diff --git a/Cargo.toml b/Cargo.toml
index 5df354e..5b3da70 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,4 +1,4 @@
 [workspace]
-members = ["protocol", "protocol/fuzz", "traffic"]
-default-members = ["protocol", "traffic"]
+members = ["protocol", "traffic"]
+exclude = ["fuzz"]
 resolver = "2"
diff --git a/protocol/fuzz/.gitignore b/fuzz/.gitignore
similarity index 100%
rename from protocol/fuzz/.gitignore
rename to fuzz/.gitignore
diff --git a/protocol/fuzz/Cargo.toml b/fuzz/Cargo.toml
similarity index 92%
rename from protocol/fuzz/Cargo.toml
rename to fuzz/Cargo.toml
index 172a00a..bfeef73 100644
--- a/protocol/fuzz/Cargo.toml
+++ b/fuzz/Cargo.toml
@@ -9,7 +9,7 @@ cargo-fuzz = true
 
 [dependencies]
 libfuzzer-sys = "0.4"
-bip324 = { path = ".." }
+bip324 = { path = "../protocol" }
 rand = "0.8"
 secp256k1 = "0.29"
 
diff --git a/protocol/fuzz/README.md b/fuzz/README.md
similarity index 100%
rename from protocol/fuzz/README.md
rename to fuzz/README.md
diff --git a/protocol/fuzz/fuzz_targets/receive_garbage.rs b/fuzz/fuzz_targets/receive_garbage.rs
similarity index 100%
rename from protocol/fuzz/fuzz_targets/receive_garbage.rs
rename to fuzz/fuzz_targets/receive_garbage.rs
diff --git a/protocol/fuzz/fuzz_targets/receive_key.rs b/fuzz/fuzz_targets/receive_key.rs
similarity index 100%
rename from protocol/fuzz/fuzz_targets/receive_key.rs
rename to fuzz/fuzz_targets/receive_key.rs
diff --git a/justfile b/justfile
index 07356fc..7a902fa 100644
--- a/justfile
+++ b/justfile
@@ -1,7 +1,7 @@
 # Every commit on the master branch is expected to have working `check` and `test-*` recipes.
 #
 # The recipes make heavy use of `rustup`'s toolchain syntax (e.g. `cargo +nightly`). `rustup` is
-# required on the system in order to intercept the `cargo` commands and to install and use the appropriate toolchain with components. 
+# required on the system in order to intercept the `cargo` commands and to install and use the appropriate toolchain with components.
 #
 # The root directory of this workspace is "virtual", it has no source code itself, just a holder of crates. This means
 # the cargo commands generally run on all the child crates by default without the `--workspace` flag.
@@ -36,12 +36,12 @@ STABLE_TOOLCHAIN := "1.88.0"
   # Adding --fix flag to apply suggestions with --allow-dirty.
   cargo +{{NIGHTLY_TOOLCHAIN}} clippy --all-features --all-targets --fix --allow-dirty -- -D warnings
 
-# Run a test suite: features, msrv, constraints, no-std, or all.
+# Run a test suite: features, msrv, constraints, no-std, fuzz, or all.
 @test suite="features":
   just _test-{{suite}}
 
 # Run all test suites.
-@_test-all: _test-features _test-msrv _test-constraints _test-no-std
+@_test-all: _test-features _test-msrv _test-constraints _test-no-std _test-fuzz
 
 # Test library with feature flag matrix compatability.
 @_test-features:
@@ -68,7 +68,7 @@ STABLE_TOOLCHAIN := "1.88.0"
   # Clear any previously resolved versions and re-resolve to the minimums.
   rm -f Cargo.lock
   cargo +{{NIGHTLY_TOOLCHAIN}} check --all-features -Z direct-minimal-versions
-  # Clear again and check the maximums by ignoring any rust-version caps. 
+  # Clear again and check the maximums by ignoring any rust-version caps.
   rm -f Cargo.lock
   cargo +{{NIGHTLY_TOOLCHAIN}} check --all-features --ignore-rust-version
   rm -f Cargo.lock
@@ -78,21 +78,15 @@ STABLE_TOOLCHAIN := "1.88.0"
   cargo install cross@0.2.5
   $HOME/.cargo/bin/cross build --package bip324 --target thumbv7m-none-eabi --no-default-features
 
+# Check that fuzz targets compile.
+@_test-fuzz:
+  cargo install cargo-fuzz@0.12.0
+  cargo +{{NIGHTLY_TOOLCHAIN}} fuzz build
+
 # Run benchmarks.
 @bench:
   cargo +{{NIGHTLY_TOOLCHAIN}} bench --package bip324 --bench cipher_session
 
-# Run fuzz target: receive_key or receive_garbage.
-@fuzz target seconds:
-  rustup component add --toolchain {{NIGHTLY_TOOLCHAIN}} llvm-tools-preview
-  cargo install cargo-fuzz@0.12.0
-  # Generate new test cases and add to corpus. Bumping length for garbage.
-  cd protocol && cargo +{{NIGHTLY_TOOLCHAIN}} fuzz run {{target}} -- -max_len=5120 -max_total_time={{seconds}}
-  # Measure coverage of corpus against code.
-  cd protocol && cargo +{{NIGHTLY_TOOLCHAIN}} fuzz coverage {{target}}
-  # Generate HTML coverage report.
-  protocol/fuzz/coverage.sh {{NIGHTLY_TOOLCHAIN}} {{target}}
-
 # Add a release tag and publish to the upstream remote. Requires write privileges.
 @tag crate version remote="upstream":
   # Guardrails: on a clean main with updated changelog and manifest.
diff --git a/protocol/fuzz/coverage.sh b/protocol/fuzz/coverage.sh
deleted file mode 100755
index d3f0ece..0000000
--- a/protocol/fuzz/coverage.sh
+++ /dev/null
@@ -1,44 +0,0 @@
-#!/usr/bin/env bash
-
-# Generate HTML coverage report
-# Usage: ./coverage.sh <toolchain> <target>
-# Example: ./coverage.sh nightly-2025-07-10 receive_key
-#
-# Grabbed from this blog: https://tweedegolf.nl/en/blog/154/what-is-my-fuzzer-doing
-# Hopefully standardized soon: https://github.com/taiki-e/cargo-llvm-cov/pull/431
-
-set -euo pipefail
-
-if [ $# -ne 2 ]; then
-    echo "Usage: $0 <toolchain> <target>"
-    echo "Example: $0 nightly-2025-07-10 receive_key"
-    exit 1
-fi
-
-TOOLCHAIN="$1"
-TARGET="$2"
-
-# Change to protocol directory.
-cd "$(dirname "$0")/.."
-
-# Install rustfilt for demangling.
-cargo install rustfilt@0.2.1
-RUSTFILT="$HOME/.cargo/bin/rustfilt"
-
-# Get toolchain info
-SYSROOT=$(rustc +${TOOLCHAIN} --print sysroot)
-HOST_TUPLE=$(rustc +${TOOLCHAIN} --print host-tuple)
-
-BINARY="target/$HOST_TUPLE/coverage/$HOST_TUPLE/release/$TARGET"
-
-echo "Generating HTML coverage report for $TARGET..."
-"$SYSROOT/lib/rustlib/$HOST_TUPLE/bin/llvm-cov" show \
-    "$BINARY" \
-    -instr-profile=fuzz/coverage/"$TARGET"/coverage.profdata \
-    -Xdemangler="$RUSTFILT" \
-    --format=html \
-    -output-dir=fuzz/coverage/"$TARGET"/html \
-    -ignore-filename-regex="\.cargo|\.rustup|fuzz_target|/rustc/"
-
-REPORT_PATH="$(pwd)/fuzz/coverage/$TARGET/html/index.html"
-echo "$REPORT_PATH"