diff --git a/auth-bsdauth.c b/auth-bsdauth.c
index 4dc5045c2..d124e994e 100644
--- a/auth-bsdauth.c
+++ b/auth-bsdauth.c
@@ -29,8 +29,6 @@
 #include <stdarg.h>
 #include <stdio.h>
 
-#include <stdarg.h>
-
 #ifdef BSD_AUTH
 #include "xmalloc.h"
 #include "sshkey.h"
diff --git a/auth-options.c b/auth-options.c
index 9550f656f..90b0d7f25 100644
--- a/auth-options.c
+++ b/auth-options.c
@@ -22,7 +22,6 @@
 #include <stdlib.h>
 #include <netdb.h>
 #include <pwd.h>
-#include <stdlib.h>
 #include <string.h>
 #include <stdio.h>
 #include <stdarg.h>
diff --git a/auth.h b/auth.h
index 04ad99ffb..becc672b5 100644
--- a/auth.h
+++ b/auth.h
@@ -234,7 +234,7 @@ pid_t	subprocess(const char *, struct passwd *,
 int	 sys_auth_passwd(struct ssh *, const char *);
 
 #if defined(KRB5) && !defined(HEIMDAL)
-#include <krb5.h>
 krb5_error_code ssh_krb5_cc_gen(krb5_context, krb5_ccache *);
 #endif
-#endif
+
+#endif /* AUTH_H */
diff --git a/auth2.c b/auth2.c
index 2143ff5de..0e7762242 100644
--- a/auth2.c
+++ b/auth2.c
@@ -52,14 +52,11 @@
 #include "auth.h"
 #include "dispatch.h"
 #include "pathnames.h"
-#include "sshbuf.h"
 #include "ssherr.h"
-
 #ifdef GSSAPI
 #include "ssh-gss.h"
 #endif
 #include "monitor_wrap.h"
-#include "ssherr.h"
 #include "digest.h"
 
 /* import */
diff --git a/dns.c b/dns.c
index ff1a2c41c..e4f9bf830 100644
--- a/dns.c
+++ b/dns.c
@@ -34,7 +34,6 @@
 #include <stdarg.h>
 #include <stdio.h>
 #include <string.h>
-#include <stdarg.h>
 #include <stdlib.h>
 
 #include "xmalloc.h"
diff --git a/hmac.c b/hmac.c
index a79e8569c..32688876d 100644
--- a/hmac.c
+++ b/hmac.c
@@ -21,7 +21,6 @@
 
 #include <stdlib.h>
 #include <string.h>
-#include <stdlib.h>
 
 #include "sshbuf.h"
 #include "digest.h"
diff --git a/hostfile.c b/hostfile.c
index 389aae1fc..96ab880d4 100644
--- a/hostfile.c
+++ b/hostfile.c
@@ -49,7 +49,6 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
-#include <stdarg.h>
 #include <unistd.h>
 
 #include "xmalloc.h"
diff --git a/kex.h b/kex.h
index 6465df88d..a5ae6ac05 100644
--- a/kex.h
+++ b/kex.h
@@ -30,6 +30,9 @@
 #include "crypto_api.h"
 
 #ifdef WITH_OPENSSL
+# include <openssl/bn.h>
+# include <openssl/dh.h>
+# include <openssl/ecdsa.h>
 # ifdef OPENSSL_HAS_ECC
 #  include <openssl/ec.h>
 # else /* OPENSSL_HAS_ECC */
@@ -45,18 +48,6 @@
 # define EC_POINT	void
 #endif /* WITH_OPENSSL */
 
-#ifdef WITH_OPENSSL
-#include <openssl/bn.h>
-#include <openssl/dh.h>
-#include <openssl/ec.h>
-#include <openssl/ecdsa.h>
-#else /* OPENSSL */
-#define BIGNUM		void
-#define DH		void
-#define EC_KEY		void
-#define EC_GROUP	void
-#endif /* WITH_OPENSSL */
-
 #define KEX_COOKIE_LEN	16
 
 #define	KEX_DH1				"diffie-hellman-group1-sha1"
diff --git a/kexecdh.c b/kexecdh.c
index be324a838..bcfa3b107 100644
--- a/kexecdh.c
+++ b/kexecdh.c
@@ -211,11 +211,9 @@ kex_ecdh_dec(struct kex *kex, const struct sshbuf *server_blob,
 
 #else
 
-#include <stdio.h>
-
-#include "sshkey.h"
-#include "kex.h"
-#include "ssherr.h"
+struct kex;
+struct sshbuf;
+struct sshkey;
 
 int
 kex_ecdh_keypair(struct kex *kex)
diff --git a/krl.c b/krl.c
index 10a8bcc87..a7f690955 100644
--- a/krl.c
+++ b/krl.c
@@ -29,7 +29,6 @@
 #include <string.h>
 #include <time.h>
 #include <unistd.h>
-#include <stdlib.h>
 
 #include "sshbuf.h"
 #include "ssherr.h"
diff --git a/mac.c b/mac.c
index de346ed20..f3dda6692 100644
--- a/mac.c
+++ b/mac.c
@@ -30,7 +30,6 @@
 #include <stdlib.h>
 #include <string.h>
 #include <stdio.h>
-#include <stdlib.h>
 
 #include "digest.h"
 #include "hmac.h"
diff --git a/sandbox-systrace.c b/sandbox-systrace.c
index add4c46d0..93e63b8e0 100644
--- a/sandbox-systrace.c
+++ b/sandbox-systrace.c
@@ -36,7 +36,6 @@
 #include <stdlib.h>
 #include <string.h>
 #include <unistd.h>
-#include <limits.h>
 
 #include "atomicio.h"
 #include "log.h"
diff --git a/ssh-keysign.c b/ssh-keysign.c
index 3ede407d3..6cfd5b46c 100644
--- a/ssh-keysign.c
+++ b/ssh-keysign.c
@@ -33,7 +33,6 @@
 #include <stdarg.h>
 #include <stdio.h>
 #include <stdlib.h>
-#include <stdio.h>
 #include <string.h>
 #include <unistd.h>
 #include <errno.h>
diff --git a/sshconnect.c b/sshconnect.c
index bcb732a32..6230dad32 100644
--- a/sshconnect.c
+++ b/sshconnect.c
@@ -56,7 +56,6 @@
 #include "compat.h"
 #include "sshkey.h"
 #include "sshconnect.h"
-#include "hostfile.h"
 #include "log.h"
 #include "misc.h"
 #include "readconf.h"