diff --git a/.cargo/config.toml b/.cargo/config.toml
new file mode 100644
index 0000000000..29b17fd88b
--- /dev/null
+++ b/.cargo/config.toml
@@ -0,0 +1,5 @@
+[alias]
+t = ["nextest", "run"]
+
+[build]
+rustflags = ["--cfg", "tokio_unstable"]
diff --git a/.dockerignore b/.dockerignore
index 75c223bfdc..f8e411e9bb 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -10,4 +10,4 @@ build_docs/**
 blueprints/local
 .git
 .venv
-target/
+target
diff --git a/CODEOWNERS b/CODEOWNERS
index 7434605024..01971905f2 100644
--- a/CODEOWNERS
+++ b/CODEOWNERS
@@ -27,6 +27,7 @@ Makefile                                @goauthentik/infrastructure
 .editorconfig                           @goauthentik/infrastructure
 CODEOWNERS                              @goauthentik/infrastructure
 # Backend packages
+packages/ak-*                           @goauthentik/backend
 packages/client-rust                    @goauthentik/backend
 packages/django-channels-postgres       @goauthentik/backend
 packages/django-postgres-cache          @goauthentik/backend
diff --git a/Cargo.lock b/Cargo.lock
index b6b1d8d758..c86d846a1b 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -102,6 +102,10 @@ dependencies = [
  "uuid",
 ]
 
+[[package]]
+name = "authentik-lib"
+version = "2026.5.0-rc1"
+
 [[package]]
 name = "autocfg"
 version = "1.5.0"
@@ -1814,6 +1818,7 @@ dependencies = [
  "signal-hook-registry",
  "socket2",
  "tokio-macros",
+ "tracing",
  "windows-sys 0.61.2",
 ]
 
diff --git a/Cargo.toml b/Cargo.toml
index b47bfb0b50..2f8dfe6fc7 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,5 +1,9 @@
 [workspace]
-members = ["packages/client-rust", "website/scripts/docsmg"]
+members = [
+  "packages/ak-lib",
+  "packages/client-rust",
+  "website/scripts/docsmg",
+]
 resolver = "3"
 
 [workspace.package]
@@ -42,11 +46,15 @@ serde_repr = "= 0.1.20"
 serde_with = { version = "= 3.18.0", default-features = false, features = [
   "base64",
 ] }
-tokio = { version = "= 1.50.0", features = ["full"] }
+tokio = { version = "= 1.50.0", features = ["full", "tracing"] }
 tokio-util = { version = "= 0.7.18", features = ["full"] }
 url = "= 2.5.8"
 uuid = { version = "= 1.23.0", features = ["serde", "v4"] }
 
+lib = { package = "authentik-lib", version = "2026.5.0-rc1", path = "./packages/ak-lib" }
+
+authentik-client = { version = "2026.5.0-rc1", path = "./packages/client-rust" }
+
 [profile.dev.package.backtrace]
 opt-level = 3
 
@@ -89,12 +97,20 @@ perf = { priority = -1, level = "warn" }
 style = { priority = -1, level = "warn" }
 suspicious = { priority = -1, level = "warn" }
 ### and disable the ones we don't want
+### cargo group
+multiple_crate_versions = "allow"
 ### pedantic group
+missing_errors_doc = "allow"
+missing_panics_doc = "allow"
+must_use_candidate = "allow"
 redundant_closure_for_method_calls = "allow"
+struct_field_names = "allow"
 too_many_lines = "allow"
 ### nursery
-redundant_pub_crate = "allow"
+missing_const_for_fn = "allow"
 option_if_let_else = "allow"
+redundant_pub_crate = "allow"
+significant_drop_tightening = "allow"
 ### restriction group
 allow_attributes = "warn"
 allow_attributes_without_reason = "warn"
@@ -107,7 +123,6 @@ create_dir = "warn"
 dbg_macro = "warn"
 default_numeric_fallback = "warn"
 disallowed_script_idents = "warn"
-doc_paragraphs_missing_punctuation = "warn"
 empty_drop = "warn"
 empty_enum_variants_with_brackets = "warn"
 empty_structs_with_brackets = "warn"
diff --git a/Makefile b/Makefile
index 6d7bbfe131..5ca965eb9b 100644
--- a/Makefile
+++ b/Makefile
@@ -153,6 +153,7 @@ endif
 	$(eval current_version := $(shell cat ${PWD}/internal/constants/VERSION))
 	$(SED_INPLACE) 's/^version = ".*"/version = "$(version)"/' ${PWD}/pyproject.toml
 	$(SED_INPLACE) 's/^VERSION = ".*"/VERSION = "$(version)"/' ${PWD}/authentik/__init__.py
+	$(SED_INPLACE) "s/version = \"${current_version}\"/version = \"$(version)\"" ${PWD}/Cargo.toml ${PWD}/Cargo.lock
 	$(MAKE) gen-build gen-compose aws-cfn
 	$(SED_INPLACE) "s/\"${current_version}\"/\"$(version)\"/" ${PWD}/package.json ${PWD}/package-lock.json ${PWD}/web/package.json ${PWD}/web/package-lock.json
 	echo -n $(version) > ${PWD}/internal/constants/VERSION
diff --git a/packages/ak-lib/Cargo.toml b/packages/ak-lib/Cargo.toml
new file mode 100644
index 0000000000..a935ca6288
--- /dev/null
+++ b/packages/ak-lib/Cargo.toml
@@ -0,0 +1,17 @@
+[package]
+name = "authentik-lib"
+version.workspace = true
+authors.workspace = true
+edition.workspace = true
+readme.workspace = true
+homepage.workspace = true
+repository.workspace = true
+license-file.workspace = true
+publish.workspace = true
+
+[dependencies]
+
+[dev-dependencies]
+
+[lints]
+workspace = true
diff --git a/packages/ak-lib/src/lib.rs b/packages/ak-lib/src/lib.rs
new file mode 100644
index 0000000000..e63d65161f
--- /dev/null
+++ b/packages/ak-lib/src/lib.rs
@@ -0,0 +1,20 @@
+//! Various utilities used by other crates
+
+pub const VERSION: &str = env!("CARGO_PKG_VERSION");
+
+pub fn authentik_build_hash(fallback: Option<String>) -> String {
+    std::env::var("GIT_BUILD_HASH").unwrap_or_else(|_| fallback.unwrap_or_default())
+}
+
+pub fn authentik_full_version() -> String {
+    let build_hash = authentik_build_hash(None);
+    if build_hash.is_empty() {
+        VERSION.to_owned()
+    } else {
+        format!("{VERSION}+{build_hash}")
+    }
+}
+
+pub fn authentik_user_agent() -> String {
+    format!("authentik@{}", authentik_full_version())
+}