diff --git a/cli/cli.go b/cli/cli.go
index d058ba2..a5f3e17 100644
--- a/cli/cli.go
+++ b/cli/cli.go
@@ -6,7 +6,6 @@ import (
 	"fmt"
 	"strings"
 
-	"github.com/micromdm/nanomdm/log"
 	"github.com/micromdm/nanomdm/storage"
 	"github.com/micromdm/nanomdm/storage/allmulti"
 	"github.com/micromdm/nanomdm/storage/file"
@@ -15,6 +14,7 @@ import (
 
 	_ "github.com/go-sql-driver/mysql"
 	_ "github.com/lib/pq"
+	"github.com/micromdm/nanolib/log"
 )
 
 type StringAccumulator []string
diff --git a/cmd/nano2nano/main.go b/cmd/nano2nano/main.go
index 6e88593..7e860ce 100644
--- a/cmd/nano2nano/main.go
+++ b/cmd/nano2nano/main.go
@@ -11,8 +11,9 @@ import (
 	"net/http"
 
 	"github.com/micromdm/nanomdm/cli"
-	"github.com/micromdm/nanomdm/log/stdlogfmt"
 	"github.com/micromdm/nanomdm/mdm"
+
+	"github.com/micromdm/nanolib/log/stdlogfmt"
 )
 
 // overridden by -ldflags -X
diff --git a/cmd/nanomdm/main.go b/cmd/nanomdm/main.go
index 60fb3ea..07256e0 100644
--- a/cmd/nanomdm/main.go
+++ b/cmd/nanomdm/main.go
@@ -17,7 +17,6 @@ import (
 	httpapi "github.com/micromdm/nanomdm/http/api"
 	"github.com/micromdm/nanomdm/http/authproxy"
 	httpmdm "github.com/micromdm/nanomdm/http/mdm"
-	"github.com/micromdm/nanomdm/log/stdlogfmt"
 	"github.com/micromdm/nanomdm/push/nanopush"
 	pushsvc "github.com/micromdm/nanomdm/push/service"
 	"github.com/micromdm/nanomdm/service"
@@ -26,6 +25,8 @@ import (
 	"github.com/micromdm/nanomdm/service/microwebhook"
 	"github.com/micromdm/nanomdm/service/multi"
 	"github.com/micromdm/nanomdm/service/nanomdm"
+
+	"github.com/micromdm/nanolib/log/stdlogfmt"
 )
 
 // overridden by -ldflags -X
diff --git a/go.mod b/go.mod
index 562dd8d..0168fc3 100644
--- a/go.mod
+++ b/go.mod
@@ -7,6 +7,7 @@ require (
 	github.com/go-sql-driver/mysql v1.8.1
 	github.com/groob/plist v0.0.0-20220217120414-63fa881b19a5
 	github.com/lib/pq v1.10.9
+	github.com/micromdm/nanolib v0.1.1
 	github.com/smallstep/pkcs7 v0.0.0-20231107075624-be1870d87d13
 	golang.org/x/net v0.25.0
 )
diff --git a/go.sum b/go.sum
index 0175b9b..5f68548 100644
--- a/go.sum
+++ b/go.sum
@@ -5,11 +5,15 @@ github.com/RobotsAndPencils/buford v0.14.0/go.mod h1:F5FvdB/nkMby8Pge6HFpPHgLOeU
 github.com/aai/gocrypto v0.0.0-20160205191751-93df0c47f8b8/go.mod h1:nE/FnVUmtbP0EbgMVCUtDrm1+86H47QfJIdcmZb+J1s=
 github.com/go-sql-driver/mysql v1.8.1 h1:LedoTUt/eveggdHS9qUFC1EFSa8bU2+1pZjSRpvNJ1Y=
 github.com/go-sql-driver/mysql v1.8.1/go.mod h1:wEBSXgmK//2ZFJyE+qWnIsVGmvmEKlqwuVSjsCm7DZg=
+github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
 github.com/gorilla/mux v1.7.3/go.mod h1:1lud6UwP+6orDFRuTfBEV8e9/aOM/c4fVVCaMa2zaAs=
 github.com/groob/plist v0.0.0-20220217120414-63fa881b19a5 h1:saaSiB25B1wgaxrshQhurfPKUGJ4It3OxNJUy0rdOjU=
 github.com/groob/plist v0.0.0-20220217120414-63fa881b19a5/go.mod h1:itkABA+w2cw7x5nYUS/pLRef6ludkZKOigbROmCTaFw=
 github.com/lib/pq v1.10.9 h1:YXG7RB+JIjhP29X+OtkiDnYaXQwpS4JEWq7dtCCRUEw=
 github.com/lib/pq v1.10.9/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
+github.com/micromdm/nanolib v0.1.1 h1:nNwY2xLBTHSpwEJsW5xGjkW9MdskAbeo/e6+ZYwr2mE=
+github.com/micromdm/nanolib v0.1.1/go.mod h1:FwBKCvvphgYvbdUZ+qw5kay7NHJcg6zPi8W7kXNajmE=
+github.com/peterbourgon/diskv/v3 v3.0.1/go.mod h1:kJ5Ny7vLdARGU3WUuy6uzO6T0nb/2gWcT1JiBvRmb5o=
 github.com/smallstep/pkcs7 v0.0.0-20231107075624-be1870d87d13 h1:qRxEt9ESQhAg1kjmgJ8oyyzlc9zkAjOooe7bcKjKORQ=
 github.com/smallstep/pkcs7 v0.0.0-20231107075624-be1870d87d13/go.mod h1:SoUAr/4M46rZ3WaLstHxGhLEgoYIDRqxQEXLOmOEB0Y=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
diff --git a/http/api/api.go b/http/api/api.go
index 2574324..8be45a7 100644
--- a/http/api/api.go
+++ b/http/api/api.go
@@ -15,11 +15,12 @@ import (
 
 	"github.com/micromdm/nanomdm/cryptoutil"
 	mdmhttp "github.com/micromdm/nanomdm/http"
-	"github.com/micromdm/nanomdm/log"
-	"github.com/micromdm/nanomdm/log/ctxlog"
 	"github.com/micromdm/nanomdm/mdm"
 	"github.com/micromdm/nanomdm/push"
 	"github.com/micromdm/nanomdm/storage"
+
+	"github.com/micromdm/nanolib/log"
+	"github.com/micromdm/nanolib/log/ctxlog"
 )
 
 // enrolledAPIResult is a per-enrollment API result.
diff --git a/http/authproxy/authproxy.go b/http/authproxy/authproxy.go
index fd04287..25e5d3c 100644
--- a/http/authproxy/authproxy.go
+++ b/http/authproxy/authproxy.go
@@ -7,8 +7,8 @@ import (
 	"net/http/httputil"
 	"net/url"
 
-	"github.com/micromdm/nanomdm/log"
-	"github.com/micromdm/nanomdm/log/ctxlog"
+	"github.com/micromdm/nanolib/log"
+	"github.com/micromdm/nanolib/log/ctxlog"
 )
 
 // HeaderFunc takes an HTTP request and returns a string value.
diff --git a/http/http.go b/http/http.go
index 4233705..c9f5719 100644
--- a/http/http.go
+++ b/http/http.go
@@ -10,8 +10,8 @@ import (
 	"net"
 	"net/http"
 
-	"github.com/micromdm/nanomdm/log"
-	"github.com/micromdm/nanomdm/log/ctxlog"
+	"github.com/micromdm/nanolib/log"
+	"github.com/micromdm/nanolib/log/ctxlog"
 )
 
 // ReadAllAndReplaceBody reads all of r.Body and replaces it with a new byte buffer.
diff --git a/http/mdm/mdm.go b/http/mdm/mdm.go
index 0002db7..9cb4830 100644
--- a/http/mdm/mdm.go
+++ b/http/mdm/mdm.go
@@ -7,10 +7,11 @@ import (
 	"strings"
 
 	mdmhttp "github.com/micromdm/nanomdm/http"
-	"github.com/micromdm/nanomdm/log"
-	"github.com/micromdm/nanomdm/log/ctxlog"
 	"github.com/micromdm/nanomdm/mdm"
 	"github.com/micromdm/nanomdm/service"
+
+	"github.com/micromdm/nanolib/log"
+	"github.com/micromdm/nanolib/log/ctxlog"
 )
 
 func mdmReqFromHTTPReq(r *http.Request) *mdm.Request {
diff --git a/http/mdm/mdm_cert.go b/http/mdm/mdm_cert.go
index 44b24ed..7363062 100644
--- a/http/mdm/mdm_cert.go
+++ b/http/mdm/mdm_cert.go
@@ -8,9 +8,10 @@ import (
 
 	"github.com/micromdm/nanomdm/cryptoutil"
 	mdmhttp "github.com/micromdm/nanomdm/http"
-	"github.com/micromdm/nanomdm/log"
-	"github.com/micromdm/nanomdm/log/ctxlog"
 	"github.com/micromdm/nanomdm/storage"
+
+	"github.com/micromdm/nanolib/log"
+	"github.com/micromdm/nanolib/log/ctxlog"
 )
 
 type contextKeyCert struct{}
diff --git a/http/mdm/mdm_test.go b/http/mdm/mdm_test.go
index c05414d..ded9030 100644
--- a/http/mdm/mdm_test.go
+++ b/http/mdm/mdm_test.go
@@ -9,7 +9,7 @@ import (
 	"net/http/httptest"
 	"testing"
 
-	"github.com/micromdm/nanomdm/log"
+	"github.com/micromdm/nanolib/log"
 )
 
 const (
diff --git a/log/ctxlog/ctxlog.go b/log/ctxlog/ctxlog.go
deleted file mode 100644
index b7d4fbb..0000000
--- a/log/ctxlog/ctxlog.go
+++ /dev/null
@@ -1,72 +0,0 @@
-// Package ctxlog allows logging data stored with a context.
-package ctxlog
-
-import (
-	"context"
-	"sync"
-
-	"github.com/micromdm/nanomdm/log"
-)
-
-// CtxKVFunc creates logger key-value pairs from a context.
-// CtxKVFuncs should aim to be be as efficient as possible—ideally only
-// doing the minimum to read context values and generate KV pairs. Each
-// associated CtxKVFunc is called every time we adapt a logger with
-// Logger.
-type CtxKVFunc func(context.Context) []interface{}
-
-// ctxKeyFuncs is the context key for storing and retriveing
-// a funcs{} struct on a context.
-type ctxKeyFuncs struct{}
-
-// funcs holds the associated CtxKVFunc functions to run.
-type funcs struct {
-	sync.RWMutex
-	funcs []CtxKVFunc
-}
-
-// AddFunc associates a new CtxKVFunc function to a context.
-func AddFunc(ctx context.Context, f CtxKVFunc) context.Context {
-	if ctx == nil {
-		return ctx
-	}
-	ctxFuncs, ok := ctx.Value(ctxKeyFuncs{}).(*funcs)
-	if !ok || ctxFuncs == nil {
-		ctxFuncs = &funcs{}
-	}
-	ctxFuncs.Lock()
-	ctxFuncs.funcs = append(ctxFuncs.funcs, f)
-	ctxFuncs.Unlock()
-	return context.WithValue(ctx, ctxKeyFuncs{}, ctxFuncs)
-}
-
-// Logger runs the associated CtxKVFunc functions and returns a new
-// logger with the results.
-func Logger(ctx context.Context, logger log.Logger) log.Logger {
-	if ctx == nil {
-		return logger
-	}
-	ctxFuncs, ok := ctx.Value(ctxKeyFuncs{}).(*funcs)
-	if !ok || ctxFuncs == nil {
-		return logger
-	}
-	var acc []interface{}
-	ctxFuncs.RLock()
-	for _, f := range ctxFuncs.funcs {
-		acc = append(acc, f(ctx)...)
-	}
-	ctxFuncs.RUnlock()
-	return logger.With(acc...)
-}
-
-// SimpleStringFunc is a helper that generates a simple CtxKVFunc that
-// returns a key-value pair if found on the context.
-func SimpleStringFunc(logKey string, ctxKey interface{}) CtxKVFunc {
-	return func(ctx context.Context) (out []interface{}) {
-		v, _ := ctx.Value(ctxKey).(string)
-		if v != "" {
-			out = []interface{}{logKey, v}
-		}
-		return
-	}
-}
diff --git a/log/logger.go b/log/logger.go
deleted file mode 100644
index 2775e82..0000000
--- a/log/logger.go
+++ /dev/null
@@ -1,17 +0,0 @@
-package log
-
-// Pacakge log is embedded (not imported) from:
-// https://github.com/jessepeterson/go-log
-
-// Logger is a generic logging interface to a structured, leveled, nest-able logger
-type Logger interface {
-	// Info logs using the info level
-	Info(...interface{})
-
-	// Debug logs using the debug level
-	Debug(...interface{})
-
-	// With nests the Logger
-	// Usually for adding logging context to a sub-logger
-	With(...interface{}) Logger
-}
diff --git a/log/nop.go b/log/nop.go
deleted file mode 100644
index c0800c5..0000000
--- a/log/nop.go
+++ /dev/null
@@ -1,21 +0,0 @@
-package log
-
-// Pacakge log is embedded (not imported) from:
-// https://github.com/jessepeterson/go-log
-
-// nopLogger does nothing
-type nopLogger struct{}
-
-// Info does nothing
-func (*nopLogger) Info(_ ...interface{}) {}
-
-// Debug does nothing
-func (*nopLogger) Debug(_ ...interface{}) {}
-
-// With returns (the same) logger
-func (logger *nopLogger) With(_ ...interface{}) Logger {
-	return logger
-}
-
-// NopLogger is a Logger that does nothing
-var NopLogger = &nopLogger{}
diff --git a/log/stdlogfmt/stdlog.go b/log/stdlogfmt/stdlog.go
deleted file mode 100644
index 9accbfb..0000000
--- a/log/stdlogfmt/stdlog.go
+++ /dev/null
@@ -1,116 +0,0 @@
-package stdlogfmt
-
-import (
-	"fmt"
-	stdlog "log"
-	"os"
-	"path/filepath"
-	"runtime"
-	"strings"
-	"time"
-
-	"github.com/micromdm/nanomdm/log"
-)
-
-// Logger wraps a standard library logger and adapts it to pkg/log.
-type Logger struct {
-	logger  *stdlog.Logger
-	context []interface{}
-	debug   bool
-	depth   int
-	ts      bool
-}
-
-type Option func(*Logger)
-
-// WithLogger sets the Go standard logger to use.
-func WithLogger(logger *stdlog.Logger) Option {
-	return func(l *Logger) {
-		l.logger = logger
-	}
-}
-
-// WithDebug turns on debug logging.
-func WithDebug() Option {
-	return func(l *Logger) {
-		l.debug = true
-	}
-}
-
-// WithDebugFlag sets debug logging on or off.
-func WithDebugFlag(flag bool) Option {
-	return func(l *Logger) {
-		l.debug = flag
-	}
-}
-
-// WithCallerDepth sets the call depth of the logger for filename and line
-// logging. Set depth to 0 to disable filename and line logging.
-func WithCallerDepth(depth int) Option {
-	return func(l *Logger) {
-		l.depth = depth
-	}
-}
-
-// WithoutTimestamp disables outputting an RFC3339 timestamp.
-func WithoutTimestamp() Option {
-	return func(l *Logger) {
-		l.ts = false
-	}
-}
-
-// New creates a new logger that adapts the Go standard log package to Logger.
-func New(opts ...Option) *Logger {
-	l := &Logger{
-		logger: stdlog.New(os.Stderr, "", 0),
-		depth:  1,
-		ts:     true,
-	}
-	for _, opt := range opts {
-		opt(l)
-	}
-	return l
-}
-
-func (l *Logger) print(args ...interface{}) {
-	if l.ts {
-		args = append([]interface{}{"ts", time.Now().Format(time.RFC3339)}, args...)
-	}
-	if l.depth > 0 {
-		_, filename, line, ok := runtime.Caller(l.depth + 1)
-		if ok {
-			caller := fmt.Sprintf("%s:%d", filepath.Base(filename), line)
-			args = append(args, "caller", caller)
-		}
-	}
-	f := strings.Repeat(" %s=%v", len(args)/2)[1:]
-	if len(args)%2 == 1 {
-		f += " UNKNOWN=%v"
-	}
-	l.logger.Printf(f, args...)
-}
-
-// Info logs using the "info" level
-func (l *Logger) Info(args ...interface{}) {
-	logs := []interface{}{"level", "info"}
-	logs = append(logs, l.context...)
-	logs = append(logs, args...)
-	l.print(logs...)
-}
-
-// Info logs using the "debug" level
-func (l *Logger) Debug(args ...interface{}) {
-	if l.debug {
-		logs := []interface{}{"level", "debug"}
-		logs = append(logs, l.context...)
-		logs = append(logs, args...)
-		l.print(logs...)
-	}
-}
-
-// With creates a new logger using args as context
-func (l *Logger) With(args ...interface{}) log.Logger {
-	l2 := *l
-	l2.context = append(l2.context, args...)
-	return &l2
-}
diff --git a/push/service/service.go b/push/service/service.go
index e80681c..196c9e0 100644
--- a/push/service/service.go
+++ b/push/service/service.go
@@ -8,11 +8,12 @@ import (
 	"fmt"
 	"sync"
 
-	"github.com/micromdm/nanomdm/log"
-	"github.com/micromdm/nanomdm/log/ctxlog"
 	"github.com/micromdm/nanomdm/mdm"
 	"github.com/micromdm/nanomdm/push"
 	"github.com/micromdm/nanomdm/storage"
+
+	"github.com/micromdm/nanolib/log"
+	"github.com/micromdm/nanolib/log/ctxlog"
 )
 
 type provider struct {
diff --git a/service/certauth/certauth.go b/service/certauth/certauth.go
index fbe3c84..038fe7e 100644
--- a/service/certauth/certauth.go
+++ b/service/certauth/certauth.go
@@ -8,11 +8,12 @@ import (
 	"errors"
 	"fmt"
 
-	"github.com/micromdm/nanomdm/log"
-	"github.com/micromdm/nanomdm/log/ctxlog"
 	"github.com/micromdm/nanomdm/mdm"
 	"github.com/micromdm/nanomdm/service"
 	"github.com/micromdm/nanomdm/storage"
+
+	"github.com/micromdm/nanolib/log"
+	"github.com/micromdm/nanolib/log/ctxlog"
 )
 
 var (
diff --git a/service/multi/multi.go b/service/multi/multi.go
index 17df36b..4331b91 100644
--- a/service/multi/multi.go
+++ b/service/multi/multi.go
@@ -4,10 +4,11 @@ package multi
 import (
 	"context"
 
-	"github.com/micromdm/nanomdm/log"
-	"github.com/micromdm/nanomdm/log/ctxlog"
 	"github.com/micromdm/nanomdm/mdm"
 	"github.com/micromdm/nanomdm/service"
+
+	"github.com/micromdm/nanolib/log"
+	"github.com/micromdm/nanolib/log/ctxlog"
 )
 
 // MultiService executes multiple services for the same service calls.
diff --git a/service/nanomdm/service.go b/service/nanomdm/service.go
index 2925ef0..66dc383 100644
--- a/service/nanomdm/service.go
+++ b/service/nanomdm/service.go
@@ -5,11 +5,12 @@ import (
 	"errors"
 	"fmt"
 
-	"github.com/micromdm/nanomdm/log"
-	"github.com/micromdm/nanomdm/log/ctxlog"
 	"github.com/micromdm/nanomdm/mdm"
 	"github.com/micromdm/nanomdm/service"
 	"github.com/micromdm/nanomdm/storage"
+
+	"github.com/micromdm/nanolib/log"
+	"github.com/micromdm/nanolib/log/ctxlog"
 )
 
 // Service is the main NanoMDM service which dispatches to storage.
diff --git a/service/nanomdm/ua.go b/service/nanomdm/ua.go
index 83a8225..20f331f 100644
--- a/service/nanomdm/ua.go
+++ b/service/nanomdm/ua.go
@@ -4,11 +4,12 @@ import (
 	"fmt"
 	"net/http"
 
-	"github.com/micromdm/nanomdm/log"
-	"github.com/micromdm/nanomdm/log/ctxlog"
 	"github.com/micromdm/nanomdm/mdm"
 	"github.com/micromdm/nanomdm/service"
 	"github.com/micromdm/nanomdm/storage"
+
+	"github.com/micromdm/nanolib/log"
+	"github.com/micromdm/nanolib/log/ctxlog"
 )
 
 // UAService is a basic UserAuthenticate service that optionally implements
diff --git a/storage/allmulti/allmulti.go b/storage/allmulti/allmulti.go
index c99268b..841ae2d 100644
--- a/storage/allmulti/allmulti.go
+++ b/storage/allmulti/allmulti.go
@@ -3,10 +3,11 @@ package allmulti
 import (
 	"context"
 
-	"github.com/micromdm/nanomdm/log"
-	"github.com/micromdm/nanomdm/log/ctxlog"
 	"github.com/micromdm/nanomdm/mdm"
 	"github.com/micromdm/nanomdm/storage"
+
+	"github.com/micromdm/nanolib/log"
+	"github.com/micromdm/nanolib/log/ctxlog"
 )
 
 // MultiAllStorage dispatches to multiple AllStorage instances.
diff --git a/storage/allmulti/migrate.go b/storage/allmulti/migrate.go
index 51fb820..469bf80 100644
--- a/storage/allmulti/migrate.go
+++ b/storage/allmulti/migrate.go
@@ -3,7 +3,7 @@ package allmulti
 import (
 	"context"
 
-	"github.com/micromdm/nanomdm/log/ctxlog"
+	"github.com/micromdm/nanolib/log/ctxlog"
 )
 
 func (ms *MultiAllStorage) RetrieveMigrationCheckins(ctx context.Context, c chan<- interface{}) error {
diff --git a/storage/mysql/mysql.go b/storage/mysql/mysql.go
index 166dfac..2af0e83 100644
--- a/storage/mysql/mysql.go
+++ b/storage/mysql/mysql.go
@@ -9,9 +9,10 @@ import (
 	"fmt"
 
 	"github.com/micromdm/nanomdm/cryptoutil"
-	"github.com/micromdm/nanomdm/log"
-	"github.com/micromdm/nanomdm/log/ctxlog"
 	"github.com/micromdm/nanomdm/mdm"
+
+	"github.com/micromdm/nanolib/log"
+	"github.com/micromdm/nanolib/log/ctxlog"
 )
 
 // Schema holds the schema for the NanoMDM MySQL storage.
diff --git a/storage/pgsql/postgresql.go b/storage/pgsql/postgresql.go
index a6fd191..9f3c4dc 100644
--- a/storage/pgsql/postgresql.go
+++ b/storage/pgsql/postgresql.go
@@ -9,9 +9,10 @@ import (
 	"fmt"
 
 	"github.com/micromdm/nanomdm/cryptoutil"
-	"github.com/micromdm/nanomdm/log"
-	"github.com/micromdm/nanomdm/log/ctxlog"
 	"github.com/micromdm/nanomdm/mdm"
+
+	"github.com/micromdm/nanolib/log"
+	"github.com/micromdm/nanolib/log/ctxlog"
 )
 
 // Schema holds the schema for the NanoMDM PostgresSQL storage.
diff --git a/storage/pgsql/queue_test.go b/storage/pgsql/queue_test.go
index f216d90..4d8bb89 100644
--- a/storage/pgsql/queue_test.go
+++ b/storage/pgsql/queue_test.go
@@ -12,7 +12,7 @@ import (
 
 	_ "github.com/lib/pq"
 	"github.com/micromdm/nanomdm/mdm"
-	"github.com/micromdm/nanomdm/storage/internal/test"
+	"github.com/micromdm/nanomdm/storage/test"
 )
 
 var flDSN = flag.String("dsn", "", "DSN of test PostgreSQL instance")
diff --git a/storage/test/queue.go b/storage/test/queue.go
index 047ac7d..aa564c3 100644
--- a/storage/test/queue.go
+++ b/storage/test/queue.go
@@ -4,9 +4,10 @@ import (
 	"context"
 	"testing"
 
-	"github.com/groob/plist"
 	"github.com/micromdm/nanomdm/mdm"
 	"github.com/micromdm/nanomdm/storage"
+
+	"github.com/groob/plist"
 )
 
 // QueueInterfaces are the storage interfaces needed for testing queue operations.