diff --git a/lib/util/fatal.c b/lib/util/fatal.c
index e2c56328a..dcccc3e3f 100644
--- a/lib/util/fatal.c
+++ b/lib/util/fatal.c
@@ -35,6 +35,9 @@
 # include "compat/stdbool.h"
 #endif /* HAVE_STDBOOL_H */
 #include <unistd.h>
+#ifndef HAVE_GETADDRINFO
+# include "compat/getaddrinfo.h"
+#endif
 
 #include "sudo_compat.h"
 #include "sudo_fatal.h"
@@ -43,10 +46,6 @@
 #include "sudo_util.h"
 #include "sudo_plugin.h"
 
-#ifndef HAVE_GETADDRINFO
-# include "compat/getaddrinfo.h"
-#endif
-
 struct sudo_fatal_callback {
     SLIST_ENTRY(sudo_fatal_callback) entries;
     void (*func)(void);
diff --git a/lib/util/regress/fnmatch/fnm_test.c b/lib/util/regress/fnmatch/fnm_test.c
index 2d6a9d2c4..9f2f01c28 100644
--- a/lib/util/regress/fnmatch/fnm_test.c
+++ b/lib/util/regress/fnmatch/fnm_test.c
@@ -9,16 +9,15 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
-
-#include "sudo_compat.h"
-#include "sudo_util.h"
-
 #ifdef HAVE_FNMATCH
 # include <fnmatch.h>
 #else
 # include "compat/fnmatch.h"
 #endif
 
+#include "sudo_compat.h"
+#include "sudo_util.h"
+
 sudo_dso_public int main(int argc, char *argv[]);
 
 int
diff --git a/logsrvd/logsrvd.c b/logsrvd/logsrvd.c
index bf76bab16..e14e376c1 100644
--- a/logsrvd/logsrvd.c
+++ b/logsrvd/logsrvd.c
@@ -43,6 +43,11 @@
 #include <string.h>
 #include <time.h>
 #include <unistd.h>
+#ifdef HAVE_GETOPT_LONG
+# include <getopt.h>
+# else
+# include "compat/getopt.h"
+#endif /* HAVE_GETOPT_LONG */
 
 #if defined(HAVE_OPENSSL)
 # include <openssl/ssl.h>
@@ -67,12 +72,6 @@
 #include "hostcheck.h"
 #include "logsrvd.h"
 
-#ifdef HAVE_GETOPT_LONG
-# include <getopt.h>
-# else
-# include "compat/getopt.h"
-#endif /* HAVE_GETOPT_LONG */
-
 #if defined(HAVE_OPENSSL)
 # define LOGSRVD_DEFAULT_CIPHER_LST12 "HIGH:!aNULL"
 # define LOGSRVD_DEFAULT_CIPHER_LST13 "TLS_AES_256_GCM_SHA384"
diff --git a/logsrvd/logsrvd_conf.c b/logsrvd/logsrvd_conf.c
index 37b65c536..ed8c8a3e1 100644
--- a/logsrvd/logsrvd_conf.c
+++ b/logsrvd/logsrvd_conf.c
@@ -40,6 +40,9 @@
 #include <unistd.h>
 #include <grp.h>
 #include <pwd.h>
+#ifndef HAVE_GETADDRINFO
+# include "compat/getaddrinfo.h"
+#endif
 
 #include "pathnames.h"
 #include "sudo_compat.h"
@@ -52,10 +55,6 @@
 #include "log_server.pb-c.h"
 #include "logsrvd.h"
 
-#ifndef HAVE_GETADDRINFO
-# include "compat/getaddrinfo.h"
-#endif
-
 #if defined(HAVE_OPENSSL)
 # define DEFAULT_CA_CERT_PATH       "/etc/ssl/sudo/cacert.pem"
 # define DEFAULT_SERVER_CERT_PATH   "/etc/ssl/sudo/certs/logsrvd_cert.pem"
diff --git a/logsrvd/sendlog.c b/logsrvd/sendlog.c
index ea5151fc4..1770f9605 100644
--- a/logsrvd/sendlog.c
+++ b/logsrvd/sendlog.c
@@ -45,6 +45,14 @@
 #include <string.h>
 #include <time.h>
 #include <unistd.h>
+#ifndef HAVE_GETADDRINFO
+# include "compat/getaddrinfo.h"
+#endif
+#ifdef HAVE_GETOPT_LONG
+# include <getopt.h>
+# else
+# include "compat/getopt.h"
+#endif /* HAVE_GETOPT_LONG */
 
 #if defined(HAVE_OPENSSL)
 # include <openssl/ssl.h>
@@ -64,15 +72,6 @@
 #include "log_server.pb-c.h"
 #include "sendlog.h"
 
-#ifndef HAVE_GETADDRINFO
-# include "compat/getaddrinfo.h"
-#endif
-#ifdef HAVE_GETOPT_LONG
-# include <getopt.h>
-# else
-# include "compat/getopt.h"
-#endif /* HAVE_GETOPT_LONG */
-
 #if defined(HAVE_OPENSSL)
 # define TLS_HANDSHAKE_TIMEO_SEC 10
 #endif
diff --git a/plugins/sudoers/cvtsudoers.c b/plugins/sudoers/cvtsudoers.c
index 83621274e..c339556ea 100644
--- a/plugins/sudoers/cvtsudoers.c
+++ b/plugins/sudoers/cvtsudoers.c
@@ -37,6 +37,11 @@
 #include <errno.h>
 #include <pwd.h>
 #include <unistd.h>
+#ifdef HAVE_GETOPT_LONG
+# include <getopt.h>
+# else
+# include "compat/getopt.h"
+#endif /* HAVE_GETOPT_LONG */
 
 #include "sudoers.h"
 #include "sudoers_version.h"
@@ -45,12 +50,6 @@
 #include "cvtsudoers.h"
 #include <gram.h>
 
-#ifdef HAVE_GETOPT_LONG
-# include <getopt.h>
-# else
-# include "compat/getopt.h"
-#endif /* HAVE_GETOPT_LONG */
-
 /*
  * Globals
  */
diff --git a/plugins/sudoers/iolog_client.c b/plugins/sudoers/iolog_client.c
index 9a1526a54..eb73bd832 100644
--- a/plugins/sudoers/iolog_client.c
+++ b/plugins/sudoers/iolog_client.c
@@ -44,6 +44,9 @@
 #include <unistd.h>
 #include <pwd.h>
 #include <grp.h>
+#ifndef HAVE_GETADDRINFO
+# include "compat/getaddrinfo.h"
+#endif
 
 #if defined(HAVE_OPENSSL)
 # include <openssl/ssl.h>
@@ -59,10 +62,6 @@
 #include "iolog_plugin.h"
 #include "hostcheck.h"
 
-#ifndef HAVE_GETADDRINFO
-# include "compat/getaddrinfo.h"
-#endif
-
 /* Server callback may redirect to client callback for TLS. */
 static void client_msg_cb(int fd, int what, void *v);
 static void server_msg_cb(int fd, int what, void *v);
diff --git a/plugins/sudoers/logging.c b/plugins/sudoers/logging.c
index 81da0f788..5be2195b5 100644
--- a/plugins/sudoers/logging.c
+++ b/plugins/sudoers/logging.c
@@ -48,13 +48,12 @@
 #include <errno.h>
 #include <fcntl.h>
 #include <syslog.h>
-
-#include "sudoers.h"
-
 #ifndef HAVE_GETADDRINFO
 # include "compat/getaddrinfo.h"
 #endif
 
+#include "sudoers.h"
+
 /* Special message for log_warning() so we know to use ngettext() */
 #define INCORRECT_PASSWORD_ATTEMPT	((char *)0x01)
 
diff --git a/plugins/sudoers/match.c b/plugins/sudoers/match.c
index 70d6b3e64..bc6f69605 100644
--- a/plugins/sudoers/match.c
+++ b/plugins/sudoers/match.c
@@ -49,16 +49,15 @@
 #include <pwd.h>
 #include <grp.h>
 #include <errno.h>
-
-#include "sudoers.h"
-#include <gram.h>
-
 #ifdef HAVE_FNMATCH
 # include <fnmatch.h>
 #else
 # include "compat/fnmatch.h"
 #endif /* HAVE_FNMATCH */
 
+#include "sudoers.h"
+#include <gram.h>
+
 static struct member_list empty = TAILQ_HEAD_INITIALIZER(empty);
 
 /*
diff --git a/plugins/sudoers/match_command.c b/plugins/sudoers/match_command.c
index ac942f40d..c7094b1c4 100644
--- a/plugins/sudoers/match_command.c
+++ b/plugins/sudoers/match_command.c
@@ -41,16 +41,15 @@
 #include <dirent.h>
 #include <fcntl.h>
 #include <errno.h>
-
-#include "sudoers.h"
-#include <gram.h>
-
 #ifdef HAVE_FNMATCH
 # include <fnmatch.h>
 #else
 # include "compat/fnmatch.h"
 #endif /* HAVE_FNMATCH */
 
+#include "sudoers.h"
+#include <gram.h>
+
 #if !defined(O_EXEC) && defined(O_PATH)
 # define O_EXEC O_PATH
 #endif
diff --git a/plugins/sudoers/sudoers.c b/plugins/sudoers/sudoers.c
index bf6c9fc33..b74549b65 100644
--- a/plugins/sudoers/sudoers.c
+++ b/plugins/sudoers/sudoers.c
@@ -57,16 +57,15 @@
 # include <selinux/selinux.h>
 #endif
 #include <ctype.h>
+#ifndef HAVE_GETADDRINFO
+# include "compat/getaddrinfo.h"
+#endif
 
 #include "sudoers.h"
 #include "parse.h"
 #include "auth/sudo_auth.h"
 #include "sudo_iolog.h"
 
-#ifndef HAVE_GETADDRINFO
-# include "compat/getaddrinfo.h"
-#endif
-
 /*
  * Prototypes
  */
diff --git a/plugins/sudoers/sudoreplay.c b/plugins/sudoers/sudoreplay.c
index 782a075d1..a37c30df9 100644
--- a/plugins/sudoers/sudoreplay.c
+++ b/plugins/sudoers/sudoreplay.c
@@ -50,6 +50,11 @@
 #endif /* HAVE_STDBOOL_H */
 #include <regex.h>
 #include <signal.h>
+#ifdef HAVE_GETOPT_LONG
+# include <getopt.h>
+# else
+# include "compat/getopt.h"
+#endif /* HAVE_GETOPT_LONG */
 
 #include "pathnames.h"
 #include "sudo_compat.h"
@@ -65,12 +70,6 @@
 
 #include "logging.h"
 
-#ifdef HAVE_GETOPT_LONG
-# include <getopt.h>
-# else
-# include "compat/getopt.h"
-#endif /* HAVE_GETOPT_LONG */
-
 struct replay_closure {
     const char *iolog_dir;
     struct sudo_event_base *evbase;
diff --git a/plugins/sudoers/visudo.c b/plugins/sudoers/visudo.c
index d73add09e..01aaab8ec 100644
--- a/plugins/sudoers/visudo.c
+++ b/plugins/sudoers/visudo.c
@@ -57,6 +57,11 @@
 #include <time.h>
 #include <netinet/in.h>
 #include <arpa/inet.h>
+#ifdef HAVE_GETOPT_LONG
+# include <getopt.h>
+# else
+# include "compat/getopt.h"
+#endif /* HAVE_GETOPT_LONG */
 
 #include "sudoers.h"
 #include "interfaces.h"
@@ -65,12 +70,6 @@
 #include "sudo_conf.h"
 #include <gram.h>
 
-#ifdef HAVE_GETOPT_LONG
-# include <getopt.h>
-# else
-# include "compat/getopt.h"
-#endif /* HAVE_GETOPT_LONG */
-
 struct sudoersfile {
     TAILQ_ENTRY(sudoersfile) entries;
     char *path;
diff --git a/src/parse_args.c b/src/parse_args.c
index d37a2839e..d40eacb0b 100644
--- a/src/parse_args.c
+++ b/src/parse_args.c
@@ -32,17 +32,16 @@
 #include <string.h>
 #include <ctype.h>
 #include <assert.h>
-
-#include <sudo_usage.h>
-#include "sudo.h"
-#include "sudo_lbuf.h"
-
 #ifdef HAVE_GETOPT_LONG
 # include <getopt.h>
 # else
 # include "compat/getopt.h"
 #endif /* HAVE_GETOPT_LONG */
 
+#include <sudo_usage.h>
+#include "sudo.h"
+#include "sudo_lbuf.h"
+
 int tgetpass_flags;
 
 /*