diff --git a/zcash_client_backend/Cargo.toml b/zcash_client_backend/Cargo.toml
index 02459135c..78cd3685c 100644
--- a/zcash_client_backend/Cargo.toml
+++ b/zcash_client_backend/Cargo.toml
@@ -17,49 +17,72 @@ rust-version = "1.56.1"
 development = ["zcash_proofs"]
 
 [dependencies]
-base64 = "0.13"
-bech32 = "0.8"
-bls12_381 = "0.7"
-bs58 = { version = "0.4", features = ["check"] }
-byteorder = { version = "1", optional = true }
-crossbeam-channel = "0.5"
-group = "0.12"
-hex = "0.4"
-hdwallet = { version = "0.3.1", optional = true }
-jubjub = "0.9"
-memuse = "0.2"
-nom = "7"
-orchard = "0.3"
-percent-encoding = "2.1.0"
-proptest = { version = "1.0.0", optional = true }
-protobuf = "~2.27.1" # MSRV 1.52.1
-rand_core = "0.6"
-rayon = "1.5"
-ripemd = { version = "0.1", optional = true }
-secp256k1 = { version = "0.21", optional = true }
-secrecy = "0.8"
-sha2 = { version = "0.10.1", optional = true }
-subtle = "2.2.3"
-time = "0.2"
-tracing = "0.1"
 zcash_address = { version = "0.2", path = "../components/zcash_address" }
 zcash_encoding = { version = "0.2", path = "../components/zcash_encoding" }
 zcash_note_encryption = { version = "0.2", path = "../components/zcash_note_encryption" }
 zcash_primitives = { version = "0.8", path = "../zcash_primitives" }
 
+# Dependencies exposed in a public API:
+# (Breaking upgrades to these require a breaking upgrade to this crate.)
+# - Data Access API
+time = "0.2"
+
+# - Encodings
+base64 = "0.13"
+bech32 = "0.8"
+bs58 = { version = "0.4", features = ["check"] }
+
+# - Errors
+hdwallet = { version = "0.3.1", optional = true }
+
+# - Logging and metrics
+memuse = "0.2"
+tracing = "0.1"
+
+# - Protobuf interfaces
+protobuf = "~2.27.1" # MSRV 1.52.1
+
+# - Secret management
+secrecy = "0.8"
+subtle = "2.2.3"
+
+# - Shielded protocols
+bls12_381 = "0.7"
+group = "0.12"
+orchard = "0.3"
+
+# - Test dependencies
+proptest = { version = "1.0.0", optional = true }
+
+# - ZIP 321
+nom = "7"
+
+# Dependencies used internally:
+# (Breaking upgrades to these are usually backwards-compatible, but check MSRVs.)
+# - Encodings
+byteorder = { version = "1", optional = true }
+percent-encoding = "2.1.0"
+
+# - Scanning
+crossbeam-channel = "0.5"
+rayon = "1.5"
+
 [build-dependencies]
 protobuf-codegen-pure = "~2.27.1" # MSRV 1.52.1
 
 [dev-dependencies]
 gumdrop = "0.8"
+hex = "0.4"
+jubjub = "0.9"
 proptest = "1.0.0"
+rand_core = "0.6"
 rand_xorshift = "0.3"
 tempfile = "3.1.0"
 zcash_proofs = { version = "0.8", path = "../zcash_proofs" }
 zcash_address = { version = "0.2", path = "../components/zcash_address", features = ["test-dependencies"] }
 
 [features]
-transparent-inputs = ["ripemd", "hdwallet", "sha2", "secp256k1", "zcash_primitives/transparent-inputs"]
+transparent-inputs = ["hdwallet", "zcash_primitives/transparent-inputs"]
 test-dependencies = [
     "proptest",
     "orchard/test-dependencies",
diff --git a/zcash_client_sqlite/Cargo.toml b/zcash_client_sqlite/Cargo.toml
index 52011a694..742d2c439 100644
--- a/zcash_client_sqlite/Cargo.toml
+++ b/zcash_client_sqlite/Cargo.toml
@@ -14,24 +14,36 @@ edition = "2021"
 rust-version = "1.56.1"
 
 [dependencies]
-bech32 = "0.8"
-bs58 = { version = "0.4", features = ["check"] }
-group = "0.12"
-hdwallet = { version = "0.3.1", optional = true }
-jubjub = "0.9"
-protobuf = "~2.27.1" # MSRV 1.52.1
-rand_core = "0.6"
-rusqlite = { version = "0.25", features = ["bundled", "time"] }
-schemer = "0.2"
-schemer-rusqlite = "0.2"
-secrecy = "0.8"
-time = "0.2"
-uuid = "1.1"
 zcash_client_backend = { version = "0.5", path = "../zcash_client_backend" }
 zcash_primitives = { version = "0.8", path = "../zcash_primitives" }
 
+# Dependencies exposed in a public API:
+# (Breaking upgrades to these require a breaking upgrade to this crate.)
+# - Errors
+bs58 = { version = "0.4", features = ["check"] }
+hdwallet = { version = "0.3.1", optional = true }
+
+# - Protobuf interfaces
+protobuf = "~2.27.1" # MSRV 1.52.1
+
+# - Secret management
+secrecy = "0.8"
+
+# - SQLite databases
+group = "0.12"
+jubjub = "0.9"
+rusqlite = { version = "0.25", features = ["bundled", "time"] }
+schemer = "0.2"
+schemer-rusqlite = "0.2"
+time = "0.2"
+uuid = "1.1"
+
+# Dependencies used internally:
+# (Breaking upgrades to these are usually backwards-compatible, but check MSRVs.)
+
 [dev-dependencies]
 proptest = "1.0.0"
+rand_core = "0.6"
 regex = "1.4"
 tempfile = "3"
 zcash_proofs = { version = "0.8", path = "../zcash_proofs" }
diff --git a/zcash_primitives/Cargo.toml b/zcash_primitives/Cargo.toml
index dc7ec2d86..7adbdc034 100644
--- a/zcash_primitives/Cargo.toml
+++ b/zcash_primitives/Cargo.toml
@@ -18,43 +18,74 @@ categories = ["cryptography::cryptocurrencies"]
 all-features = true
 
 [dependencies]
-aes = "0.7"
-bitvec = "1"
-bip0039 = { version = "0.9", features = ["std", "all-languages"] }
-blake2b_simd = "1"
-blake2s_simd = "1"
-bls12_381 = "0.7"
-bs58 = { version = "0.4", features = ["check"], optional = true }
-byteorder = "1"
-chacha20poly1305 = "0.10"
 equihash = { version = "0.2", path = "../components/equihash" }
-ff = "0.12"
-fpe = "0.5"
-group = { version = "0.12.1", features = ["wnaf-memuse"] }
-hdwallet = { version = "0.3.1", optional = true }
-hex = "0.4"
-incrementalmerkletree = "0.3"
-jubjub = "0.9"
-lazy_static = "1"
-memuse = "0.2.1"
-nonempty = "0.7"
-orchard = "0.3"
-proptest = { version = "1.0.0", optional = true }
-rand = "0.8"
-rand_core = "0.6"
-ripemd = { version = "0.1", optional = true }
-secp256k1 = { version = "0.21", optional = true }
-sha2 = "0.9"
-subtle = "2.2.3"
 zcash_address = { version = "0.2", path = "../components/zcash_address" }
 zcash_encoding = { version = "0.2", path = "../components/zcash_encoding" }
 
+# Dependencies exposed in a public API:
+# (Breaking upgrades to these require a breaking upgrade to this crate.)
+# - CSPRNG
+rand = "0.8"
+rand_core = "0.6"
+
+# - Digests (output types exposed)
+blake2b_simd = "1"
+sha2 = "0.9"
+
+# - Metrics
+memuse = "0.2.1"
+
+# - Secret management
+subtle = "2.2.3"
+
+# - Shielded protocols
+bls12_381 = "0.7"
+ff = "0.12"
+group = { version = "0.12.1", features = ["wnaf-memuse"] }
+incrementalmerkletree = "0.3"
+jubjub = "0.9"
+nonempty = "0.7"
+orchard = "0.3"
+
+# - Static constants
+lazy_static = "1"
+
+# - Test dependencies
+proptest = { version = "1.0.0", optional = true }
+
+# - Transparent inputs
+#   - `Error` type exposed
+hdwallet = { version = "0.3.1", optional = true }
+#   - `SecretKey` and `PublicKey` types exposed
+secp256k1 = { version = "0.21", optional = true }
+
+# - ZIP 339
+bip0039 = { version = "0.9", features = ["std", "all-languages"] }
+
+# Dependencies used internally:
+# (Breaking upgrades to these are usually backwards-compatible, but check MSRVs.)
+# - Encodings
+byteorder = "1"
+hex = "0.4"
+
+# - Shielded protocols
+bitvec = "1"
+blake2s_simd = "1"
+
+# - Transparent inputs
+ripemd = { version = "0.1", optional = true }
+
+# - ZIP 32
+aes = "0.7"
+fpe = "0.5"
+
 [dependencies.zcash_note_encryption]
 version = "0.2"
 path = "../components/zcash_note_encryption"
 features = ["pre-zip-212"]
 
 [dev-dependencies]
+chacha20poly1305 = "0.10"
 criterion = "0.3"
 proptest = "1.0.0"
 rand_xorshift = "0.3"
@@ -64,7 +95,7 @@ orchard = { version = "0.3", features = ["test-dependencies"] }
 pprof = { version = "0.9", features = ["criterion", "flamegraph"] } # MSRV 1.56
 
 [features]
-transparent-inputs = ["bs58", "hdwallet", "ripemd", "secp256k1"]
+transparent-inputs = ["hdwallet", "ripemd", "secp256k1"]
 test-dependencies = ["proptest", "orchard/test-dependencies"]
 zfuture = []
 
diff --git a/zcash_proofs/Cargo.toml b/zcash_proofs/Cargo.toml
index 5302cabbf..7c2286f5c 100644
--- a/zcash_proofs/Cargo.toml
+++ b/zcash_proofs/Cargo.toml
@@ -17,22 +17,28 @@ categories = ["cryptography::cryptocurrencies"]
 all-features = true
 
 [dependencies]
+zcash_primitives = { version = "0.8", path = "../zcash_primitives" }
+
+# Dependencies exposed in a public API:
+# (Breaking upgrades to these require a breaking upgrade to this crate.)
 bellman = { version = "0.13.1", default-features = false, features = ["groth16"] }
-blake2b_simd = "1"
 bls12_381 = "0.7"
-byteorder = "1"
-directories = { version = "4", optional = true }
 group = "0.12"
 jubjub = "0.9"
 lazy_static = "1"
 minreq = { version = "2", features = ["https"], optional = true }
 rand_core = "0.6"
-redjubjub = "0.5"
 tracing = "0.1"
+
+# Dependencies used internally:
+# (Breaking upgrades to these are usually backwards-compatible, but check MSRVs.)
+blake2b_simd = "1"
+directories = { version = "4", optional = true }
+redjubjub = "0.5"
 wagyu-zcash-parameters = { version = "0.2", optional = true }
-zcash_primitives = { version = "0.8", path = "../zcash_primitives" }
 
 [dev-dependencies]
+byteorder = "1"
 criterion = "0.3"
 rand_xorshift = "0.3"