diff --git a/src/workerd/api/BUILD.bazel b/src/workerd/api/BUILD.bazel
index dd29dfc17bd..b30584f0d97 100644
--- a/src/workerd/api/BUILD.bazel
+++ b/src/workerd/api/BUILD.bazel
@@ -393,6 +393,8 @@ wd_cc_library(
     implementation_deps = [
         "//src/workerd/io",
         "//src/workerd/util:strings",
+        "@capnp-cpp//src/kj/compat:kj-gzip",
+        "@capnp-cpp//src/kj/compat:kj-tls",
     ],
     visibility = ["//visibility:public"],
     deps = [
@@ -401,9 +403,7 @@ wd_cc_library(
         "//src/workerd/io:compatibility-date_capnp",
         "//src/workerd/jsg",
         "@capnp-cpp//src/kj:kj-async",
-        "@capnp-cpp//src/kj/compat:kj-gzip",
         "@capnp-cpp//src/kj/compat:kj-http",
-        "@capnp-cpp//src/kj/compat:kj-tls",
     ],
 )
 
@@ -528,13 +528,27 @@ wd_cc_library(
     for f in [
         "actor-state-test.c++",
         "basics-test.c++",
-        "crypto/aes-test.c++",
-        "crypto/impl-test.c++",
         "streams/queue-test.c++",
         "streams/standard-test.c++",
     ]
 ]
 
+[
+    kj_test(
+        src = f,
+        deps = [
+            "//src/workerd/io",
+            "//src/workerd/io:promise-wrapper",
+            "@ncrypto",
+            "@ssl",
+        ],
+    )
+    for f in [
+        "crypto/aes-test.c++",
+        "crypto/impl-test.c++",
+    ]
+]
+
 kj_test(
     src = "data-url-test.c++",
     deps = [
@@ -562,6 +576,7 @@ kj_test(
     deps = [
         "//src/workerd/io",
         "//src/workerd/tests:test-fixture",
+        "@ssl",
     ],
 )
 
@@ -591,12 +606,16 @@ kj_test(
         ":urlpattern-standard",
         "//src/workerd/io",
         "//src/workerd/jsg:rtti",
+        "@ssl",
     ],
 )
 
 kj_test(
     src = "base64-test.c++",
-    deps = ["//src/workerd/tests:test-fixture"],
+    deps = [
+        ":base64",
+        "//src/workerd/tests:test-fixture",
+    ],
 )
 
 kj_test(
@@ -618,6 +637,7 @@ kj_test(
         "//src/workerd/io",
         "//src/workerd/jsg",
         "//src/workerd/tests:test-fixture",
+        "@capnp-cpp//src/kj/compat:kj-gzip",
     ],
 )
 
diff --git a/src/workerd/api/crypto/crypto.h b/src/workerd/api/crypto/crypto.h
index 3560f142833..adcd6b0f68b 100644
--- a/src/workerd/api/crypto/crypto.h
+++ b/src/workerd/api/crypto/crypto.h
@@ -9,7 +9,13 @@
 #include <workerd/io/features.h>
 #include <workerd/jsg/jsg.h>
 
-#include <openssl/base.h>  // for EVP_MD_CTX, X509
+// Forward declarations for OpenSSL types (avoids including openssl/base.h in header)
+struct x509_st;
+struct env_md_ctx_st;
+struct bio_st;
+using X509 = struct x509_st;
+using EVP_MD_CTX = struct env_md_ctx_st;
+using BIO = struct bio_st;
 
 #include <bit>
 
diff --git a/src/workerd/io/BUILD.bazel b/src/workerd/io/BUILD.bazel
index 94dcbf0b796..54320865be6 100644
--- a/src/workerd/io/BUILD.bazel
+++ b/src/workerd/io/BUILD.bazel
@@ -21,7 +21,7 @@ wd_cc_library(
     visibility = ["//visibility:public"],
     deps = [
         "//src/workerd/jsg",
-        "@capnp-cpp//src/capnp/compat:http-over-capnp",
+        "@capnp-cpp//src/kj/compat:kj-http",
     ],
 )
 
@@ -70,11 +70,14 @@ wd_cc_library(
         ],
     }),
     implementation_deps = [
+        ":cdp_capnp",
         "//src/workerd/api:crypto-crc-impl",
         "//src/workerd/api:data-url",
         "//src/workerd/api/node:exceptions",
         "//src/workerd/util:completion-membrane",
         "//src/workerd/util:entropy",
+        "//src/workerd/util:header-validation",
+        "//src/workerd/util:immediate-crash",
         "//src/workerd/util:perfetto",
         "//src/workerd/util:string-buffer",
         "//src/workerd/util:strings",
@@ -83,13 +86,13 @@ wd_cc_library(
         "@capnp-cpp//src/kj/compat:kj-gzip",
         "@nbytes",
         "@simdutf",
+        "@ssl",
     ],
     visibility = ["//visibility:public"],
     deps = [
         ":actor",
         ":actor-id",
         ":actor-storage_capnp",
-        ":cdp_capnp",
         ":container_capnp",
         ":features",
         ":frankenvalue",
@@ -113,8 +116,6 @@ wd_cc_library(
         "//src/workerd/jsg:script",
         "//src/workerd/util:checked-queue",
         "//src/workerd/util:exception",
-        "//src/workerd/util:header-validation",
-        "//src/workerd/util:immediate-crash",
         "//src/workerd/util:ring-buffer",
         "//src/workerd/util:small-set",
         "//src/workerd/util:sqlite",
@@ -124,7 +125,6 @@ wd_cc_library(
         "@capnp-cpp//src/capnp/compat:http-over-capnp",
         "@capnp-cpp//src/kj:kj-async",
         "@ncrypto",
-        "@ssl",
     ],
 )
 
@@ -204,16 +204,18 @@ wd_cc_library(
         "actor-sqlite.h",
         "actor-storage.h",
     ],
+    implementation_deps = [
+        ":io-gate",
+        "//src/workerd/util:autogate",
+        "//src/workerd/util:duration-exceeded-logger",
+        "@capnp-cpp//src/capnp:capnp-rpc",
+    ],
     visibility = ["//visibility:public"],
     deps = [
         ":actor-storage_capnp",
-        ":io-gate",
         ":trace",
         "//src/workerd/jsg:exception",
-        "//src/workerd/util:autogate",
-        "//src/workerd/util:duration-exceeded-logger",
         "//src/workerd/util:sqlite",
-        "@capnp-cpp//src/capnp:capnp-rpc",
         "@capnp-cpp//src/kj:kj-async",
     ],
 )
@@ -222,11 +224,13 @@ wd_cc_library(
     name = "frankenvalue",
     srcs = ["frankenvalue.c++"],
     hdrs = ["frankenvalue.h"],
+    implementation_deps = [
+        "@capnp-cpp//src/capnp:capnpc",
+    ],
     visibility = ["//visibility:public"],
     deps = [
         ":frankenvalue_capnp",
         "//src/workerd/jsg",
-        "@capnp-cpp//src/capnp:capnpc",
     ],
 )
 
@@ -237,6 +241,8 @@ wd_cc_library(
     implementation_deps = [
         "//src/workerd/util:entropy",
         "//src/workerd/util:thread-scopes",
+        "@capnp-cpp//src/capnp:capnpc",
+        "@capnp-cpp//src/kj/compat:kj-http",
     ],
     visibility = ["//visibility:public"],
     deps = [
@@ -245,9 +251,6 @@ wd_cc_library(
         "//src/workerd/jsg:memory-tracker",
         "//src/workerd/util:own-util",
         "@capnp-cpp//src/capnp:capnp-rpc",
-        "@capnp-cpp//src/capnp:capnpc",
-        "@capnp-cpp//src/kj/compat:kj-http",
-        "@ssl",
     ],
 )
 
@@ -307,15 +310,18 @@ wd_cc_library(
     name = "worker-interface",
     srcs = ["worker-interface.c++"],
     hdrs = ["worker-interface.h"],
+    implementation_deps = [
+        "//src/workerd/util",
+        "@capnp-cpp//src/capnp:capnpc",
+        "@capnp-cpp//src/capnp/compat:http-over-capnp",
+    ],
     visibility = ["//visibility:public"],
     deps = [
         ":frankenvalue_capnp",
         ":trace",
         ":worker-interface_capnp",
-        "//src/workerd/util",
         "@capnp-cpp//src/capnp:capnp-rpc",
-        "@capnp-cpp//src/capnp:capnpc",
-        "@capnp-cpp//src/capnp/compat:http-over-capnp",
+        "@capnp-cpp//src/kj/compat:kj-http",
     ],
 )
 
@@ -408,6 +414,7 @@ kj_test(
     deps = [
         ":actor",
         ":io-gate",
+        "//src/workerd/util:autogate",
         "//src/workerd/util:test",
         "//src/workerd/util:test-util",
         "@sqlite3",
diff --git a/src/workerd/io/io-thread-context.h b/src/workerd/io/io-thread-context.h
index 3217573efe9..2b45ec8d00c 100644
--- a/src/workerd/io/io-thread-context.h
+++ b/src/workerd/io/io-thread-context.h
@@ -1,8 +1,12 @@
 #pragma once
 
-#include <capnp/compat/http-over-capnp.h>
 #include <kj/compat/http.h>
 
+namespace capnp {
+class HttpOverCapnpFactory;
+class ByteStreamFactory;
+}  // namespace capnp
+
 namespace workerd {
 
 // Thread-level stuff needed to construct a IoContext. One of these is created for each
diff --git a/src/workerd/io/worker-interface.c++ b/src/workerd/io/worker-interface.c++
index 9a586a54b12..7e0d7a5f40f 100644
--- a/src/workerd/io/worker-interface.c++
+++ b/src/workerd/io/worker-interface.c++
@@ -6,6 +6,7 @@
 
 #include <workerd/util/http-util.h>
 
+#include <capnp/compat/http-over-capnp.h>
 #include <kj/debug.h>
 
 using kj::byte;
diff --git a/src/workerd/io/worker-interface.h b/src/workerd/io/worker-interface.h
index f68085d9382..810275ca674 100644
--- a/src/workerd/io/worker-interface.h
+++ b/src/workerd/io/worker-interface.h
@@ -7,12 +7,15 @@
 #include <workerd/io/outcome.capnp.h>
 #include <workerd/io/trace.h>
 #include <workerd/io/worker-interface.capnp.h>
-#include <workerd/util/http-util.h>
 
-#include <capnp/compat/http-over-capnp.h>
 #include <kj/compat/http.h>
 #include <kj/debug.h>
 
+namespace capnp {
+class HttpOverCapnpFactory;
+class ByteStreamFactory;
+}  // namespace capnp
+
 namespace workerd {
 
 class Frankenvalue;
diff --git a/src/workerd/jsg/BUILD.bazel b/src/workerd/jsg/BUILD.bazel
index 6ffaf496aba..7f37434b54b 100644
--- a/src/workerd/jsg/BUILD.bazel
+++ b/src/workerd/jsg/BUILD.bazel
@@ -333,7 +333,6 @@ kj_test(
     src = "url-test.c++",
     deps = [
         ":url",
-        "@ssl",
     ],
 )
 
diff --git a/src/workerd/server/BUILD.bazel b/src/workerd/server/BUILD.bazel
index 63eaea3511b..e627ce4a4f4 100644
--- a/src/workerd/server/BUILD.bazel
+++ b/src/workerd/server/BUILD.bazel
@@ -66,11 +66,14 @@ wd_cc_binary(
         ":json-logger",
         ":server",
         ":v8-platform-impl",
+        ":workerd-api",
         ":workerd-capnp-schema",
         ":workerd_capnp",
         "//src/pyodide:pyodide_extra_capnp",
         "//src/rust/cxx-integration",
+        "//src/workerd/jsg",
         "//src/workerd/util:autogate",
+        "//src/workerd/util:entropy",
         "//src/workerd/util:perfetto",
         "@capnp-cpp//src/capnp:capnpc",
     ],
@@ -121,6 +124,10 @@ wd_cc_library(
     hdrs = [
         "pyodide.h",
     ],
+    implementation_deps = [
+        "@capnp-cpp//src/kj/compat:kj-gzip",
+        "@capnp-cpp//src/kj/compat:kj-tls",
+    ],
     visibility = ["//visibility:public"],
     deps = [
         "//src/workerd/api:pyodide",
@@ -128,8 +135,6 @@ wd_cc_library(
         "//src/workerd/jsg",
         "@capnp-cpp//src/kj",
         "@capnp-cpp//src/kj:kj-async",
-        "@capnp-cpp//src/kj/compat:kj-gzip",
-        "@capnp-cpp//src/kj/compat:kj-tls",
     ],
 )
 
@@ -156,41 +161,41 @@ wd_cc_library(
         "workerd-api.h",
     ],
     implementation_deps = [
-        "//src/workerd/api:analytics-engine",
-        "//src/workerd/api:capnp",
-        "//src/workerd/api:kv",
-        "//src/workerd/api:streams",
-        "//src/workerd/api:urlpattern",
-        "//src/workerd/api:urlpattern-standard",
-        "//src/workerd/api:worker-loader",
-        "//src/workerd/io:promise-wrapper",
-    ],
-    visibility = ["//visibility:public"],
-    deps = [
         ":actor-id-impl",
         ":fallback-service",
-        ":pyodide",
         ":workerd-debug-port-client",
-        ":workerd_capnp",
         "//src/cloudflare",
         "//src/node",
         "//src/pyodide:pyodide_static",
         "//src/pyodide:python-entrypoint",
         "//src/rust/transpiler",
+        "//src/workerd/api:analytics-engine",
+        "//src/workerd/api:capnp",
         "//src/workerd/api:html-rewriter",
         "//src/workerd/api:hyperdrive",
-        "//src/workerd/api:memory-cache",
-        "//src/workerd/api:pyodide",
+        "//src/workerd/api:kv",
         "//src/workerd/api:r2",
         "//src/workerd/api:rtti",
+        "//src/workerd/api:streams",
+        "//src/workerd/api:urlpattern",
+        "//src/workerd/api:urlpattern-standard",
+        "//src/workerd/api:worker-loader",
         "//src/workerd/api/node",
-        "//src/workerd/io",
+        "//src/workerd/io:promise-wrapper",
         "//src/workerd/io:worker-modules",
-        "//src/workerd/jsg",
         "//src/workerd/util:perfetto",
         "@capnp-cpp//src/kj/compat:kj-gzip",
         "@capnp-cpp//src/kj/compat:kj-tls",
     ],
+    visibility = ["//visibility:public"],
+    deps = [
+        ":pyodide",
+        ":workerd_capnp",
+        "//src/workerd/api:memory-cache",
+        "//src/workerd/api:pyodide",
+        "//src/workerd/io",
+        "//src/workerd/jsg",
+    ],
 )
 
 wd_cc_library(
@@ -203,29 +208,33 @@ wd_cc_library(
         "channel-token.h",
         "server.h",
     ],
-    deps = [
+    implementation_deps = [
         ":actor-id-impl",
-        ":alarm-scheduler",
-        ":channel-token_capnp",
         ":container-client",
         ":facet-tree-index",
         ":fallback-service",
         ":workerd-api",
-        ":workerd_capnp",
         "//src/cloudflare",
         "//src/node",
         "//src/pyodide:pyodide_static",
-        "//src/workerd/api:memory-cache",
-        "//src/workerd/api:pyodide",
-        "//src/workerd/io",
         "//src/workerd/io:bundle-fs",
         "//src/workerd/io:worker-entrypoint",
         "//src/workerd/jsg",
+        "//src/workerd/util:mimetype",
         "//src/workerd/util:perfetto",
+        "//src/workerd/util:uuid",
         "//src/workerd/util:websocket-error-handler",
         "@capnp-cpp//src/kj/compat:kj-gzip",
         "@capnp-cpp//src/kj/compat:kj-tls",
     ],
+    deps = [
+        ":alarm-scheduler",
+        ":channel-token_capnp",
+        ":workerd_capnp",
+        "//src/workerd/api:memory-cache",
+        "//src/workerd/api:pyodide",
+        "//src/workerd/io",
+    ],
 )
 
 wd_capnp_library(src = "docker-api.capnp")
diff --git a/src/workerd/server/server.c++ b/src/workerd/server/server.c++
index 2ff0cb33639..0dbf3573d16 100644
--- a/src/workerd/server/server.c++
+++ b/src/workerd/server/server.c++
@@ -40,6 +40,7 @@
 #include <openssl/bio.h>
 #include <openssl/pem.h>
 
+#include <capnp/compat/http-over-capnp.h>
 #include <capnp/compat/json.h>
 #include <capnp/message.h>
 #include <capnp/rpc-twoparty.h>
diff --git a/src/workerd/tests/test-fixture.h b/src/workerd/tests/test-fixture.h
index 72db0c6cde1..63a29d51bbe 100644
--- a/src/workerd/tests/test-fixture.h
+++ b/src/workerd/tests/test-fixture.h
@@ -10,6 +10,7 @@
 #include <workerd/jsg/jsg.h>
 #include <workerd/server/workerd.capnp.h>
 
+#include <capnp/compat/http-over-capnp.h>
 #include <capnp/message.h>
 #include <kj/function.h>
 #include <kj/test.h>
diff --git a/src/workerd/util/BUILD.bazel b/src/workerd/util/BUILD.bazel
index 427fdbcd056..73cfdb3d155 100644
--- a/src/workerd/util/BUILD.bazel
+++ b/src/workerd/util/BUILD.bazel
@@ -102,7 +102,6 @@ wd_cc_library(
         ":strings",
         "//src/workerd/jsg:memory-tracker",
         "@capnp-cpp//src/kj",
-        "@capnp-cpp//src/kj:kj-async",
     ],
 )
 
@@ -342,7 +341,6 @@ kj_test(
     deps = [
         ":sqlite",
         "//src/workerd/io:io-gate",
-        "@sqlite3",
     ],
 )