diff --git a/.github/workflows/_ci-clients.yml b/.github/workflows/_ci-clients.yml
index cd78b35505..a8f2882f04 100644
--- a/.github/workflows/_ci-clients.yml
+++ b/.github/workflows/_ci-clients.yml
@@ -140,6 +140,12 @@ jobs:
         run: swift build -c release --package-path mobile/ios/BuzzPushKit
       - name: Test
         run: swift test --package-path mobile/ios/BuzzPushKit
+      - name: Verify app and extension can import BuzzPushKit without private C modules
+        run: |
+          consumer=$(mktemp -d)
+          trap 'rm -rf "$consumer"' EXIT
+          printf 'import BuzzPushKit\n' > "$consumer/main.swift"
+          swiftc -typecheck -I "$(swift build --package-path mobile/ios/BuzzPushKit --show-bin-path)" "$consumer/main.swift"
       - name: Test native pagination geometry
         run: /bin/bash scripts/test-mobile-pagination.sh
       - name: Trust pinned Swift source-copy plugin
diff --git a/mobile/ios/BuzzPushKit/Sources/BuzzPushKit/NostrHTTPAuth.swift b/mobile/ios/BuzzPushKit/Sources/BuzzPushKit/NostrHTTPAuth.swift
index 3912370456..5e4240c3ae 100644
--- a/mobile/ios/BuzzPushKit/Sources/BuzzPushKit/NostrHTTPAuth.swift
+++ b/mobile/ios/BuzzPushKit/Sources/BuzzPushKit/NostrHTTPAuth.swift
@@ -1,6 +1,7 @@
 import CryptoKit
 import Foundation
-import P256K
+// Keep the private crypto implementation out of app/extension module imports.
+@_implementationOnly import P256K
 
 public enum NostrHTTPAuthError: Error, Equatable {
     case invalidHex