diff --git a/tink/keyderivation/BUILD.bazel b/tink/keyderivation/BUILD.bazel
index 3fd7d882..fb9be9b3 100644
--- a/tink/keyderivation/BUILD.bazel
+++ b/tink/keyderivation/BUILD.bazel
@@ -12,10 +12,12 @@ cc_library(
     visibility = ["//visibility:public"],
     deps = [
         ":keyset_deriver_wrapper",
+        "//tink:registry",
         "//tink/config:tink_fips",
         "//tink/keyderivation/internal:prf_based_deriver_key_manager",
         "//tink/prf:hkdf_prf_key_manager",
         "//tink/util:status",
+        "@com_google_absl//absl/memory",
     ],
 )
 
@@ -26,13 +28,17 @@ cc_test(
         ":key_derivation_config",
         ":key_derivation_key_templates",
         ":keyset_deriver",
+        "//tink:aead",
+        "//tink:keyset_handle",
         "//tink:registry",
         "//tink/aead:aead_config",
         "//tink/aead:aead_key_templates",
         "//tink/aead:aes_gcm_key_manager",
+        "//tink/config:global_registry",
         "//tink/prf:prf_key_templates",
         "//tink/util:statusor",
         "//tink/util:test_matchers",
+        "@com_google_absl//absl/memory",
         "@com_google_googletest//:gtest_main",
     ],
 )
@@ -44,9 +50,11 @@ cc_library(
     include_prefix = "tink/keyderivation",
     visibility = ["//visibility:public"],
     deps = [
+        ":keyset_deriver",
+        "//tink:keyset_handle",
+        "//tink/config:global_registry",
         "//tink/keyderivation/internal:prf_based_deriver_key_manager",
         "//proto:tink_cc_proto",
-        "//tink/subtle:random",
         "//tink/util:statusor",
     ],
 )
@@ -67,6 +75,7 @@ cc_test(
         "//proto:tink_cc_proto",
         "//tink/util:statusor",
         "//tink/util:test_matchers",
+        "@com_google_absl//absl/memory",
         "@com_google_absl//absl/status",
         "@com_google_googletest//:gtest_main",
     ],
@@ -92,10 +101,15 @@ cc_library(
     deps = [
         ":keyset_deriver",
         "//tink:cleartext_keyset_handle",
+        "//tink:keyset_handle",
         "//tink:primitive_set",
         "//tink:primitive_wrapper",
         "//proto:tink_cc_proto",
+        "//tink/util:status",
+        "//tink/util:statusor",
+        "@com_google_absl//absl/memory",
         "@com_google_absl//absl/status",
+        "@com_google_absl//absl/strings:string_view",
     ],
 )
 
@@ -106,10 +120,15 @@ cc_test(
         ":keyset_deriver",
         ":keyset_deriver_wrapper",
         "//tink:cleartext_keyset_handle",
+        "//tink:keyset_handle",
         "//tink:primitive_set",
         "//proto:tink_cc_proto",
+        "//tink/util:statusor",
         "//tink/util:test_matchers",
+        "@com_google_absl//absl/memory",
         "@com_google_absl//absl/status",
+        "@com_google_absl//absl/strings",
+        "@com_google_absl//absl/strings:string_view",
         "@com_google_googletest//:gtest_main",
     ],
 )
diff --git a/tink/keyderivation/CMakeLists.txt b/tink/keyderivation/CMakeLists.txt
index fa3d7e84..9c685ec9 100644
--- a/tink/keyderivation/CMakeLists.txt
+++ b/tink/keyderivation/CMakeLists.txt
@@ -9,6 +9,8 @@ tink_cc_library(
     key_derivation_config.h
   DEPS
     tink::keyderivation::keyset_deriver_wrapper
+    absl::memory
+    tink::core::registry
     tink::config::tink_fips
     tink::keyderivation::internal::prf_based_deriver_key_manager
     tink::prf::hkdf_prf_key_manager
@@ -25,10 +27,14 @@ tink_cc_test(
     tink::keyderivation::key_derivation_key_templates
     tink::keyderivation::keyset_deriver
     gmock
+    absl::memory
+    tink::core::aead
+    tink::core::keyset_handle
     tink::core::registry
     tink::aead::aead_config
     tink::aead::aead_key_templates
     tink::aead::aes_gcm_key_manager
+    tink::config::global_registry
     tink::prf::prf_key_templates
     tink::util::statusor
     tink::util::test_matchers
@@ -40,8 +46,10 @@ tink_cc_library(
     key_derivation_key_templates.cc
     key_derivation_key_templates.h
   DEPS
+    tink::keyderivation::keyset_deriver
+    tink::core::keyset_handle
+    tink::config::global_registry
     tink::keyderivation::internal::prf_based_deriver_key_manager
-    tink::subtle::random
     tink::util::statusor
     tink::proto::tink_cc_proto
   PUBLIC
@@ -55,6 +63,7 @@ tink_cc_test(
     tink::keyderivation::key_derivation_key_templates
     tink::keyderivation::keyset_deriver_wrapper
     gmock
+    absl::memory
     absl::status
     tink::core::registry
     tink::aead::aead_key_templates
@@ -86,10 +95,15 @@ tink_cc_library(
     keyset_deriver_wrapper.h
   DEPS
     tink::keyderivation::keyset_deriver
+    absl::memory
     absl::status
+    absl::string_view
     tink::core::cleartext_keyset_handle
+    tink::core::keyset_handle
     tink::core::primitive_set
     tink::core::primitive_wrapper
+    tink::util::status
+    tink::util::statusor
     tink::proto::tink_cc_proto
 )
 
@@ -101,9 +115,14 @@ tink_cc_test(
     tink::keyderivation::keyset_deriver
     tink::keyderivation::keyset_deriver_wrapper
     gmock
+    absl::memory
     absl::status
+    absl::strings
+    absl::string_view
     tink::core::cleartext_keyset_handle
+    tink::core::keyset_handle
     tink::core::primitive_set
+    tink::util::statusor
     tink::util::test_matchers
     tink::proto::tink_cc_proto
 )
diff --git a/tink/keyderivation/key_derivation_config.cc b/tink/keyderivation/key_derivation_config.cc
index 2194e330..fef7aaff 100644
--- a/tink/keyderivation/key_derivation_config.cc
+++ b/tink/keyderivation/key_derivation_config.cc
@@ -16,10 +16,13 @@
 
 #include "tink/keyderivation/key_derivation_config.h"
 
+#include "absl/memory/memory.h"
 #include "tink/config/tink_fips.h"
 #include "tink/keyderivation/internal/prf_based_deriver_key_manager.h"
 #include "tink/keyderivation/keyset_deriver_wrapper.h"
 #include "tink/prf/hkdf_prf_key_manager.h"
+#include "tink/registry.h"
+#include "tink/util/status.h"
 
 namespace crypto {
 namespace tink {
diff --git a/tink/keyderivation/key_derivation_config_test.cc b/tink/keyderivation/key_derivation_config_test.cc
index 5d0d4dea..47c81451 100644
--- a/tink/keyderivation/key_derivation_config_test.cc
+++ b/tink/keyderivation/key_derivation_config_test.cc
@@ -21,11 +21,15 @@
 
 #include "gmock/gmock.h"
 #include "gtest/gtest.h"
+#include "absl/memory/memory.h"
+#include "tink/aead.h"
 #include "tink/aead/aead_config.h"
 #include "tink/aead/aead_key_templates.h"
 #include "tink/aead/aes_gcm_key_manager.h"
+#include "tink/config/global_registry.h"
 #include "tink/keyderivation/key_derivation_key_templates.h"
 #include "tink/keyderivation/keyset_deriver.h"
+#include "tink/keyset_handle.h"
 #include "tink/prf/prf_key_templates.h"
 #include "tink/registry.h"
 #include "tink/util/statusor.h"
diff --git a/tink/keyderivation/key_derivation_key_templates.cc b/tink/keyderivation/key_derivation_key_templates.cc
index 98912d55..39da1a22 100644
--- a/tink/keyderivation/key_derivation_key_templates.cc
+++ b/tink/keyderivation/key_derivation_key_templates.cc
@@ -18,8 +18,11 @@
 
 #include <memory>
 
+#include "tink/config/global_registry.h"
 #include "tink/keyderivation/internal/prf_based_deriver_key_manager.h"
-#include "tink/subtle/random.h"
+#include "tink/keyderivation/keyset_deriver.h"
+#include "tink/keyset_handle.h"
+#include "tink/util/statusor.h"
 
 namespace crypto {
 namespace tink {
diff --git a/tink/keyderivation/key_derivation_key_templates_test.cc b/tink/keyderivation/key_derivation_key_templates_test.cc
index a6e01b3d..5388cb53 100644
--- a/tink/keyderivation/key_derivation_key_templates_test.cc
+++ b/tink/keyderivation/key_derivation_key_templates_test.cc
@@ -20,6 +20,7 @@
 
 #include "gmock/gmock.h"
 #include "gtest/gtest.h"
+#include "absl/memory/memory.h"
 #include "absl/status/status.h"
 #include "tink/aead/aead_key_templates.h"
 #include "tink/aead/aes_gcm_key_manager.h"
diff --git a/tink/keyderivation/keyset_deriver_wrapper.cc b/tink/keyderivation/keyset_deriver_wrapper.cc
index cf74a110..144c1095 100644
--- a/tink/keyderivation/keyset_deriver_wrapper.cc
+++ b/tink/keyderivation/keyset_deriver_wrapper.cc
@@ -19,8 +19,15 @@
 #include <memory>
 #include <utility>
 
+#include "absl/memory/memory.h"
 #include "absl/status/status.h"
+#include "absl/strings/string_view.h"
 #include "tink/cleartext_keyset_handle.h"
+#include "tink/keyderivation/keyset_deriver.h"
+#include "tink/keyset_handle.h"
+#include "tink/primitive_set.h"
+#include "tink/util/status.h"
+#include "tink/util/statusor.h"
 #include "proto/tink.pb.h"
 
 namespace crypto {
diff --git a/tink/keyderivation/keyset_deriver_wrapper.h b/tink/keyderivation/keyset_deriver_wrapper.h
index 256440af..f840ea84 100644
--- a/tink/keyderivation/keyset_deriver_wrapper.h
+++ b/tink/keyderivation/keyset_deriver_wrapper.h
@@ -22,6 +22,7 @@
 #include "tink/keyderivation/keyset_deriver.h"
 #include "tink/primitive_set.h"
 #include "tink/primitive_wrapper.h"
+#include "tink/util/statusor.h"
 
 namespace crypto {
 namespace tink {
diff --git a/tink/keyderivation/keyset_deriver_wrapper_test.cc b/tink/keyderivation/keyset_deriver_wrapper_test.cc
index dde29fbc..918540af 100644
--- a/tink/keyderivation/keyset_deriver_wrapper_test.cc
+++ b/tink/keyderivation/keyset_deriver_wrapper_test.cc
@@ -23,10 +23,15 @@
 
 #include "gmock/gmock.h"
 #include "gtest/gtest.h"
+#include "absl/memory/memory.h"
 #include "absl/status/status.h"
+#include "absl/strings/str_cat.h"
+#include "absl/strings/string_view.h"
 #include "tink/cleartext_keyset_handle.h"
 #include "tink/keyderivation/keyset_deriver.h"
+#include "tink/keyset_handle.h"
 #include "tink/primitive_set.h"
+#include "tink/util/statusor.h"
 #include "tink/util/test_matchers.h"
 #include "proto/tink.pb.h"