diff --git a/clients/wicketd-client/src/lib.rs b/clients/wicketd-client/src/lib.rs
index 53b272007a7..63e1f58a8d7 100644
--- a/clients/wicketd-client/src/lib.rs
+++ b/clients/wicketd-client/src/lib.rs
@@ -40,7 +40,7 @@ progenitor::generate_api!(
         AllowedSourceIps = omicron_common::api::internal::shared::AllowedSourceIps,
         ArtifactId = omicron_common::update::ArtifactId,
         Baseboard = sled_hardware_types::Baseboard,
-        BgpAuthKey = wicket_common::rack_setup::BgpAuthKey,
+        BgpAuthKey = wicketd_commission_types_versions::latest::rack_setup::BgpAuthKey,
         BgpAuthKeyId = wicketd_commission_types_versions::latest::rack_setup::BgpAuthKeyId,
         BgpAuthKeyInfo = wicket_common::rack_setup::BgpAuthKeyInfo,
         BgpAuthKeyStatus = wicket_common::rack_setup::BgpAuthKeyStatus,
diff --git a/wicket-common/src/rack_setup.rs b/wicket-common/src/rack_setup.rs
index 570d43f91db..65c66943bd4 100644
--- a/wicket-common/src/rack_setup.rs
+++ b/wicket-common/src/rack_setup.rs
@@ -17,6 +17,7 @@ use std::net::IpAddr;
 use std::net::Ipv6Addr;
 use tufaceous_artifact::ArtifactHash;
 use wicketd_commission_types::rack_setup::AllowedSourceIps;
+use wicketd_commission_types::rack_setup::BgpAuthKey;
 use wicketd_commission_types::rack_setup::BgpAuthKeyId;
 use wicketd_commission_types::rack_setup::IpRange;
 use wicketd_commission_types::rack_setup::UserSpecifiedRackNetworkConfig;
@@ -79,43 +80,6 @@ impl<T: fmt::Display> fmt::Display for DisplaySlice<'_, T> {
     }
 }
 
-/// Describes the actual authentication key to use with a BGP peer.
-///
-/// Currently, only TCP-MD5 authentication is supported.
-#[derive(Clone, Serialize, Deserialize, PartialEq, Eq, JsonSchema)]
-#[serde(tag = "kind", rename_all = "snake_case")]
-pub enum BgpAuthKey {
-    /// TCP-MD5 authentication.
-    TcpMd5 {
-        /// The pre-shared key.
-        key: String,
-    },
-}
-
-impl BgpAuthKey {
-    /// Returns information about the key that is safe to display in the UI.
-    pub fn info(&self) -> BgpAuthKeyInfo {
-        match self {
-            BgpAuthKey::TcpMd5 { key } => {
-                let sha256 =
-                    ArtifactHash(Sha256::digest(key.as_bytes()).into());
-                BgpAuthKeyInfo::TcpMd5 { sha256 }
-            }
-        }
-    }
-}
-
-// Ensure that the key is not displayed in debug output.
-impl fmt::Debug for BgpAuthKey {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        match self {
-            BgpAuthKey::TcpMd5 { key: _ } => {
-                f.debug_struct("TcpMd5").field("key", &"********").finish()
-            }
-        }
-    }
-}
-
 /// Describes insensitive information about a BGP authentication key.
 ///
 /// This information is considered okay to display in the UI.
@@ -142,6 +106,17 @@ pub enum BgpAuthKeyInfo {
 }
 
 impl BgpAuthKeyInfo {
+    /// Returns information about a key that is safe to display in the UI.
+    pub fn for_key(key: &BgpAuthKey) -> Self {
+        match key {
+            BgpAuthKey::TcpMd5 { key } => {
+                let sha256 =
+                    ArtifactHash(Sha256::digest(key.as_bytes()).into());
+                BgpAuthKeyInfo::TcpMd5 { sha256 }
+            }
+        }
+    }
+
     pub fn to_string_styled(&self, label_style: Style) -> String {
         match self {
             BgpAuthKeyInfo::TcpMd5 { sha256 } => {
diff --git a/wicket/src/cli/rack_setup.rs b/wicket/src/cli/rack_setup.rs
index 7bdf8b31db7..092d0384c07 100644
--- a/wicket/src/cli/rack_setup.rs
+++ b/wicket/src/cli/rack_setup.rs
@@ -26,7 +26,7 @@ use std::io::Read;
 use std::mem;
 use std::net::SocketAddrV6;
 use std::time::Duration;
-use wicket_common::rack_setup::BgpAuthKey;
+use wicket_common::rack_setup::BgpAuthKeyInfo;
 use wicket_common::rack_setup::BgpAuthKeyStatus;
 use wicket_common::rack_setup::DisplaySlice;
 use wicketd_client::types::GetBgpAuthKeyParams;
@@ -34,6 +34,7 @@ use wicketd_client::types::NewPasswordHash;
 use wicketd_client::types::PutBgpAuthKeyBody;
 use wicketd_client::types::PutRssRecoveryUserPasswordHash;
 use wicketd_client::types::SetBgpAuthKeyStatus;
+use wicketd_commission_types::rack_setup::BgpAuthKey;
 use wicketd_commission_types::rack_setup::BgpAuthKeyId;
 use wicketd_commission_types::rack_setup::CertificateUploadResponse;
 use wicketd_commission_types::rack_setup::PutRssUserConfigInsensitive;
@@ -393,7 +394,8 @@ impl SetBgpAuthKeyArgs {
                     );
 
                     let key = read_bgp_md5_key(&prompt)?;
-                    let info = key.info().to_string_styled(styles.bold);
+                    let info = BgpAuthKeyInfo::for_key(&key)
+                        .to_string_styled(styles.bold);
                     let response = client
                         .put_bgp_auth_key(&key_id, &PutBgpAuthKeyBody { key })
                         .await
diff --git a/wicketd-api/src/lib.rs b/wicketd-api/src/lib.rs
index 6dd3cc61610..54aefd67c15 100644
--- a/wicketd-api/src/lib.rs
+++ b/wicketd-api/src/lib.rs
@@ -29,16 +29,17 @@ use wicket_common::inventory::SpType;
 use wicket_common::multirack_setup::CurrentMultirackJoinUserConfig;
 use wicket_common::multirack_setup::MultirackJoinConfigBaseUserInput;
 use wicket_common::preflight_check;
-use wicket_common::rack_setup::BgpAuthKey;
 use wicket_common::rack_setup::CurrentRssUserConfigInsensitive;
 use wicket_common::rack_setup::GetBgpAuthKeyInfoResponse;
 use wicket_common::rack_update::AbortUpdateOptions;
 use wicket_common::rack_update::ClearUpdateStateOptions;
 use wicket_common::rack_update::StartUpdateOptions;
 use wicket_common::update_events::EventReport;
+use wicketd_commission_types::rack_setup::BgpAuthKey;
 use wicketd_commission_types::rack_setup::BgpAuthKeyId;
 use wicketd_commission_types::rack_setup::CertificateUploadResponse;
 use wicketd_commission_types::rack_setup::PutRssUserConfigInsensitive;
+use wicketd_commission_types::rack_setup::SetBgpAuthKeyStatus;
 use wicketd_commission_types::update::ClearUpdateStateResponse;
 use wicketd_commission_types::update::UpdateTargets;
 
@@ -436,19 +437,6 @@ pub struct PutBgpAuthKeyResponse {
     pub status: SetBgpAuthKeyStatus,
 }
 
-#[derive(Clone, Debug, Serialize, JsonSchema, PartialEq)]
-#[serde(rename_all = "snake_case")]
-pub enum SetBgpAuthKeyStatus {
-    /// The key was accepted and replaced an old key.
-    Replaced,
-
-    /// The key was accepted, and is the same as the existing key.
-    Unchanged,
-
-    /// The key was accepted and is new.
-    Added,
-}
-
 #[derive(Clone, Debug, Serialize, Deserialize, JsonSchema, PartialEq)]
 pub struct PutRssRecoveryUserPasswordHash {
     pub hash: omicron_passwords::NewPasswordHash,
diff --git a/wicketd-commission-types/versions/src/initial/rack_setup.rs b/wicketd-commission-types/versions/src/initial/rack_setup.rs
index 73ae99ee056..112e34165c6 100644
--- a/wicketd-commission-types/versions/src/initial/rack_setup.rs
+++ b/wicketd-commission-types/versions/src/initial/rack_setup.rs
@@ -496,6 +496,43 @@ impl<'de> Deserialize<'de> for UserSpecifiedRouterPeerAddr {
 )]
 pub struct BgpAuthKeyId(pub(crate) Name);
 
+/// Describes the actual authentication key to use with a BGP peer.
+///
+/// Currently, only TCP-MD5 authentication is supported.
+#[derive(Clone, Serialize, Deserialize, PartialEq, Eq, JsonSchema)]
+#[serde(tag = "kind", rename_all = "snake_case")]
+pub enum BgpAuthKey {
+    /// TCP-MD5 authentication.
+    TcpMd5 {
+        /// The pre-shared key.
+        key: String,
+    },
+}
+
+// Ensure that the key is not displayed in debug output.
+impl fmt::Debug for BgpAuthKey {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            BgpAuthKey::TcpMd5 { key: _ } => {
+                f.debug_struct("TcpMd5").field("key", &"********").finish()
+            }
+        }
+    }
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize, JsonSchema, PartialEq)]
+#[serde(rename_all = "snake_case")]
+pub enum SetBgpAuthKeyStatus {
+    /// The key was accepted and replaced an old key.
+    Replaced,
+
+    /// The key was accepted, and is the same as the existing key.
+    Unchanged,
+
+    /// The key was accepted and is new.
+    Added,
+}
+
 /// The result of uploading half of a certificate/key pair.
 #[derive(Clone, Debug, Serialize, Deserialize, JsonSchema, PartialEq)]
 #[serde(tag = "status", rename_all = "snake_case")]
diff --git a/wicketd-commission-types/versions/src/latest.rs b/wicketd-commission-types/versions/src/latest.rs
index f433d8ddcf9..c61eeaf7c75 100644
--- a/wicketd-commission-types/versions/src/latest.rs
+++ b/wicketd-commission-types/versions/src/latest.rs
@@ -6,6 +6,7 @@
 
 pub mod rack_setup {
     pub use crate::v1::rack_setup::AllowedSourceIps;
+    pub use crate::v1::rack_setup::BgpAuthKey;
     pub use crate::v1::rack_setup::BgpAuthKeyId;
     pub use crate::v1::rack_setup::BgpConfig;
     pub use crate::v1::rack_setup::CertificateUploadResponse;
@@ -23,6 +24,7 @@ pub mod rack_setup {
     pub use crate::v1::rack_setup::RouteConfig;
     pub use crate::v1::rack_setup::RouterLifetimeConfig;
     pub use crate::v1::rack_setup::RouterPeerIpAddr;
+    pub use crate::v1::rack_setup::SetBgpAuthKeyStatus;
     pub use crate::v1::rack_setup::TxEqConfig;
     pub use crate::v1::rack_setup::UplinkAddress;
     pub use crate::v1::rack_setup::UplinkIpNet;
diff --git a/wicketd/src/bgp_auth_keys.rs b/wicketd/src/bgp_auth_keys.rs
index 78cac5a54ae..a819512cb89 100644
--- a/wicketd/src/bgp_auth_keys.rs
+++ b/wicketd/src/bgp_auth_keys.rs
@@ -5,11 +5,12 @@
 use std::collections::BTreeMap;
 use std::collections::btree_map;
 use thiserror::Error;
-use wicket_common::rack_setup::BgpAuthKey;
+use wicket_common::rack_setup::BgpAuthKeyInfo;
 use wicket_common::rack_setup::BgpAuthKeyStatus;
 use wicket_common::rack_setup::DisplaySlice;
-use wicketd_api::SetBgpAuthKeyStatus;
+use wicketd_commission_types::rack_setup::BgpAuthKey;
 use wicketd_commission_types::rack_setup::BgpAuthKeyId;
+use wicketd_commission_types::rack_setup::SetBgpAuthKeyStatus;
 
 #[derive(Clone, Debug, PartialEq, Eq, Error)]
 pub(crate) enum BgpAuthKeyError {
@@ -71,7 +72,9 @@ impl BgpAuthKeys {
             .map(|(key_id, key)| {
                 let status = key
                     .as_ref()
-                    .map(|key| BgpAuthKeyStatus::Set { info: key.info() })
+                    .map(|key| BgpAuthKeyStatus::Set {
+                        info: BgpAuthKeyInfo::for_key(key),
+                    })
                     .unwrap_or(BgpAuthKeyStatus::Unset);
                 (key_id.clone(), status)
             })
diff --git a/wicketd/src/context.rs b/wicketd/src/context.rs
index 9eefaefb0b8..23c13dcee0f 100644
--- a/wicketd/src/context.rs
+++ b/wicketd/src/context.rs
@@ -35,11 +35,11 @@ use std::sync::OnceLock;
 use wicket_common::inventory::MgsV1Inventory;
 use wicket_common::inventory::SledInventory;
 use wicket_common::inventory::SpIdentifier;
-use wicket_common::rack_setup::BgpAuthKey;
 use wicket_common::rack_setup::BgpAuthKeyStatus;
 use wicket_common::rack_setup::BootstrapSledDescription;
-use wicketd_api::SetBgpAuthKeyStatus;
+use wicketd_commission_types::rack_setup::BgpAuthKey;
 use wicketd_commission_types::rack_setup::BgpAuthKeyId;
+use wicketd_commission_types::rack_setup::SetBgpAuthKeyStatus;
 
 #[derive(Default)]
 pub(crate) struct RssOrMultirackJoinConfigCommon {
diff --git a/wicketd/src/rss_config.rs b/wicketd/src/rss_config.rs
index 290fac18fbe..e19cf5e171d 100644
--- a/wicketd/src/rss_config.rs
+++ b/wicketd/src/rss_config.rs
@@ -38,11 +38,11 @@ use std::collections::BTreeMap;
 use std::net::IpAddr;
 use std::net::Ipv6Addr;
 use wicket_common::inventory::MgsV1Inventory;
-use wicket_common::rack_setup::BgpAuthKey;
 use wicket_common::rack_setup::CurrentRssUserConfigInsensitive;
 use wicket_common::rack_setup::GetBgpAuthKeyInfoResponse;
 use wicketd_api::CurrentRssUserConfig;
 use wicketd_api::CurrentRssUserConfigSensitive;
+use wicketd_commission_types::rack_setup::BgpAuthKey;
 use wicketd_commission_types::rack_setup::CertificateUploadResponse;
 use wicketd_commission_types::rack_setup::ManualPortConfig;
 use wicketd_commission_types::rack_setup::PutRssUserConfigInsensitive;
@@ -699,9 +699,10 @@ mod tests {
     use omicron_test_utils::certificates::CertificateChain;
     use omicron_test_utils::dev;
     use wicket_common::example::ExampleRackSetupData;
+    use wicket_common::rack_setup::BgpAuthKeyInfo;
     use wicket_common::rack_setup::BgpAuthKeyStatus;
-    use wicketd_api::SetBgpAuthKeyStatus;
     use wicketd_commission_types::rack_setup::BgpAuthKeyId;
+    use wicketd_commission_types::rack_setup::SetBgpAuthKeyStatus;
 
     use super::*;
 
@@ -931,7 +932,9 @@ mod tests {
             let key_data = current_config.common.get_bgp_auth_key_data();
             assert_eq!(
                 key_data.get(&key1),
-                Some(&BgpAuthKeyStatus::Set { info: shared_key.info() })
+                Some(&BgpAuthKeyStatus::Set {
+                    info: BgpAuthKeyInfo::for_key(&shared_key)
+                })
             );
         }
 
@@ -945,7 +948,9 @@ mod tests {
             let key_data = current_config.common.get_bgp_auth_key_data();
             assert_eq!(
                 key_data.get(&key1),
-                Some(&BgpAuthKeyStatus::Set { info: shared_key.info() })
+                Some(&BgpAuthKeyStatus::Set {
+                    info: BgpAuthKeyInfo::for_key(&shared_key)
+                })
             );
         }
 
@@ -959,7 +964,9 @@ mod tests {
             let key_data = current_config.common.get_bgp_auth_key_data();
             assert_eq!(
                 key_data.get(&key1),
-                Some(&BgpAuthKeyStatus::Set { info: new_key.info() })
+                Some(&BgpAuthKeyStatus::Set {
+                    info: BgpAuthKeyInfo::for_key(&new_key)
+                })
             );
         }
 
@@ -999,7 +1006,9 @@ mod tests {
 
             assert_eq!(
                 key_data.get(&key2),
-                Some(&BgpAuthKeyStatus::Set { info: shared_key.info() })
+                Some(&BgpAuthKeyStatus::Set {
+                    info: BgpAuthKeyInfo::for_key(&shared_key)
+                })
             );
         }
 
@@ -1020,7 +1029,9 @@ mod tests {
         assert_eq!(key_data.len(), 1);
         assert_eq!(
             key_data.get(&key1),
-            Some(&BgpAuthKeyStatus::Set { info: new_key.info() })
+            Some(&BgpAuthKeyStatus::Set {
+                info: BgpAuthKeyInfo::for_key(&new_key)
+            })
         );
         assert_eq!(key_data.get(&key2), None, "key2 should have been dropped",);
 
@@ -1040,7 +1051,9 @@ mod tests {
         assert_eq!(key_data.len(), 2);
         assert_eq!(
             key_data.get(&key1),
-            Some(&BgpAuthKeyStatus::Set { info: new_key.info() })
+            Some(&BgpAuthKeyStatus::Set {
+                info: BgpAuthKeyInfo::for_key(&new_key)
+            })
         );
         assert_eq!(key_data.get(&key2), Some(&BgpAuthKeyStatus::Unset));