diff --git a/src/crypto/hpke/hpke_test.cc b/src/crypto/hpke/hpke_test.cc
index ce68adc60..2e22e335f 100644
--- a/src/crypto/hpke/hpke_test.cc
+++ b/src/crypto/hpke/hpke_test.cc
@@ -34,7 +34,7 @@
 #include "../test/test_util.h"
 
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 namespace {
 
 const decltype(&EVP_hpke_aes_128_gcm) kAllAEADs[] = {
@@ -635,5 +635,4 @@ TEST(HPKETest, InternalParseIntSafe) {
   ASSERT_FALSE(ParseIntSafe(&u16, "65536"));
 }
 
-
-}  // namespace bssl
+BSSL_NAMESPACE_END
diff --git a/src/include/openssl/pki/certificate.h b/src/include/openssl/pki/certificate.h
index 782a70a62..9fc6e7b5f 100644
--- a/src/include/openssl/pki/certificate.h
+++ b/src/include/openssl/pki/certificate.h
@@ -22,7 +22,7 @@
 #include <openssl/base.h>
 #include <openssl/span.h>
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 struct CertificateInternals;
 
@@ -78,6 +78,6 @@ class OPENSSL_EXPORT Certificate {
   std::unique_ptr<CertificateInternals> internals_;
 };
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
 
 #endif  // OPENSSL_HEADER_BSSL_PKI_CERTIFICATE_H_ && __cplusplus
diff --git a/src/include/openssl/pki/signature_verify_cache.h b/src/include/openssl/pki/signature_verify_cache.h
index ae7376563..706888375 100644
--- a/src/include/openssl/pki/signature_verify_cache.h
+++ b/src/include/openssl/pki/signature_verify_cache.h
@@ -8,7 +8,7 @@
 #include <openssl/base.h>
 #include <string>
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 class OPENSSL_EXPORT SignatureVerifyCache {
  public:
@@ -36,6 +36,6 @@ class OPENSSL_EXPORT SignatureVerifyCache {
   virtual Value Check(const std::string &key) = 0;
 };
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_PKI_SIGNATURE_VERIFY_CACHE_H_ && __cplusplus
diff --git a/src/include/openssl/pki/verify.h b/src/include/openssl/pki/verify.h
index 0c1b551ba..06ca1af86 100644
--- a/src/include/openssl/pki/verify.h
+++ b/src/include/openssl/pki/verify.h
@@ -10,7 +10,8 @@
 #include <openssl/pki/signature_verify_cache.h>
 #include <openssl/pki/verify_error.h>
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
+
 class CertIssuerSourceStatic;
 class TrustStoreInMemory;
 class CertificateVerifyOptions;
@@ -165,6 +166,6 @@ OPENSSL_EXPORT std::optional<std::vector<std::string>> CertificateVerify(
 OPENSSL_EXPORT std::optional<std::vector<std::vector<std::string>>>
 CertificateVerifyAllPaths(const CertificateVerifyOptions &opts);
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_VERIFY_H_
diff --git a/src/include/openssl/pki/verify_error.h b/src/include/openssl/pki/verify_error.h
index 34b5dc5f1..6bfb826ab 100644
--- a/src/include/openssl/pki/verify_error.h
+++ b/src/include/openssl/pki/verify_error.h
@@ -15,10 +15,11 @@
 #if !defined(OPENSSL_HEADER_BSSL_PKI_VERIFY_ERROR_H_) && defined(__cplusplus)
 #define OPENSSL_HEADER_BSSL_PKI_VERIFY_ERROR_H_
 
-#include <string>
-#include <string_view>
+#include <openssl/base.h>
 
-namespace bssl {
+#include <string>
+
+BSSL_NAMESPACE_BEGIN
 
 // VerifyError describes certificate chain validation result.
 class OPENSSL_EXPORT VerifyError {
@@ -132,6 +133,6 @@ class OPENSSL_EXPORT VerifyError {
   std::string diagnostic_;
 };
 
-} // namespace bssl
+BSSL_NAMESPACE_END
 
 #endif  // OPENSSL_HEADER_BSSL_PKI_VERIFY_ERROR_H_
diff --git a/src/include/openssl/service_indicator.h b/src/include/openssl/service_indicator.h
index 33b38b23e..e426e056f 100644
--- a/src/include/openssl/service_indicator.h
+++ b/src/include/openssl/service_indicator.h
@@ -56,7 +56,7 @@ extern "C++" {
     return func;                                                \
   }()
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 enum class FIPSStatus {
   NOT_APPROVED = 0,
@@ -87,7 +87,7 @@ class FIPSIndicatorHelper {
   const uint64_t before_;
 };
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
 }  // extern "C++"
 
 #endif  // !BORINGSSL_NO_CXX
diff --git a/src/pki/cert_error_id.cc b/src/pki/cert_error_id.cc
index 81add1d38..6c041d929 100644
--- a/src/pki/cert_error_id.cc
+++ b/src/pki/cert_error_id.cc
@@ -4,11 +4,11 @@
 
 #include "cert_error_id.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 const char *CertErrorIdToDebugString(CertErrorId id) {
   // The CertErrorId is simply a pointer for a C-string literal.
   return reinterpret_cast<const char *>(id);
 }
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
diff --git a/src/pki/cert_error_id.h b/src/pki/cert_error_id.h
index d325b1bcc..6f71a86b6 100644
--- a/src/pki/cert_error_id.h
+++ b/src/pki/cert_error_id.h
@@ -7,7 +7,7 @@
 
 #include <openssl/base.h>
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 // Each "class" of certificate error/warning has its own unique ID. This is
 // essentially like an error code, however the value is not stable. Under the
@@ -32,6 +32,6 @@ using CertErrorId = const void *;
 // string literal given to DEFINE_CERT_ERROR_ID(), which is human-readable.
 OPENSSL_EXPORT const char *CertErrorIdToDebugString(CertErrorId id);
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_PKI_CERT_ERROR_ID_H_
diff --git a/src/pki/cert_error_params.cc b/src/pki/cert_error_params.cc
index dd962c43f..e258e9875 100644
--- a/src/pki/cert_error_params.cc
+++ b/src/pki/cert_error_params.cc
@@ -11,7 +11,7 @@
 #include "input.h"
 #include "string_util.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace {
 
@@ -132,4 +132,4 @@ OPENSSL_EXPORT std::unique_ptr<CertErrorParams> CreateCertErrorParams2SizeT(
   return std::make_unique<CertErrorParams2SizeT>(name1, value1, name2, value2);
 }
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
diff --git a/src/pki/cert_error_params.h b/src/pki/cert_error_params.h
index c4077824d..d960435ee 100644
--- a/src/pki/cert_error_params.h
+++ b/src/pki/cert_error_params.h
@@ -10,7 +10,7 @@
 
 #include <openssl/base.h>
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace der {
 class Input;
@@ -54,6 +54,6 @@ OPENSSL_EXPORT std::unique_ptr<CertErrorParams> CreateCertErrorParams1SizeT(
 OPENSSL_EXPORT std::unique_ptr<CertErrorParams> CreateCertErrorParams2SizeT(
     const char *name1, size_t value1, const char *name2, size_t value2);
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_PKI_CERT_ERROR_PARAMS_H_
diff --git a/src/pki/cert_errors.cc b/src/pki/cert_errors.cc
index f54903eac..8bd7084a9 100644
--- a/src/pki/cert_errors.cc
+++ b/src/pki/cert_errors.cc
@@ -10,7 +10,7 @@
 
 #include <sstream>
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace {
 
@@ -232,4 +232,4 @@ std::string CertPathErrors::ToDebugString(
   return result.str();
 }
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
diff --git a/src/pki/cert_errors.h b/src/pki/cert_errors.h
index 43ea7fcdd..23b88ba6d 100644
--- a/src/pki/cert_errors.h
+++ b/src/pki/cert_errors.h
@@ -54,7 +54,7 @@
 #include "cert_error_id.h"
 #include "parsed_certificate.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 class CertErrorParams;
 class CertPathErrors;
@@ -176,6 +176,6 @@ class OPENSSL_EXPORT CertPathErrors {
   CertErrors other_errors_;
 };
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_PKI_CERT_ERRORS_H_
diff --git a/src/pki/cert_issuer_source.h b/src/pki/cert_issuer_source.h
index 7de0fa460..cffad9db9 100644
--- a/src/pki/cert_issuer_source.h
+++ b/src/pki/cert_issuer_source.h
@@ -12,7 +12,7 @@
 
 #include "parsed_certificate.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 // Interface for looking up issuers of a certificate during path building.
 // Provides a synchronous and asynchronous method for retrieving issuers, so the
@@ -63,6 +63,6 @@ class OPENSSL_EXPORT CertIssuerSource {
                                  std::unique_ptr<Request> *out_req) = 0;
 };
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_PKI_CERT_ISSUER_SOURCE_H_
diff --git a/src/pki/cert_issuer_source_static.cc b/src/pki/cert_issuer_source_static.cc
index 162b8de40..1c15594df 100644
--- a/src/pki/cert_issuer_source_static.cc
+++ b/src/pki/cert_issuer_source_static.cc
@@ -4,7 +4,7 @@
 
 #include "cert_issuer_source_static.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 CertIssuerSourceStatic::CertIssuerSourceStatic() = default;
 CertIssuerSourceStatic::~CertIssuerSourceStatic() = default;
@@ -42,4 +42,4 @@ void CertIssuerSourceStatic::AsyncGetIssuersOf(
   out_req->reset();
 }
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
diff --git a/src/pki/cert_issuer_source_static.h b/src/pki/cert_issuer_source_static.h
index a0395efb8..a0e11a07e 100644
--- a/src/pki/cert_issuer_source_static.h
+++ b/src/pki/cert_issuer_source_static.h
@@ -12,7 +12,7 @@
 
 #include "cert_issuer_source.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 // Synchronously returns issuers from a pre-supplied set.
 class OPENSSL_EXPORT CertIssuerSourceStatic : public CertIssuerSource {
@@ -50,6 +50,6 @@ class OPENSSL_EXPORT CertIssuerSourceStatic : public CertIssuerSource {
       intermediates_;
 };
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_PKI_CERT_ISSUER_SOURCE_STATIC_H_
diff --git a/src/pki/cert_issuer_source_static_unittest.cc b/src/pki/cert_issuer_source_static_unittest.cc
index 8b0a36c63..39ba2a8b3 100644
--- a/src/pki/cert_issuer_source_static_unittest.cc
+++ b/src/pki/cert_issuer_source_static_unittest.cc
@@ -9,7 +9,7 @@
 #include "cert_issuer_source_sync_unittest.h"
 #include "parsed_certificate.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace {
 
@@ -72,4 +72,4 @@ TEST(CertIssuerSourceStaticTest, AddCertsGetCertsAndClear) {
 
 }  // namespace
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
diff --git a/src/pki/cert_issuer_source_sync_unittest.h b/src/pki/cert_issuer_source_sync_unittest.h
index c9e25c11a..d00bd63d4 100644
--- a/src/pki/cert_issuer_source_sync_unittest.h
+++ b/src/pki/cert_issuer_source_sync_unittest.h
@@ -13,7 +13,7 @@
 #include "cert_issuer_source.h"
 #include "test_helpers.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace {
 
@@ -211,6 +211,6 @@ TYPED_TEST_P(CertIssuerSourceSyncNotNormalizedTest,
 REGISTER_TYPED_TEST_SUITE_P(CertIssuerSourceSyncNotNormalizedTest,
                             OneMatchWithoutNormalization);
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_PKI_CERT_ISSUER_SOURCE_SYNC_UNITTEST_H_
diff --git a/src/pki/certificate.cc b/src/pki/certificate.cc
index db1c62701..5cb746c3e 100644
--- a/src/pki/certificate.cc
+++ b/src/pki/certificate.cc
@@ -24,7 +24,7 @@
 #include "pem.h"
 #include "parse_values.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace {
 
@@ -114,4 +114,4 @@ bssl::Span<const uint8_t> Certificate::GetSerialNumber() const {
   return internals_->cert->tbs().serial_number;
 }
 
-}  // namespace boringssl
+BSSL_NAMESPACE_END
diff --git a/src/pki/certificate_policies.cc b/src/pki/certificate_policies.cc
index 198e3480b..70536b86b 100644
--- a/src/pki/certificate_policies.cc
+++ b/src/pki/certificate_policies.cc
@@ -13,7 +13,7 @@
 #include "parse_values.h"
 #include "parser.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace {
 
@@ -388,4 +388,4 @@ bool ParsePolicyMappings(der::Input policy_mappings_tlv,
   return true;
 }
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
diff --git a/src/pki/certificate_policies.h b/src/pki/certificate_policies.h
index ccba1e97e..a6c736880 100644
--- a/src/pki/certificate_policies.h
+++ b/src/pki/certificate_policies.h
@@ -12,7 +12,7 @@
 #include <optional>
 #include "input.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 class CertErrors;
 
@@ -123,6 +123,6 @@ struct ParsedPolicyMapping {
 [[nodiscard]] OPENSSL_EXPORT bool ParsePolicyMappings(
     der::Input policy_mappings_tlv, std::vector<ParsedPolicyMapping> *mappings);
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_PKI_CERTIFICATE_POLICIES_H_
diff --git a/src/pki/certificate_policies_unittest.cc b/src/pki/certificate_policies_unittest.cc
index 9458659d8..f66b74815 100644
--- a/src/pki/certificate_policies_unittest.cc
+++ b/src/pki/certificate_policies_unittest.cc
@@ -9,7 +9,7 @@
 #include "parser.h"
 #include "test_helpers.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 namespace {
 
 ::testing::AssertionResult LoadTestData(const std::string &name,
@@ -309,4 +309,4 @@ TEST(ParseCertificatePoliciesExtensionTest, TwoPoliciesWithQualifiers) {
 // parsed_certificate_unittest.cc
 
 }  // namespace
-}  // namespace bssl
+BSSL_NAMESPACE_END
diff --git a/src/pki/common_cert_errors.cc b/src/pki/common_cert_errors.cc
index 00f574399..0e6ad0f93 100644
--- a/src/pki/common_cert_errors.cc
+++ b/src/pki/common_cert_errors.cc
@@ -4,7 +4,8 @@
 
 #include "common_cert_errors.h"
 
-namespace bssl::cert_errors {
+BSSL_NAMESPACE_BEGIN
+namespace cert_errors {
 
 DEFINE_CERT_ERROR_ID(kInternalError, "Internal error");
 DEFINE_CERT_ERROR_ID(kValidityFailedNotAfter, "Time is after notAfter");
@@ -79,4 +80,5 @@ DEFINE_CERT_ERROR_ID(kDeadlineExceeded, "Deadline exceeded");
 DEFINE_CERT_ERROR_ID(kIterationLimitExceeded, "Iteration limit exceeded");
 DEFINE_CERT_ERROR_ID(kDepthLimitExceeded, "Depth limit exceeded");
 
-}  // namespace bssl::cert_errors
+}  // namespace cert_errors
+BSSL_NAMESPACE_END
diff --git a/src/pki/common_cert_errors.h b/src/pki/common_cert_errors.h
index d2b37ba35..81d67f088 100644
--- a/src/pki/common_cert_errors.h
+++ b/src/pki/common_cert_errors.h
@@ -13,7 +13,8 @@
 // defined by the core verification/path building code).
 //
 // Errors may be defined for other domains.
-namespace bssl::cert_errors {
+BSSL_NAMESPACE_BEGIN
+namespace cert_errors {
 
 // An internal error occurred which prevented path building or verification
 // from finishing.
@@ -155,6 +156,7 @@ OPENSSL_EXPORT extern const CertErrorId kIterationLimitExceeded;
 // Depth limit was reached during path building.
 OPENSSL_EXPORT extern const CertErrorId kDepthLimitExceeded;
 
-}  // namespace bssl::cert_errors
+}  // namespace cert_errors
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_PKI_COMMON_CERT_ERRORS_H_
diff --git a/src/pki/crl.cc b/src/pki/crl.cc
index 63e1cc6d9..70ab07a4f 100644
--- a/src/pki/crl.cc
+++ b/src/pki/crl.cc
@@ -18,7 +18,7 @@
 #include "verify_name_match.h"
 #include "verify_signed_data.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace {
 
@@ -670,4 +670,4 @@ CRLRevocationStatus CheckCRL(std::string_view raw_crl,
   return CRLRevocationStatus::UNKNOWN;
 }
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
diff --git a/src/pki/crl.h b/src/pki/crl.h
index d527de940..2fd3b2f62 100644
--- a/src/pki/crl.h
+++ b/src/pki/crl.h
@@ -14,7 +14,7 @@
 #include "parse_values.h"
 #include "parsed_certificate.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 struct ParsedCrlTbsCertList;
 struct ParsedDistributionPoint;
@@ -215,6 +215,6 @@ GetCRLStatusForCert(der::Input cert_serial, CrlVersion crl_version,
     size_t target_cert_index, const ParsedDistributionPoint &cert_dp,
     int64_t verify_time_epoch_seconds, std::optional<int64_t> max_age_seconds);
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_PKI_CRL_H_
diff --git a/src/pki/crl_unittest.cc b/src/pki/crl_unittest.cc
index b9be70fc0..f8f26d2e4 100644
--- a/src/pki/crl_unittest.cc
+++ b/src/pki/crl_unittest.cc
@@ -13,7 +13,7 @@
 #include "string_util.h"
 #include "test_helpers.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace {
 
@@ -205,4 +205,4 @@ TEST_P(CheckCRLTest, FromFile) {
 
 }  // namespace
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
diff --git a/src/pki/encode_values.cc b/src/pki/encode_values.cc
index 0054fa28f..b2dbb8392 100644
--- a/src/pki/encode_values.cc
+++ b/src/pki/encode_values.cc
@@ -8,7 +8,8 @@
 
 #include <openssl/posix_time.h>
 
-namespace bssl::der {
+BSSL_NAMESPACE_BEGIN
+namespace der {
 
 namespace {
 
@@ -104,4 +105,5 @@ bool EncodeUTCTime(const GeneralizedTime &time, uint8_t out[kUTCTimeLength]) {
   return true;
 }
 
-}  // namespace bssl::der
+}  // namespace der
+BSSL_NAMESPACE_END
diff --git a/src/pki/encode_values.h b/src/pki/encode_values.h
index 030c864d5..f175eeb9d 100644
--- a/src/pki/encode_values.h
+++ b/src/pki/encode_values.h
@@ -10,7 +10,8 @@
 
 #include <openssl/base.h>
 
-namespace bssl::der {
+BSSL_NAMESPACE_BEGIN
+namespace der {
 
 struct GeneralizedTime;
 
@@ -40,6 +41,7 @@ static const size_t kUTCTimeLength = 13;
 OPENSSL_EXPORT bool EncodeUTCTime(const GeneralizedTime &time,
                                   uint8_t out[kUTCTimeLength]);
 
-}  // namespace bssl::der
+}  // namespace der
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_DER_ENCODE_VALUES_H_
diff --git a/src/pki/encode_values_unittest.cc b/src/pki/encode_values_unittest.cc
index e0a78205f..2e60a4310 100644
--- a/src/pki/encode_values_unittest.cc
+++ b/src/pki/encode_values_unittest.cc
@@ -9,7 +9,8 @@
 #include <gtest/gtest.h>
 #include "parse_values.h"
 
-namespace bssl::der::test {
+BSSL_NAMESPACE_BEGIN
+namespace der::test {
 
 namespace {
 
@@ -166,4 +167,5 @@ TEST(EncodeValuesTest, EncodeUTCTime) {
   EXPECT_FALSE(EncodeUTCTime(time, out));
 }
 
-}  // namespace bssl::der::test
+}  // namespace der::test
+BSSL_NAMESPACE_END
diff --git a/src/pki/extended_key_usage.cc b/src/pki/extended_key_usage.cc
index 1aeeb6a12..a3bb1d418 100644
--- a/src/pki/extended_key_usage.cc
+++ b/src/pki/extended_key_usage.cc
@@ -9,7 +9,7 @@
 #include "input.h"
 #include "parser.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 bool ParseEKUExtension(der::Input extension_value,
                        std::vector<der::Input> *eku_oids) {
@@ -42,4 +42,4 @@ bool ParseEKUExtension(der::Input extension_value,
   return true;
 }
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
diff --git a/src/pki/extended_key_usage.h b/src/pki/extended_key_usage.h
index c78f15703..63f937a4e 100644
--- a/src/pki/extended_key_usage.h
+++ b/src/pki/extended_key_usage.h
@@ -11,7 +11,7 @@
 
 #include "input.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 // The arc for the anyExtendedKeyUsage OID is found under the id-ce arc,
 // defined in section 4.2.1 of RFC 5280:
@@ -78,6 +78,6 @@ inline constexpr uint8_t kOCSPSigning[] = {0x2b, 0x06, 0x01, 0x05,
 OPENSSL_EXPORT bool ParseEKUExtension(der::Input extension_value,
                                       std::vector<der::Input> *eku_oids);
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_PKI_EXTENDED_KEY_USAGE_H_
diff --git a/src/pki/extended_key_usage_unittest.cc b/src/pki/extended_key_usage_unittest.cc
index b5229a1a6..b65b49de3 100644
--- a/src/pki/extended_key_usage_unittest.cc
+++ b/src/pki/extended_key_usage_unittest.cc
@@ -8,7 +8,7 @@
 #include "extended_key_usage.h"
 #include "input.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace {
 
@@ -164,4 +164,4 @@ TEST(ExtendedKeyUsageTest, EmptyExtension) {
 
 }  // namespace
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
diff --git a/src/pki/general_names.cc b/src/pki/general_names.cc
index c446287b3..f88efbb23 100644
--- a/src/pki/general_names.cc
+++ b/src/pki/general_names.cc
@@ -17,7 +17,7 @@
 #include "parser.h"
 #include "string_util.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 DEFINE_CERT_ERROR_ID(kFailedParsingGeneralName, "Failed parsing GeneralName");
 
@@ -216,4 +216,4 @@ std::unique_ptr<GeneralNames> GeneralNames::CreateFromValue(
   return true;
 }
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
diff --git a/src/pki/general_names.h b/src/pki/general_names.h
index 838a2d721..701927eb6 100644
--- a/src/pki/general_names.h
+++ b/src/pki/general_names.h
@@ -14,7 +14,7 @@
 
 #include "cert_error_id.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 class CertErrors;
 
@@ -126,6 +126,6 @@ struct OPENSSL_EXPORT GeneralNames {
     GeneralNames::ParseGeneralNameIPAddressType ip_address_type,
     GeneralNames *subtrees, CertErrors *errors);
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_PKI_GENERAL_NAMES_H_
diff --git a/src/pki/general_names_unittest.cc b/src/pki/general_names_unittest.cc
index be508a25a..1836c98cc 100644
--- a/src/pki/general_names_unittest.cc
+++ b/src/pki/general_names_unittest.cc
@@ -7,7 +7,7 @@
 #include <gtest/gtest.h>
 #include "test_helpers.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 namespace {
 
 ::testing::AssertionResult LoadTestData(const char *token,
@@ -223,4 +223,4 @@ TEST(GeneralNames, RegisteredIDs) {
   EXPECT_EQ(der::Input(expected_der), general_names->registered_ids[0]);
 }
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
diff --git a/src/pki/input.cc b/src/pki/input.cc
index 2f5a8b162..f68ece200 100644
--- a/src/pki/input.cc
+++ b/src/pki/input.cc
@@ -4,9 +4,8 @@
 
 #include "input.h"
 
-#include <openssl/base.h>
-
-namespace bssl::der {
+BSSL_NAMESPACE_BEGIN
+namespace der {
 
 std::string Input::AsString() const { return std::string(AsStringView()); }
 
@@ -42,4 +41,5 @@ void ByteReader::Advance(size_t len) {
   data_ = data_.subspan(len);
 }
 
-}  // namespace bssl::der
+}  // namespace der
+BSSL_NAMESPACE_END
diff --git a/src/pki/input.h b/src/pki/input.h
index 15bdbd62e..9337d387d 100644
--- a/src/pki/input.h
+++ b/src/pki/input.h
@@ -22,9 +22,11 @@
 
 #if defined(__cpp_lib_ranges) && __cpp_lib_ranges >= 201911L
 #include <ranges>
-namespace bssl::der {
+BSSL_NAMESPACE_BEGIN
+namespace der {
 class OPENSSL_EXPORT Input;
 }
+BSSL_NAMESPACE_END
 
 // Mark `Input` as satisfying the `view` and `borrowed_range` concepts. This
 // should be done before the definition of `Input`, so that any inlined calls to
@@ -36,7 +38,8 @@ inline constexpr bool std::ranges::enable_borrowed_range<bssl::der::Input> =
     true;
 #endif
 
-namespace bssl::der {
+BSSL_NAMESPACE_BEGIN
+namespace der {
 
 // An opaque class that represents a fixed buffer of data of a fixed length,
 // to be used as an input to other operations. An Input object does not own
@@ -188,6 +191,7 @@ class OPENSSL_EXPORT ByteReader {
   bssl::Span<const uint8_t> data_;
 };
 
-}  // namespace bssl::der
+}  // namespace der
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_DER_INPUT_H_
diff --git a/src/pki/input_unittest.cc b/src/pki/input_unittest.cc
index 655a8087a..6aa009d7f 100644
--- a/src/pki/input_unittest.cc
+++ b/src/pki/input_unittest.cc
@@ -6,7 +6,8 @@
 
 #include <gtest/gtest.h>
 
-namespace bssl::der::test {
+BSSL_NAMESPACE_BEGIN
+namespace der::test {
 
 constexpr uint8_t kInput[] = {'t', 'e', 's', 't'};
 const uint8_t kInput2[] = {'t', 'e', 'a', 'l'};
@@ -104,4 +105,5 @@ TEST(ByteReaderTest, HasMore) {
   ASSERT_FALSE(reader.HasMore());
 }
 
-}  // namespace bssl::der::test
+}  // namespace der::test
+BSSL_NAMESPACE_END
diff --git a/src/pki/ip_util.cc b/src/pki/ip_util.cc
index 663669ee1..d4996b6a2 100644
--- a/src/pki/ip_util.cc
+++ b/src/pki/ip_util.cc
@@ -4,7 +4,7 @@
 
 #include "ip_util.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 bool IsValidNetmask(der::Input mask) {
   if (mask.size() != kIPv4AddressSize && mask.size() != kIPv6AddressSize) {
@@ -46,4 +46,4 @@ bool IPAddressMatchesWithNetmask(der::Input addr1, der::Input addr2,
   return true;
 }
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
diff --git a/src/pki/ip_util.h b/src/pki/ip_util.h
index 3bcc7dff7..22f27bf36 100644
--- a/src/pki/ip_util.h
+++ b/src/pki/ip_util.h
@@ -9,7 +9,7 @@
 
 #include "input.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 inline constexpr size_t kIPv4AddressSize = 4;
 inline constexpr size_t kIPv6AddressSize = 16;
@@ -24,6 +24,6 @@ OPENSSL_EXPORT bool IPAddressMatchesWithNetmask(der::Input addr1,
                                                 der::Input addr2,
                                                 der::Input mask);
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_PKI_IP_UTIL_H_
diff --git a/src/pki/ip_util_unittest.cc b/src/pki/ip_util_unittest.cc
index 268a92415..251006ced 100644
--- a/src/pki/ip_util_unittest.cc
+++ b/src/pki/ip_util_unittest.cc
@@ -9,7 +9,7 @@
 #include <gtest/gtest.h>
 #include "input.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 TEST(IPUtilTest, IsValidNetmask) {
   uint8_t kWrongSize[3] = {0xff, 0xff, 0xff};
@@ -104,4 +104,4 @@ TEST(IPUtilTest, IPAddressMatchesWithNetmask) {
   }
 }
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
diff --git a/src/pki/mock_signature_verify_cache.cc b/src/pki/mock_signature_verify_cache.cc
index d99f6902d..28f6f7d94 100644
--- a/src/pki/mock_signature_verify_cache.cc
+++ b/src/pki/mock_signature_verify_cache.cc
@@ -6,7 +6,7 @@
 
 #include <algorithm>
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 MockSignatureVerifyCache::MockSignatureVerifyCache() = default;
 
@@ -29,4 +29,4 @@ SignatureVerifyCache::Value MockSignatureVerifyCache::Check(
   return iter->second;
 }
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
diff --git a/src/pki/mock_signature_verify_cache.h b/src/pki/mock_signature_verify_cache.h
index f380f616e..ff0dc112c 100644
--- a/src/pki/mock_signature_verify_cache.h
+++ b/src/pki/mock_signature_verify_cache.h
@@ -13,7 +13,7 @@
 
 #include <openssl/pki/signature_verify_cache.h>
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 // MockSignatureVerifyCache is an implementation of SignatureVerifyCache.  It is
 // intended only for testing of cache functionality.
@@ -42,6 +42,6 @@ class MockSignatureVerifyCache : public SignatureVerifyCache {
   size_t stores_ = 0;
 };
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_PKI_MOCK_PATH_BUILDER_DELEGATE_H_
diff --git a/src/pki/name_constraints.cc b/src/pki/name_constraints.cc
index 1ce9a8f04..933ac2151 100644
--- a/src/pki/name_constraints.cc
+++ b/src/pki/name_constraints.cc
@@ -21,7 +21,7 @@
 #include "string_util.h"
 #include "verify_name_match.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace {
 
@@ -707,4 +707,4 @@ bool NameConstraints::IsPermittedIP(der::Input ip) const {
   return false;
 }
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
diff --git a/src/pki/name_constraints.h b/src/pki/name_constraints.h
index a025985fe..444a40bc1 100644
--- a/src/pki/name_constraints.h
+++ b/src/pki/name_constraints.h
@@ -11,7 +11,7 @@
 
 #include "general_names.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 class CertErrors;
 
@@ -101,6 +101,6 @@ class OPENSSL_EXPORT NameConstraints {
   int constrained_name_types_ = GENERAL_NAME_NONE;
 };
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_PKI_NAME_CONSTRAINTS_H_
diff --git a/src/pki/name_constraints_unittest.cc b/src/pki/name_constraints_unittest.cc
index a7150627e..1e4ed0adb 100644
--- a/src/pki/name_constraints_unittest.cc
+++ b/src/pki/name_constraints_unittest.cc
@@ -11,7 +11,7 @@
 #include "common_cert_errors.h"
 #include "test_helpers.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 namespace {
 
 ::testing::AssertionResult LoadTestData(const char *token,
@@ -1901,4 +1901,4 @@ TEST_P(ParseNameConstraints, IsPermittedCertSubjectIpAddresses) {
                               nullptr /* subject_alt_names */));
 }
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
diff --git a/src/pki/nist_pkits_unittest.cc b/src/pki/nist_pkits_unittest.cc
index 309cb6415..5439661b2 100644
--- a/src/pki/nist_pkits_unittest.cc
+++ b/src/pki/nist_pkits_unittest.cc
@@ -8,7 +8,7 @@
 
 #include <sstream>
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace {
 
@@ -97,4 +97,4 @@ void PkitsTestInfo::SetUserConstrainedPolicySet(
   SetPolicySetFromString(policy_names, &user_constrained_policy_set);
 }
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
diff --git a/src/pki/nist_pkits_unittest.h b/src/pki/nist_pkits_unittest.h
index 5f9219ce2..28d427891 100644
--- a/src/pki/nist_pkits_unittest.h
+++ b/src/pki/nist_pkits_unittest.h
@@ -11,7 +11,7 @@
 #include "parse_values.h"
 #include "test_helpers.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 // Describes the inputs and outputs (other than the certificates) for
 // the PKITS tests.
@@ -144,6 +144,6 @@ class PkitsTest : public ::testing::Test {
 // Inline the generated test code:
 #include "testdata/nist-pkits/pkits_testcases-inl.h"
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_PKI_NIST_PKITS_UNITTEST_H_
diff --git a/src/pki/ocsp.cc b/src/pki/ocsp.cc
index 03d6c2144..1a30b2233 100644
--- a/src/pki/ocsp.cc
+++ b/src/pki/ocsp.cc
@@ -17,7 +17,7 @@
 #include "verify_name_match.h"
 #include "verify_signed_data.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 OCSPCertID::OCSPCertID() = default;
 OCSPCertID::~OCSPCertID() = default;
@@ -1120,4 +1120,4 @@ std::optional<std::string> CreateOCSPGetURL(
   return std::string(ocsp_responder_url) + "/" + b64_encoded;
 }
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
diff --git a/src/pki/ocsp.h b/src/pki/ocsp.h
index 5b076dc83..a9f11d2f3 100644
--- a/src/pki/ocsp.h
+++ b/src/pki/ocsp.h
@@ -19,7 +19,7 @@
 #include "parser.h"
 #include "signature_algorithm.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 class ParsedCertificate;
 
@@ -310,6 +310,6 @@ OPENSSL_EXPORT std::optional<std::string> CreateOCSPGetURL(
     const ParsedCertificate *cert, const ParsedCertificate *issuer,
     std::string_view ocsp_responder_url);
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_PKI_OCSP_H_
diff --git a/src/pki/ocsp_revocation_status.h b/src/pki/ocsp_revocation_status.h
index 2816aade5..ce47e8443 100644
--- a/src/pki/ocsp_revocation_status.h
+++ b/src/pki/ocsp_revocation_status.h
@@ -5,7 +5,7 @@
 #ifndef BSSL_PKI_OCSP_REVOCATION_STATUS_H_
 #define BSSL_PKI_OCSP_REVOCATION_STATUS_H_
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 // This value is histogrammed, so do not re-order or change values, and add
 // new values at the end.
@@ -16,6 +16,6 @@ enum class OCSPRevocationStatus {
   MAX_VALUE = UNKNOWN
 };
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_PKI_OCSP_REVOCATION_STATUS_H_
diff --git a/src/pki/ocsp_unittest.cc b/src/pki/ocsp_unittest.cc
index 98ae8ddc2..1a65b4720 100644
--- a/src/pki/ocsp_unittest.cc
+++ b/src/pki/ocsp_unittest.cc
@@ -11,7 +11,7 @@
 #include "string_util.h"
 #include "test_helpers.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace {
 
@@ -239,4 +239,4 @@ TEST_P(CreateOCSPGetURLTest, Basic) {
 
 }  // namespace
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
diff --git a/src/pki/ocsp_verify_result.cc b/src/pki/ocsp_verify_result.cc
index f343f8ea6..c094169c2 100644
--- a/src/pki/ocsp_verify_result.cc
+++ b/src/pki/ocsp_verify_result.cc
@@ -4,7 +4,7 @@
 
 #include "ocsp_verify_result.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 OCSPVerifyResult::OCSPVerifyResult() = default;
 OCSPVerifyResult::OCSPVerifyResult(const OCSPVerifyResult &) = default;
@@ -22,4 +22,4 @@ bool OCSPVerifyResult::operator==(const OCSPVerifyResult &other) const {
   return true;
 }
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
diff --git a/src/pki/ocsp_verify_result.h b/src/pki/ocsp_verify_result.h
index 1e07f1a12..0b5194c65 100644
--- a/src/pki/ocsp_verify_result.h
+++ b/src/pki/ocsp_verify_result.h
@@ -9,7 +9,7 @@
 
 #include "ocsp_revocation_status.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 // The result of OCSP verification. This always contains a ResponseStatus, which
 // describes whether or not an OCSP response was provided, and response level
@@ -71,6 +71,6 @@ struct OPENSSL_EXPORT OCSPVerifyResult {
   OCSPRevocationStatus revocation_status = OCSPRevocationStatus::UNKNOWN;
 };
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_PKI_OCSP_VERIFY_RESULT_H_
diff --git a/src/pki/parse_certificate.cc b/src/pki/parse_certificate.cc
index 5e2ff88e1..29191048b 100644
--- a/src/pki/parse_certificate.cc
+++ b/src/pki/parse_certificate.cc
@@ -18,7 +18,7 @@
 #include "parser.h"
 #include "string_util.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace {
 
@@ -1013,4 +1013,4 @@ bool ParseSubjectKeyIdentifier(der::Input extension_value,
   return true;
 }
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
diff --git a/src/pki/parse_certificate.h b/src/pki/parse_certificate.h
index 81e267f6e..f1337150c 100644
--- a/src/pki/parse_certificate.h
+++ b/src/pki/parse_certificate.h
@@ -18,7 +18,7 @@
 #include "input.h"
 #include "parse_values.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace der {
 class Parser;
@@ -625,6 +625,6 @@ struct OPENSSL_EXPORT ParsedAuthorityKeyIdentifier {
 [[nodiscard]] OPENSSL_EXPORT bool ParseSubjectKeyIdentifier(
     der::Input extension_value, der::Input *subject_key_identifier);
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_PKI_PARSE_CERTIFICATE_H_
diff --git a/src/pki/parse_certificate_unittest.cc b/src/pki/parse_certificate_unittest.cc
index ec3c642b8..c541da96d 100644
--- a/src/pki/parse_certificate_unittest.cc
+++ b/src/pki/parse_certificate_unittest.cc
@@ -12,7 +12,7 @@
 #include "parsed_certificate.h"
 #include "test_helpers.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace {
 
@@ -1173,4 +1173,4 @@ TEST(ParseSubjectKeyIdentifierTest, ExtraData) {
 
 }  // namespace
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
diff --git a/src/pki/parse_name.cc b/src/pki/parse_name.cc
index 2c4695f31..3e0821a76 100644
--- a/src/pki/parse_name.cc
+++ b/src/pki/parse_name.cc
@@ -12,7 +12,7 @@
 #include "parse_values.h"
 #include "string_util.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace {
 
@@ -231,4 +231,4 @@ bool ConvertToRFC2253(const RDNSequence &rdn_sequence, std::string *out) {
   return true;
 }
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
diff --git a/src/pki/parse_name.h b/src/pki/parse_name.h
index be5c53eea..92ebf71fd 100644
--- a/src/pki/parse_name.h
+++ b/src/pki/parse_name.h
@@ -13,7 +13,7 @@
 #include "input.h"
 #include "parser.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 // id-at-commonName: 2.5.4.3 (RFC 5280)
 inline constexpr uint8_t kTypeCommonNameOid[] = {0x55, 0x04, 0x03};
@@ -152,6 +152,6 @@ typedef std::vector<RelativeDistinguishedName> RDNSequence;
 // successful.
 [[nodiscard]] OPENSSL_EXPORT bool ConvertToRFC2253(
     const RDNSequence &rdn_sequence, std::string *out);
-}  // namespace bssl
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_PKI_PARSE_NAME_H_
diff --git a/src/pki/parse_name_unittest.cc b/src/pki/parse_name_unittest.cc
index ceef9c2ef..0bb2c6f7b 100644
--- a/src/pki/parse_name_unittest.cc
+++ b/src/pki/parse_name_unittest.cc
@@ -7,7 +7,7 @@
 #include <gtest/gtest.h>
 #include "test_helpers.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace {
 // Loads test data from file. The filename is constructed from the parameters:
@@ -363,4 +363,4 @@ TEST(ParseNameTest, RFC2253FormatUTF8) {
   ASSERT_EQ("SN=Lu\\C4\\8Di\\C4\\87", output);
 }
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
diff --git a/src/pki/parse_values.cc b/src/pki/parse_values.cc
index 8d07b3dd8..d3312c7af 100644
--- a/src/pki/parse_values.cc
+++ b/src/pki/parse_values.cc
@@ -12,7 +12,8 @@
 #include <openssl/bytestring.h>
 #include <openssl/mem.h>
 
-namespace bssl::der {
+BSSL_NAMESPACE_BEGIN
+namespace der {
 
 namespace {
 
@@ -470,4 +471,5 @@ bool ParseBmpString(Input in, std::string *out) {
   return true;
 }
 
-}  // namespace bssl::der
+}  // namespace der
+BSSL_NAMESPACE_END
diff --git a/src/pki/parse_values.h b/src/pki/parse_values.h
index 1b7ed1220..8f808a845 100644
--- a/src/pki/parse_values.h
+++ b/src/pki/parse_values.h
@@ -13,7 +13,8 @@
 
 #include "input.h"
 
-namespace bssl::der {
+BSSL_NAMESPACE_BEGIN
+namespace der {
 
 // Reads a DER-encoded ASN.1 BOOLEAN value from |in| and puts the resulting
 // value in |out|. Returns whether the encoded value could successfully be
@@ -149,6 +150,7 @@ OPENSSL_EXPORT bool operator>=(const GeneralizedTime &lhs,
 // result in |out| as UTF-8, returning true if successful.
 [[nodiscard]] OPENSSL_EXPORT bool ParseBmpString(Input in, std::string *out);
 
-}  // namespace bssl::der
+}  // namespace der
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_DER_PARSE_VALUES_H_
diff --git a/src/pki/parse_values_unittest.cc b/src/pki/parse_values_unittest.cc
index e29b4b9ef..a24c4c1d0 100644
--- a/src/pki/parse_values_unittest.cc
+++ b/src/pki/parse_values_unittest.cc
@@ -8,7 +8,8 @@
 
 #include <gtest/gtest.h>
 
-namespace bssl::der::test {
+BSSL_NAMESPACE_BEGIN
+namespace der::test {
 
 namespace {
 
@@ -461,4 +462,5 @@ TEST(ParseValuesTest, ParseUniversalString) {
       ParseUniversalString(der::Input(invalid_non_4_multiple_der), &s));
 }
 
-}  // namespace bssl::der::test
+}  // namespace der::test
+BSSL_NAMESPACE_END
diff --git a/src/pki/parsed_certificate.cc b/src/pki/parsed_certificate.cc
index 9e23d30ee..402a6df05 100644
--- a/src/pki/parsed_certificate.cc
+++ b/src/pki/parsed_certificate.cc
@@ -15,7 +15,7 @@
 #include "signature_algorithm.h"
 #include "verify_name_match.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace {
 
@@ -295,4 +295,4 @@ bool ParsedCertificate::CreateAndAddToVector(
   return true;
 }
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
diff --git a/src/pki/parsed_certificate.h b/src/pki/parsed_certificate.h
index a4043cb59..c39d1a86e 100644
--- a/src/pki/parsed_certificate.h
+++ b/src/pki/parsed_certificate.h
@@ -17,7 +17,7 @@
 #include "parse_certificate.h"
 #include "signature_algorithm.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 struct GeneralNames;
 class NameConstraints;
@@ -323,6 +323,6 @@ class OPENSSL_EXPORT ParsedCertificate {
   ExtensionsMap extensions_;
 };
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_PKI_PARSED_CERTIFICATE_H_
diff --git a/src/pki/parsed_certificate_unittest.cc b/src/pki/parsed_certificate_unittest.cc
index f5150034e..2babc5b50 100644
--- a/src/pki/parsed_certificate_unittest.cc
+++ b/src/pki/parsed_certificate_unittest.cc
@@ -13,7 +13,7 @@
 
 // TODO(eroman): Add tests for parsing of policy mappings.
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace {
 
@@ -594,4 +594,4 @@ TEST(ParsedCertificateTest, AuthourityKeyIdentifierNotSequence) {
 
 }  // namespace
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
diff --git a/src/pki/parser.cc b/src/pki/parser.cc
index 51f2661dc..4ae76481a 100644
--- a/src/pki/parser.cc
+++ b/src/pki/parser.cc
@@ -4,10 +4,10 @@
 
 #include "parser.h"
 
-#include <openssl/base.h>
 #include "parse_values.h"
 
-namespace bssl::der {
+BSSL_NAMESPACE_BEGIN
+namespace der {
 
 Parser::Parser() { CBS_init(&cbs_, nullptr, 0); }
 
@@ -157,4 +157,5 @@ bool Parser::ReadGeneralizedTime(GeneralizedTime *out) {
   return ParseGeneralizedTime(value, out);
 }
 
-}  // namespace bssl::der
+}  // namespace der
+BSSL_NAMESPACE_END
diff --git a/src/pki/parser.h b/src/pki/parser.h
index 64599b550..f2cdcc851 100644
--- a/src/pki/parser.h
+++ b/src/pki/parser.h
@@ -14,7 +14,8 @@
 
 #include "input.h"
 
-namespace bssl::der {
+BSSL_NAMESPACE_BEGIN
+namespace der {
 
 class BitString;
 struct GeneralizedTime;
@@ -207,6 +208,7 @@ class OPENSSL_EXPORT Parser {
   size_t advance_len_ = 0;
 };
 
-}  // namespace bssl::der
+}  // namespace der
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_DER_PARSER_H_
diff --git a/src/pki/parser_unittest.cc b/src/pki/parser_unittest.cc
index 2deb1cd0c..34138bc59 100644
--- a/src/pki/parser_unittest.cc
+++ b/src/pki/parser_unittest.cc
@@ -8,7 +8,8 @@
 #include "input.h"
 #include "parse_values.h"
 
-namespace bssl::der::test {
+BSSL_NAMESPACE_BEGIN
+namespace der::test {
 
 TEST(ParserTest, ConsumesAllBytesOfTLV) {
   const uint8_t der[] = {0x04 /* OCTET STRING */, 0x00};
@@ -362,4 +363,5 @@ TEST(ParserTest, ReadBitStringBadTag) {
   EXPECT_FALSE(bit_string.has_value());
 }
 
-}  // namespace bssl::der::test
+}  // namespace der::test
+BSSL_NAMESPACE_END
diff --git a/src/pki/path_builder.cc b/src/pki/path_builder.cc
index ef2317281..806cef966 100644
--- a/src/pki/path_builder.cc
+++ b/src/pki/path_builder.cc
@@ -24,7 +24,7 @@
 #include "verify_certificate_chain.h"
 #include "verify_name_match.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace {
 
@@ -1044,4 +1044,4 @@ void CertPathBuilder::AddResultPath(
   out_result_.paths.push_back(std::move(result_path));
 }
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
diff --git a/src/pki/path_builder.h b/src/pki/path_builder.h
index fd207f7c9..42a16eb50 100644
--- a/src/pki/path_builder.h
+++ b/src/pki/path_builder.h
@@ -18,7 +18,7 @@
 #include "trust_store.h"
 #include "verify_certificate_chain.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace der {
 struct GeneralizedTime;
@@ -258,6 +258,6 @@ class OPENSSL_EXPORT CertPathBuilder {
   size_t valid_path_count_ = 0;
 };
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_PKI_PATH_BUILDER_H_
diff --git a/src/pki/path_builder_pkits_unittest.cc b/src/pki/path_builder_pkits_unittest.cc
index 5bc070335..ba10b58d0 100644
--- a/src/pki/path_builder_pkits_unittest.cc
+++ b/src/pki/path_builder_pkits_unittest.cc
@@ -22,7 +22,7 @@
 
 constexpr int64_t kOneYear = 60 * 60 * 24 * 365;
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace {
 
@@ -289,4 +289,4 @@ INSTANTIATE_TYPED_TEST_SUITE_P(PathBuilder,
                                PkitsTest16PrivateCertificateExtensions,
                                PathBuilderPkitsTestDelegate);
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
diff --git a/src/pki/path_builder_unittest.cc b/src/pki/path_builder_unittest.cc
index 05d961965..b92cfab70 100644
--- a/src/pki/path_builder_unittest.cc
+++ b/src/pki/path_builder_unittest.cc
@@ -22,7 +22,7 @@
 #include <gtest/gtest.h>
 #include <openssl/pool.h>
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 // TODO(crbug.com/634443): Assert the errors for each ResultPath.
 
@@ -2921,4 +2921,4 @@ TEST(PathBuilderPrioritizationTest, SelfIssuedPrioritization) {
 
 }  // namespace
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
diff --git a/src/pki/path_builder_verify_certificate_chain_unittest.cc b/src/pki/path_builder_verify_certificate_chain_unittest.cc
index a5aeef735..94da678e5 100644
--- a/src/pki/path_builder_verify_certificate_chain_unittest.cc
+++ b/src/pki/path_builder_verify_certificate_chain_unittest.cc
@@ -9,7 +9,7 @@
 #include "trust_store_in_memory.h"
 #include "verify_certificate_chain_typed_unittest.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace {
 
@@ -53,4 +53,4 @@ INSTANTIATE_TYPED_TEST_SUITE_P(PathBuilder,
                                VerifyCertificateChainSingleRootTest,
                                PathBuilderTestDelegate);
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
diff --git a/src/pki/pem.cc b/src/pki/pem.cc
index 63d7c4506..d7f5f932d 100644
--- a/src/pki/pem.cc
+++ b/src/pki/pem.cc
@@ -15,7 +15,7 @@ constexpr std::string_view kPEMHeaderTail = "-----";
 
 }  // namespace
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 
 
@@ -140,4 +140,4 @@ std::string PEMEncode(std::string_view data, const std::string &type) {
   return pem_encoded;
 }
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
diff --git a/src/pki/pem.h b/src/pki/pem.h
index 1fd28fbf6..c9f43146e 100644
--- a/src/pki/pem.h
+++ b/src/pki/pem.h
@@ -13,7 +13,7 @@
 
 #include <openssl/base.h>
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 // PEMTokenizer is a utility class for the parsing of data encapsulated
 // using RFC 1421, Privacy Enhancement for Internet Electronic Mail. It
@@ -81,6 +81,6 @@ class OPENSSL_EXPORT PEMTokenizer {
 OPENSSL_EXPORT std::string PEMEncode(std::string_view data,
                                      const std::string &type);
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_PKI_PEM_H_
diff --git a/src/pki/pem_unittest.cc b/src/pki/pem_unittest.cc
index a7f9edae3..5fb3d1c9d 100644
--- a/src/pki/pem_unittest.cc
+++ b/src/pki/pem_unittest.cc
@@ -6,7 +6,7 @@
 
 #include <gtest/gtest.h>
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 TEST(PEMTokenizerTest, BasicParsing) {
   const char data[] =
@@ -202,4 +202,4 @@ TEST(PEMEncodeTest, Wrapping) {
                 "WRAPPED LINE"));
 }
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
diff --git a/src/pki/revocation_util.cc b/src/pki/revocation_util.cc
index 80779d7d5..997f12d67 100644
--- a/src/pki/revocation_util.cc
+++ b/src/pki/revocation_util.cc
@@ -7,7 +7,7 @@
 #include "encode_values.h"
 #include "parse_values.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace {
 
@@ -56,4 +56,4 @@ bool CheckRevocationDateValid(const der::GeneralizedTime &this_update,
   return true;
 }
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
diff --git a/src/pki/revocation_util.h b/src/pki/revocation_util.h
index 5b20f4c9b..f4226d33d 100644
--- a/src/pki/revocation_util.h
+++ b/src/pki/revocation_util.h
@@ -10,7 +10,7 @@
 
 #include <openssl/base.h>
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace der {
 struct GeneralizedTime;
@@ -26,6 +26,6 @@ struct GeneralizedTime;
     const der::GeneralizedTime *next_update, int64_t verify_time_epoch_seconds,
     std::optional<int64_t> max_age_seconds);
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_PKI_REVOCATION_UTIL_H_
diff --git a/src/pki/signature_algorithm.cc b/src/pki/signature_algorithm.cc
index 73d8bc1bc..f00eee2c1 100644
--- a/src/pki/signature_algorithm.cc
+++ b/src/pki/signature_algorithm.cc
@@ -11,7 +11,7 @@
 #include "parse_values.h"
 #include "parser.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace {
 
@@ -422,4 +422,4 @@ std::optional<DigestAlgorithm> GetTlsServerEndpointDigestAlgorithm(
   return std::nullopt;
 }
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
diff --git a/src/pki/signature_algorithm.h b/src/pki/signature_algorithm.h
index be654fc01..74470b774 100644
--- a/src/pki/signature_algorithm.h
+++ b/src/pki/signature_algorithm.h
@@ -12,7 +12,7 @@
 #include <openssl/base.h>
 #include <openssl/evp.h>
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace der {
 class Input;
@@ -81,6 +81,6 @@ OPENSSL_EXPORT std::optional<SignatureAlgorithm> ParseSignatureAlgorithm(
 OPENSSL_EXPORT std::optional<DigestAlgorithm>
 GetTlsServerEndpointDigestAlgorithm(SignatureAlgorithm alg);
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_PKI_SIGNATURE_ALGORITHM_H_
diff --git a/src/pki/signature_algorithm_unittest.cc b/src/pki/signature_algorithm_unittest.cc
index dc0bfa69d..0ca326067 100644
--- a/src/pki/signature_algorithm_unittest.cc
+++ b/src/pki/signature_algorithm_unittest.cc
@@ -10,7 +10,7 @@
 #include "input.h"
 #include "parser.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace {
 
@@ -1448,4 +1448,4 @@ TEST(SignatureAlgorithmTest, ParseDerDsaWithSha256NoParams) {
 
 }  // namespace
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
diff --git a/src/pki/simple_path_builder_delegate.cc b/src/pki/simple_path_builder_delegate.cc
index 89000e3af..29306d544 100644
--- a/src/pki/simple_path_builder_delegate.cc
+++ b/src/pki/simple_path_builder_delegate.cc
@@ -19,7 +19,7 @@
 #include "signature_algorithm.h"
 #include "verify_signed_data.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 DEFINE_CERT_ERROR_ID(SimplePathBuilderDelegate::kRsaModulusTooSmall,
                      "RSA modulus too small");
@@ -127,4 +127,4 @@ bool SimplePathBuilderDelegate::IsPublicKeyAcceptable(EVP_PKEY *public_key,
   return false;
 }
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
diff --git a/src/pki/simple_path_builder_delegate.h b/src/pki/simple_path_builder_delegate.h
index 6d95b0de8..8cfaa7fd3 100644
--- a/src/pki/simple_path_builder_delegate.h
+++ b/src/pki/simple_path_builder_delegate.h
@@ -13,7 +13,7 @@
 #include "path_builder.h"
 #include "signature_algorithm.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 class CertErrors;
 
@@ -78,6 +78,6 @@ class OPENSSL_EXPORT SimplePathBuilderDelegate
   const DigestPolicy digest_policy_;
 };
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_PKI_SIMPLE_PATH_BUILDER_DELEGATE_H_
diff --git a/src/pki/simple_path_builder_delegate_unittest.cc b/src/pki/simple_path_builder_delegate_unittest.cc
index f0131fa8e..b9fa818ee 100644
--- a/src/pki/simple_path_builder_delegate_unittest.cc
+++ b/src/pki/simple_path_builder_delegate_unittest.cc
@@ -16,7 +16,7 @@
 #include "test_helpers.h"
 #include "verify_signed_data.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace {
 
@@ -103,4 +103,4 @@ TEST_P(SimplePathBuilderDelegate2048FailTest, RsaKeySmallerThan2048) {
 
 }  // namespace
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
diff --git a/src/pki/string_util.cc b/src/pki/string_util.cc
index 423cd76b4..1cf8ea357 100644
--- a/src/pki/string_util.cc
+++ b/src/pki/string_util.cc
@@ -12,7 +12,8 @@
 #include <openssl/base64.h>
 #include <openssl/mem.h>
 
-namespace bssl::string_util {
+BSSL_NAMESPACE_BEGIN
+namespace string_util {
 
 bool IsAscii(std::string_view str) {
   for (unsigned char c : str) {
@@ -190,4 +191,5 @@ bool Base64Decode(const std::string_view &input, std::string *output) {
   return true;
 }
 
-}  // namespace bssl::string_util
+}  // namespace string_util
+BSSL_NAMESPACE_END
diff --git a/src/pki/string_util.h b/src/pki/string_util.h
index 1dad828c1..2a51809a7 100644
--- a/src/pki/string_util.h
+++ b/src/pki/string_util.h
@@ -13,7 +13,8 @@
 #include <openssl/base.h>
 #include <openssl/span.h>
 
-namespace bssl::string_util {
+BSSL_NAMESPACE_BEGIN
+namespace string_util {
 
 // Returns true if the characters in |str| are all ASCII, false otherwise.
 OPENSSL_EXPORT bool IsAscii(std::string_view str);
@@ -70,6 +71,7 @@ OPENSSL_EXPORT bool Base64Encode(const std::string_view &input,
 OPENSSL_EXPORT bool Base64Decode(const std::string_view &input,
                                  std::string *output);
 
-}  // namespace bssl::string_util
+}  // namespace string_util
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_PKI_STRING_UTIL_H_
diff --git a/src/pki/string_util_unittest.cc b/src/pki/string_util_unittest.cc
index 32e446d54..2faa561b4 100644
--- a/src/pki/string_util_unittest.cc
+++ b/src/pki/string_util_unittest.cc
@@ -5,7 +5,7 @@
 #include "string_util.h"
 #include <gtest/gtest.h>
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace {
 
@@ -152,4 +152,4 @@ TEST(StringUtilTest, SplitString) {
 
 }  // namespace
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
diff --git a/src/pki/test_helpers.cc b/src/pki/test_helpers.cc
index 061500802..82704aa76 100644
--- a/src/pki/test_helpers.cc
+++ b/src/pki/test_helpers.cc
@@ -26,7 +26,7 @@
 #include "string_util.h"
 #include "trust_store.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace {
 
@@ -483,4 +483,4 @@ void VerifyUserConstrainedPolicySet(
   }
 }
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
diff --git a/src/pki/test_helpers.h b/src/pki/test_helpers.h
index 91d74cead..8f3594abb 100644
--- a/src/pki/test_helpers.h
+++ b/src/pki/test_helpers.h
@@ -19,7 +19,7 @@
 #include "trust_store.h"
 #include "verify_certificate_chain.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace der {
 
@@ -162,6 +162,6 @@ void VerifyUserConstrainedPolicySet(
     const std::set<der::Input> &actual_user_constrained_policy_set,
     const std::string &errors_file_path);
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_PKI_TEST_HELPERS_H_
diff --git a/src/pki/trust_store.cc b/src/pki/trust_store.cc
index fc373f75f..126df3e79 100644
--- a/src/pki/trust_store.cc
+++ b/src/pki/trust_store.cc
@@ -8,7 +8,7 @@
 
 #include "string_util.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace {
 
@@ -174,4 +174,4 @@ void TrustStore::AsyncGetIssuersOf(const ParsedCertificate *cert,
   out_req->reset();
 }
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
diff --git a/src/pki/trust_store.h b/src/pki/trust_store.h
index 5493f6ba2..736970f90 100644
--- a/src/pki/trust_store.h
+++ b/src/pki/trust_store.h
@@ -12,7 +12,7 @@
 #include "cert_issuer_source.h"
 #include "parsed_certificate.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 enum class CertificateTrustType {
   // This certificate is explicitly blocked (distrusted).
@@ -139,6 +139,6 @@ class OPENSSL_EXPORT TrustStore : public CertIssuerSource {
                          std::unique_ptr<Request> *out_req) final;
 };
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_PKI_TRUST_STORE_H_
diff --git a/src/pki/trust_store_collection.cc b/src/pki/trust_store_collection.cc
index 4c607b5fc..9540065cc 100644
--- a/src/pki/trust_store_collection.cc
+++ b/src/pki/trust_store_collection.cc
@@ -6,7 +6,7 @@
 
 #include <openssl/base.h>
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 TrustStoreCollection::TrustStoreCollection() = default;
 TrustStoreCollection::~TrustStoreCollection() = default;
@@ -44,4 +44,4 @@ CertificateTrust TrustStoreCollection::GetTrust(const ParsedCertificate *cert) {
   return result;
 }
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
diff --git a/src/pki/trust_store_collection.h b/src/pki/trust_store_collection.h
index 494909ee9..04c8f3e13 100644
--- a/src/pki/trust_store_collection.h
+++ b/src/pki/trust_store_collection.h
@@ -9,7 +9,7 @@
 
 #include "trust_store.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 // TrustStoreCollection is an implementation of TrustStore which combines the
 // results from multiple TrustStores.
@@ -38,6 +38,6 @@ class OPENSSL_EXPORT TrustStoreCollection : public TrustStore {
   std::vector<TrustStore *> stores_;
 };
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_PKI_TRUST_STORE_COLLECTION_H_
diff --git a/src/pki/trust_store_collection_unittest.cc b/src/pki/trust_store_collection_unittest.cc
index 94989ba39..a04c64fc9 100644
--- a/src/pki/trust_store_collection_unittest.cc
+++ b/src/pki/trust_store_collection_unittest.cc
@@ -8,7 +8,7 @@
 #include "test_helpers.h"
 #include "trust_store_in_memory.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace {
 
@@ -185,4 +185,4 @@ TEST_F(TrustStoreCollectionTest, DistrustTakesPriority) {
 
 }  // namespace
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
diff --git a/src/pki/trust_store_in_memory.cc b/src/pki/trust_store_in_memory.cc
index 1c77b63b2..89a4eb2df 100644
--- a/src/pki/trust_store_in_memory.cc
+++ b/src/pki/trust_store_in_memory.cc
@@ -4,7 +4,7 @@
 
 #include "trust_store_in_memory.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 TrustStoreInMemory::TrustStoreInMemory() = default;
 TrustStoreInMemory::~TrustStoreInMemory() = default;
@@ -98,4 +98,4 @@ const TrustStoreInMemory::Entry *TrustStoreInMemory::GetEntry(
   return nullptr;
 }
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
diff --git a/src/pki/trust_store_in_memory.h b/src/pki/trust_store_in_memory.h
index 4da26cd7c..03d06beb9 100644
--- a/src/pki/trust_store_in_memory.h
+++ b/src/pki/trust_store_in_memory.h
@@ -12,7 +12,7 @@
 
 #include "trust_store.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 // A very simple implementation of a TrustStore, which contains a set of
 // certificates and their trustedness.
@@ -96,6 +96,6 @@ class OPENSSL_EXPORT TrustStoreInMemory : public TrustStore {
   const Entry *GetEntry(const ParsedCertificate *cert) const;
 };
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_PKI_TRUST_STORE_IN_MEMORY_H_
diff --git a/src/pki/trust_store_in_memory_unittest.cc b/src/pki/trust_store_in_memory_unittest.cc
index 4292675c8..902053506 100644
--- a/src/pki/trust_store_in_memory_unittest.cc
+++ b/src/pki/trust_store_in_memory_unittest.cc
@@ -17,7 +17,7 @@
 #include <gtest/gtest.h>
 #include "test_helpers.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 namespace {
 
 class TrustStoreInMemoryTest : public testing::Test {
@@ -109,4 +109,4 @@ TEST_F(TrustStoreInMemoryTest, DistrustBySPKIOverridesTrust) {
 }
 
 }  // namespace
-}  // namespace bssl
+BSSL_NAMESPACE_END
diff --git a/src/pki/verify.cc b/src/pki/verify.cc
index 6bd9dc2d3..157a6b67e 100644
--- a/src/pki/verify.cc
+++ b/src/pki/verify.cc
@@ -41,7 +41,7 @@
 #include "trust_store_in_memory.h"
 #include "verify_certificate_chain.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace {
 
@@ -351,4 +351,4 @@ std::optional<std::vector<std::vector<std::string>>> CertificateVerifyAllPaths(
   return CertificateVerifyInternal(opts, nullptr, nullptr, /*all_paths=*/true);
 }
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
diff --git a/src/pki/verify_certificate_chain.cc b/src/pki/verify_certificate_chain.cc
index 4985ae978..e72915fb8 100644
--- a/src/pki/verify_certificate_chain.cc
+++ b/src/pki/verify_certificate_chain.cc
@@ -19,7 +19,7 @@
 #include "trust_store.h"
 #include "verify_signed_data.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace {
 
@@ -1677,4 +1677,4 @@ bool VerifyCertificateIsSelfSigned(const ParsedCertificate &cert,
   return true;
 }
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
diff --git a/src/pki/verify_certificate_chain.h b/src/pki/verify_certificate_chain.h
index 4603acefd..8daf64f8b 100644
--- a/src/pki/verify_certificate_chain.h
+++ b/src/pki/verify_certificate_chain.h
@@ -15,7 +15,7 @@
 #include "input.h"
 #include "parsed_certificate.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace der {
 struct GeneralizedTime;
@@ -270,6 +270,6 @@ OPENSSL_EXPORT bool VerifyCertificateIsSelfSigned(const ParsedCertificate &cert,
                                                   SignatureVerifyCache *cache,
                                                   CertErrors *errors);
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_PKI_VERIFY_CERTIFICATE_CHAIN_H_
diff --git a/src/pki/verify_certificate_chain_pkits_unittest.cc b/src/pki/verify_certificate_chain_pkits_unittest.cc
index 98d1504a6..d3f641f53 100644
--- a/src/pki/verify_certificate_chain_pkits_unittest.cc
+++ b/src/pki/verify_certificate_chain_pkits_unittest.cc
@@ -19,7 +19,7 @@
 
 #include "nist_pkits_unittest.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace {
 
@@ -126,4 +126,4 @@ INSTANTIATE_TYPED_TEST_SUITE_P(VerifyCertificateChain,
 // PkitsTest05VerifyingPathswithSelfIssuedCertificates,
 // PkitsTest14DistributionPoints, PkitsTest15DeltaCRLs
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
diff --git a/src/pki/verify_certificate_chain_typed_unittest.h b/src/pki/verify_certificate_chain_typed_unittest.h
index e9948e12d..4f85959d5 100644
--- a/src/pki/verify_certificate_chain_typed_unittest.h
+++ b/src/pki/verify_certificate_chain_typed_unittest.h
@@ -13,7 +13,7 @@
 #include "trust_store.h"
 #include "verify_certificate_chain.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 template <typename TestDelegate>
 class VerifyCertificateChainTest : public ::testing::Test {
@@ -343,6 +343,6 @@ REGISTER_TYPED_TEST_SUITE_P(VerifyCertificateChainSingleRootTest, Simple,
                             TrustAnchorNotSelfSigned, KeyRollover, Policies,
                             ManyNames, TargetOnly, TargetSelfSigned);
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_PKI_VERIFY_CERTIFICATE_CHAIN_TYPED_UNITTEST_H_
diff --git a/src/pki/verify_certificate_chain_unittest.cc b/src/pki/verify_certificate_chain_unittest.cc
index 5ea3e085e..1d9be6fee 100644
--- a/src/pki/verify_certificate_chain_unittest.cc
+++ b/src/pki/verify_certificate_chain_unittest.cc
@@ -12,7 +12,7 @@
 #include "trust_store.h"
 #include "verify_certificate_chain_typed_unittest.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace {
 
@@ -125,4 +125,4 @@ TEST(VerifyCertificateIsSelfSigned, SelfSigned) {
   EXPECT_EQ(cache.CacheStores(), 1U);
 }
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
diff --git a/src/pki/verify_error.cc b/src/pki/verify_error.cc
index da61236fb..688b4e28f 100644
--- a/src/pki/verify_error.cc
+++ b/src/pki/verify_error.cc
@@ -1,7 +1,7 @@
 #include <openssl/base.h>
 #include <openssl/pki/verify_error.h>
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 VerifyError::VerifyError(StatusCode code, ptrdiff_t offset,
                          std::string diagnostic)
@@ -13,4 +13,4 @@ ptrdiff_t VerifyError::Index() const { return offset_; }
 
 VerifyError::StatusCode VerifyError::Code() const { return code_; }
 
-}  // namespacee bssl
+BSSL_NAMESPACE_END
diff --git a/src/pki/verify_name_match.cc b/src/pki/verify_name_match.cc
index 09f6102c8..e849d90b2 100644
--- a/src/pki/verify_name_match.cc
+++ b/src/pki/verify_name_match.cc
@@ -13,7 +13,7 @@
 #include "parse_name.h"
 #include "parser.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 DEFINE_CERT_ERROR_ID(kFailedConvertingAttributeValue,
                      "Failed converting AttributeValue to string");
@@ -435,4 +435,4 @@ bool FindEmailAddressesInName(
   return true;
 }
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
diff --git a/src/pki/verify_name_match.h b/src/pki/verify_name_match.h
index 79c9ce868..188c7d58d 100644
--- a/src/pki/verify_name_match.h
+++ b/src/pki/verify_name_match.h
@@ -10,7 +10,7 @@
 
 #include <openssl/base.h>
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 class CertErrors;
 
@@ -56,6 +56,6 @@ OPENSSL_EXPORT bool VerifyNameInSubtree(der::Input name_rdn_sequence,
     der::Input name_rdn_sequence,
     std::vector<std::string> *contained_email_addresses);
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_PKI_VERIFY_NAME_MATCH_H_
diff --git a/src/pki/verify_name_match_unittest.cc b/src/pki/verify_name_match_unittest.cc
index 53cd012ad..77df50195 100644
--- a/src/pki/verify_name_match_unittest.cc
+++ b/src/pki/verify_name_match_unittest.cc
@@ -8,7 +8,7 @@
 #include "string_util.h"
 #include "test_helpers.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 namespace {
 
 // Loads test data from file. The filename is constructed from the parameters:
@@ -605,4 +605,4 @@ TEST(NameNormalizationTest, NormalizeCustom) {
   EXPECT_EQ(SequenceValueFromString(raw_der), der::Input(normalized_der));
 }
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
diff --git a/src/pki/verify_signed_data.cc b/src/pki/verify_signed_data.cc
index 4502e2de0..9c546fd88 100644
--- a/src/pki/verify_signed_data.cc
+++ b/src/pki/verify_signed_data.cc
@@ -18,7 +18,7 @@
 #include "parser.h"
 #include "signature_algorithm.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace {
 
@@ -290,4 +290,4 @@ bool VerifySignedData(SignatureAlgorithm algorithm, der::Input signed_data,
                           public_key.get(), cache);
 }
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
diff --git a/src/pki/verify_signed_data.h b/src/pki/verify_signed_data.h
index 5ecfceab1..e8c4c4d9e 100644
--- a/src/pki/verify_signed_data.h
+++ b/src/pki/verify_signed_data.h
@@ -11,7 +11,7 @@
 
 #include "signature_algorithm.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace der {
 class BitString;
@@ -42,6 +42,6 @@ class Input;
 [[nodiscard]] OPENSSL_EXPORT bool ParsePublicKey(
     der::Input public_key_spki, bssl::UniquePtr<EVP_PKEY> *public_key);
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
 
 #endif  // BSSL_PKI_VERIFY_SIGNED_DATA_H_
diff --git a/src/pki/verify_signed_data_unittest.cc b/src/pki/verify_signed_data_unittest.cc
index 1d94bb63a..1a0232214 100644
--- a/src/pki/verify_signed_data_unittest.cc
+++ b/src/pki/verify_signed_data_unittest.cc
@@ -17,7 +17,7 @@
 #include "signature_algorithm.h"
 #include "test_helpers.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 namespace {
 
@@ -238,4 +238,4 @@ TEST(VerifySignedDataTestWithCache, TestVerifyCache) {
 
 }  // namespace
 
-}  // namespace bssl
+BSSL_NAMESPACE_END
diff --git a/src/pki/verify_unittest.cc b/src/pki/verify_unittest.cc
index b724a98d5..0be540b42 100644
--- a/src/pki/verify_unittest.cc
+++ b/src/pki/verify_unittest.cc
@@ -25,7 +25,7 @@
 
 #include "test_helpers.h"
 
-namespace bssl {
+BSSL_NAMESPACE_BEGIN
 
 static std::unique_ptr<VerifyTrustStore> MozillaRootStore() {
   std::string diagnostic;
@@ -137,4 +137,4 @@ TEST(VerifyTest, DepthLimit) {
       << error.DiagnosticString();
 }
 
-}  // namespace bssl
+BSSL_NAMESPACE_END