diff --git a/CHANGELOG.md b/CHANGELOG.md
index 851061fd..06bbcea3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -328,6 +328,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   binder tearing down and rebinding every second while teardown silently
   declined to abort anything.
 
+- Tracing targets of the TUN adapter, DNS responder and ICMPv6 code move from
+  `fips::upper::*` to `fips::ipv6tun::*`, because the module they log from is
+  now `ipv6tun` (for example `fips::upper::tun` becomes `fips::ipv6tun::tun`).
+  An existing `RUST_LOG` filter naming an old target still parses and simply
+  stops matching, so the symptom is missing log lines rather than an error.
+  Update `RUST_LOG` filters, journal-watch recipes and any log-scraping alert
+  accordingly. The library path `fips::upper` still resolves.
+
 #### Packaging (Debian)
 
 - An upgrade of the `.deb` now reapplies the firewall ruleset in place. Until
diff --git a/docs/how-to/diagnose-mtu-issues.md b/docs/how-to/diagnose-mtu-issues.md
index c81f727f..fff84b44 100644
--- a/docs/how-to/diagnose-mtu-issues.md
+++ b/docs/how-to/diagnose-mtu-issues.md
@@ -87,7 +87,7 @@ fully-qualified module paths under the `fips` crate.
 sudo systemctl edit fips
 # Add:
 # [Service]
-# Environment=RUST_LOG=info,fips::upper::tun=trace,fips::node::handlers::mmp=debug
+# Environment=RUST_LOG=info,fips::ipv6tun::tun=trace,fips::node::handlers::mmp=debug
 sudo systemctl restart fips
 sudo journalctl -u fips -f
 ```
diff --git a/src/upper/config.rs b/src/ipv6tun/config.rs
similarity index 100%
rename from src/upper/config.rs
rename to src/ipv6tun/config.rs
diff --git a/src/upper/dns.rs b/src/ipv6tun/dns.rs
similarity index 100%
rename from src/upper/dns.rs
rename to src/ipv6tun/dns.rs
diff --git a/src/upper/hosts.rs b/src/ipv6tun/hosts.rs
similarity index 100%
rename from src/upper/hosts.rs
rename to src/ipv6tun/hosts.rs
diff --git a/src/upper/icmp.rs b/src/ipv6tun/icmp.rs
similarity index 100%
rename from src/upper/icmp.rs
rename to src/ipv6tun/icmp.rs
diff --git a/src/upper/icmp_rate_limit.rs b/src/ipv6tun/icmp_rate_limit.rs
similarity index 100%
rename from src/upper/icmp_rate_limit.rs
rename to src/ipv6tun/icmp_rate_limit.rs
diff --git a/src/upper/ipv6_shim.rs b/src/ipv6tun/ipv6_shim.rs
similarity index 100%
rename from src/upper/ipv6_shim.rs
rename to src/ipv6tun/ipv6_shim.rs
diff --git a/src/upper/mod.rs b/src/ipv6tun/mod.rs
similarity index 100%
rename from src/upper/mod.rs
rename to src/ipv6tun/mod.rs
diff --git a/src/upper/tcp_mss.rs b/src/ipv6tun/tcp_mss.rs
similarity index 100%
rename from src/upper/tcp_mss.rs
rename to src/ipv6tun/tcp_mss.rs
diff --git a/src/upper/tun.rs b/src/ipv6tun/tun.rs
similarity index 100%
rename from src/upper/tun.rs
rename to src/ipv6tun/tun.rs
diff --git a/src/lib.rs b/src/lib.rs
index d4675d42..4a4707f0 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -20,6 +20,7 @@ pub mod identity;
 // modules that follow.
 #[macro_use]
 pub(crate) mod instr;
+pub mod ipv6tun;
 pub mod mdns;
 pub mod native;
 pub mod node;
@@ -32,10 +33,13 @@ pub(crate) mod proto;
 pub(crate) mod testutil;
 mod time;
 pub mod transport;
-pub mod upper;
 pub mod utils;
 pub mod version;
 
+// `upper` is the former name of `ipv6tun`; the alias keeps `crate::upper::`
+// and `fips::upper::` paths resolving.
+pub use ipv6tun as upper;
+
 // Re-export identity types
 pub use identity::{
     AuthChallenge, AuthResponse, FipsAddress, Identity, IdentityError, NodeAddr, PeerIdentity,