diff --git a/include/osmocom/sgsn/Makefile.am b/include/osmocom/sgsn/Makefile.am
index 017954d..aa6cd0f 100644
--- a/include/osmocom/sgsn/Makefile.am
+++ b/include/osmocom/sgsn/Makefile.am
@@ -1,5 +1,6 @@
 noinst_HEADERS = \
 	apn.h \
+	auth.h \
 	common.h \
 	crc24.h \
 	debug.h \
@@ -13,7 +14,6 @@
 	gprs_llc.h \
 	gprs_llc_xid.h \
 	gprs_ranap.h \
-	gprs_sgsn.h \
 	gprs_sm.h \
 	gprs_sndcp_comp.h \
 	gprs_sndcp_dcomp.h \
@@ -25,6 +25,7 @@
 	gtp.h \
 	gtp_ggsn.h \
 	gtp_mme.h \
+	mmctx.h \
 	pdpctx.h \
 	sgsn.h \
 	sgsn_rim.h \
diff --git a/include/osmocom/sgsn/auth.h b/include/osmocom/sgsn/auth.h
new file mode 100644
index 0000000..a46fb16
--- /dev/null
+++ b/include/osmocom/sgsn/auth.h
@@ -0,0 +1,39 @@
+/* MS authorization and subscriber data handling */
+#pragma once
+
+#include <osmocom/core/linuxlist.h>
+
+struct sgsn_config;
+struct sgsn_instance;
+struct sgsn_mm_ctx;
+struct gsm_auth_tuple;
+
+/* Authorization/ACL handling */
+enum sgsn_auth_state {
+	SGSN_AUTH_UNKNOWN,
+	SGSN_AUTH_AUTHENTICATE,
+	SGSN_AUTH_UMTS_RESYNC,
+	SGSN_AUTH_ACCEPTED,
+	SGSN_AUTH_REJECTED
+};
+
+extern const struct value_string *sgsn_auth_state_names;
+
+void sgsn_auth_init(struct sgsn_instance *sgsn);
+/* Request authorization */
+enum sgsn_auth_state sgsn_auth_state(struct sgsn_mm_ctx *mm);
+int sgsn_auth_request(struct sgsn_mm_ctx *mm);
+void sgsn_auth_update(struct sgsn_mm_ctx *mm);
+struct gsm_auth_tuple *sgsn_auth_get_tuple(struct sgsn_mm_ctx *mmctx,
+					   unsigned key_seq);
+
+/*
+ * Authorization/ACL handling
+ */
+struct imsi_acl_entry {
+	struct llist_head list;
+	char imsi[OSMO_IMSI_BUF_SIZE];
+};
+struct imsi_acl_entry *sgsn_acl_lookup(const char *imsi, const struct sgsn_config *cfg);
+int sgsn_acl_add(const char *imsi, struct sgsn_config *cfg);
+int sgsn_acl_del(const char *imsi, struct sgsn_config *cfg);
diff --git a/include/osmocom/sgsn/gprs_gmm.h b/include/osmocom/sgsn/gprs_gmm.h
index 0d04280..71dd1fa 100644
--- a/include/osmocom/sgsn/gprs_gmm.h
+++ b/include/osmocom/sgsn/gprs_gmm.h
@@ -1,11 +1,15 @@
 #ifndef _GPRS_GMM_H
 #define _GPRS_GMM_H
 
-#include <osmocom/core/msgb.h>
-#include <osmocom/sgsn/gprs_sgsn.h>
-
 #include <stdbool.h>
 
+#include <osmocom/core/msgb.h>
+#include <osmocom/gsm/gsm48.h>
+#include <osmocom/crypt/auth.h>
+
+struct sgsn_mm_ctx;
+struct gprs_llc_llme;
+
 int gsm48_tx_gmm_auth_ciph_req(struct sgsn_mm_ctx *mm,
 				      const struct osmo_auth_vector *vec,
 				      uint8_t key_seq, bool force_standby);
diff --git a/include/osmocom/sgsn/gprs_gmm_fsm.h b/include/osmocom/sgsn/gprs_gmm_fsm.h
index f10851e..2f0e81a 100644
--- a/include/osmocom/sgsn/gprs_gmm_fsm.h
+++ b/include/osmocom/sgsn/gprs_gmm_fsm.h
@@ -1,8 +1,10 @@
 #pragma once
 
 #include <osmocom/core/fsm.h>
-#include <osmocom/sgsn/gprs_sgsn.h>
 
+#include <osmocom/sgsn/mmctx.h>
+
+struct gprs_llc_llme;
 
 /* 3GPP TS 24.008 § 4.1.3.3 GMM mobility management states on the network side */
 enum gmm_fsm_states {
diff --git a/include/osmocom/sgsn/gprs_llc.h b/include/osmocom/sgsn/gprs_llc.h
index 32b16b0..6f0e492 100644
--- a/include/osmocom/sgsn/gprs_llc.h
+++ b/include/osmocom/sgsn/gprs_llc.h
@@ -2,9 +2,15 @@
 
 #include <stdint.h>
 #include <stdbool.h>
-#include <osmocom/sgsn/gprs_sgsn.h>
+
+#include <osmocom/core/timer.h>
+#include <osmocom/gsm/tlv.h>
+#include <osmocom/crypt/gprs_cipher.h>
+
 #include <osmocom/sgsn/gprs_llc_xid.h>
 
+struct sgsn_mm_ctx;
+
 /* Section 4.7 LLC Layer Structure */
 enum gprs_llc_sapi {
 	GPRS_SAPI_GMM		= 1,
diff --git a/include/osmocom/sgsn/gprs_ranap.h b/include/osmocom/sgsn/gprs_ranap.h
index 62fdf6f..68f9115 100644
--- a/include/osmocom/sgsn/gprs_ranap.h
+++ b/include/osmocom/sgsn/gprs_ranap.h
@@ -1,13 +1,15 @@
 #pragma once
 
 #include <osmocom/core/msgb.h>
-#include <osmocom/sgsn/gprs_sgsn.h>
 
 #ifdef BUILD_IU
 #include <osmocom/ranap/ranap_ies_defs.h>
 #include <osmocom/ranap/ranap_msg_factory.h>
 #include <osmocom/ranap/iu_client.h>
 
+struct sgsn_mm_ctx;
+struct sgsn_pdp_ctx;
+
 void activate_pdp_rabs(struct sgsn_mm_ctx *ctx);
 int sgsn_ranap_iu_event(struct ranap_ue_conn_ctx *ctx, enum ranap_iu_event_type type, void *data);
 int iu_rab_act_ps(uint8_t rab_id, struct sgsn_pdp_ctx *pdp);
diff --git a/include/osmocom/sgsn/gprs_sm.h b/include/osmocom/sgsn/gprs_sm.h
index 55c95b8..78bb2d8 100644
--- a/include/osmocom/sgsn/gprs_sm.h
+++ b/include/osmocom/sgsn/gprs_sm.h
@@ -1,7 +1,10 @@
 #pragma once
 
 #include <osmocom/core/msgb.h>
-#include <osmocom/sgsn/gprs_sgsn.h>
+
+struct sgsn_mm_ctx;
+struct sgsn_pdp_ctx;
+struct gprs_llc_llme;
 
 int gsm48_tx_gsm_deact_pdp_req(struct sgsn_pdp_ctx *pdp, uint8_t sm_cause, bool teardown);
 int gsm48_tx_gsm_act_pdp_rej(struct sgsn_mm_ctx *mm, uint8_t tid,
diff --git a/include/osmocom/sgsn/gprs_sndcp.h b/include/osmocom/sgsn/gprs_sndcp.h
index b4a0af8..30ea053 100644
--- a/include/osmocom/sgsn/gprs_sndcp.h
+++ b/include/osmocom/sgsn/gprs_sndcp.h
@@ -3,6 +3,9 @@
 
 #include <stdint.h>
 #include <osmocom/core/linuxlist.h>
+#include <osmocom/gsm/gsm48.h>
+
+struct gprs_llc_lle;
 
 /* A fragment queue header, maintaining list of fragments for one N-PDU */
 struct defrag_state {
diff --git a/include/osmocom/sgsn/gprs_sgsn.h b/include/osmocom/sgsn/mmctx.h
similarity index 87%
rename from include/osmocom/sgsn/gprs_sgsn.h
rename to include/osmocom/sgsn/mmctx.h
index c9e301d..dd78124 100644
--- a/include/osmocom/sgsn/gprs_sgsn.h
+++ b/include/osmocom/sgsn/mmctx.h
@@ -1,5 +1,4 @@
-#ifndef _GPRS_SGSN_H
-#define _GPRS_SGSN_H
+#pragma once
 
 #include <stdint.h>
 #include <netinet/in.h>
@@ -15,6 +14,7 @@
 #include <osmocom/crypt/auth.h>
 
 #include <osmocom/sgsn/apn.h>
+#include <osmocom/sgsn/auth.h>
 #include <osmocom/sgsn/gprs_subscriber.h>
 
 #define GSM_EXTENSION_LENGTH 15
@@ -48,17 +48,6 @@
 	GMM_T3350_MODE_PTMSI_REALL,
 };
 
-/* Authorization/ACL handling */
-enum sgsn_auth_state {
-	SGSN_AUTH_UNKNOWN,
-	SGSN_AUTH_AUTHENTICATE,
-	SGSN_AUTH_UMTS_RESYNC,
-	SGSN_AUTH_ACCEPTED,
-	SGSN_AUTH_REJECTED
-};
-
-#define MS_RADIO_ACCESS_CAPA
-
 enum sgsn_ggsn_lookup_state {
 	SGSN_GGSN_2DIGIT,
 	SGSN_GGSN_3DIGIT,
@@ -296,32 +285,5 @@
 
 uint32_t sgsn_alloc_ptmsi(void);
 
-/*
- * Authorization/ACL handling
- */
-struct imsi_acl_entry {
-	struct llist_head list;
-	char imsi[OSMO_IMSI_BUF_SIZE];
-};
-
-#define SGSN_ERROR_CAUSE_NONE (-1)
-
-struct sgsn_config;
-struct sgsn_instance;
-extern const struct value_string *sgsn_auth_state_names;
-
-void sgsn_auth_init(struct sgsn_instance *sgsn);
-struct imsi_acl_entry *sgsn_acl_lookup(const char *imsi, const struct sgsn_config *cfg);
-int sgsn_acl_add(const char *imsi, struct sgsn_config *cfg);
-int sgsn_acl_del(const char *imsi, struct sgsn_config *cfg);
-/* Request authorization */
-int sgsn_auth_request(struct sgsn_mm_ctx *mm);
-enum sgsn_auth_state sgsn_auth_state(struct sgsn_mm_ctx *mm);
-void sgsn_auth_update(struct sgsn_mm_ctx *mm);
-struct gsm_auth_tuple *sgsn_auth_get_tuple(struct sgsn_mm_ctx *mmctx,
-					   unsigned key_seq);
-
 /* Called on subscriber data updates */
 void sgsn_update_subscriber_data(struct sgsn_mm_ctx *mmctx);
-
-#endif /* _GPRS_SGSN_H */
diff --git a/include/osmocom/sgsn/sgsn.h b/include/osmocom/sgsn/sgsn.h
index aadb8a7..0963863 100644
--- a/include/osmocom/sgsn/sgsn.h
+++ b/include/osmocom/sgsn/sgsn.h
@@ -8,7 +8,7 @@
 #include <osmocom/gprs/gprs_ns2.h>
 #include <osmocom/gprs/gprs_bssgp.h>
 
-#include <osmocom/sgsn/gprs_sgsn.h>
+#include <osmocom/sgsn/auth.h>
 #include <osmocom/sgsn/gtp_mme.h>
 #include <osmocom/gsm/oap_client.h>
 #include <osmocom/gsupclient/gsup_client.h>
@@ -25,6 +25,8 @@
 
 struct hostent;
 
+#define SGSN_ERROR_CAUSE_NONE (-1)
+
 enum sgsn_auth_policy {
 	SGSN_AUTH_POLICY_OPEN,
 	SGSN_AUTH_POLICY_CLOSED,