diff --git a/system/acl.go b/internal/system/acl.go
similarity index 98%
rename from system/acl.go
rename to internal/system/acl.go
index c89a478..854e812 100644
--- a/system/acl.go
+++ b/internal/system/acl.go
@@ -8,7 +8,7 @@ import (
 
 	"hakurei.app/container/check"
 	"hakurei.app/hst"
-	"hakurei.app/system/acl"
+	"hakurei.app/internal/system/acl"
 )
 
 // UpdatePerm calls UpdatePermType with the [Process] criteria.
diff --git a/system/acl/acl.go b/internal/system/acl/acl.go
similarity index 100%
rename from system/acl/acl.go
rename to internal/system/acl/acl.go
diff --git a/system/acl/acl_test.go b/internal/system/acl/acl_test.go
similarity index 99%
rename from system/acl/acl_test.go
rename to internal/system/acl/acl_test.go
index c6c3e56..b0dd58d 100644
--- a/system/acl/acl_test.go
+++ b/internal/system/acl/acl_test.go
@@ -13,7 +13,7 @@ import (
 	"strconv"
 	"testing"
 
-	"hakurei.app/system/acl"
+	"hakurei.app/internal/system/acl"
 )
 
 const testFileName = "acl.test"
diff --git a/system/acl/libacl-helper.c b/internal/system/acl/libacl-helper.c
similarity index 100%
rename from system/acl/libacl-helper.c
rename to internal/system/acl/libacl-helper.c
diff --git a/system/acl/libacl-helper.go b/internal/system/acl/libacl-helper.go
similarity index 100%
rename from system/acl/libacl-helper.go
rename to internal/system/acl/libacl-helper.go
diff --git a/system/acl/libacl-helper.h b/internal/system/acl/libacl-helper.h
similarity index 100%
rename from system/acl/libacl-helper.h
rename to internal/system/acl/libacl-helper.h
diff --git a/system/acl/libacl-helper_test.go b/internal/system/acl/libacl-helper_test.go
similarity index 100%
rename from system/acl/libacl-helper_test.go
rename to internal/system/acl/libacl-helper_test.go
diff --git a/system/acl/perms.go b/internal/system/acl/perms.go
similarity index 100%
rename from system/acl/perms.go
rename to internal/system/acl/perms.go
diff --git a/system/acl/perms_test.go b/internal/system/acl/perms_test.go
similarity index 95%
rename from system/acl/perms_test.go
rename to internal/system/acl/perms_test.go
index 16b282a..3d5e3df 100644
--- a/system/acl/perms_test.go
+++ b/internal/system/acl/perms_test.go
@@ -3,7 +3,7 @@ package acl_test
 import (
 	"testing"
 
-	"hakurei.app/system/acl"
+	"hakurei.app/internal/system/acl"
 )
 
 func TestPerms(t *testing.T) {
diff --git a/system/acl_test.go b/internal/system/acl_test.go
similarity index 99%
rename from system/acl_test.go
rename to internal/system/acl_test.go
index 2202d95..1fc3b1a 100644
--- a/system/acl_test.go
+++ b/internal/system/acl_test.go
@@ -7,7 +7,7 @@ import (
 
 	"hakurei.app/container/stub"
 	"hakurei.app/hst"
-	"hakurei.app/system/acl"
+	"hakurei.app/internal/system/acl"
 )
 
 func TestACLUpdateOp(t *testing.T) {
diff --git a/system/dbus.go b/internal/system/dbus.go
similarity index 99%
rename from system/dbus.go
rename to internal/system/dbus.go
index 424f9df..b9021b8 100644
--- a/system/dbus.go
+++ b/internal/system/dbus.go
@@ -13,7 +13,7 @@ import (
 
 	"hakurei.app/container"
 	"hakurei.app/hst"
-	"hakurei.app/system/dbus"
+	"hakurei.app/internal/system/dbus"
 )
 
 // ErrDBusConfig is returned when a required [hst.BusConfig] argument is nil.
diff --git a/system/dbus/address.go b/internal/system/dbus/address.go
similarity index 100%
rename from system/dbus/address.go
rename to internal/system/dbus/address.go
diff --git a/system/dbus/address_escape_test.go b/internal/system/dbus/address_escape_test.go
similarity index 100%
rename from system/dbus/address_escape_test.go
rename to internal/system/dbus/address_escape_test.go
diff --git a/system/dbus/address_test.go b/internal/system/dbus/address_test.go
similarity index 98%
rename from system/dbus/address_test.go
rename to internal/system/dbus/address_test.go
index 5de9053..9ed4821 100644
--- a/system/dbus/address_test.go
+++ b/internal/system/dbus/address_test.go
@@ -5,7 +5,7 @@ import (
 	"reflect"
 	"testing"
 
-	"hakurei.app/system/dbus"
+	"hakurei.app/internal/system/dbus"
 )
 
 func TestParse(t *testing.T) {
diff --git a/system/dbus/config.go b/internal/system/dbus/config.go
similarity index 100%
rename from system/dbus/config.go
rename to internal/system/dbus/config.go
diff --git a/system/dbus/config_test.go b/internal/system/dbus/config_test.go
similarity index 98%
rename from system/dbus/config_test.go
rename to internal/system/dbus/config_test.go
index 644c766..dec4cb1 100644
--- a/system/dbus/config_test.go
+++ b/internal/system/dbus/config_test.go
@@ -7,7 +7,7 @@ import (
 	"testing"
 
 	"hakurei.app/hst"
-	"hakurei.app/system/dbus"
+	"hakurei.app/internal/system/dbus"
 )
 
 func TestConfigArgs(t *testing.T) {
diff --git a/system/dbus/dbus.go b/internal/system/dbus/dbus.go
similarity index 100%
rename from system/dbus/dbus.go
rename to internal/system/dbus/dbus.go
diff --git a/system/dbus/dbus_test.go b/internal/system/dbus/dbus_test.go
similarity index 99%
rename from system/dbus/dbus_test.go
rename to internal/system/dbus/dbus_test.go
index 3a9af57..9fc2b53 100644
--- a/system/dbus/dbus_test.go
+++ b/internal/system/dbus/dbus_test.go
@@ -12,8 +12,8 @@ import (
 	"time"
 
 	"hakurei.app/internal/helper"
+	"hakurei.app/internal/system/dbus"
 	"hakurei.app/message"
-	"hakurei.app/system/dbus"
 )
 
 func TestFinalise(t *testing.T) {
diff --git a/system/dbus/export_test.go b/internal/system/dbus/export_test.go
similarity index 100%
rename from system/dbus/export_test.go
rename to internal/system/dbus/export_test.go
diff --git a/system/dbus/proc.go b/internal/system/dbus/proc.go
similarity index 100%
rename from system/dbus/proc.go
rename to internal/system/dbus/proc.go
diff --git a/system/dbus/proc_test.go b/internal/system/dbus/proc_test.go
similarity index 100%
rename from system/dbus/proc_test.go
rename to internal/system/dbus/proc_test.go
diff --git a/system/dbus/proxy.go b/internal/system/dbus/proxy.go
similarity index 100%
rename from system/dbus/proxy.go
rename to internal/system/dbus/proxy.go
diff --git a/system/dbus/samples_test.go b/internal/system/dbus/samples_test.go
similarity index 100%
rename from system/dbus/samples_test.go
rename to internal/system/dbus/samples_test.go
diff --git a/system/dbus/testdata/dev.vencord.Vesktop.json b/internal/system/dbus/testdata/dev.vencord.Vesktop.json
similarity index 100%
rename from system/dbus/testdata/dev.vencord.Vesktop.json
rename to internal/system/dbus/testdata/dev.vencord.Vesktop.json
diff --git a/system/dbus/testdata/org.chromium.Chromium+.json b/internal/system/dbus/testdata/org.chromium.Chromium+.json
similarity index 100%
rename from system/dbus/testdata/org.chromium.Chromium+.json
rename to internal/system/dbus/testdata/org.chromium.Chromium+.json
diff --git a/system/dbus/testdata/org.chromium.Chromium.json b/internal/system/dbus/testdata/org.chromium.Chromium.json
similarity index 100%
rename from system/dbus/testdata/org.chromium.Chromium.json
rename to internal/system/dbus/testdata/org.chromium.Chromium.json
diff --git a/system/dbus/testdata/uk.gensokyo.CrashTestDummy.json b/internal/system/dbus/testdata/uk.gensokyo.CrashTestDummy.json
similarity index 100%
rename from system/dbus/testdata/uk.gensokyo.CrashTestDummy.json
rename to internal/system/dbus/testdata/uk.gensokyo.CrashTestDummy.json
diff --git a/system/dbus_test.go b/internal/system/dbus_test.go
similarity index 99%
rename from system/dbus_test.go
rename to internal/system/dbus_test.go
index eedb233..f79c848 100644
--- a/system/dbus_test.go
+++ b/internal/system/dbus_test.go
@@ -12,7 +12,7 @@ import (
 	"hakurei.app/container/stub"
 	"hakurei.app/hst"
 	"hakurei.app/internal/helper"
-	"hakurei.app/system/dbus"
+	"hakurei.app/internal/system/dbus"
 )
 
 func TestDBusProxyOp(t *testing.T) {
diff --git a/system/dispatcher.go b/internal/system/dispatcher.go
similarity index 96%
rename from system/dispatcher.go
rename to internal/system/dispatcher.go
index cdc9507..86aebca 100644
--- a/system/dispatcher.go
+++ b/internal/system/dispatcher.go
@@ -7,9 +7,9 @@ import (
 	"os"
 
 	"hakurei.app/hst"
-	"hakurei.app/system/acl"
-	"hakurei.app/system/dbus"
-	"hakurei.app/system/internal/xcb"
+	"hakurei.app/internal/system/acl"
+	"hakurei.app/internal/system/dbus"
+	"hakurei.app/internal/system/xcb"
 )
 
 type osFile interface {
diff --git a/system/dispatcher_test.go b/internal/system/dispatcher_test.go
similarity index 98%
rename from system/dispatcher_test.go
rename to internal/system/dispatcher_test.go
index fd6e5d0..8000f0c 100644
--- a/system/dispatcher_test.go
+++ b/internal/system/dispatcher_test.go
@@ -10,9 +10,9 @@ import (
 
 	"hakurei.app/container/stub"
 	"hakurei.app/hst"
-	"hakurei.app/system/acl"
-	"hakurei.app/system/dbus"
-	"hakurei.app/system/internal/xcb"
+	"hakurei.app/internal/system/acl"
+	"hakurei.app/internal/system/dbus"
+	"hakurei.app/internal/system/xcb"
 )
 
 // call initialises a [stub.Call].
diff --git a/system/link.go b/internal/system/link.go
similarity index 100%
rename from system/link.go
rename to internal/system/link.go
diff --git a/system/link_test.go b/internal/system/link_test.go
similarity index 100%
rename from system/link_test.go
rename to internal/system/link_test.go
diff --git a/system/mkdir.go b/internal/system/mkdir.go
similarity index 100%
rename from system/mkdir.go
rename to internal/system/mkdir.go
diff --git a/system/mkdir_test.go b/internal/system/mkdir_test.go
similarity index 100%
rename from system/mkdir_test.go
rename to internal/system/mkdir_test.go
diff --git a/system/output.go b/internal/system/output.go
similarity index 100%
rename from system/output.go
rename to internal/system/output.go
diff --git a/system/output_test.go b/internal/system/output_test.go
similarity index 100%
rename from system/output_test.go
rename to internal/system/output_test.go
diff --git a/system/system.go b/internal/system/system.go
similarity index 98%
rename from system/system.go
rename to internal/system/system.go
index cadaab0..f518975 100644
--- a/system/system.go
+++ b/internal/system/system.go
@@ -44,7 +44,7 @@ type Op interface {
 	String() string
 }
 
-// TypeString extends [Enablement.String] to support [User] and [Process].
+// TypeString extends [hst.Enablement.String] to support [User] and [Process].
 func TypeString(e hst.Enablement) string {
 	switch e {
 	case User:
diff --git a/system/system_test.go b/internal/system/system_test.go
similarity index 99%
rename from system/system_test.go
rename to internal/system/system_test.go
index 83df9de..b0773b0 100644
--- a/system/system_test.go
+++ b/internal/system/system_test.go
@@ -11,8 +11,8 @@ import (
 	"hakurei.app/container/check"
 	"hakurei.app/container/stub"
 	"hakurei.app/hst"
+	"hakurei.app/internal/system/xcb"
 	"hakurei.app/message"
-	"hakurei.app/system/internal/xcb"
 )
 
 func TestCriteria(t *testing.T) {
diff --git a/system/wayland.go b/internal/system/wayland.go
similarity index 96%
rename from system/wayland.go
rename to internal/system/wayland.go
index bb144d8..8883148 100644
--- a/system/wayland.go
+++ b/internal/system/wayland.go
@@ -7,8 +7,8 @@ import (
 
 	"hakurei.app/container/check"
 	"hakurei.app/hst"
-	"hakurei.app/system/acl"
-	"hakurei.app/system/wayland"
+	"hakurei.app/internal/system/acl"
+	"hakurei.app/internal/system/wayland"
 )
 
 type waylandConn interface {
diff --git a/system/wayland/conn.go b/internal/system/wayland/conn.go
similarity index 97%
rename from system/wayland/conn.go
rename to internal/system/wayland/conn.go
index 86e0a28..c55fe70 100644
--- a/system/wayland/conn.go
+++ b/internal/system/wayland/conn.go
@@ -1,4 +1,3 @@
-// Package wayland implements Wayland security_context_v1 protocol.
 package wayland
 
 import (
diff --git a/system/wayland/security-context-v1-protocol.c b/internal/system/wayland/security-context-v1-protocol.c
similarity index 100%
rename from system/wayland/security-context-v1-protocol.c
rename to internal/system/wayland/security-context-v1-protocol.c
diff --git a/system/wayland/security-context-v1-protocol.h b/internal/system/wayland/security-context-v1-protocol.h
similarity index 100%
rename from system/wayland/security-context-v1-protocol.h
rename to internal/system/wayland/security-context-v1-protocol.h
diff --git a/system/wayland/wayland-client-helper.c b/internal/system/wayland/wayland-client-helper.c
similarity index 100%
rename from system/wayland/wayland-client-helper.c
rename to internal/system/wayland/wayland-client-helper.c
diff --git a/system/wayland/wayland-client-helper.h b/internal/system/wayland/wayland-client-helper.h
similarity index 100%
rename from system/wayland/wayland-client-helper.h
rename to internal/system/wayland/wayland-client-helper.h
diff --git a/system/wayland/wayland.go b/internal/system/wayland/wayland.go
similarity index 56%
rename from system/wayland/wayland.go
rename to internal/system/wayland/wayland.go
index 2aa1fe1..7a8694c 100644
--- a/system/wayland/wayland.go
+++ b/internal/system/wayland/wayland.go
@@ -1,3 +1,4 @@
+// Package wayland implements Wayland security_context_v1 protocol.
 package wayland
 
 //go:generate sh -c "wayland-scanner client-header `pkg-config --variable=datarootdir wayland-protocols`/wayland-protocols/staging/security-context/security-context-v1.xml security-context-v1-protocol.h"
@@ -13,10 +14,21 @@ import "C"
 import (
 	"errors"
 	"strings"
+	"syscall"
 )
 
-var (
-	ErrContainsNull = errors.New("string contains null character")
+const (
+	// Display contains the name of the server socket
+	// (https://gitlab.freedesktop.org/wayland/wayland/-/blob/1.23.1/src/wayland-client.c#L1147)
+	// which is concatenated with XDG_RUNTIME_DIR
+	// (https://gitlab.freedesktop.org/wayland/wayland/-/blob/1.23.1/src/wayland-client.c#L1171)
+	// or used as-is if absolute
+	// (https://gitlab.freedesktop.org/wayland/wayland/-/blob/1.23.1/src/wayland-client.c#L1176).
+	Display = "WAYLAND_DISPLAY"
+
+	// FallbackName is used as the wayland socket name if WAYLAND_DISPLAY is unset
+	// (https://gitlab.freedesktop.org/wayland/wayland/-/blob/1.23.1/src/wayland-client.c#L1149).
+	FallbackName = "wayland-0"
 )
 
 var resErr = [...]error{
@@ -27,10 +39,10 @@ var resErr = [...]error{
 
 func bindWaylandFd(socketPath string, fd uintptr, appID, instanceID string, syncFd uintptr) error {
 	if hasNull(appID) || hasNull(instanceID) {
-		return ErrContainsNull
+		return syscall.EINVAL
 	}
 	res := C.hakurei_bind_wayland_fd(C.CString(socketPath), C.int(fd), C.CString(appID), C.CString(instanceID), C.int(syncFd))
 	return resErr[int32(res)]
 }
 
-func hasNull(s string) bool { return strings.IndexByte(s, '\x00') > -1 }
+func hasNull(s string) bool { return strings.IndexByte(s, 0) > -1 }
diff --git a/system/wayland_test.go b/internal/system/wayland_test.go
similarity index 99%
rename from system/wayland_test.go
rename to internal/system/wayland_test.go
index 6805b0c..083c8ba 100644
--- a/system/wayland_test.go
+++ b/internal/system/wayland_test.go
@@ -6,8 +6,8 @@ import (
 	"testing"
 
 	"hakurei.app/container/stub"
-	"hakurei.app/system/acl"
-	"hakurei.app/system/wayland"
+	"hakurei.app/internal/system/acl"
+	"hakurei.app/internal/system/wayland"
 )
 
 type stubWaylandConn struct {
diff --git a/system/internal/xcb/changehosts.go b/internal/system/xcb/changehosts.go
similarity index 100%
rename from system/internal/xcb/changehosts.go
rename to internal/system/xcb/changehosts.go
diff --git a/system/internal/xcb/xcb.go b/internal/system/xcb/xcb.go
similarity index 100%
rename from system/internal/xcb/xcb.go
rename to internal/system/xcb/xcb.go
diff --git a/system/xhost.go b/internal/system/xhost.go
similarity index 97%
rename from system/xhost.go
rename to internal/system/xhost.go
index 9a547f4..27e60c2 100644
--- a/system/xhost.go
+++ b/internal/system/xhost.go
@@ -2,7 +2,7 @@ package system
 
 import (
 	"hakurei.app/hst"
-	"hakurei.app/system/internal/xcb"
+	"hakurei.app/internal/system/xcb"
 )
 
 // ChangeHosts inserts the target user into X11 hosts and deletes it once its [Enablement] is no longer satisfied.
diff --git a/system/xhost_test.go b/internal/system/xhost_test.go
similarity index 98%
rename from system/xhost_test.go
rename to internal/system/xhost_test.go
index 759f753..853da65 100644
--- a/system/xhost_test.go
+++ b/internal/system/xhost_test.go
@@ -5,7 +5,7 @@ import (
 
 	"hakurei.app/container/stub"
 	"hakurei.app/hst"
-	"hakurei.app/system/internal/xcb"
+	"hakurei.app/internal/system/xcb"
 )
 
 func TestXHostOp(t *testing.T) {
diff --git a/system/acl/deprecated.go b/system/acl/deprecated.go
new file mode 100644
index 0000000..4119057
--- /dev/null
+++ b/system/acl/deprecated.go
@@ -0,0 +1,25 @@
+// Package acl exposes the internal/system/acl package.
+//
+// Deprecated: This package will be removed in 0.4.
+package acl
+
+import (
+	_ "unsafe" // for go:linkname
+
+	"hakurei.app/internal/system/acl"
+)
+
+type Perm = acl.Perm
+
+const (
+	Read    = acl.Read
+	Write   = acl.Write
+	Execute = acl.Execute
+)
+
+// Update replaces ACL_USER entry with qualifier uid.
+//
+//go:linkname Update hakurei.app/internal/system/acl.Update
+func Update(name string, uid int, perms ...Perm) error
+
+type Perms = acl.Perms
diff --git a/system/dbus/deprecated.go b/system/dbus/deprecated.go
new file mode 100644
index 0000000..67a309c
--- /dev/null
+++ b/system/dbus/deprecated.go
@@ -0,0 +1,115 @@
+// Package dbus exposes the internal/system/dbus package.
+//
+// Deprecated: This package will be removed in 0.4.
+package dbus
+
+import (
+	"context"
+	"io"
+	_ "unsafe" // for go:linkname
+
+	"hakurei.app/hst"
+	"hakurei.app/internal/system/dbus"
+	"hakurei.app/message"
+)
+
+type AddrEntry = dbus.AddrEntry
+
+// EqualAddrEntries returns whether two slices of [AddrEntry] are equal.
+//
+//go:linkname EqualAddrEntries hakurei.app/internal/system/dbus.EqualAddrEntries
+func EqualAddrEntries(entries, target []AddrEntry) bool
+
+// Parse parses D-Bus address according to
+// https://dbus.freedesktop.org/doc/dbus-specification.html#addresses
+//
+//go:linkname Parse hakurei.app/internal/system/dbus.Parse
+func Parse(addr []byte) ([]AddrEntry, error)
+
+type ParseError = dbus.ParseError
+
+const (
+	ErrNoColon         = dbus.ErrNoColon
+	ErrBadPairSep      = dbus.ErrBadPairSep
+	ErrBadPairKey      = dbus.ErrBadPairKey
+	ErrBadPairVal      = dbus.ErrBadPairVal
+	ErrBadValLength    = dbus.ErrBadValLength
+	ErrBadValByte      = dbus.ErrBadValByte
+	ErrBadValHexLength = dbus.ErrBadValHexLength
+	ErrBadValHexByte   = dbus.ErrBadValHexByte
+)
+
+type BadAddressError = dbus.BadAddressError
+
+// ProxyPair is an upstream dbus address and a downstream socket path.
+type ProxyPair = dbus.ProxyPair
+
+// Args returns the xdg-dbus-proxy arguments equivalent of [hst.BusConfig].
+//
+//go:linkname Args hakurei.app/internal/system/dbus.Args
+func Args(c *hst.BusConfig, bus ProxyPair) (args []string)
+
+// NewConfig returns the address of a new [hst.BusConfig] with optional defaults.
+//
+//go:linkname NewConfig hakurei.app/internal/system/dbus.NewConfig
+func NewConfig(id string, defaults, mpris bool) *hst.BusConfig
+
+const (
+	/*
+		SessionBusAddress is the name of the environment variable where the address of the login session message bus is given in.
+
+		If that variable is not set, applications may also try to read the address from the X Window System root window property _DBUS_SESSION_BUS_ADDRESS.
+		The root window property must have type STRING. The environment variable should have precedence over the root window property.
+
+		The address of the login session message bus is given in the DBUS_SESSION_BUS_ADDRESS environment variable.
+		If DBUS_SESSION_BUS_ADDRESS is not set, or if it's set to the string "autolaunch:",
+		the system should use platform-specific methods of locating a running D-Bus session server,
+		or starting one if a running instance cannot be found.
+		Note that this mechanism is not recommended for attempting to determine if a daemon is running.
+		It is inherently racy to attempt to make this determination, since the bus daemon may be started just before or just after the determination is made.
+		Therefore, it is recommended that applications do not try to make this determination for their functionality purposes, and instead they should attempt to start the server.
+
+		This package diverges from the specification, as the caller is unlikely to be an X client, or be in a position to autolaunch a dbus server.
+		So a fallback address with a socket located in the well-known default XDG_RUNTIME_DIR formatting is used.
+	*/
+	SessionBusAddress = dbus.SessionBusAddress
+
+	/*
+		SystemBusAddress is the name of the environment variable where the address of the system message bus is given in.
+
+		If that variable is not set, applications should try to connect to the well-known address unix:path=/var/run/dbus/system_bus_socket.
+		Implementations of the well-known system bus should listen on an address that will result in that connection being successful.
+	*/
+	SystemBusAddress = dbus.SystemBusAddress
+
+	// FallbackSystemBusAddress is used when [SystemBusAddress] is not set.
+	FallbackSystemBusAddress = dbus.FallbackSystemBusAddress
+)
+
+// Address returns the session and system bus addresses copied from environment,
+// or appropriate fallback values if they are not set.
+//
+//go:linkname Address hakurei.app/internal/system/dbus.Address
+func Address() (session, system string)
+
+// ProxyName is the file name or path to the proxy program.
+// Overriding ProxyName will only affect Proxy instance created after the change.
+//
+//go:linkname ProxyName hakurei.app/internal/system/dbus.ProxyName
+var ProxyName string
+
+// Proxy holds the state of a xdg-dbus-proxy process, and should never be copied.
+type Proxy = dbus.Proxy
+
+// Final describes the outcome of a proxy configuration.
+type Final = dbus.Final
+
+// Finalise creates a checked argument writer for [Proxy].
+//
+//go:linkname Finalise hakurei.app/internal/system/dbus.Finalise
+func Finalise(sessionBus, systemBus ProxyPair, session, system *hst.BusConfig) (final *Final, err error)
+
+// New returns a new instance of [Proxy].
+//
+//go:linkname New hakurei.app/internal/system/dbus.New
+func New(ctx context.Context, msg message.Msg, final *Final, output io.Writer) *Proxy
diff --git a/system/deprecated.go b/system/deprecated.go
new file mode 100644
index 0000000..3f0a423
--- /dev/null
+++ b/system/deprecated.go
@@ -0,0 +1,50 @@
+// Package system exposes the internal/system package.
+//
+// Deprecated: This package will be removed in 0.4.
+package system
+
+import (
+	"context"
+	_ "unsafe" // for go:linkname
+
+	"hakurei.app/hst"
+	"hakurei.app/internal/system"
+	"hakurei.app/message"
+)
+
+// ErrDBusConfig is returned when a required hst.BusConfig argument is nil.
+//
+//go:linkname ErrDBusConfig hakurei.app/internal/system.ErrDBusConfig
+var ErrDBusConfig error
+
+// OpError is returned by [I.Commit] and [I.Revert].
+type OpError = system.OpError
+
+const (
+	// User type is reverted at final instance exit.
+	User = system.User
+	// Process type is unconditionally reverted on exit.
+	Process = system.Process
+
+	CM = system.CM
+)
+
+// Criteria specifies types of Op to revert.
+type Criteria = system.Criteria
+
+// Op is a reversible system operation.
+type Op = system.Op
+
+// TypeString extends [Enablement.String] to support [User] and [Process].
+//
+//go:linkname TypeString hakurei.app/internal/system.TypeString
+func TypeString(e hst.Enablement) string
+
+// New returns the address of a new [I] targeting uid.
+//
+//go:linkname New hakurei.app/internal/system.New
+func New(ctx context.Context, msg message.Msg, uid int) (sys *I)
+
+// An I provides deferred operating system interaction. [I] must not be copied.
+// Methods of [I] must not be used concurrently.
+type I = system.I
diff --git a/system/wayland/consts.go b/system/wayland/deprecated.go
similarity index 63%
rename from system/wayland/consts.go
rename to system/wayland/deprecated.go
index 672e639..bf364d9 100644
--- a/system/wayland/consts.go
+++ b/system/wayland/deprecated.go
@@ -1,5 +1,17 @@
+// Package wayland exposes the internal/system/wayland package.
+//
+// Deprecated: This package will be removed in 0.4.
 package wayland
 
+import (
+	_ "unsafe" // for go:linkname
+
+	"hakurei.app/internal/system/wayland"
+)
+
+// Conn represents a connection to the wayland display server.
+type Conn = wayland.Conn
+
 const (
 	// WaylandDisplay contains the name of the server socket
 	// (https://gitlab.freedesktop.org/wayland/wayland/-/blob/1.23.1/src/wayland-client.c#L1147)
@@ -7,9 +19,9 @@ const (
 	// (https://gitlab.freedesktop.org/wayland/wayland/-/blob/1.23.1/src/wayland-client.c#L1171)
 	// or used as-is if absolute
 	// (https://gitlab.freedesktop.org/wayland/wayland/-/blob/1.23.1/src/wayland-client.c#L1176).
-	WaylandDisplay = "WAYLAND_DISPLAY"
+	WaylandDisplay = wayland.Display
 
 	// FallbackName is used as the wayland socket name if WAYLAND_DISPLAY is unset
 	// (https://gitlab.freedesktop.org/wayland/wayland/-/blob/1.23.1/src/wayland-client.c#L1149).
-	FallbackName = "wayland-0"
+	FallbackName = wayland.FallbackName
 )