diff --git a/Cargo.lock b/Cargo.lock
index c7653b6..0795df7 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1053,8 +1053,8 @@ dependencies = [
  "clap",
  "keyfork-derive-openpgp",
  "keyfork-derive-util",
+ "keyfork-entropy",
  "keyfork-mnemonic-util",
- "keyfork-plumbing",
  "keyfork-prompt",
  "keyfork-shard",
  "keyforkd",
@@ -1113,6 +1113,10 @@ dependencies = [
  "thiserror",
 ]
 
+[[package]]
+name = "keyfork-entropy"
+version = "0.1.0"
+
 [[package]]
 name = "keyfork-frame"
 version = "0.1.0"
@@ -1140,6 +1144,7 @@ dependencies = [
 name = "keyfork-plumbing"
 version = "0.1.0"
 dependencies = [
+ "keyfork-entropy",
  "keyfork-mnemonic-util",
  "smex",
 ]
diff --git a/Cargo.toml b/Cargo.toml
index b53e93d..cfc3d47 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -3,6 +3,7 @@
 resolver = "2"
 members = [
     "keyfork",
+    "keyfork-entropy",
     "keyfork-derive-key",
     "keyfork-derive-openpgp",
     "keyfork-derive-path-data",
diff --git a/keyfork-entropy/Cargo.toml b/keyfork-entropy/Cargo.toml
new file mode 100644
index 0000000..36d3750
--- /dev/null
+++ b/keyfork-entropy/Cargo.toml
@@ -0,0 +1,9 @@
+[package]
+name = "keyfork-entropy"
+version = "0.1.0"
+edition = "2021"
+license = "MIT"
+
+# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
+
+[dependencies]
diff --git a/keyfork-plumbing/src/lib.rs b/keyfork-entropy/src/lib.rs
similarity index 93%
rename from keyfork-plumbing/src/lib.rs
rename to keyfork-entropy/src/lib.rs
index 766262c..49461af 100644
--- a/keyfork-plumbing/src/lib.rs
+++ b/keyfork-entropy/src/lib.rs
@@ -1,7 +1,4 @@
-use std::{
-    fs::{read_dir, read_to_string},
-    io::Read,
-};
+use std::{fs::{read_dir, read_to_string, File}, io::Read};
 
 static WARNING_LINKS: [&str; 1] =
     ["https://lore.kernel.org/lkml/20211223141113.1240679-2-Jason@zx2c4.com/"];
@@ -58,8 +55,9 @@ pub fn ensure_safe() {
 }
 
 pub fn generate_entropy_of_size(byte_count: usize) -> Result<Vec<u8>, std::io::Error> {
+    ensure_safe();
     let mut vec = vec![0u8; byte_count];
-    let mut entropy_file = std::fs::File::open("/dev/urandom")?;
+    let mut entropy_file = File::open("/dev/urandom")?;
     entropy_file.read_exact(&mut vec[..])?;
     Ok(vec)
 }
diff --git a/keyfork-plumbing/Cargo.toml b/keyfork-plumbing/Cargo.toml
index ef6a470..77f5f42 100644
--- a/keyfork-plumbing/Cargo.toml
+++ b/keyfork-plumbing/Cargo.toml
@@ -7,5 +7,6 @@ license = "AGPL-3.0-only"
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 
 [dependencies]
+keyfork-entropy = { version = "0.1.0", path = "../keyfork-entropy" }
 keyfork-mnemonic-util = { version = "0.1.0", path = "../keyfork-mnemonic-util" }
 smex = { version = "0.1.0", path = "../smex" }
diff --git a/keyfork-plumbing/src/bin/keyfork-entropy.rs b/keyfork-plumbing/src/bin/keyfork-entropy.rs
index d913d4c..f1b1a46 100644
--- a/keyfork-plumbing/src/bin/keyfork-entropy.rs
+++ b/keyfork-plumbing/src/bin/keyfork-entropy.rs
@@ -13,8 +13,7 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
         "Maximum supported bit size is 256, got: {bit_size}"
     );
 
-    keyfork_plumbing::ensure_safe();
-    let entropy = keyfork_plumbing::generate_entropy_of_size(bit_size / 8)?;
+    let entropy = keyfork_entropy::generate_entropy_of_size(bit_size / 8)?;
     println!("{}", smex::encode(&entropy));
 
     Ok(())
diff --git a/keyfork/Cargo.toml b/keyfork/Cargo.toml
index 939774d..b075a57 100644
--- a/keyfork/Cargo.toml
+++ b/keyfork/Cargo.toml
@@ -11,7 +11,6 @@ keyfork-mnemonic-util = { version = "0.1.0", path = "../keyfork-mnemonic-util" }
 clap = { version = "4.4.2", features = ["derive", "env", "wrap_help"] }
 thiserror = "1.0.48"
 smex = { version = "0.1.0", path = "../smex" }
-keyfork-plumbing = { version = "0.1.0", path = "../keyfork-plumbing" }
 keyfork-shard = { version = "0.1.0", path = "../keyfork-shard" }
 serde = { version = "1.0.192", features = ["derive"] }
 keyforkd = { version = "0.1.0", path = "../keyforkd", features = ["tracing"] }
@@ -23,3 +22,4 @@ card-backend-pcsc = "0.5.0"
 openpgp-card-sequoia = "0.2.0"
 openpgp-card = "0.4.1"
 keyfork-prompt = { version = "0.1.0", path = "../keyfork-prompt" }
+keyfork-entropy = { version = "0.1.0", path = "../keyfork-entropy" }
diff --git a/keyfork/src/cli/mnemonic.rs b/keyfork/src/cli/mnemonic.rs
index 2477440..fd0fbca 100644
--- a/keyfork/src/cli/mnemonic.rs
+++ b/keyfork/src/cli/mnemonic.rs
@@ -103,8 +103,7 @@ impl MnemonicSeedSource {
         };
         let seed = match self {
             MnemonicSeedSource::System => {
-                keyfork_plumbing::ensure_safe();
-                keyfork_plumbing::generate_entropy_of_size(size / 8)?
+                keyfork_entropy::generate_entropy_of_size(size / 8)?
             }
             MnemonicSeedSource::Playing => todo!(),
             MnemonicSeedSource::Tarot => todo!(),
diff --git a/keyfork/src/cli/wizard.rs b/keyfork/src/cli/wizard.rs
index 568d6b4..ca36b29 100644
--- a/keyfork/src/cli/wizard.rs
+++ b/keyfork/src/cli/wizard.rs
@@ -101,8 +101,7 @@ fn factory_reset_current_card(
 }
 
 fn generate_shard_secret(threshold: u8, max: u8, keys_per_shard: u8) -> Result<()> {
-    keyfork_plumbing::ensure_safe();
-    let seed = keyfork_plumbing::generate_entropy_of_size(256 / 8)?;
+    let seed = keyfork_entropy::generate_entropy_of_size(256 / 8)?;
     let mut pm = PromptManager::new(std::io::stdin(), std::io::stderr())?;
     let mut certs = vec![];
     let mut seen_cards: HashSet<String> = HashSet::new();