diff --git a/lib/iolog/host_port.c b/lib/iolog/host_port.c
index c334f8b32..b16c65867 100644
--- a/lib/iolog/host_port.c
+++ b/lib/iolog/host_port.c
@@ -26,9 +26,9 @@
 #include <stdio.h>
 #include <string.h>
 
-#include "sudo_gettext.h"	/* must be included before sudo_compat.h */
 #include "sudo_compat.h"
 #include "sudo_debug.h"
+#include "sudo_gettext.h"
 #include "sudo_util.h"
 
 /*
diff --git a/lib/iolog/iolog_fileio.c b/lib/iolog/iolog_fileio.c
index 75ed27b30..fa59b21a2 100644
--- a/lib/iolog/iolog_fileio.c
+++ b/lib/iolog/iolog_fileio.c
@@ -37,17 +37,17 @@
 #include <fcntl.h>
 #include <limits.h>
 
-#include "sudo_gettext.h"	/* must be included before sudo_compat.h */
+#include "pathnames.h"
 #include "sudo_compat.h"
 #include "sudo_conf.h"
 #include "sudo_debug.h"
 #include "sudo_event.h"
+#include "sudo_fatal.h"
+#include "sudo_gettext.h"
+#include "sudo_iolog.h"
 #include "sudo_json.h"
 #include "sudo_queue.h"
 #include "sudo_util.h"
-#include "sudo_fatal.h"
-#include "sudo_iolog.h"
-#include "pathnames.h"
 
 static unsigned char const gzip_magic[2] = {0x1f, 0x8b};
 static unsigned int sessid_max = SESSID_MAX;
diff --git a/lib/iolog/iolog_json.c b/lib/iolog/iolog_json.c
index 3adf06dc5..1c52e2c6c 100644
--- a/lib/iolog/iolog_json.c
+++ b/lib/iolog/iolog_json.c
@@ -37,13 +37,12 @@
 #include <fcntl.h>
 #include <time.h>
 
-#include "sudo_gettext.h"	/* must be included before sudo_compat.h */
-
 #include "sudo_compat.h"
-#include "sudo_fatal.h"
 #include "sudo_debug.h"
-#include "sudo_util.h"
+#include "sudo_fatal.h"
+#include "sudo_gettext.h"
 #include "sudo_iolog.h"
+#include "sudo_util.h"
 
 #include "iolog_json.h"
 
diff --git a/lib/iolog/iolog_path.c b/lib/iolog/iolog_path.c
index c11eab1fd..1f34c0b10 100644
--- a/lib/iolog/iolog_path.c
+++ b/lib/iolog/iolog_path.c
@@ -35,13 +35,12 @@
 #include <time.h>
 #include <unistd.h>
 
-#include "sudo_gettext.h"	/* must be included before sudo_compat.h */
-
 #include "sudo_compat.h"
-#include "sudo_fatal.h"
 #include "sudo_debug.h"
-#include "sudo_util.h"
+#include "sudo_fatal.h"
+#include "sudo_gettext.h"
 #include "sudo_iolog.h"
+#include "sudo_util.h"
 
 /*
  * Expand any escape sequences in inpath, returning the expanded path.
diff --git a/lib/iolog/iolog_util.c b/lib/iolog/iolog_util.c
index 05264e233..c1339d5dc 100644
--- a/lib/iolog/iolog_util.c
+++ b/lib/iolog/iolog_util.c
@@ -39,13 +39,12 @@
 #include <fcntl.h>
 #include <time.h>
 
-#include "sudo_gettext.h"	/* must be included before sudo_compat.h */
-
 #include "sudo_compat.h"
-#include "sudo_fatal.h"
 #include "sudo_debug.h"
-#include "sudo_util.h"
+#include "sudo_fatal.h"
+#include "sudo_gettext.h"
 #include "sudo_iolog.h"
+#include "sudo_util.h"
 
 static int timing_event_adj;
 
diff --git a/lib/util/ttyname_dev.c b/lib/util/ttyname_dev.c
index 9349a722c..def4ace2c 100644
--- a/lib/util/ttyname_dev.c
+++ b/lib/util/ttyname_dev.c
@@ -41,7 +41,7 @@
 #include <limits.h>
 #include <dirent.h>
 
-#include <pathnames.h>
+#include "pathnames.h"
 #include "sudo_compat.h"
 #include "sudo_debug.h"
 #include "sudo_conf.h"
diff --git a/logsrvd/eventlog.c b/logsrvd/eventlog.c
index 2c7920c66..006a9b5dc 100644
--- a/logsrvd/eventlog.c
+++ b/logsrvd/eventlog.c
@@ -45,15 +45,16 @@
 #include <time.h>
 #include <unistd.h>
 
-#include "log_server.pb-c.h"
-#include "sudo_gettext.h"	/* must be included before sudo_compat.h */
 #include "sudo_compat.h"
+#include "sudo_debug.h"
 #include "sudo_fatal.h"
+#include "sudo_gettext.h"
+#include "sudo_iolog.h"
 #include "sudo_json.h"
 #include "sudo_queue.h"
-#include "sudo_debug.h"
 #include "sudo_util.h"
-#include "sudo_iolog.h"
+
+#include "log_server.pb-c.h"
 #include "logsrvd.h"
 
 #define	LL_HOST_STR	"HOST="
diff --git a/logsrvd/iolog_writer.c b/logsrvd/iolog_writer.c
index f00147727..7e9918296 100644
--- a/logsrvd/iolog_writer.c
+++ b/logsrvd/iolog_writer.c
@@ -38,13 +38,14 @@
 #include <time.h>
 #include <unistd.h>
 
-#include "log_server.pb-c.h"
-#include "sudo_gettext.h"	/* must be included before sudo_compat.h */
 #include "sudo_compat.h"
-#include "sudo_queue.h"
 #include "sudo_debug.h"
-#include "sudo_util.h"
+#include "sudo_gettext.h"
 #include "sudo_iolog.h"
+#include "sudo_queue.h"
+#include "sudo_util.h"
+
+#include "log_server.pb-c.h"
 #include "logsrvd.h"
 
 static inline bool
diff --git a/logsrvd/logsrv_util.c b/logsrvd/logsrv_util.c
index 72b0700c3..6ddc3e302 100644
--- a/logsrvd/logsrv_util.c
+++ b/logsrvd/logsrv_util.c
@@ -37,12 +37,13 @@
 #include <time.h>
 #include <unistd.h>
 
-#include "sudo_gettext.h"	/* must be included before sudo_compat.h */
 #include "sudo_compat.h"
 #include "sudo_debug.h"
-#include "sudo_util.h"
 #include "sudo_fatal.h"
+#include "sudo_gettext.h"
 #include "sudo_iolog.h"
+#include "sudo_util.h"
+
 #include "logsrv_util.h"
 
 /*
diff --git a/logsrvd/logsrvd.c b/logsrvd/logsrvd.c
index c34881323..559bbe9be 100644
--- a/logsrvd/logsrvd.c
+++ b/logsrvd/logsrvd.c
@@ -51,18 +51,19 @@
 
 #define NEED_INET_NTOP		/* to expose sudo_inet_ntop in sudo_compat.h */
 
-#include "log_server.pb-c.h"
-#include "sudo_gettext.h"	/* must be included before sudo_compat.h */
+#include "pathnames.h"
 #include "sudo_compat.h"
 #include "sudo_conf.h"
 #include "sudo_debug.h"
 #include "sudo_event.h"
-#include "sudo_queue.h"
-#include "sudo_util.h"
-#include "sudo_rand.h"
 #include "sudo_fatal.h"
+#include "sudo_gettext.h"
 #include "sudo_iolog.h"
-#include "pathnames.h"
+#include "sudo_queue.h"
+#include "sudo_rand.h"
+#include "sudo_util.h"
+
+#include "log_server.pb-c.h"
 #include "hostcheck.h"
 #include "logsrvd.h"
 
diff --git a/logsrvd/logsrvd_conf.c b/logsrvd/logsrvd_conf.c
index 4877f3d8e..37b65c536 100644
--- a/logsrvd/logsrvd_conf.c
+++ b/logsrvd/logsrvd_conf.c
@@ -41,20 +41,21 @@
 #include <grp.h>
 #include <pwd.h>
 
+#include "pathnames.h"
+#include "sudo_compat.h"
+#include "sudo_debug.h"
+#include "sudo_fatal.h"
+#include "sudo_gettext.h"
+#include "sudo_iolog.h"
+#include "sudo_util.h"
+
+#include "log_server.pb-c.h"
+#include "logsrvd.h"
+
 #ifndef HAVE_GETADDRINFO
 # include "compat/getaddrinfo.h"
 #endif
 
-#include "log_server.pb-c.h"
-#include "sudo_gettext.h"	/* must be included before sudo_compat.h */
-#include "sudo_compat.h"
-#include "sudo_debug.h"
-#include "sudo_util.h"
-#include "sudo_fatal.h"
-#include "sudo_iolog.h"
-#include "pathnames.h"
-#include "logsrvd.h"
-
 #if defined(HAVE_OPENSSL)
 # define DEFAULT_CA_CERT_PATH       "/etc/ssl/sudo/cacert.pem"
 # define DEFAULT_SERVER_CERT_PATH   "/etc/ssl/sudo/certs/logsrvd_cert.pem"
diff --git a/logsrvd/sendlog.c b/logsrvd/sendlog.c
index cf8304ed0..7af7219a6 100644
--- a/logsrvd/sendlog.c
+++ b/logsrvd/sendlog.c
@@ -46,23 +46,24 @@
 #include <time.h>
 #include <unistd.h>
 
-#include "log_server.pb-c.h"
-#include "sudo_gettext.h"	/* must be included before sudo_compat.h */
-#include "sudo_compat.h"
-#include "sudo_conf.h"
-#include "sudo_debug.h"
-#include "sudo_util.h"
-#include "sudo_event.h"
-#include "sudo_fatal.h"
-#include "sudo_iolog.h"
-#include "hostcheck.h"
-#include "sendlog.h"
-
 #if defined(HAVE_OPENSSL)
 # include <openssl/ssl.h>
 # include <openssl/err.h>
 #endif
 
+#include "sudo_compat.h"
+#include "sudo_conf.h"
+#include "sudo_debug.h"
+#include "sudo_event.h"
+#include "sudo_fatal.h"
+#include "sudo_gettext.h"
+#include "sudo_iolog.h"
+#include "sudo_util.h"
+
+#include "hostcheck.h"
+#include "log_server.pb-c.h"
+#include "sendlog.h"
+
 #ifndef HAVE_GETADDRINFO
 # include "compat/getaddrinfo.h"
 #endif
diff --git a/plugins/audit_json/audit_json.c b/plugins/audit_json/audit_json.c
index 85a0ff351..04b1866ce 100644
--- a/plugins/audit_json/audit_json.c
+++ b/plugins/audit_json/audit_json.c
@@ -40,17 +40,16 @@
 #include <limits.h>
 #include <time.h>
 
-#include "sudo_gettext.h"	/* must be included before sudo_compat.h */
-
+#include "pathnames.h"
 #include "sudo_compat.h"
 #include "sudo_conf.h"
 #include "sudo_debug.h"
 #include "sudo_dso.h"
 #include "sudo_fatal.h"
+#include "sudo_gettext.h"
 #include "sudo_json.h"
 #include "sudo_plugin.h"
 #include "sudo_util.h"
-#include "pathnames.h"
 
 static int audit_debug_instance = SUDO_DEBUG_INSTANCE_INITIALIZER;
 static sudo_conv_t audit_conv;
diff --git a/plugins/sample/sample_plugin.c b/plugins/sample/sample_plugin.c
index 232aece80..1886ea687 100644
--- a/plugins/sample/sample_plugin.c
+++ b/plugins/sample/sample_plugin.c
@@ -44,7 +44,7 @@
 #include <grp.h>
 #include <pwd.h>
 
-#include <pathnames.h>
+#include "pathnames.h"
 #include "sudo_compat.h"
 #include "sudo_plugin.h"
 #include "sudo_util.h"
diff --git a/plugins/sample_approval/sample_approval.c b/plugins/sample_approval/sample_approval.c
index eae64d1f1..c433f208f 100644
--- a/plugins/sample_approval/sample_approval.c
+++ b/plugins/sample_approval/sample_approval.c
@@ -34,12 +34,11 @@
 #include <unistd.h>
 #include <time.h>
 
-#include "sudo_gettext.h"	/* must be included before sudo_compat.h */
-
 #include "sudo_compat.h"
 #include "sudo_conf.h"
 #include "sudo_debug.h"
 #include "sudo_fatal.h"
+#include "sudo_gettext.h"
 #include "sudo_plugin.h"
 #include "sudo_util.h"
 
diff --git a/plugins/sudoers/locale.c b/plugins/sudoers/locale.c
index 074a204f0..a5d393ced 100644
--- a/plugins/sudoers/locale.c
+++ b/plugins/sudoers/locale.c
@@ -33,11 +33,12 @@
 #endif /* HAVE_STDBOOL_H */
 
 #define DEFAULT_TEXT_DOMAIN	"sudoers"
-#include "sudo_gettext.h"	/* must be included before sudo_compat.h */
 
 #include "sudo_compat.h"
 #include "sudo_fatal.h"
+#include "sudo_gettext.h"
 #include "sudoers_debug.h"
+
 #include "defaults.h"
 #include "logging.h"
 
diff --git a/plugins/sudoers/sudoers.h b/plugins/sudoers/sudoers.h
index b2eb5811d..df6d5b376 100644
--- a/plugins/sudoers/sudoers.h
+++ b/plugins/sudoers/sudoers.h
@@ -33,20 +33,21 @@
 #endif /* HAVE_STDBOOL_H */
 
 #define DEFAULT_TEXT_DOMAIN	"sudoers"
-#include "sudo_gettext.h"	/* must be included before sudo_compat.h */
 
-#include <pathnames.h>
+#include "pathnames.h"
 #include "sudo_compat.h"
+#include "sudo_conf.h"
 #include "sudo_fatal.h"
+#include "sudo_gettext.h"
+#include "sudo_nss.h"
+#include "sudo_plugin.h"
 #include "sudo_queue.h"
+#include "sudo_util.h"
+#include "sudoers_debug.h"
+
 #include "defaults.h"
 #include "logging.h"
 #include "parse.h"
-#include "sudo_nss.h"
-#include "sudo_plugin.h"
-#include "sudo_conf.h"
-#include "sudo_util.h"
-#include "sudoers_debug.h"
 
 /*
  * Info passed in from the sudo front-end.
diff --git a/plugins/sudoers/sudoreplay.c b/plugins/sudoers/sudoreplay.c
index 762a41699..45fe0afa2 100644
--- a/plugins/sudoers/sudoreplay.c
+++ b/plugins/sudoers/sudoreplay.c
@@ -51,21 +51,20 @@
 #include <regex.h>
 #include <signal.h>
 
-#include <pathnames.h>
-
-#include "sudo_gettext.h"	/* must be included before sudo_compat.h */
-
+#include "pathnames.h"
 #include "sudo_compat.h"
-#include "sudo_fatal.h"
-#include "logging.h"
-#include "sudo_iolog.h"
-#include "sudo_queue.h"
-#include "sudo_plugin.h"
 #include "sudo_conf.h"
 #include "sudo_debug.h"
 #include "sudo_event.h"
+#include "sudo_fatal.h"
+#include "sudo_gettext.h"
+#include "sudo_iolog.h"
+#include "sudo_plugin.h"
+#include "sudo_queue.h"
 #include "sudo_util.h"
 
+#include "logging.h"
+
 #ifdef HAVE_GETOPT_LONG
 # include <getopt.h>
 # else
diff --git a/src/net_ifs.c b/src/net_ifs.c
index 8d8220b04..0bdeace64 100644
--- a/src/net_ifs.c
+++ b/src/net_ifs.c
@@ -83,12 +83,12 @@ struct rtentry;
 #define NEED_INET_NTOP		/* to expose sudo_inet_ntop in sudo_compat.h */
 
 #define DEFAULT_TEXT_DOMAIN	"sudo"
-#include "sudo_gettext.h"	/* must be included before sudo_compat.h */
 
 #include "sudo_compat.h"
-#include "sudo_fatal.h"
 #include "sudo_conf.h"
 #include "sudo_debug.h"
+#include "sudo_fatal.h"
+#include "sudo_gettext.h"
 
 /* Minix apparently lacks IFF_LOOPBACK */
 #ifndef IFF_LOOPBACK
diff --git a/src/sesh.c b/src/sesh.c
index c9d426000..55f409c29 100644
--- a/src/sesh.c
+++ b/src/sesh.c
@@ -39,13 +39,12 @@
 # include "compat/stdbool.h"
 #endif /* HAVE_STDBOOL_H */
 
-#include "sudo_gettext.h"	/* must be included before sudo_compat.h */
-
 #include "sudo_compat.h"
-#include "sudo_fatal.h"
 #include "sudo_conf.h"
 #include "sudo_debug.h"
 #include "sudo_exec.h"
+#include "sudo_fatal.h"
+#include "sudo_gettext.h"
 #include "sudo_plugin.h"
 #include "sudo_util.h"
 
diff --git a/src/sudo.h b/src/sudo.h
index 2a3c5050f..23f734c6e 100644
--- a/src/sudo.h
+++ b/src/sudo.h
@@ -25,27 +25,25 @@
 #define SUDO_SUDO_H
 
 #include <limits.h>
-#include <pathnames.h>
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
 # include "compat/stdbool.h"
 #endif /* HAVE_STDBOOL_H */
-
-#include "sudo_gettext.h"	/* must be included before sudo_compat.h */
-
-#include "sudo_compat.h"
-#include "sudo_fatal.h"
-#include "sudo_conf.h"
-#include "sudo_debug.h"
-#include "sudo_queue.h"
-#include "sudo_event.h"
-#include "sudo_util.h"
-
 #ifdef HAVE_PRIV_SET
 # include <priv.h>
 #endif
 
+#include "pathnames.h"
+#include "sudo_compat.h"
+#include "sudo_conf.h"
+#include "sudo_debug.h"
+#include "sudo_event.h"
+#include "sudo_fatal.h"
+#include "sudo_gettext.h"
+#include "sudo_queue.h"
+#include "sudo_util.h"
+
 /* Enable asserts() to avoid static analyzer false positives. */
 #if !(defined(SUDO_DEVEL) || defined(__clang_analyzer__) || defined(__COVERITY__))
 # define NDEBUG