diff --git a/Include/Python.h b/Include/Python.h
index e1abdd16f03..717e27feab6 100644
--- a/Include/Python.h
+++ b/Include/Python.h
@@ -124,6 +124,7 @@
 #include "pylifecycle.h"
 #include "ceval.h"
 #include "sysmodule.h"
+#include "audit.h"
 #include "osmodule.h"
 #include "intrcheck.h"
 #include "import.h"
diff --git a/Include/audit.h b/Include/audit.h
new file mode 100644
index 00000000000..793b7077e10
--- /dev/null
+++ b/Include/audit.h
@@ -0,0 +1,30 @@
+#ifndef Py_AUDIT_H
+#define Py_AUDIT_H
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+
+#if !defined(Py_LIMITED_API) || Py_LIMITED_API+0 >= 0x030d0000
+PyAPI_FUNC(int) PySys_Audit(
+    const char *event,
+    const char *argFormat,
+    ...);
+
+PyAPI_FUNC(int) PySys_AuditTuple(
+    const char *event,
+    PyObject *args);
+#endif
+
+
+#ifndef Py_LIMITED_API
+#  define Py_CPYTHON_AUDIT_H
+#  include "cpython/audit.h"
+#  undef Py_CPYTHON_AUDIT_H
+#endif
+
+
+#ifdef __cplusplus
+}
+#endif
+#endif /* !Py_AUDIT_H */
diff --git a/Include/cpython/audit.h b/Include/cpython/audit.h
new file mode 100644
index 00000000000..3c5c7a8c060
--- /dev/null
+++ b/Include/cpython/audit.h
@@ -0,0 +1,8 @@
+#ifndef Py_CPYTHON_AUDIT_H
+#  error "this header file must not be included directly"
+#endif
+
+
+typedef int(*Py_AuditHookFunction)(const char *, PyObject *, void *);
+
+PyAPI_FUNC(int) PySys_AddAuditHook(Py_AuditHookFunction, void*);
diff --git a/Include/cpython/ceval.h b/Include/cpython/ceval.h
index 78f74056616..ca8109e3248 100644
--- a/Include/cpython/ceval.h
+++ b/Include/cpython/ceval.h
@@ -23,3 +23,21 @@ _PyEval_RequestCodeExtraIndex(freefunc f) {
 
 PyAPI_FUNC(int) _PyEval_SliceIndex(PyObject *, Py_ssize_t *);
 PyAPI_FUNC(int) _PyEval_SliceIndexNotNone(PyObject *, Py_ssize_t *);
+
+
+// Trampoline API
+
+typedef struct {
+    FILE* perf_map;
+    PyThread_type_lock map_lock;
+} PerfMapState;
+
+PyAPI_FUNC(int) PyUnstable_PerfMapState_Init(void);
+PyAPI_FUNC(int) PyUnstable_WritePerfMapEntry(
+    const void *code_addr,
+    unsigned int code_size,
+    const char *entry_name);
+PyAPI_FUNC(void) PyUnstable_PerfMapState_Fini(void);
+PyAPI_FUNC(int) PyUnstable_CopyPerfMapFile(const char* parent_filename);
+PyAPI_FUNC(int) PyUnstable_PerfTrampoline_CompileCode(PyCodeObject *);
+PyAPI_FUNC(int) PyUnstable_PerfTrampoline_SetPersistAfterFork(int enable);
diff --git a/Include/cpython/sysmodule.h b/Include/cpython/sysmodule.h
deleted file mode 100644
index a3ac07f538a..00000000000
--- a/Include/cpython/sysmodule.h
+++ /dev/null
@@ -1,22 +0,0 @@
-#ifndef Py_CPYTHON_SYSMODULE_H
-#  error "this header file must not be included directly"
-#endif
-
-typedef int(*Py_AuditHookFunction)(const char *, PyObject *, void *);
-
-PyAPI_FUNC(int) PySys_AddAuditHook(Py_AuditHookFunction, void*);
-
-typedef struct {
-    FILE* perf_map;
-    PyThread_type_lock map_lock;
-} PerfMapState;
-
-PyAPI_FUNC(int) PyUnstable_PerfMapState_Init(void);
-PyAPI_FUNC(int) PyUnstable_WritePerfMapEntry(
-    const void *code_addr,
-    unsigned int code_size,
-    const char *entry_name);
-PyAPI_FUNC(void) PyUnstable_PerfMapState_Fini(void);
-PyAPI_FUNC(int) PyUnstable_CopyPerfMapFile(const char* parent_filename);
-PyAPI_FUNC(int) PyUnstable_PerfTrampoline_CompileCode(PyCodeObject *);
-PyAPI_FUNC(int) PyUnstable_PerfTrampoline_SetPersistAfterFork(int enable);
diff --git a/Include/internal/pycore_audit.h b/Include/internal/pycore_audit.h
new file mode 100644
index 00000000000..2811aaa6236
--- /dev/null
+++ b/Include/internal/pycore_audit.h
@@ -0,0 +1,35 @@
+#ifndef Py_INTERNAL_AUDIT_H
+#define Py_INTERNAL_AUDIT_H
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#ifndef Py_BUILD_CORE
+#  error "this header requires Py_BUILD_CORE define"
+#endif
+
+
+/* Runtime audit hook state */
+
+typedef struct _Py_AuditHookEntry {
+    struct _Py_AuditHookEntry *next;
+    Py_AuditHookFunction hookCFunction;
+    void *userData;
+} _Py_AuditHookEntry;
+
+
+extern int _PySys_Audit(
+    PyThreadState *tstate,
+    const char *event,
+    const char *argFormat,
+    ...);
+
+// _PySys_ClearAuditHooks() must not be exported: use extern rather than
+// PyAPI_FUNC(). We want minimal exposure of this function.
+extern void _PySys_ClearAuditHooks(PyThreadState *tstate);
+
+
+#ifdef __cplusplus
+}
+#endif
+#endif /* !Py_INTERNAL_AUDIT_H */
diff --git a/Include/internal/pycore_debug_offsets.h b/Include/internal/pycore_debug_offsets.h
new file mode 100644
index 00000000000..184f4b9360b
--- /dev/null
+++ b/Include/internal/pycore_debug_offsets.h
@@ -0,0 +1,269 @@
+#ifndef Py_INTERNAL_DEBUG_OFFSETS_H
+#define Py_INTERNAL_DEBUG_OFFSETS_H
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#ifndef Py_BUILD_CORE
+#  error "this header requires Py_BUILD_CORE define"
+#endif
+
+
+#define _Py_Debug_Cookie "xdebugpy"
+
+#ifdef Py_GIL_DISABLED
+# define _Py_Debug_gilruntimestate_enabled offsetof(struct _gil_runtime_state, enabled)
+# define _Py_Debug_Free_Threaded 1
+#else
+# define _Py_Debug_gilruntimestate_enabled 0
+# define _Py_Debug_Free_Threaded 0
+#endif
+
+
+typedef struct _Py_DebugOffsets {
+    char cookie[8];
+    uint64_t version;
+    uint64_t free_threaded;
+    // Runtime state offset;
+    struct _runtime_state {
+        uint64_t size;
+        uint64_t finalizing;
+        uint64_t interpreters_head;
+    } runtime_state;
+
+    // Interpreter state offset;
+    struct _interpreter_state {
+        uint64_t size;
+        uint64_t id;
+        uint64_t next;
+        uint64_t threads_head;
+        uint64_t gc;
+        uint64_t imports_modules;
+        uint64_t sysdict;
+        uint64_t builtins;
+        uint64_t ceval_gil;
+        uint64_t gil_runtime_state;
+        uint64_t gil_runtime_state_enabled;
+        uint64_t gil_runtime_state_locked;
+        uint64_t gil_runtime_state_holder;
+    } interpreter_state;
+
+    // Thread state offset;
+    struct _thread_state{
+        uint64_t size;
+        uint64_t prev;
+        uint64_t next;
+        uint64_t interp;
+        uint64_t current_frame;
+        uint64_t thread_id;
+        uint64_t native_thread_id;
+        uint64_t datastack_chunk;
+        uint64_t status;
+    } thread_state;
+
+    // InterpreterFrame offset;
+    struct _interpreter_frame {
+        uint64_t size;
+        uint64_t previous;
+        uint64_t executable;
+        uint64_t instr_ptr;
+        uint64_t localsplus;
+        uint64_t owner;
+    } interpreter_frame;
+
+    // Code object offset;
+    struct _code_object {
+        uint64_t size;
+        uint64_t filename;
+        uint64_t name;
+        uint64_t qualname;
+        uint64_t linetable;
+        uint64_t firstlineno;
+        uint64_t argcount;
+        uint64_t localsplusnames;
+        uint64_t localspluskinds;
+        uint64_t co_code_adaptive;
+    } code_object;
+
+    // PyObject offset;
+    struct _pyobject {
+        uint64_t size;
+        uint64_t ob_type;
+    } pyobject;
+
+    // PyTypeObject object offset;
+    struct _type_object {
+        uint64_t size;
+        uint64_t tp_name;
+        uint64_t tp_repr;
+        uint64_t tp_flags;
+    } type_object;
+
+    // PyTuple object offset;
+    struct _tuple_object {
+        uint64_t size;
+        uint64_t ob_item;
+        uint64_t ob_size;
+    } tuple_object;
+
+    // PyList object offset;
+    struct _list_object {
+        uint64_t size;
+        uint64_t ob_item;
+        uint64_t ob_size;
+    } list_object;
+
+    // PyDict object offset;
+    struct _dict_object {
+        uint64_t size;
+        uint64_t ma_keys;
+        uint64_t ma_values;
+    } dict_object;
+
+    // PyFloat object offset;
+    struct _float_object {
+        uint64_t size;
+        uint64_t ob_fval;
+    } float_object;
+
+    // PyLong object offset;
+    struct _long_object {
+        uint64_t size;
+        uint64_t lv_tag;
+        uint64_t ob_digit;
+    } long_object;
+
+    // PyBytes object offset;
+    struct _bytes_object {
+        uint64_t size;
+        uint64_t ob_size;
+        uint64_t ob_sval;
+    } bytes_object;
+
+    // Unicode object offset;
+    struct _unicode_object {
+        uint64_t size;
+        uint64_t state;
+        uint64_t length;
+        uint64_t asciiobject_size;
+    } unicode_object;
+
+    // GC runtime state offset;
+    struct _gc {
+        uint64_t size;
+        uint64_t collecting;
+    } gc;
+} _Py_DebugOffsets;
+
+
+#define _Py_DebugOffsets_INIT(debug_cookie) { \
+    .cookie = debug_cookie, \
+    .version = PY_VERSION_HEX, \
+    .free_threaded = _Py_Debug_Free_Threaded, \
+    .runtime_state = { \
+        .size = sizeof(_PyRuntimeState), \
+        .finalizing = offsetof(_PyRuntimeState, _finalizing), \
+        .interpreters_head = offsetof(_PyRuntimeState, interpreters.head), \
+    }, \
+    .interpreter_state = { \
+        .size = sizeof(PyInterpreterState), \
+        .id = offsetof(PyInterpreterState, id), \
+        .next = offsetof(PyInterpreterState, next), \
+        .threads_head = offsetof(PyInterpreterState, threads.head), \
+        .gc = offsetof(PyInterpreterState, gc), \
+        .imports_modules = offsetof(PyInterpreterState, imports.modules), \
+        .sysdict = offsetof(PyInterpreterState, sysdict), \
+        .builtins = offsetof(PyInterpreterState, builtins), \
+        .ceval_gil = offsetof(PyInterpreterState, ceval.gil), \
+        .gil_runtime_state = offsetof(PyInterpreterState, _gil), \
+        .gil_runtime_state_enabled = _Py_Debug_gilruntimestate_enabled, \
+        .gil_runtime_state_locked = offsetof(PyInterpreterState, _gil.locked), \
+        .gil_runtime_state_holder = offsetof(PyInterpreterState, _gil.last_holder), \
+    }, \
+    .thread_state = { \
+        .size = sizeof(PyThreadState), \
+        .prev = offsetof(PyThreadState, prev), \
+        .next = offsetof(PyThreadState, next), \
+        .interp = offsetof(PyThreadState, interp), \
+        .current_frame = offsetof(PyThreadState, current_frame), \
+        .thread_id = offsetof(PyThreadState, thread_id), \
+        .native_thread_id = offsetof(PyThreadState, native_thread_id), \
+        .datastack_chunk = offsetof(PyThreadState, datastack_chunk), \
+        .status = offsetof(PyThreadState, _status), \
+    }, \
+    .interpreter_frame = { \
+        .size = sizeof(_PyInterpreterFrame), \
+        .previous = offsetof(_PyInterpreterFrame, previous), \
+        .executable = offsetof(_PyInterpreterFrame, f_executable), \
+        .instr_ptr = offsetof(_PyInterpreterFrame, instr_ptr), \
+        .localsplus = offsetof(_PyInterpreterFrame, localsplus), \
+        .owner = offsetof(_PyInterpreterFrame, owner), \
+    }, \
+    .code_object = { \
+        .size = sizeof(PyCodeObject), \
+        .filename = offsetof(PyCodeObject, co_filename), \
+        .name = offsetof(PyCodeObject, co_name), \
+        .qualname = offsetof(PyCodeObject, co_qualname), \
+        .linetable = offsetof(PyCodeObject, co_linetable), \
+        .firstlineno = offsetof(PyCodeObject, co_firstlineno), \
+        .argcount = offsetof(PyCodeObject, co_argcount), \
+        .localsplusnames = offsetof(PyCodeObject, co_localsplusnames), \
+        .localspluskinds = offsetof(PyCodeObject, co_localspluskinds), \
+        .co_code_adaptive = offsetof(PyCodeObject, co_code_adaptive), \
+    }, \
+    .pyobject = { \
+        .size = sizeof(PyObject), \
+        .ob_type = offsetof(PyObject, ob_type), \
+    }, \
+    .type_object = { \
+        .size = sizeof(PyTypeObject), \
+        .tp_name = offsetof(PyTypeObject, tp_name), \
+        .tp_repr = offsetof(PyTypeObject, tp_repr), \
+        .tp_flags = offsetof(PyTypeObject, tp_flags), \
+    }, \
+    .tuple_object = { \
+        .size = sizeof(PyTupleObject), \
+        .ob_item = offsetof(PyTupleObject, ob_item), \
+        .ob_size = offsetof(PyTupleObject, ob_base.ob_size), \
+    }, \
+    .list_object = { \
+        .size = sizeof(PyListObject), \
+        .ob_item = offsetof(PyListObject, ob_item), \
+        .ob_size = offsetof(PyListObject, ob_base.ob_size), \
+    }, \
+    .dict_object = { \
+        .size = sizeof(PyDictObject), \
+        .ma_keys = offsetof(PyDictObject, ma_keys), \
+        .ma_values = offsetof(PyDictObject, ma_values), \
+    }, \
+    .float_object = { \
+        .size = sizeof(PyFloatObject), \
+        .ob_fval = offsetof(PyFloatObject, ob_fval), \
+    }, \
+    .long_object = { \
+        .size = sizeof(PyLongObject), \
+        .lv_tag = offsetof(PyLongObject, long_value.lv_tag), \
+        .ob_digit = offsetof(PyLongObject, long_value.ob_digit), \
+    }, \
+    .bytes_object = { \
+        .size = sizeof(PyBytesObject), \
+        .ob_size = offsetof(PyBytesObject, ob_base.ob_size), \
+        .ob_sval = offsetof(PyBytesObject, ob_sval), \
+    }, \
+    .unicode_object = { \
+        .size = sizeof(PyUnicodeObject), \
+        .state = offsetof(PyUnicodeObject, _base._base.state), \
+        .length = offsetof(PyUnicodeObject, _base._base.length), \
+        .asciiobject_size = sizeof(PyASCIIObject), \
+    }, \
+    .gc = { \
+        .size = sizeof(struct _gc_runtime_state), \
+        .collecting = offsetof(struct _gc_runtime_state, collecting), \
+    }, \
+}
+
+
+#ifdef __cplusplus
+}
+#endif
+#endif /* !Py_INTERNAL_DEBUG_OFFSETS_H */
diff --git a/Include/internal/pycore_object_state.h b/Include/internal/pycore_object_state.h
index e7fa7c1f10d..8a47a6d9e6e 100644
--- a/Include/internal/pycore_object_state.h
+++ b/Include/internal/pycore_object_state.h
@@ -11,6 +11,14 @@ extern "C" {
 #include "pycore_freelist_state.h"  // _Py_freelists
 #include "pycore_hashtable.h"       // _Py_hashtable_t
 
+
+/* Reference tracer state */
+struct _reftracer_runtime_state {
+    PyRefTracer tracer_func;
+    void* tracer_data;
+};
+
+
 struct _py_object_runtime_state {
 #ifdef Py_REF_DEBUG
     Py_ssize_t interpreter_leaks;
diff --git a/Include/internal/pycore_runtime.h b/Include/internal/pycore_runtime.h
index d4291b87261..7f592aa6cf9 100644
--- a/Include/internal/pycore_runtime.h
+++ b/Include/internal/pycore_runtime.h
@@ -9,8 +9,10 @@ extern "C" {
 #endif
 
 #include "pycore_atexit.h"          // struct _atexit_runtime_state
+#include "pycore_audit.h"           // _Py_AuditHookEntry
 #include "pycore_ceval_state.h"     // struct _ceval_runtime_state
-#include "pycore_crossinterp.h"   // struct _xidregistry
+#include "pycore_crossinterp.h"     // struct _xidregistry
+#include "pycore_debug_offsets.h"   // _Py_DebugOffsets
 #include "pycore_faulthandler.h"    // struct _faulthandler_runtime_state
 #include "pycore_floatobject.h"     // struct _Py_float_runtime_state
 #include "pycore_import.h"          // struct _import_runtime_state
@@ -25,185 +27,12 @@ extern "C" {
 #include "pycore_typeobject.h"      // struct _types_runtime_state
 #include "pycore_unicodeobject.h"   // struct _Py_unicode_runtime_state
 
-struct _getargs_runtime_state {
-    struct _PyArg_Parser *static_parsers;
-};
-
-/* GIL state */
-
-struct _gilstate_runtime_state {
-    /* bpo-26558: Flag to disable PyGILState_Check().
-       If set to non-zero, PyGILState_Check() always return 1. */
-    int check_enabled;
-    /* The single PyInterpreterState used by this process'
-       GILState implementation
-    */
-    /* TODO: Given interp_main, it may be possible to kill this ref */
-    PyInterpreterState *autoInterpreterState;
-};
-
-/* Runtime audit hook state */
-
-#define _Py_Debug_Cookie "xdebugpy"
-
-#ifdef Py_GIL_DISABLED
-# define _Py_Debug_gilruntimestate_enabled offsetof(struct _gil_runtime_state, enabled)
-# define _Py_Debug_Free_Threaded 1
-#else
-# define _Py_Debug_gilruntimestate_enabled 0
-# define _Py_Debug_Free_Threaded 0
-#endif
-typedef struct _Py_AuditHookEntry {
-    struct _Py_AuditHookEntry *next;
-    Py_AuditHookFunction hookCFunction;
-    void *userData;
-} _Py_AuditHookEntry;
-
-typedef struct _Py_DebugOffsets {
-    char cookie[8];
-    uint64_t version;
-    uint64_t free_threaded;
-    // Runtime state offset;
-    struct _runtime_state {
-        uint64_t size;
-        uint64_t finalizing;
-        uint64_t interpreters_head;
-    } runtime_state;
-
-    // Interpreter state offset;
-    struct _interpreter_state {
-        uint64_t size;
-        uint64_t id;
-        uint64_t next;
-        uint64_t threads_head;
-        uint64_t gc;
-        uint64_t imports_modules;
-        uint64_t sysdict;
-        uint64_t builtins;
-        uint64_t ceval_gil;
-        uint64_t gil_runtime_state;
-        uint64_t gil_runtime_state_enabled;
-        uint64_t gil_runtime_state_locked;
-        uint64_t gil_runtime_state_holder;
-    } interpreter_state;
-
-    // Thread state offset;
-    struct _thread_state{
-        uint64_t size;
-        uint64_t prev;
-        uint64_t next;
-        uint64_t interp;
-        uint64_t current_frame;
-        uint64_t thread_id;
-        uint64_t native_thread_id;
-        uint64_t datastack_chunk;
-        uint64_t status;
-    } thread_state;
-
-    // InterpreterFrame offset;
-    struct _interpreter_frame {
-        uint64_t size;
-        uint64_t previous;
-        uint64_t executable;
-        uint64_t instr_ptr;
-        uint64_t localsplus;
-        uint64_t owner;
-    } interpreter_frame;
-
-    // Code object offset;
-    struct _code_object {
-        uint64_t size;
-        uint64_t filename;
-        uint64_t name;
-        uint64_t qualname;
-        uint64_t linetable;
-        uint64_t firstlineno;
-        uint64_t argcount;
-        uint64_t localsplusnames;
-        uint64_t localspluskinds;
-        uint64_t co_code_adaptive;
-    } code_object;
-
-    // PyObject offset;
-    struct _pyobject {
-        uint64_t size;
-        uint64_t ob_type;
-    } pyobject;
-
-    // PyTypeObject object offset;
-    struct _type_object {
-        uint64_t size;
-        uint64_t tp_name;
-        uint64_t tp_repr;
-        uint64_t tp_flags;
-    } type_object;
-
-    // PyTuple object offset;
-    struct _tuple_object {
-        uint64_t size;
-        uint64_t ob_item;
-        uint64_t ob_size;
-    } tuple_object;
-
-    // PyList object offset;
-    struct _list_object {
-        uint64_t size;
-        uint64_t ob_item;
-        uint64_t ob_size;
-    } list_object;
-
-    // PyDict object offset;
-    struct _dict_object {
-        uint64_t size;
-        uint64_t ma_keys;
-        uint64_t ma_values;
-    } dict_object;
-
-    // PyFloat object offset;
-    struct _float_object {
-        uint64_t size;
-        uint64_t ob_fval;
-    } float_object;
-
-    // PyLong object offset;
-    struct _long_object {
-        uint64_t size;
-        uint64_t lv_tag;
-        uint64_t ob_digit;
-    } long_object;
-
-    // PyBytes object offset;
-    struct _bytes_object {
-        uint64_t size;
-        uint64_t ob_size;
-        uint64_t ob_sval;
-    } bytes_object;
-
-    // Unicode object offset;
-    struct _unicode_object {
-        uint64_t size;
-        uint64_t state;
-        uint64_t length;
-        uint64_t asciiobject_size;
-    } unicode_object;
-
-    // GC runtime state offset;
-    struct _gc {
-        uint64_t size;
-        uint64_t collecting;
-    } gc;
-} _Py_DebugOffsets;
-
-/* Reference tracer state */
-struct _reftracer_runtime_state {
-    PyRefTracer tracer_func;
-    void* tracer_data;
-};
 
 /* Full Python runtime state */
 
 /* _PyRuntimeState holds the global state for the CPython runtime.
-   That data is exposed in the internal API as a static variable (_PyRuntime).
+   That data is exported by the internal API as a global variable
+   (_PyRuntime, defined near the top of pylifecycle.c).
    */
 typedef struct pyruntimestate {
     /* This field must be first to facilitate locating it by out of process
@@ -299,8 +128,19 @@ typedef struct pyruntimestate {
 
     struct _import_runtime_state imports;
     struct _ceval_runtime_state ceval;
-    struct _gilstate_runtime_state gilstate;
-    struct _getargs_runtime_state getargs;
+    struct _gilstate_runtime_state {
+        /* bpo-26558: Flag to disable PyGILState_Check().
+           If set to non-zero, PyGILState_Check() always return 1. */
+        int check_enabled;
+        /* The single PyInterpreterState used by this process'
+           GILState implementation
+        */
+        /* TODO: Given interp_main, it may be possible to kill this ref */
+        PyInterpreterState *autoInterpreterState;
+    } gilstate;
+    struct _getargs_runtime_state {
+        struct _PyArg_Parser *static_parsers;
+    } getargs;
     struct _fileutils_state fileutils;
     struct _faulthandler_runtime_state faulthandler;
     struct _tracemalloc_runtime_state tracemalloc;
@@ -404,6 +244,7 @@ _PyRuntimeState_SetFinalizing(_PyRuntimeState *runtime, PyThreadState *tstate) {
     }
 }
 
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/Include/internal/pycore_runtime_init.h b/Include/internal/pycore_runtime_init.h
index a17ba46966d..e99febab2f3 100644
--- a/Include/internal/pycore_runtime_init.h
+++ b/Include/internal/pycore_runtime_init.h
@@ -9,6 +9,7 @@ extern "C" {
 #endif
 
 #include "pycore_ceval_state.h"   // _PyEval_RUNTIME_PERF_INIT
+#include "pycore_debug_offsets.h"  // _Py_DebugOffsets_INIT()
 #include "pycore_faulthandler.h"  // _faulthandler_runtime_state_INIT
 #include "pycore_floatobject.h"   // _py_float_format_unknown
 #include "pycore_function.h"
@@ -32,111 +33,7 @@ extern PyTypeObject _PyExc_MemoryError;
 
 #define _PyRuntimeState_INIT(runtime, debug_cookie) \
     { \
-        .debug_offsets = { \
-            .cookie = debug_cookie, \
-            .version = PY_VERSION_HEX, \
-            .free_threaded = _Py_Debug_Free_Threaded, \
-            .runtime_state = { \
-                .size = sizeof(_PyRuntimeState), \
-                .finalizing = offsetof(_PyRuntimeState, _finalizing), \
-                .interpreters_head = offsetof(_PyRuntimeState, interpreters.head), \
-            }, \
-            .interpreter_state = { \
-                .size = sizeof(PyInterpreterState), \
-                .id = offsetof(PyInterpreterState, id), \
-                .next = offsetof(PyInterpreterState, next), \
-                .threads_head = offsetof(PyInterpreterState, threads.head), \
-                .gc = offsetof(PyInterpreterState, gc), \
-                .imports_modules = offsetof(PyInterpreterState, imports.modules), \
-                .sysdict = offsetof(PyInterpreterState, sysdict), \
-                .builtins = offsetof(PyInterpreterState, builtins), \
-                .ceval_gil = offsetof(PyInterpreterState, ceval.gil), \
-                .gil_runtime_state = offsetof(PyInterpreterState, _gil), \
-                .gil_runtime_state_enabled = _Py_Debug_gilruntimestate_enabled, \
-                .gil_runtime_state_locked = offsetof(PyInterpreterState, _gil.locked), \
-                .gil_runtime_state_holder = offsetof(PyInterpreterState, _gil.last_holder), \
-            }, \
-            .thread_state = { \
-                .size = sizeof(PyThreadState), \
-                .prev = offsetof(PyThreadState, prev), \
-                .next = offsetof(PyThreadState, next), \
-                .interp = offsetof(PyThreadState, interp), \
-                .current_frame = offsetof(PyThreadState, current_frame), \
-                .thread_id = offsetof(PyThreadState, thread_id), \
-                .native_thread_id = offsetof(PyThreadState, native_thread_id), \
-                .datastack_chunk = offsetof(PyThreadState, datastack_chunk), \
-                .status = offsetof(PyThreadState, _status), \
-            }, \
-            .interpreter_frame = { \
-                .size = sizeof(_PyInterpreterFrame), \
-                .previous = offsetof(_PyInterpreterFrame, previous), \
-                .executable = offsetof(_PyInterpreterFrame, f_executable), \
-                .instr_ptr = offsetof(_PyInterpreterFrame, instr_ptr), \
-                .localsplus = offsetof(_PyInterpreterFrame, localsplus), \
-                .owner = offsetof(_PyInterpreterFrame, owner), \
-            }, \
-            .code_object = { \
-                .size = sizeof(PyCodeObject), \
-                .filename = offsetof(PyCodeObject, co_filename), \
-                .name = offsetof(PyCodeObject, co_name), \
-                .qualname = offsetof(PyCodeObject, co_qualname), \
-                .linetable = offsetof(PyCodeObject, co_linetable), \
-                .firstlineno = offsetof(PyCodeObject, co_firstlineno), \
-                .argcount = offsetof(PyCodeObject, co_argcount), \
-                .localsplusnames = offsetof(PyCodeObject, co_localsplusnames), \
-                .localspluskinds = offsetof(PyCodeObject, co_localspluskinds), \
-                .co_code_adaptive = offsetof(PyCodeObject, co_code_adaptive), \
-            }, \
-            .pyobject = { \
-                .size = sizeof(PyObject), \
-                .ob_type = offsetof(PyObject, ob_type), \
-            }, \
-            .type_object = { \
-                .size = sizeof(PyTypeObject), \
-                .tp_name = offsetof(PyTypeObject, tp_name), \
-                .tp_repr = offsetof(PyTypeObject, tp_repr), \
-                .tp_flags = offsetof(PyTypeObject, tp_flags), \
-            }, \
-            .tuple_object = { \
-                .size = sizeof(PyTupleObject), \
-                .ob_item = offsetof(PyTupleObject, ob_item), \
-                .ob_size = offsetof(PyTupleObject, ob_base.ob_size), \
-            }, \
-            .list_object = { \
-                .size = sizeof(PyListObject), \
-                .ob_item = offsetof(PyListObject, ob_item), \
-                .ob_size = offsetof(PyListObject, ob_base.ob_size), \
-            }, \
-            .dict_object = { \
-                .size = sizeof(PyDictObject), \
-                .ma_keys = offsetof(PyDictObject, ma_keys), \
-                .ma_values = offsetof(PyDictObject, ma_values), \
-            }, \
-            .float_object = { \
-                .size = sizeof(PyFloatObject), \
-                .ob_fval = offsetof(PyFloatObject, ob_fval), \
-            }, \
-            .long_object = { \
-                .size = sizeof(PyLongObject), \
-                .lv_tag = offsetof(PyLongObject, long_value.lv_tag), \
-                .ob_digit = offsetof(PyLongObject, long_value.ob_digit), \
-            }, \
-            .bytes_object = { \
-                .size = sizeof(PyBytesObject), \
-                .ob_size = offsetof(PyBytesObject, ob_base.ob_size), \
-                .ob_sval = offsetof(PyBytesObject, ob_sval), \
-            }, \
-            .unicode_object = { \
-                .size = sizeof(PyUnicodeObject), \
-                .state = offsetof(PyUnicodeObject, _base._base.state), \
-                .length = offsetof(PyUnicodeObject, _base._base.length), \
-                .asciiobject_size = sizeof(PyASCIIObject), \
-            }, \
-            .gc = { \
-                .size = sizeof(struct _gc_runtime_state), \
-                .collecting = offsetof(struct _gc_runtime_state, collecting), \
-            }, \
-        }, \
+        .debug_offsets = _Py_DebugOffsets_INIT(debug_cookie), \
         .allocators = { \
             .standard = _pymem_allocators_standard_INIT(runtime), \
             .debug = _pymem_allocators_debug_INIT, \
diff --git a/Include/internal/pycore_sysmodule.h b/Include/internal/pycore_sysmodule.h
index a1d795e284f..99968df54a4 100644
--- a/Include/internal/pycore_sysmodule.h
+++ b/Include/internal/pycore_sysmodule.h
@@ -14,16 +14,6 @@ PyAPI_FUNC(PyObject*) _PySys_GetAttr(PyThreadState *tstate, PyObject *name);
 // Export for '_pickle' shared extension
 PyAPI_FUNC(size_t) _PySys_GetSizeOf(PyObject *);
 
-extern int _PySys_Audit(
-    PyThreadState *tstate,
-    const char *event,
-    const char *argFormat,
-    ...);
-
-// _PySys_ClearAuditHooks() must not be exported: use extern rather than
-// PyAPI_FUNC(). We want minimal exposure of this function.
-extern void _PySys_ClearAuditHooks(PyThreadState *tstate);
-
 extern int _PySys_SetAttr(PyObject *, PyObject *);
 
 extern int _PySys_ClearAttrString(PyInterpreterState *interp,
diff --git a/Include/sysmodule.h b/Include/sysmodule.h
index 5a0af2e1578..c1d5f610fe0 100644
--- a/Include/sysmodule.h
+++ b/Include/sysmodule.h
@@ -21,23 +21,6 @@ Py_DEPRECATED(3.13) PyAPI_FUNC(void) PySys_ResetWarnOptions(void);
 
 PyAPI_FUNC(PyObject *) PySys_GetXOptions(void);
 
-#if !defined(Py_LIMITED_API) || Py_LIMITED_API+0 >= 0x030d0000
-PyAPI_FUNC(int) PySys_Audit(
-    const char *event,
-    const char *argFormat,
-    ...);
-
-PyAPI_FUNC(int) PySys_AuditTuple(
-    const char *event,
-    PyObject *args);
-#endif
-
-#ifndef Py_LIMITED_API
-#  define Py_CPYTHON_SYSMODULE_H
-#  include "cpython/sysmodule.h"
-#  undef Py_CPYTHON_SYSMODULE_H
-#endif
-
 #ifdef __cplusplus
 }
 #endif
diff --git a/Makefile.pre.in b/Makefile.pre.in
index 07c8a4d2014..fb6f22d5739 100644
--- a/Makefile.pre.in
+++ b/Makefile.pre.in
@@ -1032,6 +1032,7 @@ python.worker.js: $(srcdir)/Tools/wasm/python.worker.js
 PYTHON_HEADERS= \
 		$(srcdir)/Include/Python.h \
 		$(srcdir)/Include/abstract.h \
+		$(srcdir)/Include/audit.h \
 		$(srcdir)/Include/bltinmodule.h \
 		$(srcdir)/Include/boolobject.h \
 		$(srcdir)/Include/bytearrayobject.h \
@@ -1110,6 +1111,7 @@ PYTHON_HEADERS= \
 		$(PARSER_HEADERS) \
 		\
 		$(srcdir)/Include/cpython/abstract.h \
+		$(srcdir)/Include/cpython/audit.h \
 		$(srcdir)/Include/cpython/bytearrayobject.h \
 		$(srcdir)/Include/cpython/bytesobject.h \
 		$(srcdir)/Include/cpython/cellobject.h \
@@ -1159,7 +1161,6 @@ PYTHON_HEADERS= \
 		$(srcdir)/Include/cpython/pythonrun.h \
 		$(srcdir)/Include/cpython/pythread.h \
 		$(srcdir)/Include/cpython/setobject.h \
-		$(srcdir)/Include/cpython/sysmodule.h \
 		$(srcdir)/Include/cpython/traceback.h \
 		$(srcdir)/Include/cpython/tracemalloc.h \
 		$(srcdir)/Include/cpython/tupleobject.h \
@@ -1174,6 +1175,7 @@ PYTHON_HEADERS= \
 		$(srcdir)/Include/internal/pycore_ast.h \
 		$(srcdir)/Include/internal/pycore_ast_state.h \
 		$(srcdir)/Include/internal/pycore_atexit.h \
+		$(srcdir)/Include/internal/pycore_audit.h \
 		$(srcdir)/Include/internal/pycore_backoff.h \
 		$(srcdir)/Include/internal/pycore_bitutils.h \
 		$(srcdir)/Include/internal/pycore_blocks_output_buffer.h \
@@ -1193,6 +1195,7 @@ PYTHON_HEADERS= \
 		$(srcdir)/Include/internal/pycore_context.h \
 		$(srcdir)/Include/internal/pycore_critical_section.h \
 		$(srcdir)/Include/internal/pycore_crossinterp.h \
+		$(srcdir)/Include/internal/pycore_debug_offsets.h \
 		$(srcdir)/Include/internal/pycore_descrobject.h \
 		$(srcdir)/Include/internal/pycore_dict.h \
 		$(srcdir)/Include/internal/pycore_dict_state.h \
diff --git a/Modules/_testexternalinspection.c b/Modules/_testexternalinspection.c
index 2476346777c..0807d1e47b6 100644
--- a/Modules/_testexternalinspection.c
+++ b/Modules/_testexternalinspection.c
@@ -51,7 +51,9 @@
 #    define Py_BUILD_CORE_MODULE 1
 #endif
 #include "Python.h"
-#include <internal/pycore_runtime.h>
+#include <internal/pycore_debug_offsets.h>  // _Py_DebugOffsets
+#include <internal/pycore_frame.h>          // FRAME_OWNED_BY_CSTACK
+#include <internal/pycore_stackref.h>       // Py_TAG_BITS
 
 #ifndef HAVE_PROCESS_VM_READV
 #    define HAVE_PROCESS_VM_READV 0
diff --git a/Objects/object.c b/Objects/object.c
index 4a4c5bf7d7f..1a15b70d3dc 100644
--- a/Objects/object.c
+++ b/Objects/object.c
@@ -17,6 +17,7 @@
 #include "pycore_memoryobject.h"  // _PyManagedBuffer_Type
 #include "pycore_namespace.h"     // _PyNamespace_Type
 #include "pycore_object.h"        // PyAPI_DATA() _Py_SwappedOp definition
+#include "pycore_object_state.h"  // struct _reftracer_runtime_state
 #include "pycore_long.h"          // _PyLong_GetZero()
 #include "pycore_optimizer.h"     // _PyUOpExecutor_Type, _PyUOpOptimizer_Type, ...
 #include "pycore_pyerrors.h"      // _PyErr_Occurred()
diff --git a/PCbuild/pythoncore.vcxproj b/PCbuild/pythoncore.vcxproj
index 3b33c6bf6bb..a4881e9256e 100644
--- a/PCbuild/pythoncore.vcxproj
+++ b/PCbuild/pythoncore.vcxproj
@@ -128,6 +128,7 @@
   <ItemGroup>
     <ClInclude Include="..\Include\Python.h" />
     <ClInclude Include="..\Include\abstract.h" />
+    <ClInclude Include="..\Include\audit.h" />
     <ClInclude Include="..\Include\boolobject.h" />
     <ClInclude Include="..\Include\bytearrayobject.h" />
     <ClInclude Include="..\Include\bytesobject.h" />
@@ -137,6 +138,7 @@
     <ClInclude Include="..\Include\complexobject.h" />
     <ClInclude Include="..\Include\critical_section.h" />
     <ClInclude Include="..\Include\cpython\abstract.h" />
+    <ClInclude Include="..\Include\cpython\audit.h" />
     <ClInclude Include="..\Include\cpython\bytearrayobject.h" />
     <ClInclude Include="..\Include\cpython\bytesobject.h" />
     <ClInclude Include="..\Include\cpython\cellobject.h" />
@@ -185,7 +187,6 @@
     <ClInclude Include="..\Include\cpython\pythonrun.h" />
     <ClInclude Include="..\Include\cpython\pythread.h" />
     <ClInclude Include="..\Include\cpython\setobject.h" />
-    <ClInclude Include="..\Include\cpython\sysmodule.h" />
     <ClInclude Include="..\Include\cpython\traceback.h" />
     <ClInclude Include="..\Include\cpython\tracemalloc.h" />
     <ClInclude Include="..\Include\cpython\tupleobject.h" />
@@ -208,6 +209,7 @@
     <ClInclude Include="..\Include\internal\pycore_ast.h" />
     <ClInclude Include="..\Include\internal\pycore_ast_state.h" />
     <ClInclude Include="..\Include\internal\pycore_atexit.h" />
+    <ClInclude Include="..\Include\internal\pycore_audit.h" />
     <ClInclude Include="..\Include\internal\pycore_backoff.h" />
     <ClInclude Include="..\Include\internal\pycore_bitutils.h" />
     <ClInclude Include="..\Include\internal\pycore_brc.h" />
@@ -227,6 +229,7 @@
     <ClInclude Include="..\Include\internal\pycore_context.h" />
     <ClInclude Include="..\Include\internal\pycore_critical_section.h" />
     <ClInclude Include="..\Include\internal\pycore_crossinterp.h" />
+    <ClInclude Include="..\Include\internal\pycore_debug_offsets.h" />
     <ClInclude Include="..\Include\internal\pycore_descrobject.h" />
     <ClInclude Include="..\Include\internal\pycore_dict.h" />
     <ClInclude Include="..\Include\internal\pycore_dict_state.h" />
diff --git a/PCbuild/pythoncore.vcxproj.filters b/PCbuild/pythoncore.vcxproj.filters
index ee2930b1043..6b294683320 100644
--- a/PCbuild/pythoncore.vcxproj.filters
+++ b/PCbuild/pythoncore.vcxproj.filters
@@ -48,6 +48,9 @@
     <ClInclude Include="..\Include\abstract.h">
       <Filter>Include</Filter>
     </ClInclude>
+    <ClInclude Include="..\Include\audit.h">
+      <Filter>Include</Filter>
+    </ClInclude>
     <ClInclude Include="..\Include\boolobject.h">
       <Filter>Include</Filter>
     </ClInclude>
@@ -354,6 +357,9 @@
     <ClInclude Include="..\Include\cpython\abstract.h">
       <Filter>Include\cpython</Filter>
     </ClInclude>
+    <ClInclude Include="..\Include\cpython\audit.h">
+      <Filter>Include\cpython</Filter>
+    </ClInclude>
     <ClInclude Include="..\Include\cpython\bytearrayobject.h">
       <Filter>Include\cpython</Filter>
     </ClInclude>
@@ -513,9 +519,6 @@
     <ClInclude Include="..\Include\cpython\setobject.h">
       <Filter>Include\cpython</Filter>
     </ClInclude>
-    <ClInclude Include="..\Include\cpython\sysmodule.h">
-      <Filter>Include\cpython</Filter>
-    </ClInclude>
     <ClInclude Include="..\Include\cpython\pystate.h">
       <Filter>Include\cpython</Filter>
     </ClInclude>
@@ -552,6 +555,9 @@
     <ClInclude Include="..\Include\internal\pycore_atexit.h">
       <Filter>Include\internal</Filter>
     </ClInclude>
+    <ClInclude Include="..\Include\internal\pycore_audit.h">
+      <Filter>Include\internal</Filter>
+    </ClInclude>
     <ClInclude Include="..\Include\internal\pycore_bitutils.h">
       <Filter>Include\internal</Filter>
     </ClInclude>
@@ -603,6 +609,9 @@
     <ClInclude Include="..\Include\internal\pycore_crossinterp.h">
       <Filter>Include\internal</Filter>
     </ClInclude>
+    <ClInclude Include="..\Include\internal\pycore_debug_offsets.h">
+      <Filter>Include\internal</Filter>
+    </ClInclude>
     <ClInclude Include="..\Include\internal\pycore_descrobject.h">
       <Filter>Include\internal</Filter>
     </ClInclude>
diff --git a/Python/bytecodes.c b/Python/bytecodes.c
index e6525657cab..c59a35c3e82 100644
--- a/Python/bytecodes.c
+++ b/Python/bytecodes.c
@@ -8,6 +8,7 @@
 
 #include "Python.h"
 #include "pycore_abstract.h"      // _PyIndex_Check()
+#include "pycore_audit.h"         // _PySys_Audit()
 #include "pycore_backoff.h"
 #include "pycore_cell.h"          // PyCell_GetRef()
 #include "pycore_ceval.h"
@@ -27,7 +28,6 @@
 #include "pycore_range.h"         // _PyRangeIterObject
 #include "pycore_setobject.h"     // _PySet_NextEntry()
 #include "pycore_sliceobject.h"   // _PyBuildSlice_ConsumeRefs
-#include "pycore_sysmodule.h"     // _PySys_Audit()
 #include "pycore_tuple.h"         // _PyTuple_ITEMS()
 #include "pycore_typeobject.h"    // _PySuper_Lookup()
 
diff --git a/Python/ceval.c b/Python/ceval.c
index 98d95b28488..55e5eba25ea 100644
--- a/Python/ceval.c
+++ b/Python/ceval.c
@@ -4,6 +4,7 @@
 
 #include "Python.h"
 #include "pycore_abstract.h"      // _PyIndex_Check()
+#include "pycore_audit.h"         // _PySys_Audit()
 #include "pycore_backoff.h"
 #include "pycore_call.h"          // _PyObject_CallNoArgs()
 #include "pycore_cell.h"          // PyCell_GetRef()
@@ -26,7 +27,6 @@
 #include "pycore_range.h"         // _PyRangeIterObject
 #include "pycore_setobject.h"     // _PySet_Update()
 #include "pycore_sliceobject.h"   // _PyBuildSlice_ConsumeRefs
-#include "pycore_sysmodule.h"     // _PySys_Audit()
 #include "pycore_tuple.h"         // _PyTuple_ITEMS()
 #include "pycore_typeobject.h"    // _PySuper_Lookup()
 #include "pycore_uop_ids.h"       // Uops
diff --git a/Python/errors.c b/Python/errors.c
index 9e2a3ce062a..7f3b4aabc43 100644
--- a/Python/errors.c
+++ b/Python/errors.c
@@ -2,12 +2,13 @@
 /* Error handling */
 
 #include "Python.h"
+#include "pycore_audit.h"         // _PySys_Audit()
 #include "pycore_call.h"          // _PyObject_CallNoArgs()
 #include "pycore_initconfig.h"    // _PyStatus_ERR()
 #include "pycore_pyerrors.h"      // _PyErr_Format()
 #include "pycore_pystate.h"       // _PyThreadState_GET()
 #include "pycore_structseq.h"     // _PyStructSequence_FiniBuiltin()
-#include "pycore_sysmodule.h"     // _PySys_Audit()
+#include "pycore_sysmodule.h"     // _PySys_GetAttr()
 #include "pycore_traceback.h"     // _PyTraceBack_FromFrame()
 
 #ifdef MS_WINDOWS
diff --git a/Python/import.c b/Python/import.c
index acf849f1456..d8ad37b2422 100644
--- a/Python/import.c
+++ b/Python/import.c
@@ -1,6 +1,7 @@
 /* Module definition and import implementation */
 
 #include "Python.h"
+#include "pycore_audit.h"         // _PySys_Audit()
 #include "pycore_ceval.h"
 #include "pycore_hashtable.h"     // _Py_hashtable_new_full()
 #include "pycore_import.h"        // _PyImport_BootstrapImp()
@@ -14,7 +15,7 @@
 #include "pycore_pylifecycle.h"
 #include "pycore_pymem.h"         // _PyMem_SetDefaultAllocator()
 #include "pycore_pystate.h"       // _PyInterpreterState_GET()
-#include "pycore_sysmodule.h"     // _PySys_Audit()
+#include "pycore_sysmodule.h"     // _PySys_ClearAttrString()
 #include "pycore_time.h"          // _PyTime_AsMicroseconds()
 #include "pycore_weakref.h"       // _PyWeakref_GET_REF()
 
diff --git a/Python/legacy_tracing.c b/Python/legacy_tracing.c
index 1436921a19b..45af275f1f6 100644
--- a/Python/legacy_tracing.c
+++ b/Python/legacy_tracing.c
@@ -3,9 +3,9 @@
  */
 
 #include "Python.h"
+#include "pycore_audit.h"         // _PySys_Audit()
 #include "pycore_ceval.h"         // export _PyEval_SetProfile()
 #include "pycore_object.h"
-#include "pycore_sysmodule.h"     // _PySys_Audit()
 
 #include "opcode.h"
 #include <stddef.h>
diff --git a/Python/pylifecycle.c b/Python/pylifecycle.c
index 5fb9c4f7c71..b8f424854ec 100644
--- a/Python/pylifecycle.c
+++ b/Python/pylifecycle.c
@@ -2,6 +2,7 @@
 
 #include "Python.h"
 
+#include "pycore_audit.h"         // _PySys_ClearAuditHooks()
 #include "pycore_call.h"          // _PyObject_CallMethod()
 #include "pycore_ceval.h"         // _PyEval_FiniGIL()
 #include "pycore_codecs.h"        // _PyCodec_Lookup()
@@ -26,7 +27,7 @@
 #include "pycore_runtime_init.h"  // _PyRuntimeState_INIT
 #include "pycore_setobject.h"     // _PySet_NextEntry()
 #include "pycore_sliceobject.h"   // _PySlice_Fini()
-#include "pycore_sysmodule.h"     // _PySys_ClearAuditHooks()
+#include "pycore_sysmodule.h"     // _PySys_GetAttr()
 #include "pycore_traceback.h"     // _Py_DumpTracebackThreads()
 #include "pycore_uniqueid.h"      // _PyObject_FinalizeUniqueIdPool()
 #include "pycore_typeobject.h"    // _PyTypes_InitTypes()
@@ -78,6 +79,7 @@ static void wait_for_thread_shutdown(PyThreadState *tstate);
 static void finalize_subinterpreters(void);
 static void call_ll_exitfuncs(_PyRuntimeState *runtime);
 
+
 /* The following places the `_PyRuntime` structure in a location that can be
  * found without any external information. This is meant to ease access to the
  * interpreter state for various runtime debugging tools, but is *not* an
@@ -107,6 +109,7 @@ __attribute__ ((section (".PyRuntime")))
 = _PyRuntimeState_INIT(_PyRuntime, _Py_Debug_Cookie);
 _Py_COMP_DIAG_POP
 
+
 static int runtime_initialized = 0;
 
 PyStatus
diff --git a/Python/pystate.c b/Python/pystate.c
index e3812cba41d..7df872cd6d7 100644
--- a/Python/pystate.c
+++ b/Python/pystate.c
@@ -3,6 +3,7 @@
 
 #include "Python.h"
 #include "pycore_abstract.h"      // _PyIndex_Check()
+#include "pycore_audit.h"         // _Py_AuditHookEntry
 #include "pycore_ceval.h"
 #include "pycore_code.h"          // stats
 #include "pycore_critical_section.h"       // _PyCriticalSection_Resume()
@@ -18,7 +19,6 @@
 #include "pycore_pymem.h"         // _PyMem_SetDefaultAllocator()
 #include "pycore_pystate.h"
 #include "pycore_runtime_init.h"  // _PyRuntimeState_INIT
-#include "pycore_sysmodule.h"     // _PySys_Audit()
 #include "pycore_obmalloc.h"      // _PyMem_obmalloc_state_on_heap()
 #include "pycore_uniqueid.h"      // _PyObject_FinalizePerThreadRefcounts()
 
diff --git a/Python/pythonrun.c b/Python/pythonrun.c
index b67597113ea..fc0f11bc4e8 100644
--- a/Python/pythonrun.c
+++ b/Python/pythonrun.c
@@ -13,6 +13,7 @@
 #include "Python.h"
 
 #include "pycore_ast.h"           // PyAST_mod2obj()
+#include "pycore_audit.h"         // _PySys_Audit()
 #include "pycore_ceval.h"         // _Py_EnterRecursiveCall()
 #include "pycore_compile.h"       // _PyAST_Compile()
 #include "pycore_interp.h"        // PyInterpreterState.importlib
@@ -22,7 +23,7 @@
 #include "pycore_pylifecycle.h"   // _Py_FdIsInteractive()
 #include "pycore_pystate.h"       // _PyInterpreterState_GET()
 #include "pycore_pythonrun.h"     // export _PyRun_InteractiveLoopObject()
-#include "pycore_sysmodule.h"     // _PySys_Audit()
+#include "pycore_sysmodule.h"     // _PySys_GetAttr()
 #include "pycore_traceback.h"     // _PyTraceBack_Print()
 
 #include "errcode.h"              // E_EOF
diff --git a/Python/sysmodule.c b/Python/sysmodule.c
index ac343a8048e..8b920932400 100644
--- a/Python/sysmodule.c
+++ b/Python/sysmodule.c
@@ -15,6 +15,7 @@ Data members:
 */
 
 #include "Python.h"
+#include "pycore_audit.h"         // _Py_AuditHookEntry
 #include "pycore_call.h"          // _PyObject_CallNoArgs()
 #include "pycore_ceval.h"         // _PyEval_SetAsyncGenFinalizer()
 #include "pycore_dict.h"          // _PyDict_GetItemWithError()