diff --git a/build.json b/build.json
index 0463e88..8003b58 100644
--- a/build.json
+++ b/build.json
@@ -69,6 +69,92 @@
         ]
     },
     "crypto": {
+        "hdrs": [
+            "include/openssl/aead.h",
+            "include/openssl/aes.h",
+            "include/openssl/arm_arch.h",
+            "include/openssl/asm_base.h",
+            "include/openssl/asn1.h",
+            "include/openssl/asn1_mac.h",
+            "include/openssl/asn1t.h",
+            "include/openssl/base.h",
+            "include/openssl/base64.h",
+            "include/openssl/bio.h",
+            "include/openssl/blake2.h",
+            "include/openssl/blowfish.h",
+            "include/openssl/bn.h",
+            "include/openssl/buf.h",
+            "include/openssl/buffer.h",
+            "include/openssl/bytestring.h",
+            "include/openssl/cast.h",
+            "include/openssl/chacha.h",
+            "include/openssl/cipher.h",
+            "include/openssl/cmac.h",
+            "include/openssl/conf.h",
+            "include/openssl/cpu.h",
+            "include/openssl/crypto.h",
+            "include/openssl/ctrdrbg.h",
+            "include/openssl/curve25519.h",
+            "include/openssl/des.h",
+            "include/openssl/dh.h",
+            "include/openssl/digest.h",
+            "include/openssl/dsa.h",
+            "include/openssl/e_os2.h",
+            "include/openssl/ec.h",
+            "include/openssl/ec_key.h",
+            "include/openssl/ecdh.h",
+            "include/openssl/ecdsa.h",
+            "include/openssl/engine.h",
+            "include/openssl/err.h",
+            "include/openssl/evp.h",
+            "include/openssl/evp_errors.h",
+            "include/openssl/ex_data.h",
+            "include/openssl/experimental/kyber.h",
+            "include/openssl/experimental/spx.h",
+            "include/openssl/hkdf.h",
+            "include/openssl/hmac.h",
+            "include/openssl/hpke.h",
+            "include/openssl/hrss.h",
+            "include/openssl/is_boringssl.h",
+            "include/openssl/kdf.h",
+            "include/openssl/lhash.h",
+            "include/openssl/md4.h",
+            "include/openssl/md5.h",
+            "include/openssl/mem.h",
+            "include/openssl/nid.h",
+            "include/openssl/obj.h",
+            "include/openssl/obj_mac.h",
+            "include/openssl/objects.h",
+            "include/openssl/opensslconf.h",
+            "include/openssl/opensslv.h",
+            "include/openssl/ossl_typ.h",
+            "include/openssl/pem.h",
+            "include/openssl/pkcs12.h",
+            "include/openssl/pkcs7.h",
+            "include/openssl/pkcs8.h",
+            "include/openssl/poly1305.h",
+            "include/openssl/pool.h",
+            "include/openssl/posix_time.h",
+            "include/openssl/rand.h",
+            "include/openssl/rc4.h",
+            "include/openssl/ripemd.h",
+            "include/openssl/rsa.h",
+            "include/openssl/safestack.h",
+            "include/openssl/service_indicator.h",
+            "include/openssl/sha.h",
+            "include/openssl/siphash.h",
+            "include/openssl/span.h",
+            "include/openssl/stack.h",
+            "include/openssl/target.h",
+            "include/openssl/thread.h",
+            "include/openssl/time.h",
+            "include/openssl/trust_token.h",
+            "include/openssl/type_check.h",
+            "include/openssl/x509.h",
+            "include/openssl/x509_vfy.h",
+            "include/openssl/x509v3.h",
+            "include/openssl/x509v3_errors.h"
+        ],
         "err_data": [
             "crypto/err/*.errordata"
         ],
@@ -133,6 +219,10 @@
             "pki/verify_error.cc",
             "pki/verify_name_match.cc",
             "pki/verify_signed_data.cc"
+        ],
+        "hdrs": [
+            "include/openssl/pki/certificate.h",
+            "include/openssl/pki/signature_verify_cache.h"
         ]
     },
     "ssl": {
@@ -175,6 +265,13 @@
             "ssl/tls13_client.cc",
             "ssl/tls13_enc.cc",
             "ssl/tls13_server.cc"
+        ],
+        "hdrs": [
+            "include/openssl/dtls1.h",
+            "include/openssl/srtp.h",
+            "include/openssl/ssl.h",
+            "include/openssl/ssl3.h",
+            "include/openssl/tls1.h"
         ]
     },
     "decrepit": {
diff --git a/gen/sources.cmake b/gen/sources.cmake
index e88cb24..efa91d4 100644
--- a/gen/sources.cmake
+++ b/gen/sources.cmake
@@ -176,6 +176,95 @@
 )
 
 set(
+  CRYPTO_HEADERS
+
+  include/openssl/aead.h
+  include/openssl/aes.h
+  include/openssl/arm_arch.h
+  include/openssl/asm_base.h
+  include/openssl/asn1.h
+  include/openssl/asn1_mac.h
+  include/openssl/asn1t.h
+  include/openssl/base.h
+  include/openssl/base64.h
+  include/openssl/bio.h
+  include/openssl/blake2.h
+  include/openssl/blowfish.h
+  include/openssl/bn.h
+  include/openssl/buf.h
+  include/openssl/buffer.h
+  include/openssl/bytestring.h
+  include/openssl/cast.h
+  include/openssl/chacha.h
+  include/openssl/cipher.h
+  include/openssl/cmac.h
+  include/openssl/conf.h
+  include/openssl/cpu.h
+  include/openssl/crypto.h
+  include/openssl/ctrdrbg.h
+  include/openssl/curve25519.h
+  include/openssl/des.h
+  include/openssl/dh.h
+  include/openssl/digest.h
+  include/openssl/dsa.h
+  include/openssl/e_os2.h
+  include/openssl/ec.h
+  include/openssl/ec_key.h
+  include/openssl/ecdh.h
+  include/openssl/ecdsa.h
+  include/openssl/engine.h
+  include/openssl/err.h
+  include/openssl/evp.h
+  include/openssl/evp_errors.h
+  include/openssl/ex_data.h
+  include/openssl/experimental/kyber.h
+  include/openssl/experimental/spx.h
+  include/openssl/hkdf.h
+  include/openssl/hmac.h
+  include/openssl/hpke.h
+  include/openssl/hrss.h
+  include/openssl/is_boringssl.h
+  include/openssl/kdf.h
+  include/openssl/lhash.h
+  include/openssl/md4.h
+  include/openssl/md5.h
+  include/openssl/mem.h
+  include/openssl/nid.h
+  include/openssl/obj.h
+  include/openssl/obj_mac.h
+  include/openssl/objects.h
+  include/openssl/opensslconf.h
+  include/openssl/opensslv.h
+  include/openssl/ossl_typ.h
+  include/openssl/pem.h
+  include/openssl/pkcs12.h
+  include/openssl/pkcs7.h
+  include/openssl/pkcs8.h
+  include/openssl/poly1305.h
+  include/openssl/pool.h
+  include/openssl/posix_time.h
+  include/openssl/rand.h
+  include/openssl/rc4.h
+  include/openssl/ripemd.h
+  include/openssl/rsa.h
+  include/openssl/safestack.h
+  include/openssl/service_indicator.h
+  include/openssl/sha.h
+  include/openssl/siphash.h
+  include/openssl/span.h
+  include/openssl/stack.h
+  include/openssl/target.h
+  include/openssl/thread.h
+  include/openssl/time.h
+  include/openssl/trust_token.h
+  include/openssl/type_check.h
+  include/openssl/x509.h
+  include/openssl/x509_vfy.h
+  include/openssl/x509v3.h
+  include/openssl/x509v3_errors.h
+)
+
+set(
   CRYPTO_SOURCES_ASM
 
   crypto/curve25519/asm/x25519-asm-arm.S
@@ -603,6 +692,13 @@
 )
 
 set(
+  PKI_HEADERS
+
+  include/openssl/pki/certificate.h
+  include/openssl/pki/signature_verify_cache.h
+)
+
+set(
   PKI_TEST_SOURCES
 
   crypto/test/gtest_main.cc
@@ -2086,6 +2182,16 @@
 )
 
 set(
+  SSL_HEADERS
+
+  include/openssl/dtls1.h
+  include/openssl/srtp.h
+  include/openssl/ssl.h
+  include/openssl/ssl3.h
+  include/openssl/tls1.h
+)
+
+set(
   SSL_TEST_SOURCES
 
   crypto/test/gtest_main.cc
diff --git a/gen/sources.json b/gen/sources.json
index d00a910..9c5f318 100644
--- a/gen/sources.json
+++ b/gen/sources.json
@@ -153,6 +153,92 @@
     "srcs": [
       "gen/crypto/err_data.c"
     ],
+    "hdrs": [
+      "include/openssl/aead.h",
+      "include/openssl/aes.h",
+      "include/openssl/arm_arch.h",
+      "include/openssl/asm_base.h",
+      "include/openssl/asn1.h",
+      "include/openssl/asn1_mac.h",
+      "include/openssl/asn1t.h",
+      "include/openssl/base.h",
+      "include/openssl/base64.h",
+      "include/openssl/bio.h",
+      "include/openssl/blake2.h",
+      "include/openssl/blowfish.h",
+      "include/openssl/bn.h",
+      "include/openssl/buf.h",
+      "include/openssl/buffer.h",
+      "include/openssl/bytestring.h",
+      "include/openssl/cast.h",
+      "include/openssl/chacha.h",
+      "include/openssl/cipher.h",
+      "include/openssl/cmac.h",
+      "include/openssl/conf.h",
+      "include/openssl/cpu.h",
+      "include/openssl/crypto.h",
+      "include/openssl/ctrdrbg.h",
+      "include/openssl/curve25519.h",
+      "include/openssl/des.h",
+      "include/openssl/dh.h",
+      "include/openssl/digest.h",
+      "include/openssl/dsa.h",
+      "include/openssl/e_os2.h",
+      "include/openssl/ec.h",
+      "include/openssl/ec_key.h",
+      "include/openssl/ecdh.h",
+      "include/openssl/ecdsa.h",
+      "include/openssl/engine.h",
+      "include/openssl/err.h",
+      "include/openssl/evp.h",
+      "include/openssl/evp_errors.h",
+      "include/openssl/ex_data.h",
+      "include/openssl/experimental/kyber.h",
+      "include/openssl/experimental/spx.h",
+      "include/openssl/hkdf.h",
+      "include/openssl/hmac.h",
+      "include/openssl/hpke.h",
+      "include/openssl/hrss.h",
+      "include/openssl/is_boringssl.h",
+      "include/openssl/kdf.h",
+      "include/openssl/lhash.h",
+      "include/openssl/md4.h",
+      "include/openssl/md5.h",
+      "include/openssl/mem.h",
+      "include/openssl/nid.h",
+      "include/openssl/obj.h",
+      "include/openssl/obj_mac.h",
+      "include/openssl/objects.h",
+      "include/openssl/opensslconf.h",
+      "include/openssl/opensslv.h",
+      "include/openssl/ossl_typ.h",
+      "include/openssl/pem.h",
+      "include/openssl/pkcs12.h",
+      "include/openssl/pkcs7.h",
+      "include/openssl/pkcs8.h",
+      "include/openssl/poly1305.h",
+      "include/openssl/pool.h",
+      "include/openssl/posix_time.h",
+      "include/openssl/rand.h",
+      "include/openssl/rc4.h",
+      "include/openssl/ripemd.h",
+      "include/openssl/rsa.h",
+      "include/openssl/safestack.h",
+      "include/openssl/service_indicator.h",
+      "include/openssl/sha.h",
+      "include/openssl/siphash.h",
+      "include/openssl/span.h",
+      "include/openssl/stack.h",
+      "include/openssl/target.h",
+      "include/openssl/thread.h",
+      "include/openssl/time.h",
+      "include/openssl/trust_token.h",
+      "include/openssl/type_check.h",
+      "include/openssl/x509.h",
+      "include/openssl/x509_vfy.h",
+      "include/openssl/x509v3.h",
+      "include/openssl/x509v3_errors.h"
+    ],
     "asm": [
       "crypto/curve25519/asm/x25519-asm-arm.S",
       "crypto/hrss/asm/poly_rq_mul.S",
@@ -566,6 +652,10 @@
       "pki/verify_error.cc",
       "pki/verify_name_match.cc",
       "pki/verify_signed_data.cc"
+    ],
+    "hdrs": [
+      "include/openssl/pki/certificate.h",
+      "include/openssl/pki/signature_verify_cache.h"
     ]
   },
   "pki_test": {
@@ -2044,6 +2134,13 @@
       "ssl/tls13_server.cc",
       "ssl/tls_method.cc",
       "ssl/tls_record.cc"
+    ],
+    "hdrs": [
+      "include/openssl/dtls1.h",
+      "include/openssl/srtp.h",
+      "include/openssl/ssl.h",
+      "include/openssl/ssl3.h",
+      "include/openssl/tls1.h"
     ]
   },
   "ssl_test": {
diff --git a/util/generate_build_files.py b/util/generate_build_files.py
index a54a614..c56cd2e 100644
--- a/util/generate_build_files.py
+++ b/util/generate_build_files.py
@@ -564,18 +564,6 @@
   return not is_dir or dent != 'runner'
 
 
-def SSLHeaderFiles(path, dent, is_dir):
-  return dent in ['ssl.h', 'tls1.h', 'ssl23.h', 'ssl3.h', 'dtls1.h', 'srtp.h']
-
-
-def CryptoHeaderFiles(path, dent, is_dir):
-  if SSLHeaderFiles(path, dent, is_dir):
-    return False
-  if is_dir and dent == 'pki':
-    return False
-  return True
-
-
 def FindCFiles(directory, filter_func):
   """Recurses through directory and returns a list of paths to all the C source
   files that pass filter_func."""
@@ -661,16 +649,7 @@
 
   fuzz_c_files = FindCFiles(os.path.join('src', 'fuzz'), NoTests)
 
-  ssl_h_files = FindHeaderFiles(os.path.join('src', 'include', 'openssl'),
-                                SSLHeaderFiles)
-
   pki_internal_h_files = FindHeaderFiles(os.path.join('src', 'pki'), AllFiles)
-
-  crypto_h_files = FindHeaderFiles(os.path.join('src', 'include', 'openssl'),
-                                   CryptoHeaderFiles)
-  pki_h_files = FindHeaderFiles(
-      os.path.join('src', 'include', 'openssl', 'pki'), AllFiles)
-
   ssl_internal_h_files = FindHeaderFiles(os.path.join('src', 'ssl'), NoTests)
   crypto_internal_h_files = (
       FindHeaderFiles(os.path.join('src', 'crypto'), NoTests) +
@@ -689,21 +668,21 @@
       'crypto': crypto_c_files,
       'crypto_asm': PrefixWithSrc(crypto_asm),
       'crypto_nasm': PrefixWithSrc(crypto_nasm),
-      'crypto_headers': crypto_h_files,
+      'crypto_headers': PrefixWithSrc(sources['crypto']['hdrs']),
       'crypto_internal_headers': crypto_internal_h_files,
       'crypto_test': PrefixWithSrc(sources['crypto_test']['srcs']),
       'crypto_test_data': PrefixWithSrc(sources['crypto_test']['data']),
       'fips_fragments': fips_fragments,
       'fuzz': fuzz_c_files,
       'pki': PrefixWithSrc(sources['pki']['srcs']),
-      'pki_headers': pki_h_files,
+      'pki_headers': PrefixWithSrc(sources['pki']['hdrs']),
       'pki_internal_headers': sorted(list(pki_internal_h_files)),
       'pki_test': PrefixWithSrc(sources['pki_test']['srcs']),
       'pki_test_data': PrefixWithSrc(sources['pki_test']['data']),
       'rust_bssl_crypto': bssl_crypto_files,
       'rust_bssl_sys': bssl_sys_files,
       'ssl': PrefixWithSrc(sources['ssl']['srcs']),
-      'ssl_headers': ssl_h_files,
+      'ssl_headers': PrefixWithSrc(sources['ssl']['hdrs']),
       'ssl_internal_headers': ssl_internal_h_files,
       'ssl_test': PrefixWithSrc(sources['ssl_test']['srcs']),
       'tool': PrefixWithSrc(sources['bssl']['srcs']),