diff --git a/lib/crates/fabro-cli/src/commands/install.rs b/lib/crates/fabro-cli/src/commands/install.rs
index e2890cb50..49ed39a30 100644
--- a/lib/crates/fabro-cli/src/commands/install.rs
+++ b/lib/crates/fabro-cli/src/commands/install.rs
@@ -18,9 +18,9 @@ use fabro_auth::{AuthCredential, AuthMethod, codex_oauth_config, credential_id_f
 use fabro_config::user::SETTINGS_CONFIG_FILENAME;
 use fabro_config::{Storage, envfile, legacy_env};
 use fabro_model::Provider;
-use fabro_util::dev_token;
 use fabro_util::printer::Printer;
 use fabro_util::terminal::Styles;
+use fabro_util::{dev_token, session_secret};
 use futures::future::BoxFuture;
 use rand::Rng;
 use tokio::io::AsyncWriteExt;
@@ -1289,7 +1289,7 @@ pub(crate) async fn run_install(
             s.dim.apply_to("Generating secrets and auth material...")
         );
 
-        let session_secret = fabro_util::session_secret::generate_session_secret();
+        let session_secret = session_secret::generate_session_secret();
         fabro_util::printerr!(
             printer,
             "  {} Session secret generated",
diff --git a/lib/crates/fabro-cli/src/commands/server/start.rs b/lib/crates/fabro-cli/src/commands/server/start.rs
index 8e04232cf..faf12708d 100644
--- a/lib/crates/fabro-cli/src/commands/server/start.rs
+++ b/lib/crates/fabro-cli/src/commands/server/start.rs
@@ -10,7 +10,7 @@ use fabro_server::serve;
 use fabro_server::serve::{DEFAULT_TCP_PORT, ServeArgs};
 use fabro_util::printer::Printer;
 use fabro_util::terminal::Styles;
-use fabro_util::{Home, dev_token};
+use fabro_util::{Home, dev_token, session_secret};
 use tokio::process::Command as TokioCommand;
 use tokio::time;
 
@@ -148,7 +148,7 @@ fn load_or_create_local_dev_token(storage_dir: &Path, home: &Home) -> Result<Str
 }
 
 fn valid_session_secret(secret: &str) -> bool {
-    fabro_util::session_secret::validate_session_secret(secret).is_ok()
+    session_secret::validate_session_secret(secret).is_ok()
 }
 
 fn load_or_create_local_session_secret(storage_dir: &Path) -> Result<String> {
@@ -169,7 +169,7 @@ fn load_or_create_local_session_secret(storage_dir: &Path) -> Result<String> {
         return Ok(secret);
     }
 
-    let secret = fabro_util::session_secret::generate_session_secret();
+    let secret = session_secret::generate_session_secret();
     envfile::merge_env_file(&server_env_path, [("SESSION_SECRET", secret.as_str())])?;
     Ok(secret)
 }
diff --git a/lib/crates/fabro-server/src/diagnostics.rs b/lib/crates/fabro-server/src/diagnostics.rs
index 5120f5294..4d0a8db8d 100644
--- a/lib/crates/fabro-server/src/diagnostics.rs
+++ b/lib/crates/fabro-server/src/diagnostics.rs
@@ -11,6 +11,7 @@ use fabro_types::settings::server::GithubIntegrationStrategy;
 use fabro_types::settings::{InterpString, ServerAuthMethod};
 use fabro_util::check_report::{CheckDetail, CheckResult, CheckSection, CheckStatus};
 use fabro_util::dev_token::validate_dev_token_format;
+use fabro_util::session_secret;
 use fabro_util::version::FABRO_VERSION;
 use regex::Regex;
 use semver::Version;
@@ -145,7 +146,7 @@ fn validate_tls_private_key(pem: &str) -> Result<(), String> {
 }
 
 fn validate_session_secret(value: &str) -> Result<(), String> {
-    fabro_util::session_secret::validate_session_secret(value)
+    session_secret::validate_session_secret(value)
 }
 
 pub async fn run_all(state: &AppState) -> DiagnosticsReport {