diff --git a/include/sudo_conf.h b/include/sudo_conf.h
index 5e2bad056..866e47de3 100644
--- a/include/sudo_conf.h
+++ b/include/sudo_conf.h
@@ -22,10 +22,10 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif
 
-#include "sudo_queue.h"
+#include <sudo_queue.h>
 
 /* Flags for sudo_conf_read() */
 #define SUDO_CONF_DEBUG		0x01
diff --git a/include/sudo_debug.h b/include/sudo_debug.h
index 6ab541074..b8b2d6c78 100644
--- a/include/sudo_debug.h
+++ b/include/sudo_debug.h
@@ -24,9 +24,9 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif
-#include "sudo_queue.h"
+#include <sudo_queue.h>
 
 /*
  * List of debug files and flags for use in registration.
diff --git a/include/sudo_event.h b/include/sudo_event.h
index d27596d88..27985c486 100644
--- a/include/sudo_event.h
+++ b/include/sudo_event.h
@@ -21,7 +21,7 @@
 
 #include <time.h>	/* for struct timespec */
 #include <signal.h>	/* for sigatomic_t and NSIG */
-#include "sudo_queue.h"
+#include <sudo_queue.h>
 
 struct timeval;		/* for deprecated APIs */
 
diff --git a/include/sudo_eventlog.h b/include/sudo_eventlog.h
index aad48c033..d93c24028 100644
--- a/include/sudo_eventlog.h
+++ b/include/sudo_eventlog.h
@@ -24,7 +24,7 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif /* HAVE_STDBOOL_H */
 
 /* Supported event types. */
diff --git a/include/sudo_fatal.h b/include/sudo_fatal.h
index 6b413604a..194da0860 100644
--- a/include/sudo_fatal.h
+++ b/include/sudo_fatal.h
@@ -23,10 +23,10 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif /* HAVE_STDBOOL_H */
 
-#include "sudo_plugin.h"	/* for conversation function */
+#include <sudo_plugin.h>	/* for conversation function */
 
 /* No output to debug files when fuzzing. */
 #ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
diff --git a/include/sudo_json.h b/include/sudo_json.h
index 4a42cf5b0..be4bab52e 100644
--- a/include/sudo_json.h
+++ b/include/sudo_json.h
@@ -24,7 +24,7 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif
 
 /*
diff --git a/include/sudo_util.h b/include/sudo_util.h
index e6043cb7e..58a459481 100644
--- a/include/sudo_util.h
+++ b/include/sudo_util.h
@@ -23,7 +23,7 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif /* HAVE_STDBOOL_H */
 
 #ifdef __TANDEM
diff --git a/lib/eventlog/eventlog.c b/lib/eventlog/eventlog.c
index 478007ec4..bd63ab9fa 100644
--- a/lib/eventlog/eventlog.c
+++ b/lib/eventlog/eventlog.c
@@ -47,16 +47,16 @@
 #include <time.h>
 #include <unistd.h>
 
-#include "pathnames.h"
-#include "sudo_compat.h"
-#include "sudo_debug.h"
-#include "sudo_eventlog.h"
-#include "sudo_lbuf.h"
-#include "sudo_fatal.h"
-#include "sudo_gettext.h"
-#include "sudo_json.h"
-#include "sudo_queue.h"
-#include "sudo_util.h"
+#include <pathnames.h>
+#include <sudo_compat.h>
+#include <sudo_debug.h>
+#include <sudo_eventlog.h>
+#include <sudo_lbuf.h>
+#include <sudo_fatal.h>
+#include <sudo_gettext.h>
+#include <sudo_json.h>
+#include <sudo_queue.h>
+#include <sudo_util.h>
 
 #define IS_SESSID(s) ( \
     isalnum((unsigned char)(s)[0]) && isalnum((unsigned char)(s)[1]) && \
diff --git a/lib/eventlog/eventlog_conf.c b/lib/eventlog/eventlog_conf.c
index ed801ec33..0663a38f3 100644
--- a/lib/eventlog/eventlog_conf.c
+++ b/lib/eventlog/eventlog_conf.c
@@ -47,15 +47,15 @@
 #include <time.h>
 #include <unistd.h>
 
-#include "pathnames.h"
-#include "sudo_compat.h"
-#include "sudo_debug.h"
-#include "sudo_eventlog.h"
-#include "sudo_fatal.h"
-#include "sudo_gettext.h"
-#include "sudo_json.h"
-#include "sudo_queue.h"
-#include "sudo_util.h"
+#include <pathnames.h>
+#include <sudo_compat.h>
+#include <sudo_debug.h>
+#include <sudo_eventlog.h>
+#include <sudo_fatal.h>
+#include <sudo_gettext.h>
+#include <sudo_json.h>
+#include <sudo_queue.h>
+#include <sudo_util.h>
 
 static FILE *eventlog_stub_open_log(int type, const char *logfile);
 static void eventlog_stub_close_log(int type, FILE *fp);
diff --git a/lib/eventlog/eventlog_free.c b/lib/eventlog/eventlog_free.c
index 6b2cda18a..902ff280d 100644
--- a/lib/eventlog/eventlog_free.c
+++ b/lib/eventlog/eventlog_free.c
@@ -30,10 +30,10 @@
 #include <stdio.h>
 #include <stdlib.h>
 
-#include "sudo_compat.h"
-#include "sudo_debug.h"
-#include "sudo_eventlog.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_debug.h>
+#include <sudo_eventlog.h>
+#include <sudo_util.h>
 
 /*
  * Free the strings in a struct eventlog.
diff --git a/lib/eventlog/logwrap.c b/lib/eventlog/logwrap.c
index 9e3f1789b..849ccb4ad 100644
--- a/lib/eventlog/logwrap.c
+++ b/lib/eventlog/logwrap.c
@@ -27,10 +27,10 @@
 #include <stdlib.h>
 #include <string.h>
 
-#include "sudo_compat.h"
-#include "sudo_debug.h"
-#include "sudo_util.h"
-#include "sudo_eventlog.h"
+#include <sudo_compat.h>
+#include <sudo_debug.h>
+#include <sudo_util.h>
+#include <sudo_eventlog.h>
 
 size_t
 eventlog_writeln(FILE * restrict fp, char * restrict line, size_t linelen, size_t maxlen)
diff --git a/lib/eventlog/parse_json.c b/lib/eventlog/parse_json.c
index dc41f0209..d9da66106 100644
--- a/lib/eventlog/parse_json.c
+++ b/lib/eventlog/parse_json.c
@@ -28,7 +28,7 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif /* HAVE_STDBOOL_H */
 #include <string.h>
 #include <unistd.h>
@@ -37,14 +37,14 @@
 #include <fcntl.h>
 #include <time.h>
 
-#include "sudo_compat.h"
-#include "sudo_debug.h"
-#include "sudo_eventlog.h"
-#include "sudo_fatal.h"
-#include "sudo_gettext.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_debug.h>
+#include <sudo_eventlog.h>
+#include <sudo_fatal.h>
+#include <sudo_gettext.h>
+#include <sudo_util.h>
 
-#include "parse_json.h"
+#include <parse_json.h>
 
 struct json_stack {
     unsigned int depth;
diff --git a/lib/eventlog/parse_json.h b/lib/eventlog/parse_json.h
index 5ab2142f6..e04efea85 100644
--- a/lib/eventlog/parse_json.h
+++ b/lib/eventlog/parse_json.h
@@ -19,8 +19,8 @@
 #ifndef PARSE_JSON_H
 #define PARSE_JSON_H
 
-#include "sudo_json.h"
-#include "sudo_queue.h"
+#include <sudo_json.h>
+#include <sudo_queue.h>
 
 TAILQ_HEAD(json_item_list, json_item);
 
diff --git a/lib/eventlog/regress/eventlog_store/store_json_test.c b/lib/eventlog/regress/eventlog_store/store_json_test.c
index 611630bec..5c8f6fef6 100644
--- a/lib/eventlog/regress/eventlog_store/store_json_test.c
+++ b/lib/eventlog/regress/eventlog_store/store_json_test.c
@@ -26,12 +26,12 @@
 
 #define SUDO_ERROR_WRAP 0
 
-#include "sudo_compat.h"
-#include "sudo_eventlog.h"
-#include "sudo_fatal.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_eventlog.h>
+#include <sudo_fatal.h>
+#include <sudo_util.h>
 
-#include "parse_json.h"
+#include <parse_json.h>
 
 sudo_dso_public int main(int argc, char *argv[]);
 
diff --git a/lib/eventlog/regress/eventlog_store/store_sudo_test.c b/lib/eventlog/regress/eventlog_store/store_sudo_test.c
index b407324ca..f873cd5c0 100644
--- a/lib/eventlog/regress/eventlog_store/store_sudo_test.c
+++ b/lib/eventlog/regress/eventlog_store/store_sudo_test.c
@@ -26,11 +26,11 @@
 
 #define SUDO_ERROR_WRAP 0
 
-#include "sudo_compat.h"
-#include "sudo_eventlog.h"
-#include "sudo_fatal.h"
-#include "sudo_lbuf.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_eventlog.h>
+#include <sudo_fatal.h>
+#include <sudo_lbuf.h>
+#include <sudo_util.h>
 
 sudo_dso_public int main(int argc, char *argv[]);
 
diff --git a/lib/eventlog/regress/logwrap/check_wrap.c b/lib/eventlog/regress/logwrap/check_wrap.c
index 836406be1..c5066bef2 100644
--- a/lib/eventlog/regress/logwrap/check_wrap.c
+++ b/lib/eventlog/regress/logwrap/check_wrap.c
@@ -26,11 +26,11 @@
 
 #define SUDO_ERROR_WRAP 0
 
-#include "sudo_compat.h"
-#include "sudo_eventlog.h"
-#include "sudo_fatal.h"
-#include "sudo_plugin.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_eventlog.h>
+#include <sudo_fatal.h>
+#include <sudo_plugin.h>
+#include <sudo_util.h>
 
 sudo_dso_public int main(int argc, char *argv[]);
 
diff --git a/lib/eventlog/regress/parse_json/check_parse_json.c b/lib/eventlog/regress/parse_json/check_parse_json.c
index 350595fb4..496fac904 100644
--- a/lib/eventlog/regress/parse_json/check_parse_json.c
+++ b/lib/eventlog/regress/parse_json/check_parse_json.c
@@ -26,12 +26,12 @@
 
 #define SUDO_ERROR_WRAP 0
 
-#include "sudo_compat.h"
-#include "sudo_eventlog.h"
-#include "sudo_fatal.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_eventlog.h>
+#include <sudo_fatal.h>
+#include <sudo_util.h>
 
-#include "parse_json.h"
+#include <parse_json.h>
 
 sudo_dso_public int main(int argc, char *argv[]);
 
diff --git a/lib/fuzzstub/fuzzstub.c b/lib/fuzzstub/fuzzstub.c
index 0d1002202..abe8e7f98 100644
--- a/lib/fuzzstub/fuzzstub.c
+++ b/lib/fuzzstub/fuzzstub.c
@@ -39,8 +39,8 @@
 # include <inttypes.h>
 #endif
 
-#include "sudo_compat.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_util.h>
 
 int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size);
 
diff --git a/lib/iolog/host_port.c b/lib/iolog/host_port.c
index 7fcc0b03f..615daded8 100644
--- a/lib/iolog/host_port.c
+++ b/lib/iolog/host_port.c
@@ -26,17 +26,17 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif /* HAVE_STDBOOL_H */
 #include <stdio.h>
 #include <string.h>
 #include <time.h>
 
-#include "sudo_compat.h"
-#include "sudo_debug.h"
-#include "sudo_gettext.h"
-#include "sudo_util.h"
-#include "sudo_iolog.h"
+#include <sudo_compat.h>
+#include <sudo_debug.h>
+#include <sudo_gettext.h>
+#include <sudo_util.h>
+#include <sudo_iolog.h>
 
 /*
  * Parse a string in the form host[:port] where host can also be
diff --git a/lib/iolog/hostcheck.c b/lib/iolog/hostcheck.c
index 62ab7601d..efb016ce5 100644
--- a/lib/iolog/hostcheck.c
+++ b/lib/iolog/hostcheck.c
@@ -35,10 +35,10 @@
 
 # define NEED_INET_NTOP		/* to expose sudo_inet_ntop in sudo_compat.h */
 
-# include  "sudo_compat.h"
-# include  "sudo_debug.h"
-# include  "sudo_util.h"
-# include  "hostcheck.h"
+# include  <sudo_compat.h>
+# include  <sudo_debug.h>
+# include  <sudo_util.h>
+# include  <hostcheck.h>
 
 #ifndef INET_ADDRSTRLEN
 # define INET_ADDRSTRLEN 16
diff --git a/lib/iolog/iolog_clearerr.c b/lib/iolog/iolog_clearerr.c
index 631e02090..44a9b341b 100644
--- a/lib/iolog/iolog_clearerr.c
+++ b/lib/iolog/iolog_clearerr.c
@@ -26,9 +26,9 @@
 #include <stdio.h>
 #include <time.h>
 
-#include "sudo_compat.h"
-#include "sudo_debug.h"
-#include "sudo_iolog.h"
+#include <sudo_compat.h>
+#include <sudo_debug.h>
+#include <sudo_iolog.h>
 
 void
 iolog_clearerr(struct iolog_file *iol)
diff --git a/lib/iolog/iolog_close.c b/lib/iolog/iolog_close.c
index caa68c6db..29add5494 100644
--- a/lib/iolog/iolog_close.c
+++ b/lib/iolog/iolog_close.c
@@ -28,15 +28,15 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif
 #include <string.h>
 #include <errno.h>
 #include <time.h>
 
-#include "sudo_compat.h"
-#include "sudo_debug.h"
-#include "sudo_iolog.h"
+#include <sudo_compat.h>
+#include <sudo_debug.h>
+#include <sudo_iolog.h>
 
 /*
  * Close an I/O log.
diff --git a/lib/iolog/iolog_conf.c b/lib/iolog/iolog_conf.c
index 61a35a5f3..1921b8f45 100644
--- a/lib/iolog/iolog_conf.c
+++ b/lib/iolog/iolog_conf.c
@@ -30,14 +30,14 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif
 
-#include "pathnames.h"
-#include "sudo_compat.h"
-#include "sudo_debug.h"
-#include "sudo_util.h"
-#include "sudo_iolog.h"
+#include <pathnames.h>
+#include <sudo_compat.h>
+#include <sudo_debug.h>
+#include <sudo_util.h>
+#include <sudo_iolog.h>
 
 static unsigned int sessid_max = SESSID_MAX;
 static mode_t iolog_filemode = S_IRUSR|S_IWUSR;
diff --git a/lib/iolog/iolog_eof.c b/lib/iolog/iolog_eof.c
index c1cece287..4f4eb05fb 100644
--- a/lib/iolog/iolog_eof.c
+++ b/lib/iolog/iolog_eof.c
@@ -27,13 +27,13 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif
 #include <time.h>
 
-#include "sudo_compat.h"
-#include "sudo_debug.h"
-#include "sudo_iolog.h"
+#include <sudo_compat.h>
+#include <sudo_debug.h>
+#include <sudo_iolog.h>
 
 /*
  * Returns true if at end of I/O log file, else false.
diff --git a/lib/iolog/iolog_filter.c b/lib/iolog/iolog_filter.c
index 397a3a0da..e78f2aeb6 100644
--- a/lib/iolog/iolog_filter.c
+++ b/lib/iolog/iolog_filter.c
@@ -29,19 +29,19 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif
 #include <regex.h>
 #include <string.h>
 #include <time.h>
 
-#include "sudo_compat.h"
-#include "sudo_debug.h"
-#include "sudo_fatal.h"
-#include "sudo_gettext.h"
-#include "sudo_iolog.h"
-#include "sudo_queue.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_debug.h>
+#include <sudo_fatal.h>
+#include <sudo_gettext.h>
+#include <sudo_iolog.h>
+#include <sudo_queue.h>
+#include <sudo_util.h>
 
 struct pwfilt_regex {
     TAILQ_ENTRY(pwfilt_regex) entries;
diff --git a/lib/iolog/iolog_flush.c b/lib/iolog/iolog_flush.c
index f7a0b0815..910447364 100644
--- a/lib/iolog/iolog_flush.c
+++ b/lib/iolog/iolog_flush.c
@@ -28,9 +28,9 @@
 #include <time.h>
 #include <errno.h>
 
-#include "sudo_compat.h"
-#include "sudo_debug.h"
-#include "sudo_iolog.h"
+#include <sudo_compat.h>
+#include <sudo_debug.h>
+#include <sudo_iolog.h>
 
 /*
  * I/O log wrapper for fflush/gzflush.
diff --git a/lib/iolog/iolog_gets.c b/lib/iolog/iolog_gets.c
index 38d7eae28..f60c3b081 100644
--- a/lib/iolog/iolog_gets.c
+++ b/lib/iolog/iolog_gets.c
@@ -28,16 +28,16 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif
 #include <string.h>
 #include <errno.h>
 #include <limits.h>
 #include <time.h>
 
-#include "sudo_compat.h"
-#include "sudo_debug.h"
-#include "sudo_iolog.h"
+#include <sudo_compat.h>
+#include <sudo_debug.h>
+#include <sudo_iolog.h>
 
 /*
  * Like fgets() but for struct iolog_file.
diff --git a/lib/iolog/iolog_json.c b/lib/iolog/iolog_json.c
index d3d3bef0e..8ae68a049 100644
--- a/lib/iolog/iolog_json.c
+++ b/lib/iolog/iolog_json.c
@@ -28,13 +28,13 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif /* HAVE_STDBOOL_H */
 
-#include "sudo_compat.h"
-#include "sudo_debug.h"
-#include "sudo_eventlog.h"
-#include "sudo_iolog.h"
+#include <sudo_compat.h>
+#include <sudo_debug.h>
+#include <sudo_eventlog.h>
+#include <sudo_iolog.h>
 
 bool
 iolog_parse_loginfo_json(FILE *fp, const char *iolog_dir, struct eventlog *evlog)
diff --git a/lib/iolog/iolog_legacy.c b/lib/iolog/iolog_legacy.c
index 3a2a5c551..7119782ba 100644
--- a/lib/iolog/iolog_legacy.c
+++ b/lib/iolog/iolog_legacy.c
@@ -28,20 +28,20 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif /* HAVE_STDBOOL_H */
 #include <string.h>
 #include <signal.h>
 #include <limits.h>
 #include <time.h>
 
-#include "sudo_compat.h"
-#include "sudo_debug.h"
-#include "sudo_eventlog.h"
-#include "sudo_fatal.h"
-#include "sudo_gettext.h"
-#include "sudo_iolog.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_debug.h>
+#include <sudo_eventlog.h>
+#include <sudo_fatal.h>
+#include <sudo_gettext.h>
+#include <sudo_iolog.h>
+#include <sudo_util.h>
 
 bool
 iolog_parse_loginfo_legacy(FILE *fp, const char *iolog_dir,
diff --git a/lib/iolog/iolog_loginfo.c b/lib/iolog/iolog_loginfo.c
index 373a81e06..9b2141320 100644
--- a/lib/iolog/iolog_loginfo.c
+++ b/lib/iolog/iolog_loginfo.c
@@ -28,20 +28,20 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif /* HAVE_STDBOOL_H */
 #include <string.h>
 #include <unistd.h>
 #include <fcntl.h>
 
-#include "sudo_compat.h"
-#include "sudo_debug.h"
-#include "sudo_eventlog.h"
-#include "sudo_fatal.h"
-#include "sudo_gettext.h"
-#include "sudo_json.h"
-#include "sudo_iolog.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_debug.h>
+#include <sudo_eventlog.h>
+#include <sudo_fatal.h>
+#include <sudo_gettext.h>
+#include <sudo_json.h>
+#include <sudo_iolog.h>
+#include <sudo_util.h>
 
 struct eventlog *
 iolog_parse_loginfo(int dfd, const char *iolog_dir)
diff --git a/lib/iolog/iolog_mkdirs.c b/lib/iolog/iolog_mkdirs.c
index 8dc1b3982..afe8b20d1 100644
--- a/lib/iolog/iolog_mkdirs.c
+++ b/lib/iolog/iolog_mkdirs.c
@@ -29,18 +29,18 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif
 #include <unistd.h>
 #include <errno.h>
 #include <fcntl.h>
 
-#include "sudo_compat.h"
-#include "sudo_debug.h"
-#include "sudo_fatal.h"
-#include "sudo_gettext.h"
-#include "sudo_iolog.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_debug.h>
+#include <sudo_fatal.h>
+#include <sudo_gettext.h>
+#include <sudo_iolog.h>
+#include <sudo_util.h>
 
 /*
  * Create directory and any parent directories as needed.
diff --git a/lib/iolog/iolog_mkdtemp.c b/lib/iolog/iolog_mkdtemp.c
index 4d43a6ab9..6ac9c8f87 100644
--- a/lib/iolog/iolog_mkdtemp.c
+++ b/lib/iolog/iolog_mkdtemp.c
@@ -30,17 +30,17 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif
 #include <time.h>
 #include <errno.h>
 
-#include "sudo_compat.h"
-#include "sudo_debug.h"
-#include "sudo_fatal.h"
-#include "sudo_gettext.h"
-#include "sudo_util.h"
-#include "sudo_iolog.h"
+#include <sudo_compat.h>
+#include <sudo_debug.h>
+#include <sudo_fatal.h>
+#include <sudo_gettext.h>
+#include <sudo_util.h>
+#include <sudo_iolog.h>
 
 /*
  * Create temporary directory and any parent directories as needed.
diff --git a/lib/iolog/iolog_mkpath.c b/lib/iolog/iolog_mkpath.c
index b4d177a99..75a79e1c6 100644
--- a/lib/iolog/iolog_mkpath.c
+++ b/lib/iolog/iolog_mkpath.c
@@ -29,13 +29,13 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif
 #include <string.h>
 
-#include "sudo_compat.h"
-#include "sudo_debug.h"
-#include "sudo_iolog.h"
+#include <sudo_compat.h>
+#include <sudo_debug.h>
+#include <sudo_iolog.h>
 
 /*
  * Create path and any intermediate directories.
diff --git a/lib/iolog/iolog_nextid.c b/lib/iolog/iolog_nextid.c
index 8977a35f6..3cc16095c 100644
--- a/lib/iolog/iolog_nextid.c
+++ b/lib/iolog/iolog_nextid.c
@@ -29,7 +29,7 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif
 #include <string.h>
 #include <unistd.h>
@@ -37,12 +37,12 @@
 #include <fcntl.h>
 #include <limits.h>
 
-#include "sudo_compat.h"
-#include "sudo_debug.h"
-#include "sudo_fatal.h"
-#include "sudo_gettext.h"
-#include "sudo_iolog.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_debug.h>
+#include <sudo_fatal.h>
+#include <sudo_gettext.h>
+#include <sudo_iolog.h>
+#include <sudo_util.h>
 
 /*
  * Read the on-disk sequence number, set sessid to the next
diff --git a/lib/iolog/iolog_open.c b/lib/iolog/iolog_open.c
index c2556a7f8..24e19d8f2 100644
--- a/lib/iolog/iolog_open.c
+++ b/lib/iolog/iolog_open.c
@@ -28,17 +28,17 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif
 #include <errno.h>
 #include <fcntl.h>
 #include <time.h>
 #include <unistd.h>
 
-#include "sudo_compat.h"
-#include "sudo_debug.h"
-#include "sudo_iolog.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_debug.h>
+#include <sudo_iolog.h>
+#include <sudo_util.h>
 
 static unsigned char const gzip_magic[2] = {0x1f, 0x8b};
 
diff --git a/lib/iolog/iolog_openat.c b/lib/iolog/iolog_openat.c
index f6cd21b57..75146a59a 100644
--- a/lib/iolog/iolog_openat.c
+++ b/lib/iolog/iolog_openat.c
@@ -29,18 +29,18 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif
 #include <errno.h>
 #include <fcntl.h>
 #include <unistd.h>
 
-#include "sudo_compat.h"
-#include "sudo_debug.h"
-#include "sudo_fatal.h"
-#include "sudo_gettext.h"
-#include "sudo_iolog.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_debug.h>
+#include <sudo_fatal.h>
+#include <sudo_gettext.h>
+#include <sudo_iolog.h>
+#include <sudo_util.h>
 
 /*
  * Wrapper for openat(2) that sets umask and retries as iolog_uid/iolog_gid
diff --git a/lib/iolog/iolog_path.c b/lib/iolog/iolog_path.c
index 16f228c51..ef018e19b 100644
--- a/lib/iolog/iolog_path.c
+++ b/lib/iolog/iolog_path.c
@@ -28,19 +28,19 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif /* HAVE_STDBOOL_H */
 #include <string.h>
 #include <limits.h>
 #include <time.h>
 #include <unistd.h>
 
-#include "sudo_compat.h"
-#include "sudo_debug.h"
-#include "sudo_fatal.h"
-#include "sudo_gettext.h"
-#include "sudo_iolog.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_debug.h>
+#include <sudo_fatal.h>
+#include <sudo_gettext.h>
+#include <sudo_iolog.h>
+#include <sudo_util.h>
 
 /*
  * Expand any escape sequences in inpath, returning the expanded path.
diff --git a/lib/iolog/iolog_read.c b/lib/iolog/iolog_read.c
index 6e7b106c1..013ecaa02 100644
--- a/lib/iolog/iolog_read.c
+++ b/lib/iolog/iolog_read.c
@@ -27,16 +27,16 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif
 #include <string.h>
 #include <errno.h>
 #include <limits.h>
 #include <time.h>
 
-#include "sudo_compat.h"
-#include "sudo_debug.h"
-#include "sudo_iolog.h"
+#include <sudo_compat.h>
+#include <sudo_debug.h>
+#include <sudo_iolog.h>
 
 /*
  * Read from a (possibly compressed) I/O log file.
diff --git a/lib/iolog/iolog_seek.c b/lib/iolog/iolog_seek.c
index 928ae6ef6..d08799ae5 100644
--- a/lib/iolog/iolog_seek.c
+++ b/lib/iolog/iolog_seek.c
@@ -26,9 +26,9 @@
 #include <stdio.h>
 #include <time.h>
 
-#include "sudo_compat.h"
-#include "sudo_debug.h"
-#include "sudo_iolog.h"
+#include <sudo_compat.h>
+#include <sudo_debug.h>
+#include <sudo_iolog.h>
 
 /*
  * I/O log wrapper for fseek/gzseek.
diff --git a/lib/iolog/iolog_swapids.c b/lib/iolog/iolog_swapids.c
index a0a361498..6b5957495 100644
--- a/lib/iolog/iolog_swapids.c
+++ b/lib/iolog/iolog_swapids.c
@@ -28,16 +28,16 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif
 #include <time.h>
 #include <unistd.h>
 
-#include "sudo_compat.h"
-#include "sudo_debug.h"
-#include "sudo_fatal.h"
-#include "sudo_gettext.h"
-#include "sudo_iolog.h"
+#include <sudo_compat.h>
+#include <sudo_debug.h>
+#include <sudo_fatal.h>
+#include <sudo_gettext.h>
+#include <sudo_iolog.h>
 
 /*
  * Set effective user and group-IDs to iolog_uid and iolog_gid.
diff --git a/lib/iolog/iolog_timing.c b/lib/iolog/iolog_timing.c
index 2e8c33931..3c519e974 100644
--- a/lib/iolog/iolog_timing.c
+++ b/lib/iolog/iolog_timing.c
@@ -28,7 +28,7 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif /* HAVE_STDBOOL_H */
 #include <string.h>
 #include <signal.h>
@@ -39,13 +39,13 @@
 #include <fcntl.h>
 #include <time.h>
 
-#include "sudo_compat.h"
-#include "sudo_debug.h"
-#include "sudo_eventlog.h"
-#include "sudo_fatal.h"
-#include "sudo_gettext.h"
-#include "sudo_iolog.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_debug.h>
+#include <sudo_eventlog.h>
+#include <sudo_fatal.h>
+#include <sudo_gettext.h>
+#include <sudo_iolog.h>
+#include <sudo_util.h>
 
 static int timing_event_adj;
 
diff --git a/lib/iolog/iolog_util.c b/lib/iolog/iolog_util.c
index bb1dde8b0..8ff5b830b 100644
--- a/lib/iolog/iolog_util.c
+++ b/lib/iolog/iolog_util.c
@@ -28,13 +28,13 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif
 #include <time.h>
 
-#include "sudo_compat.h"
-#include "sudo_debug.h"
-#include "sudo_iolog.h"
+#include <sudo_compat.h>
+#include <sudo_debug.h>
+#include <sudo_iolog.h>
 
 /*
  * Map IOFD_* -> name.
diff --git a/lib/iolog/iolog_write.c b/lib/iolog/iolog_write.c
index 7e8c6ee47..0ce5a81f4 100644
--- a/lib/iolog/iolog_write.c
+++ b/lib/iolog/iolog_write.c
@@ -27,16 +27,16 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif
 #include <string.h>
 #include <errno.h>
 #include <limits.h>
 #include <time.h>
 
-#include "sudo_compat.h"
-#include "sudo_debug.h"
-#include "sudo_iolog.h"
+#include <sudo_compat.h>
+#include <sudo_debug.h>
+#include <sudo_iolog.h>
 
 /*
  * Write to an I/O log, optionally compressing.
diff --git a/lib/iolog/regress/fuzz/fuzz_iolog_json.c b/lib/iolog/regress/fuzz/fuzz_iolog_json.c
index ef12721d6..b4cfcafe9 100644
--- a/lib/iolog/regress/fuzz/fuzz_iolog_json.c
+++ b/lib/iolog/regress/fuzz/fuzz_iolog_json.c
@@ -26,13 +26,13 @@
 # include <inttypes.h>
 #endif
 
-#include "sudo_compat.h"
-#include "sudo_debug.h"
-#include "sudo_eventlog.h"
-#include "sudo_fatal.h"
-#include "sudo_iolog.h"
-#include "sudo_plugin.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_debug.h>
+#include <sudo_eventlog.h>
+#include <sudo_fatal.h>
+#include <sudo_iolog.h>
+#include <sudo_plugin.h>
+#include <sudo_util.h>
 
 int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size);
 
diff --git a/lib/iolog/regress/fuzz/fuzz_iolog_legacy.c b/lib/iolog/regress/fuzz/fuzz_iolog_legacy.c
index 207374cc9..fae456e47 100644
--- a/lib/iolog/regress/fuzz/fuzz_iolog_legacy.c
+++ b/lib/iolog/regress/fuzz/fuzz_iolog_legacy.c
@@ -26,13 +26,13 @@
 # include <inttypes.h>
 #endif
 
-#include "sudo_compat.h"
-#include "sudo_debug.h"
-#include "sudo_eventlog.h"
-#include "sudo_fatal.h"
-#include "sudo_iolog.h"
-#include "sudo_plugin.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_debug.h>
+#include <sudo_eventlog.h>
+#include <sudo_fatal.h>
+#include <sudo_iolog.h>
+#include <sudo_plugin.h>
+#include <sudo_util.h>
 
 int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size);
 
diff --git a/lib/iolog/regress/fuzz/fuzz_iolog_timing.c b/lib/iolog/regress/fuzz/fuzz_iolog_timing.c
index dac9736c6..87a5fcf8e 100644
--- a/lib/iolog/regress/fuzz/fuzz_iolog_timing.c
+++ b/lib/iolog/regress/fuzz/fuzz_iolog_timing.c
@@ -30,16 +30,16 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif /* HAVE_STDBOOL_H */
 
-#include "sudo_compat.h"
-#include "sudo_debug.h"
-#include "sudo_eventlog.h"
-#include "sudo_fatal.h"
-#include "sudo_iolog.h"
-#include "sudo_plugin.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_debug.h>
+#include <sudo_eventlog.h>
+#include <sudo_fatal.h>
+#include <sudo_iolog.h>
+#include <sudo_plugin.h>
+#include <sudo_util.h>
 
 int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size);
 
diff --git a/lib/iolog/regress/host_port/host_port_test.c b/lib/iolog/regress/host_port/host_port_test.c
index d1c6e83d1..128e0f953 100644
--- a/lib/iolog/regress/host_port/host_port_test.c
+++ b/lib/iolog/regress/host_port/host_port_test.c
@@ -24,15 +24,15 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif
 #include <time.h>
 #include <unistd.h>
 
-#include "sudo_compat.h"
-#include "sudo_fatal.h"
-#include "sudo_iolog.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_fatal.h>
+#include <sudo_iolog.h>
+#include <sudo_util.h>
 
 sudo_dso_public int main(int argc, char *argv[]);
 
diff --git a/lib/iolog/regress/iolog_filter/check_iolog_filter.c b/lib/iolog/regress/iolog_filter/check_iolog_filter.c
index d24f12f84..bb51420b0 100644
--- a/lib/iolog/regress/iolog_filter/check_iolog_filter.c
+++ b/lib/iolog/regress/iolog_filter/check_iolog_filter.c
@@ -26,11 +26,11 @@
 
 #define SUDO_ERROR_WRAP 0
 
-#include "sudo_compat.h"
-#include "sudo_util.h"
-#include "sudo_fatal.h"
+#include <sudo_compat.h>
+#include <sudo_util.h>
+#include <sudo_fatal.h>
 
-#include "sudo_iolog.h"
+#include <sudo_iolog.h>
 
 sudo_dso_public int main(int argc, char *argv[]);
 
diff --git a/lib/iolog/regress/iolog_mkpath/check_iolog_mkpath.c b/lib/iolog/regress/iolog_mkpath/check_iolog_mkpath.c
index 36935eec4..c11992fb4 100644
--- a/lib/iolog/regress/iolog_mkpath/check_iolog_mkpath.c
+++ b/lib/iolog/regress/iolog_mkpath/check_iolog_mkpath.c
@@ -27,10 +27,10 @@
 
 #define SUDO_ERROR_WRAP 0
 
-#include "sudo_compat.h"
-#include "sudo_util.h"
-#include "sudo_fatal.h"
-#include "sudo_iolog.h"
+#include <sudo_compat.h>
+#include <sudo_util.h>
+#include <sudo_fatal.h>
+#include <sudo_iolog.h>
 
 sudo_dso_public int main(int argc, char *argv[]);
 
diff --git a/lib/iolog/regress/iolog_path/check_iolog_path.c b/lib/iolog/regress/iolog_path/check_iolog_path.c
index f650b2db9..882135a58 100644
--- a/lib/iolog/regress/iolog_path/check_iolog_path.c
+++ b/lib/iolog/regress/iolog_path/check_iolog_path.c
@@ -27,10 +27,10 @@
 
 #define SUDO_ERROR_WRAP 0
 
-#include "sudo_compat.h"
-#include "sudo_util.h"
-#include "sudo_fatal.h"
-#include "sudo_iolog.h"
+#include <sudo_compat.h>
+#include <sudo_util.h>
+#include <sudo_fatal.h>
+#include <sudo_iolog.h>
 
 static struct iolog_escape_data {
     char sessid[7];
diff --git a/lib/iolog/regress/iolog_timing/check_iolog_timing.c b/lib/iolog/regress/iolog_timing/check_iolog_timing.c
index a29736885..5fa34b8aa 100644
--- a/lib/iolog/regress/iolog_timing/check_iolog_timing.c
+++ b/lib/iolog/regress/iolog_timing/check_iolog_timing.c
@@ -26,10 +26,10 @@
 
 #define SUDO_ERROR_WRAP 0
 
-#include "sudo_compat.h"
-#include "sudo_util.h"
-#include "sudo_fatal.h"
-#include "sudo_iolog.h"
+#include <sudo_compat.h>
+#include <sudo_util.h>
+#include <sudo_fatal.h>
+#include <sudo_iolog.h>
 
 sudo_dso_public int main(int argc, char *argv[]);
 
diff --git a/lib/logsrv/log_server.pb-c.c b/lib/logsrv/log_server.pb-c.c
index e46bc1094..21c87b85e 100644
--- a/lib/logsrv/log_server.pb-c.c
+++ b/lib/logsrv/log_server.pb-c.c
@@ -6,7 +6,7 @@
 #define PROTOBUF_C__NO_DEPRECATED
 #endif
 
-#include "log_server.pb-c.h"
+#include <log_server.pb-c.h>
 void   client_message__init
                      (ClientMessage         *message)
 {
diff --git a/lib/protobuf-c/protobuf-c.c b/lib/protobuf-c/protobuf-c.c
index 56f8dc8f1..9d7da2681 100644
--- a/lib/protobuf-c/protobuf-c.c
+++ b/lib/protobuf-c/protobuf-c.c
@@ -56,10 +56,10 @@
 #elif defined(HAVE_MACHINE_ENDIAN_H)
 # include <machine/endian.h>
 #else
-# include "compat/endian.h"
+# include <compat/endian.h>
 #endif
 
-#include "protobuf-c/protobuf-c.h"
+#include <protobuf-c/protobuf-c.h>
 
 #if BYTE_ORDER == BIG_ENDIAN
 # define WORDS_BIGENDIAN
diff --git a/lib/ssl_compat/ssl_compat.c b/lib/ssl_compat/ssl_compat.c
index 88d76a5fc..2942807f1 100644
--- a/lib/ssl_compat/ssl_compat.c
+++ b/lib/ssl_compat/ssl_compat.c
@@ -31,8 +31,8 @@
 # endif
 # include <openssl/ssl.h>
 
-# include "sudo_compat.h"
-# include "sudo_ssl_compat.h"
+# include <sudo_compat.h>
+# include <sudo_ssl_compat.h>
 
 /*
  * Emulate SSL_read_ex() using SSL_read().
diff --git a/lib/util/aix.c b/lib/util/aix.c
index 8a1c7505a..3751f5837 100644
--- a/lib/util/aix.c
+++ b/lib/util/aix.c
@@ -31,11 +31,11 @@
 #include <usersec.h>
 #include <uinfo.h>
 
-#include "sudo_compat.h"
-#include "sudo_debug.h"
-#include "sudo_fatal.h"
-#include "sudo_gettext.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_debug.h>
+#include <sudo_fatal.h>
+#include <sudo_gettext.h>
+#include <sudo_util.h>
 
 #ifdef HAVE_GETUSERATTR
 
diff --git a/lib/util/arc4random.c b/lib/util/arc4random.c
index 4002645d1..20ff4e1cb 100644
--- a/lib/util/arc4random.c
+++ b/lib/util/arc4random.c
@@ -50,9 +50,9 @@
 # include <inttypes.h>
 #endif
 
-#include "sudo_compat.h"
-#include "sudo_fatal.h"
-#include "sudo_rand.h"
+#include <sudo_compat.h>
+#include <sudo_fatal.h>
+#include <sudo_rand.h>
 
 #define KEYSTREAM_ONLY
 #include "chacha_private.h"
diff --git a/lib/util/arc4random_buf.c b/lib/util/arc4random_buf.c
index 053c92280..c0fbe704b 100644
--- a/lib/util/arc4random_buf.c
+++ b/lib/util/arc4random_buf.c
@@ -32,8 +32,8 @@
 # include <inttypes.h>
 #endif
 
-#include "sudo_compat.h"
-#include "sudo_rand.h"
+#include <sudo_compat.h>
+#include <sudo_rand.h>
 
 #define minimum(a, b) ((a) < (b) ? (a) : (b))
 
diff --git a/lib/util/arc4random_uniform.c b/lib/util/arc4random_uniform.c
index 3299a14da..ad3c5aa68 100644
--- a/lib/util/arc4random_uniform.c
+++ b/lib/util/arc4random_uniform.c
@@ -34,8 +34,8 @@
 # include <inttypes.h>
 #endif
 
-#include "sudo_compat.h"
-#include "sudo_rand.h"
+#include <sudo_compat.h>
+#include <sudo_rand.h>
 
 /*
  * Calculate a uniformly distributed random number less than upper_bound
diff --git a/lib/util/basename.c b/lib/util/basename.c
index b757b36fe..a2c2c3964 100644
--- a/lib/util/basename.c
+++ b/lib/util/basename.c
@@ -30,8 +30,8 @@
 #include <string.h>
 #include <syslog.h>
 
-#include "sudo_compat.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_util.h>
 
 /*
  * GNU-compatible basename(3)
diff --git a/lib/util/cfmakeraw.c b/lib/util/cfmakeraw.c
index 956001f0e..f0dd41e04 100644
--- a/lib/util/cfmakeraw.c
+++ b/lib/util/cfmakeraw.c
@@ -25,7 +25,7 @@
 
 #include <termios.h>
 
-#include "sudo_compat.h"
+#include <sudo_compat.h>
 
 /* Non-standard termios input flags */
 #ifndef IUCLC
diff --git a/lib/util/closefrom.c b/lib/util/closefrom.c
index d6e95fd58..ef8e20cd3 100644
--- a/lib/util/closefrom.c
+++ b/lib/util/closefrom.c
@@ -43,9 +43,9 @@
 # include <linux/close_range.h>
 #endif
 
-#include "sudo_compat.h"
-#include "sudo_util.h"
-#include "pathnames.h"
+#include <sudo_compat.h>
+#include <sudo_util.h>
+#include <pathnames.h>
 
 #ifndef OPEN_MAX
 # define OPEN_MAX	256
diff --git a/lib/util/digest.c b/lib/util/digest.c
index cebaf8416..b3a3b8787 100644
--- a/lib/util/digest.c
+++ b/lib/util/digest.c
@@ -32,14 +32,14 @@
 #include <unistd.h>
 #include <errno.h>
 
-#include "sudo_compat.h"
-#include "sudo_debug.h"
-#include "sudo_digest.h"
+#include <sudo_compat.h>
+#include <sudo_debug.h>
+#include <sudo_digest.h>
 
 #ifdef HAVE_SHA224UPDATE
 # include <sha2.h>
 #else
-# include "compat/sha2.h"
+# include <compat/sha2.h>
 #endif
 
 static struct digest_function {
diff --git a/lib/util/digest_gcrypt.c b/lib/util/digest_gcrypt.c
index e04cc534b..7deae2dac 100644
--- a/lib/util/digest_gcrypt.c
+++ b/lib/util/digest_gcrypt.c
@@ -26,7 +26,7 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif
 #include <stdlib.h>
 #include <string.h>
@@ -34,9 +34,9 @@
 
 #include <gcrypt.h>
 
-#include "sudo_compat.h"
-#include "sudo_debug.h"
-#include "sudo_digest.h"
+#include <sudo_compat.h>
+#include <sudo_debug.h>
+#include <sudo_digest.h>
 
 #define SUDO_LIBGCRYPT_VERSION_MIN "1.3.0"
 
diff --git a/lib/util/digest_openssl.c b/lib/util/digest_openssl.c
index 95f84b94c..712b20b7a 100644
--- a/lib/util/digest_openssl.c
+++ b/lib/util/digest_openssl.c
@@ -31,9 +31,9 @@
 #endif
 #include <openssl/evp.h>
 
-#include "sudo_compat.h"
-#include "sudo_debug.h"
-#include "sudo_digest.h"
+#include <sudo_compat.h>
+#include <sudo_debug.h>
+#include <sudo_digest.h>
 
 struct sudo_digest {
     EVP_MD_CTX *ctx;
diff --git a/lib/util/dup3.c b/lib/util/dup3.c
index 68d6ebf79..c3ab1417b 100644
--- a/lib/util/dup3.c
+++ b/lib/util/dup3.c
@@ -29,7 +29,7 @@
 #include <fcntl.h>
 #include <unistd.h>
 
-#include "sudo_compat.h"
+#include <sudo_compat.h>
 
 int
 sudo_dup3(int oldd, int newd, int flags)
diff --git a/lib/util/event.c b/lib/util/event.c
index 9228fc2c0..e49f657b8 100644
--- a/lib/util/event.c
+++ b/lib/util/event.c
@@ -30,7 +30,7 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif /* HAVE_STDBOOL_H */
 #include <string.h>
 #include <errno.h>
@@ -38,11 +38,11 @@
 #include <time.h>
 #include <unistd.h>
 
-#include "sudo_compat.h"
-#include "sudo_fatal.h"
-#include "sudo_debug.h"
-#include "sudo_event.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_fatal.h>
+#include <sudo_debug.h>
+#include <sudo_event.h>
+#include <sudo_util.h>
 
 static void sudo_ev_init(struct sudo_event *ev, int fd, int events,
     sudo_ev_callback_t callback, void *closure);
diff --git a/lib/util/event_poll.c b/lib/util/event_poll.c
index 3dc4362f5..245fe5996 100644
--- a/lib/util/event_poll.c
+++ b/lib/util/event_poll.c
@@ -30,11 +30,11 @@
 #include <stdlib.h>
 #include <time.h>
 
-#include "sudo_compat.h"
-#include "sudo_util.h"
-#include "sudo_fatal.h"
-#include "sudo_debug.h"
-#include "sudo_event.h"
+#include <sudo_compat.h>
+#include <sudo_util.h>
+#include <sudo_fatal.h>
+#include <sudo_debug.h>
+#include <sudo_event.h>
 
 #if defined(OPEN_MAX) && OPEN_MAX > 256
 # define SUDO_OPEN_MAX  OPEN_MAX
diff --git a/lib/util/event_select.c b/lib/util/event_select.c
index 92803c85a..74e6e2f3a 100644
--- a/lib/util/event_select.c
+++ b/lib/util/event_select.c
@@ -35,11 +35,11 @@
 #include <string.h>
 #include <time.h>
 
-#include "sudo_compat.h"
-#include "sudo_util.h"
-#include "sudo_fatal.h"
-#include "sudo_debug.h"
-#include "sudo_event.h"
+#include <sudo_compat.h>
+#include <sudo_util.h>
+#include <sudo_fatal.h>
+#include <sudo_debug.h>
+#include <sudo_event.h>
 
 int
 sudo_ev_base_alloc_impl(struct sudo_event_base *base)
diff --git a/lib/util/explicit_bzero.c b/lib/util/explicit_bzero.c
index 3ffb97278..3d0ee1ffb 100644
--- a/lib/util/explicit_bzero.c
+++ b/lib/util/explicit_bzero.c
@@ -30,7 +30,7 @@
 # include <strings.h>
 #endif /* HAVE_STRINGS_H */
 
-#include "sudo_compat.h"
+#include <sudo_compat.h>
 
 #ifndef HAVE_EXPLICIT_BZERO
 
diff --git a/lib/util/fatal.c b/lib/util/fatal.c
index 4a99f96d6..bdee6a1af 100644
--- a/lib/util/fatal.c
+++ b/lib/util/fatal.c
@@ -32,19 +32,19 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif /* HAVE_STDBOOL_H */
 #include <unistd.h>
 #ifndef HAVE_GETADDRINFO
-# include "compat/getaddrinfo.h"
+# include <compat/getaddrinfo.h>
 #endif
 
-#include "sudo_compat.h"
-#include "sudo_fatal.h"
-#include "sudo_gettext.h"
-#include "sudo_queue.h"
-#include "sudo_util.h"
-#include "sudo_plugin.h"
+#include <sudo_compat.h>
+#include <sudo_fatal.h>
+#include <sudo_gettext.h>
+#include <sudo_queue.h>
+#include <sudo_util.h>
+#include <sudo_plugin.h>
 
 struct sudo_fatal_callback {
     SLIST_ENTRY(sudo_fatal_callback) entries;
diff --git a/lib/util/fchmodat.c b/lib/util/fchmodat.c
index 9800296f2..39d294ed8 100644
--- a/lib/util/fchmodat.c
+++ b/lib/util/fchmodat.c
@@ -29,7 +29,7 @@
 #include <fcntl.h>
 #include <unistd.h>
 
-#include "sudo_compat.h"
+#include <sudo_compat.h>
 
 #ifndef HAVE_FCHMODAT
 int
diff --git a/lib/util/fchownat.c b/lib/util/fchownat.c
index 545a21e66..035f2394c 100644
--- a/lib/util/fchownat.c
+++ b/lib/util/fchownat.c
@@ -26,7 +26,7 @@
 #include <fcntl.h>
 #include <unistd.h>
 
-#include "sudo_compat.h"
+#include <sudo_compat.h>
 
 #ifndef HAVE_FCHOWNAT
 int
diff --git a/lib/util/fnmatch.c b/lib/util/fnmatch.c
index f393bb400..729d54612 100644
--- a/lib/util/fnmatch.c
+++ b/lib/util/fnmatch.c
@@ -102,9 +102,9 @@
 #include <ctype.h>
 #include <string.h>
 
-#include "sudo_compat.h"
-#include "compat/charclass.h"
-#include "compat/fnmatch.h"
+#include <sudo_compat.h>
+#include <compat/charclass.h>
+#include <compat/fnmatch.h>
 
 #define	RANGE_MATCH	1
 #define	RANGE_NOMATCH	0
diff --git a/lib/util/freezero.c b/lib/util/freezero.c
index e2d2e8a2a..dae48b553 100644
--- a/lib/util/freezero.c
+++ b/lib/util/freezero.c
@@ -26,7 +26,7 @@
 #include <stdlib.h>
 #include <string.h>
 
-#include "sudo_compat.h"
+#include <sudo_compat.h>
 
 #ifndef HAVE_FREEZERO
 void
diff --git a/lib/util/fstatat.c b/lib/util/fstatat.c
index 0b342d1dd..983085d54 100644
--- a/lib/util/fstatat.c
+++ b/lib/util/fstatat.c
@@ -28,7 +28,7 @@
 #include <fcntl.h>
 #include <unistd.h>
 
-#include "sudo_compat.h"
+#include <sudo_compat.h>
 
 #ifndef HAVE_FSTATAT
 int
diff --git a/lib/util/getaddrinfo.c b/lib/util/getaddrinfo.c
index b46f1e245..4d8256ea4 100644
--- a/lib/util/getaddrinfo.c
+++ b/lib/util/getaddrinfo.c
@@ -50,8 +50,8 @@
 # include <resolv.h>
 #endif /* NEED_RESOLV_H */
 
-#include "sudo_compat.h"
-#include "compat/getaddrinfo.h"
+#include <sudo_compat.h>
+#include <compat/getaddrinfo.h>
 
 /* We need access to h_errno to map errors from gethostbyname. */
 #ifndef HAVE_DECL_H_ERRNO
diff --git a/lib/util/getdelim.c b/lib/util/getdelim.c
index 53687a1f8..7984fb5a3 100644
--- a/lib/util/getdelim.c
+++ b/lib/util/getdelim.c
@@ -30,7 +30,7 @@
 #include <string.h>
 #include <limits.h>
 
-#include "sudo_compat.h"
+#include <sudo_compat.h>
 
 ssize_t
 sudo_getdelim(char **buf, size_t *bufsize, int delim, FILE *fp)
diff --git a/lib/util/getentropy.c b/lib/util/getentropy.c
index 7233c641b..5daf0f742 100644
--- a/lib/util/getentropy.c
+++ b/lib/util/getentropy.c
@@ -76,9 +76,9 @@
 # include <openssl/rand.h>
 #endif
 
-#include "sudo_compat.h"
-#include "sudo_digest.h"
-#include "sudo_rand.h"
+#include <sudo_compat.h>
+#include <sudo_digest.h>
+#include <sudo_rand.h>
 
 #if !defined(MAP_ANON) && defined(MAP_ANONYMOUS)
 # define MAP_ANON MAP_ANONYMOUS
diff --git a/lib/util/getgrouplist.c b/lib/util/getgrouplist.c
index c8a16686c..48d1fbe0b 100644
--- a/lib/util/getgrouplist.c
+++ b/lib/util/getgrouplist.c
@@ -36,13 +36,13 @@
 # ifdef HAVE_NSS_DBDEFS_H
 #  include <nss_dbdefs.h>
 # else
-#  include "compat/nss_dbdefs.h"
+#  include <compat/nss_dbdefs.h>
 # endif
 #endif
 
-#include "sudo_compat.h"
-#include "sudo_debug.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_debug.h>
+#include <sudo_util.h>
 
 #ifndef HAVE_GETGROUPLIST
 int
diff --git a/lib/util/gethostname.c b/lib/util/gethostname.c
index 894aefa3d..34f714be0 100644
--- a/lib/util/gethostname.c
+++ b/lib/util/gethostname.c
@@ -26,8 +26,8 @@
 #include <stdlib.h>
 #include <unistd.h>
 
-#include "sudo_compat.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_util.h>
 
 /*
  * Return a malloc()ed copy of the system hostname, or NULL if 
diff --git a/lib/util/getopt_long.c b/lib/util/getopt_long.c
index 15b04eef9..04f6d4726 100644
--- a/lib/util/getopt_long.c
+++ b/lib/util/getopt_long.c
@@ -64,9 +64,9 @@
 
 #define SUDO_ERROR_WRAP 0
 
-#include "sudo_compat.h"
-#include "sudo_fatal.h"
-#include "compat/getopt.h"
+#include <sudo_compat.h>
+#include <sudo_fatal.h>
+#include <compat/getopt.h>
 
 #define GNU_COMPATIBLE		/* Be more compatible with GNU getopt. */
 
diff --git a/lib/util/gettime.c b/lib/util/gettime.c
index e7161b507..54fbcb347 100644
--- a/lib/util/gettime.c
+++ b/lib/util/gettime.c
@@ -32,9 +32,9 @@
 # include <mach/clock.h>
 #endif
 
-#include "sudo_compat.h"
-#include "sudo_debug.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_debug.h>
+#include <sudo_util.h>
 
 /*
  * On Linux and FreeBSD, CLOCK_MONOTONIC does not run while sleeping.
diff --git a/lib/util/getusershell.c b/lib/util/getusershell.c
index 56661d012..05bbc44dd 100644
--- a/lib/util/getusershell.c
+++ b/lib/util/getusershell.c
@@ -27,12 +27,12 @@
 #include <stdlib.h>
 #include <string.h>
 
-#include "sudo_compat.h"
-#include "sudo_debug.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_debug.h>
+#include <sudo_util.h>
 
 #ifdef TESTSUDOERS
-# include "tsgetgrpw.h"
+# include <tsgetgrpw.h>
 #endif
 
 static const char *shellfile = "/etc/shell";
diff --git a/lib/util/gidlist.c b/lib/util/gidlist.c
index c1a2562e3..efcb7df6f 100644
--- a/lib/util/gidlist.c
+++ b/lib/util/gidlist.c
@@ -26,11 +26,11 @@
 #include <stdlib.h>
 #include <grp.h>
 
-#include "sudo_compat.h"
-#include "sudo_debug.h"
-#include "sudo_fatal.h"
-#include "sudo_gettext.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_debug.h>
+#include <sudo_fatal.h>
+#include <sudo_gettext.h>
+#include <sudo_util.h>
 
 /*
  * Parse a comma-separated list of gids into an allocated array of GETGROUPS_T.
diff --git a/lib/util/glob.c b/lib/util/glob.c
index 762e107be..5ed419a46 100644
--- a/lib/util/glob.c
+++ b/lib/util/glob.c
@@ -73,9 +73,9 @@
 #include <limits.h>
 #include <pwd.h>
 
-#include "sudo_compat.h"
-#include "compat/glob.h"
-#include "compat/charclass.h"
+#include <sudo_compat.h>
+#include <compat/glob.h>
+#include <compat/charclass.h>
 
 #define	DOLLAR		'$'
 #define	DOT		'.'
diff --git a/lib/util/gmtime_r.c b/lib/util/gmtime_r.c
index b9feb1f71..11e2651df 100644
--- a/lib/util/gmtime_r.c
+++ b/lib/util/gmtime_r.c
@@ -28,8 +28,8 @@
 #include <sys/types.h>
 #include <time.h>
 
-#include "sudo_compat.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_util.h>
 
 /*
  * Fake gmtime_r() that just stores the result.
diff --git a/lib/util/hexchar.c b/lib/util/hexchar.c
index 8585f57f7..06508436e 100644
--- a/lib/util/hexchar.c
+++ b/lib/util/hexchar.c
@@ -23,9 +23,9 @@
 
 #include <config.h>
 
-#include "sudo_compat.h"
-#include "sudo_debug.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_debug.h>
+#include <sudo_util.h>
 
 /*
  * Converts a two-byte hex string to decimal.
diff --git a/lib/util/inet_ntop.c b/lib/util/inet_ntop.c
index f6847e204..e456d6e87 100644
--- a/lib/util/inet_ntop.c
+++ b/lib/util/inet_ntop.c
@@ -32,7 +32,7 @@
 #include <errno.h>
 #include <stdio.h>
 
-#include "sudo_compat.h"
+#include <sudo_compat.h>
 
 #ifndef EAFNOSUPPORT
 # define EAFNOSUPPORT EINVAL
diff --git a/lib/util/inet_pton.c b/lib/util/inet_pton.c
index c73c9c3f8..d3b4b4bf5 100644
--- a/lib/util/inet_pton.c
+++ b/lib/util/inet_pton.c
@@ -31,7 +31,7 @@
 #include <string.h>
 #include <errno.h>
 
-#include "sudo_compat.h"
+#include <sudo_compat.h>
 
 #ifndef EAFNOSUPPORT
 # define EAFNOSUPPORT EINVAL
diff --git a/lib/util/isblank.c b/lib/util/isblank.c
index 753e0307c..cc099c0b3 100644
--- a/lib/util/isblank.c
+++ b/lib/util/isblank.c
@@ -26,7 +26,7 @@
 
 #ifndef HAVE_ISBLANK
 
-#include "sudo_compat.h"
+#include <sudo_compat.h>
 
 #undef isblank
 int
diff --git a/lib/util/json.c b/lib/util/json.c
index 58e3305ed..e0bd286b7 100644
--- a/lib/util/json.c
+++ b/lib/util/json.c
@@ -29,16 +29,16 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif /* HAVE_STDBOOL_H */
 #include <string.h>
 
-#include "sudo_compat.h"
-#include "sudo_debug.h"
-#include "sudo_fatal.h"
-#include "sudo_gettext.h"
-#include "sudo_json.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_debug.h>
+#include <sudo_fatal.h>
+#include <sudo_gettext.h>
+#include <sudo_json.h>
+#include <sudo_util.h>
 
 /*
  * Double the size of the json buffer.
diff --git a/lib/util/key_val.c b/lib/util/key_val.c
index 91caad197..89ba4acbd 100644
--- a/lib/util/key_val.c
+++ b/lib/util/key_val.c
@@ -26,9 +26,9 @@
 #include <stdlib.h>
 #include <string.h>
 
-#include "sudo_compat.h"
-#include "sudo_debug.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_debug.h>
+#include <sudo_util.h>
 
 /*
  * Create a new key=value pair and return it.
diff --git a/lib/util/lbuf.c b/lib/util/lbuf.c
index 6aee5609b..6bc74ee94 100644
--- a/lib/util/lbuf.c
+++ b/lib/util/lbuf.c
@@ -29,10 +29,10 @@
 #include <stdlib.h>
 #include <string.h>
 
-#include "sudo_compat.h"
-#include "sudo_debug.h"
-#include "sudo_lbuf.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_debug.h>
+#include <sudo_lbuf.h>
+#include <sudo_util.h>
 
 void
 sudo_lbuf_init_v1(struct sudo_lbuf *lbuf, sudo_lbuf_output_t output,
diff --git a/lib/util/localtime_r.c b/lib/util/localtime_r.c
index 674cb1aa5..180c8904f 100644
--- a/lib/util/localtime_r.c
+++ b/lib/util/localtime_r.c
@@ -28,8 +28,8 @@
 #include <sys/types.h>
 #include <time.h>
 
-#include "sudo_compat.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_util.h>
 
 /*
  * Fake localtime_r() that just stores the result.
diff --git a/lib/util/locking.c b/lib/util/locking.c
index 638b08202..a6bce60cf 100644
--- a/lib/util/locking.c
+++ b/lib/util/locking.c
@@ -33,15 +33,15 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif
 #include <errno.h>
 #include <fcntl.h>
 #include <unistd.h>
 
-#include "sudo_compat.h"
-#include "sudo_util.h"
-#include "sudo_debug.h"
+#include <sudo_compat.h>
+#include <sudo_util.h>
+#include <sudo_debug.h>
 
 bool
 sudo_lock_file_v1(int fd, int type)
diff --git a/lib/util/logfac.c b/lib/util/logfac.c
index 5a97ac3b1..cb9c3ce90 100644
--- a/lib/util/logfac.c
+++ b/lib/util/logfac.c
@@ -31,9 +31,9 @@
 #include <string.h>
 #include <syslog.h>
 
-#include "sudo_compat.h"
-#include "sudo_debug.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_debug.h>
+#include <sudo_util.h>
 
 /*
  * For converting between syslog numbers and strings.
diff --git a/lib/util/logpri.c b/lib/util/logpri.c
index a6503bd76..3fd1f6cbc 100644
--- a/lib/util/logpri.c
+++ b/lib/util/logpri.c
@@ -31,9 +31,9 @@
 #include <string.h>
 #include <syslog.h>
 
-#include "sudo_compat.h"
-#include "sudo_debug.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_debug.h>
+#include <sudo_util.h>
 
 /*
  * For converting between syslog numbers and strings.
diff --git a/lib/util/memrchr.c b/lib/util/memrchr.c
index a5a1177e8..0a042e461 100644
--- a/lib/util/memrchr.c
+++ b/lib/util/memrchr.c
@@ -28,7 +28,7 @@
 
 #include <sys/types.h>
 
-#include "sudo_compat.h"
+#include <sudo_compat.h>
 
 /*
  * Reverse memchr()
diff --git a/lib/util/mkdir_parents.c b/lib/util/mkdir_parents.c
index f8a056d2a..b48374828 100644
--- a/lib/util/mkdir_parents.c
+++ b/lib/util/mkdir_parents.c
@@ -29,7 +29,7 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif /* HAVE_STDBOOL_H */
 #include <string.h>
 #include <unistd.h>
@@ -38,11 +38,11 @@
 #include <fcntl.h>
 #include <limits.h>
 
-#include "sudo_compat.h"
-#include "sudo_fatal.h"
-#include "sudo_gettext.h"
-#include "sudo_debug.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_fatal.h>
+#include <sudo_gettext.h>
+#include <sudo_debug.h>
+#include <sudo_util.h>
 
 #ifndef O_NOFOLLOW
 # define O_NOFOLLOW 0
diff --git a/lib/util/mkdirat.c b/lib/util/mkdirat.c
index 4dee92d10..18649b1f2 100644
--- a/lib/util/mkdirat.c
+++ b/lib/util/mkdirat.c
@@ -27,7 +27,7 @@
 #include <fcntl.h>
 #include <unistd.h>
 
-#include "sudo_compat.h"
+#include <sudo_compat.h>
 
 #ifndef HAVE_MKDIRAT
 int
diff --git a/lib/util/mksiglist.c b/lib/util/mksiglist.c
index fd5b81773..bcdfa1da4 100644
--- a/lib/util/mksiglist.c
+++ b/lib/util/mksiglist.c
@@ -27,7 +27,7 @@
 #include <stdlib.h>
 #include <signal.h>
 
-#include "sudo_compat.h"
+#include <sudo_compat.h>
 
 sudo_dso_public int main(int argc, char *argv[]);
 
diff --git a/lib/util/mksigname.c b/lib/util/mksigname.c
index e2dc6fb64..a4ca3dbdf 100644
--- a/lib/util/mksigname.c
+++ b/lib/util/mksigname.c
@@ -27,7 +27,7 @@
 #include <stdlib.h>
 #include <signal.h>
 
-#include "sudo_compat.h"
+#include <sudo_compat.h>
 
 sudo_dso_public int main(int argc, char *argv[]);
 
diff --git a/lib/util/mktemp.c b/lib/util/mktemp.c
index ef5e7de1c..08f289ab4 100644
--- a/lib/util/mktemp.c
+++ b/lib/util/mktemp.c
@@ -43,9 +43,9 @@
 #include <ctype.h>
 #include <unistd.h>
 
-#include "sudo_compat.h"
-#include "sudo_rand.h"
-#include "pathnames.h"
+#include <sudo_compat.h>
+#include <sudo_rand.h>
+#include <pathnames.h>
 
 #define MKTEMP_FILE	1
 #define MKTEMP_DIR	2
diff --git a/lib/util/mmap_alloc.c b/lib/util/mmap_alloc.c
index cd678a07c..b587338d6 100644
--- a/lib/util/mmap_alloc.c
+++ b/lib/util/mmap_alloc.c
@@ -36,8 +36,8 @@
 # include <inttypes.h>
 #endif
 
-#include "sudo_compat.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_util.h>
 
 #if !defined(MAP_ANON) && defined(MAP_ANONYMOUS)
 # define MAP_ANON MAP_ANONYMOUS
diff --git a/lib/util/multiarch.c b/lib/util/multiarch.c
index d2a0fcd8c..0b79de590 100644
--- a/lib/util/multiarch.c
+++ b/lib/util/multiarch.c
@@ -32,8 +32,8 @@
 #include <stdlib.h>
 #include <string.h>
 
-#include "sudo_compat.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_util.h>
 
 # if defined(__linux__)
 /* 
diff --git a/lib/util/nanosleep.c b/lib/util/nanosleep.c
index 19eb90a09..84c41b8fc 100644
--- a/lib/util/nanosleep.c
+++ b/lib/util/nanosleep.c
@@ -34,8 +34,8 @@
 #include <time.h>
 #include <errno.h>
 
-#include "sudo_compat.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_util.h>
 
 int
 sudo_nanosleep(const struct timespec *timeout, struct timespec *remainder)
diff --git a/lib/util/openat.c b/lib/util/openat.c
index 5431525f1..b748be9d2 100644
--- a/lib/util/openat.c
+++ b/lib/util/openat.c
@@ -26,7 +26,7 @@
 #include <fcntl.h>
 #include <unistd.h>
 
-#include "sudo_compat.h"
+#include <sudo_compat.h>
 
 #ifndef HAVE_OPENAT
 int
diff --git a/lib/util/parseln.c b/lib/util/parseln.c
index 11d813060..ec10d9d58 100644
--- a/lib/util/parseln.c
+++ b/lib/util/parseln.c
@@ -31,12 +31,12 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif
 
-#include "sudo_compat.h"
-#include "sudo_util.h"
-#include "sudo_debug.h"
+#include <sudo_compat.h>
+#include <sudo_util.h>
+#include <sudo_debug.h>
 
 /*
  * Read a line of input, honoring line continuation chars.
diff --git a/lib/util/pipe2.c b/lib/util/pipe2.c
index 43527a027..1ffcad09a 100644
--- a/lib/util/pipe2.c
+++ b/lib/util/pipe2.c
@@ -28,7 +28,7 @@
 #include <fcntl.h>
 #include <unistd.h>
 
-#include "sudo_compat.h"
+#include <sudo_compat.h>
 
 int
 sudo_pipe2(int fildes[2], int flags)
diff --git a/lib/util/pread.c b/lib/util/pread.c
index 9328c543a..a8a4774d0 100644
--- a/lib/util/pread.c
+++ b/lib/util/pread.c
@@ -26,7 +26,7 @@
 #include <errno.h>
 #include <unistd.h>
 
-#include "sudo_compat.h"
+#include <sudo_compat.h>
 
 #if !defined(HAVE_PREAD) && !defined(HAVE_PREAD64)
 ssize_t
diff --git a/lib/util/progname.c b/lib/util/progname.c
index 6a7a9236d..9355b6a5c 100644
--- a/lib/util/progname.c
+++ b/lib/util/progname.c
@@ -26,8 +26,8 @@
 #include <stdlib.h>
 #include <string.h>
 
-#include "sudo_compat.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_util.h>
 
 /*
  * Declare/define __progname[] if necessary.
diff --git a/lib/util/pw_dup.c b/lib/util/pw_dup.c
index ccd2fbb00..d643b5b35 100644
--- a/lib/util/pw_dup.c
+++ b/lib/util/pw_dup.c
@@ -34,7 +34,7 @@
 #include <string.h>
 #include <pwd.h>
 
-#include "sudo_compat.h"
+#include <sudo_compat.h>
 
 #define PW_SIZE(name, size)				\
 do {							\
diff --git a/lib/util/pwrite.c b/lib/util/pwrite.c
index 48f8cbf8e..24dba6cab 100644
--- a/lib/util/pwrite.c
+++ b/lib/util/pwrite.c
@@ -26,7 +26,7 @@
 #include <errno.h>
 #include <unistd.h>
 
-#include "sudo_compat.h"
+#include <sudo_compat.h>
 
 #if !defined(HAVE_PWRITE) && !defined(HAVE_PWRITE64)
 ssize_t
diff --git a/lib/util/rcstr.c b/lib/util/rcstr.c
index 56cc39417..1fefbad44 100644
--- a/lib/util/rcstr.c
+++ b/lib/util/rcstr.c
@@ -27,9 +27,9 @@
 #include <stdlib.h>
 #include <string.h>
 
-#include "sudo_compat.h"
-#include "sudo_debug.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_debug.h>
+#include <sudo_util.h>
 
 /* Trivial reference-counted strings. */
 struct rcstr {
diff --git a/lib/util/reallocarray.c b/lib/util/reallocarray.c
index 56283e712..63d788259 100644
--- a/lib/util/reallocarray.c
+++ b/lib/util/reallocarray.c
@@ -35,7 +35,7 @@
 #include <errno.h>
 #include <limits.h>
 
-#include "sudo_compat.h"
+#include <sudo_compat.h>
 
 /*
  * This is sqrt(SIZE_MAX+1), as s1*s2 <= SIZE_MAX
diff --git a/lib/util/regex.c b/lib/util/regex.c
index 1d20da4d1..1f91b4dbc 100644
--- a/lib/util/regex.c
+++ b/lib/util/regex.c
@@ -30,10 +30,10 @@
 #include <limits.h>
 #include <regex.h>
 
-#include "sudo_compat.h"
-#include "sudo_debug.h"
-#include "sudo_util.h"
-#include "sudo_gettext.h"
+#include <sudo_compat.h>
+#include <sudo_debug.h>
+#include <sudo_util.h>
+#include <sudo_gettext.h>
 
 static char errbuf[1024];
 
diff --git a/lib/util/regress/closefrom/closefrom_test.c b/lib/util/regress/closefrom/closefrom_test.c
index 375bb5102..750c951a5 100644
--- a/lib/util/regress/closefrom/closefrom_test.c
+++ b/lib/util/regress/closefrom/closefrom_test.c
@@ -27,9 +27,9 @@
 
 #define SUDO_ERROR_WRAP 0
 
-#include "sudo_compat.h"
-#include "sudo_fatal.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_fatal.h>
+#include <sudo_util.h>
 
 sudo_dso_public int main(int argc, char *argv[]);
 
diff --git a/lib/util/regress/digest/digest_test.c b/lib/util/regress/digest/digest_test.c
index 915d8545f..69740a934 100644
--- a/lib/util/regress/digest/digest_test.c
+++ b/lib/util/regress/digest/digest_test.c
@@ -24,10 +24,10 @@
 
 #define SUDO_ERROR_WRAP 0
 
-#include "sudo_compat.h"
-#include "sudo_digest.h"
-#include "sudo_util.h"
-#include "sudo_fatal.h"
+#include <sudo_compat.h>
+#include <sudo_digest.h>
+#include <sudo_util.h>
+#include <sudo_fatal.h>
 
 sudo_dso_public int main(int argc, char *argv[]);
 
diff --git a/lib/util/regress/fnmatch/fnm_test.c b/lib/util/regress/fnmatch/fnm_test.c
index 126683b8d..e4689c85f 100644
--- a/lib/util/regress/fnmatch/fnm_test.c
+++ b/lib/util/regress/fnmatch/fnm_test.c
@@ -13,11 +13,11 @@
 #ifdef HAVE_FNMATCH
 # include <fnmatch.h>
 #else
-# include "compat/fnmatch.h"
+# include <compat/fnmatch.h>
 #endif
 
-#include "sudo_compat.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_util.h>
 
 sudo_dso_public int main(int argc, char *argv[]);
 
diff --git a/lib/util/regress/fuzz/fuzz_sudo_conf.c b/lib/util/regress/fuzz/fuzz_sudo_conf.c
index a6e120cb9..e2e2723ca 100644
--- a/lib/util/regress/fuzz/fuzz_sudo_conf.c
+++ b/lib/util/regress/fuzz/fuzz_sudo_conf.c
@@ -28,12 +28,12 @@
 
 #define SUDO_ERROR_WRAP 0
 
-#include "sudo_compat.h"
-#include "sudo_conf.h"
-#include "sudo_debug.h"
-#include "sudo_fatal.h"
-#include "sudo_plugin.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_conf.h>
+#include <sudo_debug.h>
+#include <sudo_fatal.h>
+#include <sudo_plugin.h>
+#include <sudo_util.h>
 
 int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size);
 
diff --git a/lib/util/regress/getdelim/getdelim_test.c b/lib/util/regress/getdelim/getdelim_test.c
index 2e77fd2c9..091f6c130 100644
--- a/lib/util/regress/getdelim/getdelim_test.c
+++ b/lib/util/regress/getdelim/getdelim_test.c
@@ -27,14 +27,14 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif
 #include <limits.h>
 #include <unistd.h>
 
-#include "sudo_compat.h"
-#include "sudo_fatal.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_fatal.h>
+#include <sudo_util.h>
 
 sudo_dso_public int main(int argc, char *argv[]);
 
diff --git a/lib/util/regress/getgrouplist/getgids.c b/lib/util/regress/getgrouplist/getgids.c
index f366f83ed..83518f37d 100644
--- a/lib/util/regress/getgrouplist/getgids.c
+++ b/lib/util/regress/getgrouplist/getgids.c
@@ -24,7 +24,7 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif
 #include <unistd.h>
 #include <pwd.h>
@@ -32,9 +32,9 @@
 
 #define SUDO_ERROR_WRAP 0
 
-#include "sudo_compat.h"
-#include "sudo_fatal.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_fatal.h>
+#include <sudo_util.h>
 
 sudo_dso_public int main(int argc, char *argv[]);
 
diff --git a/lib/util/regress/getgrouplist/getgrouplist_test.c b/lib/util/regress/getgrouplist/getgrouplist_test.c
index 8429528b7..e400e60ab 100644
--- a/lib/util/regress/getgrouplist/getgrouplist_test.c
+++ b/lib/util/regress/getgrouplist/getgrouplist_test.c
@@ -24,15 +24,15 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif
 #include <pwd.h>
 #include <grp.h>
 #include <unistd.h>
 
-#include "sudo_compat.h"
-#include "sudo_fatal.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_fatal.h>
+#include <sudo_util.h>
 
 sudo_dso_public int main(int argc, char *argv[]);
 
diff --git a/lib/util/regress/glob/globtest.c b/lib/util/regress/glob/globtest.c
index 866535a1b..7ace43896 100644
--- a/lib/util/regress/glob/globtest.c
+++ b/lib/util/regress/glob/globtest.c
@@ -12,13 +12,13 @@
 #ifdef HAVE_GLOB
 # include <glob.h>
 #else
-# include "compat/glob.h"
+# include <compat/glob.h>
 #endif
 #include <errno.h>
 #include <unistd.h>
 
-#include "sudo_compat.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_util.h>
 
 #define MAX_RESULTS	256
 
diff --git a/lib/util/regress/hexchar/hexchar_test.c b/lib/util/regress/hexchar/hexchar_test.c
index 857e23d89..284d1d42b 100644
--- a/lib/util/regress/hexchar/hexchar_test.c
+++ b/lib/util/regress/hexchar/hexchar_test.c
@@ -24,8 +24,8 @@
 
 #define SUDO_ERROR_WRAP 0
 
-#include "sudo_compat.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_util.h>
 
 sudo_dso_public int main(int argc, char *argv[]);
 
diff --git a/lib/util/regress/json/json_test.c b/lib/util/regress/json/json_test.c
index 8dc67193e..5acaeb535 100644
--- a/lib/util/regress/json/json_test.c
+++ b/lib/util/regress/json/json_test.c
@@ -27,10 +27,10 @@
 
 #define SUDO_ERROR_WRAP 0
 
-#include "sudo_compat.h"
-#include "sudo_json.h"
-#include "sudo_util.h"
-#include "sudo_fatal.h"
+#include <sudo_compat.h>
+#include <sudo_json.h>
+#include <sudo_util.h>
+#include <sudo_fatal.h>
 
 sudo_dso_public int main(int argc, char *argv[]);
 
diff --git a/lib/util/regress/mktemp/mktemp_test.c b/lib/util/regress/mktemp/mktemp_test.c
index 53c19e8bd..b44143173 100644
--- a/lib/util/regress/mktemp/mktemp_test.c
+++ b/lib/util/regress/mktemp/mktemp_test.c
@@ -22,9 +22,9 @@
 
 #define SUDO_ERROR_WRAP 0
 
-#include "sudo_compat.h"
-#include "sudo_util.h"
-#include "sudo_fatal.h"
+#include <sudo_compat.h>
+#include <sudo_util.h>
+#include <sudo_fatal.h>
 
 #ifndef MAP_ANON
 # if defined(MAP_ANONYMOUS)
diff --git a/lib/util/regress/multiarch/multiarch_test.c b/lib/util/regress/multiarch/multiarch_test.c
index 1c60aff92..a6e70c174 100644
--- a/lib/util/regress/multiarch/multiarch_test.c
+++ b/lib/util/regress/multiarch/multiarch_test.c
@@ -27,9 +27,9 @@
 
 #define SUDO_ERROR_WRAP 0
 
-#include "sudo_compat.h"
-#include "sudo_fatal.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_fatal.h>
+#include <sudo_util.h>
 
 sudo_dso_public int main(int argc, char *argv[]);
 
diff --git a/lib/util/regress/open_parent_dir/open_parent_dir_test.c b/lib/util/regress/open_parent_dir/open_parent_dir_test.c
index 95f1a09ed..0a4f2522b 100644
--- a/lib/util/regress/open_parent_dir/open_parent_dir_test.c
+++ b/lib/util/regress/open_parent_dir/open_parent_dir_test.c
@@ -27,9 +27,9 @@
 
 #define SUDO_ERROR_WRAP 0
 
-#include "sudo_compat.h"
-#include "sudo_fatal.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_fatal.h>
+#include <sudo_util.h>
 
 sudo_dso_public int main(int argc, char *argv[]);
 
diff --git a/lib/util/regress/parse_gids/parse_gids_test.c b/lib/util/regress/parse_gids/parse_gids_test.c
index 241e81b49..786843ff7 100644
--- a/lib/util/regress/parse_gids/parse_gids_test.c
+++ b/lib/util/regress/parse_gids/parse_gids_test.c
@@ -23,9 +23,9 @@
 #include <string.h>
 #include <unistd.h>
 
-#include "sudo_compat.h"
-#include "sudo_fatal.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_fatal.h>
+#include <sudo_util.h>
 
 sudo_dso_public int main(int argc, char *argv[]);
 
diff --git a/lib/util/regress/progname/progname_test.c b/lib/util/regress/progname/progname_test.c
index 0a88fafeb..330736c70 100644
--- a/lib/util/regress/progname/progname_test.c
+++ b/lib/util/regress/progname/progname_test.c
@@ -23,8 +23,8 @@
 #include <string.h>
 #include <unistd.h>
 
-#include "sudo_compat.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_util.h>
 
 sudo_dso_public int main(int argc, char *argv[]);
 
diff --git a/lib/util/regress/regex/regex_test.c b/lib/util/regress/regex/regex_test.c
index ed6986e16..ce629c65a 100644
--- a/lib/util/regress/regex/regex_test.c
+++ b/lib/util/regress/regex/regex_test.c
@@ -26,14 +26,14 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif
 
 #define SUDO_ERROR_WRAP 0
 
-#include "sudo_compat.h"
-#include "sudo_fatal.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_fatal.h>
+#include <sudo_util.h>
 
 sudo_dso_public int main(int argc, char *argv[]);
 
diff --git a/lib/util/regress/strsig/strsig_test.c b/lib/util/regress/strsig/strsig_test.c
index 30aaa2d51..79b40fad5 100644
--- a/lib/util/regress/strsig/strsig_test.c
+++ b/lib/util/regress/strsig/strsig_test.c
@@ -24,9 +24,9 @@
 #include <string.h>
 #include <unistd.h>
 
-#include "sudo_compat.h"
-#include "sudo_util.h"
-#include "sudo_fatal.h"
+#include <sudo_compat.h>
+#include <sudo_util.h>
+#include <sudo_fatal.h>
 
 sudo_dso_public int main(int argc, char *argv[]);
 
diff --git a/lib/util/regress/strsplit/strsplit_test.c b/lib/util/regress/strsplit/strsplit_test.c
index 9ba830ba9..fb868f450 100644
--- a/lib/util/regress/strsplit/strsplit_test.c
+++ b/lib/util/regress/strsplit/strsplit_test.c
@@ -23,9 +23,9 @@
 #include <string.h>
 #include <unistd.h>
 
-#include "sudo_compat.h"
-#include "sudo_fatal.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_fatal.h>
+#include <sudo_util.h>
 
 sudo_dso_public int main(int argc, char *argv[]);
 
diff --git a/lib/util/regress/strtofoo/strtobool_test.c b/lib/util/regress/strtofoo/strtobool_test.c
index 5b5a6cf84..8264d4f1c 100644
--- a/lib/util/regress/strtofoo/strtobool_test.c
+++ b/lib/util/regress/strtofoo/strtobool_test.c
@@ -23,13 +23,13 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif
 #include <unistd.h>
 
-#include "sudo_compat.h"
-#include "sudo_util.h"
-#include "sudo_fatal.h"
+#include <sudo_compat.h>
+#include <sudo_util.h>
+#include <sudo_fatal.h>
 
 sudo_dso_public int main(int argc, char *argv[]);
 
diff --git a/lib/util/regress/strtofoo/strtoid_test.c b/lib/util/regress/strtofoo/strtoid_test.c
index e2985c89e..6e5998f58 100644
--- a/lib/util/regress/strtofoo/strtoid_test.c
+++ b/lib/util/regress/strtofoo/strtoid_test.c
@@ -23,9 +23,9 @@
 #include <errno.h>
 #include <unistd.h>
 
-#include "sudo_compat.h"
-#include "sudo_util.h"
-#include "sudo_fatal.h"
+#include <sudo_compat.h>
+#include <sudo_util.h>
+#include <sudo_fatal.h>
 
 sudo_dso_public int main(int argc, char *argv[]);
 
diff --git a/lib/util/regress/strtofoo/strtomode_test.c b/lib/util/regress/strtofoo/strtomode_test.c
index 5e4d862ea..c7a31b0b1 100644
--- a/lib/util/regress/strtofoo/strtomode_test.c
+++ b/lib/util/regress/strtofoo/strtomode_test.c
@@ -22,9 +22,9 @@
 #include <stdlib.h>
 #include <unistd.h>
 
-#include "sudo_compat.h"
-#include "sudo_util.h"
-#include "sudo_fatal.h"
+#include <sudo_compat.h>
+#include <sudo_util.h>
+#include <sudo_fatal.h>
 
 sudo_dso_public int main(int argc, char *argv[]);
 
diff --git a/lib/util/regress/strtofoo/strtonum_test.c b/lib/util/regress/strtofoo/strtonum_test.c
index 8aca97da8..a90ed0234 100644
--- a/lib/util/regress/strtofoo/strtonum_test.c
+++ b/lib/util/regress/strtofoo/strtonum_test.c
@@ -24,9 +24,9 @@
 #include <errno.h>
 #include <unistd.h>
 
-#include "sudo_compat.h"
-#include "sudo_util.h"
-#include "sudo_fatal.h"
+#include <sudo_compat.h>
+#include <sudo_util.h>
+#include <sudo_fatal.h>
 
 sudo_dso_public int main(int argc, char *argv[]);
 
diff --git a/lib/util/regress/sudo_conf/conf_test.c b/lib/util/regress/sudo_conf/conf_test.c
index dc96146df..dc65bc384 100644
--- a/lib/util/regress/sudo_conf/conf_test.c
+++ b/lib/util/regress/sudo_conf/conf_test.c
@@ -23,10 +23,10 @@
 #include <string.h>
 #include <unistd.h>
 
-#include "sudo_compat.h"
-#include "sudo_conf.h"
-#include "sudo_debug.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_conf.h>
+#include <sudo_debug.h>
+#include <sudo_util.h>
 
 static void sudo_conf_dump(void);
 
diff --git a/lib/util/regress/sudo_parseln/parseln_test.c b/lib/util/regress/sudo_parseln/parseln_test.c
index 8cd72947a..946376781 100644
--- a/lib/util/regress/sudo_parseln/parseln_test.c
+++ b/lib/util/regress/sudo_parseln/parseln_test.c
@@ -23,8 +23,8 @@
 #include <string.h>
 #include <unistd.h>
 
-#include "sudo_compat.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_util.h>
 
 sudo_dso_public int main(int argc, char *argv[]);
 
diff --git a/lib/util/regress/tailq/hltq_test.c b/lib/util/regress/tailq/hltq_test.c
index 447f884dd..412d7a9b0 100644
--- a/lib/util/regress/tailq/hltq_test.c
+++ b/lib/util/regress/tailq/hltq_test.c
@@ -24,10 +24,10 @@
 #include <string.h>
 #include <unistd.h>
 
-#include "sudo_compat.h"
-#include "sudo_fatal.h"
-#include "sudo_queue.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_fatal.h>
+#include <sudo_queue.h>
+#include <sudo_util.h>
 
 sudo_dso_public int main(int argc, char *argv[]);
 
diff --git a/lib/util/regress/uuid/uuid_test.c b/lib/util/regress/uuid/uuid_test.c
index 37ef4171e..411266c21 100644
--- a/lib/util/regress/uuid/uuid_test.c
+++ b/lib/util/regress/uuid/uuid_test.c
@@ -29,9 +29,9 @@
 
 #define SUDO_ERROR_WRAP 0
 
-#include "sudo_compat.h"
-#include "sudo_fatal.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_fatal.h>
+#include <sudo_util.h>
 
 sudo_dso_public int main(int argc, char *argv[]);
 
diff --git a/lib/util/roundup.c b/lib/util/roundup.c
index cdb4d50ad..b19d9a4db 100644
--- a/lib/util/roundup.c
+++ b/lib/util/roundup.c
@@ -23,9 +23,9 @@
 
 #include <config.h>
 
-#include "sudo_compat.h"
-#include "sudo_debug.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_debug.h>
+#include <sudo_util.h>
 
 /*
  * Round 32-bit unsigned length to the next highest power of two.
diff --git a/lib/util/secure_path.c b/lib/util/secure_path.c
index debd5417c..aaceb5763 100644
--- a/lib/util/secure_path.c
+++ b/lib/util/secure_path.c
@@ -29,9 +29,9 @@
 #include <string.h>
 #include <unistd.h>
 
-#include "sudo_compat.h"
-#include "sudo_util.h"
-#include "sudo_debug.h"
+#include <sudo_compat.h>
+#include <sudo_util.h>
+#include <sudo_debug.h>
 
 /*
  * Verify that path is the right type and not writable by other users.
diff --git a/lib/util/setgroups.c b/lib/util/setgroups.c
index b094c9e68..7298fcc04 100644
--- a/lib/util/setgroups.c
+++ b/lib/util/setgroups.c
@@ -29,9 +29,9 @@
 #include <grp.h>
 #include <limits.h>
 
-#include "sudo_compat.h"
-#include "sudo_debug.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_debug.h>
+#include <sudo_util.h>
 
 int
 sudo_setgroups_v1(int ngids, const GETGROUPS_T *gids)
diff --git a/lib/util/sha2.c b/lib/util/sha2.c
index a9e385740..7ec65044e 100644
--- a/lib/util/sha2.c
+++ b/lib/util/sha2.c
@@ -44,11 +44,11 @@
 #elif defined(HAVE_MACHINE_ENDIAN_H)
 # include <machine/endian.h>
 #else
-# include "compat/endian.h"
+# include <compat/endian.h>
 #endif
 
-#include "sudo_compat.h"
-#include "compat/sha2.h"
+#include <sudo_compat.h>
+#include <compat/sha2.h>
 
 /*
  * SHA-2 operates on 32-bit and 64-bit words in big endian byte order.
diff --git a/lib/util/sig2str.c b/lib/util/sig2str.c
index 29a9318f9..11acc5e2b 100644
--- a/lib/util/sig2str.c
+++ b/lib/util/sig2str.c
@@ -31,8 +31,8 @@
 #include <signal.h>
 #include <unistd.h>
 
-#include "sudo_compat.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_util.h>
 
 #if !defined(HAVE_SIGABBREV_NP)
 # if defined(HAVE_DECL_SYS_SIGNAME) && HAVE_DECL_SYS_SIGNAME == 1
diff --git a/lib/util/snprintf.c b/lib/util/snprintf.c
index 365e6d3e1..64765da8e 100644
--- a/lib/util/snprintf.c
+++ b/lib/util/snprintf.c
@@ -68,8 +68,8 @@
 #endif
 #include <fcntl.h>
 
-#include "sudo_compat.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_util.h>
 
 /* Avoid printf format attacks by ignoring the %n escape. */
 #define NO_PRINTF_PERCENT_N
diff --git a/lib/util/str2sig.c b/lib/util/str2sig.c
index cc72ddd7a..5b0bcbf3a 100644
--- a/lib/util/str2sig.c
+++ b/lib/util/str2sig.c
@@ -34,8 +34,8 @@
 #include <signal.h>
 #include <unistd.h>
 
-#include "sudo_compat.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_util.h>
 
 #if !defined(HAVE_SIGABBREV_NP)
 # if defined(HAVE_DECL_SYS_SIGNAME) && HAVE_DECL_SYS_SIGNAME == 1
diff --git a/lib/util/strlcat.c b/lib/util/strlcat.c
index 5531e35a1..a124a4fa1 100644
--- a/lib/util/strlcat.c
+++ b/lib/util/strlcat.c
@@ -30,7 +30,7 @@
 
 #include <string.h>
 
-#include "sudo_compat.h"
+#include <sudo_compat.h>
 
 /*
  * Appends src to string dst of size dsize (unlike strncat, dsize is the
diff --git a/lib/util/strlcpy.c b/lib/util/strlcpy.c
index 6f737ea00..c2daada88 100644
--- a/lib/util/strlcpy.c
+++ b/lib/util/strlcpy.c
@@ -30,7 +30,7 @@
 
 #include <string.h>
 
-#include "sudo_compat.h"
+#include <sudo_compat.h>
 
 /*
  * Copy string src to buffer dst of size dsize.  At most dsize-1
diff --git a/lib/util/strndup.c b/lib/util/strndup.c
index 75b92eb08..f44fc8dba 100644
--- a/lib/util/strndup.c
+++ b/lib/util/strndup.c
@@ -30,7 +30,7 @@
 #include <stdlib.h>
 #include <string.h>
 
-#include "sudo_compat.h"
+#include <sudo_compat.h>
 
 char *
 sudo_strndup(const char *str, size_t maxlen)
diff --git a/lib/util/strnlen.c b/lib/util/strnlen.c
index 5e0977aa7..c39451528 100644
--- a/lib/util/strnlen.c
+++ b/lib/util/strnlen.c
@@ -29,7 +29,7 @@
 
 #include <sys/types.h>
 
-#include "sudo_compat.h"
+#include <sudo_compat.h>
 
 size_t
 sudo_strnlen(const char *str, size_t maxlen)
diff --git a/lib/util/strsignal.c b/lib/util/strsignal.c
index 76c93785d..411252f16 100644
--- a/lib/util/strsignal.c
+++ b/lib/util/strsignal.c
@@ -27,8 +27,8 @@
 
 #include <signal.h>
 
-#include "sudo_compat.h"
-#include "sudo_gettext.h"
+#include <sudo_compat.h>
+#include <sudo_gettext.h>
 
 #if defined(HAVE_DECL_SYS_SIGLIST) && HAVE_DECL_SYS_SIGLIST == 1
 # define sudo_sys_siglist	sys_siglist
diff --git a/lib/util/strsplit.c b/lib/util/strsplit.c
index 76634600c..234397507 100644
--- a/lib/util/strsplit.c
+++ b/lib/util/strsplit.c
@@ -23,9 +23,9 @@
 
 #include <config.h>
 
-#include "sudo_compat.h"
-#include "sudo_debug.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_debug.h>
+#include <sudo_util.h>
 
 /*
  * Like strtok_r but non-destructive and works w/o a NUL terminator.
diff --git a/lib/util/strtobool.c b/lib/util/strtobool.c
index 3cd198689..61aebbc12 100644
--- a/lib/util/strtobool.c
+++ b/lib/util/strtobool.c
@@ -27,9 +27,9 @@
 # include <strings.h>
 #endif /* HAVE_STRINGS_H */
 
-#include "sudo_compat.h"
-#include "sudo_debug.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_debug.h>
+#include <sudo_util.h>
 
 int
 sudo_strtobool_v1(const char *str)
diff --git a/lib/util/strtoid.c b/lib/util/strtoid.c
index 5b19fc89e..7e66a5380 100644
--- a/lib/util/strtoid.c
+++ b/lib/util/strtoid.c
@@ -28,16 +28,16 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif
 #include <ctype.h>
 #include <errno.h>
 #include <limits.h>
 
-#include "sudo_compat.h"
-#include "sudo_debug.h"
-#include "sudo_gettext.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_debug.h>
+#include <sudo_gettext.h>
+#include <sudo_util.h>
 
 /*
  * Make sure that the ID ends with a valid separator char.
diff --git a/lib/util/strtomode.c b/lib/util/strtomode.c
index 7c90c81c5..190203161 100644
--- a/lib/util/strtomode.c
+++ b/lib/util/strtomode.c
@@ -28,10 +28,10 @@
 #include <stdlib.h>
 #include <errno.h>
 
-#include "sudo_compat.h"
-#include "sudo_debug.h"
-#include "sudo_gettext.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_debug.h>
+#include <sudo_gettext.h>
+#include <sudo_util.h>
 
 /*
  * Parse an octal file mode in the range [0, 0777].
diff --git a/lib/util/strtonum.c b/lib/util/strtonum.c
index 8dc6f4a73..78e42e955 100644
--- a/lib/util/strtonum.c
+++ b/lib/util/strtonum.c
@@ -26,9 +26,9 @@
 #include <ctype.h>
 #include <errno.h>
 
-#include "sudo_compat.h"
-#include "sudo_gettext.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_gettext.h>
+#include <sudo_util.h>
 
 enum strtonum_err {
     STN_INITIAL,
diff --git a/lib/util/sudo_conf.c b/lib/util/sudo_conf.c
index 0fe8e3778..3104da166 100644
--- a/lib/util/sudo_conf.c
+++ b/lib/util/sudo_conf.c
@@ -29,7 +29,7 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif
 #include <string.h>
 #ifdef HAVE_STRINGS_H
@@ -43,14 +43,14 @@
 
 #define SUDO_ERROR_WRAP	0
 
-#include "sudo_compat.h"
-#include "sudo_conf.h"
-#include "sudo_debug.h"
-#include "sudo_fatal.h"
-#include "sudo_gettext.h"
-#include "sudo_plugin.h"
-#include "sudo_util.h"
-#include "pathnames.h"
+#include <sudo_compat.h>
+#include <sudo_conf.h>
+#include <sudo_debug.h>
+#include <sudo_fatal.h>
+#include <sudo_gettext.h>
+#include <sudo_plugin.h>
+#include <sudo_util.h>
+#include <pathnames.h>
 
 #ifndef _PATH_SUDO_INTERCEPT
 # define _PATH_SUDO_INTERCEPT NULL
diff --git a/lib/util/sudo_debug.c b/lib/util/sudo_debug.c
index fe9ed458b..47a7ba7ff 100644
--- a/lib/util/sudo_debug.c
+++ b/lib/util/sudo_debug.c
@@ -38,13 +38,13 @@
 #include <fcntl.h>
 #include <time.h>
 
-#include "sudo_compat.h"
-#include "sudo_conf.h"
-#include "sudo_debug.h"
-#include "sudo_fatal.h"
-#include "sudo_gettext.h"
-#include "sudo_plugin.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_conf.h>
+#include <sudo_debug.h>
+#include <sudo_fatal.h>
+#include <sudo_gettext.h>
+#include <sudo_plugin.h>
+#include <sudo_util.h>
 
 #ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
 /*
diff --git a/lib/util/sudo_dso.c b/lib/util/sudo_dso.c
index cd8144b80..0124b20f9 100644
--- a/lib/util/sudo_dso.c
+++ b/lib/util/sudo_dso.c
@@ -38,9 +38,9 @@
 #endif
 #include <errno.h>
 
-#include "sudo_compat.h"
-#include "sudo_dso.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_dso.h>
+#include <sudo_util.h>
 
 /*
  * Pointer for statically compiled symbols.
diff --git a/lib/util/sys_siglist.h b/lib/util/sys_siglist.h
index f2ed2b23c..561c00e0e 100644
--- a/lib/util/sys_siglist.h
+++ b/lib/util/sys_siglist.h
@@ -3,7 +3,7 @@
 #include <config.h>
 #include <sys/types.h>
 #include <signal.h>
-#include "sudo_compat.h"
+#include <sudo_compat.h>
 
 int sudo_end_of_headers;
 static char *sudo_sys_siglist[NSIG];
diff --git a/lib/util/sys_signame.h b/lib/util/sys_signame.h
index 3616df3e6..8c068299c 100644
--- a/lib/util/sys_signame.h
+++ b/lib/util/sys_signame.h
@@ -3,7 +3,7 @@
 #include <config.h>
 #include <sys/types.h>
 #include <signal.h>
-#include "sudo_compat.h"
+#include <sudo_compat.h>
 
 int sudo_end_of_headers;
 static char *sudo_sys_signame[NSIG];
diff --git a/lib/util/term.c b/lib/util/term.c
index 6e3bf98eb..6545d2647 100644
--- a/lib/util/term.c
+++ b/lib/util/term.c
@@ -32,9 +32,9 @@
 #include <termios.h>
 #include <unistd.h>
 
-#include "sudo_compat.h"
-#include "sudo_debug.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_debug.h>
+#include <sudo_util.h>
 
 /* TCSASOFT is a BSD extension that ignores control flags and speed. */
 #ifndef TCSASOFT
diff --git a/lib/util/timegm.c b/lib/util/timegm.c
index 968d829f4..acb519078 100644
--- a/lib/util/timegm.c
+++ b/lib/util/timegm.c
@@ -28,8 +28,8 @@
 #include <stdio.h>
 #include <time.h>
 
-#include "sudo_compat.h"
-#include "sudo_debug.h"
+#include <sudo_compat.h>
+#include <sudo_debug.h>
 
 /*
  * Returns the offset from GMT in seconds (algorithm taken from sendmail).
diff --git a/lib/util/ttyname_dev.c b/lib/util/ttyname_dev.c
index f3be755d7..3236925cd 100644
--- a/lib/util/ttyname_dev.c
+++ b/lib/util/ttyname_dev.c
@@ -41,11 +41,11 @@
 #include <limits.h>
 #include <dirent.h>
 
-#include "pathnames.h"
-#include "sudo_compat.h"
-#include "sudo_debug.h"
-#include "sudo_conf.h"
-#include "sudo_util.h"
+#include <pathnames.h>
+#include <sudo_compat.h>
+#include <sudo_debug.h>
+#include <sudo_conf.h>
+#include <sudo_util.h>
 
 #if defined(HAVE_DEVNAME)
 /*
diff --git a/lib/util/ttysize.c b/lib/util/ttysize.c
index bbfe877ea..54085e7ac 100644
--- a/lib/util/ttysize.c
+++ b/lib/util/ttysize.c
@@ -29,9 +29,9 @@
 #include <termios.h>		/* for struct winsize on HP-UX */
 #include <limits.h>
 
-#include "sudo_compat.h"
-#include "sudo_debug.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_debug.h>
+#include <sudo_util.h>
 
 static int
 get_ttysize_ioctl(int fd, int *rowp, int *colp)
diff --git a/lib/util/unlinkat.c b/lib/util/unlinkat.c
index f1d590eb8..b62902ed1 100644
--- a/lib/util/unlinkat.c
+++ b/lib/util/unlinkat.c
@@ -26,7 +26,7 @@
 #include <fcntl.h>
 #include <unistd.h>
 
-#include "sudo_compat.h"
+#include <sudo_compat.h>
 
 #ifndef HAVE_UNLINKAT
 int
diff --git a/lib/util/utimens.c b/lib/util/utimens.c
index c6b8ee230..74d6c656c 100644
--- a/lib/util/utimens.c
+++ b/lib/util/utimens.c
@@ -33,8 +33,8 @@
 # include <utime.h>
 #endif
 
-#include "sudo_compat.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_util.h>
 
 #if !defined(HAVE_FUTIMES) && defined(HAVE_FUTIMESAT)
 # define futimes(_f, _tv)	futimesat(_f, NULL, _tv)
diff --git a/lib/util/uuid.c b/lib/util/uuid.c
index b32d29b7e..764c8db40 100644
--- a/lib/util/uuid.c
+++ b/lib/util/uuid.c
@@ -32,9 +32,9 @@
 #include <string.h>
 #include <arpa/inet.h>
 
-#include "sudo_compat.h"
-#include "sudo_util.h"
-#include "sudo_rand.h"
+#include <sudo_compat.h>
+#include <sudo_util.h>
+#include <sudo_rand.h>
 
 struct uuid {
     uint32_t time_low;
diff --git a/logsrvd/iolog_writer.c b/logsrvd/iolog_writer.c
index c1cebac4b..c9361ff56 100644
--- a/logsrvd/iolog_writer.c
+++ b/logsrvd/iolog_writer.c
@@ -35,7 +35,7 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif /* HAVE_STDBOOL_H */
 #include <stdio.h>
 #include <stdlib.h>
@@ -43,16 +43,16 @@
 #include <time.h>
 #include <unistd.h>
 
-#include "sudo_compat.h"
-#include "sudo_debug.h"
-#include "sudo_eventlog.h"
-#include "sudo_gettext.h"
-#include "sudo_iolog.h"
-#include "sudo_fatal.h"
-#include "sudo_queue.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_debug.h>
+#include <sudo_eventlog.h>
+#include <sudo_gettext.h>
+#include <sudo_iolog.h>
+#include <sudo_fatal.h>
+#include <sudo_queue.h>
+#include <sudo_util.h>
 
-#include "logsrvd.h"
+#include <logsrvd.h>
 
 static bool
 type_matches(InfoMessage *info, const char *source,
diff --git a/logsrvd/logsrv_util.c b/logsrvd/logsrv_util.c
index 0c4aa7e62..fd972f6ac 100644
--- a/logsrvd/logsrv_util.c
+++ b/logsrvd/logsrv_util.c
@@ -29,7 +29,7 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif /* HAVE_STDBOOL_H */
 #if defined(HAVE_STDINT_H)
 # include <stdint.h>
@@ -42,12 +42,12 @@
 #include <time.h>
 #include <unistd.h>
 
-#include "sudo_compat.h"
-#include "sudo_debug.h"
-#include "sudo_fatal.h"
-#include "sudo_gettext.h"
-#include "sudo_iolog.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_debug.h>
+#include <sudo_fatal.h>
+#include <sudo_gettext.h>
+#include <sudo_iolog.h>
+#include <sudo_util.h>
 
 #include "logsrv_util.h"
 
diff --git a/logsrvd/logsrvd.c b/logsrvd/logsrvd.c
index 7f07bf35e..c3296382a 100644
--- a/logsrvd/logsrvd.c
+++ b/logsrvd/logsrvd.c
@@ -36,7 +36,7 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif /* HAVE_STDBOOL_H */
 #if defined(HAVE_STDINT_H)
 # include <stdint.h>
@@ -51,27 +51,27 @@
 #ifdef HAVE_GETOPT_LONG
 # include <getopt.h>
 # else
-# include "compat/getopt.h"
+# include <compat/getopt.h>
 #endif /* HAVE_GETOPT_LONG */
 
 #define NEED_INET_NTOP		/* to expose sudo_inet_ntop in sudo_compat.h */
 
-#include "pathnames.h"
-#include "sudo_compat.h"
-#include "sudo_conf.h"
-#include "sudo_debug.h"
-#include "sudo_event.h"
-#include "sudo_eventlog.h"
-#include "sudo_fatal.h"
-#include "sudo_gettext.h"
-#include "sudo_json.h"
-#include "sudo_iolog.h"
-#include "sudo_queue.h"
-#include "sudo_rand.h"
-#include "sudo_util.h"
+#include <pathnames.h>
+#include <sudo_compat.h>
+#include <sudo_conf.h>
+#include <sudo_debug.h>
+#include <sudo_event.h>
+#include <sudo_eventlog.h>
+#include <sudo_fatal.h>
+#include <sudo_gettext.h>
+#include <sudo_json.h>
+#include <sudo_iolog.h>
+#include <sudo_queue.h>
+#include <sudo_rand.h>
+#include <sudo_util.h>
 
-#include "logsrvd.h"
-#include "hostcheck.h"
+#include <logsrvd.h>
+#include <hostcheck.h>
 
 #ifndef O_NOFOLLOW
 # define O_NOFOLLOW 0
diff --git a/logsrvd/logsrvd.h b/logsrvd/logsrvd.h
index 4d371f31f..ec4f6ba1a 100644
--- a/logsrvd/logsrvd.h
+++ b/logsrvd/logsrvd.h
@@ -19,7 +19,7 @@
 #ifndef SUDO_LOGSRVD_H
 #define SUDO_LOGSRVD_H
 
-#include "log_server.pb-c.h"
+#include <log_server.pb-c.h>
 #if PROTOBUF_C_VERSION_NUMBER < 1003000
 # error protobuf-c version 1.30 or higher required
 #endif
@@ -35,7 +35,7 @@
 #endif
 
 #include "logsrv_util.h"
-#include "tls_common.h"
+#include <tls_common.h>
 
 /* Default timeout value for server socket */
 #define DEFAULT_SOCKET_TIMEOUT_SEC 30
diff --git a/logsrvd/logsrvd_conf.c b/logsrvd/logsrvd_conf.c
index d528027f3..9a28c33f2 100644
--- a/logsrvd/logsrvd_conf.c
+++ b/logsrvd/logsrvd_conf.c
@@ -36,7 +36,7 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif
 #include <stddef.h>
 #include <stdio.h>
@@ -48,19 +48,19 @@
 #include <grp.h>
 #include <pwd.h>
 #ifndef HAVE_GETADDRINFO
-# include "compat/getaddrinfo.h"
+# include <compat/getaddrinfo.h>
 #endif
 
-#include "pathnames.h"
-#include "sudo_compat.h"
-#include "sudo_debug.h"
-#include "sudo_eventlog.h"
-#include "sudo_fatal.h"
-#include "sudo_gettext.h"
-#include "sudo_iolog.h"
-#include "sudo_util.h"
+#include <pathnames.h>
+#include <sudo_compat.h>
+#include <sudo_debug.h>
+#include <sudo_eventlog.h>
+#include <sudo_fatal.h>
+#include <sudo_gettext.h>
+#include <sudo_iolog.h>
+#include <sudo_util.h>
 
-#include "logsrvd.h"
+#include <logsrvd.h>
 
 #if defined(HAVE_OPENSSL)
 # define DEFAULT_CA_CERT_PATH       "/etc/ssl/sudo/cacert.pem"
diff --git a/logsrvd/logsrvd_journal.c b/logsrvd/logsrvd_journal.c
index a29cd5dc3..bb5301d5a 100644
--- a/logsrvd/logsrvd_journal.c
+++ b/logsrvd/logsrvd_journal.c
@@ -36,7 +36,7 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif /* HAVE_STDBOOL_H */
 #if defined(HAVE_STDINT_H)
 # include <stdint.h>
@@ -49,17 +49,17 @@
 #include <time.h>
 #include <unistd.h>
 
-#include "sudo_compat.h"
-#include "sudo_conf.h"
-#include "sudo_debug.h"
-#include "sudo_event.h"
-#include "sudo_eventlog.h"
-#include "sudo_fatal.h"
-#include "sudo_gettext.h"
-#include "sudo_iolog.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_conf.h>
+#include <sudo_debug.h>
+#include <sudo_event.h>
+#include <sudo_eventlog.h>
+#include <sudo_fatal.h>
+#include <sudo_gettext.h>
+#include <sudo_iolog.h>
+#include <sudo_util.h>
 
-#include "logsrvd.h"
+#include <logsrvd.h>
 
 /*
  * Helper function to set closure->journal and closure->journal_path.
diff --git a/logsrvd/logsrvd_local.c b/logsrvd/logsrvd_local.c
index 4d328ef8f..821f6129b 100644
--- a/logsrvd/logsrvd_local.c
+++ b/logsrvd/logsrvd_local.c
@@ -37,7 +37,7 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif /* HAVE_STDBOOL_H */
 #if defined(HAVE_STDINT_H)
 # include <stdint.h>
@@ -50,19 +50,19 @@
 #include <time.h>
 #include <unistd.h>
 
-#include "sudo_compat.h"
-#include "sudo_conf.h"
-#include "sudo_debug.h"
-#include "sudo_event.h"
-#include "sudo_eventlog.h"
-#include "sudo_fatal.h"
-#include "sudo_gettext.h"
-#include "sudo_json.h"
-#include "sudo_iolog.h"
-#include "sudo_rand.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_conf.h>
+#include <sudo_debug.h>
+#include <sudo_event.h>
+#include <sudo_eventlog.h>
+#include <sudo_fatal.h>
+#include <sudo_gettext.h>
+#include <sudo_json.h>
+#include <sudo_iolog.h>
+#include <sudo_rand.h>
+#include <sudo_util.h>
 
-#include "logsrvd.h"
+#include <logsrvd.h>
 
 struct logsrvd_info_closure {
     InfoMessage **info_msgs;
diff --git a/logsrvd/logsrvd_queue.c b/logsrvd/logsrvd_queue.c
index 4152d7a30..cf4865638 100644
--- a/logsrvd/logsrvd_queue.c
+++ b/logsrvd/logsrvd_queue.c
@@ -36,7 +36,7 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif /* HAVE_STDBOOL_H */
 #if defined(HAVE_STDINT_H)
 # include <stdint.h>
@@ -50,18 +50,18 @@
 #include <time.h>
 #include <unistd.h>
 
-#include "sudo_compat.h"
-#include "sudo_conf.h"
-#include "sudo_debug.h"
-#include "sudo_event.h"
-#include "sudo_eventlog.h"
-#include "sudo_fatal.h"
-#include "sudo_gettext.h"
-#include "sudo_iolog.h"
-#include "sudo_queue.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_conf.h>
+#include <sudo_debug.h>
+#include <sudo_event.h>
+#include <sudo_eventlog.h>
+#include <sudo_fatal.h>
+#include <sudo_gettext.h>
+#include <sudo_iolog.h>
+#include <sudo_queue.h>
+#include <sudo_util.h>
 
-#include "logsrvd.h"
+#include <logsrvd.h>
 
 #if defined(HAVE_STRUCT_DIRENT_D_NAMLEN) && HAVE_STRUCT_DIRENT_D_NAMLEN
 # define NAMLEN(dirent) (dirent)->d_namlen
diff --git a/logsrvd/logsrvd_relay.c b/logsrvd/logsrvd_relay.c
index 3cd8f7ba4..5ee01b174 100644
--- a/logsrvd/logsrvd_relay.c
+++ b/logsrvd/logsrvd_relay.c
@@ -36,7 +36,7 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif /* HAVE_STDBOOL_H */
 #if defined(HAVE_STDINT_H)
 # include <stdint.h>
@@ -51,17 +51,17 @@
 
 #define NEED_INET_NTOP		/* to expose sudo_inet_ntop in sudo_compat.h */
 
-#include "sudo_compat.h"
-#include "sudo_debug.h"
-#include "sudo_event.h"
-#include "sudo_eventlog.h"
-#include "sudo_gettext.h"
-#include "sudo_iolog.h"
-#include "sudo_fatal.h"
-#include "sudo_queue.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_debug.h>
+#include <sudo_event.h>
+#include <sudo_eventlog.h>
+#include <sudo_gettext.h>
+#include <sudo_iolog.h>
+#include <sudo_fatal.h>
+#include <sudo_queue.h>
+#include <sudo_util.h>
 
-#include "logsrvd.h"
+#include <logsrvd.h>
 
 static void relay_client_msg_cb(int fd, int what, void *v);
 static void relay_server_msg_cb(int fd, int what, void *v);
diff --git a/logsrvd/regress/fuzz/fuzz_logsrvd_conf.c b/logsrvd/regress/fuzz/fuzz_logsrvd_conf.c
index 958661f5d..dc012bea0 100644
--- a/logsrvd/regress/fuzz/fuzz_logsrvd_conf.c
+++ b/logsrvd/regress/fuzz/fuzz_logsrvd_conf.c
@@ -36,16 +36,16 @@
 # include <inttypes.h>
 #endif
 
-#include "sudo_compat.h"
-#include "sudo_conf.h"
-#include "sudo_debug.h"
-#include "sudo_eventlog.h"
-#include "sudo_fatal.h"
-#include "sudo_iolog.h"
-#include "sudo_plugin.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_conf.h>
+#include <sudo_debug.h>
+#include <sudo_eventlog.h>
+#include <sudo_fatal.h>
+#include <sudo_iolog.h>
+#include <sudo_plugin.h>
+#include <sudo_util.h>
 
-#include "logsrvd.h"
+#include <logsrvd.h>
 
 int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size);
 
diff --git a/logsrvd/regress/logsrvd_conf/logsrvd_conf_test.c b/logsrvd/regress/logsrvd_conf/logsrvd_conf_test.c
index be13abac8..cf286bd39 100644
--- a/logsrvd/regress/logsrvd_conf/logsrvd_conf_test.c
+++ b/logsrvd/regress/logsrvd_conf/logsrvd_conf_test.c
@@ -23,18 +23,18 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif /* HAVE_STDBOOL_H */
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <unistd.h>
 
-#include "sudo_compat.h"
-#include "sudo_util.h"
-#include "sudo_iolog.h"
-#include "sudo_queue.h"
-#include "logsrvd.h"
+#include <sudo_compat.h>
+#include <sudo_util.h>
+#include <sudo_iolog.h>
+#include <sudo_queue.h>
+#include <logsrvd.h>
 
 sudo_dso_public int main(int argc, char *argv[]);
 
diff --git a/logsrvd/sendlog.c b/logsrvd/sendlog.c
index 9719bf82c..f05998fb6 100644
--- a/logsrvd/sendlog.c
+++ b/logsrvd/sendlog.c
@@ -38,7 +38,7 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif /* HAVE_STDBOOL_H */
 #if defined(HAVE_STDINT_H)
 # include <stdint.h>
@@ -51,26 +51,26 @@
 #include <time.h>
 #include <unistd.h>
 #ifndef HAVE_GETADDRINFO
-# include "compat/getaddrinfo.h"
+# include <compat/getaddrinfo.h>
 #endif
 #ifdef HAVE_GETOPT_LONG
 # include <getopt.h>
 # else
-# include "compat/getopt.h"
+# include <compat/getopt.h>
 #endif /* HAVE_GETOPT_LONG */
 
-#include "sudo_compat.h"
-#include "sudo_conf.h"
-#include "sudo_debug.h"
-#include "sudo_event.h"
-#include "sudo_eventlog.h"
-#include "sudo_fatal.h"
-#include "sudo_gettext.h"
-#include "sudo_iolog.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_conf.h>
+#include <sudo_debug.h>
+#include <sudo_event.h>
+#include <sudo_eventlog.h>
+#include <sudo_fatal.h>
+#include <sudo_gettext.h>
+#include <sudo_iolog.h>
+#include <sudo_util.h>
 
 #include "sendlog.h"
-#include "hostcheck.h"
+#include <hostcheck.h>
 
 #if defined(HAVE_OPENSSL)
 # define TLS_HANDSHAKE_TIMEO_SEC 10
diff --git a/logsrvd/sendlog.h b/logsrvd/sendlog.h
index 74014efd9..ba40b3bf9 100644
--- a/logsrvd/sendlog.h
+++ b/logsrvd/sendlog.h
@@ -19,7 +19,7 @@
 #ifndef SUDO_SENDLOG_H
 #define SUDO_SENDLOG_H
 
-#include "log_server.pb-c.h"
+#include <log_server.pb-c.h>
 #if PROTOBUF_C_VERSION_NUMBER < 1003000
 # error protobuf-c version 1.30 or higher required
 #endif
@@ -35,7 +35,7 @@
 #endif
 
 #include "logsrv_util.h"
-#include "tls_common.h"
+#include <tls_common.h>
 
 enum client_state {
     ERROR,
diff --git a/logsrvd/tls_client.c b/logsrvd/tls_client.c
index dde6a6009..0cb0aa20b 100644
--- a/logsrvd/tls_client.c
+++ b/logsrvd/tls_client.c
@@ -27,7 +27,7 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif /* HAVE_STDBOOL_H */
 #if defined(HAVE_STDINT_H)
 # include <stdint.h>
@@ -39,16 +39,16 @@
 #include <string.h>
 #include <time.h>
 
-#include "sudo_compat.h"
-#include "sudo_debug.h"
-#include "sudo_event.h"
-#include "sudo_fatal.h"
-#include "sudo_gettext.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_debug.h>
+#include <sudo_event.h>
+#include <sudo_fatal.h>
+#include <sudo_gettext.h>
+#include <sudo_util.h>
 
 #include "logsrv_util.h"
-#include "tls_common.h"
-#include "hostcheck.h"
+#include <tls_common.h>
+#include <hostcheck.h>
 
 #if defined(HAVE_OPENSSL)
 
diff --git a/logsrvd/tls_common.h b/logsrvd/tls_common.h
index 61fbe1027..222211818 100644
--- a/logsrvd/tls_common.h
+++ b/logsrvd/tls_common.h
@@ -27,7 +27,7 @@
 # endif
 # include <openssl/ssl.h>
 # include <openssl/err.h>
-# include "sudo_ssl_compat.h"
+# include <sudo_ssl_compat.h>
 
 struct tls_client_closure {
     SSL *ssl;
diff --git a/logsrvd/tls_init.c b/logsrvd/tls_init.c
index 65cc8daa2..c8c623eb2 100644
--- a/logsrvd/tls_init.c
+++ b/logsrvd/tls_init.c
@@ -26,7 +26,7 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif /* HAVE_STDBOOL_H */
 #if defined(HAVE_STDINT_H)
 # include <stdint.h>
@@ -39,14 +39,14 @@
 #include <fcntl.h>
 #include <unistd.h>
 
-#include "sudo_compat.h"
-#include "sudo_debug.h"
-#include "sudo_event.h"
-#include "sudo_fatal.h"
-#include "sudo_gettext.h"
+#include <sudo_compat.h>
+#include <sudo_debug.h>
+#include <sudo_event.h>
+#include <sudo_fatal.h>
+#include <sudo_gettext.h>
 
-#include "tls_common.h"
-#include "hostcheck.h"
+#include <tls_common.h>
+#include <hostcheck.h>
 
 #define DEFAULT_CIPHER_LST12 "HIGH:!aNULL"
 #define DEFAULT_CIPHER_LST13 "TLS_AES_256_GCM_SHA384"
diff --git a/plugins/audit_json/audit_json.c b/plugins/audit_json/audit_json.c
index 182a17fe5..c19c29be2 100644
--- a/plugins/audit_json/audit_json.c
+++ b/plugins/audit_json/audit_json.c
@@ -31,7 +31,7 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif /* HAVE_STDBOOL_H */
 #include <string.h>
 #include <signal.h>
@@ -40,16 +40,16 @@
 #include <limits.h>
 #include <time.h>
 
-#include "pathnames.h"
-#include "sudo_compat.h"
-#include "sudo_conf.h"
-#include "sudo_debug.h"
-#include "sudo_dso.h"
-#include "sudo_fatal.h"
-#include "sudo_gettext.h"
-#include "sudo_json.h"
-#include "sudo_plugin.h"
-#include "sudo_util.h"
+#include <pathnames.h>
+#include <sudo_compat.h>
+#include <sudo_conf.h>
+#include <sudo_debug.h>
+#include <sudo_dso.h>
+#include <sudo_fatal.h>
+#include <sudo_gettext.h>
+#include <sudo_json.h>
+#include <sudo_plugin.h>
+#include <sudo_util.h>
 
 static int audit_debug_instance = SUDO_DEBUG_INSTANCE_INITIALIZER;
 static sudo_conv_t audit_conv;
diff --git a/plugins/group_file/getgrent.c b/plugins/group_file/getgrent.c
index f37fb0ec2..031aed5c2 100644
--- a/plugins/group_file/getgrent.c
+++ b/plugins/group_file/getgrent.c
@@ -34,8 +34,8 @@
 #include <limits.h>
 #include <grp.h>
 
-#include "sudo_compat.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_util.h>
 
 #undef GRMEM_MAX
 #define GRMEM_MAX 200
diff --git a/plugins/group_file/group_file.c b/plugins/group_file/group_file.c
index 7c9a25d3e..de9a49104 100644
--- a/plugins/group_file/group_file.c
+++ b/plugins/group_file/group_file.c
@@ -30,7 +30,7 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif /* HAVE_STDBOOL_H */
 #include <string.h>
 #ifdef HAVE_STRINGS_H
@@ -41,8 +41,8 @@
 #include <fcntl.h>
 #include <grp.h>
 
-#include "sudo_plugin.h"
-#include "sudo_compat.h"
+#include <sudo_plugin.h>
+#include <sudo_compat.h>
 
 /*
  * Sample sudoers group plugin that uses an extra group file with the
diff --git a/plugins/group_file/plugin_test.c b/plugins/group_file/plugin_test.c
index 7670ac77b..cb1ef636e 100644
--- a/plugins/group_file/plugin_test.c
+++ b/plugins/group_file/plugin_test.c
@@ -32,7 +32,7 @@
 #include <string.h>
 #include <unistd.h>
 
-#include "sudo_plugin.h"
+#include <sudo_plugin.h>
 
 sudo_dso_public int main(int argc, char *argv[]);
 
diff --git a/plugins/python/pyhelpers.c b/plugins/python/pyhelpers.c
index 9487a0102..79e6c9372 100644
--- a/plugins/python/pyhelpers.c
+++ b/plugins/python/pyhelpers.c
@@ -25,7 +25,7 @@
 
 #include <pwd.h>
 #include <signal.h>
-#include "pathnames.h"
+#include <pathnames.h>
 
 static int
 _sudo_printf_default(int msg_type, const char * restrict fmt, ...)
diff --git a/plugins/python/pyhelpers.h b/plugins/python/pyhelpers.h
index ef0289b87..2493cc7eb 100644
--- a/plugins/python/pyhelpers.h
+++ b/plugins/python/pyhelpers.h
@@ -26,8 +26,8 @@
 #undef SIZEOF_TIME_T
 
 #include <config.h>
-#include "sudo_compat.h"
-#include "sudo_plugin.h"
+#include <sudo_compat.h>
+#include <sudo_plugin.h>
 
 #include "pyhelpers_cpychecker.h"
 
diff --git a/plugins/python/python_plugin_common.c b/plugins/python/python_plugin_common.c
index 961d7f836..6afceacb5 100644
--- a/plugins/python/python_plugin_common.c
+++ b/plugins/python/python_plugin_common.c
@@ -24,8 +24,8 @@
 #include "python_plugin_common.h"
 #include "sudo_python_module.h"
 
-#include "sudo_queue.h"
-#include "sudo_conf.h"
+#include <sudo_queue.h>
+#include <sudo_conf.h>
 
 #include <limits.h>
 #include <string.h>
diff --git a/plugins/python/regress/check_python_examples.c b/plugins/python/regress/check_python_examples.c
index a59b78fef..3143d82ce 100644
--- a/plugins/python/regress/check_python_examples.c
+++ b/plugins/python/regress/check_python_examples.c
@@ -24,7 +24,7 @@
 #include "testhelpers.h"
 #include <unistd.h>
 
-#include "sudo_dso.h"
+#include <sudo_dso.h>
 
 #define DECL_PLUGIN(type, variable_name) \
     static struct type *variable_name = NULL; \
diff --git a/plugins/python/regress/iohelpers.h b/plugins/python/regress/iohelpers.h
index 42b32e102..b0fc5ab0e 100644
--- a/plugins/python/regress/iohelpers.h
+++ b/plugins/python/regress/iohelpers.h
@@ -26,14 +26,14 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif /* HAVE_STDBOOL_H */
 #include <string.h>
 #include <stdarg.h>
 #include <signal.h>
 #include <pwd.h>
 
-#include "sudo_compat.h"
+#include <sudo_compat.h>
 
 #define MAX_OUTPUT (2 << 16)
 
diff --git a/plugins/python/regress/testhelpers.h b/plugins/python/regress/testhelpers.h
index 70ec33b43..8f78d9fb5 100644
--- a/plugins/python/regress/testhelpers.h
+++ b/plugins/python/regress/testhelpers.h
@@ -23,7 +23,7 @@
 
 #include "../pyhelpers.h"
 
-#include "sudo_conf.h"
+#include <sudo_conf.h>
 
 // just for the IDE
 #ifndef SRC_DIR
diff --git a/plugins/python/sudo_python_debug.c b/plugins/python/sudo_python_debug.c
index 3ba79bfca..e036282bc 100644
--- a/plugins/python/sudo_python_debug.c
+++ b/plugins/python/sudo_python_debug.c
@@ -27,12 +27,12 @@
 #include <ctype.h>
 #include <stdlib.h>
 
-#include "sudo_gettext.h"
-#include "sudo_compat.h"
+#include <sudo_gettext.h>
+#include <sudo_compat.h>
 #include "sudo_python_debug.h"
-#include "sudo_queue.h"
-#include "sudo_conf.h"
-#include "sudo_fatal.h"
+#include <sudo_queue.h>
+#include <sudo_conf.h>
+#include <sudo_fatal.h>
 
 
 static int python_debug_instance = SUDO_DEBUG_INSTANCE_INITIALIZER;
diff --git a/plugins/python/sudo_python_debug.h b/plugins/python/sudo_python_debug.h
index 08c4f29ff..dcd024d11 100644
--- a/plugins/python/sudo_python_debug.h
+++ b/plugins/python/sudo_python_debug.h
@@ -19,7 +19,7 @@
 #ifndef SUDO_PYTHON_DEBUG_H
 #define SUDO_PYTHON_DEBUG_H
 
-#include "sudo_debug.h"
+#include <sudo_debug.h>
 
 /*
  * Sudo python plugin debug subsystems.
diff --git a/plugins/sample/sample_plugin.c b/plugins/sample/sample_plugin.c
index 0e68e9662..a52920819 100644
--- a/plugins/sample/sample_plugin.c
+++ b/plugins/sample/sample_plugin.c
@@ -32,7 +32,7 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif /* HAVE_STDBOOL_H */
 #include <string.h>
 #ifdef HAVE_STRINGS_H
@@ -45,10 +45,10 @@
 #include <grp.h>
 #include <pwd.h>
 
-#include "pathnames.h"
-#include "sudo_compat.h"
-#include "sudo_plugin.h"
-#include "sudo_util.h"
+#include <pathnames.h>
+#include <sudo_compat.h>
+#include <sudo_plugin.h>
+#include <sudo_util.h>
 
 /*
  * Sample plugin module that allows any user who knows the password
diff --git a/plugins/sample_approval/sample_approval.c b/plugins/sample_approval/sample_approval.c
index 505f32c39..eb08f9ca9 100644
--- a/plugins/sample_approval/sample_approval.c
+++ b/plugins/sample_approval/sample_approval.c
@@ -28,19 +28,19 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif /* HAVE_STDBOOL_H */
 #include <string.h>
 #include <unistd.h>
 #include <time.h>
 
-#include "sudo_compat.h"
-#include "sudo_conf.h"
-#include "sudo_debug.h"
-#include "sudo_fatal.h"
-#include "sudo_gettext.h"
-#include "sudo_plugin.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_conf.h>
+#include <sudo_debug.h>
+#include <sudo_fatal.h>
+#include <sudo_gettext.h>
+#include <sudo_plugin.h>
+#include <sudo_util.h>
 
 static int approval_debug_instance = SUDO_DEBUG_INSTANCE_INITIALIZER;
 sudo_printf_t sudo_printf;
diff --git a/plugins/sudoers/alias.c b/plugins/sudoers/alias.c
index f7c728352..ab01d4d2b 100644
--- a/plugins/sudoers/alias.c
+++ b/plugins/sudoers/alias.c
@@ -34,8 +34,8 @@
 #include <string.h>
 #include <errno.h>
 
-#include "sudoers.h"
-#include "redblack.h"
+#include <sudoers.h>
+#include <redblack.h>
 #include <gram.h>
 
 /*
diff --git a/plugins/sudoers/audit.c b/plugins/sudoers/audit.c
index b14051403..85d4c30a9 100644
--- a/plugins/sudoers/audit.c
+++ b/plugins/sudoers/audit.c
@@ -29,19 +29,19 @@
 #include <stdlib.h>
 #include <string.h>
 
-#include "sudoers.h"
+#include <sudoers.h>
 #ifdef SUDOERS_LOG_CLIENT
-# include "log_client.h"
+# include <log_client.h>
 #endif
 
 #ifdef HAVE_BSM_AUDIT
-# include "bsm_audit.h"
+# include <bsm_audit.h>
 #endif
 #ifdef HAVE_LINUX_AUDIT
-# include "linux_audit.h"
+# include <linux_audit.h>
 #endif
 #ifdef HAVE_SOLARIS_AUDIT
-# include "solaris_audit.h"
+# include <solaris_audit.h>
 #endif
 
 #ifdef SUDOERS_LOG_CLIENT
diff --git a/plugins/sudoers/auth/afs.c b/plugins/sudoers/auth/afs.c
index 10a529153..7fae2071d 100644
--- a/plugins/sudoers/auth/afs.c
+++ b/plugins/sudoers/auth/afs.c
@@ -40,9 +40,9 @@
 #include <afs/stds.h>
 #include <afs/kautils.h>
 
-#include "sudoers.h"
+#include <sudoers.h>
 #include "sudo_auth.h"
-#include "timestamp.h"
+#include <timestamp.h>
 
 int
 sudo_afs_verify(const struct sudoers_context *ctx, struct passwd *pw,
diff --git a/plugins/sudoers/auth/aix_auth.c b/plugins/sudoers/auth/aix_auth.c
index 37ab3291a..74a3bc95b 100644
--- a/plugins/sudoers/auth/aix_auth.c
+++ b/plugins/sudoers/auth/aix_auth.c
@@ -41,7 +41,7 @@
 #include <signal.h>
 #include <usersec.h>
 
-#include "sudoers.h"
+#include <sudoers.h>
 #include "sudo_auth.h"
 
 /*
diff --git a/plugins/sudoers/auth/bsdauth.c b/plugins/sudoers/auth/bsdauth.c
index a4c18204f..d48148ca8 100644
--- a/plugins/sudoers/auth/bsdauth.c
+++ b/plugins/sudoers/auth/bsdauth.c
@@ -42,7 +42,7 @@
 #include <login_cap.h>
 #include <bsd_auth.h>
 
-#include "sudoers.h"
+#include <sudoers.h>
 #include "sudo_auth.h"
 
 # ifndef LOGIN_DEFROOTCLASS
diff --git a/plugins/sudoers/auth/dce.c b/plugins/sudoers/auth/dce.c
index 42d54a1e1..aa7c47b10 100644
--- a/plugins/sudoers/auth/dce.c
+++ b/plugins/sudoers/auth/dce.c
@@ -52,9 +52,9 @@
 #include <dce/sec_login.h>
 #include <dce/dce_error.h> /* required to call dce_error_inq_text routine */
 
-#include "sudoers.h"
+#include <sudoers.h>
 #include "sudo_auth.h"
-#include "timestamp.h"
+#include <timestamp.h>
 
 static int check_dce_status(error_status_t, char *);
 
diff --git a/plugins/sudoers/auth/fwtk.c b/plugins/sudoers/auth/fwtk.c
index 466810f97..ae62c97b2 100644
--- a/plugins/sudoers/auth/fwtk.c
+++ b/plugins/sudoers/auth/fwtk.c
@@ -40,7 +40,7 @@
 #include <auth.h>
 #include <firewall.h>
 
-#include "sudoers.h"
+#include <sudoers.h>
 #include "sudo_auth.h"
 
 int
diff --git a/plugins/sudoers/auth/kerb5.c b/plugins/sudoers/auth/kerb5.c
index b51c03bd1..ce134df87 100644
--- a/plugins/sudoers/auth/kerb5.c
+++ b/plugins/sudoers/auth/kerb5.c
@@ -41,7 +41,7 @@
 #include <com_err.h>
 #endif
 
-#include "sudoers.h"
+#include <sudoers.h>
 #include "sudo_auth.h"
 
 #ifdef HAVE_HEIMDAL
diff --git a/plugins/sudoers/auth/pam.c b/plugins/sudoers/auth/pam.c
index 8a17f0d30..e8d17856a 100644
--- a/plugins/sudoers/auth/pam.c
+++ b/plugins/sudoers/auth/pam.c
@@ -60,7 +60,7 @@
 # define dgt(d, t)	dgettext(d, t)
 #endif
 
-#include "sudoers.h"
+#include <sudoers.h>
 #include "sudo_auth.h"
 
 /* Only OpenPAM and Linux PAM use const qualifiers. */
diff --git a/plugins/sudoers/auth/passwd.c b/plugins/sudoers/auth/passwd.c
index df12805f8..0b1fcdef1 100644
--- a/plugins/sudoers/auth/passwd.c
+++ b/plugins/sudoers/auth/passwd.c
@@ -34,7 +34,7 @@
 #include <unistd.h>
 #include <pwd.h>
 
-#include "sudoers.h"
+#include <sudoers.h>
 #include "sudo_auth.h"
 
 #define DESLEN			13
diff --git a/plugins/sudoers/auth/rfc1938.c b/plugins/sudoers/auth/rfc1938.c
index 15219a775..bde9e33d1 100644
--- a/plugins/sudoers/auth/rfc1938.c
+++ b/plugins/sudoers/auth/rfc1938.c
@@ -53,7 +53,7 @@
 # define rfc1938verify(a,b)		opieverify((a),(b))
 #endif
 
-#include "sudoers.h"
+#include <sudoers.h>
 #include "sudo_auth.h"
 
 int
diff --git a/plugins/sudoers/auth/secureware.c b/plugins/sudoers/auth/secureware.c
index 88aedd9bc..a193e5561 100644
--- a/plugins/sudoers/auth/secureware.c
+++ b/plugins/sudoers/auth/secureware.c
@@ -43,7 +43,7 @@
 #endif /* __hpux */
 #include <prot.h>
 
-#include "sudoers.h"
+#include <sudoers.h>
 #include "sudo_auth.h"
 
 #ifdef __alpha
diff --git a/plugins/sudoers/auth/securid5.c b/plugins/sudoers/auth/securid5.c
index 38e5ffe0b..6d3c636bb 100644
--- a/plugins/sudoers/auth/securid5.c
+++ b/plugins/sudoers/auth/securid5.c
@@ -43,7 +43,7 @@
 #include <acexport.h>
 #include <sdacmvls.h>
 
-#include "sudoers.h"
+#include <sudoers.h>
 #include "sudo_auth.h"
 
 /*
diff --git a/plugins/sudoers/auth/sia.c b/plugins/sudoers/auth/sia.c
index 575198acb..924ca7387 100644
--- a/plugins/sudoers/auth/sia.c
+++ b/plugins/sudoers/auth/sia.c
@@ -39,7 +39,7 @@
 #include <signal.h>
 #include <siad.h>
 
-#include "sudoers.h"
+#include <sudoers.h>
 #include "sudo_auth.h"
 
 static int sudo_argc;
diff --git a/plugins/sudoers/auth/sudo_auth.c b/plugins/sudoers/auth/sudo_auth.c
index ade94cb35..b74ab347c 100644
--- a/plugins/sudoers/auth/sudo_auth.c
+++ b/plugins/sudoers/auth/sudo_auth.c
@@ -41,10 +41,10 @@
 #include <time.h>
 #include <signal.h>
 
-#include "sudoers.h"
+#include <sudoers.h>
 #include "sudo_auth.h"
-#include "insults.h"
-#include "timestamp.h"
+#include <insults.h>
+#include <timestamp.h>
 
 static sudo_auth auth_switch[] = {
 /* Standalone entries first */
diff --git a/plugins/sudoers/b64_decode.c b/plugins/sudoers/b64_decode.c
index 736df2827..624288873 100644
--- a/plugins/sudoers/b64_decode.c
+++ b/plugins/sudoers/b64_decode.c
@@ -23,7 +23,7 @@
 
 #include <config.h>
 
-#include "sudoers.h"
+#include <sudoers.h>
 
 /*
  * Derived from code with the following declaration:
diff --git a/plugins/sudoers/b64_encode.c b/plugins/sudoers/b64_encode.c
index 7f95f5859..1e1afa0db 100644
--- a/plugins/sudoers/b64_encode.c
+++ b/plugins/sudoers/b64_encode.c
@@ -23,7 +23,7 @@
 
 #include <config.h>
 
-#include "sudoers.h"
+#include <sudoers.h>
 
 static const unsigned char base64enc_tab[64] =
     "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
diff --git a/plugins/sudoers/boottime.c b/plugins/sudoers/boottime.c
index 883173c13..5e7ce5f25 100644
--- a/plugins/sudoers/boottime.c
+++ b/plugins/sudoers/boottime.c
@@ -42,7 +42,7 @@
 # endif
 #endif /* !__linux__ */
 
-#include "sudoers.h"
+#include <sudoers.h>
 
 /*
  * Fill in a struct timespec with the time the system booted.
diff --git a/plugins/sudoers/bsm_audit.c b/plugins/sudoers/bsm_audit.c
index 633542bbf..95bd2d174 100644
--- a/plugins/sudoers/bsm_audit.c
+++ b/plugins/sudoers/bsm_audit.c
@@ -37,8 +37,8 @@
 #include <errno.h>
 #include <unistd.h>
 
-#include "sudoers.h"
-#include "bsm_audit.h"
+#include <sudoers.h>
+#include <bsm_audit.h>
 
 /*
  * Solaris auditon() returns EINVAL if BSM audit not configured.
diff --git a/plugins/sudoers/canon_path.c b/plugins/sudoers/canon_path.c
index 3a322a82d..79f8eef12 100644
--- a/plugins/sudoers/canon_path.c
+++ b/plugins/sudoers/canon_path.c
@@ -31,8 +31,8 @@
 #include <unistd.h>
 #include <errno.h>
 
-#include "sudoers.h"
-#include "redblack.h"
+#include <sudoers.h>
+#include <redblack.h>
 
 static struct rbtree *canon_cache;
 
diff --git a/plugins/sudoers/check.c b/plugins/sudoers/check.c
index 45351c42d..4356dd185 100644
--- a/plugins/sudoers/check.c
+++ b/plugins/sudoers/check.c
@@ -39,8 +39,8 @@
 #include <pwd.h>
 #include <grp.h>
 
-#include "sudoers.h"
-#include "timestamp.h"
+#include <sudoers.h>
+#include <timestamp.h>
 
 /*
  * Get passwd entry for the user we are going to authenticate as.
diff --git a/plugins/sudoers/check_aliases.c b/plugins/sudoers/check_aliases.c
index 86c4fdd91..871969890 100644
--- a/plugins/sudoers/check_aliases.c
+++ b/plugins/sudoers/check_aliases.c
@@ -29,7 +29,7 @@
 #include <string.h>
 #include <errno.h>
 
-#include "sudoers.h"
+#include <sudoers.h>
 #include <gram.h>
 
 struct alias_warned {
diff --git a/plugins/sudoers/check_util.c b/plugins/sudoers/check_util.c
index 54d397d7a..a67606935 100644
--- a/plugins/sudoers/check_util.c
+++ b/plugins/sudoers/check_util.c
@@ -29,7 +29,7 @@
 #include <unistd.h>
 #include <pwd.h>
 
-#include "sudoers.h"
+#include <sudoers.h>
 
 /*
  * Check whether specified runchroot matches def_runchroot.
diff --git a/plugins/sudoers/cvtsudoers.c b/plugins/sudoers/cvtsudoers.c
index 93700ed82..e1db214bc 100644
--- a/plugins/sudoers/cvtsudoers.c
+++ b/plugins/sudoers/cvtsudoers.c
@@ -41,16 +41,16 @@
 #ifdef HAVE_GETOPT_LONG
 # include <getopt.h>
 # else
-# include "compat/getopt.h"
+# include <compat/getopt.h>
 #endif /* HAVE_GETOPT_LONG */
 
-#include "sudoers.h"
-#include "sudoers_version.h"
-#include "sudo_lbuf.h"
-#include "redblack.h"
-#include "cvtsudoers.h"
-#include "testsudoers_pwutil.h"
-#include "tsgetgrpw.h"
+#include <sudoers.h>
+#include <sudoers_version.h>
+#include <sudo_lbuf.h>
+#include <redblack.h>
+#include <cvtsudoers.h>
+#include <testsudoers_pwutil.h>
+#include <tsgetgrpw.h>
 #include <gram.h>
 
 /* Long-only options values. */
diff --git a/plugins/sudoers/cvtsudoers.h b/plugins/sudoers/cvtsudoers.h
index 02c6bd236..09d0e9bf6 100644
--- a/plugins/sudoers/cvtsudoers.h
+++ b/plugins/sudoers/cvtsudoers.h
@@ -19,7 +19,7 @@
 #ifndef SUDOERS_CVTSUDOERS_H
 #define SUDOERS_CVTSUDOERS_H
 
-#include "strlist.h"
+#include <strlist.h>
 
 /* Supported input/output formats. */
 enum sudoers_formats {
diff --git a/plugins/sudoers/cvtsudoers_csv.c b/plugins/sudoers/cvtsudoers_csv.c
index 9312614c2..d5cb6a54a 100644
--- a/plugins/sudoers/cvtsudoers_csv.c
+++ b/plugins/sudoers/cvtsudoers_csv.c
@@ -32,8 +32,8 @@
 #include <unistd.h>
 #include <stdarg.h>
 
-#include "sudoers.h"
-#include "cvtsudoers.h"
+#include <sudoers.h>
+#include <cvtsudoers.h>
 #include <gram.h>
 
 static void print_member_list_csv(FILE *fp, const struct sudoers_parse_tree *parse_tree, struct member_list *members, bool negated, short alias_type, bool expand_aliases);
diff --git a/plugins/sudoers/cvtsudoers_json.c b/plugins/sudoers/cvtsudoers_json.c
index a78243f5c..3ff543dc1 100644
--- a/plugins/sudoers/cvtsudoers_json.c
+++ b/plugins/sudoers/cvtsudoers_json.c
@@ -30,9 +30,9 @@
 #include <stdarg.h>
 #include <ctype.h>
 
-#include "sudoers.h"
-#include "sudo_json.h"
-#include "cvtsudoers.h"
+#include <sudoers.h>
+#include <sudo_json.h>
+#include <cvtsudoers.h>
 #include <gram.h>
 
 /*
diff --git a/plugins/sudoers/cvtsudoers_ldif.c b/plugins/sudoers/cvtsudoers_ldif.c
index 3bc742d75..b967d471e 100644
--- a/plugins/sudoers/cvtsudoers_ldif.c
+++ b/plugins/sudoers/cvtsudoers_ldif.c
@@ -32,11 +32,11 @@
 #include <unistd.h>
 #include <stdarg.h>
 
-#include "sudoers.h"
-#include "sudo_ldap.h"
-#include "redblack.h"
-#include "cvtsudoers.h"
-#include "sudo_lbuf.h"
+#include <sudoers.h>
+#include <sudo_ldap.h>
+#include <redblack.h>
+#include <cvtsudoers.h>
+#include <sudo_lbuf.h>
 #include <gram.h>
 
 struct seen_user {
diff --git a/plugins/sudoers/cvtsudoers_merge.c b/plugins/sudoers/cvtsudoers_merge.c
index a64c7614d..d5e5b0876 100644
--- a/plugins/sudoers/cvtsudoers_merge.c
+++ b/plugins/sudoers/cvtsudoers_merge.c
@@ -31,9 +31,9 @@
 #include <ctype.h>
 #include <errno.h>
 
-#include "sudoers.h"
-#include "redblack.h"
-#include "cvtsudoers.h"
+#include <sudoers.h>
+#include <redblack.h>
+#include <cvtsudoers.h>
 #include <gram.h>
 
 static struct member *
diff --git a/plugins/sudoers/cvtsudoers_pwutil.c b/plugins/sudoers/cvtsudoers_pwutil.c
index 86c7e4366..2a0dc0504 100644
--- a/plugins/sudoers/cvtsudoers_pwutil.c
+++ b/plugins/sudoers/cvtsudoers_pwutil.c
@@ -41,9 +41,9 @@
 #include <pwd.h>
 #include <grp.h>
 
-#include "sudoers.h"
-#include "cvtsudoers.h"
-#include "pwutil.h"
+#include <sudoers.h>
+#include <cvtsudoers.h>
+#include <pwutil.h>
 
 #ifndef LOGIN_NAME_MAX
 # ifdef _POSIX_LOGIN_NAME_MAX
diff --git a/plugins/sudoers/defaults.c b/plugins/sudoers/defaults.c
index 555483749..3e7be0353 100644
--- a/plugins/sudoers/defaults.c
+++ b/plugins/sudoers/defaults.c
@@ -38,9 +38,9 @@
 #include <limits.h>
 #include <syslog.h>
 
-#include "sudoers.h"
-#include "sudo_eventlog.h"
-#include "sudo_iolog.h"
+#include <sudoers.h>
+#include <sudo_eventlog.h>
+#include <sudo_iolog.h>
 #include <gram.h>
 
 static struct early_default early_defaults[] = {
diff --git a/plugins/sudoers/defaults.h b/plugins/sudoers/defaults.h
index 0319eb5dd..9909024cc 100644
--- a/plugins/sudoers/defaults.h
+++ b/plugins/sudoers/defaults.h
@@ -26,7 +26,7 @@
 
 #include <time.h>
 #include <def_data.h>
-#include "sudo_queue.h"
+#include <sudo_queue.h>
 
 struct list_member {
     SLIST_ENTRY(list_member) entries;
diff --git a/plugins/sudoers/digestname.c b/plugins/sudoers/digestname.c
index f70b48fb1..94152205d 100644
--- a/plugins/sudoers/digestname.c
+++ b/plugins/sudoers/digestname.c
@@ -23,10 +23,10 @@
 
 #include <config.h>
 
-#include "sudo_compat.h"
-#include "sudo_digest.h"
-#include "sudoers_debug.h"
-#include "parse.h"
+#include <sudo_compat.h>
+#include <sudo_digest.h>
+#include <sudoers_debug.h>
+#include <parse.h>
 
 const char *
 digest_type_to_name(unsigned int digest_type)
diff --git a/plugins/sudoers/display.c b/plugins/sudoers/display.c
index 403598ee4..83b4e42df 100644
--- a/plugins/sudoers/display.c
+++ b/plugins/sudoers/display.c
@@ -31,8 +31,8 @@
 #include <ctype.h>
 #include <pwd.h>
 
-#include "sudoers.h"
-#include "sudo_lbuf.h"
+#include <sudoers.h>
+#include <sudo_lbuf.h>
 #include <gram.h>
 
 static int
diff --git a/plugins/sudoers/editor.c b/plugins/sudoers/editor.c
index ce69eb37f..db1e3e0a9 100644
--- a/plugins/sudoers/editor.c
+++ b/plugins/sudoers/editor.c
@@ -30,7 +30,7 @@
 #include <unistd.h>
 #include <errno.h>
 
-#include "sudoers.h"
+#include <sudoers.h>
 
 /*
  * Non-destructive word-split that handles single and double quotes and
diff --git a/plugins/sudoers/env.c b/plugins/sudoers/env.c
index ed0bece6b..e49d021fa 100644
--- a/plugins/sudoers/env.c
+++ b/plugins/sudoers/env.c
@@ -48,7 +48,7 @@
 #include <limits.h>
 #include <pwd.h>
 
-#include "sudoers.h"
+#include <sudoers.h>
 
 /*
  * Flags used in rebuild_env()
diff --git a/plugins/sudoers/env_pattern.c b/plugins/sudoers/env_pattern.c
index d1b9a1b24..502f56baf 100644
--- a/plugins/sudoers/env_pattern.c
+++ b/plugins/sudoers/env_pattern.c
@@ -27,7 +27,7 @@
 #include <stdlib.h>
 #include <string.h>
 
-#include "sudoers.h"
+#include <sudoers.h>
 
 /* extern for regress tests */
 bool
diff --git a/plugins/sudoers/exptilde.c b/plugins/sudoers/exptilde.c
index b6e8a602b..03de3da9a 100644
--- a/plugins/sudoers/exptilde.c
+++ b/plugins/sudoers/exptilde.c
@@ -29,8 +29,8 @@
 #include <grp.h>
 #include <pwd.h>
 
-#include "sudoers.h"
-#include "pwutil.h"
+#include <sudoers.h>
+#include <pwutil.h>
 
 /*
  * Expand leading tilde in *path, which must be dynamically allocated.
diff --git a/plugins/sudoers/file.c b/plugins/sudoers/file.c
index 4e18a7d14..651ece35c 100644
--- a/plugins/sudoers/file.c
+++ b/plugins/sudoers/file.c
@@ -26,8 +26,8 @@
 #include <stdio.h>
 #include <stdlib.h>
 
-#include "sudoers.h"
-#include "sudo_lbuf.h"
+#include <sudoers.h>
+#include <sudo_lbuf.h>
 #include <gram.h>
 
 struct sudo_file_handle {
diff --git a/plugins/sudoers/filedigest.c b/plugins/sudoers/filedigest.c
index 27f87211b..36cc49821 100644
--- a/plugins/sudoers/filedigest.c
+++ b/plugins/sudoers/filedigest.c
@@ -30,8 +30,8 @@
 #include <fcntl.h>
 #include <errno.h>
 
-#include "sudoers.h"
-#include "sudo_digest.h"
+#include <sudoers.h>
+#include <sudo_digest.h>
 
 unsigned char *
 sudo_filedigest(int fd, const char *file, unsigned int digest_type,
diff --git a/plugins/sudoers/find_path.c b/plugins/sudoers/find_path.c
index 94f9f8692..9b9661538 100644
--- a/plugins/sudoers/find_path.c
+++ b/plugins/sudoers/find_path.c
@@ -35,7 +35,7 @@
 #include <unistd.h>
 #include <errno.h>
 
-#include "sudoers.h"
+#include <sudoers.h>
 
 /*
  * Check the given command against the specified allowlist (NULL-terminated).
diff --git a/plugins/sudoers/fmtsudoers.c b/plugins/sudoers/fmtsudoers.c
index 1b4b7c5ef..7e6d45de6 100644
--- a/plugins/sudoers/fmtsudoers.c
+++ b/plugins/sudoers/fmtsudoers.c
@@ -29,8 +29,8 @@
 #include <pwd.h>
 #include <time.h>
 
-#include "sudoers.h"
-#include "sudo_lbuf.h"
+#include <sudoers.h>
+#include <sudo_lbuf.h>
 #include <gram.h>
 
 /*
diff --git a/plugins/sudoers/fmtsudoers_cvt.c b/plugins/sudoers/fmtsudoers_cvt.c
index ab55d1195..0f68fa00f 100644
--- a/plugins/sudoers/fmtsudoers_cvt.c
+++ b/plugins/sudoers/fmtsudoers_cvt.c
@@ -28,8 +28,8 @@
 #include <string.h>
 #include <time.h>
 
-#include "sudoers.h"
-#include "sudo_lbuf.h"
+#include <sudoers.h>
+#include <sudo_lbuf.h>
 #include <gram.h>
 
 /*
diff --git a/plugins/sudoers/gc.c b/plugins/sudoers/gc.c
index eeea7bbf9..5bcb2dc9d 100644
--- a/plugins/sudoers/gc.c
+++ b/plugins/sudoers/gc.c
@@ -26,7 +26,7 @@
 #include <stdlib.h>
 #include <string.h>
 
-#include "sudoers.h"
+#include <sudoers.h>
 
 struct sudoers_gc_entry {
     SLIST_ENTRY(sudoers_gc_entry) entries;
diff --git a/plugins/sudoers/gentime.c b/plugins/sudoers/gentime.c
index 43ff16260..7575c3750 100644
--- a/plugins/sudoers/gentime.c
+++ b/plugins/sudoers/gentime.c
@@ -28,15 +28,15 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif /* HAVE_STDBOOL_H */
 #include <string.h>
 #include <ctype.h>
 #include <time.h>
 
-#include "sudo_compat.h"
-#include "sudoers_debug.h"
-#include "parse.h"
+#include <sudo_compat.h>
+#include <sudoers_debug.h>
+#include <parse.h>
 
 /* Since timegm() is only used in one place we keep the macro local. */
 #ifndef HAVE_TIMEGM
diff --git a/plugins/sudoers/getdate.c b/plugins/sudoers/getdate.c
index 25ebd7b14..8c86148de 100644
--- a/plugins/sudoers/getdate.c
+++ b/plugins/sudoers/getdate.c
@@ -105,7 +105,7 @@
 #include <limits.h>
 #include <ctype.h>
 
-#include "sudo_compat.h"
+#include <sudo_compat.h>
 
 
 #define EPOCH		1970
diff --git a/plugins/sudoers/getdate.y b/plugins/sudoers/getdate.y
index c55ce3660..6b17eae1f 100644
--- a/plugins/sudoers/getdate.y
+++ b/plugins/sudoers/getdate.y
@@ -29,7 +29,7 @@
 #include <limits.h>
 #include <ctype.h>
 
-#include "sudo_compat.h"
+#include <sudo_compat.h>
 
 
 #define EPOCH		1970
diff --git a/plugins/sudoers/getspwuid.c b/plugins/sudoers/getspwuid.c
index 650b3f3bd..dd5092d72 100644
--- a/plugins/sudoers/getspwuid.c
+++ b/plugins/sudoers/getspwuid.c
@@ -46,7 +46,7 @@
 # include <prot.h>
 #endif /* HAVE_GETPRPWNAM */
 
-#include "sudoers.h"
+#include <sudoers.h>
 
 /*
  * Exported for auth/secureware.c
diff --git a/plugins/sudoers/goodpath.c b/plugins/sudoers/goodpath.c
index 10d83ad8b..b2d412ded 100644
--- a/plugins/sudoers/goodpath.c
+++ b/plugins/sudoers/goodpath.c
@@ -33,7 +33,7 @@
 #include <string.h>
 #include <errno.h>
 
-#include "sudoers.h"
+#include <sudoers.h>
 
 /*
  * Verify that path is a normal file and executable by root.
diff --git a/plugins/sudoers/gram.c b/plugins/sudoers/gram.c
index df328c425..11064674c 100644
--- a/plugins/sudoers/gram.c
+++ b/plugins/sudoers/gram.c
@@ -114,9 +114,9 @@
 #include <unistd.h>
 #include <errno.h>
 
-#include "sudoers.h"
-#include "sudo_digest.h"
-#include "toke.h"
+#include <sudoers.h>
+#include <sudo_digest.h>
+#include <toke.h>
 
 #ifdef YYBISON
 # define YYERROR_VERBOSE
diff --git a/plugins/sudoers/gram.y b/plugins/sudoers/gram.y
index 064e6ef14..85ad24019 100644
--- a/plugins/sudoers/gram.y
+++ b/plugins/sudoers/gram.y
@@ -31,9 +31,9 @@
 #include <unistd.h>
 #include <errno.h>
 
-#include "sudoers.h"
-#include "sudo_digest.h"
-#include "toke.h"
+#include <sudoers.h>
+#include <sudo_digest.h>
+#include <toke.h>
 
 #ifdef YYBISON
 # define YYERROR_VERBOSE
diff --git a/plugins/sudoers/group_plugin.c b/plugins/sudoers/group_plugin.c
index 19878f7b9..02e4b5fa1 100644
--- a/plugins/sudoers/group_plugin.c
+++ b/plugins/sudoers/group_plugin.c
@@ -31,8 +31,8 @@
 #include <ctype.h>
 #include <errno.h>
 
-#include "sudoers.h"
-#include "sudo_dso.h"
+#include <sudoers.h>
+#include <sudo_dso.h>
 
 #if defined(HAVE_DLOPEN) || defined(HAVE_SHL_LOAD)
 
diff --git a/plugins/sudoers/insults.h b/plugins/sudoers/insults.h
index 752d7e6e4..25ad46ad9 100644
--- a/plugins/sudoers/insults.h
+++ b/plugins/sudoers/insults.h
@@ -22,7 +22,7 @@
 
 #if defined(HAL_INSULTS) || defined(GOONS_INSULTS) || defined(CLASSIC_INSULTS) || defined(CSOPS_INSULTS) || defined(PYTHON_INSULTS)
 
-#include "sudo_rand.h"
+#include <sudo_rand.h>
 
 /*
  * Use one or more set of insults as determined by configure
diff --git a/plugins/sudoers/interfaces.c b/plugins/sudoers/interfaces.c
index b60f2a621..19c6767d5 100644
--- a/plugins/sudoers/interfaces.c
+++ b/plugins/sudoers/interfaces.c
@@ -37,8 +37,8 @@
 #include <netdb.h>
 #include <errno.h>
 
-#include "sudoers.h"
-#include "interfaces.h"
+#include <sudoers.h>
+#include <interfaces.h>
 
 static struct interface_list interfaces = SLIST_HEAD_INITIALIZER(interfaces);
 
diff --git a/plugins/sudoers/iolog.c b/plugins/sudoers/iolog.c
index 605d2bf36..cddc18d24 100644
--- a/plugins/sudoers/iolog.c
+++ b/plugins/sudoers/iolog.c
@@ -39,12 +39,12 @@
 #include <arpa/inet.h>
 #include <netinet/in.h>
 
-#include "sudoers.h"
-#include "sudo_eventlog.h"
-#include "sudo_iolog.h"
-#include "strlist.h"
+#include <sudoers.h>
+#include <sudo_eventlog.h>
+#include <sudo_iolog.h>
+#include <strlist.h>
 #ifdef SUDOERS_LOG_CLIENT
-# include "log_client.h"
+# include <log_client.h>
 #endif
 
 static struct iolog_file iolog_files[] = {
diff --git a/plugins/sudoers/iolog_path_escapes.c b/plugins/sudoers/iolog_path_escapes.c
index 1b85387a0..d234c5532 100644
--- a/plugins/sudoers/iolog_path_escapes.c
+++ b/plugins/sudoers/iolog_path_escapes.c
@@ -30,8 +30,8 @@
 #include <grp.h>
 #include <unistd.h>
 
-#include "sudoers.h"
-#include "sudo_iolog.h"
+#include <sudoers.h>
+#include <sudo_iolog.h>
 
 /*
  * Like strlcpy(3) but replaces '/' with '_'.
diff --git a/plugins/sudoers/ldap.c b/plugins/sudoers/ldap.c
index d39d6e887..08ed3ec21 100644
--- a/plugins/sudoers/ldap.c
+++ b/plugins/sudoers/ldap.c
@@ -61,11 +61,11 @@
 # endif
 #endif /* HAVE_LDAP_SASL_INTERACTIVE_BIND_S */
 
-#include "sudoers.h"
-#include "sudo_lbuf.h"
-#include "sudo_ldap.h"
-#include "sudo_ldap_conf.h"
-#include "sudo_dso.h"
+#include <sudoers.h>
+#include <sudo_lbuf.h>
+#include <sudo_ldap.h>
+#include <sudo_ldap_conf.h>
+#include <sudo_dso.h>
 
 #if defined(HAVE_LDAP_SASL_INTERACTIVE_BIND_S) && !defined(LDAP_SASL_QUIET)
 # define LDAP_SASL_QUIET	0
diff --git a/plugins/sudoers/ldap_conf.c b/plugins/sudoers/ldap_conf.c
index f989bf313..8c772ade4 100644
--- a/plugins/sudoers/ldap_conf.c
+++ b/plugins/sudoers/ldap_conf.c
@@ -45,10 +45,10 @@
 # include <mps/ldap_ssl.h>
 #endif
 
-#include "sudoers.h"
-#include "sudo_lbuf.h"
-#include "sudo_ldap.h"
-#include "sudo_ldap_conf.h"
+#include <sudoers.h>
+#include <sudo_lbuf.h>
+#include <sudo_ldap.h>
+#include <sudo_ldap_conf.h>
 
 /* Older Netscape LDAP SDKs don't prototype ldapssl_set_strength() */
 #if defined(HAVE_LDAPSSL_SET_STRENGTH) && !defined(HAVE_LDAP_SSL_H) && !defined(HAVE_MPS_LDAP_SSL_H)
diff --git a/plugins/sudoers/ldap_innetgr.c b/plugins/sudoers/ldap_innetgr.c
index 28cb340fb..2309485b1 100644
--- a/plugins/sudoers/ldap_innetgr.c
+++ b/plugins/sudoers/ldap_innetgr.c
@@ -38,9 +38,9 @@
 #endif
 #include <ldap.h>
 
-#include "sudoers.h"
-#include "sudo_ldap.h"
-#include "sudo_ldap_conf.h"
+#include <sudoers.h>
+#include <sudo_ldap.h>
+#include <sudo_ldap_conf.h>
 
 /*
  * Compare str to netgroup string ngstr of length nglen where str is a
diff --git a/plugins/sudoers/ldap_util.c b/plugins/sudoers/ldap_util.c
index b6d3b88e6..3cfd3b036 100644
--- a/plugins/sudoers/ldap_util.c
+++ b/plugins/sudoers/ldap_util.c
@@ -34,11 +34,11 @@
 #include <netinet/in.h>
 #include <arpa/inet.h>
 
-#include "sudoers.h"
-#include "interfaces.h"
-#include "sudo_lbuf.h"
-#include "sudo_ldap.h"
-#include "sudo_digest.h"
+#include <sudoers.h>
+#include <interfaces.h>
+#include <sudo_lbuf.h>
+#include <sudo_ldap.h>
+#include <sudo_digest.h>
 #include <gram.h>
 
 /*
diff --git a/plugins/sudoers/linux_audit.c b/plugins/sudoers/linux_audit.c
index e3fb498f8..2b52dac3a 100644
--- a/plugins/sudoers/linux_audit.c
+++ b/plugins/sudoers/linux_audit.c
@@ -32,8 +32,8 @@
 #include <string.h>
 #include <libaudit.h>
 
-#include "sudoers.h"
-#include "linux_audit.h"
+#include <sudoers.h>
+#include <linux_audit.h>
 
 #define AUDIT_NOT_CONFIGURED	-2
 
diff --git a/plugins/sudoers/locale.c b/plugins/sudoers/locale.c
index c2315bbeb..40cee30d7 100644
--- a/plugins/sudoers/locale.c
+++ b/plugins/sudoers/locale.c
@@ -29,19 +29,19 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif /* HAVE_STDBOOL_H */
 
 #define DEFAULT_TEXT_DOMAIN	"sudoers"
 
-#include "sudo_compat.h"
-#include "sudo_eventlog.h"
-#include "sudo_fatal.h"
-#include "sudo_gettext.h"
-#include "sudoers_debug.h"
+#include <sudo_compat.h>
+#include <sudo_eventlog.h>
+#include <sudo_fatal.h>
+#include <sudo_gettext.h>
+#include <sudoers_debug.h>
 
-#include "defaults.h"
-#include "logging.h"
+#include <defaults.h>
+#include <logging.h>
 
 static int current_locale = SUDOERS_LOCALE_USER;
 static char *user_locale;
diff --git a/plugins/sudoers/log_client.c b/plugins/sudoers/log_client.c
index 9c109a305..7f72af258 100644
--- a/plugins/sudoers/log_client.c
+++ b/plugins/sudoers/log_client.c
@@ -50,7 +50,7 @@
 #include <pwd.h>
 #include <grp.h>
 #ifndef HAVE_GETADDRINFO
-# include "compat/getaddrinfo.h"
+# include <compat/getaddrinfo.h>
 #endif
 
 #if defined(HAVE_OPENSSL)
@@ -64,13 +64,13 @@
 
 #define NEED_INET_NTOP		/* to expose sudo_inet_ntop in sudo_compat.h */
 
-#include "sudoers.h"
-#include "sudo_event.h"
-#include "sudo_eventlog.h"
-#include "sudo_iolog.h"
-#include "hostcheck.h"
-#include "log_client.h"
-#include "strlist.h"
+#include <sudoers.h>
+#include <sudo_event.h>
+#include <sudo_eventlog.h>
+#include <sudo_iolog.h>
+#include <hostcheck.h>
+#include <log_client.h>
+#include <strlist.h>
 
 /* Shared between iolog.c and audit.c */
 struct client_closure *client_closure;
diff --git a/plugins/sudoers/log_client.h b/plugins/sudoers/log_client.h
index 5e37e986b..78508ef87 100644
--- a/plugins/sudoers/log_client.h
+++ b/plugins/sudoers/log_client.h
@@ -25,10 +25,10 @@
 #  include <wolfssl/options.h>
 # endif /* HAVE_WOLFSSL */
 # include <openssl/ssl.h>
-# include "sudo_ssl_compat.h"
+# include <sudo_ssl_compat.h>
 #endif /* HAVE_OPENSSL */
 
-#include "log_server.pb-c.h"
+#include <log_server.pb-c.h>
 
 #ifndef INET_ADDRSTRLEN
 # define INET_ADDRSTRLEN 16
diff --git a/plugins/sudoers/logging.c b/plugins/sudoers/logging.c
index ac072d31c..28cf6729f 100644
--- a/plugins/sudoers/logging.c
+++ b/plugins/sudoers/logging.c
@@ -50,13 +50,13 @@
 #include <signal.h>
 #include <syslog.h>
 #ifndef HAVE_GETADDRINFO
-# include "compat/getaddrinfo.h"
+# include <compat/getaddrinfo.h>
 #endif
 
-#include "sudoers.h"
+#include <sudoers.h>
 #ifdef SUDOERS_LOG_CLIENT
-# include "log_client.h"
-# include "strlist.h"
+# include <log_client.h>
+# include <strlist.h>
 #endif
 
 struct parse_error {
diff --git a/plugins/sudoers/lookup.c b/plugins/sudoers/lookup.c
index 824d634b6..b5757371c 100644
--- a/plugins/sudoers/lookup.c
+++ b/plugins/sudoers/lookup.c
@@ -29,7 +29,7 @@
 #include <unistd.h>
 #include <pwd.h>
 
-#include "sudoers.h"
+#include <sudoers.h>
 #include <gram.h>
 
 static int
diff --git a/plugins/sudoers/match.c b/plugins/sudoers/match.c
index c9880c2ad..30a4b1073 100644
--- a/plugins/sudoers/match.c
+++ b/plugins/sudoers/match.c
@@ -52,10 +52,10 @@
 #ifdef HAVE_FNMATCH
 # include <fnmatch.h>
 #else
-# include "compat/fnmatch.h"
+# include <compat/fnmatch.h>
 #endif /* HAVE_FNMATCH */
 
-#include "sudoers.h"
+#include <sudoers.h>
 #include <gram.h>
 
 /*
diff --git a/plugins/sudoers/match_addr.c b/plugins/sudoers/match_addr.c
index add53e575..c77c8734a 100644
--- a/plugins/sudoers/match_addr.c
+++ b/plugins/sudoers/match_addr.c
@@ -41,8 +41,8 @@
 # include <resolv.h>
 #endif /* NEED_RESOLV_H */
 
-#include "sudoers.h"
-#include "interfaces.h"
+#include <sudoers.h>
+#include <interfaces.h>
 
 static int
 addr_matches_if(const char *n)
diff --git a/plugins/sudoers/match_command.c b/plugins/sudoers/match_command.c
index 1be997eb1..8a39acd0a 100644
--- a/plugins/sudoers/match_command.c
+++ b/plugins/sudoers/match_command.c
@@ -37,7 +37,7 @@
 # ifdef HAVE_GLOB
 #  include <glob.h>
 # else
-#  include "compat/glob.h"
+#  include <compat/glob.h>
 # endif /* HAVE_GLOB */
 #endif /* SUDOERS_NAME_MATCH */
 #include <dirent.h>
@@ -46,11 +46,11 @@
 #ifdef HAVE_FNMATCH
 # include <fnmatch.h>
 #else
-# include "compat/fnmatch.h"
+# include <compat/fnmatch.h>
 #endif /* HAVE_FNMATCH */
 #include <regex.h>
 
-#include "sudoers.h"
+#include <sudoers.h>
 #include <gram.h>
 
 #if !defined(O_EXEC) && defined(O_PATH)
diff --git a/plugins/sudoers/match_digest.c b/plugins/sudoers/match_digest.c
index b171a64f9..92b323cc6 100644
--- a/plugins/sudoers/match_digest.c
+++ b/plugins/sudoers/match_digest.c
@@ -34,8 +34,8 @@
 #include <string.h>
 #include <unistd.h>
 
-#include "sudoers.h"
-#include "sudo_digest.h"
+#include <sudoers.h>
+#include <sudo_digest.h>
 #include <gram.h>
 
 int
diff --git a/plugins/sudoers/parse.h b/plugins/sudoers/parse.h
index 1d0660cf2..48255f1d5 100644
--- a/plugins/sudoers/parse.h
+++ b/plugins/sudoers/parse.h
@@ -21,7 +21,7 @@
 #define SUDOERS_PARSE_H
 
 #include <sys/stat.h>
-#include "sudo_queue.h"
+#include <sudo_queue.h>
 
 /* Characters that must be quoted in sudoers. */
 #define SUDOERS_QUOTED		":,=#\""
diff --git a/plugins/sudoers/parse_ldif.c b/plugins/sudoers/parse_ldif.c
index 98d84488a..87c94125c 100644
--- a/plugins/sudoers/parse_ldif.c
+++ b/plugins/sudoers/parse_ldif.c
@@ -31,10 +31,10 @@
 #endif /* HAVE_STRINGS_H */
 #include <ctype.h>
 
-#include "sudoers.h"
-#include "sudo_ldap.h"
-#include "redblack.h"
-#include "strlist.h"
+#include <sudoers.h>
+#include <sudo_ldap.h>
+#include <redblack.h>
+#include <strlist.h>
 #include <gram.h>
 
 struct sudo_role {
diff --git a/plugins/sudoers/parser_warnx.c b/plugins/sudoers/parser_warnx.c
index 2a7b38078..9b0bfdd97 100644
--- a/plugins/sudoers/parser_warnx.c
+++ b/plugins/sudoers/parser_warnx.c
@@ -27,7 +27,7 @@
 #include <stdio.h>
 #include <stdlib.h>
 
-#include "sudoers.h"
+#include <sudoers.h>
 
 bool
 parser_vwarnx(const struct sudoers_context *ctx, const char *file, int line,
diff --git a/plugins/sudoers/pivot.c b/plugins/sudoers/pivot.c
index 1c10b9ea6..59423f917 100644
--- a/plugins/sudoers/pivot.c
+++ b/plugins/sudoers/pivot.c
@@ -27,7 +27,7 @@
 #include <fcntl.h>
 #include <unistd.h>
 
-#include "sudoers.h"
+#include <sudoers.h>
 
 /*
  * Pivot to a new root directory, storing the old root and old cwd
diff --git a/plugins/sudoers/policy.c b/plugins/sudoers/policy.c
index 2dd88244e..e3c90cfd1 100644
--- a/plugins/sudoers/policy.c
+++ b/plugins/sudoers/policy.c
@@ -35,10 +35,10 @@
 #include <grp.h>
 #include <pwd.h>
 
-#include "sudoers.h"
-#include "sudoers_version.h"
-#include "timestamp.h"
-#include "interfaces.h"
+#include <sudoers.h>
+#include <sudoers_version.h>
+#include <timestamp.h>
+#include <interfaces.h>
 #include "auth/sudo_auth.h"
 
 static char **command_info;
diff --git a/plugins/sudoers/prompt.c b/plugins/sudoers/prompt.c
index fcd22f184..0bf9f7928 100644
--- a/plugins/sudoers/prompt.c
+++ b/plugins/sudoers/prompt.c
@@ -33,7 +33,7 @@
 #include <string.h>
 #include <pwd.h>
 
-#include "sudoers.h"
+#include <sudoers.h>
 
 /*
  * Expand %h and %u escapes (if present) in the prompt and pass back
diff --git a/plugins/sudoers/pwutil.c b/plugins/sudoers/pwutil.c
index 015cd0d7a..079c86d64 100644
--- a/plugins/sudoers/pwutil.c
+++ b/plugins/sudoers/pwutil.c
@@ -43,9 +43,9 @@
 #include <pwd.h>
 #include <grp.h>
 
-#include "sudoers.h"
-#include "redblack.h"
-#include "pwutil.h"
+#include <sudoers.h>
+#include <redblack.h>
+#include <pwutil.h>
 
 /*
  * The passwd and group caches.
diff --git a/plugins/sudoers/pwutil_impl.c b/plugins/sudoers/pwutil_impl.c
index e195335bf..e8c328f60 100644
--- a/plugins/sudoers/pwutil_impl.c
+++ b/plugins/sudoers/pwutil_impl.c
@@ -38,8 +38,8 @@
 #include <pwd.h>
 #include <grp.h>
 
-#include "sudoers.h"
-#include "pwutil.h"
+#include <sudoers.h>
+#include <pwutil.h>
 
 #ifndef LOGIN_NAME_MAX
 # ifdef _POSIX_LOGIN_NAME_MAX
diff --git a/plugins/sudoers/redblack.c b/plugins/sudoers/redblack.c
index a7d023cd9..58762c374 100644
--- a/plugins/sudoers/redblack.c
+++ b/plugins/sudoers/redblack.c
@@ -52,8 +52,8 @@
 #include <stdio.h>
 #include <stdlib.h>
 
-#include "sudoers.h"
-#include "redblack.h"
+#include <sudoers.h>
+#include <redblack.h>
 
 static void rbrepair(struct rbtree *, struct rbnode *);
 static void rotate_left(struct rbtree *, struct rbnode *);
diff --git a/plugins/sudoers/regress/check_symbols/check_symbols.c b/plugins/sudoers/regress/check_symbols/check_symbols.c
index bc3f8d17d..41e947997 100644
--- a/plugins/sudoers/regress/check_symbols/check_symbols.c
+++ b/plugins/sudoers/regress/check_symbols/check_symbols.c
@@ -24,10 +24,10 @@
 #include <errno.h>
 #include <limits.h>
 
-#include "sudo_compat.h"
-#include "sudo_dso.h"
-#include "sudo_util.h"
-#include "sudo_fatal.h"
+#include <sudo_compat.h>
+#include <sudo_dso.h>
+#include <sudo_util.h>
+#include <sudo_fatal.h>
 
 sudo_dso_public int main(int argc, char *argv[]);
 
diff --git a/plugins/sudoers/regress/editor/check_editor.c b/plugins/sudoers/regress/editor/check_editor.c
index 8360a91c1..65e00c077 100644
--- a/plugins/sudoers/regress/editor/check_editor.c
+++ b/plugins/sudoers/regress/editor/check_editor.c
@@ -24,7 +24,7 @@
 
 #define SUDO_ERROR_WRAP 0
 
-#include "sudoers.h"
+#include <sudoers.h>
 #include <def_data.c>
 
 /* Note hard-coded array lengths. */
diff --git a/plugins/sudoers/regress/env_match/check_env_pattern.c b/plugins/sudoers/regress/env_match/check_env_pattern.c
index 90c1a0d14..81649c1f6 100644
--- a/plugins/sudoers/regress/env_match/check_env_pattern.c
+++ b/plugins/sudoers/regress/env_match/check_env_pattern.c
@@ -22,7 +22,7 @@
 #include <stdlib.h>
 #include <string.h>
 
-#include "sudoers.h"
+#include <sudoers.h>
 
 sudo_dso_public int main(int argc, char *argv[]);
 
diff --git a/plugins/sudoers/regress/exptilde/check_exptilde.c b/plugins/sudoers/regress/exptilde/check_exptilde.c
index 20f4995bd..6962a94fa 100644
--- a/plugins/sudoers/regress/exptilde/check_exptilde.c
+++ b/plugins/sudoers/regress/exptilde/check_exptilde.c
@@ -27,7 +27,7 @@
 
 #define SUDO_ERROR_WRAP 0
 
-#include "sudoers.h"
+#include <sudoers.h>
 
 #include <def_data.c>
 
diff --git a/plugins/sudoers/regress/fuzz/fuzz_policy.c b/plugins/sudoers/regress/fuzz/fuzz_policy.c
index 9ae6fbaa0..0b01e4e20 100644
--- a/plugins/sudoers/regress/fuzz/fuzz_policy.c
+++ b/plugins/sudoers/regress/fuzz/fuzz_policy.c
@@ -35,13 +35,13 @@
 #include <unistd.h>
 #include <string.h>
 #ifndef HAVE_GETADDRINFO
-# include "compat/getaddrinfo.h"
+# include <compat/getaddrinfo.h>
 #endif
 
-#include "sudoers.h"
-#include "sudo_iolog.h"
-#include "interfaces.h"
-#include "timestamp.h"
+#include <sudoers.h>
+#include <sudo_iolog.h>
+#include <interfaces.h>
+#include <timestamp.h>
 #include "auth/sudo_auth.h"
 
 extern char **environ;
diff --git a/plugins/sudoers/regress/fuzz/fuzz_stubs.c b/plugins/sudoers/regress/fuzz/fuzz_stubs.c
index 198240a5d..ce47bf562 100644
--- a/plugins/sudoers/regress/fuzz/fuzz_stubs.c
+++ b/plugins/sudoers/regress/fuzz/fuzz_stubs.c
@@ -38,9 +38,9 @@
 #endif /* NEED_RESOLV_H */
 #include <netdb.h>
 
-#include "sudoers.h"
-#include "timestamp.h"
-#include "interfaces.h"
+#include <sudoers.h>
+#include <timestamp.h>
+#include <interfaces.h>
 
 int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size);
 
diff --git a/plugins/sudoers/regress/fuzz/fuzz_sudoers.c b/plugins/sudoers/regress/fuzz/fuzz_sudoers.c
index 71eccaed0..e77634a39 100644
--- a/plugins/sudoers/regress/fuzz/fuzz_sudoers.c
+++ b/plugins/sudoers/regress/fuzz/fuzz_sudoers.c
@@ -38,8 +38,8 @@
 #endif /* NEED_RESOLV_H */
 #include <netdb.h>
 
-#include "sudoers.h"
-#include "interfaces.h"
+#include <sudoers.h>
+#include <interfaces.h>
 
 static int fuzz_conversation(int num_msgs, const struct sudo_conv_message msgs[], struct sudo_conv_reply replies[], struct sudo_conv_callback *callback);
 static int fuzz_printf(int msg_type, const char * restrict fmt, ...);
diff --git a/plugins/sudoers/regress/fuzz/fuzz_sudoers_ldif.c b/plugins/sudoers/regress/fuzz/fuzz_sudoers_ldif.c
index a42f0f235..9f9b394d1 100644
--- a/plugins/sudoers/regress/fuzz/fuzz_sudoers_ldif.c
+++ b/plugins/sudoers/regress/fuzz/fuzz_sudoers_ldif.c
@@ -26,7 +26,7 @@
 # include <inttypes.h>
 #endif
 
-#include "sudoers.h"
+#include <sudoers.h>
 
 static int fuzz_printf(int msg_type, const char * restrict fmt, ...);
 int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size);
diff --git a/plugins/sudoers/regress/iolog_plugin/check_iolog_plugin.c b/plugins/sudoers/regress/iolog_plugin/check_iolog_plugin.c
index 7c4b3558d..991c30ce7 100644
--- a/plugins/sudoers/regress/iolog_plugin/check_iolog_plugin.c
+++ b/plugins/sudoers/regress/iolog_plugin/check_iolog_plugin.c
@@ -27,10 +27,10 @@
 
 #define SUDO_ERROR_WRAP 0
 
-#include "sudoers.h"
-#include "sudo_eventlog.h"
-#include "sudo_iolog.h"
-#include "sudo_plugin.h"
+#include <sudoers.h>
+#include <sudo_eventlog.h>
+#include <sudo_iolog.h>
+#include <sudo_plugin.h>
 
 #include <def_data.c>		/* for iolog_path.c */
 
diff --git a/plugins/sudoers/regress/parser/check_addr.c b/plugins/sudoers/regress/parser/check_addr.c
index 138713232..3db53c64a 100644
--- a/plugins/sudoers/regress/parser/check_addr.c
+++ b/plugins/sudoers/regress/parser/check_addr.c
@@ -31,8 +31,8 @@
 
 #define SUDO_ERROR_WRAP 0
 
-#include "sudoers.h"
-#include "interfaces.h"
+#include <sudoers.h>
+#include <interfaces.h>
 
 sudo_dso_public int main(int argc, char *argv[]);
 
diff --git a/plugins/sudoers/regress/parser/check_base64.c b/plugins/sudoers/regress/parser/check_base64.c
index 002d6b455..4fe54ade5 100644
--- a/plugins/sudoers/regress/parser/check_base64.c
+++ b/plugins/sudoers/regress/parser/check_base64.c
@@ -24,8 +24,8 @@
 
 #define SUDO_ERROR_WRAP 0
 
-#include "sudo_compat.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_util.h>
 
 /* From parse.h */
 extern size_t base64_decode(const char *str, unsigned char *dst, size_t dsize);
diff --git a/plugins/sudoers/regress/parser/check_digest.c b/plugins/sudoers/regress/parser/check_digest.c
index de2b3aed5..66527a66e 100644
--- a/plugins/sudoers/regress/parser/check_digest.c
+++ b/plugins/sudoers/regress/parser/check_digest.c
@@ -23,12 +23,12 @@
 #include <string.h>
 #include <unistd.h>
 
-#include "sudo_compat.h"
-#include "sudo_fatal.h"
-#include "sudo_queue.h"
-#include "sudo_digest.h"
-#include "sudo_util.h"
-#include "parse.h"
+#include <sudo_compat.h>
+#include <sudo_fatal.h>
+#include <sudo_queue.h>
+#include <sudo_digest.h>
+#include <sudo_util.h>
+#include <parse.h>
 
 sudo_dso_public int main(int argc, char *argv[]);
 
diff --git a/plugins/sudoers/regress/parser/check_fill.c b/plugins/sudoers/regress/parser/check_fill.c
index f70cfb570..cd8475fd5 100644
--- a/plugins/sudoers/regress/parser/check_fill.c
+++ b/plugins/sudoers/regress/parser/check_fill.c
@@ -23,18 +23,18 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif /* HAVE_STDBOOL_H */
 #include <string.h>
 
 #define SUDO_ERROR_WRAP 0
 
-#include "sudo_compat.h"
-#include "sudo_queue.h"
-#include "parse.h"
-#include "toke.h"
-#include "sudo_plugin.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_queue.h>
+#include <parse.h>
+#include <toke.h>
+#include <sudo_plugin.h>
+#include <sudo_util.h>
 #include <gram.h>
 
 sudo_dso_public int main(int argc, char *argv[]);
diff --git a/plugins/sudoers/regress/parser/check_gentime.c b/plugins/sudoers/regress/parser/check_gentime.c
index 8e62639c6..8b1e0f650 100644
--- a/plugins/sudoers/regress/parser/check_gentime.c
+++ b/plugins/sudoers/regress/parser/check_gentime.c
@@ -25,10 +25,10 @@
 
 #define SUDO_ERROR_WRAP 0
 
-#include "sudo_compat.h"
-#include "sudo_util.h"
-#include "sudoers_debug.h"
-#include "parse.h"
+#include <sudo_compat.h>
+#include <sudo_util.h>
+#include <sudoers_debug.h>
+#include <parse.h>
 
 sudo_dso_public int main(int argc, char *argv[]);
 
diff --git a/plugins/sudoers/regress/serialize_list/check_serialize_list.c b/plugins/sudoers/regress/serialize_list/check_serialize_list.c
index db828247d..cf559c51e 100644
--- a/plugins/sudoers/regress/serialize_list/check_serialize_list.c
+++ b/plugins/sudoers/regress/serialize_list/check_serialize_list.c
@@ -24,7 +24,7 @@
 
 #define SUDO_ERROR_WRAP 0
 
-#include "sudoers.h"
+#include <sudoers.h>
 
 sudo_dso_public int main(int argc, char *argv[]);
 
diff --git a/plugins/sudoers/regress/starttime/check_starttime.c b/plugins/sudoers/regress/starttime/check_starttime.c
index f658e94c0..406d7fb73 100644
--- a/plugins/sudoers/regress/starttime/check_starttime.c
+++ b/plugins/sudoers/regress/starttime/check_starttime.c
@@ -25,10 +25,10 @@
 #include <time.h>
 #include <unistd.h>
 
-#include "sudo_compat.h"
-#include "sudo_util.h"
-#include "sudo_fatal.h"
-#include "timestamp.h"
+#include <sudo_compat.h>
+#include <sudo_util.h>
+#include <sudo_fatal.h>
+#include <timestamp.h>
 
 sudo_dso_public int main(int argc, char *argv[]);
 
diff --git a/plugins/sudoers/regress/unescape/check_unesc.c b/plugins/sudoers/regress/unescape/check_unesc.c
index 305a6a06c..87497c855 100644
--- a/plugins/sudoers/regress/unescape/check_unesc.c
+++ b/plugins/sudoers/regress/unescape/check_unesc.c
@@ -24,7 +24,7 @@
 
 #define SUDO_ERROR_WRAP 0
 
-#include "sudoers.h"
+#include <sudoers.h>
 
 struct test_data {
     const char *input;
diff --git a/plugins/sudoers/resolve_cmnd.c b/plugins/sudoers/resolve_cmnd.c
index 685618dea..24e34de0a 100644
--- a/plugins/sudoers/resolve_cmnd.c
+++ b/plugins/sudoers/resolve_cmnd.c
@@ -23,7 +23,7 @@
 
 #include <config.h>
 
-#include "sudoers.h"
+#include <sudoers.h>
 
 /*
  * Calls find_path() first with PERM_RUNAS, falling back to PERM_USER.
diff --git a/plugins/sudoers/serialize_list.c b/plugins/sudoers/serialize_list.c
index 2c1f91637..11d2c289b 100644
--- a/plugins/sudoers/serialize_list.c
+++ b/plugins/sudoers/serialize_list.c
@@ -27,7 +27,7 @@
 #include <stdlib.h>
 #include <string.h>
 
-#include "sudoers.h"
+#include <sudoers.h>
 
 /*
  * Convert struct list_members to a comma-separated string with
diff --git a/plugins/sudoers/set_perms.c b/plugins/sudoers/set_perms.c
index e8f88d8ef..9f8009457 100644
--- a/plugins/sudoers/set_perms.c
+++ b/plugins/sudoers/set_perms.c
@@ -39,8 +39,8 @@
 #include <errno.h>
 #include <grp.h>
 
-#include "sudoers.h"
-#include "timestamp.h"
+#include <sudoers.h>
+#include <timestamp.h>
 
 /* No change when passed to setresuid(), etc. */
 #define NO_UID	(uid_t)-1
diff --git a/plugins/sudoers/sethost.c b/plugins/sudoers/sethost.c
index 17c402a7a..bfbb69ff8 100644
--- a/plugins/sudoers/sethost.c
+++ b/plugins/sudoers/sethost.c
@@ -27,7 +27,7 @@
 #include <stdlib.h>
 #include <string.h>
 
-#include "sudoers.h"
+#include <sudoers.h>
 
 /*
  * Set ctx->user.host. ctx->user.shost, ctx->runas.host and ctx->runas.shost
diff --git a/plugins/sudoers/solaris_audit.c b/plugins/sudoers/solaris_audit.c
index 0971b9d6b..bfbea7e9e 100644
--- a/plugins/sudoers/solaris_audit.c
+++ b/plugins/sudoers/solaris_audit.c
@@ -35,8 +35,8 @@
 #include <bsm/adt.h>
 #include <bsm/adt_event.h>
 
-#include "sudoers.h"
-#include "solaris_audit.h"
+#include <sudoers.h>
+#include <solaris_audit.h>
 
 static adt_session_data_t *ah;		/* audit session handle */
 static adt_event_data_t	*event;		/* event to be generated */
diff --git a/plugins/sudoers/sssd.c b/plugins/sudoers/sssd.c
index 6b80392f4..c0804cb84 100644
--- a/plugins/sudoers/sssd.c
+++ b/plugins/sudoers/sssd.c
@@ -39,10 +39,10 @@
 #include <errno.h>
 #include <pwd.h>
 
-#include "sudoers.h"
-#include "sudo_lbuf.h"
-#include "sudo_ldap.h"
-#include "sudo_dso.h"
+#include <sudoers.h>
+#include <sudo_lbuf.h>
+#include <sudo_ldap.h>
+#include <sudo_dso.h>
 
 /* SSSD <--> SUDO interface - do not change */
 struct sss_sudo_attr {
diff --git a/plugins/sudoers/starttime.c b/plugins/sudoers/starttime.c
index 4819ffcbb..cbdbf160e 100644
--- a/plugins/sudoers/starttime.c
+++ b/plugins/sudoers/starttime.c
@@ -62,8 +62,8 @@
 #include <limits.h>
 #include <unistd.h>
 
-#include "sudoers.h"
-#include "timestamp.h"
+#include <sudoers.h>
+#include <timestamp.h>
 
 /*
  * Arguments for sysctl(2) when reading the process start time.
diff --git a/plugins/sudoers/strlcpy_unesc.c b/plugins/sudoers/strlcpy_unesc.c
index c8c89ac69..56a7a4eb7 100644
--- a/plugins/sudoers/strlcpy_unesc.c
+++ b/plugins/sudoers/strlcpy_unesc.c
@@ -27,7 +27,7 @@
 #include <stdio.h>
 #include <ctype.h>
 
-#include "sudoers.h"
+#include <sudoers.h>
 
 /*
  * Like strlcpy() but collapses non-space chars escaped with a backslash.
diff --git a/plugins/sudoers/strlist.c b/plugins/sudoers/strlist.c
index 4b633ab58..912ce46cc 100644
--- a/plugins/sudoers/strlist.c
+++ b/plugins/sudoers/strlist.c
@@ -26,11 +26,11 @@
 #include <stdlib.h>
 #include <string.h>
 
-#include "sudo_compat.h"
-#include "sudo_queue.h"
-#include "sudo_util.h"
-#include "sudoers_debug.h"
-#include "strlist.h"
+#include <sudo_compat.h>
+#include <sudo_queue.h>
+#include <sudo_util.h>
+#include <sudoers_debug.h>
+#include <strlist.h>
 
 struct sudoers_string *
 sudoers_string_alloc(const char *s)
diff --git a/plugins/sudoers/strvec_join.c b/plugins/sudoers/strvec_join.c
index ae209eb91..bee2e44fe 100644
--- a/plugins/sudoers/strvec_join.c
+++ b/plugins/sudoers/strvec_join.c
@@ -27,7 +27,7 @@
 #include <stdlib.h>
 #include <string.h>
 
-#include "sudoers.h"
+#include <sudoers.h>
 
 #ifdef HAVE_STRLCPY
 # define cpy_default	strlcpy
diff --git a/plugins/sudoers/stubs.c b/plugins/sudoers/stubs.c
index 6af01fef6..b8bc10435 100644
--- a/plugins/sudoers/stubs.c
+++ b/plugins/sudoers/stubs.c
@@ -34,8 +34,8 @@
 #include <netinet/in.h>
 #include <arpa/inet.h>
 
-#include "sudoers.h"
-#include "interfaces.h"
+#include <sudoers.h>
+#include <interfaces.h>
 
 /* STUB */
 bool
diff --git a/plugins/sudoers/sudo_nss.c b/plugins/sudoers/sudo_nss.c
index f95533588..83eeaa240 100644
--- a/plugins/sudoers/sudo_nss.c
+++ b/plugins/sudoers/sudo_nss.c
@@ -31,7 +31,7 @@
 #endif /* HAVE_STRINGS_H */
 #include <ctype.h>
 
-#include "sudoers.h"
+#include <sudoers.h>
 
 extern struct sudo_nss sudo_nss_file;
 #ifdef HAVE_LDAP
diff --git a/plugins/sudoers/sudo_printf.c b/plugins/sudoers/sudo_printf.c
index 1586adbc1..6658a046a 100644
--- a/plugins/sudoers/sudo_printf.c
+++ b/plugins/sudoers/sudo_printf.c
@@ -27,10 +27,10 @@
 #include <stdarg.h>
 #include <errno.h>
 
-#include "sudo_compat.h"
-#include "sudo_plugin.h"
-#include "sudo_debug.h"
-#include "pathnames.h"
+#include <sudo_compat.h>
+#include <sudo_plugin.h>
+#include <sudo_debug.h>
+#include <pathnames.h>
 
 static int
 sudo_printf_int(int msg_type, const char * restrict fmt, ...)
diff --git a/plugins/sudoers/sudoers.c b/plugins/sudoers/sudoers.c
index b11c5b9cd..47ab49c18 100644
--- a/plugins/sudoers/sudoers.c
+++ b/plugins/sudoers/sudoers.c
@@ -58,12 +58,12 @@
 #endif
 #include <ctype.h>
 #ifndef HAVE_GETADDRINFO
-# include "compat/getaddrinfo.h"
+# include <compat/getaddrinfo.h>
 #endif
 
-#include "sudoers.h"
-#include "timestamp.h"
-#include "sudo_iolog.h"
+#include <sudoers.h>
+#include <timestamp.h>
+#include <sudo_iolog.h>
 
 /*
  * Prototypes
diff --git a/plugins/sudoers/sudoers.h b/plugins/sudoers/sudoers.h
index 2cdf6243b..3ef9c7ed2 100644
--- a/plugins/sudoers/sudoers.h
+++ b/plugins/sudoers/sudoers.h
@@ -29,27 +29,27 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif /* HAVE_STDBOOL_H */
 
 #define DEFAULT_TEXT_DOMAIN	"sudoers"
 
-#include "pathnames.h"
-#include "sudo_compat.h"
-#include "sudo_conf.h"
-#include "sudo_eventlog.h"
-#include "sudo_fatal.h"
-#include "sudo_gettext.h"
-#include "sudo_nss.h"
-#include "sudo_plugin.h"
-#include "sudo_queue.h"
-#include "sudo_util.h"
-#include "sudoers_debug.h"
+#include <pathnames.h>
+#include <sudo_compat.h>
+#include <sudo_conf.h>
+#include <sudo_eventlog.h>
+#include <sudo_fatal.h>
+#include <sudo_gettext.h>
+#include <sudo_nss.h>
+#include <sudo_plugin.h>
+#include <sudo_queue.h>
+#include <sudo_util.h>
+#include <sudoers_debug.h>
 
-#include "defaults.h"
-#include "logging.h"
-#include "parse.h"
-#include "pivot.h"
+#include <defaults.h>
+#include <logging.h>
+#include <parse.h>
+#include <pivot.h>
 
 /*
  * Info passed in from the sudo front-end.
diff --git a/plugins/sudoers/sudoers_cb.c b/plugins/sudoers/sudoers_cb.c
index 469e89fce..4fc4c54b1 100644
--- a/plugins/sudoers/sudoers_cb.c
+++ b/plugins/sudoers/sudoers_cb.c
@@ -38,12 +38,12 @@
 #include <grp.h>
 #include <netdb.h>
 #ifndef HAVE_GETADDRINFO
-# include "compat/getaddrinfo.h"
+# include <compat/getaddrinfo.h>
 #endif
 
-#include "sudoers.h"
-#include "timestamp.h"
-#include "sudo_iolog.h"
+#include <sudoers.h>
+#include <timestamp.h>
+#include <sudo_iolog.h>
 
 #ifndef AI_FQDN
 # define AI_FQDN AI_CANONNAME
diff --git a/plugins/sudoers/sudoers_ctx_free.c b/plugins/sudoers/sudoers_ctx_free.c
index 1d685e54e..b9c5af609 100644
--- a/plugins/sudoers/sudoers_ctx_free.c
+++ b/plugins/sudoers/sudoers_ctx_free.c
@@ -27,7 +27,7 @@
 #include <stdlib.h>
 #include <string.h>
 
-#include "sudoers.h"
+#include <sudoers.h>
 
 /*
  * Free memory allocated for struct sudoers_context.
diff --git a/plugins/sudoers/sudoers_debug.c b/plugins/sudoers/sudoers_debug.c
index 471ea8c9b..0c1efe7ae 100644
--- a/plugins/sudoers/sudoers_debug.c
+++ b/plugins/sudoers/sudoers_debug.c
@@ -27,7 +27,7 @@
 #include <stdlib.h>
 #include <string.h>
 
-#include "sudoers.h"
+#include <sudoers.h>
 
 static int sudoers_debug_instance = SUDO_DEBUG_INSTANCE_INITIALIZER;
 static unsigned int sudoers_debug_refcnt;
diff --git a/plugins/sudoers/sudoers_debug.h b/plugins/sudoers/sudoers_debug.h
index bb3e263c8..f97f9af79 100644
--- a/plugins/sudoers/sudoers_debug.h
+++ b/plugins/sudoers/sudoers_debug.h
@@ -19,7 +19,7 @@
 #ifndef SUDOERS_DEBUG_H
 #define SUDOERS_DEBUG_H
 
-#include "sudo_debug.h"
+#include <sudo_debug.h>
 
 /*
  * Sudoers debug subsystems.
diff --git a/plugins/sudoers/sudoers_hooks.c b/plugins/sudoers/sudoers_hooks.c
index 738f93b38..e0993a217 100644
--- a/plugins/sudoers/sudoers_hooks.c
+++ b/plugins/sudoers/sudoers_hooks.c
@@ -33,7 +33,7 @@
 #include <string.h>
 #include <errno.h>
 
-#include "sudoers.h"
+#include <sudoers.h>
 
 /*
  * Similar to setenv(3) but operates on a private copy of the environment.
diff --git a/plugins/sudoers/sudoreplay.c b/plugins/sudoers/sudoreplay.c
index 8db83833c..f6e8cbc22 100644
--- a/plugins/sudoers/sudoreplay.c
+++ b/plugins/sudoers/sudoreplay.c
@@ -46,31 +46,31 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif /* HAVE_STDBOOL_H */
 #include <regex.h>
 #include <signal.h>
 #ifdef HAVE_GETOPT_LONG
 # include <getopt.h>
 # else
-# include "compat/getopt.h"
+# include <compat/getopt.h>
 #endif /* HAVE_GETOPT_LONG */
 
-#include "pathnames.h"
-#include "sudo_compat.h"
-#include "sudo_conf.h"
-#include "sudo_debug.h"
-#include "sudo_event.h"
-#include "sudo_eventlog.h"
-#include "sudo_lbuf.h"
-#include "sudo_fatal.h"
-#include "sudo_gettext.h"
-#include "sudo_iolog.h"
-#include "sudo_plugin.h"
-#include "sudo_queue.h"
-#include "sudo_util.h"
+#include <pathnames.h>
+#include <sudo_compat.h>
+#include <sudo_conf.h>
+#include <sudo_debug.h>
+#include <sudo_event.h>
+#include <sudo_eventlog.h>
+#include <sudo_lbuf.h>
+#include <sudo_fatal.h>
+#include <sudo_gettext.h>
+#include <sudo_iolog.h>
+#include <sudo_plugin.h>
+#include <sudo_queue.h>
+#include <sudo_util.h>
 
-#include "logging.h"
+#include <logging.h>
 
 struct replay_closure {
     const char *iolog_dir;
diff --git a/plugins/sudoers/testsudoers.c b/plugins/sudoers/testsudoers.c
index 399fb342e..2ebd7b459 100644
--- a/plugins/sudoers/testsudoers.c
+++ b/plugins/sudoers/testsudoers.c
@@ -37,7 +37,7 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif /* HAVE_STDBOOL_H */
 #include <string.h>
 #ifdef HAVE_STRINGS_H
@@ -46,13 +46,13 @@
 #include <unistd.h>
 #include <errno.h>
 
-#include "testsudoers_pwutil.h"
-#include "toke.h"
-#include "tsgetgrpw.h"
-#include "sudoers.h"
-#include "interfaces.h"
-#include "sudo_conf.h"
-#include "sudo_lbuf.h"
+#include <testsudoers_pwutil.h>
+#include <toke.h>
+#include <tsgetgrpw.h>
+#include <sudoers.h>
+#include <interfaces.h>
+#include <sudo_conf.h>
+#include <sudo_lbuf.h>
 #include <gram.h>
 
 #ifndef YYDEBUG
diff --git a/plugins/sudoers/testsudoers_pwutil.c b/plugins/sudoers/testsudoers_pwutil.c
index bc64d30f7..474278d39 100644
--- a/plugins/sudoers/testsudoers_pwutil.c
+++ b/plugins/sudoers/testsudoers_pwutil.c
@@ -5,6 +5,6 @@
 
 #define PWUTIL_PREFIX		testsudoers
 
-#include "testsudoers_pwutil.h"
-#include "tsgetgrpw.h"
+#include <testsudoers_pwutil.h>
+#include <tsgetgrpw.h>
 #include "pwutil_impl.c"
diff --git a/plugins/sudoers/testsudoers_pwutil.h b/plugins/sudoers/testsudoers_pwutil.h
index b87d7a6f6..a0e140f0d 100644
--- a/plugins/sudoers/testsudoers_pwutil.h
+++ b/plugins/sudoers/testsudoers_pwutil.h
@@ -24,7 +24,7 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif /* HAVE_STDBOOL_H */
 #include <grp.h>
 #include <pwd.h>
diff --git a/plugins/sudoers/timeout.c b/plugins/sudoers/timeout.c
index d7c2a2d4d..4ed168c95 100644
--- a/plugins/sudoers/timeout.c
+++ b/plugins/sudoers/timeout.c
@@ -30,9 +30,9 @@
 #include <errno.h>
 #include <limits.h>
 
-#include "sudo_compat.h"
-#include "sudoers_debug.h"
-#include "parse.h"
+#include <sudo_compat.h>
+#include <sudoers_debug.h>
+#include <parse.h>
 
 /*
  * Parse a command timeout in sudoers in the format 1d2h3m4s
diff --git a/plugins/sudoers/timestamp.c b/plugins/sudoers/timestamp.c
index 0529ae73a..20bcc2d61 100644
--- a/plugins/sudoers/timestamp.c
+++ b/plugins/sudoers/timestamp.c
@@ -41,8 +41,8 @@
 #include <pwd.h>
 #include <signal.h>
 
-#include "sudoers.h"
-#include "timestamp.h"
+#include <sudoers.h>
+#include <timestamp.h>
 
 #define TIMESTAMP_OPEN_ERROR	-1
 #define TIMESTAMP_PERM_ERROR	-2
diff --git a/plugins/sudoers/timestr.c b/plugins/sudoers/timestr.c
index 2af6f9bc3..2f32b5012 100644
--- a/plugins/sudoers/timestr.c
+++ b/plugins/sudoers/timestr.c
@@ -26,7 +26,7 @@
 
 #include <time.h>
 
-#include "sudoers.h"
+#include <sudoers.h>
 
 /*
  * Return a static buffer with the current date + time.
diff --git a/plugins/sudoers/toke.c b/plugins/sudoers/toke.c
index b44a6b22d..c24a26777 100644
--- a/plugins/sudoers/toke.c
+++ b/plugins/sudoers/toke.c
@@ -3298,11 +3298,11 @@ char *yytext;
 #include <dirent.h>
 #include <errno.h>
 #include <ctype.h>
-#include "sudoers.h"
-#include "toke.h"
+#include <sudoers.h>
+#include <toke.h>
 #include <gram.h>
-#include "sudo_digest.h"
-#include "sudo_lbuf.h"
+#include <sudo_digest.h>
+#include <sudo_lbuf.h>
 
 #if defined(HAVE_STRUCT_DIRENT_D_NAMLEN) && HAVE_STRUCT_DIRENT_D_NAMLEN
 # define NAMLEN(dirent)	(dirent)->d_namlen
diff --git a/plugins/sudoers/toke.l b/plugins/sudoers/toke.l
index d6fcb25b3..fa117acb9 100644
--- a/plugins/sudoers/toke.l
+++ b/plugins/sudoers/toke.l
@@ -38,11 +38,11 @@
 #include <dirent.h>
 #include <errno.h>
 #include <ctype.h>
-#include "sudoers.h"
-#include "toke.h"
+#include <sudoers.h>
+#include <toke.h>
 #include <gram.h>
-#include "sudo_digest.h"
-#include "sudo_lbuf.h"
+#include <sudo_digest.h>
+#include <sudo_lbuf.h>
 
 #if defined(HAVE_STRUCT_DIRENT_D_NAMLEN) && HAVE_STRUCT_DIRENT_D_NAMLEN
 # define NAMLEN(dirent)	(dirent)->d_namlen
diff --git a/plugins/sudoers/toke_util.c b/plugins/sudoers/toke_util.c
index c5295f698..7db07f848 100644
--- a/plugins/sudoers/toke_util.c
+++ b/plugins/sudoers/toke_util.c
@@ -33,8 +33,8 @@
 #include <string.h>
 #include <regex.h>
 
-#include "sudoers.h"
-#include "toke.h"
+#include <sudoers.h>
+#include <toke.h>
 #include <gram.h>
 
 static size_t arg_len = 0;
diff --git a/plugins/sudoers/tsdump.c b/plugins/sudoers/tsdump.c
index bc138c66e..d38ffc4f3 100644
--- a/plugins/sudoers/tsdump.c
+++ b/plugins/sudoers/tsdump.c
@@ -32,8 +32,8 @@
 #include <time.h>
 #include <unistd.h>
 
-#include "sudoers.h"
-#include "timestamp.h"
+#include <sudoers.h>
+#include <timestamp.h>
 
 struct timestamp_entry_common {
     unsigned short version;	/* version number */
diff --git a/plugins/sudoers/tsgetgrpw.c b/plugins/sudoers/tsgetgrpw.c
index 418f58136..2a779bae6 100644
--- a/plugins/sudoers/tsgetgrpw.c
+++ b/plugins/sudoers/tsgetgrpw.c
@@ -37,8 +37,8 @@
 #include <limits.h>
 #include <unistd.h>
 
-#include "tsgetgrpw.h"
-#include "sudoers.h"
+#include <tsgetgrpw.h>
+#include <sudoers.h>
 
 #undef GRMEM_MAX
 #define GRMEM_MAX 200
diff --git a/plugins/sudoers/unesc_str.c b/plugins/sudoers/unesc_str.c
index 2b5e24271..cd46794bf 100644
--- a/plugins/sudoers/unesc_str.c
+++ b/plugins/sudoers/unesc_str.c
@@ -25,7 +25,7 @@
 
 #include <string.h>
 
-#include "sudoers.h"
+#include <sudoers.h>
 
 /*
  * Remove backslash escape chars.
diff --git a/plugins/sudoers/visudo.c b/plugins/sudoers/visudo.c
index 8d3f2792f..77bf11734 100644
--- a/plugins/sudoers/visudo.c
+++ b/plugins/sudoers/visudo.c
@@ -60,14 +60,14 @@
 #ifdef HAVE_GETOPT_LONG
 # include <getopt.h>
 # else
-# include "compat/getopt.h"
+# include <compat/getopt.h>
 #endif /* HAVE_GETOPT_LONG */
 
-#include "sudoers.h"
-#include "interfaces.h"
-#include "redblack.h"
-#include "sudoers_version.h"
-#include "sudo_conf.h"
+#include <sudoers.h>
+#include <interfaces.h>
+#include <redblack.h>
+#include <sudoers_version.h>
+#include <sudo_conf.h>
 #include <gram.h>
 
 struct sudoersfile {
diff --git a/plugins/sudoers/visudo_cb.c b/plugins/sudoers/visudo_cb.c
index 681f7371e..8b6309ce8 100644
--- a/plugins/sudoers/visudo_cb.c
+++ b/plugins/sudoers/visudo_cb.c
@@ -23,7 +23,7 @@
 
 #include <config.h>
 
-#include "sudoers.h"
+#include <sudoers.h>
 
 /*
  * Set visudo Defaults callbacks.
diff --git a/plugins/system_group/system_group.c b/plugins/system_group/system_group.c
index c43fc0c15..bf877b604 100644
--- a/plugins/system_group/system_group.c
+++ b/plugins/system_group/system_group.c
@@ -28,7 +28,7 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif /* HAVE_STDBOOL_H */
 #include <string.h>
 #ifdef HAVE_STRINGS_H
@@ -36,10 +36,10 @@
 #endif /* HAVE_STRINGS_H */
 #include <grp.h>
 
-#include "sudo_compat.h"
-#include "sudo_dso.h"
-#include "sudo_plugin.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_dso.h>
+#include <sudo_plugin.h>
+#include <sudo_util.h>
 
 /*
  * Sudoers group plugin that does group name-based lookups using the system
diff --git a/src/apparmor.c b/src/apparmor.c
index cbfa2aa88..8ec7a85e8 100644
--- a/src/apparmor.c
+++ b/src/apparmor.c
@@ -29,8 +29,8 @@
 # include <stdlib.h>
 # include <sys/apparmor.h>
 
-# include "sudo.h"
-# include "sudo_debug.h"
+# include <sudo.h>
+# include <sudo_debug.h>
 
 /**
  * @brief Check whether AppArmor is enabled.
diff --git a/src/conversation.c b/src/conversation.c
index 76467649f..eaffc2b01 100644
--- a/src/conversation.c
+++ b/src/conversation.c
@@ -34,9 +34,9 @@
 #include <fcntl.h>
 #include <unistd.h>
 
-#include "sudo.h"
-#include "sudo_plugin.h"
-#include "sudo_plugin_int.h"
+#include <sudo.h>
+#include <sudo_plugin.h>
+#include <sudo_plugin_int.h>
 
 /*
  * Sudo conversation function.
diff --git a/src/copy_file.c b/src/copy_file.c
index 8f08ffdcb..b9b5d1da3 100644
--- a/src/copy_file.c
+++ b/src/copy_file.c
@@ -29,8 +29,8 @@
 #include <unistd.h>
 #include <errno.h>
 
-#include "sudo.h"
-#include "sudo_edit.h"
+#include <sudo.h>
+#include <sudo_edit.h>
 
 /*
  * Extend the given fd to the specified size in bytes.
diff --git a/src/edit_open.c b/src/edit_open.c
index 3745aa7a2..2fa58f554 100644
--- a/src/edit_open.c
+++ b/src/edit_open.c
@@ -34,8 +34,8 @@
 #include <pwd.h>
 #include <fcntl.h>
 
-#include "sudo.h"
-#include "sudo_edit.h"
+#include <sudo.h>
+#include <sudo_edit.h>
 
 #if defined(HAVE_SETRESUID) || defined(HAVE_SETREUID) || defined(HAVE_SETEUID)
 
diff --git a/src/env_hooks.c b/src/env_hooks.c
index 1a789047a..e840c7825 100644
--- a/src/env_hooks.c
+++ b/src/env_hooks.c
@@ -27,9 +27,9 @@
 #include <string.h>
 #include <errno.h>
 
-#include "sudo.h"
-#include "sudo_plugin.h"
-#include "sudo_dso.h"
+#include <sudo.h>
+#include <sudo_plugin.h>
+#include <sudo_dso.h>
 
 extern char **environ;		/* global environment pointer */
 static char **priv_environ;	/* private environment pointer */
diff --git a/src/exec.c b/src/exec.c
index e7bb29117..46fc8bc41 100644
--- a/src/exec.c
+++ b/src/exec.c
@@ -43,10 +43,10 @@
 # include <sys/task.h>
 #endif
 
-#include "sudo.h"
-#include "sudo_exec.h"
-#include "sudo_plugin.h"
-#include "sudo_plugin_int.h"
+#include <sudo.h>
+#include <sudo_exec.h>
+#include <sudo_plugin.h>
+#include <sudo_plugin_int.h>
 
 #ifdef HAVE_PTRACE_INTERCEPT
 static void
diff --git a/src/exec_common.c b/src/exec_common.c
index 0f05dad87..9e2d954a2 100644
--- a/src/exec_common.c
+++ b/src/exec_common.c
@@ -33,8 +33,8 @@
 #endif
 #include <errno.h>
 
-#include "sudo.h"
-#include "sudo_exec.h"
+#include <sudo.h>
+#include <sudo_exec.h>
 
 /*
  * Disable execution of child processes in the command we are about
diff --git a/src/exec_intercept.c b/src/exec_intercept.c
index d84c9d605..de9d894ba 100644
--- a/src/exec_intercept.c
+++ b/src/exec_intercept.c
@@ -39,13 +39,13 @@
 #include <fcntl.h>
 #include <limits.h>
 
-#include "sudo.h"
-#include "sudo_exec.h"
-#include "sudo_plugin.h"
-#include "sudo_plugin_int.h"
-#include "sudo_rand.h"
-#include "intercept.pb-c.h"
-#include "exec_intercept.h"
+#include <sudo.h>
+#include <sudo_exec.h>
+#include <sudo_plugin.h>
+#include <sudo_plugin_int.h>
+#include <sudo_rand.h>
+#include <intercept.pb-c.h>
+#include <exec_intercept.h>
 
 #ifdef _PATH_SUDO_INTERCEPT
 static union sudo_token_un intercept_token;
diff --git a/src/exec_iolog.c b/src/exec_iolog.c
index 143dc70fe..239fc4180 100644
--- a/src/exec_iolog.c
+++ b/src/exec_iolog.c
@@ -31,10 +31,10 @@
 #include <fcntl.h>
 #include <signal.h>
 
-#include "sudo.h"
-#include "sudo_exec.h"
-#include "sudo_plugin.h"
-#include "sudo_plugin_int.h"
+#include <sudo.h>
+#include <sudo_exec.h>
+#include <sudo_plugin.h>
+#include <sudo_plugin_int.h>
 
 int io_fds[6] = { -1, -1, -1, -1, -1, -1 };
 
diff --git a/src/exec_monitor.c b/src/exec_monitor.c
index fc3d110a0..9681e56d0 100644
--- a/src/exec_monitor.c
+++ b/src/exec_monitor.c
@@ -36,10 +36,10 @@
 #include <fcntl.h>
 #include <signal.h>
 
-#include "sudo.h"
-#include "sudo_exec.h"
-#include "sudo_plugin.h"
-#include "sudo_plugin_int.h"
+#include <sudo.h>
+#include <sudo_exec.h>
+#include <sudo_plugin.h>
+#include <sudo_plugin_int.h>
 
 struct monitor_closure {
     const struct command_details *details;
diff --git a/src/exec_nopty.c b/src/exec_nopty.c
index ffb9ac9c5..1b1ae6d55 100644
--- a/src/exec_nopty.c
+++ b/src/exec_nopty.c
@@ -42,10 +42,10 @@
 #include <signal.h>
 #include <termios.h>		/* for struct winsize on HP-UX */
 
-#include "sudo.h"
-#include "sudo_exec.h"
-#include "sudo_plugin.h"
-#include "sudo_plugin_int.h"
+#include <sudo.h>
+#include <sudo_exec.h>
+#include <sudo_plugin.h>
+#include <sudo_plugin_int.h>
 
 static void handle_sigchld_nopty(struct exec_closure *ec);
 
diff --git a/src/exec_preload.c b/src/exec_preload.c
index af5b12944..f463716a0 100644
--- a/src/exec_preload.c
+++ b/src/exec_preload.c
@@ -30,9 +30,9 @@
 #include <string.h>
 #include <unistd.h>
 
-#include "sudo.h"
-#include "sudo_exec.h"
-#include "sudo_util.h"
+#include <sudo.h>
+#include <sudo_exec.h>
+#include <sudo_util.h>
 
 #ifdef RTLD_PRELOAD_VAR
 typedef void * (*sudo_alloc_fn_t)(size_t, size_t);
diff --git a/src/exec_ptrace.c b/src/exec_ptrace.c
index a4b7ed3bb..2698cd7a9 100644
--- a/src/exec_ptrace.c
+++ b/src/exec_ptrace.c
@@ -48,15 +48,15 @@
 #elif defined(HAVE_MACHINE_ENDIAN_H)
 # include <machine/endian.h>
 #else
-# include "compat/endian.h"
+# include <compat/endian.h>
 #endif
 
-#include "sudo.h"
-#include "sudo_exec.h"
+#include <sudo.h>
+#include <sudo_exec.h>
 
 #ifdef HAVE_PTRACE_INTERCEPT
-# include "exec_intercept.h"
-# include "exec_ptrace.h"
+# include <exec_intercept.h>
+# include <exec_ptrace.h>
 
 /* We need to take care when ptracing 32-bit binaries on 64-bit kernels. */
 # ifdef __LP64__
diff --git a/src/exec_pty.c b/src/exec_pty.c
index 341b25fa5..1aa8a9b0d 100644
--- a/src/exec_pty.c
+++ b/src/exec_pty.c
@@ -43,10 +43,10 @@
 #include <signal.h>
 #include <termios.h>		/* for struct winsize on HP-UX */
 
-#include "sudo.h"
-#include "sudo_exec.h"
-#include "sudo_plugin.h"
-#include "sudo_plugin_int.h"
+#include <sudo.h>
+#include <sudo_exec.h>
+#include <sudo_plugin.h>
+#include <sudo_plugin_int.h>
 
 /* Tail queue of messages to send to the monitor. */
 struct monitor_message {
diff --git a/src/get_pty.c b/src/get_pty.c
index 7c5840c80..666a295fb 100644
--- a/src/get_pty.c
+++ b/src/get_pty.c
@@ -48,7 +48,7 @@
 # endif
 #endif
 
-#include "sudo.h"
+#include <sudo.h>
 
 #if defined(HAVE_OPENPTY)
 char *
diff --git a/src/hooks.c b/src/hooks.c
index 70ff02e58..8ef3e935e 100644
--- a/src/hooks.c
+++ b/src/hooks.c
@@ -27,9 +27,9 @@
 #include <string.h>
 #include <errno.h>
 
-#include "sudo.h"
-#include "sudo_plugin.h"
-#include "sudo_plugin_int.h"
+#include <sudo.h>
+#include <sudo_plugin.h>
+#include <sudo_plugin_int.h>
 
 /* Singly linked hook list. */
 struct sudo_hook_entry {
diff --git a/src/intercept.pb-c.c b/src/intercept.pb-c.c
index 36d11eeb8..2c58e6937 100644
--- a/src/intercept.pb-c.c
+++ b/src/intercept.pb-c.c
@@ -6,7 +6,7 @@
 #define PROTOBUF_C__NO_DEPRECATED
 #endif
 
-#include "intercept.pb-c.h"
+#include <intercept.pb-c.h>
 void   intercept_request__init
                      (InterceptRequest         *message)
 {
diff --git a/src/limits.c b/src/limits.c
index d82ac0041..2ed69c34c 100644
--- a/src/limits.c
+++ b/src/limits.c
@@ -34,7 +34,7 @@
 #include <errno.h>
 #include <limits.h>
 
-#include "sudo.h"
+#include <sudo.h>
 
 /*
  * Avoid using RLIM_INFINITY for the nofile soft limit to prevent
diff --git a/src/load_plugins.c b/src/load_plugins.c
index 5575c083b..df08b9579 100644
--- a/src/load_plugins.c
+++ b/src/load_plugins.c
@@ -29,10 +29,10 @@
 #include <string.h>
 #include <errno.h>
 
-#include "sudo.h"
-#include "sudo_plugin.h"
-#include "sudo_plugin_int.h"
-#include "sudo_dso.h"
+#include <sudo.h>
+#include <sudo_plugin.h>
+#include <sudo_plugin_int.h>
+#include <sudo_dso.h>
 
 #ifdef ENABLE_SUDO_PLUGIN_API
 static bool
diff --git a/src/openbsd.c b/src/openbsd.c
index 180a79102..72d4374a1 100644
--- a/src/openbsd.c
+++ b/src/openbsd.c
@@ -23,7 +23,7 @@
 
 #include <config.h>
 
-#include "sudo.h"
+#include <sudo.h>
 
 int
 os_init(int argc, char *argv[], char *envp[])
diff --git a/src/parse_args.c b/src/parse_args.c
index bd6c29ae5..f74738fb4 100644
--- a/src/parse_args.c
+++ b/src/parse_args.c
@@ -35,12 +35,12 @@
 #ifdef HAVE_GETOPT_LONG
 # include <getopt.h>
 # else
-# include "compat/getopt.h"
+# include <compat/getopt.h>
 #endif /* HAVE_GETOPT_LONG */
 
 #include <sudo_usage.h>
-#include "sudo.h"
-#include "sudo_lbuf.h"
+#include <sudo.h>
+#include <sudo_lbuf.h>
 
 unsigned int tgetpass_flags;
 
diff --git a/src/preload.c b/src/preload.c
index 907ebd5a8..e18cc955f 100644
--- a/src/preload.c
+++ b/src/preload.c
@@ -34,9 +34,9 @@
 # endif
 #endif
 
-#include "sudo.h"
-#include "sudo_dso.h"
-#include "sudo_plugin.h"
+#include <sudo.h>
+#include <sudo_dso.h>
+#include <sudo_plugin.h>
 
 #ifdef STATIC_SUDOERS_PLUGIN
 
diff --git a/src/preserve_fds.c b/src/preserve_fds.c
index b912d3f01..ebe4797fb 100644
--- a/src/preserve_fds.c
+++ b/src/preserve_fds.c
@@ -30,7 +30,7 @@
 #include <fcntl.h>
 #include <limits.h>
 
-#include "sudo.h"
+#include <sudo.h>
 
 /*
  * Add an fd to preserve.
diff --git a/src/regress/net_ifs/check_net_ifs.c b/src/regress/net_ifs/check_net_ifs.c
index f1551c4ff..60adcfa73 100644
--- a/src/regress/net_ifs/check_net_ifs.c
+++ b/src/regress/net_ifs/check_net_ifs.c
@@ -25,15 +25,15 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif /* HAVE_STDBOOL_H */
 #include <string.h>
 #include <unistd.h>
 #include <limits.h>
 #include <errno.h>
 
-#include "sudo_compat.h"
-#include "sudo_util.h"
+#include <sudo_compat.h>
+#include <sudo_util.h>
 
 sudo_dso_public int main(int argc, char *argv[]);
 
diff --git a/src/regress/noexec/check_noexec.c b/src/regress/noexec/check_noexec.c
index bad25e09c..a5f7ff4a0 100644
--- a/src/regress/noexec/check_noexec.c
+++ b/src/regress/noexec/check_noexec.c
@@ -25,7 +25,7 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif /* HAVE_STDBOOL_H */
 #include <string.h>
 #ifdef HAVE_WORDEXP_H
@@ -36,11 +36,11 @@
 #include <limits.h>
 #include <errno.h>
 
-#include "sudo_compat.h"
-#include "sudo_fatal.h"
-#include "sudo_util.h"
-#include "sudo_queue.h"
-#include "sudo_exec.h"
+#include <sudo_compat.h>
+#include <sudo_fatal.h>
+#include <sudo_util.h>
+#include <sudo_queue.h>
+#include <sudo_exec.h>
 
 static bool verbose;
 
diff --git a/src/regress/ttyname/check_ttyname.c b/src/regress/ttyname/check_ttyname.c
index 7efcd06df..715423d1d 100644
--- a/src/regress/ttyname/check_ttyname.c
+++ b/src/regress/ttyname/check_ttyname.c
@@ -24,7 +24,7 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif /* HAVE_STDBOOL_H */
 #include <stdlib.h>
 #include <string.h>
@@ -32,10 +32,10 @@
 #include <limits.h>
 #include <errno.h>
 
-#include "sudo_compat.h"
-#include "sudo_fatal.h"
-#include "sudo_util.h"
-#include "sudo_debug.h"
+#include <sudo_compat.h>
+#include <sudo_fatal.h>
+#include <sudo_util.h>
+#include <sudo_debug.h>
 
 sudo_dso_public int main(int argc, char *argv[]);
 
diff --git a/src/selinux.c b/src/selinux.c
index fa5d0318a..74bc571db 100644
--- a/src/selinux.c
+++ b/src/selinux.c
@@ -54,8 +54,8 @@
 # include <libaudit.h>
 #endif
 
-#include "sudo.h"
-#include "sudo_exec.h"
+#include <sudo.h>
+#include <sudo_exec.h>
 
 static struct selinux_state {
     char * old_context;
diff --git a/src/sesh.c b/src/sesh.c
index 34f168083..44faa115d 100644
--- a/src/sesh.c
+++ b/src/sesh.c
@@ -36,17 +36,17 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif /* HAVE_STDBOOL_H */
 #ifdef HAVE_GETOPT_LONG
 # include <getopt.h>
 # else
-# include "compat/getopt.h"
+# include <compat/getopt.h>
 #endif /* HAVE_GETOPT_LONG */
 
-#include "sudo.h"
-#include "sudo_exec.h"
-#include "sudo_edit.h"
+#include <sudo.h>
+#include <sudo_exec.h>
+#include <sudo_edit.h>
 
 enum sesh_mode {
     SESH_RUN_COMMAND,
diff --git a/src/signal.c b/src/signal.c
index 866b64790..59cb5f498 100644
--- a/src/signal.c
+++ b/src/signal.c
@@ -26,8 +26,8 @@
 #include <errno.h>
 #include <signal.h>
 
-#include "sudo.h"
-#include "sudo_exec.h"
+#include <sudo.h>
+#include <sudo_exec.h>
 
 static struct signal_state {
     int signo;
diff --git a/src/solaris.c b/src/solaris.c
index 754664f7f..49cc6eb75 100644
--- a/src/solaris.c
+++ b/src/solaris.c
@@ -30,8 +30,8 @@
 # include <pwd.h>
 #endif
 
-#include "sudo.h"
-#include "sudo_dso.h"
+#include <sudo.h>
+#include <sudo_dso.h>
 
 int
 os_init(int argc, char *argv[], char *envp[])
diff --git a/src/sudo.c b/src/sudo.c
index 4f3cc9fed..e597e3cd3 100644
--- a/src/sudo.c
+++ b/src/sudo.c
@@ -64,9 +64,9 @@
 # include <prot.h>
 #endif /* HAVE_GETPRPWNAM && HAVE_SET_AUTH_PARAMETERS */
 
-#include "sudo.h"
-#include "sudo_plugin.h"
-#include "sudo_plugin_int.h"
+#include <sudo.h>
+#include <sudo_plugin.h>
+#include <sudo_plugin_int.h>
 
 /*
  * Local variables
diff --git a/src/sudo.h b/src/sudo.h
index 3a6fae0d0..f38e34e49 100644
--- a/src/sudo.h
+++ b/src/sudo.h
@@ -28,21 +28,21 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif /* HAVE_STDBOOL_H */
 #ifdef HAVE_PRIV_SET
 # include <priv.h>
 #endif
 
-#include "pathnames.h"
-#include "sudo_compat.h"
-#include "sudo_conf.h"
-#include "sudo_debug.h"
-#include "sudo_event.h"
-#include "sudo_fatal.h"
-#include "sudo_gettext.h"
-#include "sudo_queue.h"
-#include "sudo_util.h"
+#include <pathnames.h>
+#include <sudo_compat.h>
+#include <sudo_conf.h>
+#include <sudo_debug.h>
+#include <sudo_event.h>
+#include <sudo_fatal.h>
+#include <sudo_gettext.h>
+#include <sudo_queue.h>
+#include <sudo_util.h>
 
 /* Enable asserts() to avoid static analyzer false positives. */
 #if !(defined(SUDO_DEVEL) || defined(__clang_analyzer__) || defined(__COVERITY__))
diff --git a/src/sudo_edit.c b/src/sudo_edit.c
index f2d9c16a0..b7f7ca5e7 100644
--- a/src/sudo_edit.c
+++ b/src/sudo_edit.c
@@ -37,9 +37,9 @@
 #include <signal.h>
 #include <fcntl.h>
 
-#include "sudo.h"
-#include "sudo_edit.h"
-#include "sudo_exec.h"
+#include <sudo.h>
+#include <sudo_edit.h>
+#include <sudo_exec.h>
 
 #if defined(HAVE_SETRESUID) || defined(HAVE_SETREUID) || defined(HAVE_SETEUID)
 
diff --git a/src/sudo_intercept.c b/src/sudo_intercept.c
index 965f27547..4eeb71cce 100644
--- a/src/sudo_intercept.c
+++ b/src/sudo_intercept.c
@@ -39,7 +39,7 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif /* HAVE_STDBOOL_H */
 #if defined(HAVE_SHL_LOAD)
 # include <dl.h>
@@ -50,10 +50,10 @@
 # include <crt_externs.h>
 #endif
 
-#include "sudo_compat.h"
-#include "sudo_debug.h"
-#include "sudo_util.h"
-#include "pathnames.h"
+#include <sudo_compat.h>
+#include <sudo_debug.h>
+#include <sudo_util.h>
+#include <pathnames.h>
 
 /* execl flavors */
 #define SUDO_EXECL	0x0
diff --git a/src/sudo_intercept_common.c b/src/sudo_intercept_common.c
index 59da6d470..730614ed0 100644
--- a/src/sudo_intercept_common.c
+++ b/src/sudo_intercept_common.c
@@ -45,20 +45,20 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #else
-# include "compat/stdbool.h"
+# include <compat/stdbool.h>
 #endif /* HAVE_STDBOOL_H */
 #ifdef HAVE_CRT_EXTERNS_H
 # include <crt_externs.h>
 #endif
 
-#include "sudo_compat.h"
-#include "sudo_conf.h"
-#include "sudo_debug.h"
-#include "sudo_exec.h"
-#include "sudo_fatal.h"
-#include "sudo_gettext.h"
-#include "sudo_util.h"
-#include "intercept.pb-c.h"
+#include <sudo_compat.h>
+#include <sudo_conf.h>
+#include <sudo_debug.h>
+#include <sudo_exec.h>
+#include <sudo_fatal.h>
+#include <sudo_gettext.h>
+#include <sudo_util.h>
+#include <intercept.pb-c.h>
 
 #ifdef HAVE__NSGETENVIRON
 # define environ (*_NSGetEnviron())
diff --git a/src/sudo_noexec.c b/src/sudo_noexec.c
index 71a36d6fe..6ba74d57e 100644
--- a/src/sudo_noexec.c
+++ b/src/sudo_noexec.c
@@ -51,8 +51,8 @@
 # include <dlfcn.h>
 #endif
 
-#include "sudo_compat.h"
-#include "pathnames.h"
+#include <sudo_compat.h>
+#include <pathnames.h>
 
 #ifdef HAVE___INTERPOSE
 /*
diff --git a/src/suspend_parent.c b/src/suspend_parent.c
index eef8542a6..af6957f87 100644
--- a/src/suspend_parent.c
+++ b/src/suspend_parent.c
@@ -30,11 +30,11 @@
 #include <fcntl.h>
 #include <signal.h>
 
-#include "pathnames.h"
-#include "sudo_debug.h"
-#include "sudo_fatal.h"
-#include "sudo_gettext.h"
-#include "sudo_exec.h"
+#include <pathnames.h>
+#include <sudo_debug.h>
+#include <sudo_fatal.h>
+#include <sudo_gettext.h>
+#include <sudo_exec.h>
 
 static volatile sig_atomic_t got_sigttou;
 
diff --git a/src/tgetpass.c b/src/tgetpass.c
index 151cc18a2..c9bc6446a 100644
--- a/src/tgetpass.c
+++ b/src/tgetpass.c
@@ -41,8 +41,8 @@
 #include <signal.h>
 #include <fcntl.h>
 
-#include "sudo.h"
-#include "sudo_plugin.h"
+#include <sudo.h>
+#include <sudo_plugin.h>
 
 enum tgetpass_errval {
     TGP_ERRVAL_NOERROR,
diff --git a/src/ttyname.c b/src/ttyname.c
index ccf4952cb..65f0875f7 100644
--- a/src/ttyname.c
+++ b/src/ttyname.c
@@ -60,7 +60,7 @@
 # include <sys/pstat.h>
 #endif
 
-#include "sudo.h"
+#include <sudo.h>
 
 /*
  * How to access the tty device number in struct kinfo_proc.
diff --git a/src/utmp.c b/src/utmp.c
index 397f329ea..7ce683d41 100644
--- a/src/utmp.c
+++ b/src/utmp.c
@@ -41,8 +41,8 @@
 #include <fcntl.h>
 #include <signal.h>
 
-#include "sudo.h"
-#include "sudo_exec.h"
+#include <sudo.h>
+#include <sudo_exec.h>
 
 /*
  * GCC 8 warns about strncpy() where the size field is the size of the buffer.