/analyzer/Manager.h"
 
 namespace zeek::analyzer {
 
diff --git a/src/analyzer/Tag.h b/src/analyzer/Tag.h
index 8e8325a9d3..6aa04d0d02 100644
--- a/src/analyzer/Tag.h
+++ b/src/analyzer/Tag.h
@@ -4,7 +4,7 @@
 #pragma once
 
 #include "zeek-config.h"
-#include "../Tag.h"
+#include "zeek/Tag.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(EnumVal, zeek);
 
diff --git a/src/analyzer/analyzer.bif b/src/analyzer/analyzer.bif
index dfa997676b..18ed0e883b 100644
--- a/src/analyzer/analyzer.bif
+++ b/src/analyzer/analyzer.bif
@@ -3,9 +3,8 @@
 module Analyzer;
 
 %%{
-#include "NetVar.h"
-
-#include "analyzer/Manager.h"
+#include "zeek/NetVar.h"
+#include "zeek/analyzer/Manager.h"
 %%}
 
 function Analyzer::__enable_analyzer%(id: Analyzer::Tag%) : bool
diff --git a/src/analyzer/protocol/ayiya/AYIYA.cc b/src/analyzer/protocol/ayiya/AYIYA.cc
index 1eab658b1a..58dec78f12 100644
--- a/src/analyzer/protocol/ayiya/AYIYA.cc
+++ b/src/analyzer/protocol/ayiya/AYIYA.cc
@@ -1,8 +1,9 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "AYIYA.h"
-#include "Func.h"
-#include "packet_analysis/protocol/iptunnel/IPTunnel.h"
+#include "zeek/analyzer/protocol/ayiya/AYIYA.h"
+
+#include "zeek/Func.h"
+#include "zeek/packet_analysis/protocol/iptunnel/IPTunnel.h"
 
 namespace zeek::analyzer::ayiya {
 
diff --git a/src/analyzer/protocol/ayiya/AYIYA.h b/src/analyzer/protocol/ayiya/AYIYA.h
index c59458075e..916a88f504 100644
--- a/src/analyzer/protocol/ayiya/AYIYA.h
+++ b/src/analyzer/protocol/ayiya/AYIYA.h
@@ -1,6 +1,6 @@
 #pragma once
 
-#include "ayiya_pac.h"
+#include "analyzer/protocol/ayiya/ayiya_pac.h"
 
 namespace binpac::AYIYA { class AYIYA_Conn; }
 
diff --git a/src/analyzer/protocol/ayiya/Plugin.cc b/src/analyzer/protocol/ayiya/Plugin.cc
index 6e52239191..a8cf028f05 100644
--- a/src/analyzer/protocol/ayiya/Plugin.cc
+++ b/src/analyzer/protocol/ayiya/Plugin.cc
@@ -1,8 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-#include "AYIYA.h"
-#include "plugin/Plugin.h"
-#include "analyzer/Component.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/analyzer/Component.h"
+#include "zeek/analyzer/protocol/ayiya/AYIYA.h"
 
 namespace zeek::plugin::detail::Zeek_AYIYA {
 
diff --git a/src/analyzer/protocol/ayiya/ayiya-analyzer.pac b/src/analyzer/protocol/ayiya/ayiya-analyzer.pac
index cc4af8c1ad..b36f8acb59 100644
--- a/src/analyzer/protocol/ayiya/ayiya-analyzer.pac
+++ b/src/analyzer/protocol/ayiya/ayiya-analyzer.pac
@@ -1,7 +1,7 @@
 %extern{
-#include "Sessions.h"
-#include "Conn.h"
-#include "AYIYA.h"
+#include "zeek/Sessions.h"
+#include "zeek/Conn.h"
+#include "zeek/analyzer/protocol/ayiya/AYIYA.h"
 %}
 
 connection AYIYA_Conn(zeek_analyzer: ZeekAnalyzer)
diff --git a/src/analyzer/protocol/ayiya/ayiya.pac b/src/analyzer/protocol/ayiya/ayiya.pac
index 8e30bd3109..c1e3fbc613 100644
--- a/src/analyzer/protocol/ayiya/ayiya.pac
+++ b/src/analyzer/protocol/ayiya/ayiya.pac
@@ -3,9 +3,9 @@
 %include zeek.pac
 
 %extern{
-#include "IP.h"
-#include "Reporter.h"
-#include "TunnelEncapsulation.h"
+#include "zeek/IP.h"
+#include "zeek/Reporter.h"
+#include "zeek/TunnelEncapsulation.h"
 %}
 
 analyzer AYIYA withcontext {
diff --git a/src/analyzer/protocol/bittorrent/BitTorrent.cc b/src/analyzer/protocol/bittorrent/BitTorrent.cc
index 22ecb33835..1d09dfdf98 100644
--- a/src/analyzer/protocol/bittorrent/BitTorrent.cc
+++ b/src/analyzer/protocol/bittorrent/BitTorrent.cc
@@ -1,9 +1,9 @@
 // This code contributed by Nadi Sarrar.
 
-#include "BitTorrent.h"
-#include "analyzer/protocol/tcp/TCP_Reassembler.h"
+#include "zeek/analyzer/protocol/bittorrent/BitTorrent.h"
+#include "zeek/analyzer/protocol/tcp/TCP_Reassembler.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/bittorrent/events.bif.h"
 
 namespace zeek::analyzer::bittorrent {
 
diff --git a/src/analyzer/protocol/bittorrent/BitTorrent.h b/src/analyzer/protocol/bittorrent/BitTorrent.h
index 58a758c178..9060a62f78 100644
--- a/src/analyzer/protocol/bittorrent/BitTorrent.h
+++ b/src/analyzer/protocol/bittorrent/BitTorrent.h
@@ -2,9 +2,9 @@
 
 #pragma once
 
-#include "analyzer/protocol/tcp/TCP.h"
+#include "zeek/analyzer/protocol/tcp/TCP.h"
 
-#include "bittorrent_pac.h"
+#include "analyzer/protocol/bittorrent/bittorrent_pac.h"
 
 namespace zeek::analyzer::bittorrent {
 
diff --git a/src/analyzer/protocol/bittorrent/BitTorrentTracker.cc b/src/analyzer/protocol/bittorrent/BitTorrentTracker.cc
index 779dfb4539..803b5d09c3 100644
--- a/src/analyzer/protocol/bittorrent/BitTorrentTracker.cc
+++ b/src/analyzer/protocol/bittorrent/BitTorrentTracker.cc
@@ -1,15 +1,15 @@
 // This code contributed by Nadi Sarrar.
 
-#include "BitTorrentTracker.h"
-#include "analyzer/protocol/tcp/TCP_Reassembler.h"
-
-#include "events.bif.h"
+#include "zeek/analyzer/protocol/bittorrent/BitTorrentTracker.h"
 
 #include <sys/types.h>
 #include <regex.h>
-
 #include <algorithm>
 
+#include "zeek/analyzer/protocol/tcp/TCP_Reassembler.h"
+
+#include "analyzer/protocol/bittorrent/events.bif.h"
+
 # define FMT_INT "%" PRId64
 # define FMT_UINT "%" PRIu64
 
diff --git a/src/analyzer/protocol/bittorrent/BitTorrentTracker.h b/src/analyzer/protocol/bittorrent/BitTorrentTracker.h
index 507375e19b..2375dbcb75 100644
--- a/src/analyzer/protocol/bittorrent/BitTorrentTracker.h
+++ b/src/analyzer/protocol/bittorrent/BitTorrentTracker.h
@@ -2,7 +2,7 @@
 
 #pragma once
 
-#include "analyzer/protocol/tcp/TCP.h"
+#include "zeek/analyzer/protocol/tcp/TCP.h"
 
 #define BTTRACKER_BUF 2048
 
diff --git a/src/analyzer/protocol/bittorrent/Plugin.cc b/src/analyzer/protocol/bittorrent/Plugin.cc
index 6dba2f78cf..b625acaf72 100644
--- a/src/analyzer/protocol/bittorrent/Plugin.cc
+++ b/src/analyzer/protocol/bittorrent/Plugin.cc
@@ -1,9 +1,9 @@
 // See the file  in the main distribution directory for copyright.
 
-#include "BitTorrent.h"
-#include "BitTorrentTracker.h"
-#include "plugin/Plugin.h"
-#include "analyzer/Component.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/analyzer/Component.h"
+#include "zeek/analyzer/protocol/bittorrent/BitTorrent.h"
+#include "zeek/analyzer/protocol/bittorrent/BitTorrentTracker.h"
 
 namespace zeek::plugin::plugin::Zeek_BitTorrent {
 
diff --git a/src/analyzer/protocol/bittorrent/bittorrent.pac b/src/analyzer/protocol/bittorrent/bittorrent.pac
index dbf0efecf1..eb2fe7e579 100644
--- a/src/analyzer/protocol/bittorrent/bittorrent.pac
+++ b/src/analyzer/protocol/bittorrent/bittorrent.pac
@@ -6,7 +6,7 @@
 %extern{
 #define MSGLEN_LIMIT 0x40000
 
-#include "events.bif.h"
+#include "analyzer/protocol/bittorrent/events.bif.h"
 %}
 
 analyzer BitTorrent withcontext {
diff --git a/src/analyzer/protocol/conn-size/ConnSize.cc b/src/analyzer/protocol/conn-size/ConnSize.cc
index f8f41e0131..98acb55f1e 100644
--- a/src/analyzer/protocol/conn-size/ConnSize.cc
+++ b/src/analyzer/protocol/conn-size/ConnSize.cc
@@ -2,14 +2,14 @@
 //
 // See ConnSize.h for more extensive comments.
 
+#include "zeek/analyzer/protocol/conn-size/ConnSize.h"
 
-#include "ConnSize.h"
-#include "analyzer/protocol/tcp/TCP.h"
-#include "IP.h"
-#include "Reporter.h"
-#include "RunState.h"
+#include "zeek/analyzer/protocol/tcp/TCP.h"
+#include "zeek/IP.h"
+#include "zeek/Reporter.h"
+#include "zeek/RunState.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/conn-size/events.bif.h"
 
 namespace zeek::analyzer::conn_size {
 
diff --git a/src/analyzer/protocol/conn-size/ConnSize.h b/src/analyzer/protocol/conn-size/ConnSize.h
index 37fda7df71..93b939f8cf 100644
--- a/src/analyzer/protocol/conn-size/ConnSize.h
+++ b/src/analyzer/protocol/conn-size/ConnSize.h
@@ -1,10 +1,9 @@
 // See the file "COPYING" in the main distribution directory for copyright.
-//
 
 #pragma once
 
-#include "analyzer/Analyzer.h"
-#include "NetVar.h"
+#include "zeek/analyzer/Analyzer.h"
+#include "zeek/NetVar.h"
 
 namespace zeek::analyzer::conn_size {
 
diff --git a/src/analyzer/protocol/conn-size/Plugin.cc b/src/analyzer/protocol/conn-size/Plugin.cc
index 5470abbd1d..5475f1ddcb 100644
--- a/src/analyzer/protocol/conn-size/Plugin.cc
+++ b/src/analyzer/protocol/conn-size/Plugin.cc
@@ -1,8 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-#include "ConnSize.h"
-#include "plugin/Plugin.h"
-#include "analyzer/Component.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/analyzer/Component.h"
+#include "zeek/analyzer/protocol/conn-size/ConnSize.h"
 
 namespace zeek::plugin::detail::Zeek_ConnSize {
 
diff --git a/src/analyzer/protocol/conn-size/functions.bif b/src/analyzer/protocol/conn-size/functions.bif
index fa9d2d2c9d..a60195ae9c 100644
--- a/src/analyzer/protocol/conn-size/functions.bif
+++ b/src/analyzer/protocol/conn-size/functions.bif
@@ -1,7 +1,7 @@
 %%{
-#include "analyzer/protocol/conn-size/ConnSize.h"
-#include "Reporter.h"
-#include "Sessions.h"
+#include "zeek/analyzer/protocol/conn-size/ConnSize.h"
+#include "zeek/Reporter.h"
+#include "zeek/Sessions.h"
 
 static zeek::analyzer::Analyzer* GetConnsizeAnalyzer(zeek::Val* cid)
 	{
diff --git a/src/analyzer/protocol/dce-rpc/DCE_RPC.cc b/src/analyzer/protocol/dce-rpc/DCE_RPC.cc
index a50a6e3b26..b9387932e8 100644
--- a/src/analyzer/protocol/dce-rpc/DCE_RPC.cc
+++ b/src/analyzer/protocol/dce-rpc/DCE_RPC.cc
@@ -1,7 +1,7 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
-#include "DCE_RPC.h"
+#include "zeek/analyzer/protocol/dce-rpc/DCE_RPC.h"
 
 #include <stdlib.h>
 #include <string>
diff --git a/src/analyzer/protocol/dce-rpc/DCE_RPC.h b/src/analyzer/protocol/dce-rpc/DCE_RPC.h
index 0a7fec416c..500160ac15 100644
--- a/src/analyzer/protocol/dce-rpc/DCE_RPC.h
+++ b/src/analyzer/protocol/dce-rpc/DCE_RPC.h
@@ -2,12 +2,12 @@
 
 #pragma once
 
-#include "NetVar.h"
-#include "analyzer/protocol/tcp/TCP.h"
-#include "analyzer/protocol/dce-rpc/events.bif.h"
-#include "IPAddr.h"
+#include "zeek/NetVar.h"
+#include "zeek/analyzer/protocol/tcp/TCP.h"
+#include "zeek/IPAddr.h"
 
-#include "dce_rpc_pac.h"
+#include "analyzer/protocol/dce-rpc/events.bif.h"
+#include "analyzer/protocol/dce-rpc/dce_rpc_pac.h"
 
 namespace zeek::analyzer::dce_rpc {
 
diff --git a/src/analyzer/protocol/dce-rpc/Plugin.cc b/src/analyzer/protocol/dce-rpc/Plugin.cc
index 6afa802c3b..7d70eca075 100644
--- a/src/analyzer/protocol/dce-rpc/Plugin.cc
+++ b/src/analyzer/protocol/dce-rpc/Plugin.cc
@@ -1,9 +1,7 @@
 // See the file  in the main distribution directory for copyright.
 
-
-#include "plugin/Plugin.h"
-
-#include "DCE_RPC.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/analyzer/protocol/dce-rpc/DCE_RPC.h"
 
 namespace zeek::plugin::detail::Zeek_DCE_RPC {
 
diff --git a/src/analyzer/protocol/dce-rpc/dce_rpc-auth.pac b/src/analyzer/protocol/dce-rpc/dce_rpc-auth.pac
index 5207f3611a..d413abd39e 100644
--- a/src/analyzer/protocol/dce-rpc/dce_rpc-auth.pac
+++ b/src/analyzer/protocol/dce-rpc/dce_rpc-auth.pac
@@ -1,5 +1,5 @@
 %extern{
-#include "analyzer/Manager.h"
+#include "zeek/analyzer/Manager.h"
 %}
 
 refine connection DCE_RPC_Conn += {
diff --git a/src/analyzer/protocol/dce-rpc/dce_rpc.pac b/src/analyzer/protocol/dce-rpc/dce_rpc.pac
index 521885ea1a..f7089ace53 100644
--- a/src/analyzer/protocol/dce-rpc/dce_rpc.pac
+++ b/src/analyzer/protocol/dce-rpc/dce_rpc.pac
@@ -2,9 +2,9 @@
 %include zeek.pac
 
 %extern{
-#include "consts.bif.h"
-#include "types.bif.h"
-#include "events.bif.h"
+#include "analyzer/protocol/dce-rpc/consts.bif.h"
+#include "analyzer/protocol/dce-rpc/types.bif.h"
+#include "analyzer/protocol/dce-rpc/events.bif.h"
 %}
 
 analyzer DCE_RPC withcontext {
diff --git a/src/analyzer/protocol/dhcp/DHCP.cc b/src/analyzer/protocol/dhcp/DHCP.cc
index f5e029a2bb..a66405fdcc 100644
--- a/src/analyzer/protocol/dhcp/DHCP.cc
+++ b/src/analyzer/protocol/dhcp/DHCP.cc
@@ -1,7 +1,7 @@
-#include "DHCP.h"
+#include "zeek/analyzer/protocol/dhcp/DHCP.h"
 
-#include "events.bif.h"
-#include "types.bif.h"
+#include "analyzer/protocol/dhcp/events.bif.h"
+#include "analyzer/protocol/dhcp/types.bif.h"
 
 namespace zeek::analyzer::dhcp {
 
diff --git a/src/analyzer/protocol/dhcp/DHCP.h b/src/analyzer/protocol/dhcp/DHCP.h
index 9df8b3d469..de0d3d59d9 100644
--- a/src/analyzer/protocol/dhcp/DHCP.h
+++ b/src/analyzer/protocol/dhcp/DHCP.h
@@ -1,8 +1,8 @@
 #pragma once
 
-#include "analyzer/protocol/udp/UDP.h"
+#include "zeek/analyzer/protocol/udp/UDP.h"
 
-#include "dhcp_pac.h"
+#include "analyzer/protocol/dhcp/dhcp_pac.h"
 
 namespace zeek::analyzer::dhcp {
 
diff --git a/src/analyzer/protocol/dhcp/Plugin.cc b/src/analyzer/protocol/dhcp/Plugin.cc
index 6ff2db8d8f..838d183bc2 100644
--- a/src/analyzer/protocol/dhcp/Plugin.cc
+++ b/src/analyzer/protocol/dhcp/Plugin.cc
@@ -1,8 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-#include "DHCP.h"
-#include "plugin/Plugin.h"
-#include "analyzer/Component.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/analyzer/Component.h"
+#include "zeek/analyzer/protocol/dhcp/DHCP.h"
 
 namespace zeek::plugin::detail::Zeek_DHCP {
 
diff --git a/src/analyzer/protocol/dhcp/dhcp.pac b/src/analyzer/protocol/dhcp/dhcp.pac
index f67523299b..6305f15429 100644
--- a/src/analyzer/protocol/dhcp/dhcp.pac
+++ b/src/analyzer/protocol/dhcp/dhcp.pac
@@ -2,8 +2,8 @@
 %include zeek.pac
 
 %extern{
-#include "types.bif.h"
-#include "events.bif.h"
+#include "analyzer/protocol/dhcp/types.bif.h"
+#include "analyzer/protocol/dhcp/events.bif.h"
 %}
 
 analyzer DHCP withcontext {
diff --git a/src/analyzer/protocol/dnp3/DNP3.cc b/src/analyzer/protocol/dnp3/DNP3.cc
index b0eecaa58c..0cd02d0dc5 100644
--- a/src/analyzer/protocol/dnp3/DNP3.cc
+++ b/src/analyzer/protocol/dnp3/DNP3.cc
@@ -96,9 +96,10 @@
 //                                                   \/
 //                                            Binpac DNP3 Analyzer
 
-#include "DNP3.h"
-#include "Reporter.h"
-#include "events.bif.h"
+#include "zeek/analyzer/protocol/dnp3/DNP3.h"
+#include "zeek/Reporter.h"
+
+#include "analyzer/protocol/dnp3/events.bif.h"
 
 constexpr unsigned int PSEUDO_LENGTH_INDEX = 2;		// index of len field of DNP3 Pseudo Link Layer
 constexpr unsigned int PSEUDO_CONTROL_FIELD_INDEX = 3;	// index of ctrl field of DNP3 Pseudo Link Layer
diff --git a/src/analyzer/protocol/dnp3/DNP3.h b/src/analyzer/protocol/dnp3/DNP3.h
index b840489742..bb94a881bf 100644
--- a/src/analyzer/protocol/dnp3/DNP3.h
+++ b/src/analyzer/protocol/dnp3/DNP3.h
@@ -1,10 +1,9 @@
-
 #pragma once
 
-#include "analyzer/protocol/tcp/TCP.h"
-#include "analyzer/protocol/udp/UDP.h"
+#include "zeek/analyzer/protocol/tcp/TCP.h"
+#include "zeek/analyzer/protocol/udp/UDP.h"
 
-#include "dnp3_pac.h"
+#include "analyzer/protocol/dnp3/dnp3_pac.h"
 
 namespace zeek::analyzer::dnp3 {
 
diff --git a/src/analyzer/protocol/dnp3/Plugin.cc b/src/analyzer/protocol/dnp3/Plugin.cc
index 3061fb2ce9..a3fbbfa484 100644
--- a/src/analyzer/protocol/dnp3/Plugin.cc
+++ b/src/analyzer/protocol/dnp3/Plugin.cc
@@ -1,8 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-#include "DNP3.h"
-#include "plugin/Plugin.h"
-#include "analyzer/Component.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/analyzer/Component.h"
+#include "zeek/analyzer/protocol/dnp3/DNP3.h"
 
 namespace zeek::plugin::detail::Zeek_DNP3 {
 
diff --git a/src/analyzer/protocol/dnp3/dnp3.pac b/src/analyzer/protocol/dnp3/dnp3.pac
index 4c3169f669..9810e9dfc8 100644
--- a/src/analyzer/protocol/dnp3/dnp3.pac
+++ b/src/analyzer/protocol/dnp3/dnp3.pac
@@ -3,7 +3,7 @@
 %include zeek.pac
 
 %extern{
-#include "events.bif.h"
+#include "analyzer/protocol/dnp3/events.bif.h"
 %}
 
 analyzer DNP3 withcontext {
diff --git a/src/analyzer/protocol/dns/DNS.cc b/src/analyzer/protocol/dns/DNS.cc
index a11c0300ad..d8c81f8571 100644
--- a/src/analyzer/protocol/dns/DNS.cc
+++ b/src/analyzer/protocol/dns/DNS.cc
@@ -1,7 +1,7 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
-#include "DNS.h"
+#include "zeek/analyzer/protocol/dns/DNS.h"
 
 #include <ctype.h>
 #include <sys/types.h>
@@ -9,13 +9,13 @@
 #include <netinet/in.h>
 #include <arpa/inet.h>
 
-#include "ZeekString.h"
-#include "NetVar.h"
-#include "Sessions.h"
-#include "Event.h"
-#include "RunState.h"
+#include "zeek/ZeekString.h"
+#include "zeek/NetVar.h"
+#include "zeek/Sessions.h"
+#include "zeek/Event.h"
+#include "zeek/RunState.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/dns/events.bif.h"
 
 namespace zeek::analyzer::dns {
 
diff --git a/src/analyzer/protocol/dns/DNS.h b/src/analyzer/protocol/dns/DNS.h
index 1eae864643..d98ec6ddfa 100644
--- a/src/analyzer/protocol/dns/DNS.h
+++ b/src/analyzer/protocol/dns/DNS.h
@@ -2,8 +2,8 @@
 
 #pragma once
 
-#include "analyzer/protocol/tcp/TCP.h"
-#include "binpac_zeek.h"
+#include "zeek/analyzer/protocol/tcp/TCP.h"
+#include "zeek/binpac_zeek.h"
 
 namespace zeek::analyzer::dns {
 namespace detail {
diff --git a/src/analyzer/protocol/dns/Plugin.cc b/src/analyzer/protocol/dns/Plugin.cc
index 1a31bbd56a..0d454b721b 100644
--- a/src/analyzer/protocol/dns/Plugin.cc
+++ b/src/analyzer/protocol/dns/Plugin.cc
@@ -1,8 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-#include "DNS.h"
-#include "plugin/Plugin.h"
-#include "analyzer/Component.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/analyzer/Component.h"
+#include "zeek/analyzer/protocol/dns/DNS.h"
 
 namespace zeek::plugin::detail::Zeek_DNS {
 
diff --git a/src/analyzer/protocol/file/File.cc b/src/analyzer/protocol/file/File.cc
index 7353adb7be..8668f12bb3 100644
--- a/src/analyzer/protocol/file/File.cc
+++ b/src/analyzer/protocol/file/File.cc
@@ -1,13 +1,13 @@
+#include "zeek/analyzer/protocol/file/File.h"
+
 #include <algorithm>
 
-#include "File.h"
+#include "zeek/file_analysis/Manager.h"
+#include "zeek/RuleMatcher.h"
+#include "zeek/Reporter.h"
+#include "zeek/util.h"
 
-#include "file_analysis/Manager.h"
-#include "RuleMatcher.h"
-#include "Reporter.h"
-#include "util.h"
-
-#include "events.bif.h"
+#include "analyzer/protocol/file/events.bif.h"
 
 namespace zeek::analyzer::file {
 
diff --git a/src/analyzer/protocol/file/File.h b/src/analyzer/protocol/file/File.h
index fcf1883ece..13b4a98f66 100644
--- a/src/analyzer/protocol/file/File.h
+++ b/src/analyzer/protocol/file/File.h
@@ -2,10 +2,10 @@
 
 #pragma once
 
-#include "analyzer/protocol/tcp/TCP.h"
-
 #include <string>
 
+#include "zeek/analyzer/protocol/tcp/TCP.h"
+
 namespace zeek::analyzer::file {
 
 class File_Analyzer : public analyzer::tcp::TCP_ApplicationAnalyzer {
diff --git a/src/analyzer/protocol/file/Plugin.cc b/src/analyzer/protocol/file/Plugin.cc
index e700d1644e..b9457eed91 100644
--- a/src/analyzer/protocol/file/Plugin.cc
+++ b/src/analyzer/protocol/file/Plugin.cc
@@ -1,8 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-#include "File.h"
-#include "plugin/Plugin.h"
-#include "analyzer/Component.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/analyzer/Component.h"
+#include "zeek/analyzer/protocol/file/File.h"
 
 namespace zeek::plugin::detail::Zeek_File {
 
diff --git a/src/analyzer/protocol/finger/Finger.cc b/src/analyzer/protocol/finger/Finger.cc
index 8868cfc914..6a4763a59a 100644
--- a/src/analyzer/protocol/finger/Finger.cc
+++ b/src/analyzer/protocol/finger/Finger.cc
@@ -1,15 +1,15 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
+#include "zeek/analyzer/protocol/finger/Finger.h"
 
 #include <ctype.h>
 
-#include "NetVar.h"
-#include "Finger.h"
-#include "Event.h"
-#include "analyzer/protocol/tcp/ContentLine.h"
+#include "zeek/NetVar.h"
+#include "zeek/Event.h"
+#include "zeek/analyzer/protocol/tcp/ContentLine.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/finger/events.bif.h"
 
 namespace zeek::analyzer::finger {
 
diff --git a/src/analyzer/protocol/finger/Finger.h b/src/analyzer/protocol/finger/Finger.h
index c2546e9027..363e3df2d7 100644
--- a/src/analyzer/protocol/finger/Finger.h
+++ b/src/analyzer/protocol/finger/Finger.h
@@ -2,8 +2,8 @@
 
 #pragma once
 
-#include "analyzer/protocol/tcp/TCP.h"
-#include "analyzer/protocol/tcp/ContentLine.h"
+#include "zeek/analyzer/protocol/tcp/TCP.h"
+#include "zeek/analyzer/protocol/tcp/ContentLine.h"
 
 namespace zeek::analyzer::finger {
 
diff --git a/src/analyzer/protocol/finger/Plugin.cc b/src/analyzer/protocol/finger/Plugin.cc
index 7bc3322e29..242e1e9877 100644
--- a/src/analyzer/protocol/finger/Plugin.cc
+++ b/src/analyzer/protocol/finger/Plugin.cc
@@ -1,8 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-#include "Finger.h"
-#include "plugin/Plugin.h"
-#include "analyzer/Component.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/analyzer/Component.h"
+#include "zeek/analyzer/protocol/finger/Finger.h"
 
 namespace zeek::plugin::detail::Zeek_Finger {
 
diff --git a/src/analyzer/protocol/ftp/FTP.cc b/src/analyzer/protocol/ftp/FTP.cc
index bb9b730323..71d645c18a 100644
--- a/src/analyzer/protocol/ftp/FTP.cc
+++ b/src/analyzer/protocol/ftp/FTP.cc
@@ -1,19 +1,19 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
-#include "FTP.h"
+#include "zeek/analyzer/protocol/ftp/FTP.h"
 
 #include <stdlib.h>
 
-#include "ZeekString.h"
-#include "NetVar.h"
-#include "Event.h"
-#include "Base64.h"
-#include "analyzer/Manager.h"
-#include "analyzer/protocol/login/NVT.h"
-#include "RuleMatcher.h"
+#include "zeek/ZeekString.h"
+#include "zeek/NetVar.h"
+#include "zeek/Event.h"
+#include "zeek/Base64.h"
+#include "zeek/analyzer/Manager.h"
+#include "zeek/analyzer/protocol/login/NVT.h"
+#include "zeek/RuleMatcher.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/ftp/events.bif.h"
 
 namespace zeek::analyzer::ftp {
 
diff --git a/src/analyzer/protocol/ftp/FTP.h b/src/analyzer/protocol/ftp/FTP.h
index cd5ff8d6ad..6e972de6e3 100644
--- a/src/analyzer/protocol/ftp/FTP.h
+++ b/src/analyzer/protocol/ftp/FTP.h
@@ -2,7 +2,7 @@
 
 #pragma once
 
-#include "analyzer/protocol/tcp/TCP.h"
+#include "zeek/analyzer/protocol/tcp/TCP.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(NVT_Analyzer, zeek, analyzer::login);
 
diff --git a/src/analyzer/protocol/ftp/Plugin.cc b/src/analyzer/protocol/ftp/Plugin.cc
index 5429f61152..08d639375a 100644
--- a/src/analyzer/protocol/ftp/Plugin.cc
+++ b/src/analyzer/protocol/ftp/Plugin.cc
@@ -1,8 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-#include "FTP.h"
-#include "plugin/Plugin.h"
-#include "analyzer/Component.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/analyzer/Component.h"
+#include "zeek/analyzer/protocol/ftp/FTP.h"
 
 namespace zeek::plugin::detail::Zeek_FTP {
 
diff --git a/src/analyzer/protocol/ftp/functions.bif b/src/analyzer/protocol/ftp/functions.bif
index c4223334d7..7037a939cc 100644
--- a/src/analyzer/protocol/ftp/functions.bif
+++ b/src/analyzer/protocol/ftp/functions.bif
@@ -2,7 +2,7 @@
 type ftp_port: record;
 
 %%{
-#include "Reporter.h"
+#include "zeek/Reporter.h"
 
 static zeek::ValPtr parse_port(const char* line)
 	{
diff --git a/src/analyzer/protocol/gnutella/Gnutella.cc b/src/analyzer/protocol/gnutella/Gnutella.cc
index 4d3d81aea6..4ba8e86243 100644
--- a/src/analyzer/protocol/gnutella/Gnutella.cc
+++ b/src/analyzer/protocol/gnutella/Gnutella.cc
@@ -1,18 +1,18 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
+#include "zeek/analyzer/protocol/gnutella/Gnutella.h"
 
 #include <ctype.h>
 
 #include <algorithm>
 
-#include "NetVar.h"
-#include "Gnutella.h"
-#include "Event.h"
-#include "analyzer/protocol/pia/PIA.h"
-#include "analyzer/Manager.h"
+#include "zeek/NetVar.h"
+#include "zeek/Event.h"
+#include "zeek/analyzer/protocol/pia/PIA.h"
+#include "zeek/analyzer/Manager.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/gnutella/events.bif.h"
 
 namespace zeek::analyzer::gnutella {
 
diff --git a/src/analyzer/protocol/gnutella/Gnutella.h b/src/analyzer/protocol/gnutella/Gnutella.h
index 649c15a9ce..49307e62f0 100644
--- a/src/analyzer/protocol/gnutella/Gnutella.h
+++ b/src/analyzer/protocol/gnutella/Gnutella.h
@@ -2,7 +2,7 @@
 
 #pragma once
 
-#include "analyzer/protocol/tcp/TCP.h"
+#include "zeek/analyzer/protocol/tcp/TCP.h"
 
 namespace zeek::analyzer::gnutella {
 
diff --git a/src/analyzer/protocol/gnutella/Plugin.cc b/src/analyzer/protocol/gnutella/Plugin.cc
index d3e5d2e6e5..419e1ff8cc 100644
--- a/src/analyzer/protocol/gnutella/Plugin.cc
+++ b/src/analyzer/protocol/gnutella/Plugin.cc
@@ -1,8 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-#include "Gnutella.h"
-#include "plugin/Plugin.h"
-#include "analyzer/Component.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/analyzer/Component.h"
+#include "zeek/analyzer/protocol/gnutella/Gnutella.h"
 
 namespace zeek::plugin::detail::Zeek_Gnutella {
 
diff --git a/src/analyzer/protocol/gssapi/GSSAPI.cc b/src/analyzer/protocol/gssapi/GSSAPI.cc
index 991c7ab34a..59988a83cf 100644
--- a/src/analyzer/protocol/gssapi/GSSAPI.cc
+++ b/src/analyzer/protocol/gssapi/GSSAPI.cc
@@ -1,9 +1,11 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "GSSAPI.h"
-#include "analyzer/protocol/tcp/TCP_Reassembler.h"
-#include "Reporter.h"
-#include "events.bif.h"
+#include "zeek/analyzer/protocol/gssapi/GSSAPI.h"
+
+#include "zeek/analyzer/protocol/tcp/TCP_Reassembler.h"
+#include "zeek/Reporter.h"
+
+#include "analyzer/protocol/gssapi/events.bif.h"
 
 namespace zeek::analyzer::gssapi {
 
diff --git a/src/analyzer/protocol/gssapi/GSSAPI.h b/src/analyzer/protocol/gssapi/GSSAPI.h
index e7e30f5aa1..e420c3b285 100644
--- a/src/analyzer/protocol/gssapi/GSSAPI.h
+++ b/src/analyzer/protocol/gssapi/GSSAPI.h
@@ -2,10 +2,10 @@
 
 #pragma once
 
-#include "events.bif.h"
-#include "analyzer/protocol/tcp/TCP.h"
+#include "zeek/analyzer/protocol/tcp/TCP.h"
 
-#include "gssapi_pac.h"
+#include "analyzer/protocol/gssapi/events.bif.h"
+#include "analyzer/protocol/gssapi/gssapi_pac.h"
 
 namespace zeek::analyzer::gssapi {
 
diff --git a/src/analyzer/protocol/gssapi/Plugin.cc b/src/analyzer/protocol/gssapi/Plugin.cc
index 6d4704e60e..8eb016ce52 100644
--- a/src/analyzer/protocol/gssapi/Plugin.cc
+++ b/src/analyzer/protocol/gssapi/Plugin.cc
@@ -1,8 +1,7 @@
 // See the file in the main distribution directory for copyright.
 
-#include "plugin/Plugin.h"
-
-#include "GSSAPI.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/analyzer/protocol/gssapi/GSSAPI.h"
 
 namespace zeek::plugin::detail::Zeek_GSSAPI {
 
diff --git a/src/analyzer/protocol/gssapi/gssapi.pac b/src/analyzer/protocol/gssapi/gssapi.pac
index b3c8c5023f..73ca7c5a1b 100644
--- a/src/analyzer/protocol/gssapi/gssapi.pac
+++ b/src/analyzer/protocol/gssapi/gssapi.pac
@@ -2,10 +2,10 @@
 %include zeek.pac
 
 %extern{
-#include "analyzer/Manager.h"
-#include "analyzer/Analyzer.h"
+#include "zeek/analyzer/Manager.h"
+#include "zeek/analyzer/Analyzer.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/gssapi/events.bif.h"
 %}
 
 analyzer GSSAPI withcontext {
diff --git a/src/analyzer/protocol/gtpv1/GTPv1.cc b/src/analyzer/protocol/gtpv1/GTPv1.cc
index 57407c4f8f..49276179ea 100644
--- a/src/analyzer/protocol/gtpv1/GTPv1.cc
+++ b/src/analyzer/protocol/gtpv1/GTPv1.cc
@@ -1,9 +1,9 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "GTPv1.h"
-#include "packet_analysis/protocol/iptunnel/IPTunnel.h"
+#include "zeek/analyzer/protocol/gtpv1/GTPv1.h"
+#include "zeek/packet_analysis/protocol/iptunnel/IPTunnel.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/gtpv1/events.bif.h"
 
 namespace zeek::analyzer::gtpv1 {
 
diff --git a/src/analyzer/protocol/gtpv1/GTPv1.h b/src/analyzer/protocol/gtpv1/GTPv1.h
index 37811b4004..0f1edb0ac6 100644
--- a/src/analyzer/protocol/gtpv1/GTPv1.h
+++ b/src/analyzer/protocol/gtpv1/GTPv1.h
@@ -1,6 +1,6 @@
 #pragma once
 
-#include "gtpv1_pac.h"
+#include "analyzer/protocol/gtpv1/gtpv1_pac.h"
 
 namespace binpac::GTPv1 { class GTPv1_Conn; }
 
diff --git a/src/analyzer/protocol/gtpv1/Plugin.cc b/src/analyzer/protocol/gtpv1/Plugin.cc
index ec0b011bf7..7b7450b2fb 100644
--- a/src/analyzer/protocol/gtpv1/Plugin.cc
+++ b/src/analyzer/protocol/gtpv1/Plugin.cc
@@ -1,8 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-#include "GTPv1.h"
-#include "plugin/Plugin.h"
-#include "analyzer/Component.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/analyzer/Component.h"
+#include "zeek/analyzer/protocol/gtpv1/GTPv1.h"
 
 namespace zeek::plugin::detail::Zeek_GTPv1 {
 
diff --git a/src/analyzer/protocol/gtpv1/gtpv1-analyzer.pac b/src/analyzer/protocol/gtpv1/gtpv1-analyzer.pac
index 68d50f2bb9..25c5f8a9da 100644
--- a/src/analyzer/protocol/gtpv1/gtpv1-analyzer.pac
+++ b/src/analyzer/protocol/gtpv1/gtpv1-analyzer.pac
@@ -1,7 +1,7 @@
 %extern{
-#include "Sessions.h"
-#include "ZeekString.h"
-#include "GTPv1.h"
+#include "zeek/Sessions.h"
+#include "zeek/ZeekString.h"
+#include "zeek/analyzer/protocol/gtpv1/GTPv1.h"
 %}
 
 %code{
diff --git a/src/analyzer/protocol/gtpv1/gtpv1.pac b/src/analyzer/protocol/gtpv1/gtpv1.pac
index 15cccfc89a..3910471b08 100644
--- a/src/analyzer/protocol/gtpv1/gtpv1.pac
+++ b/src/analyzer/protocol/gtpv1/gtpv1.pac
@@ -2,10 +2,11 @@
 %include zeek.pac
 
 %extern{
-#include "IP.h"
-#include "TunnelEncapsulation.h"
-#include "Reporter.h"
-#include "events.bif.h"
+#include "zeek/IP.h"
+#include "zeek/TunnelEncapsulation.h"
+#include "zeek/Reporter.h"
+
+#include "analyzer/protocol/gtpv1/events.bif.h"
 %}
 
 analyzer GTPv1 withcontext {
diff --git a/src/analyzer/protocol/http/HTTP.cc b/src/analyzer/protocol/http/HTTP.cc
index 5c661e72b3..efb6ed49c3 100644
--- a/src/analyzer/protocol/http/HTTP.cc
+++ b/src/analyzer/protocol/http/HTTP.cc
@@ -1,6 +1,7 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
+#include "zeek/analyzer/protocol/http/HTTP.h"
 
 #include <ctype.h>
 #include <math.h>
@@ -8,13 +9,12 @@
 #include <string>
 #include <algorithm>
 
-#include "NetVar.h"
-#include "HTTP.h"
-#include "Event.h"
-#include "analyzer/protocol/mime/MIME.h"
-#include "file_analysis/Manager.h"
+#include "zeek/NetVar.h"
+#include "zeek/Event.h"
+#include "zeek/analyzer/protocol/mime/MIME.h"
+#include "zeek/file_analysis/Manager.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/http/events.bif.h"
 
 namespace zeek::analyzer::http {
 
diff --git a/src/analyzer/protocol/http/HTTP.h b/src/analyzer/protocol/http/HTTP.h
index 4c2b3fe555..a034310d68 100644
--- a/src/analyzer/protocol/http/HTTP.h
+++ b/src/analyzer/protocol/http/HTTP.h
@@ -2,13 +2,14 @@
 
 #pragma once
 
-#include "analyzer/protocol/tcp/TCP.h"
-#include "analyzer/protocol/tcp/ContentLine.h"
-#include "analyzer/protocol/pia/PIA.h"
-#include "analyzer/protocol/zip/ZIP.h"
-#include "analyzer/protocol/mime/MIME.h"
-#include "binpac_zeek.h"
-#include "IPAddr.h"
+#include "zeek/analyzer/protocol/tcp/TCP.h"
+#include "zeek/analyzer/protocol/tcp/ContentLine.h"
+#include "zeek/analyzer/protocol/pia/PIA.h"
+#include "zeek/analyzer/protocol/zip/ZIP.h"
+#include "zeek/analyzer/protocol/mime/MIME.h"
+#include "zeek/binpac_zeek.h"
+#include "zeek/IPAddr.h"
+
 #include "analyzer/protocol/http/events.bif.h"
 
 namespace zeek::analyzer::http {
diff --git a/src/analyzer/protocol/http/Plugin.cc b/src/analyzer/protocol/http/Plugin.cc
index cb2c7a4351..2bbb76899c 100644
--- a/src/analyzer/protocol/http/Plugin.cc
+++ b/src/analyzer/protocol/http/Plugin.cc
@@ -1,8 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-#include "HTTP.h"
-#include "plugin/Plugin.h"
-#include "analyzer/Component.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/analyzer/Component.h"
+#include "zeek/analyzer/protocol/http/HTTP.h"
 
 namespace zeek::plugin::detail::Zeek_HTTP {
 
diff --git a/src/analyzer/protocol/http/functions.bif b/src/analyzer/protocol/http/functions.bif
index e620412a83..f7c71acab1 100644
--- a/src/analyzer/protocol/http/functions.bif
+++ b/src/analyzer/protocol/http/functions.bif
@@ -1,6 +1,6 @@
 
 %%{
-#include "analyzer/protocol/http/HTTP.h"
+#include "zeek/analyzer/protocol/http/HTTP.h"
 %%}
 
 ## Skips the data of the HTTP entity.
diff --git a/src/analyzer/protocol/icmp/ICMP.cc b/src/analyzer/protocol/icmp/ICMP.cc
index 782e062f32..368d85c616 100644
--- a/src/analyzer/protocol/icmp/ICMP.cc
+++ b/src/analyzer/protocol/icmp/ICMP.cc
@@ -1,22 +1,20 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "ICMP.h"
-
-#include <algorithm>
-
 #include "zeek-config.h"
-
-#include "IP.h"
-#include "RunState.h"
-#include "NetVar.h"
-#include "Event.h"
-#include "Conn.h"
-#include "Desc.h"
-#include "Reporter.h"
-
-#include "events.bif.h"
+#include "zeek/analyzer/protocol/icmp/ICMP.h"
 
 #include <netinet/icmp6.h>
+#include <algorithm>
+
+#include "zeek/IP.h"
+#include "zeek/RunState.h"
+#include "zeek/NetVar.h"
+#include "zeek/Event.h"
+#include "zeek/Conn.h"
+#include "zeek/Desc.h"
+#include "zeek/Reporter.h"
+
+#include "analyzer/protocol/icmp/events.bif.h"
 
 namespace zeek::analyzer::icmp {
 
@@ -49,7 +47,7 @@ void ICMP_Analyzer::DeliverPacket(int len, const u_char* data,
 
 	const struct icmp* icmpp = (const struct icmp*) data;
 
-	if ( ! zeek::detail::ignore_checksums && 
+	if ( ! zeek::detail::ignore_checksums &&
 	     ! zeek::id::find_val<TableVal>("ignore_checksums_nets")->Contains(ip->IPHeaderSrcAddr()) &&
 	     caplen >= len )
 		{
diff --git a/src/analyzer/protocol/icmp/ICMP.h b/src/analyzer/protocol/icmp/ICMP.h
index b2f20df694..ba3e869585 100644
--- a/src/analyzer/protocol/icmp/ICMP.h
+++ b/src/analyzer/protocol/icmp/ICMP.h
@@ -2,9 +2,9 @@
 
 #pragma once
 
-#include "RuleMatcher.h"
-#include "analyzer/Analyzer.h"
-#include "net_util.h"
+#include "zeek/RuleMatcher.h"
+#include "zeek/analyzer/Analyzer.h"
+#include "zeek/net_util.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(VectorVal, zeek);
 namespace zeek {
diff --git a/src/analyzer/protocol/icmp/Plugin.cc b/src/analyzer/protocol/icmp/Plugin.cc
index 2a808603e4..7326604034 100644
--- a/src/analyzer/protocol/icmp/Plugin.cc
+++ b/src/analyzer/protocol/icmp/Plugin.cc
@@ -1,8 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-#include "ICMP.h"
-#include "plugin/Plugin.h"
-#include "analyzer/Component.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/analyzer/Component.h"
+#include "zeek/analyzer/protocol/icmp/ICMP.h"
 
 namespace zeek::plugin::detail::Zeek_ICMP {
 
diff --git a/src/analyzer/protocol/ident/Ident.cc b/src/analyzer/protocol/ident/Ident.cc
index 4a4bdd1b4a..8dbd42615e 100644
--- a/src/analyzer/protocol/ident/Ident.cc
+++ b/src/analyzer/protocol/ident/Ident.cc
@@ -1,15 +1,15 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
+#include "zeek/analyzer/protocol/ident/Ident.h"
 
 #include <ctype.h>
 
-#include "ZeekString.h"
-#include "NetVar.h"
-#include "Ident.h"
-#include "Event.h"
+#include "zeek/ZeekString.h"
+#include "zeek/NetVar.h"
+#include "zeek/Event.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/ident/events.bif.h"
 
 namespace zeek::analyzer::ident {
 
diff --git a/src/analyzer/protocol/ident/Ident.h b/src/analyzer/protocol/ident/Ident.h
index a57849e011..60deb2a91e 100644
--- a/src/analyzer/protocol/ident/Ident.h
+++ b/src/analyzer/protocol/ident/Ident.h
@@ -2,8 +2,8 @@
 
 #pragma once
 
-#include "analyzer/protocol/tcp/TCP.h"
-#include "analyzer/protocol/tcp/ContentLine.h"
+#include "zeek/analyzer/protocol/tcp/TCP.h"
+#include "zeek/analyzer/protocol/tcp/ContentLine.h"
 
 namespace zeek::analyzer::ident {
 
diff --git a/src/analyzer/protocol/ident/Plugin.cc b/src/analyzer/protocol/ident/Plugin.cc
index 87c8010619..93ba19e571 100644
--- a/src/analyzer/protocol/ident/Plugin.cc
+++ b/src/analyzer/protocol/ident/Plugin.cc
@@ -1,8 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-#include "Ident.h"
-#include "plugin/Plugin.h"
-#include "analyzer/Component.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/analyzer/Component.h"
+#include "zeek/analyzer/protocol/ident/Ident.h"
 
 namespace zeek::plugin::detail::Zeek_Ident {
 
diff --git a/src/analyzer/protocol/imap/IMAP.cc b/src/analyzer/protocol/imap/IMAP.cc
index 2bd4ff2bd4..d7dc017393 100644
--- a/src/analyzer/protocol/imap/IMAP.cc
+++ b/src/analyzer/protocol/imap/IMAP.cc
@@ -1,8 +1,8 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "IMAP.h"
-#include "analyzer/protocol/tcp/TCP_Reassembler.h"
-#include "analyzer/Manager.h"
+#include "zeek/analyzer/protocol/imap/IMAP.h"
+#include "zeek/analyzer/protocol/tcp/TCP_Reassembler.h"
+#include "zeek/analyzer/Manager.h"
 
 namespace zeek::analyzer::imap {
 
diff --git a/src/analyzer/protocol/imap/IMAP.h b/src/analyzer/protocol/imap/IMAP.h
index e287bbc055..7932b5d410 100644
--- a/src/analyzer/protocol/imap/IMAP.h
+++ b/src/analyzer/protocol/imap/IMAP.h
@@ -4,9 +4,10 @@
 
 // for std::transform
 #include <algorithm>
-#include "analyzer/protocol/tcp/TCP.h"
 
-#include "imap_pac.h"
+#include "zeek/analyzer/protocol/tcp/TCP.h"
+
+#include "analyzer/protocol/imap/imap_pac.h"
 
 namespace zeek::analyzer::imap {
 
diff --git a/src/analyzer/protocol/imap/Plugin.cc b/src/analyzer/protocol/imap/Plugin.cc
index 46dc032e7e..411f2fb217 100644
--- a/src/analyzer/protocol/imap/Plugin.cc
+++ b/src/analyzer/protocol/imap/Plugin.cc
@@ -1,8 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-#include "IMAP.h"
-#include "plugin/Plugin.h"
-#include "analyzer/Component.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/analyzer/Component.h"
+#include "zeek/analyzer/protocol/imap/IMAP.h"
 
 namespace zeek::plugin::detail::Zeek_IMAP {
 
diff --git a/src/analyzer/protocol/imap/imap.pac b/src/analyzer/protocol/imap/imap.pac
index c663d69f34..bd162f0e8e 100644
--- a/src/analyzer/protocol/imap/imap.pac
+++ b/src/analyzer/protocol/imap/imap.pac
@@ -7,15 +7,17 @@
 %include zeek.pac
 
 %extern{
-#include "zeek-config.h"
-#include "Reporter.h"
-#include "events.bif.h"
 
 namespace zeek::analyzer::imap { class IMAP_Analyzer; }
 namespace binpac { namespace IMAP { class IMAP_Conn; } }
 using IMAPAnalyzer = zeek::analyzer::imap::IMAP_Analyzer*;
 
-#include "IMAP.h"
+#include "zeek-config.h"
+#include "zeek/Reporter.h"
+#include "zeek/analyzer/protocol/imap/IMAP.h"
+
+#include "analyzer/protocol/imap/events.bif.h"
+
 %}
 
 extern type IMAPAnalyzer;
diff --git a/src/analyzer/protocol/irc/IRC.cc b/src/analyzer/protocol/irc/IRC.cc
index f52f51bb60..e75d2a6ac4 100644
--- a/src/analyzer/protocol/irc/IRC.cc
+++ b/src/analyzer/protocol/irc/IRC.cc
@@ -1,13 +1,15 @@
 // An IRC analyzer contributed by Roland Gruber.
 
-#include <iostream>
-#include "IRC.h"
-#include "NetVar.h"
-#include "Event.h"
-#include "analyzer/protocol/zip/ZIP.h"
-#include "analyzer/Manager.h"
+#include "zeek/analyzer/protocol/irc/IRC.h"
 
-#include "events.bif.h"
+#include <iostream>
+
+#include "zeek/NetVar.h"
+#include "zeek/Event.h"
+#include "zeek/analyzer/protocol/zip/ZIP.h"
+#include "zeek/analyzer/Manager.h"
+
+#include "analyzer/protocol/irc/events.bif.h"
 
 using namespace std;
 
diff --git a/src/analyzer/protocol/irc/IRC.h b/src/analyzer/protocol/irc/IRC.h
index 03edb411bf..ecb37b2b68 100644
--- a/src/analyzer/protocol/irc/IRC.h
+++ b/src/analyzer/protocol/irc/IRC.h
@@ -1,8 +1,9 @@
 // An IRC analyzer contributed by Roland Gruber.
 
 #pragma once
-#include "analyzer/protocol/tcp/TCP.h"
-#include "analyzer/protocol/tcp/ContentLine.h"
+
+#include "zeek/analyzer/protocol/tcp/TCP.h"
+#include "zeek/analyzer/protocol/tcp/ContentLine.h"
 
 namespace zeek::analyzer::irc {
 
diff --git a/src/analyzer/protocol/irc/Plugin.cc b/src/analyzer/protocol/irc/Plugin.cc
index 92120e6ed0..fe60d69769 100644
--- a/src/analyzer/protocol/irc/Plugin.cc
+++ b/src/analyzer/protocol/irc/Plugin.cc
@@ -1,8 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-#include "IRC.h"
-#include "plugin/Plugin.h"
-#include "analyzer/Component.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/analyzer/Component.h"
+#include "zeek/analyzer/protocol/irc/IRC.h"
 
 namespace zeek::plugin::detail::Zeek_IRC {
 
diff --git a/src/analyzer/protocol/krb/KRB.cc b/src/analyzer/protocol/krb/KRB.cc
index d45f8c472c..929bfb13c9 100644
--- a/src/analyzer/protocol/krb/KRB.cc
+++ b/src/analyzer/protocol/krb/KRB.cc
@@ -1,11 +1,11 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "KRB.h"
+#include "zeek/analyzer/protocol/krb/KRB.h"
 
 #include <unistd.h>
 
-#include "types.bif.h"
-#include "events.bif.h"
+#include "analyzer/protocol/krb/types.bif.h"
+#include "analyzer/protocol/krb/events.bif.h"
 
 namespace zeek::analyzer::krb {
 
diff --git a/src/analyzer/protocol/krb/KRB.h b/src/analyzer/protocol/krb/KRB.h
index 27cc7faa37..fe817e5b39 100644
--- a/src/analyzer/protocol/krb/KRB.h
+++ b/src/analyzer/protocol/krb/KRB.h
@@ -2,13 +2,14 @@
 
 #pragma once
 
-#include "krb_pac.h"
+#include "zeek-config.h"
+#include <mutex>
 
 #ifdef USE_KRB5
 #include <krb5.h>
 #endif
 
-#include <mutex>
+#include "analyzer/protocol/krb/krb_pac.h"
 
 namespace zeek::analyzer::krb {
 
diff --git a/src/analyzer/protocol/krb/KRB_TCP.cc b/src/analyzer/protocol/krb/KRB_TCP.cc
index 1e39eb340b..78b777526a 100644
--- a/src/analyzer/protocol/krb/KRB_TCP.cc
+++ b/src/analyzer/protocol/krb/KRB_TCP.cc
@@ -1,9 +1,10 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "KRB_TCP.h"
-#include "analyzer/protocol/tcp/TCP_Reassembler.h"
-#include "types.bif.h"
-#include "events.bif.h"
+#include "zeek/analyzer/protocol/krb/KRB_TCP.h"
+#include "zeek/analyzer/protocol/tcp/TCP_Reassembler.h"
+
+#include "analyzer/protocol/krb/types.bif.h"
+#include "analyzer/protocol/krb/events.bif.h"
 
 namespace zeek::analyzer::krb_tcp {
 
diff --git a/src/analyzer/protocol/krb/KRB_TCP.h b/src/analyzer/protocol/krb/KRB_TCP.h
index 7d4cdceefd..d0b7ba61d8 100644
--- a/src/analyzer/protocol/krb/KRB_TCP.h
+++ b/src/analyzer/protocol/krb/KRB_TCP.h
@@ -2,9 +2,9 @@
 
 #pragma once
 
-#include "analyzer/protocol/tcp/TCP.h"
+#include "zeek/analyzer/protocol/tcp/TCP.h"
 
-#include "krb_TCP_pac.h"
+#include "analyzer/protocol/krb/krb_TCP_pac.h"
 
 namespace zeek::analyzer::krb_tcp {
 
diff --git a/src/analyzer/protocol/krb/Plugin.cc b/src/analyzer/protocol/krb/Plugin.cc
index 8d4bfe2011..9566e0272f 100644
--- a/src/analyzer/protocol/krb/Plugin.cc
+++ b/src/analyzer/protocol/krb/Plugin.cc
@@ -1,9 +1,9 @@
 //See the file in the main distribution directory for copyright.
 
-#include "KRB.h"
-#include "KRB_TCP.h"
-#include "plugin/Plugin.h"
-#include "analyzer/Component.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/analyzer/Component.h"
+#include "zeek/analyzer/protocol/krb/KRB.h"
+#include "zeek/analyzer/protocol/krb/KRB_TCP.h"
 
 namespace zeek::plugin::detail::Zeek_KRB {
 
diff --git a/src/analyzer/protocol/krb/krb-padata.pac b/src/analyzer/protocol/krb/krb-padata.pac
index a6a389d435..ccf55a4302 100644
--- a/src/analyzer/protocol/krb/krb-padata.pac
+++ b/src/analyzer/protocol/krb/krb-padata.pac
@@ -2,8 +2,8 @@
 # so we're splitting this off
 
 %extern{
-#include "file_analysis/Manager.h"
-#include "Desc.h"
+#include "zeek/file_analysis/Manager.h"
+#include "zeek/Desc.h"
 %}
 
 %header{
diff --git a/src/analyzer/protocol/krb/krb.pac b/src/analyzer/protocol/krb/krb.pac
index cf9095d0ae..d8a2392506 100644
--- a/src/analyzer/protocol/krb/krb.pac
+++ b/src/analyzer/protocol/krb/krb.pac
@@ -2,15 +2,15 @@
 %include zeek.pac
 
 %extern{
-#include "zeek-config.h"
-#include "types.bif.h"
-#include "events.bif.h"
-
 namespace zeek::analyzer::krb { class KRB_Analyzer; }
 namespace binpac { namespace KRB { class KRB_Conn; } }
 using KRBAnalyzer = zeek::analyzer::krb::KRB_Analyzer*;
 
-#include "KRB.h"
+#include "zeek-config.h"
+#include "zeek/analyzer/protocol/krb/KRB.h"
+
+#include "analyzer/protocol/krb/types.bif.h"
+#include "analyzer/protocol/krb/events.bif.h"
 %}
 
 extern type KRBAnalyzer;
diff --git a/src/analyzer/protocol/krb/krb_TCP.pac b/src/analyzer/protocol/krb/krb_TCP.pac
index 083b28ada4..d5c48395c8 100644
--- a/src/analyzer/protocol/krb/krb_TCP.pac
+++ b/src/analyzer/protocol/krb/krb_TCP.pac
@@ -2,15 +2,15 @@
 %include zeek.pac
 
 %extern{
-#include "zeek-config.h"
-#include "types.bif.h"
-#include "events.bif.h"
-
 namespace zeek::analyzer::krb_tcp { class KRB_Analyzer; }
 namespace binpac { namespace KRB_TCP { class KRB_Conn; } }
 using KRBTCPAnalyzer = zeek::analyzer::krb_tcp::KRB_Analyzer*;
 
-#include "KRB_TCP.h"
+#include "zeek-config.h"
+#include "zeek/analyzer/protocol/krb/KRB_TCP.h"
+
+#include "analyzer/protocol/krb/types.bif.h"
+#include "analyzer/protocol/krb/events.bif.h"
 %}
 
 extern type KRBTCPAnalyzer;
diff --git a/src/analyzer/protocol/login/Login.cc b/src/analyzer/protocol/login/Login.cc
index 2c3eb02f5c..d2e35960bf 100644
--- a/src/analyzer/protocol/login/Login.cc
+++ b/src/analyzer/protocol/login/Login.cc
@@ -1,19 +1,19 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
-#include "Login.h"
+#include "zeek/analyzer/protocol/login/Login.h"
 
 #include <ctype.h>
 #include <stdlib.h>
 
-#include "ZeekString.h"
-#include "NetVar.h"
-#include "RE.h"
-#include "Reporter.h"
-#include "Event.h"
-#include "Var.h"
+#include "zeek/ZeekString.h"
+#include "zeek/NetVar.h"
+#include "zeek/RE.h"
+#include "zeek/Reporter.h"
+#include "zeek/Event.h"
+#include "zeek/Var.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/login/events.bif.h"
 
 namespace zeek::analyzer::login {
 
diff --git a/src/analyzer/protocol/login/Login.h b/src/analyzer/protocol/login/Login.h
index 07527efde1..ab7be8f942 100644
--- a/src/analyzer/protocol/login/Login.h
+++ b/src/analyzer/protocol/login/Login.h
@@ -2,7 +2,7 @@
 
 #pragma once
 
-#include "analyzer/protocol/tcp/TCP.h"
+#include "zeek/analyzer/protocol/tcp/TCP.h"
 
 namespace zeek::analyzer::login {
 
diff --git a/src/analyzer/protocol/login/NVT.cc b/src/analyzer/protocol/login/NVT.cc
index a540026b3f..341c90f224 100644
--- a/src/analyzer/protocol/login/NVT.cc
+++ b/src/analyzer/protocol/login/NVT.cc
@@ -1,17 +1,17 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
-#include "NVT.h"
+#include "zeek/analyzer/protocol/login/NVT.h"
 
 #include <stdlib.h>
 
-#include "ZeekString.h"
-#include "NetVar.h"
-#include "Event.h"
-#include "Reporter.h"
-#include "analyzer/protocol/tcp/TCP.h"
+#include "zeek/ZeekString.h"
+#include "zeek/NetVar.h"
+#include "zeek/Event.h"
+#include "zeek/Reporter.h"
+#include "zeek/analyzer/protocol/tcp/TCP.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/login/events.bif.h"
 
 #define IS_3_BYTE_OPTION(c) (c >= 251 && c <= 254)
 
diff --git a/src/analyzer/protocol/login/NVT.h b/src/analyzer/protocol/login/NVT.h
index c0503f4d09..7a02db6210 100644
--- a/src/analyzer/protocol/login/NVT.h
+++ b/src/analyzer/protocol/login/NVT.h
@@ -2,7 +2,7 @@
 
 #pragma once
 
-#include "analyzer/protocol/tcp/ContentLine.h"
+#include "zeek/analyzer/protocol/tcp/ContentLine.h"
 
 #define TELNET_OPTION_BINARY 0
 #define TELNET_OPTION_TERMINAL 24
diff --git a/src/analyzer/protocol/login/Plugin.cc b/src/analyzer/protocol/login/Plugin.cc
index 60aa82760c..1912f2fdd6 100644
--- a/src/analyzer/protocol/login/Plugin.cc
+++ b/src/analyzer/protocol/login/Plugin.cc
@@ -1,11 +1,11 @@
 // See the file  in the main distribution directory for copyright.
 
-#include "Login.h"
-#include "Telnet.h"
-#include "RSH.h"
-#include "Rlogin.h"
-#include "plugin/Plugin.h"
-#include "analyzer/Component.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/analyzer/Component.h"
+#include "zeek/analyzer/protocol/login/Login.h"
+#include "zeek/analyzer/protocol/login/Telnet.h"
+#include "zeek/analyzer/protocol/login/RSH.h"
+#include "zeek/analyzer/protocol/login/Rlogin.h"
 
 namespace zeek::plugin::detail::Zeek_Login {
 
diff --git a/src/analyzer/protocol/login/RSH.cc b/src/analyzer/protocol/login/RSH.cc
index b3ceec949d..8f6a090b39 100644
--- a/src/analyzer/protocol/login/RSH.cc
+++ b/src/analyzer/protocol/login/RSH.cc
@@ -1,13 +1,13 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
+#include "zeek/analyzer/protocol/login/RSH.h"
 
-#include "RSH.h"
-#include "NetVar.h"
-#include "Event.h"
-#include "Reporter.h"
+#include "zeek/NetVar.h"
+#include "zeek/Event.h"
+#include "zeek/Reporter.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/login/events.bif.h"
 
 namespace zeek::analyzer::login {
 
diff --git a/src/analyzer/protocol/login/RSH.h b/src/analyzer/protocol/login/RSH.h
index 8eb2a1b5a8..570c7a950a 100644
--- a/src/analyzer/protocol/login/RSH.h
+++ b/src/analyzer/protocol/login/RSH.h
@@ -2,8 +2,8 @@
 
 #pragma once
 
-#include "Login.h"
-#include "analyzer/protocol/tcp/ContentLine.h"
+#include "zeek/analyzer/protocol/login/Login.h"
+#include "zeek/analyzer/protocol/tcp/ContentLine.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(Rsh_Analyzer, zeek, analyzer::login);
 
diff --git a/src/analyzer/protocol/login/Rlogin.cc b/src/analyzer/protocol/login/Rlogin.cc
index 8f29c0709b..7bd927d797 100644
--- a/src/analyzer/protocol/login/Rlogin.cc
+++ b/src/analyzer/protocol/login/Rlogin.cc
@@ -1,13 +1,13 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
+#include "zeek/analyzer/protocol/login/Rlogin.h"
 
-#include "Rlogin.h"
-#include "NetVar.h"
-#include "Event.h"
-#include "Reporter.h"
+#include "zeek/NetVar.h"
+#include "zeek/Event.h"
+#include "zeek/Reporter.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/login/events.bif.h"
 
 namespace zeek::analyzer::login {
 
diff --git a/src/analyzer/protocol/login/Rlogin.h b/src/analyzer/protocol/login/Rlogin.h
index 7e10dab87a..cbeb874e39 100644
--- a/src/analyzer/protocol/login/Rlogin.h
+++ b/src/analyzer/protocol/login/Rlogin.h
@@ -2,8 +2,8 @@
 
 #pragma once
 
-#include "Login.h"
-#include "analyzer/protocol/tcp/ContentLine.h"
+#include "zeek/analyzer/protocol/login/Login.h"
+#include "zeek/analyzer/protocol/tcp/ContentLine.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(Rlogin_Analyzer, zeek, analyzer::login);
 
diff --git a/src/analyzer/protocol/login/Telnet.cc b/src/analyzer/protocol/login/Telnet.cc
index c6ca1a00d7..2fe167ff68 100644
--- a/src/analyzer/protocol/login/Telnet.cc
+++ b/src/analyzer/protocol/login/Telnet.cc
@@ -2,10 +2,10 @@
 
 #include "zeek-config.h"
 
-#include "Telnet.h"
-#include "NVT.h"
+#include "zeek/analyzer/protocol/login/Telnet.h"
+#include "zeek/analyzer/protocol/login/NVT.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/login/events.bif.h"
 
 namespace zeek::analyzer::login {
 
diff --git a/src/analyzer/protocol/login/Telnet.h b/src/analyzer/protocol/login/Telnet.h
index 0d6ebbe4df..f2d851f3ff 100644
--- a/src/analyzer/protocol/login/Telnet.h
+++ b/src/analyzer/protocol/login/Telnet.h
@@ -2,7 +2,7 @@
 
 #pragma once
 
-#include "Login.h"
+#include "zeek/analyzer/protocol/login/Login.h"
 
 namespace zeek::analyzer::login {
 
diff --git a/src/analyzer/protocol/login/functions.bif b/src/analyzer/protocol/login/functions.bif
index 3b2b0e610c..117c5c9395 100644
--- a/src/analyzer/protocol/login/functions.bif
+++ b/src/analyzer/protocol/login/functions.bif
@@ -1,8 +1,8 @@
 
 %%{
-#include "Login.h"
-#include "Reporter.h"
-#include "Sessions.h"
+#include "zeek/analyzer/protocol/login/Login.h"
+#include "zeek/Reporter.h"
+#include "zeek/Sessions.h"
 %%}
 
 ## Returns the state of the given login (Telnet or Rlogin) connection.
diff --git a/src/analyzer/protocol/mime/MIME.cc b/src/analyzer/protocol/mime/MIME.cc
index 8f1da4c86c..e2c96e3a4e 100644
--- a/src/analyzer/protocol/mime/MIME.cc
+++ b/src/analyzer/protocol/mime/MIME.cc
@@ -1,13 +1,13 @@
 #include "zeek-config.h"
+#include "zeek/analyzer/protocol/mime/MIME.h"
 
-#include "MIME.h"
-#include "NetVar.h"
-#include "Base64.h"
-#include "Reporter.h"
-#include "digest.h"
-#include "file_analysis/Manager.h"
+#include "zeek/NetVar.h"
+#include "zeek/Base64.h"
+#include "zeek/Reporter.h"
+#include "zeek/digest.h"
+#include "zeek/file_analysis/Manager.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/mime/events.bif.h"
 
 // Here are a few things to do:
 //
diff --git a/src/analyzer/protocol/mime/MIME.h b/src/analyzer/protocol/mime/MIME.h
index 8d7335ffa2..16c2c1895c 100644
--- a/src/analyzer/protocol/mime/MIME.h
+++ b/src/analyzer/protocol/mime/MIME.h
@@ -6,9 +6,9 @@
 #include <vector>
 #include <queue>
 
-#include "ZeekString.h"
-#include "Reporter.h"
-#include "analyzer/Analyzer.h"
+#include "zeek/ZeekString.h"
+#include "zeek/Reporter.h"
+#include "zeek/analyzer/Analyzer.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(TableVal, zeek);
 ZEEK_FORWARD_DECLARE_NAMESPACED(StringVal, zeek);
diff --git a/src/analyzer/protocol/mime/Plugin.cc b/src/analyzer/protocol/mime/Plugin.cc
index 0e06a20431..6b507460d8 100644
--- a/src/analyzer/protocol/mime/Plugin.cc
+++ b/src/analyzer/protocol/mime/Plugin.cc
@@ -1,7 +1,6 @@
 // See the file  in the main distribution directory for copyright.
 
-
-#include "plugin/Plugin.h"
+#include "zeek/plugin/Plugin.h"
 
 namespace zeek::plugin::detail::Zeek_MIME {
 
diff --git a/src/analyzer/protocol/modbus/Modbus.cc b/src/analyzer/protocol/modbus/Modbus.cc
index 374f7c2f22..5803cec40c 100644
--- a/src/analyzer/protocol/modbus/Modbus.cc
+++ b/src/analyzer/protocol/modbus/Modbus.cc
@@ -1,8 +1,7 @@
+#include "zeek/analyzer/protocol/modbus/Modbus.h"
+#include "zeek/analyzer/protocol/tcp/TCP_Reassembler.h"
 
-#include "Modbus.h"
-#include "analyzer/protocol/tcp/TCP_Reassembler.h"
-
-#include "events.bif.h"
+#include "analyzer/protocol/modbus/events.bif.h"
 
 namespace zeek::analyzer::modbus {
 
diff --git a/src/analyzer/protocol/modbus/Modbus.h b/src/analyzer/protocol/modbus/Modbus.h
index e316e6d940..9415f4ddc5 100644
--- a/src/analyzer/protocol/modbus/Modbus.h
+++ b/src/analyzer/protocol/modbus/Modbus.h
@@ -1,7 +1,8 @@
 #pragma once
 
-#include "analyzer/protocol/tcp/TCP.h"
-#include "modbus_pac.h"
+#include "zeek/analyzer/protocol/tcp/TCP.h"
+
+#include "analyzer/protocol/modbus/modbus_pac.h"
 
 namespace zeek::analyzer::modbus {
 
diff --git a/src/analyzer/protocol/modbus/Plugin.cc b/src/analyzer/protocol/modbus/Plugin.cc
index ddfee8bebe..6c19627dfe 100644
--- a/src/analyzer/protocol/modbus/Plugin.cc
+++ b/src/analyzer/protocol/modbus/Plugin.cc
@@ -1,8 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-#include "Modbus.h"
-#include "plugin/Plugin.h"
-#include "analyzer/Component.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/analyzer/Component.h"
+#include "zeek/analyzer/protocol/modbus/Modbus.h"
 
 namespace zeek::plugin::detail::Zeek_Modbus {
 
diff --git a/src/analyzer/protocol/modbus/modbus.pac b/src/analyzer/protocol/modbus/modbus.pac
index 6f94e1c43b..e768840fbe 100644
--- a/src/analyzer/protocol/modbus/modbus.pac
+++ b/src/analyzer/protocol/modbus/modbus.pac
@@ -10,7 +10,7 @@
 %include zeek.pac
 
 %extern{
-#include "events.bif.h"
+#include "analyzer/protocol/modbus/events.bif.h"
 %}
 
 analyzer ModbusTCP withcontext {
diff --git a/src/analyzer/protocol/mqtt/MQTT.cc b/src/analyzer/protocol/mqtt/MQTT.cc
index 5612d7456a..2281f5fadb 100644
--- a/src/analyzer/protocol/mqtt/MQTT.cc
+++ b/src/analyzer/protocol/mqtt/MQTT.cc
@@ -1,11 +1,10 @@
 // See the file  in the main distribution directory for copyright.
 
-#include "plugin/Plugin.h"
+#include "zeek/analyzer/protocol/mqtt/MQTT.h"
 
-#include "MQTT.h"
-#include "Reporter.h"
-#include "Scope.h"
-#include "mqtt_pac.h"
+#include "zeek/Reporter.h"
+
+#include "analyzer/protocol/mqtt/mqtt_pac.h"
 
 namespace zeek::analyzer::mqtt {
 
diff --git a/src/analyzer/protocol/mqtt/MQTT.h b/src/analyzer/protocol/mqtt/MQTT.h
index 9b1a49747b..c657281b72 100644
--- a/src/analyzer/protocol/mqtt/MQTT.h
+++ b/src/analyzer/protocol/mqtt/MQTT.h
@@ -2,8 +2,8 @@
 
 #pragma once
 
-#include "analyzer/protocol/tcp/TCP.h"
-#include "ID.h"
+#include "zeek/analyzer/protocol/tcp/TCP.h"
+#include "zeek/ID.h"
 
 namespace binpac { namespace MQTT { class MQTT_Conn; } }
 
diff --git a/src/analyzer/protocol/mqtt/Plugin.cc b/src/analyzer/protocol/mqtt/Plugin.cc
index cac61029fc..ac00c64217 100644
--- a/src/analyzer/protocol/mqtt/Plugin.cc
+++ b/src/analyzer/protocol/mqtt/Plugin.cc
@@ -1,8 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-#include "MQTT.h"
-#include "plugin/Plugin.h"
-#include "analyzer/Component.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/analyzer/Component.h"
+#include "zeek/analyzer/protocol/mqtt/MQTT.h"
 
 namespace zeek::plugin::detail::Zeek_MQTT {
 
diff --git a/src/analyzer/protocol/mqtt/mqtt.pac b/src/analyzer/protocol/mqtt/mqtt.pac
index 2dd5af2b72..82aa991fab 100644
--- a/src/analyzer/protocol/mqtt/mqtt.pac
+++ b/src/analyzer/protocol/mqtt/mqtt.pac
@@ -4,9 +4,9 @@
 %include zeek.pac
 
 %extern{
-	#include "MQTT.h"
-	#include "events.bif.h"
-	#include "types.bif.h"
+	#include "zeek/analyzer/protocol/mqtt/MQTT.h"
+	#include "analyzer/protocol/mqtt/events.bif.h"
+	#include "analyzer/protocol/mqtt/types.bif.h"
 %}
 
 analyzer MQTT withcontext {
diff --git a/src/analyzer/protocol/mysql/MySQL.cc b/src/analyzer/protocol/mysql/MySQL.cc
index db97774d53..7a5ae507b2 100644
--- a/src/analyzer/protocol/mysql/MySQL.cc
+++ b/src/analyzer/protocol/mysql/MySQL.cc
@@ -1,9 +1,11 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "MySQL.h"
-#include "analyzer/protocol/tcp/TCP_Reassembler.h"
-#include "Reporter.h"
-#include "events.bif.h"
+#include "zeek/analyzer/protocol/mysql/MySQL.h"
+
+#include "zeek/analyzer/protocol/tcp/TCP_Reassembler.h"
+#include "zeek/Reporter.h"
+
+#include "analyzer/protocol/mysql/events.bif.h"
 
 namespace zeek::analyzer::mysql {
 
diff --git a/src/analyzer/protocol/mysql/MySQL.h b/src/analyzer/protocol/mysql/MySQL.h
index 8f987e8547..4ddb872c08 100644
--- a/src/analyzer/protocol/mysql/MySQL.h
+++ b/src/analyzer/protocol/mysql/MySQL.h
@@ -2,10 +2,10 @@
 
 #pragma once
 
-#include "events.bif.h"
-#include "analyzer/protocol/tcp/TCP.h"
+#include "zeek/analyzer/protocol/tcp/TCP.h"
 
-#include "mysql_pac.h"
+#include "analyzer/protocol/mysql/events.bif.h"
+#include "analyzer/protocol/mysql/mysql_pac.h"
 
 namespace zeek::analyzer::mysql {
 
diff --git a/src/analyzer/protocol/mysql/Plugin.cc b/src/analyzer/protocol/mysql/Plugin.cc
index 98c8c9cdda..9786061244 100644
--- a/src/analyzer/protocol/mysql/Plugin.cc
+++ b/src/analyzer/protocol/mysql/Plugin.cc
@@ -1,8 +1,8 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "MySQL.h"
-#include "plugin/Plugin.h"
-#include "analyzer/Component.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/analyzer/Component.h"
+#include "zeek/analyzer/protocol/mysql/MySQL.h"
 
 namespace zeek::plugin::detail::Zeek_MySQL {
 
diff --git a/src/analyzer/protocol/mysql/mysql.pac b/src/analyzer/protocol/mysql/mysql.pac
index 28453cb830..1cf589c891 100644
--- a/src/analyzer/protocol/mysql/mysql.pac
+++ b/src/analyzer/protocol/mysql/mysql.pac
@@ -8,7 +8,7 @@
 %include zeek.pac
 
 %extern{
-	#include "events.bif.h"
+	#include "analyzer/protocol/mysql/events.bif.h"
 %}
 
 analyzer MySQL withcontext {
diff --git a/src/analyzer/protocol/ncp/NCP.cc b/src/analyzer/protocol/ncp/NCP.cc
index afeed8c3eb..7282015cfb 100644
--- a/src/analyzer/protocol/ncp/NCP.cc
+++ b/src/analyzer/protocol/ncp/NCP.cc
@@ -1,21 +1,19 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
+#include "zeek/analyzer/protocol/ncp/NCP.h"
 
 #include <stdlib.h>
 #include <string>
 #include <map>
 
-#include "NCP.h"
+#include "zeek/Sessions.h"
 
-#include "events.bif.h"
-#include "consts.bif.h"
+#include "analyzer/protocol/ncp/events.bif.h"
+#include "analyzer/protocol/ncp/consts.bif.h"
 
 using namespace std;
 
-#include "NCP.h"
-#include "Sessions.h"
-
 #define xbyte(b, n) (((const u_char*) (b))[n])
 #define extract_uint16(little_endian, bytes) \
 	((little_endian) ? \
diff --git a/src/analyzer/protocol/ncp/NCP.h b/src/analyzer/protocol/ncp/NCP.h
index 70032f28aa..4259bba8b4 100644
--- a/src/analyzer/protocol/ncp/NCP.h
+++ b/src/analyzer/protocol/ncp/NCP.h
@@ -17,10 +17,10 @@
 //
 //	http://faydoc.tripod.com/structures/21/2149.htm
 
-#include "NetVar.h"
-#include "analyzer/protocol/tcp/TCP.h"
+#include "zeek/NetVar.h"
+#include "zeek/analyzer/protocol/tcp/TCP.h"
 
-#include "ncp_pac.h"
+#include "analyzer/protocol/ncp/ncp_pac.h"
 
 namespace zeek::analyzer::ncp {
 namespace detail {
diff --git a/src/analyzer/protocol/ncp/Plugin.cc b/src/analyzer/protocol/ncp/Plugin.cc
index 8fad308bf1..ec9b26ac16 100644
--- a/src/analyzer/protocol/ncp/Plugin.cc
+++ b/src/analyzer/protocol/ncp/Plugin.cc
@@ -1,8 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-#include "NCP.h"
-#include "plugin/Plugin.h"
-#include "analyzer/Component.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/analyzer/Component.h"
+#include "zeek/analyzer/protocol/ncp/NCP.h"
 
 namespace zeek::plugin::detail::Zeek_NCP {
 
diff --git a/src/analyzer/protocol/ncp/ncp.pac b/src/analyzer/protocol/ncp/ncp.pac
index dd92672a44..d86187c2ad 100644
--- a/src/analyzer/protocol/ncp/ncp.pac
+++ b/src/analyzer/protocol/ncp/ncp.pac
@@ -3,7 +3,7 @@
 %include zeek.pac
 
 %extern{
-#include "events.bif.h"
+#include "analyzer/protocol/ncp/events.bif.h"
 %}
 
 analyzer NCP withcontext {};
diff --git a/src/analyzer/protocol/netbios/NetbiosSSN.cc b/src/analyzer/protocol/netbios/NetbiosSSN.cc
index c157aa506e..da6c91bb36 100644
--- a/src/analyzer/protocol/netbios/NetbiosSSN.cc
+++ b/src/analyzer/protocol/netbios/NetbiosSSN.cc
@@ -1,17 +1,17 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
-#include "NetbiosSSN.h"
+#include "zeek/analyzer/protocol/netbios/NetbiosSSN.h"
 
 #include <ctype.h>
 
-#include "ZeekString.h"
-#include "NetVar.h"
-#include "Sessions.h"
-#include "Event.h"
-#include "RunState.h"
+#include "zeek/ZeekString.h"
+#include "zeek/NetVar.h"
+#include "zeek/Sessions.h"
+#include "zeek/Event.h"
+#include "zeek/RunState.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/netbios/events.bif.h"
 
 constexpr double netbios_ssn_session_timeout = 15.0;
 
diff --git a/src/analyzer/protocol/netbios/NetbiosSSN.h b/src/analyzer/protocol/netbios/NetbiosSSN.h
index 444cf63e33..0da1a02c96 100644
--- a/src/analyzer/protocol/netbios/NetbiosSSN.h
+++ b/src/analyzer/protocol/netbios/NetbiosSSN.h
@@ -2,8 +2,8 @@
 
 #pragma once
 
-#include "analyzer/protocol/udp/UDP.h"
-#include "analyzer/protocol/tcp/TCP.h"
+#include "zeek/analyzer/protocol/udp/UDP.h"
+#include "zeek/analyzer/protocol/tcp/TCP.h"
 
 namespace zeek::analyzer::netbios_ssn {
 namespace detail {
diff --git a/src/analyzer/protocol/netbios/Plugin.cc b/src/analyzer/protocol/netbios/Plugin.cc
index 519430bb65..e8695936e4 100644
--- a/src/analyzer/protocol/netbios/Plugin.cc
+++ b/src/analyzer/protocol/netbios/Plugin.cc
@@ -1,8 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-#include "NetbiosSSN.h"
-#include "plugin/Plugin.h"
-#include "analyzer/Component.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/analyzer/Component.h"
+#include "zeek/analyzer/protocol/netbios/NetbiosSSN.h"
 
 namespace zeek::plugin::detail::Zeek_NetBIOS {
 
diff --git a/src/analyzer/protocol/netbios/functions.bif b/src/analyzer/protocol/netbios/functions.bif
index 255a007de5..0a20c436d1 100644
--- a/src/analyzer/protocol/netbios/functions.bif
+++ b/src/analyzer/protocol/netbios/functions.bif
@@ -1,5 +1,5 @@
 %%{
-#include "Reporter.h"
+#include "zeek/Reporter.h"
 %%}
 
 ## Decode a NetBIOS name.  See http://support.microsoft.com/kb/194203.
diff --git a/src/analyzer/protocol/ntlm/NTLM.cc b/src/analyzer/protocol/ntlm/NTLM.cc
index 480e5bb212..a12625db29 100644
--- a/src/analyzer/protocol/ntlm/NTLM.cc
+++ b/src/analyzer/protocol/ntlm/NTLM.cc
@@ -1,9 +1,11 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "NTLM.h"
-#include "analyzer/protocol/tcp/TCP_Reassembler.h"
-#include "Reporter.h"
-#include "events.bif.h"
+#include "zeek/analyzer/protocol/ntlm/NTLM.h"
+
+#include "zeek/analyzer/protocol/tcp/TCP_Reassembler.h"
+#include "zeek/Reporter.h"
+
+#include "analyzer/protocol/ntlm/events.bif.h"
 
 namespace zeek::analyzer::ntlm {
 
diff --git a/src/analyzer/protocol/ntlm/NTLM.h b/src/analyzer/protocol/ntlm/NTLM.h
index 25474ba342..79658fec6c 100644
--- a/src/analyzer/protocol/ntlm/NTLM.h
+++ b/src/analyzer/protocol/ntlm/NTLM.h
@@ -2,10 +2,10 @@
 
 #pragma once
 
-#include "events.bif.h"
-#include "analyzer/protocol/tcp/TCP.h"
+#include "zeek/analyzer/protocol/tcp/TCP.h"
 
-#include "ntlm_pac.h"
+#include "analyzer/protocol/ntlm/events.bif.h"
+#include "analyzer/protocol/ntlm/ntlm_pac.h"
 
 namespace zeek::analyzer::ntlm {
 
diff --git a/src/analyzer/protocol/ntlm/Plugin.cc b/src/analyzer/protocol/ntlm/Plugin.cc
index bf40e72a89..e9db675f83 100644
--- a/src/analyzer/protocol/ntlm/Plugin.cc
+++ b/src/analyzer/protocol/ntlm/Plugin.cc
@@ -1,8 +1,7 @@
 // See the file in the main distribution directory for copyright.
 
-#include "plugin/Plugin.h"
-
-#include "NTLM.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/analyzer/protocol/ntlm/NTLM.h"
 
 namespace zeek::plugin::detail::Zeek_NTLM {
 
diff --git a/src/analyzer/protocol/ntlm/ntlm.pac b/src/analyzer/protocol/ntlm/ntlm.pac
index ffa781b308..a686f306a2 100644
--- a/src/analyzer/protocol/ntlm/ntlm.pac
+++ b/src/analyzer/protocol/ntlm/ntlm.pac
@@ -2,11 +2,11 @@
 %include zeek.pac
 
 %extern{
-#include "analyzer/Manager.h"
-#include "analyzer/Analyzer.h"
+#include "zeek/analyzer/Manager.h"
+#include "zeek/analyzer/Analyzer.h"
 
-#include "types.bif.h"
-#include "events.bif.h"
+#include "analyzer/protocol/ntlm/types.bif.h"
+#include "analyzer/protocol/ntlm/events.bif.h"
 %}
 
 analyzer NTLM withcontext {
diff --git a/src/analyzer/protocol/ntp/NTP.cc b/src/analyzer/protocol/ntp/NTP.cc
index 0885fea3b0..b5dbcae06e 100644
--- a/src/analyzer/protocol/ntp/NTP.cc
+++ b/src/analyzer/protocol/ntp/NTP.cc
@@ -1,8 +1,8 @@
-#include "NTP.h"
+#include "zeek/analyzer/protocol/ntp/NTP.h"
 
-#include "Reporter.h"
+#include "zeek/Reporter.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/ntp/events.bif.h"
 
 namespace zeek::analyzer::ntp {
 
diff --git a/src/analyzer/protocol/ntp/NTP.h b/src/analyzer/protocol/ntp/NTP.h
index 91b3615723..c737fdff6f 100644
--- a/src/analyzer/protocol/ntp/NTP.h
+++ b/src/analyzer/protocol/ntp/NTP.h
@@ -1,11 +1,10 @@
 #pragma once
 
-#include "events.bif.h"
-#include "types.bif.h"
+#include "zeek/analyzer/protocol/udp/UDP.h"
 
-#include "analyzer/protocol/udp/UDP.h"
-
-#include "ntp_pac.h"
+#include "analyzer/protocol/ntp/events.bif.h"
+#include "analyzer/protocol/ntp/types.bif.h"
+#include "analyzer/protocol/ntp/ntp_pac.h"
 
 namespace zeek::analyzer::ntp {
 
diff --git a/src/analyzer/protocol/ntp/Plugin.cc b/src/analyzer/protocol/ntp/Plugin.cc
index d6587fe688..a1083c3c3e 100644
--- a/src/analyzer/protocol/ntp/Plugin.cc
+++ b/src/analyzer/protocol/ntp/Plugin.cc
@@ -1,8 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-#include "NTP.h"
-#include "plugin/Plugin.h"
-#include "analyzer/Component.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/analyzer/Component.h"
+#include "zeek/analyzer/protocol/ntp/NTP.h"
 
 namespace zeek::plugin::detail::Zeek_NTP {
 
diff --git a/src/analyzer/protocol/ntp/ntp.pac b/src/analyzer/protocol/ntp/ntp.pac
index 6f4343a246..807082b491 100644
--- a/src/analyzer/protocol/ntp/ntp.pac
+++ b/src/analyzer/protocol/ntp/ntp.pac
@@ -3,8 +3,8 @@
 %include zeek.pac
 
 %extern{
-	#include "types.bif.h"
-	#include "events.bif.h"
+	#include "analyzer/protocol/ntp/types.bif.h"
+	#include "analyzer/protocol/ntp/events.bif.h"
 %}
 
 analyzer NTP withcontext {
diff --git a/src/analyzer/protocol/pia/PIA.cc b/src/analyzer/protocol/pia/PIA.cc
index 840a20a5ff..daf156dae3 100644
--- a/src/analyzer/protocol/pia/PIA.cc
+++ b/src/analyzer/protocol/pia/PIA.cc
@@ -1,13 +1,14 @@
-#include "PIA.h"
-#include "RuleMatcher.h"
-#include "Event.h"
-#include "NetVar.h"
-#include "IP.h"
-#include "DebugLogger.h"
-#include "Reporter.h"
-#include "RunState.h"
-#include "analyzer/protocol/tcp/TCP_Flags.h"
-#include "analyzer/protocol/tcp/TCP_Reassembler.h"
+#include "zeek/analyzer/protocol/pia/PIA.h"
+
+#include "zeek/RuleMatcher.h"
+#include "zeek/Event.h"
+#include "zeek/NetVar.h"
+#include "zeek/IP.h"
+#include "zeek/DebugLogger.h"
+#include "zeek/Reporter.h"
+#include "zeek/RunState.h"
+#include "zeek/analyzer/protocol/tcp/TCP_Flags.h"
+#include "zeek/analyzer/protocol/tcp/TCP_Reassembler.h"
 
 namespace zeek::analyzer::pia {
 
diff --git a/src/analyzer/protocol/pia/PIA.h b/src/analyzer/protocol/pia/PIA.h
index 5d52c8b406..86d0fc18fc 100644
--- a/src/analyzer/protocol/pia/PIA.h
+++ b/src/analyzer/protocol/pia/PIA.h
@@ -2,9 +2,9 @@
 
 #pragma once
 
-#include "analyzer/Analyzer.h"
-#include "analyzer/protocol/tcp/TCP.h"
-#include "RuleMatcher.h"
+#include "zeek/analyzer/Analyzer.h"
+#include "zeek/analyzer/protocol/tcp/TCP.h"
+#include "zeek/RuleMatcher.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(RuleEndpointState, zeek::detail);
 
diff --git a/src/analyzer/protocol/pia/Plugin.cc b/src/analyzer/protocol/pia/Plugin.cc
index 6f42a90c62..ac31e2c84b 100644
--- a/src/analyzer/protocol/pia/Plugin.cc
+++ b/src/analyzer/protocol/pia/Plugin.cc
@@ -1,8 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-#include "PIA.h"
-#include "plugin/Plugin.h"
-#include "analyzer/Component.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/analyzer/Component.h"
+#include "zeek/analyzer/protocol/pia/PIA.h"
 
 namespace zeek::plugin::detail::Zeek_PIA {
 
diff --git a/src/analyzer/protocol/pop3/POP3.cc b/src/analyzer/protocol/pop3/POP3.cc
index b9dbea0f34..8c5ff60203 100644
--- a/src/analyzer/protocol/pop3/POP3.cc
+++ b/src/analyzer/protocol/pop3/POP3.cc
@@ -2,17 +2,17 @@
 // Robin Sommer.
 
 #include "zeek-config.h"
-#include "POP3.h"
+#include "zeek/analyzer/protocol/pop3/POP3.h"
 
 #include <vector>
 #include <string>
 #include <ctype.h>
 
-#include "Base64.h"
-#include "Reporter.h"
-#include "analyzer/Manager.h"
+#include "zeek/Base64.h"
+#include "zeek/Reporter.h"
+#include "zeek/analyzer/Manager.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/pop3/events.bif.h"
 
 namespace zeek::analyzer::pop3 {
 
diff --git a/src/analyzer/protocol/pop3/POP3.h b/src/analyzer/protocol/pop3/POP3.h
index dc94f9ce4c..39e116da9f 100644
--- a/src/analyzer/protocol/pop3/POP3.h
+++ b/src/analyzer/protocol/pop3/POP3.h
@@ -8,10 +8,10 @@
 #include <string>
 #include <algorithm>
 
-#include "analyzer/protocol/tcp/TCP.h"
-#include "analyzer/protocol/tcp/ContentLine.h"
-#include "analyzer/protocol/login/NVT.h"
-#include "analyzer/protocol/mime/MIME.h"
+#include "zeek/analyzer/protocol/tcp/TCP.h"
+#include "zeek/analyzer/protocol/tcp/ContentLine.h"
+#include "zeek/analyzer/protocol/login/NVT.h"
+#include "zeek/analyzer/protocol/mime/MIME.h"
 
 #undef POP3_CMD_DEF
 #define POP3_CMD_DEF(cmd)	POP3_CMD_##cmd,
diff --git a/src/analyzer/protocol/pop3/Plugin.cc b/src/analyzer/protocol/pop3/Plugin.cc
index 3b46a02471..4666b5d268 100644
--- a/src/analyzer/protocol/pop3/Plugin.cc
+++ b/src/analyzer/protocol/pop3/Plugin.cc
@@ -1,8 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-#include "POP3.h"
-#include "plugin/Plugin.h"
-#include "analyzer/Component.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/analyzer/Component.h"
+#include "zeek/analyzer/protocol/pop3/POP3.h"
 
 namespace zeek::plugin::detail::Zeek_POP3 {
 
diff --git a/src/analyzer/protocol/radius/Plugin.cc b/src/analyzer/protocol/radius/Plugin.cc
index 4b2a4df5cf..e566f221b8 100644
--- a/src/analyzer/protocol/radius/Plugin.cc
+++ b/src/analyzer/protocol/radius/Plugin.cc
@@ -1,8 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-#include "RADIUS.h"
-#include "plugin/Plugin.h"
-#include "analyzer/Component.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/analyzer/Component.h"
+#include "zeek/analyzer/protocol/radius/RADIUS.h"
 
 namespace zeek::plugin::detail::Zeek_RADIUS {
 
diff --git a/src/analyzer/protocol/radius/RADIUS.cc b/src/analyzer/protocol/radius/RADIUS.cc
index 109f4fff98..cb5d5541b3 100644
--- a/src/analyzer/protocol/radius/RADIUS.cc
+++ b/src/analyzer/protocol/radius/RADIUS.cc
@@ -1,10 +1,8 @@
-// Generated by binpac_quickstart
+#include "zeek/analyzer/protocol/radius/RADIUS.h"
 
-#include "RADIUS.h"
+#include "zeek/Reporter.h"
 
-#include "Reporter.h"
-
-#include "events.bif.h"
+#include "analyzer/protocol/radius/events.bif.h"
 
 namespace zeek::analyzer::radius {
 
diff --git a/src/analyzer/protocol/radius/RADIUS.h b/src/analyzer/protocol/radius/RADIUS.h
index 5fa9837514..0ce1c14a22 100644
--- a/src/analyzer/protocol/radius/RADIUS.h
+++ b/src/analyzer/protocol/radius/RADIUS.h
@@ -1,12 +1,9 @@
-// Generated by binpac_quickstart
-
 #pragma once
 
-#include "events.bif.h"
+#include "zeek/analyzer/protocol/udp/UDP.h"
 
-#include "analyzer/protocol/udp/UDP.h"
-
-#include "radius_pac.h"
+#include "analyzer/protocol/radius/events.bif.h"
+#include "analyzer/protocol/radius/radius_pac.h"
 
 namespace zeek::analyzer::radius {
 
diff --git a/src/analyzer/protocol/radius/radius.pac b/src/analyzer/protocol/radius/radius.pac
index 6da1813ba7..0a9c64b560 100644
--- a/src/analyzer/protocol/radius/radius.pac
+++ b/src/analyzer/protocol/radius/radius.pac
@@ -6,7 +6,7 @@
 %include zeek.pac
 
 %extern{
-	#include "events.bif.h"
+	#include "analyzer/protocol/radius/events.bif.h"
 %}
 
 analyzer RADIUS withcontext {
diff --git a/src/analyzer/protocol/rdp/Plugin.cc b/src/analyzer/protocol/rdp/Plugin.cc
index 042315cd8a..a7db2e122d 100644
--- a/src/analyzer/protocol/rdp/Plugin.cc
+++ b/src/analyzer/protocol/rdp/Plugin.cc
@@ -1,7 +1,7 @@
-#include "RDP.h"
-#include "RDPEUDP.h"
-#include "plugin/Plugin.h"
-#include "analyzer/Component.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/analyzer/Component.h"
+#include "zeek/analyzer/protocol/rdp/RDP.h"
+#include "zeek/analyzer/protocol/rdp/RDPEUDP.h"
 
 namespace zeek::plugin::detail::Zeek_RDP {
 
diff --git a/src/analyzer/protocol/rdp/RDP.cc b/src/analyzer/protocol/rdp/RDP.cc
index f04c312fbd..585cca7d2b 100644
--- a/src/analyzer/protocol/rdp/RDP.cc
+++ b/src/analyzer/protocol/rdp/RDP.cc
@@ -1,8 +1,9 @@
-#include "RDP.h"
-#include "analyzer/protocol/tcp/TCP_Reassembler.h"
-#include "Reporter.h"
-#include "events.bif.h"
-#include "types.bif.h"
+#include "zeek/analyzer/protocol/rdp/RDP.h"
+#include "zeek/analyzer/protocol/tcp/TCP_Reassembler.h"
+#include "zeek/Reporter.h"
+
+#include "analyzer/protocol/rdp/events.bif.h"
+#include "analyzer/protocol/rdp/types.bif.h"
 
 namespace zeek::analyzer::rdp {
 
diff --git a/src/analyzer/protocol/rdp/RDP.h b/src/analyzer/protocol/rdp/RDP.h
index 3b9fdfe2d3..cedd8729df 100644
--- a/src/analyzer/protocol/rdp/RDP.h
+++ b/src/analyzer/protocol/rdp/RDP.h
@@ -1,9 +1,10 @@
 #pragma once
 
-#include "events.bif.h"
-#include "analyzer/protocol/tcp/TCP.h"
-#include "analyzer/protocol/pia/PIA.h"
-#include "rdp_pac.h"
+#include "zeek/analyzer/protocol/tcp/TCP.h"
+#include "zeek/analyzer/protocol/pia/PIA.h"
+
+#include "analyzer/protocol/rdp/events.bif.h"
+#include "analyzer/protocol/rdp/rdp_pac.h"
 
 namespace zeek::analyzer::rdp {
 
diff --git a/src/analyzer/protocol/rdp/RDPEUDP.cc b/src/analyzer/protocol/rdp/RDPEUDP.cc
index 970d1f7797..5f70e80c7f 100644
--- a/src/analyzer/protocol/rdp/RDPEUDP.cc
+++ b/src/analyzer/protocol/rdp/RDPEUDP.cc
@@ -1,7 +1,9 @@
-#include "RDPEUDP.h"
-#include "Reporter.h"
-#include "events.bif.h"
-#include "rdpeudp_pac.h"
+#include "zeek/analyzer/protocol/rdp/RDPEUDP.h"
+
+#include "zeek/Reporter.h"
+
+#include "analyzer/protocol/rdp/events.bif.h"
+#include "analyzer/protocol/rdp/rdpeudp_pac.h"
 
 namespace zeek::analyzer::rdpeudp {
 
diff --git a/src/analyzer/protocol/rdp/RDPEUDP.h b/src/analyzer/protocol/rdp/RDPEUDP.h
index 8197c20425..5449685847 100644
--- a/src/analyzer/protocol/rdp/RDPEUDP.h
+++ b/src/analyzer/protocol/rdp/RDPEUDP.h
@@ -1,8 +1,9 @@
 #pragma once
 
-#include "events.bif.h"
-#include "analyzer/protocol/udp/UDP.h"
-#include "rdpeudp_pac.h"
+#include "zeek/analyzer/protocol/udp/UDP.h"
+
+#include "analyzer/protocol/rdp/events.bif.h"
+#include "analyzer/protocol/rdp/rdpeudp_pac.h"
 
 namespace zeek::analyzer::rdpeudp {
 
diff --git a/src/analyzer/protocol/rdp/rdp-analyzer.pac b/src/analyzer/protocol/rdp/rdp-analyzer.pac
index 053e56c46e..3984bdd89f 100644
--- a/src/analyzer/protocol/rdp/rdp-analyzer.pac
+++ b/src/analyzer/protocol/rdp/rdp-analyzer.pac
@@ -1,7 +1,8 @@
 %extern{
-#include "Desc.h"
-#include "file_analysis/Manager.h"
-#include "types.bif.h"
+#include "zeek/Desc.h"
+#include "zeek/file_analysis/Manager.h"
+
+#include "analyzer/protocol/rdp/types.bif.h"
 %}
 
 refine flow RDP_Flow += {
diff --git a/src/analyzer/protocol/rdp/rdp.pac b/src/analyzer/protocol/rdp/rdp.pac
index 58e0c3a61f..5f267dbe13 100644
--- a/src/analyzer/protocol/rdp/rdp.pac
+++ b/src/analyzer/protocol/rdp/rdp.pac
@@ -2,7 +2,7 @@
 %include zeek.pac
 
 %extern{
-	#include "events.bif.h"
+	#include "analyzer/protocol/rdp/events.bif.h"
 %}
 
 analyzer RDP withcontext {
diff --git a/src/analyzer/protocol/rdp/rdpeudp.pac b/src/analyzer/protocol/rdp/rdpeudp.pac
index 1ece356231..61a90f9aca 100644
--- a/src/analyzer/protocol/rdp/rdpeudp.pac
+++ b/src/analyzer/protocol/rdp/rdpeudp.pac
@@ -2,7 +2,7 @@
 %include zeek.pac
 
 %extern{
-	#include "events.bif.h"
+	#include "analyzer/protocol/rdp/events.bif.h"
 %}
 
 analyzer RDPEUDP withcontext {
diff --git a/src/analyzer/protocol/rfb/Plugin.cc b/src/analyzer/protocol/rfb/Plugin.cc
index 3a77cdab50..c1137d6036 100644
--- a/src/analyzer/protocol/rfb/Plugin.cc
+++ b/src/analyzer/protocol/rfb/Plugin.cc
@@ -1,6 +1,6 @@
-#include "RFB.h"
-#include "plugin/Plugin.h"
-#include "analyzer/Component.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/analyzer/Component.h"
+#include "zeek/analyzer/protocol/rfb/RFB.h"
 
 namespace zeek::plugin::detail::Zeek_RFB {
 
diff --git a/src/analyzer/protocol/rfb/RFB.cc b/src/analyzer/protocol/rfb/RFB.cc
index 17a8cc51df..f3f29ad45a 100644
--- a/src/analyzer/protocol/rfb/RFB.cc
+++ b/src/analyzer/protocol/rfb/RFB.cc
@@ -1,10 +1,9 @@
-#include "RFB.h"
+#include "zeek/analyzer/protocol/rfb/RFB.h"
 
-#include "analyzer/protocol/tcp/TCP_Reassembler.h"
+#include "zeek/analyzer/protocol/tcp/TCP_Reassembler.h"
+#include "zeek/Reporter.h"
 
-#include "Reporter.h"
-
-#include "events.bif.h"
+#include "analyzer/protocol/rfb/events.bif.h"
 
 namespace zeek::analyzer::rfb {
 
diff --git a/src/analyzer/protocol/rfb/RFB.h b/src/analyzer/protocol/rfb/RFB.h
index 3ec7a96021..e35c387ceb 100644
--- a/src/analyzer/protocol/rfb/RFB.h
+++ b/src/analyzer/protocol/rfb/RFB.h
@@ -1,10 +1,9 @@
 #pragma once
 
-#include "events.bif.h"
+#include "zeek/analyzer/protocol/tcp/TCP.h"
 
-#include "analyzer/protocol/tcp/TCP.h"
-
-#include "rfb_pac.h"
+#include "analyzer/protocol/rfb/events.bif.h"
+#include "analyzer/protocol/rfb/rfb_pac.h"
 
 namespace zeek::analyzer::rfb {
 
diff --git a/src/analyzer/protocol/rfb/rfb.pac b/src/analyzer/protocol/rfb/rfb.pac
index e03e3fb383..fa80c8c3bd 100644
--- a/src/analyzer/protocol/rfb/rfb.pac
+++ b/src/analyzer/protocol/rfb/rfb.pac
@@ -6,7 +6,7 @@
 %include zeek.pac
 
 %extern{
-	#include "events.bif.h"
+	#include "analyzer/protocol/rfb/events.bif.h"
 %}
 
 analyzer RFB withcontext {
diff --git a/src/analyzer/protocol/rpc/MOUNT.cc b/src/analyzer/protocol/rpc/MOUNT.cc
index 2552388521..5a5f6a2503 100644
--- a/src/analyzer/protocol/rpc/MOUNT.cc
+++ b/src/analyzer/protocol/rpc/MOUNT.cc
@@ -1,17 +1,17 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
-#include "MOUNT.h"
+#include "zeek/analyzer/protocol/rpc/MOUNT.h"
 
 #include <algorithm>
 #include <vector>
 
-#include "ZeekString.h"
-#include "NetVar.h"
-#include "XDR.h"
-#include "Event.h"
+#include "zeek/ZeekString.h"
+#include "zeek/NetVar.h"
+#include "zeek/analyzer/protocol/rpc/XDR.h"
+#include "zeek/Event.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/rpc/events.bif.h"
 
 namespace zeek::analyzer::rpc {
 namespace detail {
diff --git a/src/analyzer/protocol/rpc/MOUNT.h b/src/analyzer/protocol/rpc/MOUNT.h
index c4c11c35bb..6a28e55020 100644
--- a/src/analyzer/protocol/rpc/MOUNT.h
+++ b/src/analyzer/protocol/rpc/MOUNT.h
@@ -2,7 +2,7 @@
 
 #pragma once
 
-#include "RPC.h"
+#include "zeek/analyzer/protocol/rpc/RPC.h"
 
 namespace zeek::analyzer::rpc {
 namespace detail {
diff --git a/src/analyzer/protocol/rpc/NFS.cc b/src/analyzer/protocol/rpc/NFS.cc
index 90a984be0e..c7a77ae0a5 100644
--- a/src/analyzer/protocol/rpc/NFS.cc
+++ b/src/analyzer/protocol/rpc/NFS.cc
@@ -1,17 +1,17 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
-#include "NFS.h"
+#include "zeek/analyzer/protocol/rpc/NFS.h"
 
 #include <utility>
 #include <vector>
 
-#include "ZeekString.h"
-#include "NetVar.h"
-#include "XDR.h"
-#include "Event.h"
+#include "zeek/ZeekString.h"
+#include "zeek/NetVar.h"
+#include "zeek/analyzer/protocol/rpc/XDR.h"
+#include "zeek/Event.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/rpc/events.bif.h"
 
 namespace zeek::analyzer::rpc {
 namespace detail {
diff --git a/src/analyzer/protocol/rpc/NFS.h b/src/analyzer/protocol/rpc/NFS.h
index 4a73f10595..74dc984c6c 100644
--- a/src/analyzer/protocol/rpc/NFS.h
+++ b/src/analyzer/protocol/rpc/NFS.h
@@ -2,8 +2,8 @@
 
 #pragma once
 
-#include "RPC.h"
-#include "NetVar.h"
+#include "zeek/analyzer/protocol/rpc/RPC.h"
+#include "zeek/NetVar.h"
 
 namespace zeek::analyzer::rpc {
 namespace detail {
diff --git a/src/analyzer/protocol/rpc/Plugin.cc b/src/analyzer/protocol/rpc/Plugin.cc
index 3d740a9ed0..164c07b779 100644
--- a/src/analyzer/protocol/rpc/Plugin.cc
+++ b/src/analyzer/protocol/rpc/Plugin.cc
@@ -1,11 +1,11 @@
 // See the file  in the main distribution directory for copyright.
 
-#include "RPC.h"
-#include "NFS.h"
-#include "MOUNT.h"
-#include "Portmap.h"
-#include "plugin/Plugin.h"
-#include "analyzer/Component.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/analyzer/Component.h"
+#include "zeek/analyzer/protocol/rpc/RPC.h"
+#include "zeek/analyzer/protocol/rpc/NFS.h"
+#include "zeek/analyzer/protocol/rpc/MOUNT.h"
+#include "zeek/analyzer/protocol/rpc/Portmap.h"
 
 namespace zeek::plugin::detail::Zeek_RPC {
 
diff --git a/src/analyzer/protocol/rpc/Portmap.cc b/src/analyzer/protocol/rpc/Portmap.cc
index 58bb2590ca..6d5644c736 100644
--- a/src/analyzer/protocol/rpc/Portmap.cc
+++ b/src/analyzer/protocol/rpc/Portmap.cc
@@ -1,13 +1,13 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "Portmap.h"
-#include "NetVar.h"
-#include "XDR.h"
-#include "Event.h"
-
-#include "events.bif.h"
-
 #include "zeek-config.h"
+#include "zeek/analyzer/protocol/rpc/Portmap.h"
+
+#include "zeek/NetVar.h"
+#include "zeek/Event.h"
+#include "zeek/analyzer/protocol/rpc/XDR.h"
+
+#include "analyzer/protocol/rpc/events.bif.h"
 
 #define PMAPPROC_NULL 0
 #define PMAPPROC_SET 1
diff --git a/src/analyzer/protocol/rpc/Portmap.h b/src/analyzer/protocol/rpc/Portmap.h
index 49b1ddcb39..f92e60c36d 100644
--- a/src/analyzer/protocol/rpc/Portmap.h
+++ b/src/analyzer/protocol/rpc/Portmap.h
@@ -2,7 +2,7 @@
 
 #pragma once
 
-#include "RPC.h"
+#include "zeek/analyzer/protocol/rpc/RPC.h"
 
 namespace zeek::analyzer::rpc {
 namespace detail {
diff --git a/src/analyzer/protocol/rpc/RPC.cc b/src/analyzer/protocol/rpc/RPC.cc
index 82ec9f6a75..61ee54b861 100644
--- a/src/analyzer/protocol/rpc/RPC.cc
+++ b/src/analyzer/protocol/rpc/RPC.cc
@@ -1,18 +1,18 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
-#include "RPC.h"
+#include "zeek/analyzer/protocol/rpc/RPC.h"
 
 #include <stdlib.h>
 #include <string>
 
-#include "NetVar.h"
-#include "XDR.h"
-#include "Reporter.h"
-#include "Sessions.h"
-#include "RunState.h"
+#include "zeek/NetVar.h"
+#include "zeek/analyzer/protocol/rpc/XDR.h"
+#include "zeek/Reporter.h"
+#include "zeek/Sessions.h"
+#include "zeek/RunState.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/rpc/events.bif.h"
 
 namespace { // local namespace
 	const bool DEBUG_rpc_resync = false;
diff --git a/src/analyzer/protocol/rpc/RPC.h b/src/analyzer/protocol/rpc/RPC.h
index 2c161bc24a..ebeb434259 100644
--- a/src/analyzer/protocol/rpc/RPC.h
+++ b/src/analyzer/protocol/rpc/RPC.h
@@ -2,8 +2,8 @@
 
 #pragma once
 
-#include "analyzer/protocol/tcp/TCP.h"
-#include "NetVar.h"
+#include "zeek/analyzer/protocol/tcp/TCP.h"
+#include "zeek/NetVar.h"
 
 namespace zeek::analyzer::rpc {
 namespace detail {
diff --git a/src/analyzer/protocol/rpc/XDR.cc b/src/analyzer/protocol/rpc/XDR.cc
index 8d4e4eb7f0..2cd417a8d9 100644
--- a/src/analyzer/protocol/rpc/XDR.cc
+++ b/src/analyzer/protocol/rpc/XDR.cc
@@ -1,12 +1,12 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
-#include "XDR.h"
+#include "zeek/analyzer/protocol/rpc/XDR.h"
 
 #include <string.h>
 #include <algorithm>
 
-#include "events.bif.h"
+#include "analyzer/protocol/rpc/events.bif.h"
 
 uint32_t zeek::analyzer::rpc::extract_XDR_uint32(const u_char*& buf, int& len)
 	{
diff --git a/src/analyzer/protocol/rpc/XDR.h b/src/analyzer/protocol/rpc/XDR.h
index b39558ef92..07246802a0 100644
--- a/src/analyzer/protocol/rpc/XDR.h
+++ b/src/analyzer/protocol/rpc/XDR.h
@@ -5,7 +5,7 @@
 #include <sys/types.h>
 #include <netinet/in.h>
 
-#include "util.h"
+#include "zeek/util.h"
 
 namespace zeek::analyzer::rpc {
 
diff --git a/src/analyzer/protocol/sip/Plugin.cc b/src/analyzer/protocol/sip/Plugin.cc
index a85e8d9a13..8388a61b88 100644
--- a/src/analyzer/protocol/sip/Plugin.cc
+++ b/src/analyzer/protocol/sip/Plugin.cc
@@ -1,9 +1,9 @@
 // See the file  in the main distribution directory for copyright.
 
-#include "SIP.h"
-#include "SIP_TCP.h"
-#include "plugin/Plugin.h"
-#include "analyzer/Component.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/analyzer/Component.h"
+#include "zeek/analyzer/protocol/sip/SIP.h"
+#include "zeek/analyzer/protocol/sip/SIP_TCP.h"
 
 namespace zeek::plugin::detail::Zeek_SIP {
 
diff --git a/src/analyzer/protocol/sip/SIP.cc b/src/analyzer/protocol/sip/SIP.cc
index 994ead9111..893c976799 100644
--- a/src/analyzer/protocol/sip/SIP.cc
+++ b/src/analyzer/protocol/sip/SIP.cc
@@ -1,6 +1,6 @@
-#include "SIP.h"
+#include "zeek/analyzer/protocol/sip/SIP.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/sip/events.bif.h"
 
 namespace zeek::analyzer::sip {
 
diff --git a/src/analyzer/protocol/sip/SIP.h b/src/analyzer/protocol/sip/SIP.h
index 8c981e60ae..d4a3177b0e 100644
--- a/src/analyzer/protocol/sip/SIP.h
+++ b/src/analyzer/protocol/sip/SIP.h
@@ -1,9 +1,9 @@
 #pragma once
 
-#include "events.bif.h"
+#include "zeek/analyzer/protocol/udp/UDP.h"
 
-#include "analyzer/protocol/udp/UDP.h"
-#include "sip_pac.h"
+#include "analyzer/protocol/sip/events.bif.h"
+#include "analyzer/protocol/sip/sip_pac.h"
 
 namespace zeek::analyzer::sip{
 
diff --git a/src/analyzer/protocol/sip/SIP_TCP.cc b/src/analyzer/protocol/sip/SIP_TCP.cc
index 4d4462f2ba..4be1b5657e 100644
--- a/src/analyzer/protocol/sip/SIP_TCP.cc
+++ b/src/analyzer/protocol/sip/SIP_TCP.cc
@@ -3,9 +3,10 @@
 // TODO: This is preliminary code that's not yet functional and not
 // activated. We don't yet support SIP-over-TCP.
 
-#include "SIP_TCP.h"
-#include "analyzer/protocol/tcp/TCP_Reassembler.h"
-#include "events.bif.h"
+#include "zeek/analyzer/protocol/sip/SIP_TCP.h"
+#include "zeek/analyzer/protocol/tcp/TCP_Reassembler.h"
+
+#include "analyzer/protocol/sip/events.bif.h"
 
 namespace zeek::analyzer::sip_tcp {
 
diff --git a/src/analyzer/protocol/sip/SIP_TCP.h b/src/analyzer/protocol/sip/SIP_TCP.h
index 7a6cd40d43..8524d0577e 100644
--- a/src/analyzer/protocol/sip/SIP_TCP.h
+++ b/src/analyzer/protocol/sip/SIP_TCP.h
@@ -5,9 +5,9 @@
 
 #pragma once
 
-#include "analyzer/protocol/tcp/TCP.h"
+#include "zeek/analyzer/protocol/tcp/TCP.h"
 
-#include "sip_TCP_pac.h"
+#include "analyzer/protocol/sip/sip_TCP_pac.h"
 
 namespace zeek::analyzer::sip_tcp {
 
diff --git a/src/analyzer/protocol/sip/sip.pac b/src/analyzer/protocol/sip/sip.pac
index 7198cfe22c..833fc4e517 100644
--- a/src/analyzer/protocol/sip/sip.pac
+++ b/src/analyzer/protocol/sip/sip.pac
@@ -5,7 +5,7 @@
 %include zeek.pac
 
 %extern{
-#include "events.bif.h"
+#include "analyzer/protocol/sip/events.bif.h"
 %}
 
 analyzer SIP withcontext {
diff --git a/src/analyzer/protocol/sip/sip_TCP.pac b/src/analyzer/protocol/sip/sip_TCP.pac
index d38b271a5e..10a0dd5fa7 100644
--- a/src/analyzer/protocol/sip/sip_TCP.pac
+++ b/src/analyzer/protocol/sip/sip_TCP.pac
@@ -8,7 +8,7 @@
 %include zeek.pac
 
 %extern{
-#include "events.bif.h"
+#include "analyzer/protocol/sip/events.bif.h"
 %}
 
 analyzer SIP_TCP withcontext {
diff --git a/src/analyzer/protocol/smb/Plugin.cc b/src/analyzer/protocol/smb/Plugin.cc
index e67f2ff091..b54ecc93a1 100644
--- a/src/analyzer/protocol/smb/Plugin.cc
+++ b/src/analyzer/protocol/smb/Plugin.cc
@@ -1,8 +1,7 @@
 // See the file in the main distribution directory for copyright.
 
-#include "plugin/Plugin.h"
-
-#include "SMB.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/analyzer/protocol/smb/SMB.h"
 
 namespace zeek::plugin::detail::Zeek_SMB {
 
diff --git a/src/analyzer/protocol/smb/SMB.cc b/src/analyzer/protocol/smb/SMB.cc
index 6a24009236..14756b7c28 100644
--- a/src/analyzer/protocol/smb/SMB.cc
+++ b/src/analyzer/protocol/smb/SMB.cc
@@ -1,4 +1,4 @@
-#include "SMB.h"
+#include "zeek/analyzer/protocol/smb/SMB.h"
 
 namespace zeek::analyzer::smb {
 
diff --git a/src/analyzer/protocol/smb/SMB.h b/src/analyzer/protocol/smb/SMB.h
index 609cafe466..86ccaedb1c 100644
--- a/src/analyzer/protocol/smb/SMB.h
+++ b/src/analyzer/protocol/smb/SMB.h
@@ -1,7 +1,7 @@
 #pragma once
 
-#include "analyzer/protocol/tcp/TCP.h"
-#include "smb_pac.h"
+#include "zeek/analyzer/protocol/tcp/TCP.h"
+#include "analyzer/protocol/smb/smb_pac.h"
 
 namespace zeek::analyzer::smb {
 
diff --git a/src/analyzer/protocol/smb/smb-pipe.pac b/src/analyzer/protocol/smb/smb-pipe.pac
index b37aea87f7..c1500cdbb8 100644
--- a/src/analyzer/protocol/smb/smb-pipe.pac
+++ b/src/analyzer/protocol/smb/smb-pipe.pac
@@ -1,5 +1,5 @@
 %extern{
-#include "../dce-rpc/DCE_RPC.h"
+#include "zeek/analyzer/protocol/dce-rpc/DCE_RPC.h"
 %}
 
 refine connection SMB_Conn += {
diff --git a/src/analyzer/protocol/smb/smb-strings.pac b/src/analyzer/protocol/smb/smb-strings.pac
index ad345ba7c3..d94ec195d2 100644
--- a/src/analyzer/protocol/smb/smb-strings.pac
+++ b/src/analyzer/protocol/smb/smb-strings.pac
@@ -1,5 +1,5 @@
 %extern{
-#include "binpac_zeek.h"
+#include "zeek/binpac_zeek.h"
 %}
 
 %code{
diff --git a/src/analyzer/protocol/smb/smb.pac b/src/analyzer/protocol/smb/smb.pac
index a30547f9df..d679591503 100644
--- a/src/analyzer/protocol/smb/smb.pac
+++ b/src/analyzer/protocol/smb/smb.pac
@@ -2,45 +2,45 @@
 %include zeek.pac
 
 %extern{
-#include "analyzer/Manager.h"
-#include "analyzer/Analyzer.h"
+#include "zeek/analyzer/Manager.h"
+#include "zeek/analyzer/Analyzer.h"
 
-#include "smb1_events.bif.h"
-#include "smb2_events.bif.h"
+#include "analyzer/protocol/smb/smb1_events.bif.h"
+#include "analyzer/protocol/smb/smb2_events.bif.h"
 
-#include "types.bif.h"
-#include "events.bif.h"
-#include "consts.bif.h"
+#include "analyzer/protocol/smb/types.bif.h"
+#include "analyzer/protocol/smb/events.bif.h"
+#include "analyzer/protocol/smb/consts.bif.h"
 
-#include "smb1_com_check_directory.bif.h"
-#include "smb1_com_close.bif.h"
-#include "smb1_com_create_directory.bif.h"
-#include "smb1_com_echo.bif.h"
-#include "smb1_com_logoff_andx.bif.h"
-#include "smb1_com_negotiate.bif.h"
-#include "smb1_com_nt_cancel.bif.h"
-#include "smb1_com_nt_create_andx.bif.h"
-#include "smb1_com_query_information.bif.h"
-#include "smb1_com_read_andx.bif.h"
-#include "smb1_com_session_setup_andx.bif.h"
-#include "smb1_com_transaction.bif.h"
-#include "smb1_com_transaction_secondary.bif.h"
-#include "smb1_com_transaction2.bif.h"
-#include "smb1_com_transaction2_secondary.bif.h"
-#include "smb1_com_tree_connect_andx.bif.h"
-#include "smb1_com_tree_disconnect.bif.h"
-#include "smb1_com_write_andx.bif.h"
+#include "analyzer/protocol/smb/smb1_com_check_directory.bif.h"
+#include "analyzer/protocol/smb/smb1_com_close.bif.h"
+#include "analyzer/protocol/smb/smb1_com_create_directory.bif.h"
+#include "analyzer/protocol/smb/smb1_com_echo.bif.h"
+#include "analyzer/protocol/smb/smb1_com_logoff_andx.bif.h"
+#include "analyzer/protocol/smb/smb1_com_negotiate.bif.h"
+#include "analyzer/protocol/smb/smb1_com_nt_cancel.bif.h"
+#include "analyzer/protocol/smb/smb1_com_nt_create_andx.bif.h"
+#include "analyzer/protocol/smb/smb1_com_query_information.bif.h"
+#include "analyzer/protocol/smb/smb1_com_read_andx.bif.h"
+#include "analyzer/protocol/smb/smb1_com_session_setup_andx.bif.h"
+#include "analyzer/protocol/smb/smb1_com_transaction.bif.h"
+#include "analyzer/protocol/smb/smb1_com_transaction_secondary.bif.h"
+#include "analyzer/protocol/smb/smb1_com_transaction2.bif.h"
+#include "analyzer/protocol/smb/smb1_com_transaction2_secondary.bif.h"
+#include "analyzer/protocol/smb/smb1_com_tree_connect_andx.bif.h"
+#include "analyzer/protocol/smb/smb1_com_tree_disconnect.bif.h"
+#include "analyzer/protocol/smb/smb1_com_write_andx.bif.h"
 
-#include "smb2_com_close.bif.h"
-#include "smb2_com_create.bif.h"
-#include "smb2_com_negotiate.bif.h"
-#include "smb2_com_read.bif.h"
-#include "smb2_com_session_setup.bif.h"
-#include "smb2_com_set_info.bif.h"
-#include "smb2_com_tree_connect.bif.h"
-#include "smb2_com_tree_disconnect.bif.h"
-#include "smb2_com_write.bif.h"
-#include "smb2_com_transform_header.bif.h"
+#include "analyzer/protocol/smb/smb2_com_close.bif.h"
+#include "analyzer/protocol/smb/smb2_com_create.bif.h"
+#include "analyzer/protocol/smb/smb2_com_negotiate.bif.h"
+#include "analyzer/protocol/smb/smb2_com_read.bif.h"
+#include "analyzer/protocol/smb/smb2_com_session_setup.bif.h"
+#include "analyzer/protocol/smb/smb2_com_set_info.bif.h"
+#include "analyzer/protocol/smb/smb2_com_tree_connect.bif.h"
+#include "analyzer/protocol/smb/smb2_com_tree_disconnect.bif.h"
+#include "analyzer/protocol/smb/smb2_com_write.bif.h"
+#include "analyzer/protocol/smb/smb2_com_transform_header.bif.h"
 %}
 
 analyzer SMB withcontext {
diff --git a/src/analyzer/protocol/smb/smb1-protocol.pac b/src/analyzer/protocol/smb/smb1-protocol.pac
index d661a907ae..ea3b7f3340 100644
--- a/src/analyzer/protocol/smb/smb1-protocol.pac
+++ b/src/analyzer/protocol/smb/smb1-protocol.pac
@@ -1,5 +1,5 @@
 %extern{
-#include "file_analysis/Manager.h"
+#include "zeek/file_analysis/Manager.h"
 %}
 
 %header{
diff --git a/src/analyzer/protocol/smtp/Plugin.cc b/src/analyzer/protocol/smtp/Plugin.cc
index 5f5ea626d8..8b950d3b33 100644
--- a/src/analyzer/protocol/smtp/Plugin.cc
+++ b/src/analyzer/protocol/smtp/Plugin.cc
@@ -1,8 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-#include "SMTP.h"
-#include "plugin/Plugin.h"
-#include "analyzer/Component.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/analyzer/Component.h"
+#include "zeek/analyzer/protocol/smtp/SMTP.h"
 
 namespace zeek::plugin::detail::Zeek_SMTP {
 
diff --git a/src/analyzer/protocol/smtp/SMTP.cc b/src/analyzer/protocol/smtp/SMTP.cc
index c2f03d091b..22aaf7ec06 100644
--- a/src/analyzer/protocol/smtp/SMTP.cc
+++ b/src/analyzer/protocol/smtp/SMTP.cc
@@ -1,16 +1,16 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
+#include "zeek/analyzer/protocol/smtp/SMTP.h"
 
 #include <stdlib.h>
 
-#include "NetVar.h"
-#include "SMTP.h"
-#include "Event.h"
-#include "Reporter.h"
-#include "analyzer/Manager.h"
+#include "zeek/NetVar.h"
+#include "zeek/Event.h"
+#include "zeek/Reporter.h"
+#include "zeek/analyzer/Manager.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/smtp/events.bif.h"
 
 #undef SMTP_CMD_DEF
 #define SMTP_CMD_DEF(cmd)	#cmd,
diff --git a/src/analyzer/protocol/smtp/SMTP.h b/src/analyzer/protocol/smtp/SMTP.h
index 0e0b69b084..4cd7d3bdb2 100644
--- a/src/analyzer/protocol/smtp/SMTP.h
+++ b/src/analyzer/protocol/smtp/SMTP.h
@@ -4,9 +4,9 @@
 
 #include <list>
 
-#include "analyzer/protocol/tcp/TCP.h"
-#include "analyzer/protocol/tcp/ContentLine.h"
-#include "analyzer/protocol/mime/MIME.h"
+#include "zeek/analyzer/protocol/tcp/TCP.h"
+#include "zeek/analyzer/protocol/tcp/ContentLine.h"
+#include "zeek/analyzer/protocol/mime/MIME.h"
 
 #undef SMTP_CMD_DEF
 #define SMTP_CMD_DEF(cmd)	SMTP_CMD_##cmd,
diff --git a/src/analyzer/protocol/smtp/functions.bif b/src/analyzer/protocol/smtp/functions.bif
index f25738f863..b2369fea2c 100644
--- a/src/analyzer/protocol/smtp/functions.bif
+++ b/src/analyzer/protocol/smtp/functions.bif
@@ -1,6 +1,6 @@
 
 %%{
-#include "analyzer/protocol/smtp/SMTP.h"
+#include "zeek/analyzer/protocol/smtp/SMTP.h"
 %%}
 
 ## Skips SMTP data until the next email in a connection.
diff --git a/src/analyzer/protocol/snmp/Plugin.cc b/src/analyzer/protocol/snmp/Plugin.cc
index b42dc4de3f..224ca22af4 100644
--- a/src/analyzer/protocol/snmp/Plugin.cc
+++ b/src/analyzer/protocol/snmp/Plugin.cc
@@ -1,8 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-#include "SNMP.h"
-#include "plugin/Plugin.h"
-#include "analyzer/Component.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/analyzer/Component.h"
+#include "zeek/analyzer/protocol/snmp/SNMP.h"
 
 namespace zeek::plugin::detail::Zeek_SNMP {
 
diff --git a/src/analyzer/protocol/snmp/SNMP.cc b/src/analyzer/protocol/snmp/SNMP.cc
index e86a37987d..d3aeb9c8fd 100644
--- a/src/analyzer/protocol/snmp/SNMP.cc
+++ b/src/analyzer/protocol/snmp/SNMP.cc
@@ -1,10 +1,11 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "SNMP.h"
-#include "Func.h"
-#include "Reporter.h"
-#include "types.bif.h"
-#include "events.bif.h"
+#include "zeek/analyzer/protocol/snmp/SNMP.h"
+#include "zeek/Func.h"
+#include "zeek/Reporter.h"
+
+#include "analyzer/protocol/snmp/types.bif.h"
+#include "analyzer/protocol/snmp/events.bif.h"
 
 namespace zeek::analyzer::snmp {
 
diff --git a/src/analyzer/protocol/snmp/SNMP.h b/src/analyzer/protocol/snmp/SNMP.h
index d7074d9b62..828b31f490 100644
--- a/src/analyzer/protocol/snmp/SNMP.h
+++ b/src/analyzer/protocol/snmp/SNMP.h
@@ -2,7 +2,7 @@
 
 #pragma once
 
-#include "snmp_pac.h"
+#include "analyzer/protocol/snmp/snmp_pac.h"
 
 namespace zeek::analyzer::snmp {
 
diff --git a/src/analyzer/protocol/snmp/snmp-analyzer.pac b/src/analyzer/protocol/snmp/snmp-analyzer.pac
index 90470f6206..f719e25163 100644
--- a/src/analyzer/protocol/snmp/snmp-analyzer.pac
+++ b/src/analyzer/protocol/snmp/snmp-analyzer.pac
@@ -3,8 +3,8 @@
 #include <vector>
 #include <string>
 
-#include "net_util.h"
-#include "util.h"
+#include "zeek/net_util.h"
+#include "zeek/util.h"
 %}
 
 %header{
diff --git a/src/analyzer/protocol/snmp/snmp.pac b/src/analyzer/protocol/snmp/snmp.pac
index cbc69e5e6c..e32a9610cf 100644
--- a/src/analyzer/protocol/snmp/snmp.pac
+++ b/src/analyzer/protocol/snmp/snmp.pac
@@ -2,9 +2,9 @@
 %include zeek.pac
 
 %extern{
-#include "Reporter.h"
-#include "types.bif.h"
-#include "events.bif.h"
+#include "zeek/Reporter.h"
+#include "analyzer/protocol/snmp/types.bif.h"
+#include "analyzer/protocol/snmp/events.bif.h"
 %}
 
 analyzer SNMP withcontext {
diff --git a/src/analyzer/protocol/socks/Plugin.cc b/src/analyzer/protocol/socks/Plugin.cc
index 3c694c4ed6..38833fe57a 100644
--- a/src/analyzer/protocol/socks/Plugin.cc
+++ b/src/analyzer/protocol/socks/Plugin.cc
@@ -1,8 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-#include "SOCKS.h"
-#include "plugin/Plugin.h"
-#include "analyzer/Component.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/analyzer/Component.h"
+#include "zeek/analyzer/protocol/socks/SOCKS.h"
 
 namespace zeek::plugin::detail::Zeek_SOCKS {
 
diff --git a/src/analyzer/protocol/socks/SOCKS.cc b/src/analyzer/protocol/socks/SOCKS.cc
index 400d02afe7..e4a1a48a7b 100644
--- a/src/analyzer/protocol/socks/SOCKS.cc
+++ b/src/analyzer/protocol/socks/SOCKS.cc
@@ -1,8 +1,9 @@
-#include "SOCKS.h"
-#include "socks_pac.h"
-#include "analyzer/protocol/tcp/TCP_Reassembler.h"
+#include "zeek/analyzer/protocol/socks/SOCKS.h"
 
-#include "events.bif.h"
+#include "zeek/analyzer/protocol/tcp/TCP_Reassembler.h"
+
+#include "analyzer/protocol/socks/socks_pac.h"
+#include "analyzer/protocol/socks/events.bif.h"
 
 namespace zeek::analyzer::socks {
 
diff --git a/src/analyzer/protocol/socks/SOCKS.h b/src/analyzer/protocol/socks/SOCKS.h
index f3314f38d5..9e11509a06 100644
--- a/src/analyzer/protocol/socks/SOCKS.h
+++ b/src/analyzer/protocol/socks/SOCKS.h
@@ -2,8 +2,8 @@
 
 // SOCKS v4 analyzer.
 
-#include "analyzer/protocol/tcp/TCP.h"
-#include "analyzer/protocol/pia/PIA.h"
+#include "zeek/analyzer/protocol/tcp/TCP.h"
+#include "zeek/analyzer/protocol/pia/PIA.h"
 
 namespace binpac  {
    namespace SOCKS {
diff --git a/src/analyzer/protocol/socks/socks.pac b/src/analyzer/protocol/socks/socks.pac
index 551dff8b54..8778527193 100644
--- a/src/analyzer/protocol/socks/socks.pac
+++ b/src/analyzer/protocol/socks/socks.pac
@@ -2,10 +2,10 @@
 %include zeek.pac
 
 %extern{
-#include "SOCKS.h"
-#include "Reporter.h"
+#include "zeek/analyzer/protocol/socks/SOCKS.h"
+#include "zeek/Reporter.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/socks/events.bif.h"
 %}
 
 analyzer SOCKS withcontext {
diff --git a/src/analyzer/protocol/ssh/Plugin.cc b/src/analyzer/protocol/ssh/Plugin.cc
index 37344cabec..ad537d4f96 100644
--- a/src/analyzer/protocol/ssh/Plugin.cc
+++ b/src/analyzer/protocol/ssh/Plugin.cc
@@ -1,8 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-#include "SSH.h"
-#include "plugin/Plugin.h"
-#include "analyzer/Component.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/analyzer/Component.h"
+#include "zeek/analyzer/protocol/ssh/SSH.h"
 
 namespace zeek::plugin::detail::Zeek_SSH {
 
diff --git a/src/analyzer/protocol/ssh/SSH.cc b/src/analyzer/protocol/ssh/SSH.cc
index 1ae8794423..2b1fca11ef 100644
--- a/src/analyzer/protocol/ssh/SSH.cc
+++ b/src/analyzer/protocol/ssh/SSH.cc
@@ -1,13 +1,12 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "SSH.h"
+#include "zeek/analyzer/protocol/ssh/SSH.h"
 
-#include "analyzer/protocol/tcp/TCP_Reassembler.h"
+#include "zeek/analyzer/protocol/tcp/TCP_Reassembler.h"
+#include "zeek/Reporter.h"
 
-#include "Reporter.h"
-
-#include "types.bif.h"
-#include "events.bif.h"
+#include "analyzer/protocol/ssh/types.bif.h"
+#include "analyzer/protocol/ssh/events.bif.h"
 
 namespace zeek::analyzer::ssh {
 
diff --git a/src/analyzer/protocol/ssh/SSH.h b/src/analyzer/protocol/ssh/SSH.h
index a000010cde..e68dbec35e 100644
--- a/src/analyzer/protocol/ssh/SSH.h
+++ b/src/analyzer/protocol/ssh/SSH.h
@@ -2,10 +2,10 @@
 
 #pragma once
 
-#include "events.bif.h"
+#include "zeek/analyzer/protocol/tcp/TCP.h"
 
-#include "analyzer/protocol/tcp/TCP.h"
-#include "ssh_pac.h"
+#include "analyzer/protocol/ssh/events.bif.h"
+#include "analyzer/protocol/ssh/ssh_pac.h"
 
 namespace zeek::analyzer::ssh {
 
diff --git a/src/analyzer/protocol/ssh/ssh-protocol.pac b/src/analyzer/protocol/ssh/ssh-protocol.pac
index cf6f232247..99f361974f 100644
--- a/src/analyzer/protocol/ssh/ssh-protocol.pac
+++ b/src/analyzer/protocol/ssh/ssh-protocol.pac
@@ -1,7 +1,7 @@
 %include consts.pac
 
 %extern{
-#include "ZeekString.h"
+#include "zeek/ZeekString.h"
 %}
 
 # Common constructs across SSH1 and SSH2
diff --git a/src/analyzer/protocol/ssh/ssh.pac b/src/analyzer/protocol/ssh/ssh.pac
index 6fbab0105c..5fe486d966 100644
--- a/src/analyzer/protocol/ssh/ssh.pac
+++ b/src/analyzer/protocol/ssh/ssh.pac
@@ -8,8 +8,8 @@
 %include zeek.pac
 
 %extern{
-	#include "types.bif.h"
-	#include "events.bif.h"
+	#include "analyzer/protocol/ssh/types.bif.h"
+	#include "analyzer/protocol/ssh/events.bif.h"
 %}
 
 analyzer SSH withcontext {
diff --git a/src/analyzer/protocol/ssl/DTLS.cc b/src/analyzer/protocol/ssl/DTLS.cc
index 4ede9c6bfb..be22aa77f5 100644
--- a/src/analyzer/protocol/ssl/DTLS.cc
+++ b/src/analyzer/protocol/ssl/DTLS.cc
@@ -1,12 +1,10 @@
+#include "zeek/analyzer/protocol/ssl/DTLS.h"
+#include "zeek/Reporter.h"
+#include "zeek/util.h"
 
-#include "DTLS.h"
-#include "Reporter.h"
-#include "util.h"
-
-#include "events.bif.h"
-
-#include "dtls_pac.h"
-#include "tls-handshake_pac.h"
+#include "analyzer/protocol/ssl/events.bif.h"
+#include "analyzer/protocol/ssl/dtls_pac.h"
+#include "analyzer/protocol/ssl/tls-handshake_pac.h"
 
 namespace zeek::analyzer::dtls {
 
diff --git a/src/analyzer/protocol/ssl/DTLS.h b/src/analyzer/protocol/ssl/DTLS.h
index 1ef9727bec..fe02432ee8 100644
--- a/src/analyzer/protocol/ssl/DTLS.h
+++ b/src/analyzer/protocol/ssl/DTLS.h
@@ -1,8 +1,8 @@
 #pragma once
 
-#include "events.bif.h"
+#include "zeek/analyzer/protocol/udp/UDP.h"
 
-#include "analyzer/protocol/udp/UDP.h"
+#include "analyzer/protocol/ssl/events.bif.h"
 
 namespace binpac { namespace DTLS { class SSL_Conn; } }
 namespace binpac { namespace TLSHandshake { class Handshake_Conn; } }
diff --git a/src/analyzer/protocol/ssl/Plugin.cc b/src/analyzer/protocol/ssl/Plugin.cc
index 394b675701..a9af9e878d 100644
--- a/src/analyzer/protocol/ssl/Plugin.cc
+++ b/src/analyzer/protocol/ssl/Plugin.cc
@@ -1,9 +1,9 @@
 // See the file  in the main distribution directory for copyright.
 
-#include "SSL.h"
-#include "DTLS.h"
-#include "plugin/Plugin.h"
-#include "analyzer/Component.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/analyzer/Component.h"
+#include "zeek/analyzer/protocol/ssl/SSL.h"
+#include "zeek/analyzer/protocol/ssl/DTLS.h"
 
 namespace zeek::plugin::detail::Zeek_SSL {
 
diff --git a/src/analyzer/protocol/ssl/SSL.cc b/src/analyzer/protocol/ssl/SSL.cc
index eae5039c1a..980b2a556d 100644
--- a/src/analyzer/protocol/ssl/SSL.cc
+++ b/src/analyzer/protocol/ssl/SSL.cc
@@ -1,12 +1,12 @@
+#include "zeek/analyzer/protocol/ssl/SSL.h"
 
-#include "SSL.h"
-#include "analyzer/protocol/tcp/TCP_Reassembler.h"
-#include "Reporter.h"
-#include "util.h"
+#include "zeek/analyzer/protocol/tcp/TCP_Reassembler.h"
+#include "zeek/Reporter.h"
+#include "zeek/util.h"
 
-#include "events.bif.h"
-#include "ssl_pac.h"
-#include "tls-handshake_pac.h"
+#include "analyzer/protocol/ssl/events.bif.h"
+#include "analyzer/protocol/ssl/ssl_pac.h"
+#include "analyzer/protocol/ssl/tls-handshake_pac.h"
 
 namespace zeek::analyzer::ssl {
 
diff --git a/src/analyzer/protocol/ssl/SSL.h b/src/analyzer/protocol/ssl/SSL.h
index fcc8349280..50fabe1327 100644
--- a/src/analyzer/protocol/ssl/SSL.h
+++ b/src/analyzer/protocol/ssl/SSL.h
@@ -1,8 +1,8 @@
 #pragma once
 
-#include "events.bif.h"
+#include "zeek/analyzer/protocol/tcp/TCP.h"
 
-#include "analyzer/protocol/tcp/TCP.h"
+#include "analyzer/protocol/ssl/events.bif.h"
 
 namespace binpac { namespace SSL { class SSL_Conn; } }
 
diff --git a/src/analyzer/protocol/ssl/dtls.pac b/src/analyzer/protocol/ssl/dtls.pac
index c53b5491d9..025d1ee261 100644
--- a/src/analyzer/protocol/ssl/dtls.pac
+++ b/src/analyzer/protocol/ssl/dtls.pac
@@ -4,13 +4,14 @@
 %include zeek.pac
 
 %extern{
-#include "events.bif.h"
 
 namespace zeek::analyzer::dtls { class DTLS_Analyzer; }
 using DTLSAnalyzer = zeek::analyzer::dtls::DTLS_Analyzer*;
 
-#include "DTLS.h"
-#include "consts.bif.h"
+#include "zeek/analyzer/protocol/ssl/DTLS.h"
+
+#include "analyzer/protocol/ssl/events.bif.h"
+#include "analyzer/protocol/ssl/consts.bif.h"
 %}
 
 extern type DTLSAnalyzer;
diff --git a/src/analyzer/protocol/ssl/functions.bif b/src/analyzer/protocol/ssl/functions.bif
index a7f01a9c4c..2d72a4a741 100644
--- a/src/analyzer/protocol/ssl/functions.bif
+++ b/src/analyzer/protocol/ssl/functions.bif
@@ -1,8 +1,8 @@
 
 %%{
-#include "analyzer/protocol/ssl/SSL.h"
-#include "Reporter.h"
 #include <openssl/x509.h>
+#include "zeek/analyzer/protocol/ssl/SSL.h"
+#include "zeek/Reporter.h"
 %%}
 
 ## Sets if the SSL analyzer should consider the connection established (handshake
diff --git a/src/analyzer/protocol/ssl/ssl-defs.pac b/src/analyzer/protocol/ssl/ssl-defs.pac
index e13d6ca169..9c84c52c90 100644
--- a/src/analyzer/protocol/ssl/ssl-defs.pac
+++ b/src/analyzer/protocol/ssl/ssl-defs.pac
@@ -87,9 +87,9 @@ function version_ok(vers : uint16) : bool
 
 %extern{
 #include <string>
-using std::string;
+#include "analyzer/protocol/ssl/events.bif.h"
 
-#include "events.bif.h"
+using std::string;
 %}
 
 # a maximum of 100k for one record seems safe
diff --git a/src/analyzer/protocol/ssl/ssl-dtls-analyzer.pac b/src/analyzer/protocol/ssl/ssl-dtls-analyzer.pac
index 0c8bfdce59..99f1f9f105 100644
--- a/src/analyzer/protocol/ssl/ssl-dtls-analyzer.pac
+++ b/src/analyzer/protocol/ssl/ssl-dtls-analyzer.pac
@@ -5,9 +5,8 @@
 #include <iostream>
 #include <iterator>
 
-#include "util.h"
-
-#include "file_analysis/Manager.h"
+#include "zeek/util.h"
+#include "zeek/file_analysis/Manager.h"
 %}
 
 refine connection SSL_Conn += {
diff --git a/src/analyzer/protocol/ssl/ssl.pac b/src/analyzer/protocol/ssl/ssl.pac
index e22a012e8a..d0c06a3a4c 100644
--- a/src/analyzer/protocol/ssl/ssl.pac
+++ b/src/analyzer/protocol/ssl/ssl.pac
@@ -9,13 +9,14 @@
 %include zeek.pac
 
 %extern{
-#include "Desc.h"
-#include "events.bif.h"
 
 namespace zeek::analyzer::ssl { class SSL_Analyzer; }
 using SSLAnalyzer = zeek::analyzer::ssl::SSL_Analyzer*;
 
-#include "SSL.h"
+#include "zeek/Desc.h"
+#include "zeek/analyzer/protocol/ssl/SSL.h"
+
+#include "analyzer/protocol/ssl/events.bif.h"
 %}
 
 extern type SSLAnalyzer;
diff --git a/src/analyzer/protocol/ssl/tls-handshake-analyzer.pac b/src/analyzer/protocol/ssl/tls-handshake-analyzer.pac
index 251ecae941..f28ba40b76 100644
--- a/src/analyzer/protocol/ssl/tls-handshake-analyzer.pac
+++ b/src/analyzer/protocol/ssl/tls-handshake-analyzer.pac
@@ -6,9 +6,8 @@
 #include <iostream>
 #include <iterator>
 
-#include "util.h"
-
-#include "file_analysis/Manager.h"
+#include "zeek/util.h"
+#include "zeek/file_analysis/Manager.h"
 %}
 
 %header{
diff --git a/src/analyzer/protocol/ssl/tls-handshake.pac b/src/analyzer/protocol/ssl/tls-handshake.pac
index 012ef3fc32..4ceb759ae5 100644
--- a/src/analyzer/protocol/ssl/tls-handshake.pac
+++ b/src/analyzer/protocol/ssl/tls-handshake.pac
@@ -4,9 +4,10 @@
 %include zeek.pac
 
 %extern{
-#include "Desc.h"
-#include "types.bif.h"
-#include "events.bif.h"
+#include "zeek/Desc.h"
+
+#include "analyzer/protocol/ssl/types.bif.h"
+#include "analyzer/protocol/ssl/events.bif.h"
 %}
 
 analyzer TLSHandshake withcontext {
diff --git a/src/analyzer/protocol/stepping-stone/Plugin.cc b/src/analyzer/protocol/stepping-stone/Plugin.cc
index d43318525a..5225af089b 100644
--- a/src/analyzer/protocol/stepping-stone/Plugin.cc
+++ b/src/analyzer/protocol/stepping-stone/Plugin.cc
@@ -1,8 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-#include "SteppingStone.h"
-#include "plugin/Plugin.h"
-#include "analyzer/Component.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/analyzer/Component.h"
+#include "zeek/analyzer/protocol/stepping-stone/SteppingStone.h"
 
 namespace zeek::plugin::detail::Zeek_SteppingStone {
 
diff --git a/src/analyzer/protocol/stepping-stone/SteppingStone.cc b/src/analyzer/protocol/stepping-stone/SteppingStone.cc
index 53f1fb7786..191c67fdeb 100644
--- a/src/analyzer/protocol/stepping-stone/SteppingStone.cc
+++ b/src/analyzer/protocol/stepping-stone/SteppingStone.cc
@@ -1,17 +1,18 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
-#include "SteppingStone.h"
+#include "zeek/analyzer/protocol/stepping-stone/SteppingStone.h"
 
 #include <stdlib.h>
 
-#include "Event.h"
-#include "RunState.h"
-#include "NetVar.h"
-#include "analyzer/protocol/tcp/TCP.h"
-#include "Sessions.h"
-#include "util.h"
-#include "events.bif.h"
+#include "zeek/Event.h"
+#include "zeek/RunState.h"
+#include "zeek/NetVar.h"
+#include "zeek/analyzer/protocol/tcp/TCP.h"
+#include "zeek/Sessions.h"
+#include "zeek/util.h"
+
+#include "analyzer/protocol/stepping-stone/events.bif.h"
 
 namespace zeek::analyzer::stepping_stone {
 
diff --git a/src/analyzer/protocol/stepping-stone/SteppingStone.h b/src/analyzer/protocol/stepping-stone/SteppingStone.h
index 864173dcc3..df3fbd927d 100644
--- a/src/analyzer/protocol/stepping-stone/SteppingStone.h
+++ b/src/analyzer/protocol/stepping-stone/SteppingStone.h
@@ -2,8 +2,8 @@
 
 #pragma once
 
-#include "Queue.h"
-#include "analyzer/protocol/tcp/TCP.h"
+#include "zeek/Queue.h"
+#include "zeek/analyzer/protocol/tcp/TCP.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(NetSessions, zeek);
 
diff --git a/src/analyzer/protocol/syslog/Plugin.cc b/src/analyzer/protocol/syslog/Plugin.cc
index c38a291cb1..358f5d6bb6 100644
--- a/src/analyzer/protocol/syslog/Plugin.cc
+++ b/src/analyzer/protocol/syslog/Plugin.cc
@@ -1,8 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-#include "Syslog.h"
-#include "plugin/Plugin.h"
-#include "analyzer/Component.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/analyzer/Component.h"
+#include "zeek/analyzer/protocol/syslog/Syslog.h"
 
 namespace zeek::plugin::detail::Zeek_Syslog {
 
diff --git a/src/analyzer/protocol/syslog/Syslog.cc b/src/analyzer/protocol/syslog/Syslog.cc
index 2fefdf5aec..ab9748ee6c 100644
--- a/src/analyzer/protocol/syslog/Syslog.cc
+++ b/src/analyzer/protocol/syslog/Syslog.cc
@@ -1,8 +1,7 @@
+#include "zeek/analyzer/protocol/syslog/Syslog.h"
+#include "zeek/analyzer/protocol/tcp/TCP_Reassembler.h"
 
-#include "Syslog.h"
-#include "analyzer/protocol/tcp/TCP_Reassembler.h"
-
-#include "events.bif.h"
+#include "analyzer/protocol/syslog/events.bif.h"
 
 namespace zeek::analyzer::syslog {
 
diff --git a/src/analyzer/protocol/syslog/Syslog.h b/src/analyzer/protocol/syslog/Syslog.h
index 46e81121c0..b2e01f5cfb 100644
--- a/src/analyzer/protocol/syslog/Syslog.h
+++ b/src/analyzer/protocol/syslog/Syslog.h
@@ -1,10 +1,9 @@
-
 #pragma once
 
-#include "analyzer/protocol/udp/UDP.h"
-#include "analyzer/protocol/tcp/TCP.h"
+#include "zeek/analyzer/protocol/udp/UDP.h"
+#include "zeek/analyzer/protocol/tcp/TCP.h"
 
-#include "syslog_pac.h"
+#include "analyzer/protocol/syslog/syslog_pac.h"
 
 namespace zeek::analyzer::syslog {
 
diff --git a/src/analyzer/protocol/syslog/syslog.pac b/src/analyzer/protocol/syslog/syslog.pac
index 3784d333b9..c5a9e251a7 100644
--- a/src/analyzer/protocol/syslog/syslog.pac
+++ b/src/analyzer/protocol/syslog/syslog.pac
@@ -3,7 +3,7 @@
 %include zeek.pac
 
 %extern{
-#include "events.bif.h"
+#include "analyzer/protocol/syslog/events.bif.h"
 %}
 
 analyzer Syslog withcontext {
diff --git a/src/analyzer/protocol/tcp/ContentLine.cc b/src/analyzer/protocol/tcp/ContentLine.cc
index 20c62311e4..1e5953dfe2 100644
--- a/src/analyzer/protocol/tcp/ContentLine.cc
+++ b/src/analyzer/protocol/tcp/ContentLine.cc
@@ -1,8 +1,9 @@
-#include "ContentLine.h"
-#include "TCP.h"
-#include "Reporter.h"
+#include "zeek/analyzer/protocol/tcp/ContentLine.h"
 
-#include "events.bif.h"
+#include "zeek/analyzer/protocol/tcp/TCP.h"
+#include "zeek/Reporter.h"
+
+#include "analyzer/protocol/tcp/events.bif.h"
 
 namespace zeek::analyzer::tcp {
 
diff --git a/src/analyzer/protocol/tcp/ContentLine.h b/src/analyzer/protocol/tcp/ContentLine.h
index 77732f7226..97b46aeb7a 100644
--- a/src/analyzer/protocol/tcp/ContentLine.h
+++ b/src/analyzer/protocol/tcp/ContentLine.h
@@ -2,7 +2,7 @@
 
 #pragma once
 
-#include "analyzer/protocol/tcp/TCP.h"
+#include "zeek/analyzer/protocol/tcp/TCP.h"
 
 namespace zeek::analyzer::tcp {
 
diff --git a/src/analyzer/protocol/tcp/Plugin.cc b/src/analyzer/protocol/tcp/Plugin.cc
index 4780aaa183..8d4cccceb4 100644
--- a/src/analyzer/protocol/tcp/Plugin.cc
+++ b/src/analyzer/protocol/tcp/Plugin.cc
@@ -1,8 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-#include "TCP.h"
-#include "plugin/Plugin.h"
-#include "analyzer/Component.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/analyzer/Component.h"
+#include "zeek/analyzer/protocol/tcp/TCP.h"
 
 namespace zeek::plugin::detail::Zeek_TCP {
 
diff --git a/src/analyzer/protocol/tcp/Stats.cc b/src/analyzer/protocol/tcp/Stats.cc
index efe1ff2668..73d65551b7 100644
--- a/src/analyzer/protocol/tcp/Stats.cc
+++ b/src/analyzer/protocol/tcp/Stats.cc
@@ -1,8 +1,8 @@
+#include "zeek/analyzer/protocol/tcp/Stats.h"
 
-#include "Stats.h"
-#include "File.h"
+#include "zeek/File.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/tcp/events.bif.h"
 
 namespace zeek::analyzer::tcp {
 
diff --git a/src/analyzer/protocol/tcp/Stats.h b/src/analyzer/protocol/tcp/Stats.h
index 66afaf7805..d69e41e7a4 100644
--- a/src/analyzer/protocol/tcp/Stats.h
+++ b/src/analyzer/protocol/tcp/Stats.h
@@ -1,7 +1,6 @@
-
 #pragma once
 
-#include "TCP_Endpoint.h"
+#include "zeek/analyzer/protocol/tcp/TCP_Endpoint.h"
 
 namespace zeek::analyzer::tcp {
 
diff --git a/src/analyzer/protocol/tcp/TCP.cc b/src/analyzer/protocol/tcp/TCP.cc
index c85d07ea23..bea7dd0209 100644
--- a/src/analyzer/protocol/tcp/TCP.cc
+++ b/src/analyzer/protocol/tcp/TCP.cc
@@ -1,23 +1,23 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "analyzer/protocol/tcp/TCP.h"
+#include "zeek/analyzer/protocol/tcp/TCP.h"
 
 #include <vector>
 
-#include "analyzer/protocol/tcp/TCP_Reassembler.h"
-#include "analyzer/protocol/pia/PIA.h"
+#include "zeek/analyzer/protocol/tcp/TCP_Reassembler.h"
+#include "zeek/analyzer/protocol/pia/PIA.h"
 
-#include "IP.h"
-#include "RunState.h"
-#include "NetVar.h"
-#include "File.h"
-#include "Event.h"
-#include "Reporter.h"
-#include "Sessions.h"
-#include "DebugLogger.h"
+#include "zeek/IP.h"
+#include "zeek/RunState.h"
+#include "zeek/NetVar.h"
+#include "zeek/File.h"
+#include "zeek/Event.h"
+#include "zeek/Reporter.h"
+#include "zeek/Sessions.h"
+#include "zeek/DebugLogger.h"
 
-#include "events.bif.h"
-#include "types.bif.h"
+#include "analyzer/protocol/tcp/events.bif.h"
+#include "analyzer/protocol/tcp/types.bif.h"
 
 namespace { // local namespace
 	const bool DEBUG_tcp_data_sent = false;
@@ -276,7 +276,7 @@ bool TCP_Analyzer::ValidateChecksum(const IP_Hdr* ip, const struct tcphdr* tp,
 				TCP_Endpoint* endpoint, int len, int caplen)
 	{
 	if ( ! run_state::current_pkt->l3_checksummed &&
-	     ! detail::ignore_checksums && 
+	     ! detail::ignore_checksums &&
 	     ! zeek::id::find_val<TableVal>("ignore_checksums_nets")->Contains(ip->IPHeaderSrcAddr()) &&
 	     caplen >= len && ! endpoint->ValidChecksum(tp, len, ip->IP4_Hdr()) )
 		{
diff --git a/src/analyzer/protocol/tcp/TCP.h b/src/analyzer/protocol/tcp/TCP.h
index 609afadbcc..705bb157f0 100644
--- a/src/analyzer/protocol/tcp/TCP.h
+++ b/src/analyzer/protocol/tcp/TCP.h
@@ -2,11 +2,11 @@
 
 #pragma once
 
-#include "analyzer/Analyzer.h"
-#include "IPAddr.h"
-#include "TCP_Endpoint.h"
-#include "TCP_Flags.h"
-#include "Conn.h"
+#include "zeek/analyzer/Analyzer.h"
+#include "zeek/IPAddr.h"
+#include "zeek/analyzer/protocol/tcp/TCP_Endpoint.h"
+#include "zeek/analyzer/protocol/tcp/TCP_Flags.h"
+#include "zeek/Conn.h"
 
 // We define two classes here:
 // - TCP_Analyzer is the analyzer for the TCP protocol itself.
diff --git a/src/analyzer/protocol/tcp/TCP_Endpoint.cc b/src/analyzer/protocol/tcp/TCP_Endpoint.cc
index 949cb2f74a..aeb9f2d822 100644
--- a/src/analyzer/protocol/tcp/TCP_Endpoint.cc
+++ b/src/analyzer/protocol/tcp/TCP_Endpoint.cc
@@ -1,18 +1,20 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
+#include "zeek/analyzer/protocol/tcp/TCP_Endpoint.h"
+
 #include <errno.h>
 
-#include "RunState.h"
-#include "NetVar.h"
-#include "analyzer/protocol/tcp/TCP.h"
-#include "TCP_Reassembler.h"
-#include "Reporter.h"
-#include "Sessions.h"
-#include "Event.h"
-#include "File.h"
-#include "Val.h"
+#include "zeek/RunState.h"
+#include "zeek/NetVar.h"
+#include "zeek/analyzer/protocol/tcp/TCP.h"
+#include "zeek/analyzer/protocol/tcp/TCP_Reassembler.h"
+#include "zeek/Reporter.h"
+#include "zeek/Sessions.h"
+#include "zeek/Event.h"
+#include "zeek/File.h"
+#include "zeek/Val.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/tcp/events.bif.h"
 
 namespace zeek::analyzer::tcp {
 
diff --git a/src/analyzer/protocol/tcp/TCP_Endpoint.h b/src/analyzer/protocol/tcp/TCP_Endpoint.h
index c25ffe618c..329d336c14 100644
--- a/src/analyzer/protocol/tcp/TCP_Endpoint.h
+++ b/src/analyzer/protocol/tcp/TCP_Endpoint.h
@@ -2,8 +2,8 @@
 
 #pragma once
 
-#include "IPAddr.h"
-#include "File.h"
+#include "zeek/IPAddr.h"
+#include "zeek/File.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(Connection, zeek);
 ZEEK_FORWARD_DECLARE_NAMESPACED(IP_Hdr, zeek);
diff --git a/src/analyzer/protocol/tcp/TCP_Reassembler.cc b/src/analyzer/protocol/tcp/TCP_Reassembler.cc
index 41d532ebce..8d87ad36db 100644
--- a/src/analyzer/protocol/tcp/TCP_Reassembler.cc
+++ b/src/analyzer/protocol/tcp/TCP_Reassembler.cc
@@ -1,16 +1,17 @@
-#include "TCP_Reassembler.h"
-#include "TCP_Endpoint.h"
-#include "File.h"
-#include "analyzer/Analyzer.h"
-#include "analyzer/protocol/tcp/TCP.h"
-#include "ZeekString.h"
-#include "Reporter.h"
-#include "RuleMatcher.h"
-
-#include "events.bif.h"
+#include "zeek/analyzer/protocol/tcp/TCP_Reassembler.h"
 
 #include <algorithm>
 
+#include "zeek/analyzer/protocol/tcp/TCP_Endpoint.h"
+#include "zeek/File.h"
+#include "zeek/analyzer/Analyzer.h"
+#include "zeek/analyzer/protocol/tcp/TCP.h"
+#include "zeek/ZeekString.h"
+#include "zeek/Reporter.h"
+#include "zeek/RuleMatcher.h"
+
+#include "analyzer/protocol/tcp/events.bif.h"
+
 namespace zeek::analyzer::tcp {
 
 // Note, sequence numbers are relative. I.e., they start with 1.
diff --git a/src/analyzer/protocol/tcp/TCP_Reassembler.h b/src/analyzer/protocol/tcp/TCP_Reassembler.h
index a633caac78..d973ff603e 100644
--- a/src/analyzer/protocol/tcp/TCP_Reassembler.h
+++ b/src/analyzer/protocol/tcp/TCP_Reassembler.h
@@ -1,9 +1,9 @@
 #pragma once
 
-#include "Reassem.h"
-#include "TCP_Endpoint.h"
-#include "TCP_Flags.h"
-#include "File.h"
+#include "zeek/Reassem.h"
+#include "zeek/analyzer/protocol/tcp/TCP_Endpoint.h"
+#include "zeek/analyzer/protocol/tcp/TCP_Flags.h"
+#include "zeek/File.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(Connection, zeek);
 ZEEK_FORWARD_DECLARE_NAMESPACED(Analyzer, zeek, analyzer);
diff --git a/src/analyzer/protocol/tcp/functions.bif b/src/analyzer/protocol/tcp/functions.bif
index 1d367be61c..38a379b8b9 100644
--- a/src/analyzer/protocol/tcp/functions.bif
+++ b/src/analyzer/protocol/tcp/functions.bif
@@ -1,9 +1,9 @@
 
 %%{
-#include "File.h"
-#include "Sessions.h"
-#include "Reporter.h"
-#include "analyzer/protocol/tcp/TCP.h"
+#include "zeek/File.h"
+#include "zeek/Sessions.h"
+#include "zeek/Reporter.h"
+#include "zeek/analyzer/protocol/tcp/TCP.h"
 %%}
 
 ## Get the originator sequence number of a TCP connection. Sequence numbers
diff --git a/src/analyzer/protocol/teredo/Plugin.cc b/src/analyzer/protocol/teredo/Plugin.cc
index 998880ec78..7c7a651d64 100644
--- a/src/analyzer/protocol/teredo/Plugin.cc
+++ b/src/analyzer/protocol/teredo/Plugin.cc
@@ -1,8 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-#include "Teredo.h"
-#include "plugin/Plugin.h"
-#include "analyzer/Component.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/analyzer/Component.h"
+#include "zeek/analyzer/protocol/teredo/Teredo.h"
 
 namespace zeek::plugin::detail::Zeek_Teredo {
 
diff --git a/src/analyzer/protocol/teredo/Teredo.cc b/src/analyzer/protocol/teredo/Teredo.cc
index 77c2390446..e0003007ba 100644
--- a/src/analyzer/protocol/teredo/Teredo.cc
+++ b/src/analyzer/protocol/teredo/Teredo.cc
@@ -1,15 +1,15 @@
+#include "zeek/analyzer/protocol/teredo/Teredo.h"
 
-#include "Teredo.h"
-#include "TunnelEncapsulation.h"
-#include "Conn.h"
-#include "IP.h"
-#include "Reporter.h"
-#include "Sessions.h"
-#include "ZeekString.h"
-#include "RunState.h"
-#include "packet_analysis/protocol/iptunnel/IPTunnel.h"
+#include "zeek/TunnelEncapsulation.h"
+#include "zeek/Conn.h"
+#include "zeek/IP.h"
+#include "zeek/Reporter.h"
+#include "zeek/Sessions.h"
+#include "zeek/ZeekString.h"
+#include "zeek/RunState.h"
+#include "zeek/packet_analysis/protocol/iptunnel/IPTunnel.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/teredo/events.bif.h"
 
 namespace zeek::analyzer::teredo {
 
diff --git a/src/analyzer/protocol/teredo/Teredo.h b/src/analyzer/protocol/teredo/Teredo.h
index 66b06e2cea..41a82d9b01 100644
--- a/src/analyzer/protocol/teredo/Teredo.h
+++ b/src/analyzer/protocol/teredo/Teredo.h
@@ -1,8 +1,8 @@
 #pragma once
 
-#include "analyzer/Analyzer.h"
-#include "NetVar.h"
-#include "Reporter.h"
+#include "zeek/analyzer/Analyzer.h"
+#include "zeek/NetVar.h"
+#include "zeek/Reporter.h"
 
 namespace zeek::analyzer::teredo {
 
diff --git a/src/analyzer/protocol/udp/Plugin.cc b/src/analyzer/protocol/udp/Plugin.cc
index 403ccc464b..fc08de2eb3 100644
--- a/src/analyzer/protocol/udp/Plugin.cc
+++ b/src/analyzer/protocol/udp/Plugin.cc
@@ -1,8 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-#include "analyzer/protocol/udp/UDP.h"
-#include "plugin/Plugin.h"
-#include "analyzer/Component.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/analyzer/Component.h"
+#include "zeek/analyzer/protocol/udp/UDP.h"
 
 namespace zeek::plugin::detail::Zeek_UDP {
 
diff --git a/src/analyzer/protocol/udp/UDP.cc b/src/analyzer/protocol/udp/UDP.cc
index 268aedd0ac..ae4e2c89af 100644
--- a/src/analyzer/protocol/udp/UDP.cc
+++ b/src/analyzer/protocol/udp/UDP.cc
@@ -1,17 +1,17 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
+#include "zeek-config.h"
+#include "zeek/analyzer/protocol/udp/UDP.h"
+
 #include <algorithm>
 
-#include "zeek-config.h"
+#include "zeek/RunState.h"
+#include "zeek/NetVar.h"
+#include "zeek/analyzer/Manager.h"
+#include "zeek/Reporter.h"
+#include "zeek/Conn.h"
 
-#include "RunState.h"
-#include "NetVar.h"
-#include "analyzer/protocol/udp/UDP.h"
-#include "analyzer/Manager.h"
-#include "Reporter.h"
-#include "Conn.h"
-
-#include "events.bif.h"
+#include "analyzer/protocol/udp/events.bif.h"
 
 namespace zeek::analyzer::udp {
 
@@ -62,9 +62,9 @@ void UDP_Analyzer::DeliverPacket(int len, const u_char* data, bool is_orig,
 
 	int chksum = up->uh_sum;
 
-	auto validate_checksum = 
-		! run_state::current_pkt->l3_checksummed && 
-		! zeek::detail::ignore_checksums && 
+	auto validate_checksum =
+		! run_state::current_pkt->l3_checksummed &&
+		! zeek::detail::ignore_checksums &&
 		! zeek::id::find_val<TableVal>("ignore_checksums_nets")->Contains(ip->IPHeaderSrcAddr()) &&
 		caplen >=len;
 
diff --git a/src/analyzer/protocol/udp/UDP.h b/src/analyzer/protocol/udp/UDP.h
index 31b6020317..fea70bca61 100644
--- a/src/analyzer/protocol/udp/UDP.h
+++ b/src/analyzer/protocol/udp/UDP.h
@@ -2,8 +2,11 @@
 
 #pragma once
 
-#include "analyzer/Analyzer.h"
-#include <netinet/udp.h>
+// This will include netinet/udp.h for us, plus set up some defines that make it work on all
+// of the CI platforms.
+#include "zeek/net_util.h"
+
+#include "zeek/analyzer/Analyzer.h"
 
 namespace zeek::analyzer::udp {
 
diff --git a/src/analyzer/protocol/vxlan/Plugin.cc b/src/analyzer/protocol/vxlan/Plugin.cc
index d6bc81a2aa..dfcf565b1c 100644
--- a/src/analyzer/protocol/vxlan/Plugin.cc
+++ b/src/analyzer/protocol/vxlan/Plugin.cc
@@ -1,8 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-#include "VXLAN.h"
-#include "plugin/Plugin.h"
-#include "analyzer/Component.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/analyzer/Component.h"
+#include "zeek/analyzer/protocol/vxlan/VXLAN.h"
 
 namespace zeek::plugin::detail::Zeek_VXLAN {
 
diff --git a/src/analyzer/protocol/vxlan/VXLAN.cc b/src/analyzer/protocol/vxlan/VXLAN.cc
index c43ead89a0..a66a3b17fc 100644
--- a/src/analyzer/protocol/vxlan/VXLAN.cc
+++ b/src/analyzer/protocol/vxlan/VXLAN.cc
@@ -1,23 +1,22 @@
 // See the file  in the main distribution directory for copyright.
 
-#include <pcap.h>	// for the DLT_EN10MB constant definition
-
-#include "VXLAN.h"
-#include "TunnelEncapsulation.h"
-#include "Conn.h"
-#include "IP.h"
-#include "RunState.h"
-#include "Sessions.h"
-#include "Reporter.h"
-#include "packet_analysis/Manager.h"
-#include "packet_analysis/protocol/iptunnel/IPTunnel.h"
-
-#include "events.bif.h"
+#include "zeek/analyzer/protocol/vxlan/VXLAN.h"
 
 extern "C" {
-#include <pcap.h>
+#include <pcap.h>	// for the DLT_EN10MB constant definition
 }
 
+#include "zeek/TunnelEncapsulation.h"
+#include "zeek/Conn.h"
+#include "zeek/IP.h"
+#include "zeek/RunState.h"
+#include "zeek/Sessions.h"
+#include "zeek/Reporter.h"
+#include "zeek/packet_analysis/Manager.h"
+#include "zeek/packet_analysis/protocol/iptunnel/IPTunnel.h"
+
+#include "analyzer/protocol/vxlan/events.bif.h"
+
 namespace zeek::analyzer::vxlan {
 
 void VXLAN_Analyzer::Done()
diff --git a/src/analyzer/protocol/vxlan/VXLAN.h b/src/analyzer/protocol/vxlan/VXLAN.h
index d09bfa8c18..3904cee897 100644
--- a/src/analyzer/protocol/vxlan/VXLAN.h
+++ b/src/analyzer/protocol/vxlan/VXLAN.h
@@ -2,7 +2,7 @@
 
 #pragma once
 
-#include "analyzer/Analyzer.h"
+#include "zeek/analyzer/Analyzer.h"
 
 namespace zeek::analyzer::vxlan {
 
diff --git a/src/analyzer/protocol/xmpp/Plugin.cc b/src/analyzer/protocol/xmpp/Plugin.cc
index 5df3cda31c..14c990e56c 100644
--- a/src/analyzer/protocol/xmpp/Plugin.cc
+++ b/src/analyzer/protocol/xmpp/Plugin.cc
@@ -1,8 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-#include "XMPP.h"
-#include "plugin/Plugin.h"
-#include "analyzer/Component.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/analyzer/Component.h"
+#include "zeek/analyzer/protocol/xmpp/XMPP.h"
 
 namespace zeek::plugin::detail::Zeek_XMPP {
 
diff --git a/src/analyzer/protocol/xmpp/XMPP.cc b/src/analyzer/protocol/xmpp/XMPP.cc
index f25119cc99..1f10b26a3d 100644
--- a/src/analyzer/protocol/xmpp/XMPP.cc
+++ b/src/analyzer/protocol/xmpp/XMPP.cc
@@ -1,8 +1,9 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "XMPP.h"
-#include "analyzer/protocol/tcp/TCP_Reassembler.h"
-#include "analyzer/Manager.h"
+#include "zeek/analyzer/protocol/xmpp/XMPP.h"
+
+#include "zeek/analyzer/protocol/tcp/TCP_Reassembler.h"
+#include "zeek/analyzer/Manager.h"
 
 namespace zeek::analyzer::xmpp {
 
diff --git a/src/analyzer/protocol/xmpp/XMPP.h b/src/analyzer/protocol/xmpp/XMPP.h
index d1f830f6b3..58b1e617ea 100644
--- a/src/analyzer/protocol/xmpp/XMPP.h
+++ b/src/analyzer/protocol/xmpp/XMPP.h
@@ -2,9 +2,9 @@
 
 #pragma once
 
-#include "analyzer/protocol/tcp/TCP.h"
+#include "zeek/analyzer/protocol/tcp/TCP.h"
 
-#include "xmpp_pac.h"
+#include "analyzer/protocol/xmpp/xmpp_pac.h"
 
 namespace zeek::analyzer::xmpp {
 
diff --git a/src/analyzer/protocol/xmpp/xmpp.pac b/src/analyzer/protocol/xmpp/xmpp.pac
index f9d0a6a4e5..a81751583b 100644
--- a/src/analyzer/protocol/xmpp/xmpp.pac
+++ b/src/analyzer/protocol/xmpp/xmpp.pac
@@ -8,14 +8,15 @@
 
 
 %extern{
-#include "Reporter.h"
-#include "events.bif.h"
 
 namespace zeek::analyzer::xmpp { class XMPP_Analyzer; }
 namespace binpac { namespace XMPP { class XMPP_Conn; } }
 using XMPPAnalyzer = zeek::analyzer::xmpp::XMPP_Analyzer*;
 
-#include "XMPP.h"
+#include "zeek/Reporter.h"
+#include "zeek/analyzer/protocol/xmpp/XMPP.h"
+
+#include "analyzer/protocol/xmpp/events.bif.h"
 %}
 
 extern type XMPPAnalyzer;
diff --git a/src/analyzer/protocol/zip/Plugin.cc b/src/analyzer/protocol/zip/Plugin.cc
index b7c3d5b770..085cbcd04f 100644
--- a/src/analyzer/protocol/zip/Plugin.cc
+++ b/src/analyzer/protocol/zip/Plugin.cc
@@ -1,8 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-#include "ZIP.h"
-#include "plugin/Plugin.h"
-#include "analyzer/Component.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/analyzer/Component.h"
+#include "zeek/analyzer/protocol/zip/ZIP.h"
 
 namespace zeek::plugin::detail::Zeek_ZIP {
 
diff --git a/src/analyzer/protocol/zip/ZIP.cc b/src/analyzer/protocol/zip/ZIP.cc
index f281e6e20f..e5a5c913c4 100644
--- a/src/analyzer/protocol/zip/ZIP.cc
+++ b/src/analyzer/protocol/zip/ZIP.cc
@@ -1,6 +1,6 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "ZIP.h"
+#include "zeek/analyzer/protocol/zip/ZIP.h"
 
 namespace zeek::analyzer::zip {
 
diff --git a/src/analyzer/protocol/zip/ZIP.h b/src/analyzer/protocol/zip/ZIP.h
index 1722450666..c29f7c5a63 100644
--- a/src/analyzer/protocol/zip/ZIP.h
+++ b/src/analyzer/protocol/zip/ZIP.h
@@ -4,8 +4,9 @@
 
 #include "zeek-config.h"
 
-#include "zlib.h"
-#include "analyzer/protocol/tcp/TCP.h"
+#include <zlib.h>
+
+#include "zeek/analyzer/protocol/tcp/TCP.h"
 
 namespace zeek::analyzer::zip {
 
diff --git a/src/binpac-lib.pac b/src/binpac-lib.pac
index 2c501d90a4..317218c5b2 100644
--- a/src/binpac-lib.pac
+++ b/src/binpac-lib.pac
@@ -1,7 +1,6 @@
 %extern{
 #include <string.h>
-
-#include "binpac_bytestring.h"
+#include <binpac_bytestring.h>
 %}
 
 function bytestring_casecmp(s1: const_bytestring, s2: const_charptr): int
diff --git a/src/binpac_bro.h b/src/binpac_bro.h
index d38f2aa085..41c27eae77 100644
--- a/src/binpac_bro.h
+++ b/src/binpac_bro.h
@@ -1,4 +1,4 @@
 #pragma once
 
 #warning "binpac_bro.h is deprecated and will be removed in v4.1. Use binpac_zeek.h instead."
-#include "binpac_zeek.h"
+#include "zeek/binpac_zeek.h"
diff --git a/src/binpac_zeek-lib.pac b/src/binpac_zeek-lib.pac
index c0152092c0..2d76dcf839 100644
--- a/src/binpac_zeek-lib.pac
+++ b/src/binpac_zeek-lib.pac
@@ -1,10 +1,10 @@
 %extern{
-#include "binpac_zeek.h"
-#include "util.h"
-#include "Reporter.h"
-#include "Val.h"
-#include "ConvertUTF.h"
-#include "RunState.h"
+#include "zeek/binpac_zeek.h"
+#include "zeek/util.h"
+#include "zeek/Reporter.h"
+#include "zeek/Val.h"
+#include "zeek/ConvertUTF.h"
+#include "zeek/RunState.h"
 %}
 
 %code{
diff --git a/src/binpac_zeek.h b/src/binpac_zeek.h
index 067608c833..1659638548 100644
--- a/src/binpac_zeek.h
+++ b/src/binpac_zeek.h
@@ -1,13 +1,13 @@
 #pragma once
 
-#include "util.h"
-#include "Val.h"
-#include "IntrusivePtr.h"
-#include "analyzer/Analyzer.h"
-#include "file_analysis/Analyzer.h"
-#include "event.bif.func_h"
+#include <binpac.h>
 
-#include "binpac.h"
+#include "zeek/util.h"
+#include "zeek/Val.h"
+#include "zeek/IntrusivePtr.h"
+#include "zeek/analyzer/Analyzer.h"
+#include "zeek/file_analysis/Analyzer.h"
+#include "event.bif.func_h"
 
 namespace binpac {
 
diff --git a/src/bro.pac b/src/bro.pac
index 4badf10259..7bfe202d79 100644
--- a/src/bro.pac
+++ b/src/bro.pac
@@ -1,6 +1,6 @@
 %extern{
 #warning "bro.pac is deprecated and will be removed in v4.1. Use zeek.pac instead."
-#include "binpac_bro.h"
+#include "zeek/binpac_bro.h"
 %}
 
 extern type BroAnalyzer;
diff --git a/src/bro_inet_ntop.c b/src/bro_inet_ntop.c
index c66c1daeda..40ec26ca25 100644
--- a/src/bro_inet_ntop.c
+++ b/src/bro_inet_ntop.c
@@ -16,7 +16,7 @@
  * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-#include "bro_inet_ntop.h"
+#include "zeek/bro_inet_ntop.h"
 
 #include <sys/param.h>
 #include <sys/types.h>
diff --git a/src/broker/Data.cc b/src/broker/Data.cc
index ebf883c975..a1a592711c 100644
--- a/src/broker/Data.cc
+++ b/src/broker/Data.cc
@@ -1,16 +1,17 @@
 #include <broker/error.hh>
-#include "broker/data.bif.h"
-#include "3rdparty/doctest.h"
+#include "zeek/3rdparty/doctest.h"
 
-#include "Data.h"
-#include "File.h"
-#include "Desc.h"
-#include "IntrusivePtr.h"
-#include "RE.h"
-#include "ID.h"
-#include "Scope.h"
-#include "Func.h"
-#include "module_util.h"
+#include "zeek/broker/Data.h"
+#include "zeek/File.h"
+#include "zeek/Desc.h"
+#include "zeek/IntrusivePtr.h"
+#include "zeek/RE.h"
+#include "zeek/ID.h"
+#include "zeek/Scope.h"
+#include "zeek/Func.h"
+#include "zeek/module_util.h"
+
+#include "broker/data.bif.h"
 
 using namespace std;
 
diff --git a/src/broker/Data.h b/src/broker/Data.h
index 009bbf35c5..3f200e5e05 100644
--- a/src/broker/Data.h
+++ b/src/broker/Data.h
@@ -1,9 +1,9 @@
 #pragma once
 
-#include "OpaqueVal.h"
-#include "Reporter.h"
-#include "Frame.h"
-#include "Expr.h"
+#include "zeek/OpaqueVal.h"
+#include "zeek/Reporter.h"
+#include "zeek/Frame.h"
+#include "zeek/Expr.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(ODesc, zeek);
 namespace zeek::threading {
diff --git a/src/broker/Manager.cc b/src/broker/Manager.cc
index b119c2b5e6..1dc74092e1 100644
--- a/src/broker/Manager.cc
+++ b/src/broker/Manager.cc
@@ -1,28 +1,30 @@
-#include "Manager.h"
+#include "zeek/broker/Manager.h"
 
-#include <broker/broker.hh>
-#include <broker/zeek.hh>
 #include <cstdio>
 #include <cstring>
 #include <unistd.h>
 
-#include "Func.h"
-#include "Data.h"
-#include "Store.h"
-#include "util.h"
-#include "Var.h"
-#include "Desc.h"
-#include "Reporter.h"
-#include "IntrusivePtr.h"
+#include <broker/broker.hh>
+#include <broker/zeek.hh>
+
+#include "zeek/Func.h"
+#include "zeek/broker/Data.h"
+#include "zeek/broker/Store.h"
+#include "zeek/util.h"
+#include "zeek/Var.h"
+#include "zeek/Desc.h"
+#include "zeek/Reporter.h"
+#include "zeek/IntrusivePtr.h"
+#include "zeek/logging/Manager.h"
+#include "zeek/DebugLogger.h"
+#include "zeek/iosource/Manager.h"
+#include "zeek/SerializationFormat.h"
+#include "zeek/RunState.h"
+
 #include "broker/comm.bif.h"
 #include "broker/data.bif.h"
 #include "broker/messaging.bif.h"
 #include "broker/store.bif.h"
-#include "logging/Manager.h"
-#include "DebugLogger.h"
-#include "iosource/Manager.h"
-#include "SerializationFormat.h"
-#include "RunState.h"
 
 using namespace std;
 
diff --git a/src/broker/Manager.h b/src/broker/Manager.h
index 6e313ab915..5ef0e5efe2 100644
--- a/src/broker/Manager.h
+++ b/src/broker/Manager.h
@@ -1,5 +1,9 @@
 #pragma once
 
+#include <memory>
+#include <string>
+#include <unordered_map>
+
 #include <broker/topic.hh>
 #include <broker/data.hh>
 #include <broker/store.hh>
@@ -14,13 +18,9 @@
 #include <broker/detail/hash.hh>
 #include <broker/zeek.hh>
 
-#include <memory>
-#include <string>
-#include <unordered_map>
-
-#include "IntrusivePtr.h"
-#include "iosource/IOSource.h"
-#include "logging/WriterBackend.h"
+#include "zeek/IntrusivePtr.h"
+#include "zeek/iosource/IOSource.h"
+#include "zeek/logging/WriterBackend.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(Func, zeek);
 ZEEK_FORWARD_DECLARE_NAMESPACED(Frame, zeek::detail);
diff --git a/src/broker/Store.cc b/src/broker/Store.cc
index 1687780911..b86cc2f395 100644
--- a/src/broker/Store.cc
+++ b/src/broker/Store.cc
@@ -1,7 +1,7 @@
-#include "broker/Store.h"
-#include "Desc.h"
-#include "ID.h"
-#include "broker/Manager.h"
+#include "zeek/broker/Store.h"
+#include "zeek/Desc.h"
+#include "zeek/ID.h"
+#include "zeek/broker/Manager.h"
 
 zeek::OpaqueTypePtr zeek::Broker::detail::opaque_of_store_handle;
 zeek::OpaqueTypePtr& bro_broker::opaque_of_store_handle = zeek::Broker::detail::opaque_of_store_handle;
diff --git a/src/broker/Store.h b/src/broker/Store.h
index 833f14ae5d..513010a580 100644
--- a/src/broker/Store.h
+++ b/src/broker/Store.h
@@ -1,15 +1,16 @@
 #pragma once
 
-#include "broker/store.bif.h"
-#include "broker/data.bif.h"
-#include "OpaqueVal.h"
-#include "Trigger.h"
-
 #include <broker/store.hh>
 #include <broker/store_event.hh>
 #include <broker/backend.hh>
 #include <broker/backend_options.hh>
 
+#include "zeek/OpaqueVal.h"
+#include "zeek/Trigger.h"
+
+#include "broker/store.bif.h"
+#include "broker/data.bif.h"
+
 namespace zeek::Broker::detail {
 
 extern OpaqueTypePtr opaque_of_store_handle;
diff --git a/src/broker/comm.bif b/src/broker/comm.bif
index c997530780..87f213361c 100644
--- a/src/broker/comm.bif
+++ b/src/broker/comm.bif
@@ -2,7 +2,7 @@
 ##! Functions and events regarding broker communication mechanisms.
 
 %%{
-#include "broker/Manager.h"
+#include "zeek/broker/Manager.h"
 %%}
 
 module Broker;
diff --git a/src/broker/data.bif b/src/broker/data.bif
index 425b534633..f671702bf2 100644
--- a/src/broker/data.bif
+++ b/src/broker/data.bif
@@ -2,7 +2,7 @@
 ##! Functions for inspecting and manipulating broker data.
 
 %%{
-#include "broker/Data.h"
+#include "zeek/broker/Data.h"
 %%}
 
 module Broker;
diff --git a/src/broker/messaging.bif b/src/broker/messaging.bif
index eb41c66645..6c9e27920b 100644
--- a/src/broker/messaging.bif
+++ b/src/broker/messaging.bif
@@ -2,11 +2,12 @@
 ##! Functions for peering and various messaging patterns.
 
 %%{
-#include "broker/Manager.h"
-#include "logging/Manager.h"
 #include <set>
 #include <string>
 
+#include "zeek/broker/Manager.h"
+#include "zeek/logging/Manager.h"
+
 static bool is_string_set(const zeek::Type* type)
 	{
 	if ( ! type->IsSet() )
diff --git a/src/broker/store.bif b/src/broker/store.bif
index fceb43e68b..a4a6737467 100644
--- a/src/broker/store.bif
+++ b/src/broker/store.bif
@@ -2,10 +2,10 @@
 ##! Functions to interface with broker's distributed data store.
 
 %%{
-#include "broker/Manager.h"
-#include "broker/Store.h"
-#include "broker/Data.h"
-#include "Trigger.h"
+#include "zeek/broker/Manager.h"
+#include "zeek/broker/Store.h"
+#include "zeek/broker/Data.h"
+#include "zeek/Trigger.h"
 
 static zeek::Broker::detail::StoreHandleVal* to_store_handle(zeek::Val* h)
 	{ return dynamic_cast<zeek::Broker::detail::StoreHandleVal*>(h); }
diff --git a/src/digest.cc b/src/digest.cc
index 2157795896..afab5d4ae3 100644
--- a/src/digest.cc
+++ b/src/digest.cc
@@ -4,9 +4,9 @@
  * Wrapper and helper functions for MD5/SHA digest algorithms.
  */
 
-#include "digest.h"
+#include "zeek/digest.h"
 
-#include "Reporter.h"
+#include "zeek/Reporter.h"
 
 namespace zeek::detail {
 
diff --git a/src/digest.h b/src/digest.h
index b708144e9a..7829f4c027 100644
--- a/src/digest.h
+++ b/src/digest.h
@@ -6,13 +6,13 @@
 
 #pragma once
 
+#include <sys/types.h> // for u_char
+#include <cstdint>
+
 #include <openssl/md5.h>
 #include <openssl/sha.h>
 #include <openssl/evp.h>
 
-#include <sys/types.h> // for u_char
-#include <cstdint>
-
 #if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || defined(LIBRESSL_VERSION_NUMBER)
 #define EVP_MD_CTX_new EVP_MD_CTX_create
 #define EVP_MD_CTX_free EVP_MD_CTX_destroy
diff --git a/src/file_analysis/Analyzer.cc b/src/file_analysis/Analyzer.cc
index 665377b594..7442157b9c 100644
--- a/src/file_analysis/Analyzer.cc
+++ b/src/file_analysis/Analyzer.cc
@@ -1,8 +1,8 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "Analyzer.h"
-#include "Manager.h"
-#include "Val.h"
+#include "zeek/file_analysis/Analyzer.h"
+#include "zeek/file_analysis/Manager.h"
+#include "zeek/Val.h"
 
 namespace zeek::file_analysis {
 
diff --git a/src/file_analysis/Analyzer.h b/src/file_analysis/Analyzer.h
index e0cf074b96..0710f05563 100644
--- a/src/file_analysis/Analyzer.h
+++ b/src/file_analysis/Analyzer.h
@@ -2,10 +2,10 @@
 
 #pragma once
 
-#include "Tag.h"
-
 #include <sys/types.h> // for u_char
 
+#include "zeek/file_analysis/Tag.h"
+
 ZEEK_FORWARD_DECLARE_NAMESPACED(RecordVal, zeek);
 namespace zeek {
 using RecordValPtr = IntrusivePtr<RecordVal>;
diff --git a/src/file_analysis/AnalyzerSet.cc b/src/file_analysis/AnalyzerSet.cc
index 6c52c34080..b1498b7ad8 100644
--- a/src/file_analysis/AnalyzerSet.cc
+++ b/src/file_analysis/AnalyzerSet.cc
@@ -1,11 +1,12 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "AnalyzerSet.h"
-#include "File.h"
-#include "Analyzer.h"
-#include "Manager.h"
-#include "CompHash.h"
-#include "Val.h"
+#include "zeek/file_analysis/AnalyzerSet.h"
+#include "zeek/file_analysis/File.h"
+#include "zeek/file_analysis/Analyzer.h"
+#include "zeek/file_analysis/Manager.h"
+#include "zeek/CompHash.h"
+#include "zeek/Val.h"
+
 #include "file_analysis/file_analysis.bif.h"
 
 namespace zeek::file_analysis::detail {
diff --git a/src/file_analysis/AnalyzerSet.h b/src/file_analysis/AnalyzerSet.h
index 216210a7e8..a72757a1a2 100644
--- a/src/file_analysis/AnalyzerSet.h
+++ b/src/file_analysis/AnalyzerSet.h
@@ -5,8 +5,8 @@
 #include <queue>
 #include <memory>
 
-#include "Dict.h"
-#include "Tag.h"
+#include "zeek/Dict.h"
+#include "zeek/file_analysis/Tag.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(CompositeHash, zeek::detail);
 ZEEK_FORWARD_DECLARE_NAMESPACED(RecordVal, zeek);
diff --git a/src/file_analysis/Component.cc b/src/file_analysis/Component.cc
index e817dd338b..29fe260c7a 100644
--- a/src/file_analysis/Component.cc
+++ b/src/file_analysis/Component.cc
@@ -1,10 +1,10 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "Component.h"
-#include "Manager.h"
+#include "zeek/file_analysis/Component.h"
 
-#include "../Desc.h"
-#include "../util.h"
+#include "zeek/Desc.h"
+#include "zeek/util.h"
+#include "zeek/file_analysis/Manager.h"
 
 namespace zeek::file_analysis {
 
diff --git a/src/file_analysis/Component.h b/src/file_analysis/Component.h
index c562a65ff3..c59df0804a 100644
--- a/src/file_analysis/Component.h
+++ b/src/file_analysis/Component.h
@@ -2,11 +2,11 @@
 
 #pragma once
 
-#include "Tag.h"
-#include "plugin/Component.h"
-#include "plugin/TaggedComponent.h"
+#include "zeek-config.h"
 
-#include "../zeek-config.h"
+#include "zeek/file_analysis/Tag.h"
+#include "zeek/plugin/Component.h"
+#include "zeek/plugin/TaggedComponent.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(RecordVal, zeek);
 namespace zeek {
diff --git a/src/file_analysis/File.cc b/src/file_analysis/File.cc
index d290e32208..a54fd19585 100644
--- a/src/file_analysis/File.cc
+++ b/src/file_analysis/File.cc
@@ -1,23 +1,23 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "File.h"
+#include "zeek/file_analysis/File.h"
 
 #include <utility>
 
-#include "FileReassembler.h"
-#include "FileTimer.h"
-#include "Analyzer.h"
-#include "Manager.h"
-#include "Reporter.h"
-#include "Val.h"
-#include "Type.h"
-#include "Event.h"
-#include "RuleMatcher.h"
+#include "zeek/file_analysis/FileReassembler.h"
+#include "zeek/file_analysis/FileTimer.h"
+#include "zeek/file_analysis/Analyzer.h"
+#include "zeek/file_analysis/Manager.h"
+#include "zeek/Reporter.h"
+#include "zeek/Val.h"
+#include "zeek/Type.h"
+#include "zeek/Event.h"
+#include "zeek/RuleMatcher.h"
 
-#include "analyzer/Analyzer.h"
-#include "analyzer/Manager.h"
+#include "zeek/analyzer/Analyzer.h"
+#include "zeek/analyzer/Manager.h"
 
-#include "analyzer/extract/Extract.h"
+#include "zeek/file_analysis/analyzer/extract/Extract.h"
 
 namespace zeek::file_analysis {
 
diff --git a/src/file_analysis/File.h b/src/file_analysis/File.h
index 67ffa6f2f6..0e569db35b 100644
--- a/src/file_analysis/File.h
+++ b/src/file_analysis/File.h
@@ -6,12 +6,12 @@
 #include <string>
 #include <utility>
 
-#include "analyzer/Tag.h"
-#include "AnalyzerSet.h"
-#include "ZeekString.h"
-#include "ZeekList.h" // for ValPList
-#include "ZeekArgs.h"
-#include "WeirdState.h"
+#include "zeek/analyzer/Tag.h"
+#include "zeek/file_analysis/AnalyzerSet.h"
+#include "zeek/ZeekString.h"
+#include "zeek/ZeekList.h" // for ValPList
+#include "zeek/ZeekArgs.h"
+#include "zeek/WeirdState.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(Connection, zeek);
 ZEEK_FORWARD_DECLARE_NAMESPACED(EventHandlerPtr, zeek);
diff --git a/src/file_analysis/FileReassembler.cc b/src/file_analysis/FileReassembler.cc
index ee8e2eb727..c36627d26a 100644
--- a/src/file_analysis/FileReassembler.cc
+++ b/src/file_analysis/FileReassembler.cc
@@ -1,7 +1,7 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "FileReassembler.h"
-#include "File.h"
+#include "zeek/file_analysis/FileReassembler.h"
+#include "zeek/file_analysis/File.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(File, zeek, file_analysis);
 
diff --git a/src/file_analysis/FileReassembler.h b/src/file_analysis/FileReassembler.h
index 218b16561b..54b3d288e0 100644
--- a/src/file_analysis/FileReassembler.h
+++ b/src/file_analysis/FileReassembler.h
@@ -2,7 +2,7 @@
 
 #pragma once
 
-#include "Reassem.h"
+#include "zeek/Reassem.h"
 
 namespace zeek { class File; }
 using BroFile [[deprecated("Remove in v4.1. Use zeek::File.")]] = zeek::File;
diff --git a/src/file_analysis/FileTimer.cc b/src/file_analysis/FileTimer.cc
index 2681b26d37..6d473bf170 100644
--- a/src/file_analysis/FileTimer.cc
+++ b/src/file_analysis/FileTimer.cc
@@ -1,8 +1,8 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "FileTimer.h"
-#include "File.h"
-#include "Manager.h"
+#include "zeek/file_analysis/FileTimer.h"
+#include "zeek/file_analysis/File.h"
+#include "zeek/file_analysis/Manager.h"
 
 namespace zeek::file_analysis::detail {
 
diff --git a/src/file_analysis/FileTimer.h b/src/file_analysis/FileTimer.h
index 5523fc7307..2aafb6a1a8 100644
--- a/src/file_analysis/FileTimer.h
+++ b/src/file_analysis/FileTimer.h
@@ -3,7 +3,7 @@
 #pragma once
 
 #include <string>
-#include "Timer.h"
+#include "zeek/Timer.h"
 
 namespace zeek::file_analysis::detail {
 
diff --git a/src/file_analysis/Manager.cc b/src/file_analysis/Manager.cc
index 1fb9fad192..fa1ae36425 100644
--- a/src/file_analysis/Manager.cc
+++ b/src/file_analysis/Manager.cc
@@ -1,18 +1,19 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "Manager.h"
-#include "File.h"
-#include "Analyzer.h"
-#include "Event.h"
-#include "UID.h"
-#include "digest.h"
-
-#include "plugin/Manager.h"
-#include "analyzer/Manager.h"
-#include "file_analysis/file_analysis.bif.h"
+#include "zeek/file_analysis/Manager.h"
 
 #include <openssl/md5.h>
 
+#include "zeek/file_analysis/File.h"
+#include "zeek/file_analysis/Analyzer.h"
+#include "zeek/Event.h"
+#include "zeek/UID.h"
+#include "zeek/digest.h"
+#include "zeek/plugin/Manager.h"
+#include "zeek/analyzer/Manager.h"
+
+#include "file_analysis/file_analysis.bif.h"
+
 using namespace std;
 
 namespace zeek::file_analysis {
diff --git a/src/file_analysis/Manager.h b/src/file_analysis/Manager.h
index 0dcc23b21f..93480e144f 100644
--- a/src/file_analysis/Manager.h
+++ b/src/file_analysis/Manager.h
@@ -6,13 +6,13 @@
 #include <set>
 #include <map>
 
-#include "Component.h"
-#include "RunState.h"
-#include "RuleMatcher.h"
+#include "zeek/file_analysis/Component.h"
+#include "zeek/RunState.h"
+#include "zeek/RuleMatcher.h"
 
-#include "plugin/ComponentManager.h"
-#include "analyzer/Tag.h"
-#include "FileTimer.h"
+#include "zeek/plugin/ComponentManager.h"
+#include "zeek/analyzer/Tag.h"
+#include "zeek/file_analysis/FileTimer.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(TableVal, zeek);
 ZEEK_FORWARD_DECLARE_NAMESPACED(VectorVal, zeek);
diff --git a/src/file_analysis/Tag.cc b/src/file_analysis/Tag.cc
index dab314400f..68a24a3ef9 100644
--- a/src/file_analysis/Tag.cc
+++ b/src/file_analysis/Tag.cc
@@ -1,7 +1,7 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "Tag.h"
-#include "Manager.h"
+#include "zeek/file_analysis/Tag.h"
+#include "zeek/file_analysis/Manager.h"
 
 namespace zeek::file_analysis {
 
diff --git a/src/file_analysis/Tag.h b/src/file_analysis/Tag.h
index 75e9f42df2..8c04a998da 100644
--- a/src/file_analysis/Tag.h
+++ b/src/file_analysis/Tag.h
@@ -3,7 +3,7 @@
 #pragma once
 
 #include "zeek-config.h"
-#include "../Tag.h"
+#include "zeek/Tag.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(EnumVal, zeek);
 
diff --git a/src/file_analysis/analyzer/data_event/DataEvent.cc b/src/file_analysis/analyzer/data_event/DataEvent.cc
index d28459ab7c..afe6009b08 100644
--- a/src/file_analysis/analyzer/data_event/DataEvent.cc
+++ b/src/file_analysis/analyzer/data_event/DataEvent.cc
@@ -2,12 +2,12 @@
 
 #include <string>
 
-#include "DataEvent.h"
-#include "EventRegistry.h"
-#include "Event.h"
-#include "Func.h"
-#include "util.h"
-#include "file_analysis/Manager.h"
+#include "zeek/file_analysis/analyzer/data_event/DataEvent.h"
+#include "zeek/EventRegistry.h"
+#include "zeek/Event.h"
+#include "zeek/Func.h"
+#include "zeek/util.h"
+#include "zeek/file_analysis/Manager.h"
 
 namespace zeek::file_analysis::detail {
 
diff --git a/src/file_analysis/analyzer/data_event/DataEvent.h b/src/file_analysis/analyzer/data_event/DataEvent.h
index 98daa405c5..d48ca6c5a0 100644
--- a/src/file_analysis/analyzer/data_event/DataEvent.h
+++ b/src/file_analysis/analyzer/data_event/DataEvent.h
@@ -4,10 +4,10 @@
 
 #include <string>
 
-#include "Val.h"
-#include "File.h"
-#include "Analyzer.h"
-#include "EventHandler.h"
+#include "zeek/Val.h"
+#include "zeek/file_analysis/File.h"
+#include "zeek/file_analysis/Analyzer.h"
+#include "zeek/EventHandler.h"
 
 namespace zeek::file_analysis::detail {
 
diff --git a/src/file_analysis/analyzer/data_event/Plugin.cc b/src/file_analysis/analyzer/data_event/Plugin.cc
index 48be7fe92d..09ea29cf27 100644
--- a/src/file_analysis/analyzer/data_event/Plugin.cc
+++ b/src/file_analysis/analyzer/data_event/Plugin.cc
@@ -1,8 +1,8 @@
 // See the file in the main distribution directory for copyright.
 
-#include "DataEvent.h"
-#include "plugin/Plugin.h"
-#include "file_analysis/Component.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/file_analysis/Component.h"
+#include "zeek/file_analysis/analyzer/data_event/DataEvent.h"
 
 namespace zeek::plugin::detail::Zeek_FileDataEvent {
 
diff --git a/src/file_analysis/analyzer/entropy/Entropy.cc b/src/file_analysis/analyzer/entropy/Entropy.cc
index 868f0611c1..22517e720d 100644
--- a/src/file_analysis/analyzer/entropy/Entropy.cc
+++ b/src/file_analysis/analyzer/entropy/Entropy.cc
@@ -1,11 +1,12 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
+#include "zeek/file_analysis/analyzer/entropy/Entropy.h"
+
 #include <string>
 
-#include "Entropy.h"
-#include "util.h"
-#include "Event.h"
-#include "file_analysis/Manager.h"
+#include "zeek/util.h"
+#include "zeek/Event.h"
+#include "zeek/file_analysis/Manager.h"
 
 namespace zeek::file_analysis::detail {
 
diff --git a/src/file_analysis/analyzer/entropy/Entropy.h b/src/file_analysis/analyzer/entropy/Entropy.h
index 8d18be544c..c6b3df96f8 100644
--- a/src/file_analysis/analyzer/entropy/Entropy.h
+++ b/src/file_analysis/analyzer/entropy/Entropy.h
@@ -4,12 +4,12 @@
 
 #include <string>
 
-#include "Val.h"
-#include "OpaqueVal.h"
-#include "File.h"
-#include "Analyzer.h"
+#include "zeek/Val.h"
+#include "zeek/OpaqueVal.h"
+#include "zeek/file_analysis/File.h"
+#include "zeek/file_analysis/Analyzer.h"
 
-#include "events.bif.h"
+#include "file_analysis/analyzer/entropy/events.bif.h"
 
 namespace zeek::file_analysis::detail {
 
diff --git a/src/file_analysis/analyzer/entropy/Plugin.cc b/src/file_analysis/analyzer/entropy/Plugin.cc
index 3a14c3e190..327a9ebfa9 100644
--- a/src/file_analysis/analyzer/entropy/Plugin.cc
+++ b/src/file_analysis/analyzer/entropy/Plugin.cc
@@ -1,8 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-#include "Entropy.h"
-#include "plugin/Plugin.h"
-#include "file_analysis/Component.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/file_analysis/Component.h"
+#include "zeek/file_analysis/analyzer/entropy/Entropy.h"
 
 namespace zeek::plugin::detail::Zeek_FileEntropy {
 
diff --git a/src/file_analysis/analyzer/extract/Extract.cc b/src/file_analysis/analyzer/extract/Extract.cc
index 63b3dcb0cd..001c49ba01 100644
--- a/src/file_analysis/analyzer/extract/Extract.cc
+++ b/src/file_analysis/analyzer/extract/Extract.cc
@@ -1,12 +1,13 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include <string>
-#include <fcntl.h>
+#include "zeek/file_analysis/analyzer/extract/Extract.h"
 
-#include "Extract.h"
-#include "util.h"
-#include "Event.h"
-#include "file_analysis/Manager.h"
+#include <fcntl.h>
+#include <string>
+
+#include "zeek/util.h"
+#include "zeek/Event.h"
+#include "zeek/file_analysis/Manager.h"
 
 namespace zeek::file_analysis::detail {
 
diff --git a/src/file_analysis/analyzer/extract/Extract.h b/src/file_analysis/analyzer/extract/Extract.h
index 72b48f277b..e9c7138446 100644
--- a/src/file_analysis/analyzer/extract/Extract.h
+++ b/src/file_analysis/analyzer/extract/Extract.h
@@ -4,11 +4,11 @@
 
 #include <string>
 
-#include "Val.h"
-#include "File.h"
-#include "Analyzer.h"
+#include "zeek/Val.h"
+#include "zeek/file_analysis/File.h"
+#include "zeek/file_analysis/Analyzer.h"
 
-#include "analyzer/extract/events.bif.h"
+#include "file_analysis/analyzer/extract/events.bif.h"
 
 namespace zeek::file_analysis::detail {
 
diff --git a/src/file_analysis/analyzer/extract/Plugin.cc b/src/file_analysis/analyzer/extract/Plugin.cc
index 6ac9223b24..38454877e2 100644
--- a/src/file_analysis/analyzer/extract/Plugin.cc
+++ b/src/file_analysis/analyzer/extract/Plugin.cc
@@ -1,8 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-#include "Extract.h"
-#include "plugin/Plugin.h"
-#include "file_analysis/Component.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/file_analysis/Component.h"
+#include "zeek/file_analysis/analyzer/extract/Extract.h"
 
 namespace zeek::plugin::detail::Zeek_FileExtract {
 
diff --git a/src/file_analysis/analyzer/extract/functions.bif b/src/file_analysis/analyzer/extract/functions.bif
index 8155c1f1dc..c75127f87f 100644
--- a/src/file_analysis/analyzer/extract/functions.bif
+++ b/src/file_analysis/analyzer/extract/functions.bif
@@ -3,7 +3,8 @@
 module FileExtract;
 
 %%{
-#include "file_analysis/Manager.h"
+#include "zeek/zeek/file_analysis/Manager.h"
+
 #include "file_analysis/file_analysis.bif.h"
 %%}
 
diff --git a/src/file_analysis/analyzer/hash/Hash.cc b/src/file_analysis/analyzer/hash/Hash.cc
index ffc6e047b8..d913e0da65 100644
--- a/src/file_analysis/analyzer/hash/Hash.cc
+++ b/src/file_analysis/analyzer/hash/Hash.cc
@@ -1,11 +1,12 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
+#include "zeek/file_analysis/analyzer/hash/Hash.h"
+
 #include <string>
 
-#include "Hash.h"
-#include "util.h"
-#include "Event.h"
-#include "file_analysis/Manager.h"
+#include "zeek/util.h"
+#include "zeek/Event.h"
+#include "zeek/file_analysis/Manager.h"
 
 namespace zeek::file_analysis::detail {
 
diff --git a/src/file_analysis/analyzer/hash/Hash.h b/src/file_analysis/analyzer/hash/Hash.h
index bce6c978e6..927673b2cb 100644
--- a/src/file_analysis/analyzer/hash/Hash.h
+++ b/src/file_analysis/analyzer/hash/Hash.h
@@ -4,12 +4,12 @@
 
 #include <string>
 
-#include "Val.h"
-#include "OpaqueVal.h"
-#include "File.h"
-#include "Analyzer.h"
+#include "zeek/Val.h"
+#include "zeek/OpaqueVal.h"
+#include "zeek/file_analysis/File.h"
+#include "zeek/file_analysis/Analyzer.h"
 
-#include "events.bif.h"
+#include "file_analysis/analyzer/hash/events.bif.h"
 
 namespace zeek::file_analysis::detail {
 
diff --git a/src/file_analysis/analyzer/hash/Plugin.cc b/src/file_analysis/analyzer/hash/Plugin.cc
index d889308d35..1b25b77f84 100644
--- a/src/file_analysis/analyzer/hash/Plugin.cc
+++ b/src/file_analysis/analyzer/hash/Plugin.cc
@@ -1,8 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-#include "Hash.h"
-#include "plugin/Plugin.h"
-#include "file_analysis/Component.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/file_analysis/Component.h"
+#include "zeek/file_analysis/analyzer/hash/Hash.h"
 
 namespace zeek::plugin::detail::Zeek_FileHash {
 
diff --git a/src/file_analysis/analyzer/pe/PE.cc b/src/file_analysis/analyzer/pe/PE.cc
index 1a1dd8ead3..730ccb4a92 100644
--- a/src/file_analysis/analyzer/pe/PE.cc
+++ b/src/file_analysis/analyzer/pe/PE.cc
@@ -1,5 +1,5 @@
-#include "PE.h"
-#include "file_analysis/Manager.h"
+#include "zeek/file_analysis/analyzer/pe/PE.h"
+#include "zeek/file_analysis/Manager.h"
 
 namespace zeek::file_analysis::detail {
 
diff --git a/src/file_analysis/analyzer/pe/PE.h b/src/file_analysis/analyzer/pe/PE.h
index 661eff5991..86d5326a29 100644
--- a/src/file_analysis/analyzer/pe/PE.h
+++ b/src/file_analysis/analyzer/pe/PE.h
@@ -2,9 +2,9 @@
 
 #include <string>
 
-#include "Val.h"
-#include "../File.h"
-#include "pe_pac.h"
+#include "zeek/Val.h"
+#include "zeek/File.h"
+#include "file_analysis/analyzer/pe/pe_pac.h"
 
 namespace zeek::file_analysis::detail {
 
diff --git a/src/file_analysis/analyzer/pe/Plugin.cc b/src/file_analysis/analyzer/pe/Plugin.cc
index 77663c2e80..30acca5a1f 100644
--- a/src/file_analysis/analyzer/pe/Plugin.cc
+++ b/src/file_analysis/analyzer/pe/Plugin.cc
@@ -1,8 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-#include "PE.h"
-#include "plugin/Plugin.h"
-#include "file_analysis/Component.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/file_analysis/Component.h"
+#include "zeek/file_analysis/analyzer/pe/PE.h"
 
 namespace zeek::plugin::detail::Zeek_PE {
 
diff --git a/src/file_analysis/analyzer/pe/pe-analyzer.pac b/src/file_analysis/analyzer/pe/pe-analyzer.pac
index 4dc284b769..8b02aa3661 100644
--- a/src/file_analysis/analyzer/pe/pe-analyzer.pac
+++ b/src/file_analysis/analyzer/pe/pe-analyzer.pac
@@ -1,7 +1,8 @@
 %extern{
-#include "Event.h"
-#include "file_analysis/File.h"
-#include "events.bif.h"
+#include "zeek/Event.h"
+#include "zeek/file_analysis/File.h"
+
+#include "file_analysis/analyzer/pe/events.bif.h"
 %}
 
 %header{
diff --git a/src/file_analysis/analyzer/unified2/Plugin.cc b/src/file_analysis/analyzer/unified2/Plugin.cc
index b01e24e8a5..d78ca5cbac 100644
--- a/src/file_analysis/analyzer/unified2/Plugin.cc
+++ b/src/file_analysis/analyzer/unified2/Plugin.cc
@@ -2,9 +2,9 @@
 
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "Unified2.h"
-#include "plugin/Plugin.h"
-#include "file_analysis/Component.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/file_analysis/Component.h"
+#include "zeek/file_analysis/analyzer/unified2/Unified2.h"
 
 namespace zeek::plugin::detail::Zeek_Unified2 {
 
diff --git a/src/file_analysis/analyzer/unified2/Unified2.cc b/src/file_analysis/analyzer/unified2/Unified2.cc
index c3a9fdbe39..cc1f4950db 100644
--- a/src/file_analysis/analyzer/unified2/Unified2.cc
+++ b/src/file_analysis/analyzer/unified2/Unified2.cc
@@ -1,7 +1,7 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "Unified2.h"
-#include "file_analysis/Manager.h"
+#include "zeek/file_analysis/analyzer/unified2/Unified2.h"
+#include "zeek/file_analysis/Manager.h"
 
 namespace zeek::file_analysis::detail {
 
diff --git a/src/file_analysis/analyzer/unified2/Unified2.h b/src/file_analysis/analyzer/unified2/Unified2.h
index 24e7b19851..e79302cd36 100644
--- a/src/file_analysis/analyzer/unified2/Unified2.h
+++ b/src/file_analysis/analyzer/unified2/Unified2.h
@@ -4,10 +4,10 @@
 
 #include <string>
 
-#include "Val.h"
-#include "File.h"
-#include "Analyzer.h"
-#include "unified2_pac.h"
+#include "zeek/Val.h"
+#include "zeek/file_analysis/File.h"
+#include "zeek/file_analysis/Analyzer.h"
+#include "file_analysis/analyzer/unified2/unified2_pac.h"
 
 namespace zeek::file_analysis::detail {
 
diff --git a/src/file_analysis/analyzer/unified2/unified2-analyzer.pac b/src/file_analysis/analyzer/unified2/unified2-analyzer.pac
index bb74008099..f1af68ea00 100644
--- a/src/file_analysis/analyzer/unified2/unified2-analyzer.pac
+++ b/src/file_analysis/analyzer/unified2/unified2-analyzer.pac
@@ -1,10 +1,11 @@
 
 %extern{
-#include "Event.h"
-#include "file_analysis/File.h"
-#include "events.bif.h"
-#include "types.bif.h"
-#include "IPAddr.h"
+#include "zeek/Event.h"
+#include "zeek/file_analysis/File.h"
+#include "zeek/IPAddr.h"
+
+#include "file_analysis/analyzer/unified2/events.bif.h"
+#include "file_analysis/analyzer/unified2/types.bif.h"
 %}
 
 %code{
diff --git a/src/file_analysis/analyzer/x509/OCSP.cc b/src/file_analysis/analyzer/x509/OCSP.cc
index 81e8017cdf..dda8dd50d6 100644
--- a/src/file_analysis/analyzer/x509/OCSP.cc
+++ b/src/file_analysis/analyzer/x509/OCSP.cc
@@ -1,25 +1,23 @@
 
 // See the file "COPYING" in the main distribution directory for copyright.
 
+#include "zeek/file_analysis/analyzer/x509/OCSP.h"
+
 #include <string>
 
-#include "OCSP.h"
-#include "X509.h"
-#include "Event.h"
-#include "Reporter.h"
-
-#include "types.bif.h"
-#include "ocsp_events.bif.h"
-
-#include "file_analysis/File.h"
-#include "file_analysis/Manager.h"
-
 #include <openssl/x509.h>
 #include <openssl/x509v3.h>
 #include <openssl/asn1.h>
 #include <openssl/opensslconf.h>
 
-#include "file_analysis/analyzer/x509/X509.h"
+#include "zeek/file_analysis/analyzer/x509/X509.h"
+#include "zeek/Event.h"
+#include "zeek/Reporter.h"
+#include "zeek/file_analysis/File.h"
+#include "zeek/file_analysis/Manager.h"
+
+#include "file_analysis/analyzer/x509/types.bif.h"
+#include "file_analysis/analyzer/x509/ocsp_events.bif.h"
 
 // helper function of sk_X509_value to avoid namespace problem
 // sk_X509_value(X,Y) = > SKM_sk_value(X509,X,Y)
diff --git a/src/file_analysis/analyzer/x509/OCSP.h b/src/file_analysis/analyzer/x509/OCSP.h
index 56da14c1a6..8e12228c9c 100644
--- a/src/file_analysis/analyzer/x509/OCSP.h
+++ b/src/file_analysis/analyzer/x509/OCSP.h
@@ -5,7 +5,7 @@
 #include <string>
 #include <openssl/ocsp.h>
 
-#include "X509Common.h"
+#include "zeek/file_analysis/analyzer/x509/X509Common.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(File, zeek, file_analysis);
 
diff --git a/src/file_analysis/analyzer/x509/Plugin.cc b/src/file_analysis/analyzer/x509/Plugin.cc
index 4b6ac5a52e..ca43580e5d 100644
--- a/src/file_analysis/analyzer/x509/Plugin.cc
+++ b/src/file_analysis/analyzer/x509/Plugin.cc
@@ -1,9 +1,9 @@
 // See the file  in the main distribution directory for copyright.
 
-#include "X509.h"
-#include "OCSP.h"
-#include "plugin/Plugin.h"
-#include "file_analysis/Component.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/file_analysis/Component.h"
+#include "zeek/file_analysis/analyzer/x509/X509.h"
+#include "zeek/file_analysis/analyzer/x509/OCSP.h"
 
 namespace zeek::plugin::detail::Zeek_X509 {
 
diff --git a/src/file_analysis/analyzer/x509/X509.cc b/src/file_analysis/analyzer/x509/X509.cc
index 63a0c7055f..47a8a4a14c 100644
--- a/src/file_analysis/analyzer/x509/X509.cc
+++ b/src/file_analysis/analyzer/x509/X509.cc
@@ -1,16 +1,9 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
+#include "zeek/file_analysis/analyzer/x509/X509.h"
+
 #include <string>
 
-#include "X509.h"
-#include "Event.h"
-
-#include "events.bif.h"
-#include "types.bif.h"
-
-#include "file_analysis/File.h"
-#include "file_analysis/Manager.h"
-
 #include <broker/error.hh>
 #include <broker/expected.hh>
 #include <broker/data.hh>
@@ -21,6 +14,13 @@
 #include <openssl/opensslconf.h>
 #include <openssl/err.h>
 
+#include "zeek/Event.h"
+#include "zeek/file_analysis/File.h"
+#include "zeek/file_analysis/Manager.h"
+
+#include "file_analysis/analyzer/x509/events.bif.h"
+#include "file_analysis/analyzer/x509/types.bif.h"
+
 namespace zeek::file_analysis::detail {
 
 X509::X509(RecordValPtr args, file_analysis::File* file)
diff --git a/src/file_analysis/analyzer/x509/X509.h b/src/file_analysis/analyzer/x509/X509.h
index f1874f6534..630df300e0 100644
--- a/src/file_analysis/analyzer/x509/X509.h
+++ b/src/file_analysis/analyzer/x509/X509.h
@@ -5,9 +5,9 @@
 #include <string>
 #include <map>
 
-#include "OpaqueVal.h"
-#include "X509Common.h"
-#include "Func.h"
+#include "zeek/OpaqueVal.h"
+#include "zeek/file_analysis/analyzer/x509/X509Common.h"
+#include "zeek/Func.h"
 
 #if ( OPENSSL_VERSION_NUMBER < 0x10002000L ) || defined(LIBRESSL_VERSION_NUMBER)
 
diff --git a/src/file_analysis/analyzer/x509/X509Common.cc b/src/file_analysis/analyzer/x509/X509Common.cc
index c5ff0badd5..71bd69be59 100644
--- a/src/file_analysis/analyzer/x509/X509Common.cc
+++ b/src/file_analysis/analyzer/x509/X509Common.cc
@@ -1,12 +1,6 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "X509Common.h"
-#include "x509-extension_pac.h"
-#include "Reporter.h"
-
-#include "events.bif.h"
-#include "ocsp_events.bif.h"
-#include "types.bif.h"
+#include "zeek/file_analysis/analyzer/x509/X509Common.h"
 
 #include <openssl/x509.h>
 #include <openssl/x509v3.h>
@@ -14,6 +8,13 @@
 #include <openssl/opensslconf.h>
 #include <openssl/err.h>
 
+#include "zeek/Reporter.h"
+
+#include "file_analysis/analyzer/x509/x509-extension_pac.h"
+#include "file_analysis/analyzer/x509/events.bif.h"
+#include "file_analysis/analyzer/x509/ocsp_events.bif.h"
+#include "file_analysis/analyzer/x509/types.bif.h"
+
 namespace zeek::file_analysis::detail {
 
 X509Common::X509Common(const file_analysis::Tag& arg_tag,
diff --git a/src/file_analysis/analyzer/x509/X509Common.h b/src/file_analysis/analyzer/x509/X509Common.h
index fe51446094..db1f4ea79b 100644
--- a/src/file_analysis/analyzer/x509/X509Common.h
+++ b/src/file_analysis/analyzer/x509/X509Common.h
@@ -5,11 +5,11 @@
 
 #pragma once
 
-#include "file_analysis/Analyzer.h"
-
 #include <openssl/x509.h>
 #include <openssl/asn1.h>
 
+#include "zeek/file_analysis/Analyzer.h"
+
 ZEEK_FORWARD_DECLARE_NAMESPACED(EventHandlerPtr, zeek);
 ZEEK_FORWARD_DECLARE_NAMESPACED(Reporter, zeek);
 ZEEK_FORWARD_DECLARE_NAMESPACED(StringVal, zeek);
diff --git a/src/file_analysis/analyzer/x509/functions.bif b/src/file_analysis/analyzer/x509/functions.bif
index b6cdfab0b8..21916c02f3 100644
--- a/src/file_analysis/analyzer/x509/functions.bif
+++ b/src/file_analysis/analyzer/x509/functions.bif
@@ -1,8 +1,4 @@
 %%{
-#include "file_analysis/analyzer/x509/X509.h"
-#include "types.bif.h"
-#include "net_util.h"
-
 #include <openssl/x509.h>
 #include <openssl/asn1.h>
 #include <openssl/x509_vfy.h>
@@ -10,6 +6,11 @@
 #include <openssl/pem.h>
 #include <openssl/err.h>
 
+#include "zeek/file_analysis/analyzer/x509/X509.h"
+#include "zeek/net_util.h"
+
+#include "file_analysis/analyzer/x509/types.bif.h"
+
 // construct an error record
 static zeek::RecordValPtr x509_result_record(uint64_t num, const char* reason, zeek::ValPtr chainVector = nullptr)
 	{
diff --git a/src/file_analysis/analyzer/x509/x509-extension.pac b/src/file_analysis/analyzer/x509/x509-extension.pac
index 6a48932e88..b98e6a31b2 100644
--- a/src/file_analysis/analyzer/x509/x509-extension.pac
+++ b/src/file_analysis/analyzer/x509/x509-extension.pac
@@ -5,9 +5,10 @@
 %include zeek.pac
 
 %extern{
-#include "types.bif.h"
-#include "file_analysis/File.h"
-#include "events.bif.h"
+#include "zeek/file_analysis/File.h"
+
+#include "file_analysis/analyzer/x509/types.bif.h"
+#include "file_analysis/analyzer/x509/events.bif.h"
 %}
 
 analyzer X509Extension withcontext {
diff --git a/src/file_analysis/file_analysis.bif b/src/file_analysis/file_analysis.bif
index 2dae1e1856..0c609e80b1 100644
--- a/src/file_analysis/file_analysis.bif
+++ b/src/file_analysis/file_analysis.bif
@@ -3,9 +3,9 @@
 module Files;
 
 %%{
-#include "file_analysis/Manager.h"
-#include "file_analysis/File.h"
-#include "Reporter.h"
+#include "zeek/file_analysis/Manager.h"
+#include "zeek/file_analysis/File.h"
+#include "zeek/Reporter.h"
 %%}
 
 type AnalyzerArgs: record;
diff --git a/src/fuzzers/FuzzBuffer.cc b/src/fuzzers/FuzzBuffer.cc
index 5a2ae4573c..529a459b34 100644
--- a/src/fuzzers/FuzzBuffer.cc
+++ b/src/fuzzers/FuzzBuffer.cc
@@ -4,7 +4,7 @@
 
 #include <string.h>
 
-#include "FuzzBuffer.h"
+#include "zeek/fuzzers/FuzzBuffer.h"
 
 namespace zeek::detail {
 
diff --git a/src/fuzzers/fuzzer-setup.h b/src/fuzzers/fuzzer-setup.h
index b463d81ff7..7e90a1542d 100644
--- a/src/fuzzers/fuzzer-setup.h
+++ b/src/fuzzers/fuzzer-setup.h
@@ -3,12 +3,12 @@
 #include <unistd.h>
 #include <cstdlib>
 
-#include "zeek-setup.h"
+#include "zeek/zeek-setup.h"
 
-#include "Event.h"
-#include "Sessions.h"
-#include "broker/Manager.h"
-#include "file_analysis/Manager.h"
+#include "zeek/Event.h"
+#include "zeek/Sessions.h"
+#include "zeek/broker/Manager.h"
+#include "zeek/file_analysis/Manager.h"
 
 extern "C" int LLVMFuzzerInitialize(int* argc, char*** argv)
 	{
diff --git a/src/fuzzers/packet-fuzzer.cc b/src/fuzzers/packet-fuzzer.cc
index e0c5590b86..c7837ab3f9 100644
--- a/src/fuzzers/packet-fuzzer.cc
+++ b/src/fuzzers/packet-fuzzer.cc
@@ -1,16 +1,16 @@
-#include "binpac.h"
-
-#include "iosource/Packet.h"
-#include "Event.h"
-#include "packet_analysis/Manager.h"
-
-#include "FuzzBuffer.h"
-#include "fuzzer-setup.h"
-
 extern "C" {
 #include <pcap.h>
 }
 
+#include <binpac.h>
+
+#include "zeek/iosource/Packet.h"
+#include "zeek/Event.h"
+#include "zeek/packet_analysis/Manager.h"
+
+#include "zeek/fuzzers/FuzzBuffer.h"
+#include "zeek/fuzzers/fuzzer-setup.h"
+
 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
 	{
 	zeek::detail::FuzzBuffer fb{data, size};
diff --git a/src/fuzzers/pop3-fuzzer.cc b/src/fuzzers/pop3-fuzzer.cc
index 10aae22a08..55bf9f4735 100644
--- a/src/fuzzers/pop3-fuzzer.cc
+++ b/src/fuzzers/pop3-fuzzer.cc
@@ -1,15 +1,15 @@
-#include "binpac.h"
+#include <binpac.h>
 
-#include "RunState.h"
-#include "Conn.h"
-#include "Sessions.h"
-#include "analyzer/Analyzer.h"
-#include "analyzer/Manager.h"
-#include "analyzer/protocol/pia/PIA.h"
-#include "analyzer/protocol/tcp/TCP.h"
+#include "zeek/RunState.h"
+#include "zeek/Conn.h"
+#include "zeek/Sessions.h"
+#include "zeek/analyzer/Analyzer.h"
+#include "zeek/analyzer/Manager.h"
+#include "zeek/analyzer/protocol/pia/PIA.h"
+#include "zeek/analyzer/protocol/tcp/TCP.h"
 
-#include "FuzzBuffer.h"
-#include "fuzzer-setup.h"
+#include "zeek/fuzzers/FuzzBuffer.h"
+#include "zeek/fuzzers/fuzzer-setup.h"
 
 static constexpr auto ZEEK_FUZZ_ANALYZER = "pop3";
 
diff --git a/src/in_cksum.cc b/src/in_cksum.cc
index 63688fc9d6..40f00d9134 100644
--- a/src/in_cksum.cc
+++ b/src/in_cksum.cc
@@ -38,7 +38,7 @@
  *	@(#)in_cksum.c	8.1 (Berkeley) 6/10/93
  */
 
-#include "net_util.h"
+#include "zeek/net_util.h"
 
 namespace zeek::detail {
 
diff --git a/src/input.h b/src/input.h
index 616800e2f6..3d9f06b53d 100644
--- a/src/input.h
+++ b/src/input.h
@@ -5,7 +5,7 @@
 #include <vector>
 #include <string>
 
-#include "ZeekList.h"
+#include "zeek/ZeekList.h"
 
 // These are required by the lexer in scan.l and are intentionally not namespaced.
 extern int yyparse();
diff --git a/src/input/Component.cc b/src/input/Component.cc
index 6ec6eb4c79..a5d0b77cbc 100644
--- a/src/input/Component.cc
+++ b/src/input/Component.cc
@@ -1,10 +1,10 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "Component.h"
-#include "Manager.h"
+#include "zeek/input/Component.h"
+#include "zeek/input/Manager.h"
 
-#include "../Desc.h"
-#include "../util.h"
+#include "zeek/Desc.h"
+#include "zeek/util.h"
 
 namespace zeek::input {
 
diff --git a/src/input/Component.h b/src/input/Component.h
index 189a3eaef2..9fc4041998 100644
--- a/src/input/Component.h
+++ b/src/input/Component.h
@@ -2,9 +2,9 @@
 
 #pragma once
 
-#include "Tag.h"
-#include "plugin/Component.h"
-#include "plugin/TaggedComponent.h"
+#include "zeek/plugin/Component.h"
+#include "zeek/plugin/TaggedComponent.h"
+#include "zeek/input/Tag.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(ReaderFrontend, zeek, input);
 ZEEK_FORWARD_DECLARE_NAMESPACED(ReaderBackend, zeek, input);
diff --git a/src/input/Manager.cc b/src/input/Manager.cc
index d9347ada17..27b47491eb 100644
--- a/src/input/Manager.cc
+++ b/src/input/Manager.cc
@@ -1,26 +1,27 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "Manager.h"
+#include "zeek/input/Manager.h"
 
 #include <string>
 #include <utility>
 
-#include "ReaderFrontend.h"
-#include "ReaderBackend.h"
-#include "Desc.h"
-#include "module_util.h"
-#include "input.bif.h"
+#include "zeek/input/ReaderFrontend.h"
+#include "zeek/input/ReaderBackend.h"
+#include "zeek/Desc.h"
+#include "zeek/module_util.h"
 
-#include "Expr.h"
-#include "Event.h"
-#include "EventHandler.h"
-#include "NetVar.h"
-#include "RunState.h"
-#include "CompHash.h"
-#include "Func.h"
+#include "zeek/Expr.h"
+#include "zeek/Event.h"
+#include "zeek/EventHandler.h"
+#include "zeek/NetVar.h"
+#include "zeek/RunState.h"
+#include "zeek/CompHash.h"
+#include "zeek/Func.h"
 
-#include "../file_analysis/Manager.h"
-#include "../threading/SerialTypes.h"
+#include "zeek/file_analysis/Manager.h"
+#include "zeek/threading/SerialTypes.h"
+
+#include "input/input.bif.h"
 
 using namespace std;
 using zeek::threading::Value;
diff --git a/src/input/Manager.h b/src/input/Manager.h
index 232c85b2b6..9a7d7ffb68 100644
--- a/src/input/Manager.h
+++ b/src/input/Manager.h
@@ -6,11 +6,11 @@
 
 #include <map>
 
-#include "Component.h"
-#include "EventHandler.h"
-#include "plugin/ComponentManager.h"
-#include "threading/SerialTypes.h"
-#include "Tag.h"
+#include "zeek/input/Component.h"
+#include "zeek/EventHandler.h"
+#include "zeek/plugin/ComponentManager.h"
+#include "zeek/threading/SerialTypes.h"
+#include "zeek/input/Tag.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(RecordVal, zeek);
 ZEEK_FORWARD_DECLARE_NAMESPACED(ReaderFrontend, zeek, input);
diff --git a/src/input/ReaderBackend.cc b/src/input/ReaderBackend.cc
index 1e05210877..c7a44d6565 100644
--- a/src/input/ReaderBackend.cc
+++ b/src/input/ReaderBackend.cc
@@ -1,8 +1,8 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "ReaderBackend.h"
-#include "ReaderFrontend.h"
-#include "Manager.h"
+#include "zeek/input/ReaderBackend.h"
+#include "zeek/input/ReaderFrontend.h"
+#include "zeek/input/Manager.h"
 
 using zeek::threading::Value;
 using zeek::threading::Field;
diff --git a/src/input/ReaderBackend.h b/src/input/ReaderBackend.h
index bf9adefc99..e0cc0e4a6d 100644
--- a/src/input/ReaderBackend.h
+++ b/src/input/ReaderBackend.h
@@ -2,12 +2,12 @@
 
 #pragma once
 
-#include "ZeekString.h"
+#include "zeek/ZeekString.h"
 
-#include "threading/SerialTypes.h"
-#include "threading/MsgThread.h"
+#include "zeek/threading/SerialTypes.h"
+#include "zeek/threading/MsgThread.h"
 
-#include "Component.h"
+#include "zeek/input/Component.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(ReaderFrontend, zeek::input);
 
diff --git a/src/input/ReaderFrontend.cc b/src/input/ReaderFrontend.cc
index 53b14a04eb..7e87d4b52f 100644
--- a/src/input/ReaderFrontend.cc
+++ b/src/input/ReaderFrontend.cc
@@ -1,8 +1,9 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "Manager.h"
-#include "ReaderFrontend.h"
-#include "ReaderBackend.h"
+#include "zeek/input/ReaderFrontend.h"
+
+#include "zeek/input/Manager.h"
+#include "zeek/input/ReaderBackend.h"
 
 namespace zeek::input {
 
diff --git a/src/input/ReaderFrontend.h b/src/input/ReaderFrontend.h
index 007f60bbc3..a86a0550de 100644
--- a/src/input/ReaderFrontend.h
+++ b/src/input/ReaderFrontend.h
@@ -2,8 +2,8 @@
 
 #pragma once
 
-#include "ReaderBackend.h"
-#include "threading/SerialTypes.h"
+#include "zeek/input/ReaderBackend.h"
+#include "zeek/threading/SerialTypes.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(EnumVal, zeek);
 ZEEK_FORWARD_DECLARE_NAMESPACED(Manager, zeek, input);
diff --git a/src/input/Tag.cc b/src/input/Tag.cc
index cd5d21652b..63998e1523 100644
--- a/src/input/Tag.cc
+++ b/src/input/Tag.cc
@@ -1,7 +1,7 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "Tag.h"
-#include "Manager.h"
+#include "zeek/input/Tag.h"
+#include "zeek/input/Manager.h"
 
 namespace zeek::input {
 
diff --git a/src/input/Tag.h b/src/input/Tag.h
index 69a5f4373c..60e13d1530 100644
--- a/src/input/Tag.h
+++ b/src/input/Tag.h
@@ -3,7 +3,7 @@
 #pragma once
 
 #include "zeek-config.h"
-#include "../Tag.h"
+#include "zeek/Tag.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(EnumVal, zeek);
 
diff --git a/src/input/input.bif b/src/input/input.bif
index 990e68a475..41af1389c7 100644
--- a/src/input/input.bif
+++ b/src/input/input.bif
@@ -3,7 +3,7 @@
 module Input;
 
 %%{
-#include "input/Manager.h"
+#include "zeek/input/Manager.h"
 %%}
 
 enum Event %{
diff --git a/src/input/readers/ascii/Ascii.cc b/src/input/readers/ascii/Ascii.cc
index df7aedac83..330cbc9f5a 100644
--- a/src/input/readers/ascii/Ascii.cc
+++ b/src/input/readers/ascii/Ascii.cc
@@ -1,16 +1,16 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include <sstream>
+#include "zeek/input/readers/ascii/Ascii.h"
 
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <unistd.h>
 #include <errno.h>
+#include <sstream>
 
-#include "Ascii.h"
-#include "ascii.bif.h"
+#include "zeek/threading/SerialTypes.h"
 
-#include "threading/SerialTypes.h"
+#include "input/readers/ascii/ascii.bif.h"
 
 using namespace std;
 using zeek::threading::Value;
diff --git a/src/input/readers/ascii/Ascii.h b/src/input/readers/ascii/Ascii.h
index 7a225a469c..fb65ee267c 100644
--- a/src/input/readers/ascii/Ascii.h
+++ b/src/input/readers/ascii/Ascii.h
@@ -2,14 +2,14 @@
 
 #pragma once
 
+#include <sys/types.h>
 #include <iostream>
 #include <vector>
 #include <fstream>
 #include <memory>
-#include <sys/types.h>
 
-#include "input/ReaderBackend.h"
-#include "threading/formatters/Ascii.h"
+#include "zeek/input/ReaderBackend.h"
+#include "zeek/threading/formatters/Ascii.h"
 
 namespace zeek::input::reader::detail {
 
diff --git a/src/input/readers/ascii/Plugin.cc b/src/input/readers/ascii/Plugin.cc
index 0078a8ebd0..2075bc2994 100644
--- a/src/input/readers/ascii/Plugin.cc
+++ b/src/input/readers/ascii/Plugin.cc
@@ -1,8 +1,7 @@
 // See the file  in the main distribution directory for copyright.
 
-#include "plugin/Plugin.h"
-
-#include "Ascii.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/input/readers/ascii/Ascii.h"
 
 namespace zeek::plugin::detail::Zeek_AsciiReader {
 
diff --git a/src/input/readers/benchmark/Benchmark.cc b/src/input/readers/benchmark/Benchmark.cc
index 5e0d8b2ecf..1cd2b2c6da 100644
--- a/src/input/readers/benchmark/Benchmark.cc
+++ b/src/input/readers/benchmark/Benchmark.cc
@@ -1,15 +1,16 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
+#include "zeek/input/readers/benchmark/Benchmark.h"
+
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <unistd.h>
 #include <errno.h>
 
-#include "Benchmark.h"
-#include "benchmark.bif.h"
+#include "zeek/threading/SerialTypes.h"
+#include "zeek/threading/Manager.h"
 
-#include "threading/SerialTypes.h"
-#include "threading/Manager.h"
+#include "input/readers/benchmark/benchmark.bif.h"
 
 using threading::Value;
 using threading::Field;
diff --git a/src/input/readers/benchmark/Benchmark.h b/src/input/readers/benchmark/Benchmark.h
index 996fa5a15e..16d4aa0e82 100644
--- a/src/input/readers/benchmark/Benchmark.h
+++ b/src/input/readers/benchmark/Benchmark.h
@@ -2,8 +2,8 @@
 
 #pragma once
 
-#include "input/ReaderBackend.h"
-#include "threading/formatters/Ascii.h"
+#include "zeek/input/ReaderBackend.h"
+#include "zeek/threading/formatters/Ascii.h"
 
 namespace zeek::input::reader::detail {
 
diff --git a/src/input/readers/benchmark/Plugin.cc b/src/input/readers/benchmark/Plugin.cc
index acf251f0b5..6af26a3b46 100644
--- a/src/input/readers/benchmark/Plugin.cc
+++ b/src/input/readers/benchmark/Plugin.cc
@@ -1,8 +1,7 @@
 // See the file  in the main distribution directory for copyright.
 
-#include "plugin/Plugin.h"
-
-#include "Benchmark.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/input/readers/benchmark/Benchmark.h"
 
 namespace zeek::plugin::detail::Zeek_BenchmarkReader {
 
diff --git a/src/input/readers/binary/Binary.cc b/src/input/readers/binary/Binary.cc
index 8fbab7b804..6c77cd0c85 100644
--- a/src/input/readers/binary/Binary.cc
+++ b/src/input/readers/binary/Binary.cc
@@ -1,11 +1,12 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
+#include "zeek/input/readers/binary/Binary.h"
+
 #include <sys/stat.h>
 
-#include "Binary.h"
-#include "binary.bif.h"
+#include "zeek/threading/SerialTypes.h"
 
-#include "threading/SerialTypes.h"
+#include "input/readers/binary/binary.bif.h"
 
 using namespace std;
 using zeek::threading::Value;
diff --git a/src/input/readers/binary/Binary.h b/src/input/readers/binary/Binary.h
index b7b0634bf8..066b1f9ccc 100644
--- a/src/input/readers/binary/Binary.h
+++ b/src/input/readers/binary/Binary.h
@@ -5,7 +5,7 @@
 #include <fstream>
 #include <sys/types.h>
 
-#include "input/ReaderBackend.h"
+#include "zeek/input/ReaderBackend.h"
 
 namespace zeek::input::reader::detail {
 
diff --git a/src/input/readers/binary/Plugin.cc b/src/input/readers/binary/Plugin.cc
index 765f52d4dc..50ddc9fd5b 100644
--- a/src/input/readers/binary/Plugin.cc
+++ b/src/input/readers/binary/Plugin.cc
@@ -1,8 +1,7 @@
 // See the file  in the main distribution directory for copyright.
 
-#include "plugin/Plugin.h"
-
-#include "Binary.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/input/readers/binary/Binary.h"
 
 namespace zeek::plugin::detail::Zeek_BinaryReader {
 
diff --git a/src/input/readers/config/Config.cc b/src/input/readers/config/Config.cc
index c8fc68fe52..0a3d33811c 100644
--- a/src/input/readers/config/Config.cc
+++ b/src/input/readers/config/Config.cc
@@ -1,19 +1,19 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include <sstream>
-#include <unordered_set>
+#include "zeek/input/readers/config/Config.h"
 
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <unistd.h>
 #include <errno.h>
 #include <regex.h>
+#include <sstream>
+#include <unordered_set>
 
-#include "Config.h"
-#include "config.bif.h"
+#include "zeek/input/Manager.h"
+#include "zeek/threading/SerialTypes.h"
 
-#include "input/Manager.h"
-#include "threading/SerialTypes.h"
+#include "input/readers/config/config.bif.h"
 
 using zeek::threading::Value;
 using zeek::threading::Field;
diff --git a/src/input/readers/config/Config.h b/src/input/readers/config/Config.h
index 42d4a90bab..c8e8360ccd 100644
--- a/src/input/readers/config/Config.h
+++ b/src/input/readers/config/Config.h
@@ -2,15 +2,15 @@
 
 #pragma once
 
+#include <sys/types.h>
 #include <iostream>
 #include <vector>
 #include <fstream>
 #include <memory>
 #include <unordered_map>
-#include <sys/types.h>
 
-#include "input/ReaderBackend.h"
-#include "threading/formatters/Ascii.h"
+#include "zeek/input/ReaderBackend.h"
+#include "zeek/threading/formatters/Ascii.h"
 
 namespace zeek::input::reader::detail {
 
diff --git a/src/input/readers/config/Plugin.cc b/src/input/readers/config/Plugin.cc
index 34128f2d01..54fb3a1868 100644
--- a/src/input/readers/config/Plugin.cc
+++ b/src/input/readers/config/Plugin.cc
@@ -1,8 +1,7 @@
 // See the file  in the main distribution directory for copyright.
 
-#include "plugin/Plugin.h"
-
-#include "Config.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/input/readers/config/Config.h"
 
 namespace zeek::plugin::detail::Zeek_ConfigReader {
 
diff --git a/src/input/readers/raw/Plugin.cc b/src/input/readers/raw/Plugin.cc
index 6e48208b1f..df5e5978d2 100644
--- a/src/input/readers/raw/Plugin.cc
+++ b/src/input/readers/raw/Plugin.cc
@@ -1,6 +1,6 @@
 // See the file  in the main distribution directory for copyright.
 
-#include "Plugin.h"
+#include "zeek/input/readers/raw/Plugin.h"
 
 namespace zeek::plugin::detail::Zeek_RawReader {
 
diff --git a/src/input/readers/raw/Plugin.h b/src/input/readers/raw/Plugin.h
index e35adb274f..0f7161ebe6 100644
--- a/src/input/readers/raw/Plugin.h
+++ b/src/input/readers/raw/Plugin.h
@@ -4,9 +4,8 @@
 
 #include <mutex>
 
-#include "plugin/Plugin.h"
-
-#include "Raw.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/input/readers/raw/Raw.h"
 
 namespace zeek::plugin::detail::Zeek_RawReader {
 
diff --git a/src/input/readers/raw/Raw.cc b/src/input/readers/raw/Raw.cc
index 06616d28cb..230b233e49 100644
--- a/src/input/readers/raw/Raw.cc
+++ b/src/input/readers/raw/Raw.cc
@@ -1,5 +1,7 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
+#include "zeek/input/readers/raw/Raw.h"
+
 #include <sys/types.h>
 #include <sys/wait.h>
 #include <sys/stat.h>
@@ -10,14 +12,13 @@
 #include <signal.h>
 #include <stdlib.h>
 
-#include "Raw.h"
-#include "Plugin.h"
-#include "raw.bif.h"
+#include "zeek/input/readers/raw/Plugin.h"
+#include "zeek/threading/SerialTypes.h"
 
-#include "threading/SerialTypes.h"
+#include "input/readers/raw/raw.bif.h"
 
 extern "C" {
-#include "setsignal.h"
+#include "zeek/setsignal.h"
 }
 
 using zeek::threading::Value;
diff --git a/src/input/readers/raw/Raw.h b/src/input/readers/raw/Raw.h
index 25b57571c0..041be97dbd 100644
--- a/src/input/readers/raw/Raw.h
+++ b/src/input/readers/raw/Raw.h
@@ -2,12 +2,12 @@
 
 #pragma once
 
+#include <sys/types.h>
 #include <vector>
 #include <memory>
 #include <mutex>
-#include <sys/types.h>
 
-#include "input/ReaderBackend.h"
+#include "zeek/input/ReaderBackend.h"
 
 namespace zeek::input::reader::detail {
 
diff --git a/src/input/readers/sqlite/Plugin.cc b/src/input/readers/sqlite/Plugin.cc
index a5bb1a91a8..3c79d850ae 100644
--- a/src/input/readers/sqlite/Plugin.cc
+++ b/src/input/readers/sqlite/Plugin.cc
@@ -1,8 +1,7 @@
 // See the file  in the main distribution directory for copyright.
 
-#include "plugin/Plugin.h"
-
-#include "SQLite.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/input/readers/sqlite/SQLite.h"
 
 namespace zeek::plugin::detail::Zeek_SQLiteReader {
 
diff --git a/src/input/readers/sqlite/SQLite.cc b/src/input/readers/sqlite/SQLite.cc
index 702b54ef7e..93578c32f6 100644
--- a/src/input/readers/sqlite/SQLite.cc
+++ b/src/input/readers/sqlite/SQLite.cc
@@ -1,20 +1,20 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
+#include "zeek/input/readers/sqlite/SQLite.h"
 
-#include <fstream>
-#include <sstream>
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <unistd.h>
+#include <fstream>
+#include <sstream>
 
-#include "SQLite.h"
-#include "sqlite.bif.h"
+#include "zeek/threading/SerialTypes.h"
+
+#include "input/readers/sqlite/sqlite.bif.h"
 #include "logging/writers/sqlite/sqlite.bif.h"
 #include "logging/writers/ascii/ascii.bif.h"
 
-#include "threading/SerialTypes.h"
-
 using zeek::threading::Value;
 using zeek::threading::Field;
 
diff --git a/src/input/readers/sqlite/SQLite.h b/src/input/readers/sqlite/SQLite.h
index 810dc41ad9..705a9351a2 100644
--- a/src/input/readers/sqlite/SQLite.h
+++ b/src/input/readers/sqlite/SQLite.h
@@ -6,10 +6,10 @@
 
 #include <iostream>
 #include <vector>
+#include "zeek/3rdparty/sqlite3.h"
 
-#include "input/ReaderBackend.h"
-#include "threading/formatters/Ascii.h"
-#include "3rdparty/sqlite3.h"
+#include "zeek/input/ReaderBackend.h"
+#include "zeek/threading/formatters/Ascii.h"
 
 namespace zeek::input::reader::detail {
 
diff --git a/src/iosource/BPF_Program.cc b/src/iosource/BPF_Program.cc
index 993b95ed6d..65a47185b0 100644
--- a/src/iosource/BPF_Program.cc
+++ b/src/iosource/BPF_Program.cc
@@ -1,14 +1,13 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
-
-#include "BPF_Program.h"
+#include "zeek/iosource/BPF_Program.h"
 
 #include <string.h>
 
 #ifdef DONT_HAVE_LIBPCAP_PCAP_FREECODE
 extern "C" {
-#include "pcap-int.h"
+#include <pcap-int.h>
 
 int pcap_freecode(pcap_t* unused, struct bpf_program* program)
 	{
diff --git a/src/iosource/BPF_Program.h b/src/iosource/BPF_Program.h
index f19909f1ad..dee7f46918 100644
--- a/src/iosource/BPF_Program.h
+++ b/src/iosource/BPF_Program.h
@@ -2,12 +2,12 @@
 
 #pragma once
 
+#include <stdint.h>
+
 extern "C" {
 #include <pcap.h>
 }
 
-#include <stdint.h>
-
 namespace zeek::iosource::detail {
 
 // BPF_Programs are an abstraction around struct bpf_program,
diff --git a/src/iosource/Component.cc b/src/iosource/Component.cc
index bfacdc5699..6dededde9c 100644
--- a/src/iosource/Component.cc
+++ b/src/iosource/Component.cc
@@ -1,9 +1,9 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "Component.h"
+#include "zeek/iosource/Component.h"
 
-#include "Desc.h"
-#include "Reporter.h"
+#include "zeek/Desc.h"
+#include "zeek/Reporter.h"
 
 namespace zeek::iosource {
 
diff --git a/src/iosource/Component.h b/src/iosource/Component.h
index 5f37e79dc8..4564488fd3 100644
--- a/src/iosource/Component.h
+++ b/src/iosource/Component.h
@@ -5,7 +5,7 @@
 #include <string>
 #include <vector>
 
-#include "plugin/Component.h"
+#include "zeek/plugin/Component.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(IOSource, zeek, iosource);
 ZEEK_FORWARD_DECLARE_NAMESPACED(PktSrc, zeek, iosource);
diff --git a/src/iosource/Manager.cc b/src/iosource/Manager.cc
index 93edafbc8d..6c6a5eb258 100644
--- a/src/iosource/Manager.cc
+++ b/src/iosource/Manager.cc
@@ -1,22 +1,22 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
+#include "zeek/iosource/Manager.h"
+
 #include <sys/types.h>
 #include <sys/event.h>
 #include <sys/time.h>
 #include <unistd.h>
 #include <assert.h>
 
-#include "Manager.h"
-#include "Component.h"
-#include "IOSource.h"
-#include "RunState.h"
-#include "PktSrc.h"
-#include "PktDumper.h"
-#include "plugin/Manager.h"
-#include "broker/Manager.h"
-#include "NetVar.h"
-
-#include "util.h"
+#include "zeek/iosource/Component.h"
+#include "zeek/iosource/IOSource.h"
+#include "zeek/iosource/PktSrc.h"
+#include "zeek/iosource/PktDumper.h"
+#include "zeek/plugin/Manager.h"
+#include "zeek/broker/Manager.h"
+#include "zeek/NetVar.h"
+#include "zeek/RunState.h"
+#include "zeek/util.h"
 
 #define DEFAULT_PREFIX "pcap"
 
diff --git a/src/iosource/Manager.h b/src/iosource/Manager.h
index 71551e99ae..2a79399960 100644
--- a/src/iosource/Manager.h
+++ b/src/iosource/Manager.h
@@ -8,8 +8,8 @@
 #include <vector>
 #include <map>
 
-#include "IOSource.h"
-#include "Flare.h"
+#include "zeek/iosource/IOSource.h"
+#include "zeek/Flare.h"
 
 struct timespec;
 struct kevent;
diff --git a/src/iosource/Packet.cc b/src/iosource/Packet.cc
index 7e45fe22de..997ef52b78 100644
--- a/src/iosource/Packet.cc
+++ b/src/iosource/Packet.cc
@@ -1,11 +1,4 @@
-#include "Packet.h"
-#include "Sessions.h"
-#include "Desc.h"
-#include "IP.h"
-#include "iosource/Manager.h"
-#include "packet_analysis/Manager.h"
-#include "Var.h"
-#include "TunnelEncapsulation.h"
+#include "zeek/iosource/Packet.h"
 
 extern "C" {
 #include <pcap.h>
@@ -21,6 +14,14 @@ extern "C" {
 #endif
 }
 
+#include "zeek/Sessions.h"
+#include "zeek/Desc.h"
+#include "zeek/IP.h"
+#include "zeek/iosource/Manager.h"
+#include "zeek/packet_analysis/Manager.h"
+#include "zeek/Var.h"
+#include "zeek/TunnelEncapsulation.h"
+
 namespace zeek {
 
 void Packet::Init(int arg_link_type, pkt_timeval *arg_ts, uint32_t arg_caplen,
diff --git a/src/iosource/Packet.h b/src/iosource/Packet.h
index ac258de84b..43e2ed1b4f 100644
--- a/src/iosource/Packet.h
+++ b/src/iosource/Packet.h
@@ -13,7 +13,8 @@ typedef struct bpf_timeval pkt_timeval;
 typedef struct timeval pkt_timeval;
 #endif
 
-#include "pcap.h" // For DLT_ constants
+#include <pcap.h> // For DLT_ constants
+
 #include "zeek/NetVar.h" // For BifEnum::Tunnel
 #include "zeek/TunnelEncapsulation.h"
 #include "zeek/IP.h"
diff --git a/src/iosource/PktDumper.cc b/src/iosource/PktDumper.cc
index 336b5f7777..952f1a279c 100644
--- a/src/iosource/PktDumper.cc
+++ b/src/iosource/PktDumper.cc
@@ -3,8 +3,8 @@
 
 #include "zeek-config.h"
 
-#include "PktDumper.h"
-#include "DebugLogger.h"
+#include "zeek/iosource/PktDumper.h"
+#include "zeek/DebugLogger.h"
 
 namespace zeek::iosource {
 
diff --git a/src/iosource/PktSrc.cc b/src/iosource/PktSrc.cc
index 82caa11a88..d6e053fa1a 100644
--- a/src/iosource/PktSrc.cc
+++ b/src/iosource/PktSrc.cc
@@ -1,20 +1,20 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
-#include "PktSrc.h"
+#include "zeek/iosource/PktSrc.h"
 
 #include <sys/stat.h>
 
-#include "util.h"
-#include "Hash.h"
-#include "RunState.h"
-#include "Sessions.h"
-#include "broker/Manager.h"
-#include "iosource/Manager.h"
-#include "packet_analysis/Manager.h"
-#include "BPF_Program.h"
+#include "zeek/util.h"
+#include "zeek/Hash.h"
+#include "zeek/RunState.h"
+#include "zeek/Sessions.h"
+#include "zeek/broker/Manager.h"
+#include "zeek/iosource/Manager.h"
+#include "zeek/packet_analysis/Manager.h"
+#include "zeek/iosource/BPF_Program.h"
 
-#include "pcap/pcap.bif.h"
+#include "iosource/pcap/pcap.bif.h"
 
 namespace zeek::iosource {
 
diff --git a/src/iosource/PktSrc.h b/src/iosource/PktSrc.h
index 127d2364c2..c8de9d866b 100644
--- a/src/iosource/PktSrc.h
+++ b/src/iosource/PktSrc.h
@@ -2,12 +2,11 @@
 
 #pragma once
 
+#include <sys/types.h> // for u_char
 #include <vector>
 
-#include "IOSource.h"
-#include "Packet.h"
-
-#include <sys/types.h> // for u_char
+#include "zeek/iosource/IOSource.h"
+#include "zeek/iosource/Packet.h"
 
 struct pcap_pkthdr;
 ZEEK_FORWARD_DECLARE_NAMESPACED(BPF_Program, zeek::iosource::detail);
diff --git a/src/iosource/pcap/Dumper.cc b/src/iosource/pcap/Dumper.cc
index b7a47756ce..e84fbef861 100644
--- a/src/iosource/pcap/Dumper.cc
+++ b/src/iosource/pcap/Dumper.cc
@@ -1,13 +1,14 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
+#include "zeek/iosource/pcap/Dumper.h"
+
 #include <sys/stat.h>
 #include <errno.h>
 
-#include "Dumper.h"
-#include "../PktSrc.h"
-#include "../../RunState.h"
+#include "zeek/iosource/PktSrc.h"
+#include "zeek/RunState.h"
 
-#include "pcap.bif.h"
+#include "iosource/pcap/pcap.bif.h"
 
 namespace zeek::iosource::pcap {
 
diff --git a/src/iosource/pcap/Dumper.h b/src/iosource/pcap/Dumper.h
index 96e2c10271..ca0088bc10 100644
--- a/src/iosource/pcap/Dumper.h
+++ b/src/iosource/pcap/Dumper.h
@@ -6,7 +6,7 @@ extern "C" {
 #include <pcap.h>
 }
 
-#include "../PktDumper.h"
+#include "zeek/iosource/PktDumper.h"
 
 namespace zeek::iosource::pcap {
 
diff --git a/src/iosource/pcap/Plugin.cc b/src/iosource/pcap/Plugin.cc
index abc0e2708b..15946c2f1b 100644
--- a/src/iosource/pcap/Plugin.cc
+++ b/src/iosource/pcap/Plugin.cc
@@ -1,9 +1,9 @@
 // See the file  in the main distribution directory for copyright.
 
-#include "Source.h"
-#include "Dumper.h"
-#include "plugin/Plugin.h"
-#include "iosource/Component.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/iosource/Component.h"
+#include "zeek/iosource/pcap/Source.h"
+#include "zeek/iosource/pcap/Dumper.h"
 
 namespace zeek::plugin::detail::Zeek_Pcap {
 
diff --git a/src/iosource/pcap/Source.cc b/src/iosource/pcap/Source.cc
index 769b12ecdb..3f6fc9d777 100644
--- a/src/iosource/pcap/Source.cc
+++ b/src/iosource/pcap/Source.cc
@@ -1,19 +1,18 @@
 // See the file  in the main distribution directory for copyright.
 
 #include "zeek-config.h"
-
-#include "Source.h"
-#include "iosource/Packet.h"
-#include "iosource/BPF_Program.h"
-
-#include "Event.h"
-
-#include "pcap.bif.h"
+#include "zeek/iosource/pcap/Source.h"
 
 #ifdef HAVE_PCAP_INT_H
 #include <pcap-int.h>
 #endif
 
+#include "zeek/iosource/Packet.h"
+#include "zeek/iosource/BPF_Program.h"
+#include "zeek/Event.h"
+
+#include "iosource/pcap/pcap.bif.h"
+
 namespace zeek::iosource::pcap {
 
 PcapSource::~PcapSource()
diff --git a/src/iosource/pcap/Source.h b/src/iosource/pcap/Source.h
index e3b9944b42..5340ba36f8 100644
--- a/src/iosource/pcap/Source.h
+++ b/src/iosource/pcap/Source.h
@@ -2,13 +2,13 @@
 
 #pragma once
 
-#include "../PktSrc.h"
+#include <sys/types.h> // for u_char
 
 extern "C" {
 #include <pcap.h>
 }
 
-#include <sys/types.h> // for u_char
+#include "zeek/iosource/PktSrc.h"
 
 namespace zeek::iosource::pcap {
 
diff --git a/src/iosource/pcap/pcap.bif b/src/iosource/pcap/pcap.bif
index c37416c968..0201cd4bbd 100644
--- a/src/iosource/pcap/pcap.bif
+++ b/src/iosource/pcap/pcap.bif
@@ -6,9 +6,9 @@ const snaplen: count;
 const bufsize: count;
 
 %%{
-#include "pcap.h"
+#include <pcap.h>
 
-#include "iosource/Manager.h"
+#include "zeek/iosource/Manager.h"
 %%}
 
 ## Precompiles a PCAP filter and binds it to a given identifier.
diff --git a/src/legacy-netvar-init.cc b/src/legacy-netvar-init.cc
index e83e452e56..e9cc1eaa80 100644
--- a/src/legacy-netvar-init.cc
+++ b/src/legacy-netvar-init.cc
@@ -1,8 +1,7 @@
-
-#include "NetVar.h"
-#include "Var.h"
-#include "ID.h"
-#include "Scope.h"
+#include "zeek/NetVar.h"
+#include "zeek/Var.h"
+#include "zeek/ID.h"
+#include "zeek/Scope.h"
 
 namespace zeek::detail {
 
diff --git a/src/logging/Component.cc b/src/logging/Component.cc
index f700f18b64..40558339af 100644
--- a/src/logging/Component.cc
+++ b/src/logging/Component.cc
@@ -1,9 +1,9 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "Component.h"
-#include "Manager.h"
-#include "../Desc.h"
-#include "../util.h"
+#include "zeek/logging/Component.h"
+#include "zeek/logging/Manager.h"
+#include "zeek/Desc.h"
+#include "zeek/util.h"
 
 namespace zeek::logging {
 
diff --git a/src/logging/Component.h b/src/logging/Component.h
index 0856a883d8..1afc5847bb 100644
--- a/src/logging/Component.h
+++ b/src/logging/Component.h
@@ -2,9 +2,9 @@
 
 #pragma once
 
-#include "Tag.h"
-#include "plugin/Component.h"
-#include "plugin/TaggedComponent.h"
+#include "zeek/logging/Tag.h"
+#include "zeek/plugin/Component.h"
+#include "zeek/plugin/TaggedComponent.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(WriterFrontend, zeek, logging);
 ZEEK_FORWARD_DECLARE_NAMESPACED(WriterBackend, zeek, logging);
diff --git a/src/logging/Manager.cc b/src/logging/Manager.cc
index e3ed83a05d..889d4630f6 100644
--- a/src/logging/Manager.cc
+++ b/src/logging/Manager.cc
@@ -1,32 +1,33 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "Manager.h"
+#include "zeek/logging/Manager.h"
 
 #include <utility>
 
-#include "Event.h"
-#include "EventHandler.h"
-#include "NetVar.h"
-#include "RunState.h"
-#include "Type.h"
-#include "File.h"
-#include "input.h"
-#include "IntrusivePtr.h"
-#include "Func.h"
-
-#include "broker/Manager.h"
-#include "threading/Manager.h"
-#include "threading/SerialTypes.h"
-
-#include "Desc.h"
-#include "WriterFrontend.h"
-#include "WriterBackend.h"
-#include "logging.bif.h"
-#include "plugin/Plugin.h"
-#include "plugin/Manager.h"
-
 #include <broker/endpoint_info.hh>
 
+#include "zeek/Event.h"
+#include "zeek/EventHandler.h"
+#include "zeek/NetVar.h"
+#include "zeek/RunState.h"
+#include "zeek/Type.h"
+#include "zeek/File.h"
+#include "zeek/input.h"
+#include "zeek/IntrusivePtr.h"
+#include "zeek/Func.h"
+#include "zeek/Desc.h"
+
+#include "zeek/broker/Manager.h"
+#include "zeek/threading/Manager.h"
+#include "zeek/threading/SerialTypes.h"
+
+#include "zeek/logging/WriterFrontend.h"
+#include "zeek/logging/WriterBackend.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/plugin/Manager.h"
+
+#include "logging/logging.bif.h"
+
 using namespace std;
 
 namespace zeek::logging {
diff --git a/src/logging/Manager.h b/src/logging/Manager.h
index bbbfcc3b35..615c2284fb 100644
--- a/src/logging/Manager.h
+++ b/src/logging/Manager.h
@@ -6,13 +6,13 @@
 
 #include <string_view>
 
-#include "../Val.h"
-#include "../Tag.h"
-#include "../EventHandler.h"
-#include "../plugin/ComponentManager.h"
+#include "zeek/Val.h"
+#include "zeek/Tag.h"
+#include "zeek/EventHandler.h"
+#include "zeek/plugin/ComponentManager.h"
 
-#include "Component.h"
-#include "WriterBackend.h"
+#include "zeek/logging/Component.h"
+#include "zeek/logging/WriterBackend.h"
 
 namespace broker { struct endpoint_info; }
 ZEEK_FORWARD_DECLARE_NAMESPACED(SerializationFormat, zeek::detail);
diff --git a/src/logging/Tag.cc b/src/logging/Tag.cc
index 3bf6c2871d..1e7e5ca336 100644
--- a/src/logging/Tag.cc
+++ b/src/logging/Tag.cc
@@ -1,7 +1,7 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "Tag.h"
-#include "Manager.h"
+#include "zeek/logging/Tag.h"
+#include "zeek/logging/Manager.h"
 
 namespace zeek::logging {
 
diff --git a/src/logging/Tag.h b/src/logging/Tag.h
index ccb7963b93..8b0bd19403 100644
--- a/src/logging/Tag.h
+++ b/src/logging/Tag.h
@@ -3,7 +3,7 @@
 #pragma once
 
 #include "zeek-config.h"
-#include "../Tag.h"
+#include "zeek/Tag.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(EnumVal, zeek);
 
diff --git a/src/logging/WriterBackend.cc b/src/logging/WriterBackend.cc
index d4c6c456e0..0a938d17fc 100644
--- a/src/logging/WriterBackend.cc
+++ b/src/logging/WriterBackend.cc
@@ -1,13 +1,13 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
+#include "zeek/logging/WriterBackend.h"
+
 #include <broker/data.hh>
 
-#include "util.h"
-#include "threading/SerialTypes.h"
-
-#include "Manager.h"
-#include "WriterBackend.h"
-#include "WriterFrontend.h"
+#include "zeek/util.h"
+#include "zeek/threading/SerialTypes.h"
+#include "zeek/logging/Manager.h"
+#include "zeek/logging/WriterFrontend.h"
 
 // Messages sent from backend to frontend (i.e., "OutputMessages").
 
diff --git a/src/logging/WriterBackend.h b/src/logging/WriterBackend.h
index a3b45fa0ad..19c92aaaed 100644
--- a/src/logging/WriterBackend.h
+++ b/src/logging/WriterBackend.h
@@ -4,9 +4,8 @@
 
 #pragma once
 
-#include "threading/MsgThread.h"
-
-#include "Component.h"
+#include "zeek/threading/MsgThread.h"
+#include "zeek/logging/Component.h"
 
 namespace broker { class data; }
 
diff --git a/src/logging/WriterFrontend.cc b/src/logging/WriterFrontend.cc
index 55c7cc48c6..21a091d4e4 100644
--- a/src/logging/WriterFrontend.cc
+++ b/src/logging/WriterFrontend.cc
@@ -1,11 +1,10 @@
+#include "zeek/logging/WriterFrontend.h"
 
-#include "RunState.h"
-#include "threading/SerialTypes.h"
-#include "broker/Manager.h"
-
-#include "Manager.h"
-#include "WriterFrontend.h"
-#include "WriterBackend.h"
+#include "zeek/RunState.h"
+#include "zeek/threading/SerialTypes.h"
+#include "zeek/broker/Manager.h"
+#include "zeek/logging/Manager.h"
+#include "zeek/logging/WriterBackend.h"
 
 using zeek::threading::Value;
 using zeek::threading::Field;
diff --git a/src/logging/WriterFrontend.h b/src/logging/WriterFrontend.h
index 345ab5eac9..445235f49e 100644
--- a/src/logging/WriterFrontend.h
+++ b/src/logging/WriterFrontend.h
@@ -2,7 +2,7 @@
 
 #pragma once
 
-#include "WriterBackend.h"
+#include "zeek/logging/WriterBackend.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(Manager, zeek, logging);
 
diff --git a/src/logging/logging.bif b/src/logging/logging.bif
index 82d8e0047c..fa0c611497 100644
--- a/src/logging/logging.bif
+++ b/src/logging/logging.bif
@@ -3,7 +3,7 @@
 module Log;
 
 %%{
-#include "logging/Manager.h"
+#include "zeek/logging/Manager.h"
 %%}
 
 type Filter: record;
diff --git a/src/logging/writers/ascii/Ascii.cc b/src/logging/writers/ascii/Ascii.cc
index 5a04807b30..a032381f0a 100644
--- a/src/logging/writers/ascii/Ascii.cc
+++ b/src/logging/writers/ascii/Ascii.cc
@@ -1,11 +1,6 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include <ctime>
-#include <cstdio>
-#include <string>
-#include <vector>
-#include <memory>
-#include <optional>
+#include "zeek/logging/writers/ascii/Ascii.h"
 
 #include <errno.h>
 #include <fcntl.h>
@@ -14,13 +9,19 @@
 #include <unistd.h>
 #include <dirent.h>
 
-#include "Func.h"
-#include "RunState.h"
-#include "logging/Manager.h"
-#include "threading/SerialTypes.h"
+#include <ctime>
+#include <cstdio>
+#include <string>
+#include <vector>
+#include <memory>
+#include <optional>
 
-#include "Ascii.h"
-#include "ascii.bif.h"
+#include "zeek/Func.h"
+#include "zeek/RunState.h"
+#include "zeek/logging/Manager.h"
+#include "zeek/threading/SerialTypes.h"
+
+#include "logging/writers/ascii/ascii.bif.h"
 
 using namespace std;
 using zeek::threading::Value;
diff --git a/src/logging/writers/ascii/Ascii.h b/src/logging/writers/ascii/Ascii.h
index 6140f113b6..6b52899051 100644
--- a/src/logging/writers/ascii/Ascii.h
+++ b/src/logging/writers/ascii/Ascii.h
@@ -4,11 +4,12 @@
 
 #pragma once
 
-#include "logging/WriterBackend.h"
-#include "threading/formatters/Ascii.h"
-#include "threading/formatters/JSON.h"
-#include "Desc.h"
-#include "zlib.h"
+#include <zlib.h>
+
+#include "zeek/logging/WriterBackend.h"
+#include "zeek/threading/formatters/Ascii.h"
+#include "zeek/threading/formatters/JSON.h"
+#include "zeek/Desc.h"
 
 namespace zeek::plugin::detail::Zeek_AsciiWriter { class Plugin; }
 
diff --git a/src/logging/writers/ascii/Plugin.cc b/src/logging/writers/ascii/Plugin.cc
index 43d151837a..8df8d8e663 100644
--- a/src/logging/writers/ascii/Plugin.cc
+++ b/src/logging/writers/ascii/Plugin.cc
@@ -1,9 +1,7 @@
 // See the file  in the main distribution directory for copyright.
 
-
-#include "plugin/Plugin.h"
-
-#include "Ascii.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/logging/writers/ascii/Ascii.h"
 
 namespace zeek::plugin::detail::Zeek_AsciiWriter {
 
diff --git a/src/logging/writers/none/None.cc b/src/logging/writers/none/None.cc
index cc178a2e19..ab02c12cef 100644
--- a/src/logging/writers/none/None.cc
+++ b/src/logging/writers/none/None.cc
@@ -1,9 +1,9 @@
+#include "zeek/logging/writers/none/None.h"
 
 #include <algorithm>
 #include <iostream>
 
-#include "None.h"
-#include "none.bif.h"
+#include "logging/writers/none/none.bif.h"
 
 namespace zeek::logging::writer::detail {
 
diff --git a/src/logging/writers/none/None.h b/src/logging/writers/none/None.h
index c99171667c..5efed87fbe 100644
--- a/src/logging/writers/none/None.h
+++ b/src/logging/writers/none/None.h
@@ -4,7 +4,7 @@
 
 #pragma once
 
-#include "logging/WriterBackend.h"
+#include "zeek/logging/WriterBackend.h"
 
 namespace zeek::logging::writer::detail {
 
diff --git a/src/logging/writers/none/Plugin.cc b/src/logging/writers/none/Plugin.cc
index 07a46a0820..2687459497 100644
--- a/src/logging/writers/none/Plugin.cc
+++ b/src/logging/writers/none/Plugin.cc
@@ -1,9 +1,7 @@
 // See the file  in the main distribution directory for copyright.
 
-
-#include "plugin/Plugin.h"
-
-#include "None.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/logging/writers/none/None.h"
 
 namespace zeek::plugin::detail::Zeek_NoneWriter {
 
diff --git a/src/logging/writers/sqlite/Plugin.cc b/src/logging/writers/sqlite/Plugin.cc
index 1c40a608d2..828da74443 100644
--- a/src/logging/writers/sqlite/Plugin.cc
+++ b/src/logging/writers/sqlite/Plugin.cc
@@ -1,9 +1,7 @@
 // See the file  in the main distribution directory for copyright.
 
-
-#include "plugin/Plugin.h"
-
-#include "SQLite.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/logging/writers/sqlite/SQLite.h"
 
 namespace zeek::plugin::detail::Zeek_SQLiteWriter {
 
diff --git a/src/logging/writers/sqlite/SQLite.cc b/src/logging/writers/sqlite/SQLite.cc
index dad1c4dc43..e3977d32d8 100644
--- a/src/logging/writers/sqlite/SQLite.cc
+++ b/src/logging/writers/sqlite/SQLite.cc
@@ -1,15 +1,15 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
+#include "zeek/logging/writers/sqlite/SQLite.h"
 
-#include <string>
 #include <errno.h>
+#include <string>
 #include <vector>
 
-#include "threading/SerialTypes.h"
+#include "zeek/threading/SerialTypes.h"
 
-#include "SQLite.h"
-#include "sqlite.bif.h"
+#include "logging/writers/sqlite/sqlite.bif.h"
 
 using namespace std;
 using zeek::threading::Value;
diff --git a/src/logging/writers/sqlite/SQLite.h b/src/logging/writers/sqlite/SQLite.h
index a2cefbea01..130eba5a7b 100644
--- a/src/logging/writers/sqlite/SQLite.h
+++ b/src/logging/writers/sqlite/SQLite.h
@@ -6,10 +6,10 @@
 
 #include "zeek-config.h"
 
-#include "logging/WriterBackend.h"
-#include "threading/formatters/Ascii.h"
-#include "3rdparty/sqlite3.h"
-#include "Desc.h"
+#include "zeek/logging/WriterBackend.h"
+#include "zeek/threading/formatters/Ascii.h"
+#include "zeek/3rdparty/sqlite3.h"
+#include "zeek/Desc.h"
 
 namespace zeek::logging::writer::detail {
 
diff --git a/src/main.cc b/src/main.cc
index 35a95491c3..c8b55c9f79 100644
--- a/src/main.cc
+++ b/src/main.cc
@@ -1,11 +1,11 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
-#include "zeek-setup.h"
+#include "zeek/zeek-setup.h"
 
-#include "iosource/Manager.h"
-#include "supervisor/Supervisor.h"
-#include "RunState.h"
+#include "zeek/iosource/Manager.h"
+#include "zeek/supervisor/Supervisor.h"
+#include "zeek/RunState.h"
 
 int main(int argc, char** argv)
 	{
diff --git a/src/make_dbg_constants.py b/src/make_dbg_constants.py
index 5173b24652..51a9c4c3b7 100644
--- a/src/make_dbg_constants.py
+++ b/src/make_dbg_constants.py
@@ -48,7 +48,7 @@ init_str = '''
 // DO NOT EDIT.
 //
 
-#include "util.h"
+#include "zeek/util.h"
 namespace zeek::detail {\n
 void init_global_dbg_constants () {
 ''' % inputfile
diff --git a/src/modp_numtoa.c b/src/modp_numtoa.c
index ab6b2c95e8..6818f926b0 100644
--- a/src/modp_numtoa.c
+++ b/src/modp_numtoa.c
@@ -1,7 +1,7 @@
 /* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil; tab-width: 4 -*- */
 /* vi: set expandtab shiftwidth=4 tabstop=4: */
 
-#include "modp_numtoa.h"
+#include "zeek/modp_numtoa.h"
 
 #include <stdint.h>
 #include <stdio.h>
@@ -413,6 +413,3 @@ void modp_dtoa3(double value, char* str, int n, int prec)
     *wstr='\0';
     strreverse(str, wstr-1);
 }
-
-
-
diff --git a/src/module_util.cc b/src/module_util.cc
index 32ac0fc837..e74aa86bdf 100644
--- a/src/module_util.cc
+++ b/src/module_util.cc
@@ -1,13 +1,13 @@
 //
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "module_util.h"
+#include "zeek/module_util.h"
 
 #include <string.h>
 #include <iostream>
 #include <string>
 
-#include "3rdparty/doctest.h"
+#include "zeek/3rdparty/doctest.h"
 
 using namespace std;
 
diff --git a/src/nb_dns.c b/src/nb_dns.c
index 7cc6e80a19..cb189e40f0 100644
--- a/src/nb_dns.c
+++ b/src/nb_dns.c
@@ -12,6 +12,7 @@
  */
 
 #include "zeek-config.h"			/* must appear before first ifdef */
+#include "zeek/nb_dns.h"
 
 #include <sys/types.h>
 #include <sys/socket.h>
@@ -42,8 +43,6 @@
 #endif
 #endif
 
-#include "nb_dns.h"
-
 #if PACKETSZ > 1024
 #define MAXPACKET	PACKETSZ
 #else
diff --git a/src/nb_dns.h b/src/nb_dns.h
index 1b96a8d426..91ea1d8e94 100644
--- a/src/nb_dns.h
+++ b/src/nb_dns.h
@@ -4,6 +4,9 @@
 
 #pragma once
 
+#include <stdint.h>
+#include <sys/socket.h>
+
 /* Private data */
 struct nb_dns_info;
 
diff --git a/src/net_util.cc b/src/net_util.cc
index 00c084e303..728a1408dd 100644
--- a/src/net_util.cc
+++ b/src/net_util.cc
@@ -1,18 +1,16 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
+#include "zeek/net_util.h"
 
 #include <sys/types.h>
 #include <sys/socket.h>
-
 #include <netinet/in.h>
-
 #include <arpa/inet.h>
 
-#include "Reporter.h"
-#include "net_util.h"
-#include "IPAddr.h"
-#include "IP.h"
+#include "zeek/Reporter.h"
+#include "zeek/IPAddr.h"
+#include "zeek/IP.h"
 
 namespace zeek {
 
diff --git a/src/net_util.h b/src/net_util.h
index 629cf7450f..3d9e2a9c39 100644
--- a/src/net_util.h
+++ b/src/net_util.h
@@ -26,7 +26,7 @@ typedef enum { IPv4, IPv6 } IPFamily;
 #include <netinet/udp.h>
 #include <netinet/ip_icmp.h>
 
-#include "util.h"
+#include "zeek/util.h"
 
 #ifdef HAVE_NETINET_IP6_H
 #include <netinet/ip6.h>
diff --git a/src/option.bif b/src/option.bif
index e9de84be63..92429330e7 100644
--- a/src/option.bif
+++ b/src/option.bif
@@ -4,8 +4,8 @@
 module Option;
 
 %%{
-#include "NetVar.h"
-#include "broker/Data.h"
+#include "zeek/NetVar.h"
+#include "zeek/broker/Data.h"
 
 static bool call_option_handlers_and_set_value(zeek::StringVal* name, const zeek::detail::IDPtr& i,
                                                zeek::ValPtr val, zeek::StringVal* location)
diff --git a/src/packet_analysis/Analyzer.h b/src/packet_analysis/Analyzer.h
index 96f6a387ff..a8da218a93 100644
--- a/src/packet_analysis/Analyzer.h
+++ b/src/packet_analysis/Analyzer.h
@@ -1,9 +1,9 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 #pragma once
 
-#include "Manager.h"
-#include "Tag.h"
-#include <iosource/Packet.h>
+#include "zeek/packet_analysis/Manager.h"
+#include "zeek/packet_analysis/Tag.h"
+#include "zeek/iosource/Packet.h"
 
 namespace zeek::packet_analysis {
 
diff --git a/src/packet_analysis/Component.cc b/src/packet_analysis/Component.cc
index 0fec613648..af644824c2 100644
--- a/src/packet_analysis/Component.cc
+++ b/src/packet_analysis/Component.cc
@@ -1,8 +1,8 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "Component.h"
-#include "Desc.h"
-#include "Manager.h"
+#include "zeek/packet_analysis/Component.h"
+#include "zeek/Desc.h"
+#include "zeek/packet_analysis/Manager.h"
 
 using namespace zeek::packet_analysis;
 
diff --git a/src/packet_analysis/Component.h b/src/packet_analysis/Component.h
index 59ccb66515..2dc40d1cda 100644
--- a/src/packet_analysis/Component.h
+++ b/src/packet_analysis/Component.h
@@ -6,11 +6,11 @@
 
 #include <functional>
 
-#include "util.h"
-#include "Tag.h"
+#include "zeek/util.h"
+#include "zeek/packet_analysis/Tag.h"
 
-#include "plugin/Component.h"
-#include "plugin/TaggedComponent.h"
+#include "zeek/plugin/Component.h"
+#include "zeek/plugin/TaggedComponent.h"
 
 namespace zeek::packet_analysis {
 
diff --git a/src/packet_analysis/Dispatcher.cc b/src/packet_analysis/Dispatcher.cc
index d1b169045b..59e03efe4d 100644
--- a/src/packet_analysis/Dispatcher.cc
+++ b/src/packet_analysis/Dispatcher.cc
@@ -2,10 +2,10 @@
 
 #include <algorithm>
 
-#include "Dispatcher.h"
-#include "Analyzer.h"
-#include "Reporter.h"
-#include "DebugLogger.h"
+#include "zeek/packet_analysis/Dispatcher.h"
+#include "zeek/packet_analysis/Analyzer.h"
+#include "zeek/Reporter.h"
+#include "zeek/DebugLogger.h"
 
 namespace zeek::packet_analysis {
 
diff --git a/src/packet_analysis/Manager.cc b/src/packet_analysis/Manager.cc
index b95c60a972..2e1ebf89cd 100644
--- a/src/packet_analysis/Manager.cc
+++ b/src/packet_analysis/Manager.cc
@@ -1,14 +1,14 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "Manager.h"
+#include "zeek/packet_analysis/Manager.h"
 
-#include "Analyzer.h"
-#include "Dispatcher.h"
-#include "zeek-bif.h"
-#include "Stats.h"
+#include "zeek/packet_analysis/Analyzer.h"
+#include "zeek/packet_analysis/Dispatcher.h"
+#include "zeek/zeek-bif.h"
+#include "zeek/Stats.h"
 #include "zeek/Sessions.h"
 #include "zeek/RunState.h"
-#include "iosource/PktDumper.h"
+#include "zeek/iosource/PktDumper.h"
 
 using namespace zeek::packet_analysis;
 
diff --git a/src/packet_analysis/Manager.h b/src/packet_analysis/Manager.h
index e63d7422f4..c675f5919b 100644
--- a/src/packet_analysis/Manager.h
+++ b/src/packet_analysis/Manager.h
@@ -2,11 +2,11 @@
 
 #pragma once
 
-#include "Tag.h"
-#include "Component.h"
-#include "plugin/ComponentManager.h"
-#include "iosource/Packet.h"
-#include "Dispatcher.h"
+#include "zeek/packet_analysis/Tag.h"
+#include "zeek/packet_analysis/Component.h"
+#include "zeek/plugin/ComponentManager.h"
+#include "zeek/iosource/Packet.h"
+#include "zeek/packet_analysis/Dispatcher.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(PacketProfiler, zeek::detail);
 
diff --git a/src/packet_analysis/Tag.cc b/src/packet_analysis/Tag.cc
index 8a3cc89ea6..f036729013 100644
--- a/src/packet_analysis/Tag.cc
+++ b/src/packet_analysis/Tag.cc
@@ -1,7 +1,7 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "Tag.h"
-#include "Manager.h"
+#include "zeek/packet_analysis/Tag.h"
+#include "zeek/packet_analysis/Manager.h"
 
 namespace zeek::packet_analysis {
 
diff --git a/src/packet_analysis/Tag.h b/src/packet_analysis/Tag.h
index 6233f6d89e..36af26c3e9 100644
--- a/src/packet_analysis/Tag.h
+++ b/src/packet_analysis/Tag.h
@@ -3,7 +3,7 @@
 #pragma once
 
 #include "zeek-config.h"
-#include "../Tag.h"
+#include "zeek/Tag.h"
 
 namespace zeek::plugin {
 	template <class T> class TaggedComponent;
diff --git a/src/packet_analysis/protocol/arp/ARP.cc b/src/packet_analysis/protocol/arp/ARP.cc
index 651c29d167..0edf0816dd 100644
--- a/src/packet_analysis/protocol/arp/ARP.cc
+++ b/src/packet_analysis/protocol/arp/ARP.cc
@@ -1,11 +1,8 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "ARP.h"
-#include "Event.h"
-
-#include "events.bif.h"
-
 #include "zeek-config.h"
+#include "zeek/packet_analysis/protocol/arp/ARP.h"
+
 #ifdef HAVE_NET_ETHERNET_H
 #include <net/ethernet.h>
 #elif defined(HAVE_SYS_ETHERNET_H)
@@ -16,6 +13,10 @@
 #include <net/ethertypes.h>
 #endif
 
+#include "zeek/Event.h"
+
+#include "packet_analysis/protocol/arp/events.bif.h"
+
 using namespace zeek::packet_analysis::ARP;
 
 ARPAnalyzer::ARPAnalyzer()
diff --git a/src/packet_analysis/protocol/arp/ARP.h b/src/packet_analysis/protocol/arp/ARP.h
index c4de038876..8bad3d1251 100644
--- a/src/packet_analysis/protocol/arp/ARP.h
+++ b/src/packet_analysis/protocol/arp/ARP.h
@@ -2,12 +2,13 @@
 
 #pragma once
 
-#include <packet_analysis/Analyzer.h>
-#include <packet_analysis/Component.h>
-
+#include <sys/types.h>
 #include <sys/socket.h>
 #include <net/if_arp.h>
 
+#include "zeek/packet_analysis/Analyzer.h"
+#include "zeek/packet_analysis/Component.h"
+
 #ifndef arp_pkthdr
 #define arp_pkthdr arphdr
 #endif
diff --git a/src/packet_analysis/protocol/arp/Plugin.cc b/src/packet_analysis/protocol/arp/Plugin.cc
index e2808cffb3..1000e1ab62 100644
--- a/src/packet_analysis/protocol/arp/Plugin.cc
+++ b/src/packet_analysis/protocol/arp/Plugin.cc
@@ -1,8 +1,8 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "plugin/Plugin.h"
-#include "ARP.h"
-#include "packet_analysis/Component.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/packet_analysis/Component.h"
+#include "zeek/packet_analysis/protocol/arp/ARP.h"
 
 namespace zeek::plugin::Zeek_ARP {
 
diff --git a/src/packet_analysis/protocol/ethernet/Ethernet.cc b/src/packet_analysis/protocol/ethernet/Ethernet.cc
index 68dd5b935f..42a620a83f 100644
--- a/src/packet_analysis/protocol/ethernet/Ethernet.cc
+++ b/src/packet_analysis/protocol/ethernet/Ethernet.cc
@@ -1,8 +1,7 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "Ethernet.h"
-#include "NetVar.h"
-#include "Manager.h"
+#include "zeek/packet_analysis/protocol/ethernet/Ethernet.h"
+#include "zeek/packet_analysis/Manager.h"
 
 using namespace zeek::packet_analysis::Ethernet;
 
diff --git a/src/packet_analysis/protocol/ethernet/Ethernet.h b/src/packet_analysis/protocol/ethernet/Ethernet.h
index ea003d27ab..e1dc4d2fc8 100644
--- a/src/packet_analysis/protocol/ethernet/Ethernet.h
+++ b/src/packet_analysis/protocol/ethernet/Ethernet.h
@@ -2,8 +2,8 @@
 
 #pragma once
 
-#include <packet_analysis/Analyzer.h>
-#include <packet_analysis/Component.h>
+#include "zeek/packet_analysis/Analyzer.h"
+#include "zeek/packet_analysis/Component.h"
 
 namespace zeek::packet_analysis::Ethernet {
 
diff --git a/src/packet_analysis/protocol/ethernet/Plugin.cc b/src/packet_analysis/protocol/ethernet/Plugin.cc
index 409292b3ac..6222e5401e 100644
--- a/src/packet_analysis/protocol/ethernet/Plugin.cc
+++ b/src/packet_analysis/protocol/ethernet/Plugin.cc
@@ -1,8 +1,8 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "Ethernet.h"
-#include "plugin/Plugin.h"
-#include "packet_analysis/Component.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/packet_analysis/Component.h"
+#include "zeek/packet_analysis/protocol/ethernet/Ethernet.h"
 
 namespace zeek::plugin::Zeek_Ethernet {
 
diff --git a/src/packet_analysis/protocol/fddi/FDDI.cc b/src/packet_analysis/protocol/fddi/FDDI.cc
index 5466ab2dad..7e8f8bf616 100644
--- a/src/packet_analysis/protocol/fddi/FDDI.cc
+++ b/src/packet_analysis/protocol/fddi/FDDI.cc
@@ -1,7 +1,6 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "FDDI.h"
-#include "NetVar.h"
+#include "zeek/packet_analysis/protocol/fddi/FDDI.h"
 
 using namespace zeek::packet_analysis::FDDI;
 
diff --git a/src/packet_analysis/protocol/fddi/FDDI.h b/src/packet_analysis/protocol/fddi/FDDI.h
index 080834ae71..f4f93043a2 100644
--- a/src/packet_analysis/protocol/fddi/FDDI.h
+++ b/src/packet_analysis/protocol/fddi/FDDI.h
@@ -2,8 +2,8 @@
 
 #pragma once
 
-#include <packet_analysis/Analyzer.h>
-#include <packet_analysis/Component.h>
+#include "zeek/packet_analysis/Analyzer.h"
+#include "zeek/packet_analysis/Component.h"
 
 namespace zeek::packet_analysis::FDDI {
 
diff --git a/src/packet_analysis/protocol/fddi/Plugin.cc b/src/packet_analysis/protocol/fddi/Plugin.cc
index 8154e7f915..962138ac25 100644
--- a/src/packet_analysis/protocol/fddi/Plugin.cc
+++ b/src/packet_analysis/protocol/fddi/Plugin.cc
@@ -1,8 +1,8 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "FDDI.h"
-#include "plugin/Plugin.h"
-#include "packet_analysis/Component.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/packet_analysis/Component.h"
+#include "zeek/packet_analysis/protocol/fddi/FDDI.h"
 
 namespace zeek::plugin::Zeek_FDDI {
 
diff --git a/src/packet_analysis/protocol/gre/GRE.cc b/src/packet_analysis/protocol/gre/GRE.cc
index 02bdf2e33f..cb3516a50f 100644
--- a/src/packet_analysis/protocol/gre/GRE.cc
+++ b/src/packet_analysis/protocol/gre/GRE.cc
@@ -1,13 +1,14 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "GRE.h"
+#include "zeek/packet_analysis/protocol/gre/GRE.h"
+
+#include <pcap.h> // For DLT_ constants
+
 #include "zeek/Sessions.h"
 #include "zeek/RunState.h"
 #include "zeek/IP.h"
 #include "zeek/Reporter.h"
 
-#include "pcap.h" // For DLT_ constants
-
 using namespace zeek::packet_analysis::GRE;
 
 static unsigned int gre_header_len(uint16_t flags=0)
diff --git a/src/packet_analysis/protocol/gre/GRE.h b/src/packet_analysis/protocol/gre/GRE.h
index b90dfad0fc..567fc4e203 100644
--- a/src/packet_analysis/protocol/gre/GRE.h
+++ b/src/packet_analysis/protocol/gre/GRE.h
@@ -2,8 +2,8 @@
 
 #pragma once
 
-#include <packet_analysis/Analyzer.h>
-#include <packet_analysis/Component.h>
+#include "zeek/packet_analysis/Analyzer.h"
+#include "zeek/packet_analysis/Component.h"
 
 namespace zeek::packet_analysis::GRE {
 
diff --git a/src/packet_analysis/protocol/gre/Plugin.cc b/src/packet_analysis/protocol/gre/Plugin.cc
index 4a3aefd52e..25fbc3b489 100644
--- a/src/packet_analysis/protocol/gre/Plugin.cc
+++ b/src/packet_analysis/protocol/gre/Plugin.cc
@@ -1,8 +1,8 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "GRE.h"
-#include "plugin/Plugin.h"
-#include "packet_analysis/Component.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/packet_analysis/Component.h"
+#include "zeek/packet_analysis/protocol/gre/GRE.h"
 
 namespace zeek::plugin::Zeek_GRE {
 
diff --git a/src/packet_analysis/protocol/ieee802_11/IEEE802_11.cc b/src/packet_analysis/protocol/ieee802_11/IEEE802_11.cc
index c7e6b32982..4a46046a90 100644
--- a/src/packet_analysis/protocol/ieee802_11/IEEE802_11.cc
+++ b/src/packet_analysis/protocol/ieee802_11/IEEE802_11.cc
@@ -1,7 +1,6 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "IEEE802_11.h"
-#include "NetVar.h"
+#include "zeek/packet_analysis/protocol/ieee802_11/IEEE802_11.h"
 
 using namespace zeek::packet_analysis::IEEE802_11;
 
diff --git a/src/packet_analysis/protocol/ieee802_11/IEEE802_11.h b/src/packet_analysis/protocol/ieee802_11/IEEE802_11.h
index e919f9676c..edfb78b399 100644
--- a/src/packet_analysis/protocol/ieee802_11/IEEE802_11.h
+++ b/src/packet_analysis/protocol/ieee802_11/IEEE802_11.h
@@ -2,8 +2,8 @@
 
 #pragma once
 
-#include <packet_analysis/Analyzer.h>
-#include <packet_analysis/Component.h>
+#include "zeek/packet_analysis/Analyzer.h"
+#include "zeek/packet_analysis/Component.h"
 
 namespace zeek::packet_analysis::IEEE802_11 {
 
diff --git a/src/packet_analysis/protocol/ieee802_11/Plugin.cc b/src/packet_analysis/protocol/ieee802_11/Plugin.cc
index 11efda40c4..78bd8a5925 100644
--- a/src/packet_analysis/protocol/ieee802_11/Plugin.cc
+++ b/src/packet_analysis/protocol/ieee802_11/Plugin.cc
@@ -1,8 +1,8 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "IEEE802_11.h"
-#include "plugin/Plugin.h"
-#include "packet_analysis/Component.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/packet_analysis/Component.h"
+#include "zeek/packet_analysis/protocol/ieee802_11/IEEE802_11.h"
 
 namespace zeek::plugin::Zeek_IEEE802_11 {
 
diff --git a/src/packet_analysis/protocol/ieee802_11_radio/IEEE802_11_Radio.cc b/src/packet_analysis/protocol/ieee802_11_radio/IEEE802_11_Radio.cc
index 19fcc052a7..8f66b79437 100644
--- a/src/packet_analysis/protocol/ieee802_11_radio/IEEE802_11_Radio.cc
+++ b/src/packet_analysis/protocol/ieee802_11_radio/IEEE802_11_Radio.cc
@@ -1,9 +1,8 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include <pcap.h>
+#include "zeek/packet_analysis/protocol/ieee802_11_radio/IEEE802_11_Radio.h"
 
-#include "IEEE802_11_Radio.h"
-#include "NetVar.h"
+#include <pcap.h>
 
 using namespace zeek::packet_analysis::IEEE802_11_Radio;
 
diff --git a/src/packet_analysis/protocol/ieee802_11_radio/IEEE802_11_Radio.h b/src/packet_analysis/protocol/ieee802_11_radio/IEEE802_11_Radio.h
index bbd06d2b0f..788cb00b97 100644
--- a/src/packet_analysis/protocol/ieee802_11_radio/IEEE802_11_Radio.h
+++ b/src/packet_analysis/protocol/ieee802_11_radio/IEEE802_11_Radio.h
@@ -2,8 +2,8 @@
 
 #pragma once
 
-#include <packet_analysis/Analyzer.h>
-#include <packet_analysis/Component.h>
+#include "zeek/packet_analysis/Analyzer.h"
+#include "zeek/packet_analysis/Component.h"
 
 namespace zeek::packet_analysis::IEEE802_11_Radio {
 
diff --git a/src/packet_analysis/protocol/ieee802_11_radio/Plugin.cc b/src/packet_analysis/protocol/ieee802_11_radio/Plugin.cc
index 0b566f6d5f..6621bead8e 100644
--- a/src/packet_analysis/protocol/ieee802_11_radio/Plugin.cc
+++ b/src/packet_analysis/protocol/ieee802_11_radio/Plugin.cc
@@ -1,8 +1,8 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "IEEE802_11_Radio.h"
-#include "plugin/Plugin.h"
-#include "packet_analysis/Component.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/packet_analysis/Component.h"
+#include "zeek/packet_analysis/protocol/ieee802_11_radio/IEEE802_11_Radio.h"
 
 namespace zeek::plugin::Zeek_IEEE802_11_Radio {
 
diff --git a/src/packet_analysis/protocol/ip/IP.cc b/src/packet_analysis/protocol/ip/IP.cc
index ef1deaeac6..90757dacd7 100644
--- a/src/packet_analysis/protocol/ip/IP.cc
+++ b/src/packet_analysis/protocol/ip/IP.cc
@@ -1,6 +1,6 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "IP.h"
+#include "zeek/packet_analysis/protocol/ip/IP.h"
 #include "zeek/NetVar.h"
 #include "zeek/IP.h"
 #include "zeek/Discard.h"
diff --git a/src/packet_analysis/protocol/ip/Plugin.cc b/src/packet_analysis/protocol/ip/Plugin.cc
index c24a880c60..31ef82c663 100644
--- a/src/packet_analysis/protocol/ip/Plugin.cc
+++ b/src/packet_analysis/protocol/ip/Plugin.cc
@@ -1,8 +1,8 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "IP.h"
-#include "plugin/Plugin.h"
-#include "packet_analysis/Component.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/packet_analysis/Component.h"
+#include "zeek/packet_analysis/protocol/ip/IP.h"
 
 namespace zeek::plugin::Zeek_IP {
 
diff --git a/src/packet_analysis/protocol/iptunnel/IPTunnel.cc b/src/packet_analysis/protocol/iptunnel/IPTunnel.cc
index 45b18723ea..a7455cb214 100644
--- a/src/packet_analysis/protocol/iptunnel/IPTunnel.cc
+++ b/src/packet_analysis/protocol/iptunnel/IPTunnel.cc
@@ -1,13 +1,14 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "IPTunnel.h"
+#include "zeek/packet_analysis/protocol/iptunnel/IPTunnel.h"
+
+#include <pcap.h> // For DLT_ constants
+
 #include "zeek/Sessions.h"
 #include "zeek/RunState.h"
 #include "zeek/IP.h"
 #include "zeek/TunnelEncapsulation.h"
 
-#include "pcap.h" // For DLT_ constants
-
 namespace zeek::packet_analysis::IPTunnel {
 
 IPTunnelAnalyzer* ip_tunnel_analyzer;
diff --git a/src/packet_analysis/protocol/iptunnel/Plugin.cc b/src/packet_analysis/protocol/iptunnel/Plugin.cc
index c8305b2b9b..3efb9dfeae 100644
--- a/src/packet_analysis/protocol/iptunnel/Plugin.cc
+++ b/src/packet_analysis/protocol/iptunnel/Plugin.cc
@@ -1,8 +1,8 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "IPTunnel.h"
-#include "plugin/Plugin.h"
-#include "packet_analysis/Component.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/packet_analysis/Component.h"
+#include "zeek/packet_analysis/protocol/iptunnel/IPTunnel.h"
 
 namespace zeek::plugin::Zeek_IPTunnel {
 
diff --git a/src/packet_analysis/protocol/linux_sll/LinuxSLL.cc b/src/packet_analysis/protocol/linux_sll/LinuxSLL.cc
index 9f3dd25787..35273cd961 100644
--- a/src/packet_analysis/protocol/linux_sll/LinuxSLL.cc
+++ b/src/packet_analysis/protocol/linux_sll/LinuxSLL.cc
@@ -1,6 +1,6 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "LinuxSLL.h"
+#include "zeek/packet_analysis/protocol/linux_sll/LinuxSLL.h"
 
 using namespace zeek::packet_analysis::LinuxSLL;
 
diff --git a/src/packet_analysis/protocol/linux_sll/LinuxSLL.h b/src/packet_analysis/protocol/linux_sll/LinuxSLL.h
index ec18d92eb1..35c07f3e64 100644
--- a/src/packet_analysis/protocol/linux_sll/LinuxSLL.h
+++ b/src/packet_analysis/protocol/linux_sll/LinuxSLL.h
@@ -2,8 +2,8 @@
 
 #pragma once
 
-#include <packet_analysis/Analyzer.h>
-#include <packet_analysis/Component.h>
+#include "zeek/packet_analysis/Analyzer.h"
+#include "zeek/packet_analysis/Component.h"
 
 namespace zeek::packet_analysis::LinuxSLL {
 
diff --git a/src/packet_analysis/protocol/linux_sll/Plugin.cc b/src/packet_analysis/protocol/linux_sll/Plugin.cc
index a0cf4583be..c9f249a5a0 100644
--- a/src/packet_analysis/protocol/linux_sll/Plugin.cc
+++ b/src/packet_analysis/protocol/linux_sll/Plugin.cc
@@ -1,8 +1,8 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "plugin/Plugin.h"
-#include "LinuxSLL.h"
-#include "packet_analysis/Component.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/packet_analysis/Component.h"
+#include "zeek/packet_analysis/protocol/linux_sll/LinuxSLL.h"
 
 namespace zeek::plugin::Zeek_LinuxSLL {
 
diff --git a/src/packet_analysis/protocol/mpls/MPLS.cc b/src/packet_analysis/protocol/mpls/MPLS.cc
index 4ec72ad4b6..7314d507fa 100644
--- a/src/packet_analysis/protocol/mpls/MPLS.cc
+++ b/src/packet_analysis/protocol/mpls/MPLS.cc
@@ -1,6 +1,6 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "MPLS.h"
+#include "zeek/packet_analysis/protocol/mpls/MPLS.h"
 
 using namespace zeek::packet_analysis::MPLS;
 
diff --git a/src/packet_analysis/protocol/mpls/MPLS.h b/src/packet_analysis/protocol/mpls/MPLS.h
index b536b934d0..189642010e 100644
--- a/src/packet_analysis/protocol/mpls/MPLS.h
+++ b/src/packet_analysis/protocol/mpls/MPLS.h
@@ -2,8 +2,8 @@
 
 #pragma once
 
-#include <packet_analysis/Analyzer.h>
-#include <packet_analysis/Component.h>
+#include "zeek/packet_analysis/Analyzer.h"
+#include "zeek/packet_analysis/Component.h"
 
 namespace zeek::packet_analysis::MPLS {
 
diff --git a/src/packet_analysis/protocol/mpls/Plugin.cc b/src/packet_analysis/protocol/mpls/Plugin.cc
index ef29566623..e18fa2fc75 100644
--- a/src/packet_analysis/protocol/mpls/Plugin.cc
+++ b/src/packet_analysis/protocol/mpls/Plugin.cc
@@ -1,8 +1,8 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "MPLS.h"
-#include "plugin/Plugin.h"
-#include "packet_analysis/Component.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/packet_analysis/Component.h"
+#include "zeek/packet_analysis/protocol/mpls/MPLS.h"
 
 namespace zeek::plugin::Zeek_MPLS {
 
diff --git a/src/packet_analysis/protocol/nflog/NFLog.cc b/src/packet_analysis/protocol/nflog/NFLog.cc
index 55a09dc147..c7ae625784 100644
--- a/src/packet_analysis/protocol/nflog/NFLog.cc
+++ b/src/packet_analysis/protocol/nflog/NFLog.cc
@@ -1,7 +1,6 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "NFLog.h"
-#include "NetVar.h"
+#include "zeek/packet_analysis/protocol/nflog/NFLog.h"
 
 using namespace zeek::packet_analysis::NFLog;
 
diff --git a/src/packet_analysis/protocol/nflog/NFLog.h b/src/packet_analysis/protocol/nflog/NFLog.h
index 9e7dfecfea..aea2b2dea8 100644
--- a/src/packet_analysis/protocol/nflog/NFLog.h
+++ b/src/packet_analysis/protocol/nflog/NFLog.h
@@ -2,8 +2,8 @@
 
 #pragma once
 
-#include <packet_analysis/Analyzer.h>
-#include <packet_analysis/Component.h>
+#include "zeek/packet_analysis/Analyzer.h"
+#include "zeek/packet_analysis/Component.h"
 
 namespace zeek::packet_analysis::NFLog {
 
diff --git a/src/packet_analysis/protocol/nflog/Plugin.cc b/src/packet_analysis/protocol/nflog/Plugin.cc
index 94997fe96a..ac22a1b442 100644
--- a/src/packet_analysis/protocol/nflog/Plugin.cc
+++ b/src/packet_analysis/protocol/nflog/Plugin.cc
@@ -1,8 +1,8 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "NFLog.h"
-#include "plugin/Plugin.h"
-#include "packet_analysis/Component.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/packet_analysis/Component.h"
+#include "zeek/packet_analysis/protocol/nflog/NFLog.h"
 
 namespace zeek::plugin::Zeek_NFLog {
 
diff --git a/src/packet_analysis/protocol/null/Null.cc b/src/packet_analysis/protocol/null/Null.cc
index 92ecb29315..5a28c360c7 100644
--- a/src/packet_analysis/protocol/null/Null.cc
+++ b/src/packet_analysis/protocol/null/Null.cc
@@ -1,7 +1,6 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "Null.h"
-#include "NetVar.h"
+#include "zeek/packet_analysis/protocol/null/Null.h"
 
 using namespace zeek::packet_analysis::Null;
 
diff --git a/src/packet_analysis/protocol/null/Null.h b/src/packet_analysis/protocol/null/Null.h
index 4179130690..8357875a87 100644
--- a/src/packet_analysis/protocol/null/Null.h
+++ b/src/packet_analysis/protocol/null/Null.h
@@ -2,8 +2,8 @@
 
 #pragma once
 
-#include <packet_analysis/Analyzer.h>
-#include <packet_analysis/Component.h>
+#include "zeek/packet_analysis/Analyzer.h"
+#include "zeek/packet_analysis/Component.h"
 
 namespace zeek::packet_analysis::Null {
 
diff --git a/src/packet_analysis/protocol/null/Plugin.cc b/src/packet_analysis/protocol/null/Plugin.cc
index ab568641db..9780ffc000 100644
--- a/src/packet_analysis/protocol/null/Plugin.cc
+++ b/src/packet_analysis/protocol/null/Plugin.cc
@@ -1,8 +1,8 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "plugin/Plugin.h"
-#include "Null.h"
-#include "packet_analysis/Component.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/packet_analysis/Component.h"
+#include "zeek/packet_analysis/protocol/null/Null.h"
 
 namespace zeek::plugin::Zeek_Null {
 
diff --git a/src/packet_analysis/protocol/ppp_serial/PPPSerial.cc b/src/packet_analysis/protocol/ppp_serial/PPPSerial.cc
index 8ddf60ac82..90214f7b76 100644
--- a/src/packet_analysis/protocol/ppp_serial/PPPSerial.cc
+++ b/src/packet_analysis/protocol/ppp_serial/PPPSerial.cc
@@ -1,7 +1,6 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "PPPSerial.h"
-#include "NetVar.h"
+#include "zeek/packet_analysis/protocol/ppp_serial/PPPSerial.h"
 
 using namespace zeek::packet_analysis::PPPSerial;
 
diff --git a/src/packet_analysis/protocol/ppp_serial/PPPSerial.h b/src/packet_analysis/protocol/ppp_serial/PPPSerial.h
index 9029e1d378..f0c36a9f10 100644
--- a/src/packet_analysis/protocol/ppp_serial/PPPSerial.h
+++ b/src/packet_analysis/protocol/ppp_serial/PPPSerial.h
@@ -2,8 +2,8 @@
 
 #pragma once
 
-#include <packet_analysis/Analyzer.h>
-#include <packet_analysis/Component.h>
+#include "zeek/packet_analysis/Analyzer.h"
+#include "zeek/packet_analysis/Component.h"
 
 namespace zeek::packet_analysis::PPPSerial {
 
diff --git a/src/packet_analysis/protocol/ppp_serial/Plugin.cc b/src/packet_analysis/protocol/ppp_serial/Plugin.cc
index e45923c311..ae842448f1 100644
--- a/src/packet_analysis/protocol/ppp_serial/Plugin.cc
+++ b/src/packet_analysis/protocol/ppp_serial/Plugin.cc
@@ -1,8 +1,8 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "PPPSerial.h"
-#include "plugin/Plugin.h"
-#include "packet_analysis/Component.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/packet_analysis/Component.h"
+#include "zeek/packet_analysis/protocol/ppp_serial/PPPSerial.h"
 
 namespace zeek::plugin::Zeek_PPPSerial {
 
diff --git a/src/packet_analysis/protocol/pppoe/PPPoE.cc b/src/packet_analysis/protocol/pppoe/PPPoE.cc
index 8a7454479d..7eac6d5736 100644
--- a/src/packet_analysis/protocol/pppoe/PPPoE.cc
+++ b/src/packet_analysis/protocol/pppoe/PPPoE.cc
@@ -1,7 +1,6 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "PPPoE.h"
-#include "NetVar.h"
+#include "zeek/packet_analysis/protocol/pppoe/PPPoE.h"
 
 using namespace zeek::packet_analysis::PPPoE;
 
diff --git a/src/packet_analysis/protocol/pppoe/PPPoE.h b/src/packet_analysis/protocol/pppoe/PPPoE.h
index cb21a80760..166196f108 100644
--- a/src/packet_analysis/protocol/pppoe/PPPoE.h
+++ b/src/packet_analysis/protocol/pppoe/PPPoE.h
@@ -2,8 +2,8 @@
 
 #pragma once
 
-#include <packet_analysis/Analyzer.h>
-#include <packet_analysis/Component.h>
+#include "zeek/packet_analysis/Analyzer.h"
+#include "zeek/packet_analysis/Component.h"
 
 namespace zeek::packet_analysis::PPPoE {
 
diff --git a/src/packet_analysis/protocol/pppoe/Plugin.cc b/src/packet_analysis/protocol/pppoe/Plugin.cc
index b70e7e5af1..1e306d3853 100644
--- a/src/packet_analysis/protocol/pppoe/Plugin.cc
+++ b/src/packet_analysis/protocol/pppoe/Plugin.cc
@@ -1,8 +1,8 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "PPPoE.h"
-#include "plugin/Plugin.h"
-#include "packet_analysis/Component.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/packet_analysis/Component.h"
+#include "zeek/packet_analysis/protocol/pppoe/PPPoE.h"
 
 namespace zeek::plugin::Zeek_PPPoE {
 
diff --git a/src/packet_analysis/protocol/root/Plugin.cc b/src/packet_analysis/protocol/root/Plugin.cc
index 1d3432b627..14cd4cebef 100644
--- a/src/packet_analysis/protocol/root/Plugin.cc
+++ b/src/packet_analysis/protocol/root/Plugin.cc
@@ -1,8 +1,8 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "Root.h"
-#include "plugin/Plugin.h"
-#include "packet_analysis/Component.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/packet_analysis/Component.h"
+#include "zeek/packet_analysis/protocol/root/Root.h"
 
 namespace zeek::plugin::Zeek_Root {
 
diff --git a/src/packet_analysis/protocol/root/Root.cc b/src/packet_analysis/protocol/root/Root.cc
index 21ad3eec7e..aaa73c8fa1 100644
--- a/src/packet_analysis/protocol/root/Root.cc
+++ b/src/packet_analysis/protocol/root/Root.cc
@@ -1,7 +1,6 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "Root.h"
-#include "NetVar.h"
+#include "zeek/packet_analysis/protocol/root/Root.h"
 
 using namespace zeek::packet_analysis::Root;
 
diff --git a/src/packet_analysis/protocol/root/Root.h b/src/packet_analysis/protocol/root/Root.h
index fc1543bbb8..637bba5fce 100644
--- a/src/packet_analysis/protocol/root/Root.h
+++ b/src/packet_analysis/protocol/root/Root.h
@@ -2,8 +2,8 @@
 
 #pragma once
 
-#include <packet_analysis/Analyzer.h>
-#include <packet_analysis/Component.h>
+#include "zeek/packet_analysis/Analyzer.h"
+#include "zeek/packet_analysis/Component.h"
 
 namespace zeek::packet_analysis::Root {
 
diff --git a/src/packet_analysis/protocol/skip/Plugin.cc b/src/packet_analysis/protocol/skip/Plugin.cc
index ed3d70a564..21c2416d0a 100644
--- a/src/packet_analysis/protocol/skip/Plugin.cc
+++ b/src/packet_analysis/protocol/skip/Plugin.cc
@@ -1,8 +1,8 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "Skip.h"
-#include "plugin/Plugin.h"
-#include "packet_analysis/Component.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/packet_analysis/Component.h"
+#include "zeek/packet_analysis/protocol/skip/Skip.h"
 
 namespace zeek::plugin::Zeek_Skip {
 
diff --git a/src/packet_analysis/protocol/skip/Skip.cc b/src/packet_analysis/protocol/skip/Skip.cc
index bb2a71330a..8cfbcea2c5 100644
--- a/src/packet_analysis/protocol/skip/Skip.cc
+++ b/src/packet_analysis/protocol/skip/Skip.cc
@@ -1,7 +1,6 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "Skip.h"
-#include "NetVar.h"
+#include "zeek/packet_analysis/protocol/skip/Skip.h"
 
 using namespace zeek::packet_analysis::Skip;
 
diff --git a/src/packet_analysis/protocol/skip/Skip.h b/src/packet_analysis/protocol/skip/Skip.h
index 544d2ac43a..dd45c668cb 100644
--- a/src/packet_analysis/protocol/skip/Skip.h
+++ b/src/packet_analysis/protocol/skip/Skip.h
@@ -2,8 +2,8 @@
 
 #pragma once
 
-#include <packet_analysis/Analyzer.h>
-#include <packet_analysis/Component.h>
+#include "zeek/packet_analysis/Analyzer.h"
+#include "zeek/packet_analysis/Component.h"
 
 namespace zeek::packet_analysis::Skip {
 
diff --git a/src/packet_analysis/protocol/vlan/Plugin.cc b/src/packet_analysis/protocol/vlan/Plugin.cc
index 7a6222c9b3..0a577a99da 100644
--- a/src/packet_analysis/protocol/vlan/Plugin.cc
+++ b/src/packet_analysis/protocol/vlan/Plugin.cc
@@ -1,8 +1,8 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "VLAN.h"
-#include "plugin/Plugin.h"
-#include "packet_analysis/Component.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/packet_analysis/Component.h"
+#include "zeek/packet_analysis/protocol/vlan/VLAN.h"
 
 namespace zeek::plugin::Zeek_VLAN {
 
diff --git a/src/packet_analysis/protocol/vlan/VLAN.cc b/src/packet_analysis/protocol/vlan/VLAN.cc
index 5dc3fe1874..2700d814db 100644
--- a/src/packet_analysis/protocol/vlan/VLAN.cc
+++ b/src/packet_analysis/protocol/vlan/VLAN.cc
@@ -1,7 +1,6 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "VLAN.h"
-#include "NetVar.h"
+#include "zeek/packet_analysis/protocol/vlan/VLAN.h"
 
 using namespace zeek::packet_analysis::VLAN;
 
diff --git a/src/packet_analysis/protocol/vlan/VLAN.h b/src/packet_analysis/protocol/vlan/VLAN.h
index bde045b552..32153d5972 100644
--- a/src/packet_analysis/protocol/vlan/VLAN.h
+++ b/src/packet_analysis/protocol/vlan/VLAN.h
@@ -2,8 +2,8 @@
 
 #pragma once
 
-#include <packet_analysis/Analyzer.h>
-#include <packet_analysis/Component.h>
+#include "zeek/packet_analysis/Analyzer.h"
+#include "zeek/packet_analysis/Component.h"
 
 namespace zeek::packet_analysis::VLAN {
 
diff --git a/src/packet_analysis/protocol/wrapper/Plugin.cc b/src/packet_analysis/protocol/wrapper/Plugin.cc
index c6e9fd5334..6b7f90c456 100644
--- a/src/packet_analysis/protocol/wrapper/Plugin.cc
+++ b/src/packet_analysis/protocol/wrapper/Plugin.cc
@@ -1,8 +1,8 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "Wrapper.h"
-#include "plugin/Plugin.h"
-#include "packet_analysis/Component.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/packet_analysis/Component.h"
+#include "zeek/packet_analysis/protocol/wrapper/Wrapper.h"
 
 namespace zeek::plugin::Zeek_Wrapper {
 
diff --git a/src/packet_analysis/protocol/wrapper/Wrapper.cc b/src/packet_analysis/protocol/wrapper/Wrapper.cc
index a08581aece..c17244b4dc 100644
--- a/src/packet_analysis/protocol/wrapper/Wrapper.cc
+++ b/src/packet_analysis/protocol/wrapper/Wrapper.cc
@@ -1,7 +1,6 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "Wrapper.h"
-#include "NetVar.h"
+#include "zeek/packet_analysis/protocol/wrapper/Wrapper.h"
 
 using namespace zeek::packet_analysis::Wrapper;
 
diff --git a/src/packet_analysis/protocol/wrapper/Wrapper.h b/src/packet_analysis/protocol/wrapper/Wrapper.h
index 28bc073832..d661901d31 100644
--- a/src/packet_analysis/protocol/wrapper/Wrapper.h
+++ b/src/packet_analysis/protocol/wrapper/Wrapper.h
@@ -2,8 +2,8 @@
 
 #pragma once
 
-#include <packet_analysis/Analyzer.h>
-#include <packet_analysis/Component.h>
+#include "zeek/packet_analysis/Analyzer.h"
+#include "zeek/packet_analysis/Component.h"
 
 namespace zeek::packet_analysis::Wrapper {
 
diff --git a/src/parse.y b/src/parse.y
index 83e57e8aa3..5b0f866d04 100644
--- a/src/parse.y
+++ b/src/parse.y
@@ -81,21 +81,21 @@
 #include <set>
 #include <string>
 
-#include "input.h"
-#include "ZeekList.h"
-#include "Desc.h"
-#include "Expr.h"
-#include "Func.h"
-#include "Stmt.h"
-#include "Val.h"
-#include "Var.h"
-#include "RE.h"
-#include "Scope.h"
-#include "Reporter.h"
-#include "ScriptCoverageManager.h"
-#include "zeekygen/Manager.h"
-#include "module_util.h"
-#include "IntrusivePtr.h"
+#include "zeek/input.h"
+#include "zeek/ZeekList.h"
+#include "zeek/Desc.h"
+#include "zeek/Expr.h"
+#include "zeek/Func.h"
+#include "zeek/Stmt.h"
+#include "zeek/Val.h"
+#include "zeek/Var.h"
+#include "zeek/RE.h"
+#include "zeek/Scope.h"
+#include "zeek/Reporter.h"
+#include "zeek/ScriptCoverageManager.h"
+#include "zeek/zeekygen/Manager.h"
+#include "zeek/module_util.h"
+#include "zeek/IntrusivePtr.h"
 
 extern const char* filename;  // Absolute path of file currently being parsed.
 extern const char* last_filename; // Absolute path of last file parsed.
diff --git a/src/patricia.c b/src/patricia.c
index 589fe8c24a..eb706a327d 100644
--- a/src/patricia.c
+++ b/src/patricia.c
@@ -69,7 +69,7 @@ static char copyright[] =
 #include <sys/types.h> /* for u_short, etc. */
 #include <stdbool.h>
 
-#include "patricia.h"
+#include "zeek/patricia.h"
 
 #define Delete free
 
diff --git a/src/plugin/Component.cc b/src/plugin/Component.cc
index a0bc21cfb8..ceb7760b4e 100644
--- a/src/plugin/Component.cc
+++ b/src/plugin/Component.cc
@@ -1,9 +1,9 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "Component.h"
+#include "zeek/plugin/Component.h"
 
-#include "../Desc.h"
-#include "../Reporter.h"
+#include "zeek/Desc.h"
+#include "zeek/Reporter.h"
 
 namespace zeek::plugin {
 
diff --git a/src/plugin/Component.h b/src/plugin/Component.h
index 52068f68ce..78219f1a67 100644
--- a/src/plugin/Component.h
+++ b/src/plugin/Component.h
@@ -8,7 +8,6 @@
 ZEEK_FORWARD_DECLARE_NAMESPACED(ODesc, zeek);
 
 namespace zeek::plugin {
-
 namespace component {
 
 /**
diff --git a/src/plugin/ComponentManager.h b/src/plugin/ComponentManager.h
index 6e62875c62..ae2cad1adb 100644
--- a/src/plugin/ComponentManager.h
+++ b/src/plugin/ComponentManager.h
@@ -4,13 +4,13 @@
 #include <list>
 #include <string>
 
-#include "Type.h"
-#include "Var.h" // for add_type()
-#include "Val.h"
-#include "Reporter.h"
-#include "Scope.h"
-#include "zeekygen/Manager.h"
-#include "DebugLogger.h"
+#include "zeek/Type.h"
+#include "zeek/Var.h" // for add_type()
+#include "zeek/Val.h"
+#include "zeek/Reporter.h"
+#include "zeek/Scope.h"
+#include "zeek/zeekygen/Manager.h"
+#include "zeek/DebugLogger.h"
 
 namespace zeek::plugin {
 
diff --git a/src/plugin/Manager.cc b/src/plugin/Manager.cc
index 51579b206e..6f20c7b516 100644
--- a/src/plugin/Manager.cc
+++ b/src/plugin/Manager.cc
@@ -1,22 +1,22 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include <optional>
-#include <sstream>
-#include <fstream>
+#include "zeek/plugin/Manager.h"
+
 #include <dirent.h>
 #include <glob.h>
 #include <dlfcn.h>
 #include <errno.h>
 #include <sys/stat.h>
+#include <optional>
+#include <sstream>
+#include <fstream>
 
-#include "Manager.h"
-
-#include "../Reporter.h"
-#include "../Func.h"
-#include "../Event.h"
-#include "../Val.h"
-#include "../util.h"
-#include "../input.h"
+#include "zeek/Reporter.h"
+#include "zeek/Func.h"
+#include "zeek/Event.h"
+#include "zeek/Val.h"
+#include "zeek/util.h"
+#include "zeek/input.h"
 
 using namespace std;
 
diff --git a/src/plugin/Manager.h b/src/plugin/Manager.h
index 4c9cf49449..d34c5db07e 100644
--- a/src/plugin/Manager.h
+++ b/src/plugin/Manager.h
@@ -6,11 +6,10 @@
 #include <map>
 #include <string_view>
 
-#include "Plugin.h"
-#include "Component.h"
-
-#include "../Reporter.h"
-#include "../ZeekArgs.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/plugin/Component.h"
+#include "zeek/Reporter.h"
+#include "zeek/ZeekArgs.h"
 
 namespace zeek {
 namespace plugin {
diff --git a/src/plugin/Plugin.cc b/src/plugin/Plugin.cc
index 86220803a1..dad677f976 100644
--- a/src/plugin/Plugin.cc
+++ b/src/plugin/Plugin.cc
@@ -1,21 +1,18 @@
-// See the file  in the main distribution directory for copyright.
-
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "Plugin.h"
+#include "zeek/plugin/Plugin.h"
 
 #include <cassert>
 
-#include "Manager.h"
-#include "Component.h"
-#include "Val.h"
-
-#include "../Desc.h"
-#include "../Event.h"
-#include "../Func.h"
-#include "../Conn.h"
-#include "../input.h"
-#include "threading/SerialTypes.h"
+#include "zeek/plugin/Manager.h"
+#include "zeek/plugin/Component.h"
+#include "zeek/Val.h"
+#include "zeek/Desc.h"
+#include "zeek/Event.h"
+#include "zeek/Func.h"
+#include "zeek/Conn.h"
+#include "zeek/input.h"
+#include "zeek/threading/SerialTypes.h"
 
 namespace zeek::plugin {
 
diff --git a/src/plugin/Plugin.h b/src/plugin/Plugin.h
index a81a124d61..1ca2ad1af6 100644
--- a/src/plugin/Plugin.h
+++ b/src/plugin/Plugin.h
@@ -2,13 +2,14 @@
 
 #pragma once
 
+#include "zeek-config.h"
+
 #include <list>
 #include <string>
 #include <utility>
 
-#include "zeek-config.h"
-#include "logging/WriterBackend.h"
-#include "ZeekArgs.h"
+#include "zeek/logging/WriterBackend.h"
+#include "zeek/ZeekArgs.h"
 
 // Increase this when making incompatible changes to the plugin API. Note
 // that the constant is never used in C code. It's picked up on by CMake.
diff --git a/src/probabilistic/BitVector.cc b/src/probabilistic/BitVector.cc
index 92014df714..3c57de3098 100644
--- a/src/probabilistic/BitVector.cc
+++ b/src/probabilistic/BitVector.cc
@@ -1,14 +1,13 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "BitVector.h"
+#include "zeek/probabilistic/BitVector.h"
 
-#include <broker/data.hh>
-
-#include <openssl/sha.h>
 #include <cassert>
 #include <limits>
+#include <openssl/sha.h>
+#include <broker/data.hh>
 
-#include "digest.h"
+#include "zeek/digest.h"
 
 namespace zeek::probabilistic::detail {
 
diff --git a/src/probabilistic/BitVector.h b/src/probabilistic/BitVector.h
index be6025fa18..93e9483d2b 100644
--- a/src/probabilistic/BitVector.h
+++ b/src/probabilistic/BitVector.h
@@ -2,12 +2,12 @@
 
 #pragma once
 
-#include <broker/expected.hh>
-
 #include <iterator>
 #include <memory>
 #include <vector>
 
+#include <broker/expected.hh>
+
 namespace broker { class data; }
 
 namespace zeek::probabilistic::detail {
diff --git a/src/probabilistic/BloomFilter.cc b/src/probabilistic/BloomFilter.cc
index 444f05325e..fe582fd089 100644
--- a/src/probabilistic/BloomFilter.cc
+++ b/src/probabilistic/BloomFilter.cc
@@ -1,6 +1,6 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "BloomFilter.h"
+#include "zeek/probabilistic/BloomFilter.h"
 
 #include <cmath>
 #include <limits>
@@ -8,10 +8,9 @@
 #include <broker/data.hh>
 #include <broker/error.hh>
 
-#include "CounterVector.h"
-
-#include "../util.h"
-#include "../Reporter.h"
+#include "zeek/probabilistic/CounterVector.h"
+#include "zeek/util.h"
+#include "zeek/Reporter.h"
 
 namespace zeek::probabilistic {
 
diff --git a/src/probabilistic/BloomFilter.h b/src/probabilistic/BloomFilter.h
index 3fbbce4511..efd1ff1193 100644
--- a/src/probabilistic/BloomFilter.h
+++ b/src/probabilistic/BloomFilter.h
@@ -10,8 +10,8 @@
 
 #include <broker/expected.hh>
 
-#include "BitVector.h"
-#include "Hasher.h"
+#include "zeek/probabilistic/BitVector.h"
+#include "zeek/probabilistic/Hasher.h"
 
 namespace broker { class data; }
 
diff --git a/src/probabilistic/CardinalityCounter.cc b/src/probabilistic/CardinalityCounter.cc
index 53f13da938..ce23db6b54 100644
--- a/src/probabilistic/CardinalityCounter.cc
+++ b/src/probabilistic/CardinalityCounter.cc
@@ -1,6 +1,6 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "CardinalityCounter.h"
+#include "zeek/probabilistic/CardinalityCounter.h"
 
 #include <math.h>
 #include <stdint.h>
@@ -8,7 +8,7 @@
 
 #include <broker/data.hh>
 
-#include "Reporter.h"
+#include "zeek/Reporter.h"
 
 namespace zeek::probabilistic::detail {
 
diff --git a/src/probabilistic/CardinalityCounter.h b/src/probabilistic/CardinalityCounter.h
index 025b540400..8f6091cce0 100644
--- a/src/probabilistic/CardinalityCounter.h
+++ b/src/probabilistic/CardinalityCounter.h
@@ -2,12 +2,12 @@
 
 #pragma once
 
-#include <broker/expected.hh>
+#include <stdint.h>
 
 #include <memory>
 #include <vector>
 
-#include <stdint.h>
+#include <broker/expected.hh>
 
 namespace broker { class data; }
 
diff --git a/src/probabilistic/CounterVector.cc b/src/probabilistic/CounterVector.cc
index e308ed0178..298746921c 100644
--- a/src/probabilistic/CounterVector.cc
+++ b/src/probabilistic/CounterVector.cc
@@ -1,6 +1,6 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "CounterVector.h"
+#include "zeek/probabilistic/CounterVector.h"
 
 #include <cassert>
 #include <limits>
@@ -8,8 +8,8 @@
 #include <broker/data.hh>
 #include <broker/error.hh>
 
-#include "BitVector.h"
-#include "util.h"
+#include "zeek/probabilistic/BitVector.h"
+#include "zeek/util.h"
 
 namespace zeek::probabilistic::detail {
 
diff --git a/src/probabilistic/Hasher.cc b/src/probabilistic/Hasher.cc
index 1abfb4ea27..96bf4e4f80 100644
--- a/src/probabilistic/Hasher.cc
+++ b/src/probabilistic/Hasher.cc
@@ -1,17 +1,15 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "Hasher.h"
+#include "zeek/probabilistic/Hasher.h"
 
 #include <typeinfo>
-
 #include <openssl/evp.h>
-
-#include "NetVar.h"
-#include "Var.h"
-#include "digest.h"
-#include "highwayhash/sip_hash.h"
-
 #include <broker/data.hh>
+#include <highwayhash/sip_hash.h>
+
+#include "zeek/NetVar.h"
+#include "zeek/Var.h"
+#include "zeek/digest.h"
 
 namespace zeek::probabilistic::detail {
 
diff --git a/src/probabilistic/Hasher.h b/src/probabilistic/Hasher.h
index 7506c62f91..66f0f0c231 100644
--- a/src/probabilistic/Hasher.h
+++ b/src/probabilistic/Hasher.h
@@ -2,11 +2,10 @@
 
 #pragma once
 
-#include "Hash.h"
-
+#include <memory>
 #include <broker/expected.hh>
 
-#include <memory>
+#include "zeek/Hash.h"
 
 namespace broker { class data; }
 
diff --git a/src/probabilistic/Topk.cc b/src/probabilistic/Topk.cc
index 8cd831e8c4..79a6389e9e 100644
--- a/src/probabilistic/Topk.cc
+++ b/src/probabilistic/Topk.cc
@@ -1,13 +1,13 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "probabilistic/Topk.h"
+#include "zeek/probabilistic/Topk.h"
 
 #include <broker/error.hh>
 
-#include "broker/Data.h"
-#include "CompHash.h"
-#include "Reporter.h"
-#include "Dict.h"
+#include "zeek/broker/Data.h"
+#include "zeek/CompHash.h"
+#include "zeek/Reporter.h"
+#include "zeek/Dict.h"
 
 namespace zeek::probabilistic::detail {
 
diff --git a/src/probabilistic/Topk.h b/src/probabilistic/Topk.h
index df2e6531fa..fca837c4e3 100644
--- a/src/probabilistic/Topk.h
+++ b/src/probabilistic/Topk.h
@@ -3,8 +3,8 @@
 #pragma once
 
 #include <list>
-#include "Val.h"
-#include "OpaqueVal.h"
+#include "zeek/Val.h"
+#include "zeek/OpaqueVal.h"
 
 // This class implements the top-k algorithm. Or - to be more precise - an
 // interpretation of it.
diff --git a/src/probabilistic/bloom-filter.bif b/src/probabilistic/bloom-filter.bif
index c5fb31f9b8..f38709b5ca 100644
--- a/src/probabilistic/bloom-filter.bif
+++ b/src/probabilistic/bloom-filter.bif
@@ -5,8 +5,8 @@
 // TODO: This is currently included from the top-level src directory, hence
 // paths are relative to there. We need a better mechanisms to pull in
 // BiFs defined in sub directories.
-#include "probabilistic/BloomFilter.h"
-#include "OpaqueVal.h"
+#include "zeek/probabilistic/BloomFilter.h"
+#include "zeek/OpaqueVal.h"
 
 using namespace probabilistic;
 
diff --git a/src/probabilistic/cardinality-counter.bif b/src/probabilistic/cardinality-counter.bif
index da1fd4baf3..9b5477f043 100644
--- a/src/probabilistic/cardinality-counter.bif
+++ b/src/probabilistic/cardinality-counter.bif
@@ -1,8 +1,8 @@
 ##! Functions to create and manipulate probabilistic cardinality counters.
 
 %%{
-#include "probabilistic/CardinalityCounter.h"
-#include "OpaqueVal.h"
+#include "zeek/probabilistic/CardinalityCounter.h"
+#include "zeek/OpaqueVal.h"
 
 using namespace probabilistic;
 %%}
diff --git a/src/probabilistic/top-k.bif b/src/probabilistic/top-k.bif
index 9695dcf26e..047b73c5a9 100644
--- a/src/probabilistic/top-k.bif
+++ b/src/probabilistic/top-k.bif
@@ -1,7 +1,7 @@
 ##! Functions to probabilistically determine top-k elements.
 
 %%{
-#include "probabilistic/Topk.h"
+#include "zeek/probabilistic/Topk.h"
 %%}
 
 ## Creates a top-k data structure which tracks *size* elements.
diff --git a/src/re-parse.y b/src/re-parse.y
index d6529734f1..dc4695d924 100644
--- a/src/re-parse.y
+++ b/src/re-parse.y
@@ -3,11 +3,11 @@
 %{
 #include <stdlib.h>
 
-#include "RE.h"
-#include "CCL.h"
-#include "NFA.h"
-#include "EquivClass.h"
-#include "Reporter.h"
+#include "zeek/RE.h"
+#include "zeek/CCL.h"
+#include "zeek/NFA.h"
+#include "zeek/EquivClass.h"
+#include "zeek/Reporter.h"
 
 int csize = 256;
 int syntax_error = 0;
diff --git a/src/re-scan.l b/src/re-scan.l
index 17ffd1879a..b2f17f9aae 100644
--- a/src/re-scan.l
+++ b/src/re-scan.l
@@ -5,10 +5,10 @@
  */
 
 %{
-#include "RE.h"
-#include "CCL.h"
-#include "NFA.h"
-#include "util.h"
+#include "zeek/RE.h"
+#include "zeek/CCL.h"
+#include "zeek/NFA.h"
+#include "zeek/util.h"
 
 #define yylval RE_lval
 
diff --git a/src/reporter.bif b/src/reporter.bif
index 7f273e965a..1aec934477 100644
--- a/src/reporter.bif
+++ b/src/reporter.bif
@@ -10,7 +10,7 @@
 module Reporter;
 
 %%{
-#include "NetVar.h"
+#include "zeek/NetVar.h"
 %%}
 
 ## Generates an informational message.
diff --git a/src/rule-parse.y b/src/rule-parse.y
index cb555c0c6d..d0ffa7c04e 100644
--- a/src/rule-parse.y
+++ b/src/rule-parse.y
@@ -1,14 +1,15 @@
 %{
+#include "zeek-config.h"
 #include <stdio.h>
 #include <netinet/in.h>
 #include <vector>
-#include "zeek-config.h"
-#include "RuleAction.h"
-#include "RuleCondition.h"
-#include "RuleMatcher.h"
-#include "Reporter.h"
-#include "IPAddr.h"
-#include "net_util.h"
+
+#include "zeek/RuleAction.h"
+#include "zeek/RuleCondition.h"
+#include "zeek/RuleMatcher.h"
+#include "zeek/Reporter.h"
+#include "zeek/IPAddr.h"
+#include "zeek/net_util.h"
 
 using namespace zeek::detail;
 
diff --git a/src/rule-scan.l b/src/rule-scan.l
index 8cf698563e..5874aac1a8 100644
--- a/src/rule-scan.l
+++ b/src/rule-scan.l
@@ -5,10 +5,12 @@
 #include <sys/socket.h>
 #include <netinet/in.h>
 #include <arpa/inet.h>
-#include "RuleMatcher.h"
-#include "RuleCondition.h"
-#include "IPAddr.h"
-#include "util.h"
+
+#include "zeek/RuleMatcher.h"
+#include "zeek/RuleCondition.h"
+#include "zeek/IPAddr.h"
+#include "zeek/util.h"
+
 #include "rule-parse.h"
 
 int rules_line_number = 0;
diff --git a/src/scan.l b/src/scan.l
index 941345557d..e80ef7ed68 100644
--- a/src/scan.l
+++ b/src/scan.l
@@ -15,31 +15,32 @@
 #include <unistd.h>
 #include <libgen.h>
 
-#include "input.h"
-#include "util.h"
-#include "Scope.h"
-#include "ZeekString.h"
-#include "DNS_Mgr.h"
-#include "Expr.h"
-#include "Func.h"
-#include "Stmt.h"
-#include "IntrusivePtr.h"
-#include "Val.h"
-#include "Var.h"
-#include "Debug.h"
-#include "PolicyFile.h"
+#include "zeek/input.h"
+#include "zeek/util.h"
+#include "zeek/Scope.h"
+#include "zeek/ZeekString.h"
+#include "zeek/DNS_Mgr.h"
+#include "zeek/Expr.h"
+#include "zeek/Func.h"
+#include "zeek/Stmt.h"
+#include "zeek/IntrusivePtr.h"
+#include "zeek/Val.h"
+#include "zeek/Var.h"
+#include "zeek/Debug.h"
+#include "zeek/PolicyFile.h"
+#include "zeek/Reporter.h"
+#include "zeek/RE.h"
+#include "zeek/RunState.h"
+#include "zeek/Traverse.h"
+#include "zeek/module_util.h"
+#include "zeek/ScannedFile.h"
+
+#include "zeek/analyzer/Analyzer.h"
+#include "zeek/zeekygen/Manager.h"
+
+#include "zeek/plugin/Manager.h"
+
 #include "broparse.h"
-#include "Reporter.h"
-#include "RE.h"
-#include "RunState.h"
-#include "Traverse.h"
-#include "module_util.h"
-#include "ScannedFile.h"
-
-#include "analyzer/Analyzer.h"
-#include "zeekygen/Manager.h"
-
-#include "plugin/Manager.h"
 
 using namespace zeek::detail;
 
diff --git a/src/setsignal.c b/src/setsignal.c
index d740cc8215..90bb5fd291 100644
--- a/src/setsignal.c
+++ b/src/setsignal.c
@@ -14,7 +14,7 @@
 #include <string.h>
 #endif
 
-#include "setsignal.h"
+#include "zeek/setsignal.h"
 
 /*
  * An os independent signal() with BSD semantics, e.g. the signal
@@ -50,4 +50,3 @@ RETSIGTYPE
 #endif
 #endif
 }
-
diff --git a/src/stats.bif b/src/stats.bif
index 805d4a832f..a1dcedce7c 100644
--- a/src/stats.bif
+++ b/src/stats.bif
@@ -1,8 +1,8 @@
 
 %%{ // C segment
-#include "util.h"
-#include "threading/Manager.h"
-#include "broker/Manager.h"
+#include "zeek/util.h"
+#include "zeek/threading/Manager.h"
+#include "zeek/broker/Manager.h"
 
 zeek::RecordTypePtr ProcStats;
 zeek::RecordTypePtr NetStats;
diff --git a/src/strings.bif b/src/strings.bif
index c2c90e5059..ecabe195c8 100644
--- a/src/strings.bif
+++ b/src/strings.bif
@@ -6,9 +6,10 @@
 #include <vector>
 #include <algorithm>
 #include <cctype>
-using namespace std;
 
-#include "SmithWaterman.h"
+#include "zeek/SmithWaterman.h"
+
+using namespace std;
 %%}
 
 ## Calculates the Levenshtein distance between the two strings. See `Wikipedia
diff --git a/src/supervisor/Supervisor.cc b/src/supervisor/Supervisor.cc
index e03131576f..38eda9dcd0 100644
--- a/src/supervisor/Supervisor.cc
+++ b/src/supervisor/Supervisor.cc
@@ -1,6 +1,7 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "Supervisor.h"
+#include "zeek-config.h"
+#include "zeek/supervisor/Supervisor.h"
 
 #include <sys/types.h>
 #include <sys/wait.h>
@@ -15,29 +16,28 @@
 #include <variant>
 #include <utility>
 
-#include "iosource/Manager.h"
-#include "ZeekString.h"
-#include "Dict.h"
-#include "RE.h"
-#include "Reporter.h"
-#include "Scope.h"
-#include "DebugLogger.h"
-#include "ID.h"
-#include "Val.h"
-#include "RunState.h"
-#include "NetVar.h"
-#include "zeek-config.h"
-#include "util.h"
-#include "input.h"
-#include "zeek-affinity.h"
-
 #define RAPIDJSON_HAS_STDSTRING 1
-#include "rapidjson/document.h"
+#include <rapidjson/document.h>
 
 extern "C" {
-#include "setsignal.h"
+#include "zeek/setsignal.h"
 }
 
+#include "zeek/iosource/Manager.h"
+#include "zeek/ZeekString.h"
+#include "zeek/Dict.h"
+#include "zeek/RE.h"
+#include "zeek/Reporter.h"
+#include "zeek/Scope.h"
+#include "zeek/DebugLogger.h"
+#include "zeek/ID.h"
+#include "zeek/Val.h"
+#include "zeek/RunState.h"
+#include "zeek/NetVar.h"
+#include "zeek/util.h"
+#include "zeek/input.h"
+#include "zeek/zeek-affinity.h"
+
 #ifdef DEBUG
 #define DBG_STEM(args...) stem->LogDebug(args);
 #else
diff --git a/src/supervisor/Supervisor.h b/src/supervisor/Supervisor.h
index 75490dd1b4..5dbc878207 100644
--- a/src/supervisor/Supervisor.h
+++ b/src/supervisor/Supervisor.h
@@ -13,14 +13,14 @@
 #include <chrono>
 #include <map>
 
-#include "iosource/IOSource.h"
-#include "Timer.h"
-#include "Pipe.h"
-#include "Flare.h"
-#include "Func.h"
-#include "NetVar.h"
-#include "IntrusivePtr.h"
-#include "Options.h"
+#include "zeek/iosource/IOSource.h"
+#include "zeek/Timer.h"
+#include "zeek/Pipe.h"
+#include "zeek/Flare.h"
+#include "zeek/Func.h"
+#include "zeek/NetVar.h"
+#include "zeek/IntrusivePtr.h"
+#include "zeek/Options.h"
 
 namespace zeek {
 namespace detail {
diff --git a/src/supervisor/supervisor.bif b/src/supervisor/supervisor.bif
index 9782b446c4..4dd1909519 100644
--- a/src/supervisor/supervisor.bif
+++ b/src/supervisor/supervisor.bif
@@ -1,7 +1,7 @@
 ##! The BIFs that define the Zeek supervisor control interface.
 
 %%{
-#include "supervisor/Supervisor.h"
+#include "zeek/supervisor/Supervisor.h"
 %%}
 
 module Supervisor;
diff --git a/src/threading/BasicThread.cc b/src/threading/BasicThread.cc
index 56187bd936..46a0730ae4 100644
--- a/src/threading/BasicThread.cc
+++ b/src/threading/BasicThread.cc
@@ -1,11 +1,11 @@
+#include "zeek-config.h"
+#include "zeek/threading/BasicThread.h"
 
 #include <signal.h>
 #include <pthread.h>
 
-#include "zeek-config.h"
-#include "BasicThread.h"
-#include "Manager.h"
-#include "util.h"
+#include "zeek/threading/Manager.h"
+#include "zeek/util.h"
 
 namespace zeek::threading {
 
diff --git a/src/threading/Formatter.cc b/src/threading/Formatter.cc
index ad454ae1d6..688b2779c2 100644
--- a/src/threading/Formatter.cc
+++ b/src/threading/Formatter.cc
@@ -1,12 +1,12 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
-#include "Formatter.h"
+#include "zeek/threading/Formatter.h"
 
 #include <errno.h>
 
-#include "MsgThread.h"
-#include "bro_inet_ntop.h"
+#include "zeek/threading/MsgThread.h"
+#include "zeek/bro_inet_ntop.h"
 
 using zeek::threading::Value;
 using zeek::threading::Field;
diff --git a/src/threading/Formatter.h b/src/threading/Formatter.h
index 37b83727cc..66a1ee3224 100644
--- a/src/threading/Formatter.h
+++ b/src/threading/Formatter.h
@@ -4,8 +4,8 @@
 
 #include <string>
 
-#include "Type.h"
-#include "SerialTypes.h"
+#include "zeek/Type.h"
+#include "zeek/threading/SerialTypes.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(MsgThread, zeek, threading);
 
diff --git a/src/threading/Manager.cc b/src/threading/Manager.cc
index b1c8f70417..b342238044 100644
--- a/src/threading/Manager.cc
+++ b/src/threading/Manager.cc
@@ -1,13 +1,13 @@
-#include "Manager.h"
+#include "zeek/threading/Manager.h"
 
 #include <sys/socket.h>
 #include <unistd.h>
 
-#include "NetVar.h"
-#include "iosource/Manager.h"
-#include "Event.h"
-#include "IPAddr.h"
-#include "RunState.h"
+#include "zeek/NetVar.h"
+#include "zeek/iosource/Manager.h"
+#include "zeek/Event.h"
+#include "zeek/IPAddr.h"
+#include "zeek/RunState.h"
 
 namespace zeek::threading {
 namespace detail {
diff --git a/src/threading/Manager.h b/src/threading/Manager.h
index 5ce2797862..3cee178827 100644
--- a/src/threading/Manager.h
+++ b/src/threading/Manager.h
@@ -1,12 +1,11 @@
-
 #pragma once
 
-#include "MsgThread.h"
-#include "Timer.h"
-
 #include <list>
 #include <utility>
 
+#include "zeek/threading/MsgThread.h"
+#include "zeek/Timer.h"
+
 namespace zeek {
 namespace threading {
 namespace detail {
diff --git a/src/threading/MsgThread.cc b/src/threading/MsgThread.cc
index bcce6712ee..d1b55936b4 100644
--- a/src/threading/MsgThread.cc
+++ b/src/threading/MsgThread.cc
@@ -1,13 +1,13 @@
+#include "zeek/threading/MsgThread.h"
+
 #include <unistd.h>
 #include <signal.h>
 #include <fcntl.h>
 
-#include "DebugLogger.h"
-
-#include "MsgThread.h"
-#include "Manager.h"
-#include "iosource/Manager.h"
-#include "RunState.h"
+#include "zeek/DebugLogger.h"
+#include "zeek/threading/Manager.h"
+#include "zeek/iosource/Manager.h"
+#include "zeek/RunState.h"
 
 // Set by Zeek's main signal handler.
 extern int signal_val;
diff --git a/src/threading/MsgThread.h b/src/threading/MsgThread.h
index 5c66429281..3e57c7ddac 100644
--- a/src/threading/MsgThread.h
+++ b/src/threading/MsgThread.h
@@ -1,12 +1,10 @@
-
 #pragma once
 
-#include "DebugLogger.h"
-
-#include "BasicThread.h"
-#include "Queue.h"
-#include "iosource/IOSource.h"
-#include "Flare.h"
+#include "zeek/DebugLogger.h"
+#include "zeek/threading/BasicThread.h"
+#include "zeek/threading/Queue.h"
+#include "zeek/iosource/IOSource.h"
+#include "zeek/Flare.h"
 
 namespace zeek::threading {
 	struct Value;
diff --git a/src/threading/Queue.h b/src/threading/Queue.h
index 0d44a9c62c..8ac86320cc 100644
--- a/src/threading/Queue.h
+++ b/src/threading/Queue.h
@@ -7,8 +7,8 @@
 #include <stdint.h>
 #include <sys/time.h>
 
-#include "Reporter.h"
-#include "BasicThread.h"
+#include "zeek/Reporter.h"
+#include "zeek/threading/BasicThread.h"
 
 #undef Queue // Defined elsewhere unfortunately.
 
diff --git a/src/threading/SerialTypes.cc b/src/threading/SerialTypes.cc
index b6277281c2..231f04b2d4 100644
--- a/src/threading/SerialTypes.cc
+++ b/src/threading/SerialTypes.cc
@@ -1,18 +1,18 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
+#include "zeek/threading/SerialTypes.h"
 
-#include "SerialTypes.h"
-#include "SerializationFormat.h"
-#include "Reporter.h"
+#include "zeek/SerializationFormat.h"
+#include "zeek/Reporter.h"
 // The following are required for ValueToVal.
-#include "Val.h"
-#include "ZeekString.h"
-#include "RE.h"
-#include "module_util.h"
-#include "ID.h"
-#include "Expr.h"
-#include "Scope.h"
-#include "IPAddr.h"
+#include "zeek/Val.h"
+#include "zeek/ZeekString.h"
+#include "zeek/RE.h"
+#include "zeek/module_util.h"
+#include "zeek/ID.h"
+#include "zeek/Expr.h"
+#include "zeek/Scope.h"
+#include "zeek/IPAddr.h"
 
 namespace zeek::threading {
 
diff --git a/src/threading/SerialTypes.h b/src/threading/SerialTypes.h
index 92095341ab..d709e840e8 100644
--- a/src/threading/SerialTypes.h
+++ b/src/threading/SerialTypes.h
@@ -6,8 +6,8 @@
 #include <netinet/in.h>
 #include <arpa/inet.h>
 
-#include "Type.h"
-#include "net_util.h"
+#include "zeek/Type.h"
+#include "zeek/net_util.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(SerializationFormat, zeek::detail);
 
diff --git a/src/threading/formatters/Ascii.cc b/src/threading/formatters/Ascii.cc
index aaf648c96a..b9075f97da 100644
--- a/src/threading/formatters/Ascii.cc
+++ b/src/threading/formatters/Ascii.cc
@@ -1,13 +1,13 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
+#include "threading/formatters/Ascii.h"
 
-#include "Ascii.h"
-#include "Desc.h"
-#include "threading/MsgThread.h"
-
-#include <sstream>
 #include <errno.h>
+#include <sstream>
+
+#include "zeek/Desc.h"
+#include "zeek/threading/MsgThread.h"
 
 using namespace std;
 
diff --git a/src/threading/formatters/Ascii.h b/src/threading/formatters/Ascii.h
index 79eacc947b..c2d6218af2 100644
--- a/src/threading/formatters/Ascii.h
+++ b/src/threading/formatters/Ascii.h
@@ -2,7 +2,7 @@
 
 #pragma once
 
-#include "../Formatter.h"
+#include "zeek/threading/Formatter.h"
 
 namespace zeek::threading::formatter {
 
diff --git a/src/threading/formatters/JSON.cc b/src/threading/formatters/JSON.cc
index 959b285fab..2c09963071 100644
--- a/src/threading/formatters/JSON.cc
+++ b/src/threading/formatters/JSON.cc
@@ -1,20 +1,21 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
-
-#include "JSON.h"
-#include "rapidjson/internal/ieee754.h"
-#include "Desc.h"
-#include "threading/MsgThread.h"
+#include "zeek/threading/formatters/JSON.h"
 
 #ifndef __STDC_LIMIT_MACROS
 #define __STDC_LIMIT_MACROS
 #endif
 
-#include <sstream>
 #include <errno.h>
 #include <math.h>
 #include <stdint.h>
+#include <sstream>
+
+#include <rapidjson/internal/ieee754.h>
+
+#include "zeek/Desc.h"
+#include "zeek/threading/MsgThread.h"
 
 namespace zeek::threading::formatter {
 
diff --git a/src/threading/formatters/JSON.h b/src/threading/formatters/JSON.h
index 3eb7e1a002..630da6b306 100644
--- a/src/threading/formatters/JSON.h
+++ b/src/threading/formatters/JSON.h
@@ -3,10 +3,10 @@
 #pragma once
 
 #define RAPIDJSON_HAS_STDSTRING 1
-#include "rapidjson/document.h"
-#include "rapidjson/writer.h"
+#include <rapidjson/document.h>
+#include <rapidjson/writer.h>
 
-#include "../Formatter.h"
+#include "zeek/threading/Formatter.h"
 
 namespace zeek::threading::formatter {
 
diff --git a/src/util.cc b/src/util.cc
index 21144ff7ec..dd723492bf 100644
--- a/src/util.cc
+++ b/src/util.cc
@@ -1,9 +1,10 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
-#include "util.h"
 #include "util-config.h"
 
+#include "zeek/util.h"
+
 #ifdef TIME_WITH_SYS_TIME
 # include <sys/time.h>
 # include <time.h>
@@ -39,28 +40,6 @@
 # include <malloc.h>
 #endif
 
-#include <string>
-#include <array>
-#include <vector>
-#include <algorithm>
-#include <iostream>
-
-#include "Desc.h"
-#include "Dict.h"
-#include "digest.h"
-#include "input.h"
-#include "Obj.h"
-#include "Val.h"
-#include "NetVar.h"
-#include "RunState.h"
-#include "Reporter.h"
-#include "iosource/Manager.h"
-#include "iosource/PktSrc.h"
-#include "ConvertUTF.h"
-#include "Hash.h"
-
-#include "3rdparty/doctest.h"
-
 #ifdef __linux__
 #if __has_include(<sys/random.h>)
 #define HAVE_GETRANDOM
@@ -68,6 +47,28 @@
 #endif
 #endif
 
+#include <string>
+#include <array>
+#include <vector>
+#include <algorithm>
+#include <iostream>
+
+#include "zeek/3rdparty/doctest.h"
+
+#include "zeek/Desc.h"
+#include "zeek/Dict.h"
+#include "zeek/digest.h"
+#include "zeek/input.h"
+#include "zeek/Obj.h"
+#include "zeek/Val.h"
+#include "zeek/NetVar.h"
+#include "zeek/RunState.h"
+#include "zeek/Reporter.h"
+#include "zeek/iosource/Manager.h"
+#include "zeek/iosource/PktSrc.h"
+#include "zeek/ConvertUTF.h"
+#include "zeek/Hash.h"
+
 using namespace std;
 
 extern const char* proc_status_file;
diff --git a/src/util.h b/src/util.h
index f49d841be9..f70dcc0a3d 100644
--- a/src/util.h
+++ b/src/util.h
@@ -2,6 +2,8 @@
 
 #pragma once
 
+#include "zeek-config.h"
+
 // Expose C99 functionality from inttypes.h, which would otherwise not be
 // available in C++.
 #ifndef __STDC_FORMAT_MACROS
@@ -12,6 +14,12 @@
 #define __STDC_LIMIT_MACROS
 #endif
 
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <stdarg.h>
+#include <libgen.h>
+
 #include <cinttypes>
 #include <cstdint>
 
@@ -19,15 +27,8 @@
 #include <string_view>
 #include <array>
 #include <vector>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <stdarg.h>
-#include <libgen.h>
 #include <memory> // std::unique_ptr
 
-#include "zeek-config.h"
-
 #ifdef DEBUG
 
 #include <assert.h>
@@ -94,7 +95,7 @@ typedef int32_t ptr_compat_int [[deprecated("Remove in v4.1. Use std::intptr_t")
 
 extern "C"
 	{
-	#include "modp_numtoa.h"
+	#include "zeek/modp_numtoa.h"
 	}
 
 using bro_int_t = int64_t;
diff --git a/src/zeek-bif.h b/src/zeek-bif.h
index 7af9c1a6d3..03b48d6b4c 100644
--- a/src/zeek-bif.h
+++ b/src/zeek-bif.h
@@ -1,10 +1,10 @@
 #pragma once
 
 // Headers to include by generated BiF code.
-#include "Conn.h"
-#include "NetVar.h"
-#include "Event.h"
-#include "Reporter.h"
-#include "ID.h"
-#include "EventRegistry.h"
-#include "BifReturnVal.h"
+#include "zeek/Conn.h"
+#include "zeek/NetVar.h"
+#include "zeek/Event.h"
+#include "zeek/Reporter.h"
+#include "zeek/ID.h"
+#include "zeek/EventRegistry.h"
+#include "zeek/BifReturnVal.h"
diff --git a/src/zeek-setup.cc b/src/zeek-setup.cc
index c7ae181e92..2c0aece6bf 100644
--- a/src/zeek-setup.cc
+++ b/src/zeek-setup.cc
@@ -1,7 +1,7 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
-#include "zeek-setup.h"
+#include "zeek/zeek-setup.h"
 
 #include <stdio.h>
 #include <stdlib.h>
@@ -21,55 +21,59 @@ extern "C" {
 #include <openssl/ssl.h>
 #include <openssl/err.h>
 
-#include "Options.h"
-#include "input.h"
-#include "DNS_Mgr.h"
-#include "Frame.h"
-#include "Scope.h"
-#include "Event.h"
-#include "File.h"
-#include "Reporter.h"
-#include "RunState.h"
-#include "NetVar.h"
-#include "Var.h"
-#include "Timer.h"
-#include "Stmt.h"
-#include "Desc.h"
-#include "Debug.h"
-#include "DFA.h"
-#include "RuleMatcher.h"
-#include "Anon.h"
-#include "EventRegistry.h"
-#include "Stats.h"
-#include "ScriptCoverageManager.h"
-#include "Traverse.h"
-#include "Trigger.h"
-#include "Hash.h"
-#include "Func.h"
-#include "ScannedFile.h"
-#include "Frag.h"
-
-#include "supervisor/Supervisor.h"
-#include "threading/Manager.h"
-#include "input/Manager.h"
-#include "logging/Manager.h"
-#include "input/readers/raw/Raw.h"
-#include "analyzer/Manager.h"
-#include "analyzer/Tag.h"
-#include "packet_analysis/Manager.h"
-#include "plugin/Manager.h"
-#include "file_analysis/Manager.h"
-#include "zeekygen/Manager.h"
-#include "iosource/Manager.h"
-#include "broker/Manager.h"
-
-#include "binpac_zeek.h"
-#include "module_util.h"
-
-#include "3rdparty/sqlite3.h"
+#include "zeek/3rdparty/sqlite3.h"
 
 #define DOCTEST_CONFIG_IMPLEMENT
-#include "3rdparty/doctest.h"
+#include "zeek/3rdparty/doctest.h"
+
+#include "zeek/Options.h"
+#include "zeek/input.h"
+#include "zeek/DNS_Mgr.h"
+#include "zeek/Frame.h"
+#include "zeek/Scope.h"
+#include "zeek/Event.h"
+#include "zeek/File.h"
+#include "zeek/Reporter.h"
+#include "zeek/RunState.h"
+#include "zeek/NetVar.h"
+#include "zeek/Var.h"
+#include "zeek/Timer.h"
+#include "zeek/Stmt.h"
+#include "zeek/Desc.h"
+#include "zeek/Debug.h"
+#include "zeek/DFA.h"
+#include "zeek/RuleMatcher.h"
+#include "zeek/Anon.h"
+#include "zeek/EventRegistry.h"
+#include "zeek/Stats.h"
+#include "zeek/ScriptCoverageManager.h"
+#include "zeek/Traverse.h"
+#include "zeek/Trigger.h"
+#include "zeek/Hash.h"
+#include "zeek/Func.h"
+#include "zeek/ScannedFile.h"
+#include "zeek/Frag.h"
+
+#include "zeek/supervisor/Supervisor.h"
+#include "zeek/threading/Manager.h"
+#include "zeek/input/Manager.h"
+#include "zeek/logging/Manager.h"
+#include "zeek/input/readers/raw/Raw.h"
+#include "zeek/analyzer/Manager.h"
+#include "zeek/analyzer/Tag.h"
+#include "zeek/packet_analysis/Manager.h"
+#include "zeek/plugin/Manager.h"
+#include "zeek/file_analysis/Manager.h"
+#include "zeek/zeekygen/Manager.h"
+#include "zeek/iosource/Manager.h"
+#include "zeek/broker/Manager.h"
+
+#include "zeek/binpac_zeek.h"
+#include "zeek/module_util.h"
+
+extern "C" {
+#include "zeek/setsignal.h"
+};
 
 zeek::detail::ScriptCoverageManager zeek::detail::script_coverage_mgr;
 zeek::detail::ScriptCoverageManager& brofiler = zeek::detail::script_coverage_mgr;
@@ -80,10 +84,6 @@ char* strsep(char**, const char*);
 };
 #endif
 
-extern "C" {
-#include "setsignal.h"
-};
-
 #ifdef USE_PERFTOOLS_DEBUG
 HeapLeakChecker* heap_checker = 0;
 int perftools_leaks = 0;
diff --git a/src/zeek-setup.h b/src/zeek-setup.h
index 4b32772275..afba00fe19 100644
--- a/src/zeek-setup.h
+++ b/src/zeek-setup.h
@@ -2,7 +2,7 @@
 
 #pragma once
 
-#include "Options.h"
+#include "zeek/Options.h"
 
 namespace zeek::detail {
 
diff --git a/src/zeek.bif b/src/zeek.bif
index da727c44b7..87b15c23cd 100644
--- a/src/zeek.bif
+++ b/src/zeek.bif
@@ -16,18 +16,18 @@
 #include <cstdio>
 #include <time.h>
 
-#include "digest.h"
-#include "Reporter.h"
-#include "IPAddr.h"
-#include "util.h"
-#include "file_analysis/Manager.h"
-#include "iosource/Manager.h"
-#include "iosource/Packet.h"
-#include "iosource/PktSrc.h"
-#include "iosource/PktDumper.h"
-#include "IntrusivePtr.h"
-#include "input.h"
-#include "Hash.h"
+#include "zeek/digest.h"
+#include "zeek/Reporter.h"
+#include "zeek/IPAddr.h"
+#include "zeek/util.h"
+#include "zeek/file_analysis/Manager.h"
+#include "zeek/iosource/Manager.h"
+#include "zeek/iosource/Packet.h"
+#include "zeek/iosource/PktSrc.h"
+#include "zeek/iosource/PktDumper.h"
+#include "zeek/IntrusivePtr.h"
+#include "zeek/input.h"
+#include "zeek/Hash.h"
 
 using namespace std;
 
@@ -541,7 +541,7 @@ function piped_exec%(program: string, to_write: string%): bool
 	%}
 
 %%{
-#include "OpaqueVal.h"
+#include "zeek/OpaqueVal.h"
 %%}
 
 ## Computes the MD5 hash value of the provided list of arguments.
@@ -3519,8 +3519,8 @@ function dump_packet%(pkt: pcap_packet, file_name: string%) : bool
 	%}
 
 %%{
-#include "DNS_Mgr.h"
-#include "Trigger.h"
+#include "zeek/DNS_Mgr.h"
+#include "zeek/Trigger.h"
 
 class LookupHostCallback : public zeek::detail::DNS_Mgr::LookupCallback {
 public:
@@ -4302,7 +4302,7 @@ function file_mode%(mode: count%): string
 # ===========================================================================
 
 %%{
-#include "analyzer/Manager.h"
+#include "zeek/analyzer/Manager.h"
 %%}
 
 ## Disables the analyzer which raised the current event (if the analyzer
@@ -5095,7 +5095,7 @@ function __init_secondary_bifs%(%): bool
 
 
 %%{
-#include "Anon.h"
+#include "zeek/Anon.h"
 %%}
 
 ## Preserves the prefix of an IP address in anonymization.
diff --git a/src/zeek.pac b/src/zeek.pac
index d065490306..d53a23a4a8 100644
--- a/src/zeek.pac
+++ b/src/zeek.pac
@@ -1,5 +1,5 @@
 %extern{
-#include "binpac_zeek.h"
+#include "zeek/binpac_zeek.h"
 %}
 
 extern type ZeekAnalyzer;
diff --git a/src/zeekygen/Configuration.cc b/src/zeekygen/Configuration.cc
index 2c86c18d05..504f8a4db3 100644
--- a/src/zeekygen/Configuration.cc
+++ b/src/zeekygen/Configuration.cc
@@ -1,14 +1,14 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "Configuration.h"
-#include "utils.h"
-
-#include "Reporter.h"
+#include "zeek/zeekygen/Configuration.h"
 
+#include <errno.h>
 #include <fstream>
 #include <vector>
 #include <algorithm>
-#include <errno.h>
+
+#include "zeek/zeekygen/utils.h"
+#include "zeek/Reporter.h"
 
 using namespace std;
 
diff --git a/src/zeekygen/Configuration.h b/src/zeekygen/Configuration.h
index fab76bd4d0..7264dc9ed8 100644
--- a/src/zeekygen/Configuration.h
+++ b/src/zeekygen/Configuration.h
@@ -2,12 +2,11 @@
 
 #pragma once
 
-#include "Target.h"
-
+#include <time.h> // for time_t
 #include <string>
 #include <vector>
 
-#include <time.h> // for time_t
+#include "zeek/zeekygen/Target.h"
 
 namespace zeek::zeekygen::detail {
 
diff --git a/src/zeekygen/IdentifierInfo.cc b/src/zeekygen/IdentifierInfo.cc
index df088c2bc6..1a105fd180 100644
--- a/src/zeekygen/IdentifierInfo.cc
+++ b/src/zeekygen/IdentifierInfo.cc
@@ -1,12 +1,12 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "IdentifierInfo.h"
-#include "ScriptInfo.h"
-#include "utils.h"
+#include "zeek/zeekygen/IdentifierInfo.h"
+#include "zeek/zeekygen/ScriptInfo.h"
+#include "zeek/zeekygen/utils.h"
 
-#include "Desc.h"
-#include "Val.h"
-#include "Expr.h"
+#include "zeek/Desc.h"
+#include "zeek/Val.h"
+#include "zeek/Expr.h"
 
 using namespace std;
 
diff --git a/src/zeekygen/IdentifierInfo.h b/src/zeekygen/IdentifierInfo.h
index 739fbc31f2..5c672f9547 100644
--- a/src/zeekygen/IdentifierInfo.h
+++ b/src/zeekygen/IdentifierInfo.h
@@ -8,10 +8,10 @@
 #include <list>
 #include <map>
 
-#include "Info.h"
-#include "IntrusivePtr.h"
-#include "ID.h"
-#include "util.h"
+#include "zeek/zeekygen/Info.h"
+#include "zeek/IntrusivePtr.h"
+#include "zeek/ID.h"
+#include "zeek/util.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(TypeDecl, zeek);
 
diff --git a/src/zeekygen/Manager.cc b/src/zeekygen/Manager.cc
index 0a85f8cb3f..5260b7fc3f 100644
--- a/src/zeekygen/Manager.cc
+++ b/src/zeekygen/Manager.cc
@@ -1,17 +1,17 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "Manager.h"
+#include "zeek/zeekygen/Manager.h"
 
 #include <utility>
 #include <cstdlib>
 
-#include "plugin/Manager.h"
-#include "util.h"
-#include "Info.h"
-#include "PackageInfo.h"
-#include "ScriptInfo.h"
-#include "IdentifierInfo.h"
-#include "Expr.h"
+#include "zeek/plugin/Manager.h"
+#include "zeek/util.h"
+#include "zeek/zeekygen/Info.h"
+#include "zeek/zeekygen/PackageInfo.h"
+#include "zeek/zeekygen/ScriptInfo.h"
+#include "zeek/zeekygen/IdentifierInfo.h"
+#include "zeek/Expr.h"
 
 using namespace std;
 
diff --git a/src/zeekygen/Manager.h b/src/zeekygen/Manager.h
index c0dbdd4e18..d86d1de8cf 100644
--- a/src/zeekygen/Manager.h
+++ b/src/zeekygen/Manager.h
@@ -9,11 +9,10 @@
 #include <map>
 #include <ctime>
 
-#include "Configuration.h"
-
-#include "Reporter.h"
-#include "ID.h"
-#include "util.h"
+#include "zeek/zeekygen/Configuration.h"
+#include "zeek/Reporter.h"
+#include "zeek/ID.h"
+#include "zeek/util.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(TypeDecl, zeek);
 ZEEK_FORWARD_DECLARE_NAMESPACED(PackageInfo, zeek, zeekygen, detail);
diff --git a/src/zeekygen/PackageInfo.cc b/src/zeekygen/PackageInfo.cc
index 32c907b2ab..c8b26af293 100644
--- a/src/zeekygen/PackageInfo.cc
+++ b/src/zeekygen/PackageInfo.cc
@@ -1,13 +1,13 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "PackageInfo.h"
-#include "utils.h"
-
-#include "Reporter.h"
+#include "zeek/zeekygen/PackageInfo.h"
 
 #include <fstream>
 #include <errno.h>
 
+#include "zeek/zeekygen/utils.h"
+#include "zeek/Reporter.h"
+
 using namespace std;
 
 namespace zeek::zeekygen::detail {
diff --git a/src/zeekygen/PackageInfo.h b/src/zeekygen/PackageInfo.h
index ff198230d1..91384f14c1 100644
--- a/src/zeekygen/PackageInfo.h
+++ b/src/zeekygen/PackageInfo.h
@@ -2,12 +2,11 @@
 
 #pragma once
 
-#include "Info.h"
-
+#include <time.h> // for time_t
 #include <string>
 #include <vector>
 
-#include <time.h> // for time_t
+#include "zeek/zeekygen/Info.h"
 
 namespace zeek::zeekygen::detail {
 
diff --git a/src/zeekygen/ReStructuredTextTable.cc b/src/zeekygen/ReStructuredTextTable.cc
index d78cad10a0..da97a78084 100644
--- a/src/zeekygen/ReStructuredTextTable.cc
+++ b/src/zeekygen/ReStructuredTextTable.cc
@@ -1,6 +1,6 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "ReStructuredTextTable.h"
+#include "zeek/zeekygen/ReStructuredTextTable.h"
 
 #include <assert.h>
 
diff --git a/src/zeekygen/ScriptInfo.cc b/src/zeekygen/ScriptInfo.cc
index 2e45df3abd..e0af67db78 100644
--- a/src/zeekygen/ScriptInfo.cc
+++ b/src/zeekygen/ScriptInfo.cc
@@ -1,16 +1,16 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "ScriptInfo.h"
-#include "IdentifierInfo.h"
-#include "ReStructuredTextTable.h"
-#include "utils.h"
-#include "Manager.h"
-#include "Scope.h"
-#include "DebugLogger.h"
+#include "zeek/zeekygen/ScriptInfo.h"
+#include "zeek/zeekygen/IdentifierInfo.h"
+#include "zeek/zeekygen/ReStructuredTextTable.h"
+#include "zeek/zeekygen/utils.h"
+#include "zeek/zeekygen/Manager.h"
 
-#include "Reporter.h"
-#include "Desc.h"
-#include "Type.h"
+#include "zeek/Scope.h"
+#include "zeek/DebugLogger.h"
+#include "zeek/Reporter.h"
+#include "zeek/Desc.h"
+#include "zeek/Type.h"
 
 using namespace std;
 
diff --git a/src/zeekygen/ScriptInfo.h b/src/zeekygen/ScriptInfo.h
index c2030d9489..4cbaf15766 100644
--- a/src/zeekygen/ScriptInfo.h
+++ b/src/zeekygen/ScriptInfo.h
@@ -3,15 +3,15 @@
 #pragma once
 
 #include "zeek-config.h"
-#include "Info.h"
 
+#include <time.h> // for time_t
 #include <set>
 #include <list>
 #include <string>
 #include <vector>
 #include <map>
 
-#include <time.h> // for time_t
+#include "zeek/zeekygen/Info.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(IdentifierInfo, zeek, zeekygen, detail);
 
diff --git a/src/zeekygen/Target.cc b/src/zeekygen/Target.cc
index 83c2e6a39b..d8e1779585 100644
--- a/src/zeekygen/Target.cc
+++ b/src/zeekygen/Target.cc
@@ -1,24 +1,25 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "Target.h"
-#include "Manager.h"
-#include "IdentifierInfo.h"
-#include "PackageInfo.h"
-#include "ScriptInfo.h"
-
-#include "util.h"
-#include "Reporter.h"
-#include "plugin/Manager.h"
-#include "analyzer/Manager.h"
-#include "analyzer/Component.h"
-#include "file_analysis/Manager.h"
-#include "packet_analysis/Manager.h"
+#include "zeek/zeekygen/Target.h"
 
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <fts.h>
 #include <unistd.h>
 
+#include "zeek/zeekygen/Manager.h"
+#include "zeek/zeekygen/IdentifierInfo.h"
+#include "zeek/zeekygen/PackageInfo.h"
+#include "zeek/zeekygen/ScriptInfo.h"
+
+#include "zeek/util.h"
+#include "zeek/Reporter.h"
+#include "zeek/plugin/Manager.h"
+#include "zeek/analyzer/Manager.h"
+#include "zeek/analyzer/Component.h"
+#include "zeek/file_analysis/Manager.h"
+#include "zeek/packet_analysis/Manager.h"
+
 using namespace std;
 
 namespace zeek::zeekygen::detail {
diff --git a/src/zeekygen/utils.cc b/src/zeekygen/utils.cc
index d4410f76ad..7966981713 100644
--- a/src/zeekygen/utils.cc
+++ b/src/zeekygen/utils.cc
@@ -1,14 +1,14 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "utils.h"
-#include "ID.h"
-#include "Scope.h"
-
-#include "Reporter.h"
+#include "zeek/zeekygen/utils.h"
 
 #include <sys/stat.h>
 #include <errno.h>
 
+#include "zeek/ID.h"
+#include "zeek/Scope.h"
+#include "zeek/Reporter.h"
+
 using namespace std;
 
 namespace zeek::zeekygen::detail {
diff --git a/src/zeekygen/zeekygen.bif b/src/zeekygen/zeekygen.bif
index 7da62e2203..3217c6bb13 100644
--- a/src/zeekygen/zeekygen.bif
+++ b/src/zeekygen/zeekygen.bif
@@ -3,11 +3,11 @@
 ##! Functions for querying script, package, or variable documentation.
 
 %%{
-#include "zeekygen/Manager.h"
-#include "zeekygen/IdentifierInfo.h"
-#include "zeekygen/PackageInfo.h"
-#include "zeekygen/ScriptInfo.h"
-#include "util.h"
+#include "zeek/zeekygen/Manager.h"
+#include "zeek/zeekygen/IdentifierInfo.h"
+#include "zeek/zeekygen/PackageInfo.h"
+#include "zeek/zeekygen/ScriptInfo.h"
+#include "zeek/util.h"
 
 static zeek::StringValPtr comments_to_val(const vector<string>& comments)
 	{