diff --git a/ChangeLog b/ChangeLog
index b256af3b2..28ee5d17e 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -97,13 +97,15 @@ New deprecations
      argument (allowing memory savings if HMAC is not used)
 
 Semi-API changes (technically public, morally private)
+   * Renamed a few headers to include _internal in the name. Those headers are
+     not supposed to be included by users.
    * Changed md_info_t into an opaque structure (use md_get_xxx() accessors).
    * Changed pk_info_t into an opaque structure.
-   * Change cipher_base_t into an opaque structure.
-   * Remove sig_oid2 and rename sig_oid1 to sig_oid in x509_crt and x509_crl.
+   * Changed cipher_base_t into an opaque structure.
+   * Removed sig_oid2 and rename sig_oid1 to sig_oid in x509_crt and x509_crl.
    * x509_crt.key_usage changed from unsigned char to unsigned int.
-   * Remove r and s from ecdsa_context
-   * Remove mode from des_context and des3_context
+   * Removed r and s from ecdsa_context
+   * Removed mode from des_context and des3_context
 
 Default behavior changes
    * The default minimum TLS version is now TLS 1.0.
diff --git a/include/mbedtls/cipher_wrap.h b/include/mbedtls/cipher_internal.h
similarity index 99%
rename from include/mbedtls/cipher_wrap.h
rename to include/mbedtls/cipher_internal.h
index 8b7fd7fee..9cab3bb13 100644
--- a/include/mbedtls/cipher_wrap.h
+++ b/include/mbedtls/cipher_internal.h
@@ -1,5 +1,5 @@
 /**
- * \file cipher_wrap.h
+ * \file cipher_internal.h
  *
  * \brief Cipher wrappers.
  *
diff --git a/include/mbedtls/md.h b/include/mbedtls/md.h
index f72dba1b3..316478870 100644
--- a/include/mbedtls/md.h
+++ b/include/mbedtls/md.h
@@ -65,7 +65,7 @@ typedef enum {
 #endif
 
 /**
- * Opaque struct defined in md_wrap.h
+ * Opaque struct defined in md_internal.h
  */
 typedef struct mbedtls_md_info_t mbedtls_md_info_t;
 
diff --git a/include/mbedtls/md_wrap.h b/include/mbedtls/md_internal.h
similarity index 99%
rename from include/mbedtls/md_wrap.h
rename to include/mbedtls/md_internal.h
index 219d0fa2c..d42dc5c0e 100644
--- a/include/mbedtls/md_wrap.h
+++ b/include/mbedtls/md_internal.h
@@ -1,5 +1,5 @@
 /**
- * \file md_wrap.h
+ * \file md_internal.h
  *
  * \brief Message digest wrappers.
  *
diff --git a/include/mbedtls/pk_wrap.h b/include/mbedtls/pk_internal.h
similarity index 100%
rename from include/mbedtls/pk_wrap.h
rename to include/mbedtls/pk_internal.h
diff --git a/library/cipher.c b/library/cipher.c
index a55857537..4e97bf121 100644
--- a/library/cipher.c
+++ b/library/cipher.c
@@ -33,7 +33,7 @@
 #if defined(MBEDTLS_CIPHER_C)
 
 #include "mbedtls/cipher.h"
-#include "mbedtls/cipher_wrap.h"
+#include "mbedtls/cipher_internal.h"
 
 #include <stdlib.h>
 #include <string.h>
diff --git a/library/cipher_wrap.c b/library/cipher_wrap.c
index be892cc3d..490f9816d 100644
--- a/library/cipher_wrap.c
+++ b/library/cipher_wrap.c
@@ -32,7 +32,7 @@
 
 #if defined(MBEDTLS_CIPHER_C)
 
-#include "mbedtls/cipher_wrap.h"
+#include "mbedtls/cipher_internal.h"
 
 #if defined(MBEDTLS_AES_C)
 #include "mbedtls/aes.h"
diff --git a/library/md.c b/library/md.c
index 5fee809bd..8359d05af 100644
--- a/library/md.c
+++ b/library/md.c
@@ -33,7 +33,7 @@
 #if defined(MBEDTLS_MD_C)
 
 #include "mbedtls/md.h"
-#include "mbedtls/md_wrap.h"
+#include "mbedtls/md_internal.h"
 
 #if defined(MBEDTLS_PLATFORM_C)
 #include "mbedtls/platform.h"
diff --git a/library/md_wrap.c b/library/md_wrap.c
index f3de45233..9a9d19109 100644
--- a/library/md_wrap.c
+++ b/library/md_wrap.c
@@ -32,7 +32,7 @@
 
 #if defined(MBEDTLS_MD_C)
 
-#include "mbedtls/md_wrap.h"
+#include "mbedtls/md_internal.h"
 
 #if defined(MBEDTLS_MD2_C)
 #include "mbedtls/md2.h"
diff --git a/library/pk.c b/library/pk.c
index ebdc0630b..9da2b777f 100644
--- a/library/pk.c
+++ b/library/pk.c
@@ -28,7 +28,7 @@
 
 #if defined(MBEDTLS_PK_C)
 #include "mbedtls/pk.h"
-#include "mbedtls/pk_wrap.h"
+#include "mbedtls/pk_internal.h"
 
 #if defined(MBEDTLS_RSA_C)
 #include "mbedtls/rsa.h"
diff --git a/library/pk_wrap.c b/library/pk_wrap.c
index b1ed2c529..7a4751167 100644
--- a/library/pk_wrap.c
+++ b/library/pk_wrap.c
@@ -27,7 +27,7 @@
 #endif
 
 #if defined(MBEDTLS_PK_C)
-#include "mbedtls/pk_wrap.h"
+#include "mbedtls/pk_internal.h"
 
 /* Even if RSA not activated, for the sake of RSA-alt */
 #include "mbedtls/rsa.h"