diff --git a/src/aacs/mod.rs b/src/aacs/mod.rs
index 49088b9..3bad209 100644
--- a/src/aacs/mod.rs
+++ b/src/aacs/mod.rs
@@ -50,10 +50,19 @@ pub const PATH_MKB_RW: &str = "/AACS/MKB_RW.inf";
 pub const PATH_CONTENT_CERT: &str = "/AACS/Content000.cer";
 pub const PATH_CONTENT_CERT_ALT: &str = "/AACS/Content001.cer";
 
-// No facade: the module structure IS the public API. Consumers import from the
-// owning module directly — e.g. `aacs::content::decrypt_unit`, `aacs::mkb::MkbType`,
-// `aacs::derive::derive_vuk`, `aacs::boil::mk_from_dk`, `aacs::resolve::resolve_keys_v2`.
+// The module structure IS the public API — consumers import from the owning
+// module directly (e.g. `aacs::content::decrypt_unit`, `aacs::mkb::MkbType`,
+// `aacs::derive::derive_vuk`, `aacs::boil::mk_from_dk`, `aacs::resolve::resolve_keys_v2`).
 // The `derive::probe` reproduction harness stays reachable via its module path.
+//
+// A small set of flat re-exports is kept for the typed key primitives and the
+// content-decrypt entry points that downstream key-source crates import through
+// the `aacs::` path. These are the stable, load-bearing names; keeping them here
+// lets those crates track the module refactor without a lockstep re-pin.
+pub use boil::{MediaKey, UnitKey, Vid, Vuk, mk_from_dk, mk_from_pk, uk_from_vuk, vuk_from_mk};
+pub use content::{ALIGNED_UNIT_LEN, decrypt_unit_try_keys};
+pub use derive::derive_vuk;
+pub use types::{DeviceKey, HostCert};
 
 #[cfg(test)]
 mod tests {