diff --git a/Cargo.lock b/Cargo.lock
index c9879d6b8..4b2c82f0f 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3277,10 +3277,12 @@ dependencies = [
  "base64ct",
  "chrono",
  "crc",
+ "lettre",
  "mas-iana",
  "mas-jose",
  "oauth2-types",
  "rand 0.8.5",
+ "rand_chacha 0.3.1",
  "regex",
  "ruma-common",
  "serde",
@@ -6178,6 +6180,7 @@ dependencies = [
  "futures-util",
  "insta",
  "mas-config",
+ "mas-data-model",
  "mas-iana",
  "mas-storage",
  "mas-storage-pg",
diff --git a/crates/axum-utils/src/csrf.rs b/crates/axum-utils/src/csrf.rs
index 677a81062..a4ef49b76 100644
--- a/crates/axum-utils/src/csrf.rs
+++ b/crates/axum-utils/src/csrf.rs
@@ -6,7 +6,7 @@
 
 use base64ct::{Base64UrlUnpadded, Encoding};
 use chrono::{DateTime, Duration, Utc};
-use mas_storage::Clock;
+use mas_data_model::Clock;
 use rand::{Rng, RngCore, distributions::Standard, prelude::Distribution as _};
 use serde::{Deserialize, Serialize};
 use serde_with::{TimestampSeconds, serde_as};
diff --git a/crates/axum-utils/src/user_authorization.rs b/crates/axum-utils/src/user_authorization.rs
index fb6d233c0..395ce465a 100644
--- a/crates/axum-utils/src/user_authorization.rs
+++ b/crates/axum-utils/src/user_authorization.rs
@@ -16,9 +16,9 @@ use axum::{
 use axum_extra::typed_header::{TypedHeader, TypedHeaderRejectionReason};
 use headers::{Authorization, Header, HeaderMapExt, HeaderName, authorization::Bearer};
 use http::{HeaderMap, HeaderValue, Request, StatusCode, header::WWW_AUTHENTICATE};
-use mas_data_model::Session;
+use mas_data_model::{Clock, Session};
 use mas_storage::{
-    Clock, RepositoryAccess,
+    RepositoryAccess,
     oauth2::{OAuth2AccessTokenRepository, OAuth2SessionRepository},
 };
 use serde::{Deserialize, de::DeserializeOwned};
diff --git a/crates/cli/src/app_state.rs b/crates/cli/src/app_state.rs
index 40ae94806..f9f761338 100644
--- a/crates/cli/src/app_state.rs
+++ b/crates/cli/src/app_state.rs
@@ -9,7 +9,7 @@ use std::{convert::Infallible, net::IpAddr, sync::Arc};
 use axum::extract::{FromRef, FromRequestParts};
 use ipnetwork::IpNetwork;
 use mas_context::LogContext;
-use mas_data_model::SiteConfig;
+use mas_data_model::{BoxClock, BoxRng, SiteConfig, SystemClock};
 use mas_handlers::{
     ActivityTracker, BoundActivityTracker, CookieManager, ErrorWrapper, GraphQLSchema, Limiter,
     MetadataCache, RequesterFingerprint, passwords::PasswordManager,
@@ -19,9 +19,7 @@ use mas_keystore::{Encrypter, Keystore};
 use mas_matrix::HomeserverConnection;
 use mas_policy::{Policy, PolicyFactory};
 use mas_router::UrlBuilder;
-use mas_storage::{
-    BoxClock, BoxRepository, BoxRepositoryFactory, BoxRng, RepositoryFactory, SystemClock,
-};
+use mas_storage::{BoxRepository, BoxRepositoryFactory, RepositoryFactory};
 use mas_storage_pg::PgRepositoryFactory;
 use mas_templates::Templates;
 use opentelemetry::KeyValue;
diff --git a/crates/cli/src/commands/config.rs b/crates/cli/src/commands/config.rs
index 73c100e2c..034f84b4a 100644
--- a/crates/cli/src/commands/config.rs
+++ b/crates/cli/src/commands/config.rs
@@ -11,7 +11,7 @@ use camino::Utf8PathBuf;
 use clap::Parser;
 use figment::Figment;
 use mas_config::{ConfigurationSection, RootConfig, SyncConfig};
-use mas_storage::{Clock as _, SystemClock};
+use mas_data_model::{Clock as _, SystemClock};
 use mas_storage_pg::MIGRATOR;
 use rand::SeedableRng;
 use tokio::io::AsyncWriteExt;
diff --git a/crates/cli/src/commands/manage.rs b/crates/cli/src/commands/manage.rs
index cedfcee2b..a6a8e67a0 100644
--- a/crates/cli/src/commands/manage.rs
+++ b/crates/cli/src/commands/manage.rs
@@ -15,11 +15,11 @@ use figment::Figment;
 use mas_config::{
     ConfigurationSection, ConfigurationSectionExt, DatabaseConfig, MatrixConfig, PasswordsConfig,
 };
-use mas_data_model::{Device, TokenType, Ulid, UpstreamOAuthProvider, User};
+use mas_data_model::{Clock, Device, SystemClock, TokenType, Ulid, UpstreamOAuthProvider, User};
 use mas_email::Address;
 use mas_matrix::HomeserverConnection;
 use mas_storage::{
-    Clock, RepositoryAccess, SystemClock,
+    RepositoryAccess,
     compat::{CompatAccessTokenRepository, CompatSessionFilter, CompatSessionRepository},
     oauth2::OAuth2SessionFilter,
     queue::{
diff --git a/crates/cli/src/commands/server.rs b/crates/cli/src/commands/server.rs
index c5e56f0a3..1367f131e 100644
--- a/crates/cli/src/commands/server.rs
+++ b/crates/cli/src/commands/server.rs
@@ -14,10 +14,10 @@ use mas_config::{
     AppConfig, ClientsConfig, ConfigurationSection, ConfigurationSectionExt, UpstreamOAuth2Config,
 };
 use mas_context::LogContext;
+use mas_data_model::SystemClock;
 use mas_handlers::{ActivityTracker, CookieManager, Limiter, MetadataCache};
 use mas_listener::server::Server;
 use mas_router::UrlBuilder;
-use mas_storage::SystemClock;
 use mas_storage_pg::{MIGRATOR, PgRepositoryFactory};
 use sqlx::migrate::Migrate;
 use tracing::{Instrument, info, info_span, warn};
diff --git a/crates/cli/src/commands/syn2mas.rs b/crates/cli/src/commands/syn2mas.rs
index 50dd99778..c28935af5 100644
--- a/crates/cli/src/commands/syn2mas.rs
+++ b/crates/cli/src/commands/syn2mas.rs
@@ -13,7 +13,7 @@ use mas_config::{
     ConfigurationSection, ConfigurationSectionExt, DatabaseConfig, MatrixConfig, SyncConfig,
     UpstreamOAuth2Config,
 };
-use mas_storage::SystemClock;
+use mas_data_model::SystemClock;
 use mas_storage_pg::MIGRATOR;
 use rand::thread_rng;
 use sqlx::{Connection, Either, PgConnection, postgres::PgConnectOptions, types::Uuid};
diff --git a/crates/cli/src/commands/templates.rs b/crates/cli/src/commands/templates.rs
index 011c5d268..111f19682 100644
--- a/crates/cli/src/commands/templates.rs
+++ b/crates/cli/src/commands/templates.rs
@@ -12,7 +12,7 @@ use mas_config::{
     AccountConfig, BrandingConfig, CaptchaConfig, ConfigurationSection, ConfigurationSectionExt,
     ExperimentalConfig, MatrixConfig, PasswordsConfig, TemplatesConfig,
 };
-use mas_storage::{Clock, SystemClock};
+use mas_data_model::{Clock, SystemClock};
 use rand::SeedableRng;
 use tracing::info_span;
 
diff --git a/crates/cli/src/commands/worker.rs b/crates/cli/src/commands/worker.rs
index 22dd713e1..31d0d56c2 100644
--- a/crates/cli/src/commands/worker.rs
+++ b/crates/cli/src/commands/worker.rs
@@ -9,8 +9,8 @@ use std::{process::ExitCode, time::Duration};
 use clap::Parser;
 use figment::Figment;
 use mas_config::{AppConfig, ConfigurationSection};
+use mas_data_model::SystemClock;
 use mas_router::UrlBuilder;
-use mas_storage::SystemClock;
 use mas_storage_pg::PgRepositoryFactory;
 use tracing::{info, info_span};
 
diff --git a/crates/cli/src/sync.rs b/crates/cli/src/sync.rs
index 965a4fc95..4b8c388c3 100644
--- a/crates/cli/src/sync.rs
+++ b/crates/cli/src/sync.rs
@@ -9,9 +9,10 @@
 use std::collections::{BTreeMap, BTreeSet};
 
 use mas_config::{ClientsConfig, UpstreamOAuth2Config};
+use mas_data_model::Clock;
 use mas_keystore::Encrypter;
 use mas_storage::{
-    Clock, Pagination, RepositoryAccess,
+    Pagination, RepositoryAccess,
     upstream_oauth2::{UpstreamOAuthProviderFilter, UpstreamOAuthProviderParams},
 };
 use mas_storage_pg::PgRepository;
diff --git a/crates/data-model/Cargo.toml b/crates/data-model/Cargo.toml
index 6474d46ae..da7021b11 100644
--- a/crates/data-model/Cargo.toml
+++ b/crates/data-model/Cargo.toml
@@ -26,10 +26,13 @@ url.workspace = true
 crc.workspace = true
 ulid.workspace = true
 rand.workspace = true
+rand_chacha.workspace = true
 regex.workspace = true
 woothee.workspace = true
 ruma-common.workspace = true
+lettre.workspace = true
 
 mas-iana.workspace = true
 mas-jose.workspace = true
 oauth2-types.workspace = true
+
diff --git a/crates/storage/src/clock.rs b/crates/data-model/src/clock.rs
similarity index 100%
rename from crates/storage/src/clock.rs
rename to crates/data-model/src/clock.rs
diff --git a/crates/data-model/src/lib.rs b/crates/data-model/src/lib.rs
index f1b551891..6be06b4d9 100644
--- a/crates/data-model/src/lib.rs
+++ b/crates/data-model/src/lib.rs
@@ -8,6 +8,7 @@
 
 use thiserror::Error;
 
+pub mod clock;
 pub(crate) mod compat;
 pub mod oauth2;
 pub(crate) mod policy_data;
@@ -16,6 +17,7 @@ pub(crate) mod tokens;
 pub(crate) mod upstream_oauth2;
 pub(crate) mod user_agent;
 pub(crate) mod users;
+mod utils;
 
 /// Error when an invalid state transition is attempted.
 #[derive(Debug, Error)]
@@ -25,6 +27,7 @@ pub struct InvalidTransitionError;
 pub use ulid::Ulid;
 
 pub use self::{
+    clock::{Clock, SystemClock},
     compat::{
         CompatAccessToken, CompatRefreshToken, CompatRefreshTokenState, CompatSession,
         CompatSessionState, CompatSsoLogin, CompatSsoLoginState, Device, ToScopeTokenError,
@@ -53,4 +56,5 @@ pub use self::{
         UserEmailAuthentication, UserEmailAuthenticationCode, UserRecoverySession,
         UserRecoveryTicket, UserRegistration, UserRegistrationPassword, UserRegistrationToken,
     },
+    utils::{BoxClock, BoxRng},
 };
diff --git a/crates/data-model/src/oauth2/authorization_grant.rs b/crates/data-model/src/oauth2/authorization_grant.rs
index d6699f575..738277b84 100644
--- a/crates/data-model/src/oauth2/authorization_grant.rs
+++ b/crates/data-model/src/oauth2/authorization_grant.rs
@@ -4,6 +4,8 @@
 // SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-Element-Commercial
 // Please see LICENSE files in the repository root for full details.
 
+use std::str::FromStr as _;
+
 use chrono::{DateTime, Utc};
 use mas_iana::oauth::PkceCodeChallengeMethod;
 use oauth2_types::{
@@ -142,6 +144,7 @@ impl AuthorizationGrantStage {
 
 pub enum LoginHint<'a> {
     MXID(&'a UserId),
+    Email(lettre::Address),
     None,
 }
 
@@ -172,33 +175,28 @@ impl std::ops::Deref for AuthorizationGrant {
 }
 
 impl AuthorizationGrant {
+    /// Parse a `login_hint`
+    ///
+    /// Returns `LoginHint::MXID` for valid mxid 'mxid:@john.doe:example.com'
+    ///
+    /// Returns `LoginHint::Email` for valid email 'john.doe@example.com'
+    ///
+    /// Otherwise returns `LoginHint::None`
     #[must_use]
     pub fn parse_login_hint(&self, homeserver: &str) -> LoginHint<'_> {
         let Some(login_hint) = &self.login_hint else {
             return LoginHint::None;
         };
 
-        // Return none if the format is incorrect
-        let Some((prefix, value)) = login_hint.split_once(':') else {
-            return LoginHint::None;
-        };
-
-        match prefix {
-            "mxid" => {
-                // Instead of erroring just return none
-                let Ok(mxid) = <&UserId>::try_from(value) else {
-                    return LoginHint::None;
-                };
-
-                // Only handle MXIDs for current homeserver
-                if mxid.server_name() != homeserver {
-                    return LoginHint::None;
-                }
-
-                LoginHint::MXID(mxid)
-            }
-            // Unknown hint type, treat as none
-            _ => LoginHint::None,
+        if let Some(value) = login_hint.strip_prefix("mxid:")
+            && let Ok(mxid) = <&UserId>::try_from(value)
+            && mxid.server_name() == homeserver
+        {
+            LoginHint::MXID(mxid)
+        } else if let Ok(email) = lettre::Address::from_str(login_hint) {
+            LoginHint::Email(email)
+        } else {
+            LoginHint::None
         }
     }
 
@@ -271,17 +269,15 @@ impl AuthorizationGrant {
 
 #[cfg(test)]
 mod tests {
-    use rand::thread_rng;
+    use rand::SeedableRng;
 
     use super::*;
+    use crate::clock::{Clock, MockClock};
 
     #[test]
     fn no_login_hint() {
-        #[allow(clippy::disallowed_methods)]
-        let mut rng = thread_rng();
-
-        #[allow(clippy::disallowed_methods)]
-        let now = Utc::now();
+        let now = MockClock::default().now();
+        let mut rng = rand_chacha::ChaChaRng::seed_from_u64(42);
 
         let grant = AuthorizationGrant {
             login_hint: None,
@@ -295,11 +291,8 @@ mod tests {
 
     #[test]
     fn valid_login_hint() {
-        #[allow(clippy::disallowed_methods)]
-        let mut rng = thread_rng();
-
-        #[allow(clippy::disallowed_methods)]
-        let now = Utc::now();
+        let now = MockClock::default().now();
+        let mut rng = rand_chacha::ChaChaRng::seed_from_u64(42);
 
         let grant = AuthorizationGrant {
             login_hint: Some(String::from("mxid:@example-user:example.com")),
@@ -312,12 +305,24 @@ mod tests {
     }
 
     #[test]
-    fn invalid_login_hint() {
-        #[allow(clippy::disallowed_methods)]
-        let mut rng = thread_rng();
+    fn valid_login_hint_with_email() {
+        let now = MockClock::default().now();
+        let mut rng = rand_chacha::ChaChaRng::seed_from_u64(42);
+
+        let grant = AuthorizationGrant {
+            login_hint: Some(String::from("example@user")),
+            ..AuthorizationGrant::sample(now, &mut rng)
+        };
 
-        #[allow(clippy::disallowed_methods)]
-        let now = Utc::now();
+        let hint = grant.parse_login_hint("example.com");
+
+        assert!(matches!(hint, LoginHint::Email(email) if email.to_string() == "example@user"));
+    }
+
+    #[test]
+    fn invalid_login_hint() {
+        let now = MockClock::default().now();
+        let mut rng = rand_chacha::ChaChaRng::seed_from_u64(42);
 
         let grant = AuthorizationGrant {
             login_hint: Some(String::from("example-user")),
@@ -331,11 +336,8 @@ mod tests {
 
     #[test]
     fn valid_login_hint_for_wrong_homeserver() {
-        #[allow(clippy::disallowed_methods)]
-        let mut rng = thread_rng();
-
-        #[allow(clippy::disallowed_methods)]
-        let now = Utc::now();
+        let now = MockClock::default().now();
+        let mut rng = rand_chacha::ChaChaRng::seed_from_u64(42);
 
         let grant = AuthorizationGrant {
             login_hint: Some(String::from("mxid:@example-user:matrix.org")),
@@ -349,11 +351,8 @@ mod tests {
 
     #[test]
     fn unknown_login_hint_type() {
-        #[allow(clippy::disallowed_methods)]
-        let mut rng = thread_rng();
-
-        #[allow(clippy::disallowed_methods)]
-        let now = Utc::now();
+        let now = MockClock::default().now();
+        let mut rng = rand_chacha::ChaChaRng::seed_from_u64(42);
 
         let grant = AuthorizationGrant {
             login_hint: Some(String::from("something:anything")),
diff --git a/crates/data-model/src/utils.rs b/crates/data-model/src/utils.rs
new file mode 100644
index 000000000..bd3b15de6
--- /dev/null
+++ b/crates/data-model/src/utils.rs
@@ -0,0 +1,13 @@
+// Copyright 2025 New Vector Ltd.
+//
+// SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-Element-Commercial
+// Please see LICENSE files in the repository root for full details.
+
+use rand_chacha::rand_core::CryptoRngCore;
+
+use crate::clock::Clock;
+
+/// A boxed [`Clock`]
+pub type BoxClock = Box<dyn Clock + Send>;
+/// A boxed random number generator
+pub type BoxRng = Box<dyn CryptoRngCore + Send>;
diff --git a/crates/handlers/src/activity_tracker/bound.rs b/crates/handlers/src/activity_tracker/bound.rs
index 86286ebf8..14d36fb7c 100644
--- a/crates/handlers/src/activity_tracker/bound.rs
+++ b/crates/handlers/src/activity_tracker/bound.rs
@@ -6,8 +6,7 @@
 
 use std::net::IpAddr;
 
-use mas_data_model::{BrowserSession, CompatSession, Session};
-use mas_storage::Clock;
+use mas_data_model::{BrowserSession, Clock, CompatSession, Session};
 
 use crate::activity_tracker::ActivityTracker;
 
diff --git a/crates/handlers/src/activity_tracker/mod.rs b/crates/handlers/src/activity_tracker/mod.rs
index 6f8bf41d6..738da3856 100644
--- a/crates/handlers/src/activity_tracker/mod.rs
+++ b/crates/handlers/src/activity_tracker/mod.rs
@@ -10,8 +10,8 @@ mod worker;
 use std::net::IpAddr;
 
 use chrono::{DateTime, Utc};
-use mas_data_model::{BrowserSession, CompatSession, Session};
-use mas_storage::{BoxRepositoryFactory, Clock};
+use mas_data_model::{BrowserSession, Clock, CompatSession, Session};
+use mas_storage::BoxRepositoryFactory;
 use tokio_util::{sync::CancellationToken, task::TaskTracker};
 use ulid::Ulid;
 
diff --git a/crates/handlers/src/admin/call_context.rs b/crates/handlers/src/admin/call_context.rs
index a0470f851..ebe0e02e5 100644
--- a/crates/handlers/src/admin/call_context.rs
+++ b/crates/handlers/src/admin/call_context.rs
@@ -16,8 +16,8 @@ use axum_extra::TypedHeader;
 use headers::{Authorization, authorization::Bearer};
 use hyper::StatusCode;
 use mas_axum_utils::record_error;
-use mas_data_model::{Session, User};
-use mas_storage::{BoxClock, BoxRepository, RepositoryError};
+use mas_data_model::{BoxClock, Session, User};
+use mas_storage::{BoxRepository, RepositoryError};
 use ulid::Ulid;
 
 use super::response::ErrorResponse;
diff --git a/crates/handlers/src/admin/mod.rs b/crates/handlers/src/admin/mod.rs
index c0a0cf9ac..8cc2956c0 100644
--- a/crates/handlers/src/admin/mod.rs
+++ b/crates/handlers/src/admin/mod.rs
@@ -20,6 +20,7 @@ use axum::{
 use hyper::header::{ACCEPT, AUTHORIZATION, CONTENT_TYPE};
 use indexmap::IndexMap;
 use mas_axum_utils::InternalError;
+use mas_data_model::BoxRng;
 use mas_http::CorsLayerExt;
 use mas_matrix::HomeserverConnection;
 use mas_policy::PolicyFactory;
@@ -27,7 +28,6 @@ use mas_router::{
     ApiDoc, ApiDocCallback, OAuth2AuthorizationEndpoint, OAuth2TokenEndpoint, Route, SimpleRoute,
     UrlBuilder,
 };
-use mas_storage::BoxRng;
 use mas_templates::{ApiDocContext, Templates};
 use tower_http::cors::{Any, CorsLayer};
 
diff --git a/crates/handlers/src/admin/v1/mod.rs b/crates/handlers/src/admin/v1/mod.rs
index 1d167e98a..49ff75001 100644
--- a/crates/handlers/src/admin/v1/mod.rs
+++ b/crates/handlers/src/admin/v1/mod.rs
@@ -11,9 +11,9 @@ use aide::axum::{
     routing::{get_with, post_with},
 };
 use axum::extract::{FromRef, FromRequestParts};
+use mas_data_model::BoxRng;
 use mas_matrix::HomeserverConnection;
 use mas_policy::PolicyFactory;
-use mas_storage::BoxRng;
 
 use super::call_context::CallContext;
 use crate::passwords::PasswordManager;
diff --git a/crates/handlers/src/admin/v1/policy_data/set.rs b/crates/handlers/src/admin/v1/policy_data/set.rs
index 93260f9ac..e781a8996 100644
--- a/crates/handlers/src/admin/v1/policy_data/set.rs
+++ b/crates/handlers/src/admin/v1/policy_data/set.rs
@@ -9,8 +9,8 @@ use aide::{NoApi, OperationIo, transform::TransformOperation};
 use axum::{Json, extract::State, response::IntoResponse};
 use hyper::StatusCode;
 use mas_axum_utils::record_error;
+use mas_data_model::BoxRng;
 use mas_policy::PolicyFactory;
-use mas_storage::BoxRng;
 use schemars::JsonSchema;
 use serde::Deserialize;
 
diff --git a/crates/handlers/src/admin/v1/upstream_oauth_links/add.rs b/crates/handlers/src/admin/v1/upstream_oauth_links/add.rs
index ba59d4419..568216249 100644
--- a/crates/handlers/src/admin/v1/upstream_oauth_links/add.rs
+++ b/crates/handlers/src/admin/v1/upstream_oauth_links/add.rs
@@ -7,7 +7,7 @@ use aide::{NoApi, OperationIo, transform::TransformOperation};
 use axum::{Json, response::IntoResponse};
 use hyper::StatusCode;
 use mas_axum_utils::record_error;
-use mas_storage::BoxRng;
+use mas_data_model::BoxRng;
 use schemars::JsonSchema;
 use serde::Deserialize;
 use ulid::Ulid;
diff --git a/crates/handlers/src/admin/v1/user_emails/add.rs b/crates/handlers/src/admin/v1/user_emails/add.rs
index 55038a591..10622b619 100644
--- a/crates/handlers/src/admin/v1/user_emails/add.rs
+++ b/crates/handlers/src/admin/v1/user_emails/add.rs
@@ -9,8 +9,8 @@ use aide::{NoApi, OperationIo, transform::TransformOperation};
 use axum::{Json, response::IntoResponse};
 use hyper::StatusCode;
 use mas_axum_utils::record_error;
+use mas_data_model::BoxRng;
 use mas_storage::{
-    BoxRng,
     queue::{ProvisionUserJob, QueueJobRepositoryExt as _},
     user::UserEmailFilter,
 };
diff --git a/crates/handlers/src/admin/v1/user_emails/delete.rs b/crates/handlers/src/admin/v1/user_emails/delete.rs
index 844edbff2..133e85992 100644
--- a/crates/handlers/src/admin/v1/user_emails/delete.rs
+++ b/crates/handlers/src/admin/v1/user_emails/delete.rs
@@ -7,10 +7,8 @@ use aide::{NoApi, OperationIo, transform::TransformOperation};
 use axum::{Json, response::IntoResponse};
 use hyper::StatusCode;
 use mas_axum_utils::record_error;
-use mas_storage::{
-    BoxRng,
-    queue::{ProvisionUserJob, QueueJobRepositoryExt as _},
-};
+use mas_data_model::BoxRng;
+use mas_storage::queue::{ProvisionUserJob, QueueJobRepositoryExt as _};
 use ulid::Ulid;
 
 use crate::{
diff --git a/crates/handlers/src/admin/v1/user_registration_tokens/add.rs b/crates/handlers/src/admin/v1/user_registration_tokens/add.rs
index 7bc2b0593..3e641e25d 100644
--- a/crates/handlers/src/admin/v1/user_registration_tokens/add.rs
+++ b/crates/handlers/src/admin/v1/user_registration_tokens/add.rs
@@ -9,7 +9,7 @@ use axum::{Json, response::IntoResponse};
 use chrono::{DateTime, Utc};
 use hyper::StatusCode;
 use mas_axum_utils::record_error;
-use mas_storage::BoxRng;
+use mas_data_model::BoxRng;
 use rand::distributions::{Alphanumeric, DistString};
 use schemars::JsonSchema;
 use serde::Deserialize;
diff --git a/crates/handlers/src/admin/v1/user_registration_tokens/list.rs b/crates/handlers/src/admin/v1/user_registration_tokens/list.rs
index f9b0e714c..546491536 100644
--- a/crates/handlers/src/admin/v1/user_registration_tokens/list.rs
+++ b/crates/handlers/src/admin/v1/user_registration_tokens/list.rs
@@ -173,7 +173,7 @@ pub async fn handler(
 mod tests {
     use chrono::Duration;
     use hyper::{Request, StatusCode};
-    use mas_storage::Clock as _;
+    use mas_data_model::Clock as _;
     use sqlx::PgPool;
 
     use crate::test_utils::{RequestBuilderExt, ResponseExt, TestState, setup};
diff --git a/crates/handlers/src/admin/v1/user_registration_tokens/revoke.rs b/crates/handlers/src/admin/v1/user_registration_tokens/revoke.rs
index 9e442640f..b2632d4b6 100644
--- a/crates/handlers/src/admin/v1/user_registration_tokens/revoke.rs
+++ b/crates/handlers/src/admin/v1/user_registration_tokens/revoke.rs
@@ -105,7 +105,7 @@ pub async fn handler(
 mod tests {
     use chrono::Duration;
     use hyper::{Request, StatusCode};
-    use mas_storage::Clock as _;
+    use mas_data_model::Clock as _;
     use sqlx::PgPool;
 
     use crate::test_utils::{RequestBuilderExt, ResponseExt, TestState, setup};
diff --git a/crates/handlers/src/admin/v1/user_registration_tokens/update.rs b/crates/handlers/src/admin/v1/user_registration_tokens/update.rs
index d5eaa7342..06ad8283e 100644
--- a/crates/handlers/src/admin/v1/user_registration_tokens/update.rs
+++ b/crates/handlers/src/admin/v1/user_registration_tokens/update.rs
@@ -143,7 +143,7 @@ pub async fn handler(
 mod tests {
     use chrono::Duration;
     use hyper::{Request, StatusCode};
-    use mas_storage::Clock as _;
+    use mas_data_model::Clock as _;
     use serde_json::json;
     use sqlx::PgPool;
 
diff --git a/crates/handlers/src/admin/v1/users/add.rs b/crates/handlers/src/admin/v1/users/add.rs
index d67737526..07e87fb40 100644
--- a/crates/handlers/src/admin/v1/users/add.rs
+++ b/crates/handlers/src/admin/v1/users/add.rs
@@ -10,8 +10,8 @@ use aide::{NoApi, OperationIo, transform::TransformOperation};
 use axum::{Json, extract::State, response::IntoResponse};
 use hyper::StatusCode;
 use mas_axum_utils::record_error;
+use mas_data_model::BoxRng;
 use mas_matrix::{HomeserverConnection, ProvisionRequest};
-use mas_storage::BoxRng;
 use schemars::JsonSchema;
 use serde::Deserialize;
 use tracing::warn;
diff --git a/crates/handlers/src/admin/v1/users/deactivate.rs b/crates/handlers/src/admin/v1/users/deactivate.rs
index 25fae6a3c..8a135fadc 100644
--- a/crates/handlers/src/admin/v1/users/deactivate.rs
+++ b/crates/handlers/src/admin/v1/users/deactivate.rs
@@ -8,10 +8,8 @@ use aide::{NoApi, OperationIo, transform::TransformOperation};
 use axum::{Json, response::IntoResponse};
 use hyper::StatusCode;
 use mas_axum_utils::record_error;
-use mas_storage::{
-    BoxRng,
-    queue::{DeactivateUserJob, QueueJobRepositoryExt as _},
-};
+use mas_data_model::BoxRng;
+use mas_storage::queue::{DeactivateUserJob, QueueJobRepositoryExt as _};
 use schemars::JsonSchema;
 use serde::Deserialize;
 use tracing::info;
@@ -134,7 +132,8 @@ mod tests {
     use chrono::Duration;
     use hyper::{Request, StatusCode};
     use insta::{allow_duplicates, assert_json_snapshot};
-    use mas_storage::{Clock, RepositoryAccess, user::UserRepository};
+    use mas_data_model::Clock;
+    use mas_storage::{RepositoryAccess, user::UserRepository};
     use sqlx::{PgPool, types::Json};
 
     use crate::test_utils::{RequestBuilderExt, ResponseExt, TestState, setup};
diff --git a/crates/handlers/src/admin/v1/users/lock.rs b/crates/handlers/src/admin/v1/users/lock.rs
index ec8159532..6d6ccfcf9 100644
--- a/crates/handlers/src/admin/v1/users/lock.rs
+++ b/crates/handlers/src/admin/v1/users/lock.rs
@@ -92,7 +92,8 @@ pub async fn handler(
 mod tests {
     use chrono::Duration;
     use hyper::{Request, StatusCode};
-    use mas_storage::{Clock, RepositoryAccess, user::UserRepository};
+    use mas_data_model::Clock;
+    use mas_storage::{RepositoryAccess, user::UserRepository};
     use sqlx::PgPool;
 
     use crate::test_utils::{RequestBuilderExt, ResponseExt, TestState, setup};
diff --git a/crates/handlers/src/admin/v1/users/reactivate.rs b/crates/handlers/src/admin/v1/users/reactivate.rs
index 0be687a39..835ef0b40 100644
--- a/crates/handlers/src/admin/v1/users/reactivate.rs
+++ b/crates/handlers/src/admin/v1/users/reactivate.rs
@@ -102,8 +102,9 @@ pub async fn handler(
 #[cfg(test)]
 mod tests {
     use hyper::{Request, StatusCode};
+    use mas_data_model::Clock;
     use mas_matrix::{HomeserverConnection, ProvisionRequest};
-    use mas_storage::{Clock, RepositoryAccess, user::UserRepository};
+    use mas_storage::{RepositoryAccess, user::UserRepository};
     use sqlx::PgPool;
 
     use crate::test_utils::{RequestBuilderExt, ResponseExt, TestState, setup};
diff --git a/crates/handlers/src/admin/v1/users/set_password.rs b/crates/handlers/src/admin/v1/users/set_password.rs
index 633d72e67..390c31e47 100644
--- a/crates/handlers/src/admin/v1/users/set_password.rs
+++ b/crates/handlers/src/admin/v1/users/set_password.rs
@@ -8,7 +8,7 @@ use aide::{NoApi, OperationIo, transform::TransformOperation};
 use axum::{Json, extract::State, response::IntoResponse};
 use hyper::StatusCode;
 use mas_axum_utils::record_error;
-use mas_storage::BoxRng;
+use mas_data_model::BoxRng;
 use schemars::JsonSchema;
 use serde::Deserialize;
 use ulid::Ulid;
diff --git a/crates/handlers/src/admin/v1/users/unlock.rs b/crates/handlers/src/admin/v1/users/unlock.rs
index 944dd77f4..72987a9ff 100644
--- a/crates/handlers/src/admin/v1/users/unlock.rs
+++ b/crates/handlers/src/admin/v1/users/unlock.rs
@@ -89,8 +89,9 @@ pub async fn handler(
 #[cfg(test)]
 mod tests {
     use hyper::{Request, StatusCode};
+    use mas_data_model::Clock;
     use mas_matrix::{HomeserverConnection, ProvisionRequest};
-    use mas_storage::{Clock, RepositoryAccess, user::UserRepository};
+    use mas_storage::{RepositoryAccess, user::UserRepository};
     use sqlx::PgPool;
 
     use crate::test_utils::{RequestBuilderExt, ResponseExt, TestState, setup};
diff --git a/crates/handlers/src/bin/api-schema.rs b/crates/handlers/src/bin/api-schema.rs
index ee736de2a..894546961 100644
--- a/crates/handlers/src/bin/api-schema.rs
+++ b/crates/handlers/src/bin/api-schema.rs
@@ -50,8 +50,8 @@ macro_rules! impl_from_ref {
 }
 
 impl_from_request_parts!(mas_storage::BoxRepository);
-impl_from_request_parts!(mas_storage::BoxClock);
-impl_from_request_parts!(mas_storage::BoxRng);
+impl_from_request_parts!(mas_data_model::BoxClock);
+impl_from_request_parts!(mas_data_model::BoxRng);
 impl_from_request_parts!(mas_handlers::BoundActivityTracker);
 impl_from_ref!(mas_router::UrlBuilder);
 impl_from_ref!(mas_templates::Templates);
diff --git a/crates/handlers/src/compat/login.rs b/crates/handlers/src/compat/login.rs
index d75b4f8bd..d3c7c979f 100644
--- a/crates/handlers/src/compat/login.rs
+++ b/crates/handlers/src/compat/login.rs
@@ -11,10 +11,13 @@ use axum_extra::typed_header::TypedHeader;
 use chrono::Duration;
 use hyper::StatusCode;
 use mas_axum_utils::record_error;
-use mas_data_model::{CompatSession, CompatSsoLoginState, Device, SiteConfig, TokenType, User};
+use mas_data_model::{
+    BoxClock, BoxRng, Clock, CompatSession, CompatSsoLoginState, Device, SiteConfig, TokenType,
+    User,
+};
 use mas_matrix::HomeserverConnection;
 use mas_storage::{
-    BoxClock, BoxRepository, BoxRepositoryFactory, BoxRng, Clock, RepositoryAccess,
+    BoxRepository, BoxRepositoryFactory, RepositoryAccess,
     compat::{
         CompatAccessTokenRepository, CompatRefreshTokenRepository, CompatSessionRepository,
         CompatSsoLoginRepository,
diff --git a/crates/handlers/src/compat/login_sso_complete.rs b/crates/handlers/src/compat/login_sso_complete.rs
index 2c3b612b4..93b9f9dee 100644
--- a/crates/handlers/src/compat/login_sso_complete.rs
+++ b/crates/handlers/src/compat/login_sso_complete.rs
@@ -17,10 +17,9 @@ use mas_axum_utils::{
     cookies::CookieJar,
     csrf::{CsrfExt, ProtectedForm},
 };
+use mas_data_model::{BoxClock, BoxRng, Clock};
 use mas_router::{CompatLoginSsoAction, UrlBuilder};
-use mas_storage::{
-    BoxClock, BoxRepository, BoxRng, Clock, RepositoryAccess, compat::CompatSsoLoginRepository,
-};
+use mas_storage::{BoxRepository, RepositoryAccess, compat::CompatSsoLoginRepository};
 use mas_templates::{CompatSsoContext, ErrorContext, TemplateContext, Templates};
 use serde::{Deserialize, Serialize};
 use ulid::Ulid;
diff --git a/crates/handlers/src/compat/login_sso_redirect.rs b/crates/handlers/src/compat/login_sso_redirect.rs
index e2d63728d..09af59b45 100644
--- a/crates/handlers/src/compat/login_sso_redirect.rs
+++ b/crates/handlers/src/compat/login_sso_redirect.rs
@@ -10,8 +10,9 @@ use axum::{
 };
 use hyper::StatusCode;
 use mas_axum_utils::{GenericError, InternalError};
+use mas_data_model::{BoxClock, BoxRng};
 use mas_router::{CompatLoginSsoAction, CompatLoginSsoComplete, UrlBuilder};
-use mas_storage::{BoxClock, BoxRepository, BoxRng, compat::CompatSsoLoginRepository};
+use mas_storage::{BoxRepository, compat::CompatSsoLoginRepository};
 use rand::distributions::{Alphanumeric, DistString};
 use serde::Deserialize;
 use serde_with::serde;
diff --git a/crates/handlers/src/compat/logout.rs b/crates/handlers/src/compat/logout.rs
index 27b67b768..4642cc54b 100644
--- a/crates/handlers/src/compat/logout.rs
+++ b/crates/handlers/src/compat/logout.rs
@@ -11,9 +11,9 @@ use axum_extra::typed_header::TypedHeader;
 use headers::{Authorization, authorization::Bearer};
 use hyper::StatusCode;
 use mas_axum_utils::record_error;
-use mas_data_model::TokenType;
+use mas_data_model::{BoxClock, BoxRng, Clock, TokenType};
 use mas_storage::{
-    BoxClock, BoxRepository, BoxRng, Clock, RepositoryAccess,
+    BoxRepository, RepositoryAccess,
     compat::{CompatAccessTokenRepository, CompatSessionRepository},
     queue::{QueueJobRepositoryExt as _, SyncDevicesJob},
 };
diff --git a/crates/handlers/src/compat/logout_all.rs b/crates/handlers/src/compat/logout_all.rs
index 9cf14e428..f2ec10a82 100644
--- a/crates/handlers/src/compat/logout_all.rs
+++ b/crates/handlers/src/compat/logout_all.rs
@@ -10,9 +10,9 @@ use axum_extra::typed_header::TypedHeader;
 use headers::{Authorization, authorization::Bearer};
 use hyper::StatusCode;
 use mas_axum_utils::record_error;
-use mas_data_model::TokenType;
+use mas_data_model::{BoxClock, BoxRng, Clock, TokenType};
 use mas_storage::{
-    BoxClock, BoxRepository, BoxRng, Clock, RepositoryAccess,
+    BoxRepository, RepositoryAccess,
     compat::{CompatAccessTokenRepository, CompatSessionFilter, CompatSessionRepository},
     queue::{QueueJobRepositoryExt as _, SyncDevicesJob},
 };
diff --git a/crates/handlers/src/compat/refresh.rs b/crates/handlers/src/compat/refresh.rs
index 02e623eb4..95679af1d 100644
--- a/crates/handlers/src/compat/refresh.rs
+++ b/crates/handlers/src/compat/refresh.rs
@@ -8,9 +8,9 @@ use axum::{Json, extract::State, response::IntoResponse};
 use chrono::Duration;
 use hyper::StatusCode;
 use mas_axum_utils::record_error;
-use mas_data_model::{SiteConfig, TokenFormatError, TokenType};
+use mas_data_model::{BoxClock, BoxRng, Clock, SiteConfig, TokenFormatError, TokenType};
 use mas_storage::{
-    BoxClock, BoxRepository, BoxRng, Clock,
+    BoxRepository,
     compat::{CompatAccessTokenRepository, CompatRefreshTokenRepository, CompatSessionRepository},
 };
 use serde::{Deserialize, Serialize};
diff --git a/crates/handlers/src/graphql/mod.rs b/crates/handlers/src/graphql/mod.rs
index 9f51e8752..7ccf9e51b 100644
--- a/crates/handlers/src/graphql/mod.rs
+++ b/crates/handlers/src/graphql/mod.rs
@@ -28,13 +28,13 @@ use hyper::header::CACHE_CONTROL;
 use mas_axum_utils::{
     InternalError, SessionInfo, SessionInfoExt, cookies::CookieJar, sentry::SentryEventID,
 };
-use mas_data_model::{BrowserSession, Session, SiteConfig, User};
+use mas_data_model::{
+    BoxClock, BoxRng, BrowserSession, Clock, Session, SiteConfig, SystemClock, User,
+};
 use mas_matrix::HomeserverConnection;
 use mas_policy::{InstantiateError, Policy, PolicyFactory};
 use mas_router::UrlBuilder;
-use mas_storage::{
-    BoxClock, BoxRepository, BoxRepositoryFactory, BoxRng, Clock, RepositoryError, SystemClock,
-};
+use mas_storage::{BoxRepository, BoxRepositoryFactory, RepositoryError};
 use opentelemetry_semantic_conventions::trace::{GRAPHQL_DOCUMENT, GRAPHQL_OPERATION_NAME};
 use rand::{SeedableRng, thread_rng};
 use rand_chacha::ChaChaRng;
diff --git a/crates/handlers/src/graphql/state.rs b/crates/handlers/src/graphql/state.rs
index 600fd232e..7faf76334 100644
--- a/crates/handlers/src/graphql/state.rs
+++ b/crates/handlers/src/graphql/state.rs
@@ -5,11 +5,11 @@
 // Please see LICENSE files in the repository root for full details.
 
 use async_graphql::{Response, ServerError};
-use mas_data_model::SiteConfig;
+use mas_data_model::{BoxClock, BoxRng, SiteConfig};
 use mas_matrix::HomeserverConnection;
 use mas_policy::Policy;
 use mas_router::UrlBuilder;
-use mas_storage::{BoxClock, BoxRepository, BoxRng, RepositoryError};
+use mas_storage::{BoxRepository, RepositoryError};
 
 use crate::{Limiter, graphql::Requester, passwords::PasswordManager};
 
diff --git a/crates/handlers/src/lib.rs b/crates/handlers/src/lib.rs
index 8de6707be..65a75f550 100644
--- a/crates/handlers/src/lib.rs
+++ b/crates/handlers/src/lib.rs
@@ -42,7 +42,7 @@ use mas_keystore::{Encrypter, Keystore};
 use mas_matrix::HomeserverConnection;
 use mas_policy::Policy;
 use mas_router::{Route, UrlBuilder};
-use mas_storage::{BoxClock, BoxRepository, BoxRepositoryFactory, BoxRng};
+use mas_storage::{BoxRepository, BoxRepositoryFactory};
 use mas_templates::{ErrorContext, NotFoundContext, TemplateContext, Templates};
 use opentelemetry::metrics::Meter;
 use sqlx::PgPool;
@@ -94,6 +94,7 @@ macro_rules! impl_from_error_for_route {
 }
 
 pub use mas_axum_utils::{ErrorWrapper, cookies::CookieManager};
+use mas_data_model::{BoxClock, BoxRng};
 
 pub use self::{
     activity_tracker::{ActivityTracker, Bound as BoundActivityTracker},
diff --git a/crates/handlers/src/oauth2/authorization/consent.rs b/crates/handlers/src/oauth2/authorization/consent.rs
index 4a10b96a3..968aec08a 100644
--- a/crates/handlers/src/oauth2/authorization/consent.rs
+++ b/crates/handlers/src/oauth2/authorization/consent.rs
@@ -15,12 +15,12 @@ use mas_axum_utils::{
     cookies::CookieJar,
     csrf::{CsrfExt, ProtectedForm},
 };
-use mas_data_model::AuthorizationGrantStage;
+use mas_data_model::{AuthorizationGrantStage, BoxClock, BoxRng};
 use mas_keystore::Keystore;
 use mas_policy::Policy;
 use mas_router::{PostAuthAction, UrlBuilder};
 use mas_storage::{
-    BoxClock, BoxRepository, BoxRng,
+    BoxRepository,
     oauth2::{OAuth2AuthorizationGrantRepository, OAuth2ClientRepository},
 };
 use mas_templates::{ConsentContext, PolicyViolationContext, TemplateContext, Templates};
diff --git a/crates/handlers/src/oauth2/authorization/mod.rs b/crates/handlers/src/oauth2/authorization/mod.rs
index 6dfaf4020..6037bd9ad 100644
--- a/crates/handlers/src/oauth2/authorization/mod.rs
+++ b/crates/handlers/src/oauth2/authorization/mod.rs
@@ -10,10 +10,10 @@ use axum::{
 };
 use hyper::StatusCode;
 use mas_axum_utils::{GenericError, InternalError, SessionInfoExt, cookies::CookieJar};
-use mas_data_model::{AuthorizationCode, Pkce};
+use mas_data_model::{AuthorizationCode, BoxClock, BoxRng, Pkce};
 use mas_router::{PostAuthAction, UrlBuilder};
 use mas_storage::{
-    BoxClock, BoxRepository, BoxRng,
+    BoxRepository,
     oauth2::{OAuth2AuthorizationGrantRepository, OAuth2ClientRepository},
 };
 use mas_templates::Templates;
diff --git a/crates/handlers/src/oauth2/device/authorize.rs b/crates/handlers/src/oauth2/device/authorize.rs
index b4651f4b8..415131617 100644
--- a/crates/handlers/src/oauth2/device/authorize.rs
+++ b/crates/handlers/src/oauth2/device/authorize.rs
@@ -13,9 +13,10 @@ use mas_axum_utils::{
     client_authorization::{ClientAuthorization, CredentialsVerificationError},
     record_error,
 };
+use mas_data_model::{BoxClock, BoxRng};
 use mas_keystore::Encrypter;
 use mas_router::UrlBuilder;
-use mas_storage::{BoxClock, BoxRepository, BoxRng, oauth2::OAuth2DeviceCodeGrantParams};
+use mas_storage::{BoxRepository, oauth2::OAuth2DeviceCodeGrantParams};
 use oauth2_types::{
     errors::{ClientError, ClientErrorCode},
     requests::{DeviceAuthorizationRequest, DeviceAuthorizationResponse, GrantType},
diff --git a/crates/handlers/src/oauth2/device/consent.rs b/crates/handlers/src/oauth2/device/consent.rs
index c8114c3a0..30a35aa17 100644
--- a/crates/handlers/src/oauth2/device/consent.rs
+++ b/crates/handlers/src/oauth2/device/consent.rs
@@ -16,9 +16,10 @@ use mas_axum_utils::{
     cookies::CookieJar,
     csrf::{CsrfExt, ProtectedForm},
 };
+use mas_data_model::{BoxClock, BoxRng};
 use mas_policy::Policy;
 use mas_router::UrlBuilder;
-use mas_storage::{BoxClock, BoxRepository, BoxRng};
+use mas_storage::BoxRepository;
 use mas_templates::{DeviceConsentContext, PolicyViolationContext, TemplateContext, Templates};
 use serde::Deserialize;
 use tracing::warn;
diff --git a/crates/handlers/src/oauth2/device/link.rs b/crates/handlers/src/oauth2/device/link.rs
index 538aed3c6..da2fb2700 100644
--- a/crates/handlers/src/oauth2/device/link.rs
+++ b/crates/handlers/src/oauth2/device/link.rs
@@ -9,8 +9,9 @@ use axum::{
     response::{Html, IntoResponse},
 };
 use mas_axum_utils::{InternalError, cookies::CookieJar};
+use mas_data_model::BoxClock;
 use mas_router::UrlBuilder;
-use mas_storage::{BoxClock, BoxRepository};
+use mas_storage::BoxRepository;
 use mas_templates::{
     DeviceLinkContext, DeviceLinkFormField, FieldError, FormState, TemplateContext, Templates,
 };
diff --git a/crates/handlers/src/oauth2/introspection.rs b/crates/handlers/src/oauth2/introspection.rs
index e52e3c303..6bb61bf72 100644
--- a/crates/handlers/src/oauth2/introspection.rs
+++ b/crates/handlers/src/oauth2/introspection.rs
@@ -15,12 +15,12 @@ use mas_axum_utils::{
     client_authorization::{ClientAuthorization, CredentialsVerificationError},
     record_error,
 };
-use mas_data_model::{Device, TokenFormatError, TokenType};
+use mas_data_model::{BoxClock, Clock, Device, TokenFormatError, TokenType};
 use mas_iana::oauth::{OAuthClientAuthenticationMethod, OAuthTokenTypeHint};
 use mas_keystore::Encrypter;
 use mas_matrix::HomeserverConnection;
 use mas_storage::{
-    BoxClock, BoxRepository, Clock,
+    BoxRepository,
     compat::{CompatAccessTokenRepository, CompatRefreshTokenRepository, CompatSessionRepository},
     oauth2::{OAuth2AccessTokenRepository, OAuth2RefreshTokenRepository, OAuth2SessionRepository},
     user::UserRepository,
@@ -636,11 +636,10 @@ pub(crate) async fn post(
 mod tests {
     use chrono::Duration;
     use hyper::{Request, StatusCode};
-    use mas_data_model::{AccessToken, RefreshToken};
+    use mas_data_model::{AccessToken, Clock, RefreshToken};
     use mas_iana::oauth::OAuthTokenTypeHint;
     use mas_matrix::{HomeserverConnection, MockHomeserverConnection, ProvisionRequest};
     use mas_router::{OAuth2Introspection, OAuth2RegistrationEndpoint, SimpleRoute};
-    use mas_storage::Clock;
     use oauth2_types::{
         errors::{ClientError, ClientErrorCode},
         registration::ClientRegistrationResponse,
diff --git a/crates/handlers/src/oauth2/mod.rs b/crates/handlers/src/oauth2/mod.rs
index cbe81072f..cf28818e2 100644
--- a/crates/handlers/src/oauth2/mod.rs
+++ b/crates/handlers/src/oauth2/mod.rs
@@ -8,8 +8,8 @@ use std::collections::HashMap;
 
 use chrono::Duration;
 use mas_data_model::{
-    AccessToken, Authentication, AuthorizationGrant, BrowserSession, Client, RefreshToken, Session,
-    TokenType,
+    AccessToken, Authentication, AuthorizationGrant, BrowserSession, Client, Clock, RefreshToken,
+    Session, TokenType,
 };
 use mas_iana::jose::JsonWebSignatureAlg;
 use mas_jose::{
@@ -19,7 +19,7 @@ use mas_jose::{
 };
 use mas_keystore::Keystore;
 use mas_router::UrlBuilder;
-use mas_storage::{Clock, RepositoryAccess};
+use mas_storage::RepositoryAccess;
 use thiserror::Error;
 
 pub mod authorization;
diff --git a/crates/handlers/src/oauth2/registration.rs b/crates/handlers/src/oauth2/registration.rs
index 0cdfb32ea..5ad58b386 100644
--- a/crates/handlers/src/oauth2/registration.rs
+++ b/crates/handlers/src/oauth2/registration.rs
@@ -10,10 +10,11 @@ use axum::{Json, extract::State, response::IntoResponse};
 use axum_extra::TypedHeader;
 use hyper::StatusCode;
 use mas_axum_utils::record_error;
+use mas_data_model::{BoxClock, BoxRng};
 use mas_iana::oauth::OAuthClientAuthenticationMethod;
 use mas_keystore::Encrypter;
 use mas_policy::{EvaluationResult, Policy};
-use mas_storage::{BoxClock, BoxRepository, BoxRng, oauth2::OAuth2ClientRepository};
+use mas_storage::{BoxRepository, oauth2::OAuth2ClientRepository};
 use oauth2_types::{
     errors::{ClientError, ClientErrorCode},
     registration::{
diff --git a/crates/handlers/src/oauth2/revoke.rs b/crates/handlers/src/oauth2/revoke.rs
index 4889257b4..fa11216dc 100644
--- a/crates/handlers/src/oauth2/revoke.rs
+++ b/crates/handlers/src/oauth2/revoke.rs
@@ -10,11 +10,11 @@ use mas_axum_utils::{
     client_authorization::{ClientAuthorization, CredentialsVerificationError},
     record_error,
 };
-use mas_data_model::TokenType;
+use mas_data_model::{BoxClock, BoxRng, TokenType};
 use mas_iana::oauth::OAuthTokenTypeHint;
 use mas_keystore::Encrypter;
 use mas_storage::{
-    BoxClock, BoxRepository, BoxRng, RepositoryAccess,
+    BoxRepository, RepositoryAccess,
     queue::{QueueJobRepositoryExt as _, SyncDevicesJob},
 };
 use oauth2_types::{
diff --git a/crates/handlers/src/oauth2/token.rs b/crates/handlers/src/oauth2/token.rs
index 4b4c8dca6..4a63d8290 100644
--- a/crates/handlers/src/oauth2/token.rs
+++ b/crates/handlers/src/oauth2/token.rs
@@ -16,7 +16,8 @@ use mas_axum_utils::{
     record_error,
 };
 use mas_data_model::{
-    AuthorizationGrantStage, Client, Device, DeviceCodeGrantState, SiteConfig, TokenType,
+    AuthorizationGrantStage, BoxClock, BoxRng, Client, Clock, Device, DeviceCodeGrantState,
+    SiteConfig, TokenType,
 };
 use mas_i18n::DataLocale;
 use mas_keystore::{Encrypter, Keystore};
@@ -25,7 +26,7 @@ use mas_oidc_client::types::scope::ScopeToken;
 use mas_policy::Policy;
 use mas_router::UrlBuilder;
 use mas_storage::{
-    BoxClock, BoxRepository, BoxRng, Clock, RepositoryAccess,
+    BoxRepository, RepositoryAccess,
     oauth2::{
         OAuth2AccessTokenRepository, OAuth2AuthorizationGrantRepository,
         OAuth2RefreshTokenRepository, OAuth2SessionRepository,
diff --git a/crates/handlers/src/oauth2/userinfo.rs b/crates/handlers/src/oauth2/userinfo.rs
index 338e98ec7..c939ba9c8 100644
--- a/crates/handlers/src/oauth2/userinfo.rs
+++ b/crates/handlers/src/oauth2/userinfo.rs
@@ -15,13 +15,14 @@ use mas_axum_utils::{
     record_error,
     user_authorization::{AuthorizationVerificationError, UserAuthorization},
 };
+use mas_data_model::{BoxClock, BoxRng};
 use mas_jose::{
     constraints::Constrainable,
     jwt::{JsonWebSignatureHeader, Jwt},
 };
 use mas_keystore::Keystore;
 use mas_router::UrlBuilder;
-use mas_storage::{BoxClock, BoxRepository, BoxRng, oauth2::OAuth2ClientRepository};
+use mas_storage::{BoxRepository, oauth2::OAuth2ClientRepository};
 use serde::Serialize;
 use serde_with::skip_serializing_none;
 use thiserror::Error;
diff --git a/crates/handlers/src/rate_limit.rs b/crates/handlers/src/rate_limit.rs
index 1714d4fed..8b2485941 100644
--- a/crates/handlers/src/rate_limit.rs
+++ b/crates/handlers/src/rate_limit.rs
@@ -301,8 +301,7 @@ impl Limiter {
 
 #[cfg(test)]
 mod tests {
-    use mas_data_model::User;
-    use mas_storage::{Clock, clock::MockClock};
+    use mas_data_model::{Clock, User, clock::MockClock};
     use rand::SeedableRng;
 
     use super::*;
diff --git a/crates/handlers/src/session.rs b/crates/handlers/src/session.rs
index 75638f5cd..cb05510ba 100644
--- a/crates/handlers/src/session.rs
+++ b/crates/handlers/src/session.rs
@@ -8,9 +8,9 @@
 
 use axum::response::{Html, IntoResponse as _, Response};
 use mas_axum_utils::{SessionInfoExt, cookies::CookieJar, csrf::CsrfExt};
-use mas_data_model::BrowserSession;
+use mas_data_model::{BrowserSession, Clock};
 use mas_i18n::DataLocale;
-use mas_storage::{BoxRepository, Clock, RepositoryError};
+use mas_storage::{BoxRepository, RepositoryError};
 use mas_templates::{AccountInactiveContext, TemplateContext, Templates};
 use rand::RngCore;
 use thiserror::Error;
diff --git a/crates/handlers/src/test_utils.rs b/crates/handlers/src/test_utils.rs
index 7927c1431..e43194776 100644
--- a/crates/handlers/src/test_utils.rs
+++ b/crates/handlers/src/test_utils.rs
@@ -28,17 +28,14 @@ use mas_axum_utils::{
     cookies::{CookieJar, CookieManager},
 };
 use mas_config::RateLimitingConfig;
-use mas_data_model::SiteConfig;
+use mas_data_model::{BoxClock, BoxRng, SiteConfig, clock::MockClock};
 use mas_email::{MailTransport, Mailer};
 use mas_i18n::Translator;
 use mas_keystore::{Encrypter, JsonWebKey, JsonWebKeySet, Keystore, PrivateKey};
 use mas_matrix::{HomeserverConnection, MockHomeserverConnection};
 use mas_policy::{InstantiateError, Policy, PolicyFactory};
 use mas_router::{SimpleRoute, UrlBuilder};
-use mas_storage::{
-    BoxClock, BoxRepository, BoxRepositoryFactory, BoxRng, RepositoryError, RepositoryFactory,
-    clock::MockClock,
-};
+use mas_storage::{BoxRepository, BoxRepositoryFactory, RepositoryError, RepositoryFactory};
 use mas_storage_pg::PgRepositoryFactory;
 use mas_tasks::QueueWorker;
 use mas_templates::{SiteConfigExt, Templates};
diff --git a/crates/handlers/src/upstream_oauth2/authorize.rs b/crates/handlers/src/upstream_oauth2/authorize.rs
index c9e96f936..8d66c2ba5 100644
--- a/crates/handlers/src/upstream_oauth2/authorize.rs
+++ b/crates/handlers/src/upstream_oauth2/authorize.rs
@@ -10,11 +10,11 @@ use axum::{
 };
 use hyper::StatusCode;
 use mas_axum_utils::{GenericError, InternalError, cookies::CookieJar};
-use mas_data_model::UpstreamOAuthProvider;
+use mas_data_model::{BoxClock, BoxRng, UpstreamOAuthProvider};
 use mas_oidc_client::requests::authorization_code::AuthorizationRequestData;
 use mas_router::{PostAuthAction, UrlBuilder};
 use mas_storage::{
-    BoxClock, BoxRepository, BoxRng,
+    BoxRepository,
     upstream_oauth2::{UpstreamOAuthProviderRepository, UpstreamOAuthSessionRepository},
 };
 use thiserror::Error;
diff --git a/crates/handlers/src/upstream_oauth2/backchannel_logout.rs b/crates/handlers/src/upstream_oauth2/backchannel_logout.rs
index 9e2a034b9..76a7b574c 100644
--- a/crates/handlers/src/upstream_oauth2/backchannel_logout.rs
+++ b/crates/handlers/src/upstream_oauth2/backchannel_logout.rs
@@ -12,7 +12,9 @@ use axum::{
 };
 use hyper::StatusCode;
 use mas_axum_utils::record_error;
-use mas_data_model::{UpstreamOAuthProvider, UpstreamOAuthProviderOnBackchannelLogout};
+use mas_data_model::{
+    BoxClock, BoxRng, UpstreamOAuthProvider, UpstreamOAuthProviderOnBackchannelLogout,
+};
 use mas_jose::{
     claims::{self, Claim, TimeOptions},
     jwt::JwtDecodeError,
@@ -22,7 +24,7 @@ use mas_oidc_client::{
     requests::jose::{JwtVerificationData, verify_signed_jwt},
 };
 use mas_storage::{
-    BoxClock, BoxRepository, BoxRng, Pagination,
+    BoxRepository, Pagination,
     compat::CompatSessionFilter,
     oauth2::OAuth2SessionFilter,
     queue::{QueueJobRepositoryExt as _, SyncDevicesJob},
diff --git a/crates/handlers/src/upstream_oauth2/cache.rs b/crates/handlers/src/upstream_oauth2/cache.rs
index cfee7b78e..0857bc2c1 100644
--- a/crates/handlers/src/upstream_oauth2/cache.rs
+++ b/crates/handlers/src/upstream_oauth2/cache.rs
@@ -302,11 +302,10 @@ mod tests {
     // 'insecure' discovery
 
     use mas_data_model::{
-        UpstreamOAuthProviderClaimsImports, UpstreamOAuthProviderOnBackchannelLogout,
-        UpstreamOAuthProviderTokenAuthMethod,
+        Clock, UpstreamOAuthProviderClaimsImports, UpstreamOAuthProviderOnBackchannelLogout,
+        UpstreamOAuthProviderTokenAuthMethod, clock::MockClock,
     };
     use mas_iana::jose::JsonWebSignatureAlg;
-    use mas_storage::{Clock, clock::MockClock};
     use oauth2_types::scope::{OPENID, Scope};
     use ulid::Ulid;
     use wiremock::{
diff --git a/crates/handlers/src/upstream_oauth2/callback.rs b/crates/handlers/src/upstream_oauth2/callback.rs
index de1c087f7..7fdaf13a1 100644
--- a/crates/handlers/src/upstream_oauth2/callback.rs
+++ b/crates/handlers/src/upstream_oauth2/callback.rs
@@ -14,13 +14,15 @@ use axum::{
 };
 use hyper::StatusCode;
 use mas_axum_utils::{GenericError, InternalError, cookies::CookieJar};
-use mas_data_model::{UpstreamOAuthProvider, UpstreamOAuthProviderResponseMode};
+use mas_data_model::{
+    BoxClock, BoxRng, Clock, UpstreamOAuthProvider, UpstreamOAuthProviderResponseMode,
+};
 use mas_jose::claims::TokenHash;
 use mas_keystore::{Encrypter, Keystore};
 use mas_oidc_client::requests::jose::JwtVerificationData;
 use mas_router::UrlBuilder;
 use mas_storage::{
-    BoxClock, BoxRepository, BoxRng, Clock,
+    BoxRepository,
     upstream_oauth2::{
         UpstreamOAuthLinkRepository, UpstreamOAuthProviderRepository,
         UpstreamOAuthSessionRepository,
diff --git a/crates/handlers/src/upstream_oauth2/cookie.rs b/crates/handlers/src/upstream_oauth2/cookie.rs
index b978ddaa9..1946b2351 100644
--- a/crates/handlers/src/upstream_oauth2/cookie.rs
+++ b/crates/handlers/src/upstream_oauth2/cookie.rs
@@ -8,8 +8,8 @@
 
 use chrono::{DateTime, Duration, Utc};
 use mas_axum_utils::cookies::CookieJar;
+use mas_data_model::Clock;
 use mas_router::PostAuthAction;
-use mas_storage::Clock;
 use serde::{Deserialize, Serialize};
 use thiserror::Error;
 use ulid::Ulid;
diff --git a/crates/handlers/src/upstream_oauth2/link.rs b/crates/handlers/src/upstream_oauth2/link.rs
index 0182f0538..a3d4c1bb9 100644
--- a/crates/handlers/src/upstream_oauth2/link.rs
+++ b/crates/handlers/src/upstream_oauth2/link.rs
@@ -19,13 +19,13 @@ use mas_axum_utils::{
     csrf::{CsrfExt, ProtectedForm},
     record_error,
 };
-use mas_data_model::UpstreamOAuthProviderOnConflict;
+use mas_data_model::{BoxClock, BoxRng, UpstreamOAuthProviderOnConflict};
 use mas_jose::jwt::Jwt;
 use mas_matrix::HomeserverConnection;
 use mas_policy::Policy;
 use mas_router::UrlBuilder;
 use mas_storage::{
-    BoxClock, BoxRepository, BoxRng, RepositoryAccess,
+    BoxRepository, RepositoryAccess,
     queue::{ProvisionUserJob, QueueJobRepositoryExt as _},
     upstream_oauth2::{UpstreamOAuthLinkRepository, UpstreamOAuthSessionRepository},
     user::{BrowserSessionRepository, UserEmailRepository, UserRepository},
@@ -1483,7 +1483,7 @@ mod tests {
 
     async fn add_linked_upstream_session(
         rng: &mut ChaChaRng,
-        clock: &impl mas_storage::Clock,
+        clock: &impl mas_data_model::Clock,
         repo: &mut Box<dyn Repository<RepositoryError> + Send + Sync + 'static>,
         provider: &mas_data_model::UpstreamOAuthProvider,
         subject: &str,
diff --git a/crates/handlers/src/views/app.rs b/crates/handlers/src/views/app.rs
index b0bb3e31c..38c93bac4 100644
--- a/crates/handlers/src/views/app.rs
+++ b/crates/handlers/src/views/app.rs
@@ -9,8 +9,9 @@ use axum::{
     response::{Html, IntoResponse},
 };
 use mas_axum_utils::{InternalError, cookies::CookieJar};
+use mas_data_model::{BoxClock, BoxRng};
 use mas_router::{PostAuthAction, UrlBuilder};
-use mas_storage::{BoxClock, BoxRepository, BoxRng};
+use mas_storage::BoxRepository;
 use mas_templates::{AppContext, TemplateContext, Templates};
 use serde::Deserialize;
 
diff --git a/crates/handlers/src/views/index.rs b/crates/handlers/src/views/index.rs
index bc6b19f37..0e2acccf5 100644
--- a/crates/handlers/src/views/index.rs
+++ b/crates/handlers/src/views/index.rs
@@ -9,8 +9,9 @@ use axum::{
     response::{Html, IntoResponse, Response},
 };
 use mas_axum_utils::{InternalError, cookies::CookieJar, csrf::CsrfExt};
+use mas_data_model::{BoxClock, BoxRng};
 use mas_router::UrlBuilder;
-use mas_storage::{BoxClock, BoxRepository, BoxRng};
+use mas_storage::BoxRepository;
 use mas_templates::{IndexContext, TemplateContext, Templates};
 
 use crate::{
diff --git a/crates/handlers/src/views/login.rs b/crates/handlers/src/views/login.rs
index a89e98612..57091e5fc 100644
--- a/crates/handlers/src/views/login.rs
+++ b/crates/handlers/src/views/login.rs
@@ -17,12 +17,12 @@ use mas_axum_utils::{
     cookies::CookieJar,
     csrf::{CsrfExt, ProtectedForm},
 };
-use mas_data_model::oauth2::LoginHint;
+use mas_data_model::{BoxClock, BoxRng, Clock, oauth2::LoginHint};
 use mas_i18n::DataLocale;
 use mas_matrix::HomeserverConnection;
 use mas_router::{UpstreamOAuth2Authorize, UrlBuilder};
 use mas_storage::{
-    BoxClock, BoxRepository, BoxRng, Clock, RepositoryAccess,
+    BoxRepository, RepositoryAccess,
     upstream_oauth2::UpstreamOAuthProviderRepository,
     user::{BrowserSessionRepository, UserPasswordRepository, UserRepository},
 };
@@ -123,6 +123,7 @@ pub(crate) async fn get(
         &mut rng,
         &templates,
         &homeserver,
+        &site_config,
     )
     .await
 }
@@ -178,6 +179,7 @@ pub(crate) async fn post(
             &mut rng,
             &templates,
             &homeserver,
+            &site_config,
         )
         .await;
     }
@@ -188,7 +190,7 @@ pub(crate) async fn post(
         .unwrap_or(&form.username);
 
     // First, lookup the user
-    let Some(user) = get_user_by_email_or_by_username(site_config, &mut repo, username).await?
+    let Some(user) = get_user_by_email_or_by_username(&site_config, &mut repo, username).await?
     else {
         tracing::warn!(username, "User not found");
         let form_state = form_state.with_error_on_form(FormError::InvalidCredentials);
@@ -203,6 +205,7 @@ pub(crate) async fn post(
             &mut rng,
             &templates,
             &homeserver,
+            &site_config,
         )
         .await;
     };
@@ -222,6 +225,7 @@ pub(crate) async fn post(
             &mut rng,
             &templates,
             &homeserver,
+            &site_config,
         )
         .await;
     }
@@ -243,6 +247,7 @@ pub(crate) async fn post(
             &mut rng,
             &templates,
             &homeserver,
+            &site_config,
         )
         .await;
     };
@@ -287,6 +292,7 @@ pub(crate) async fn post(
                 &mut rng,
                 &templates,
                 &homeserver,
+                &site_config,
             )
             .await;
         }
@@ -346,7 +352,7 @@ pub(crate) async fn post(
 }
 
 async fn get_user_by_email_or_by_username<R: RepositoryAccess>(
-    site_config: SiteConfig,
+    site_config: &SiteConfig,
     repo: &mut R,
     username_or_email: &str,
 ) -> Result<Option<mas_data_model::User>, R::Error> {
@@ -371,6 +377,7 @@ fn handle_login_hint(
     mut ctx: LoginContext,
     next: &PostAuthContext,
     homeserver: &dyn HomeserverConnection,
+    site_config: &SiteConfig,
 ) -> LoginContext {
     let form_state = ctx.form_state_mut();
 
@@ -382,7 +389,10 @@ fn handle_login_hint(
     if let PostAuthContextInner::ContinueAuthorizationGrant { ref grant } = next.ctx {
         let value = match grant.parse_login_hint(homeserver.homeserver()) {
             LoginHint::MXID(mxid) => Some(mxid.localpart().to_owned()),
-            LoginHint::None => None,
+            LoginHint::Email(email) if site_config.login_with_email_allowed => {
+                Some(email.to_string())
+            }
+            _ => None,
         };
         form_state.set_value(LoginFormField::Username, value);
     }
@@ -400,6 +410,7 @@ async fn render(
     rng: impl Rng,
     templates: &Templates,
     homeserver: &dyn HomeserverConnection,
+    site_config: &SiteConfig,
 ) -> Result<Response, InternalError> {
     let (csrf_token, cookie_jar) = cookie_jar.csrf_token(clock, rng);
     let providers = repo.upstream_oauth_provider().all_enabled().await?;
@@ -413,7 +424,7 @@ async fn render(
         .await
         .map_err(InternalError::from_anyhow)?;
     let ctx = if let Some(next) = next {
-        let ctx = handle_login_hint(ctx, &next, homeserver);
+        let ctx = handle_login_hint(ctx, &next, homeserver, site_config);
         ctx.with_post_action(next)
     } else {
         ctx
diff --git a/crates/handlers/src/views/logout.rs b/crates/handlers/src/views/logout.rs
index 9d0c3ec5a..8acb9d6d0 100644
--- a/crates/handlers/src/views/logout.rs
+++ b/crates/handlers/src/views/logout.rs
@@ -13,8 +13,9 @@ use mas_axum_utils::{
     cookies::CookieJar,
     csrf::{CsrfExt, ProtectedForm},
 };
+use mas_data_model::BoxClock;
 use mas_router::{PostAuthAction, UrlBuilder};
-use mas_storage::{BoxClock, BoxRepository, user::BrowserSessionRepository};
+use mas_storage::{BoxRepository, user::BrowserSessionRepository};
 
 use crate::BoundActivityTracker;
 
diff --git a/crates/handlers/src/views/recovery/progress.rs b/crates/handlers/src/views/recovery/progress.rs
index 75c342b1e..06e71f17c 100644
--- a/crates/handlers/src/views/recovery/progress.rs
+++ b/crates/handlers/src/views/recovery/progress.rs
@@ -15,10 +15,10 @@ use mas_axum_utils::{
     cookies::CookieJar,
     csrf::{CsrfExt, ProtectedForm},
 };
-use mas_data_model::SiteConfig;
+use mas_data_model::{BoxClock, BoxRng, SiteConfig};
 use mas_router::UrlBuilder;
 use mas_storage::{
-    BoxClock, BoxRepository, BoxRng,
+    BoxRepository,
     queue::{QueueJobRepositoryExt as _, SendAccountRecoveryEmailsJob},
 };
 use mas_templates::{EmptyContext, RecoveryProgressContext, TemplateContext, Templates};
diff --git a/crates/handlers/src/views/recovery/start.rs b/crates/handlers/src/views/recovery/start.rs
index df52549b3..f877a04db 100644
--- a/crates/handlers/src/views/recovery/start.rs
+++ b/crates/handlers/src/views/recovery/start.rs
@@ -18,10 +18,10 @@ use mas_axum_utils::{
     cookies::CookieJar,
     csrf::{CsrfExt, ProtectedForm},
 };
-use mas_data_model::SiteConfig;
+use mas_data_model::{BoxClock, BoxRng, SiteConfig};
 use mas_router::UrlBuilder;
 use mas_storage::{
-    BoxClock, BoxRepository, BoxRng,
+    BoxRepository,
     queue::{QueueJobRepositoryExt as _, SendAccountRecoveryEmailsJob},
 };
 use mas_templates::{
diff --git a/crates/handlers/src/views/register/cookie.rs b/crates/handlers/src/views/register/cookie.rs
index d00d11109..ab2d7522f 100644
--- a/crates/handlers/src/views/register/cookie.rs
+++ b/crates/handlers/src/views/register/cookie.rs
@@ -9,8 +9,7 @@ use std::collections::BTreeSet;
 
 use chrono::{DateTime, Duration, Utc};
 use mas_axum_utils::cookies::CookieJar;
-use mas_data_model::UserRegistration;
-use mas_storage::Clock;
+use mas_data_model::{Clock, UserRegistration};
 use serde::{Deserialize, Serialize};
 use thiserror::Error;
 use ulid::Ulid;
diff --git a/crates/handlers/src/views/register/mod.rs b/crates/handlers/src/views/register/mod.rs
index f78a3df2e..41ee18ad6 100644
--- a/crates/handlers/src/views/register/mod.rs
+++ b/crates/handlers/src/views/register/mod.rs
@@ -8,9 +8,9 @@ use axum::{
     response::{Html, IntoResponse, Response},
 };
 use mas_axum_utils::{InternalError, SessionInfoExt, cookies::CookieJar, csrf::CsrfExt as _};
-use mas_data_model::SiteConfig;
+use mas_data_model::{BoxClock, BoxRng, SiteConfig};
 use mas_router::{PasswordRegister, UpstreamOAuth2Authorize, UrlBuilder};
-use mas_storage::{BoxClock, BoxRepository, BoxRng};
+use mas_storage::BoxRepository;
 use mas_templates::{RegisterContext, TemplateContext, Templates};
 
 use super::shared::OptionalPostAuthAction;
diff --git a/crates/handlers/src/views/register/password.rs b/crates/handlers/src/views/register/password.rs
index b7c29eaa1..a9a882f68 100644
--- a/crates/handlers/src/views/register/password.rs
+++ b/crates/handlers/src/views/register/password.rs
@@ -18,13 +18,13 @@ use mas_axum_utils::{
     cookies::CookieJar,
     csrf::{CsrfExt, CsrfToken, ProtectedForm},
 };
-use mas_data_model::CaptchaConfig;
+use mas_data_model::{BoxClock, BoxRng, CaptchaConfig};
 use mas_i18n::DataLocale;
 use mas_matrix::HomeserverConnection;
 use mas_policy::Policy;
 use mas_router::UrlBuilder;
 use mas_storage::{
-    BoxClock, BoxRepository, BoxRng, RepositoryAccess,
+    BoxRepository, RepositoryAccess,
     queue::{QueueJobRepositoryExt as _, SendEmailAuthenticationCodeJob},
     user::{UserEmailRepository, UserRepository},
 };
diff --git a/crates/handlers/src/views/register/steps/display_name.rs b/crates/handlers/src/views/register/steps/display_name.rs
index dd1a846d0..0749c097d 100644
--- a/crates/handlers/src/views/register/steps/display_name.rs
+++ b/crates/handlers/src/views/register/steps/display_name.rs
@@ -14,8 +14,9 @@ use mas_axum_utils::{
     cookies::CookieJar,
     csrf::{CsrfExt as _, ProtectedForm},
 };
+use mas_data_model::{BoxClock, BoxRng};
 use mas_router::{PostAuthAction, UrlBuilder};
-use mas_storage::{BoxClock, BoxRepository, BoxRng};
+use mas_storage::BoxRepository;
 use mas_templates::{
     FieldError, RegisterStepsDisplayNameContext, RegisterStepsDisplayNameFormField,
     TemplateContext as _, Templates, ToFormState,
diff --git a/crates/handlers/src/views/register/steps/finish.rs b/crates/handlers/src/views/register/steps/finish.rs
index 2bf0d36ee..de7a537b5 100644
--- a/crates/handlers/src/views/register/steps/finish.rs
+++ b/crates/handlers/src/views/register/steps/finish.rs
@@ -13,11 +13,11 @@ use axum::{
 use axum_extra::TypedHeader;
 use chrono::Duration;
 use mas_axum_utils::{InternalError, SessionInfoExt as _, cookies::CookieJar};
-use mas_data_model::SiteConfig;
+use mas_data_model::{BoxClock, BoxRng, SiteConfig};
 use mas_matrix::HomeserverConnection;
 use mas_router::{PostAuthAction, UrlBuilder};
 use mas_storage::{
-    BoxClock, BoxRepository, BoxRng,
+    BoxRepository,
     queue::{ProvisionUserJob, QueueJobRepositoryExt as _},
     user::UserEmailFilter,
 };
diff --git a/crates/handlers/src/views/register/steps/registration_token.rs b/crates/handlers/src/views/register/steps/registration_token.rs
index 9697214fe..f9ad5b872 100644
--- a/crates/handlers/src/views/register/steps/registration_token.rs
+++ b/crates/handlers/src/views/register/steps/registration_token.rs
@@ -14,8 +14,9 @@ use mas_axum_utils::{
     cookies::CookieJar,
     csrf::{CsrfExt as _, ProtectedForm},
 };
+use mas_data_model::{BoxClock, BoxRng};
 use mas_router::{PostAuthAction, UrlBuilder};
-use mas_storage::{BoxClock, BoxRepository, BoxRng};
+use mas_storage::BoxRepository;
 use mas_templates::{
     FieldError, RegisterStepsRegistrationTokenContext, RegisterStepsRegistrationTokenFormField,
     TemplateContext as _, Templates, ToFormState,
diff --git a/crates/handlers/src/views/register/steps/verify_email.rs b/crates/handlers/src/views/register/steps/verify_email.rs
index bf464f8d6..9b85626e1 100644
--- a/crates/handlers/src/views/register/steps/verify_email.rs
+++ b/crates/handlers/src/views/register/steps/verify_email.rs
@@ -13,8 +13,9 @@ use mas_axum_utils::{
     cookies::CookieJar,
     csrf::{CsrfExt, ProtectedForm},
 };
+use mas_data_model::{BoxClock, BoxRng};
 use mas_router::{PostAuthAction, UrlBuilder};
-use mas_storage::{BoxClock, BoxRepository, BoxRng, RepositoryAccess, user::UserEmailRepository};
+use mas_storage::{BoxRepository, RepositoryAccess, user::UserEmailRepository};
 use mas_templates::{
     FieldError, RegisterStepsVerifyEmailContext, RegisterStepsVerifyEmailFormField,
     TemplateContext, Templates, ToFormState,
diff --git a/crates/storage-pg/src/app_session.rs b/crates/storage-pg/src/app_session.rs
index bfa0b66ba..62f3979a9 100644
--- a/crates/storage-pg/src/app_session.rs
+++ b/crates/storage-pg/src/app_session.rs
@@ -7,9 +7,11 @@
 //! A module containing PostgreSQL implementation of repositories for sessions
 
 use async_trait::async_trait;
-use mas_data_model::{CompatSession, CompatSessionState, Device, Session, SessionState, User};
+use mas_data_model::{
+    Clock, CompatSession, CompatSessionState, Device, Session, SessionState, User,
+};
 use mas_storage::{
-    Clock, Page, Pagination,
+    Page, Pagination,
     app_session::{AppSession, AppSessionFilter, AppSessionRepository, AppSessionState},
     compat::CompatSessionFilter,
     oauth2::OAuth2SessionFilter,
@@ -530,11 +532,10 @@ impl AppSessionRepository for PgAppSessionRepository<'_> {
 #[cfg(test)]
 mod tests {
     use chrono::Duration;
-    use mas_data_model::Device;
+    use mas_data_model::{Device, clock::MockClock};
     use mas_storage::{
         Pagination, RepositoryAccess,
         app_session::{AppSession, AppSessionFilter},
-        clock::MockClock,
         oauth2::OAuth2SessionRepository,
     };
     use oauth2_types::{
diff --git a/crates/storage-pg/src/compat/access_token.rs b/crates/storage-pg/src/compat/access_token.rs
index 2ca36fc9a..8e68f0767 100644
--- a/crates/storage-pg/src/compat/access_token.rs
+++ b/crates/storage-pg/src/compat/access_token.rs
@@ -6,8 +6,8 @@
 
 use async_trait::async_trait;
 use chrono::{DateTime, Duration, Utc};
-use mas_data_model::{CompatAccessToken, CompatSession};
-use mas_storage::{Clock, compat::CompatAccessTokenRepository};
+use mas_data_model::{Clock, CompatAccessToken, CompatSession};
+use mas_storage::compat::CompatAccessTokenRepository;
 use rand::RngCore;
 use sqlx::PgConnection;
 use ulid::Ulid;
diff --git a/crates/storage-pg/src/compat/mod.rs b/crates/storage-pg/src/compat/mod.rs
index 2e903af77..db190db71 100644
--- a/crates/storage-pg/src/compat/mod.rs
+++ b/crates/storage-pg/src/compat/mod.rs
@@ -20,10 +20,9 @@ pub use self::{
 #[cfg(test)]
 mod tests {
     use chrono::Duration;
-    use mas_data_model::Device;
+    use mas_data_model::{Clock, Device, clock::MockClock};
     use mas_storage::{
-        Clock, Pagination, RepositoryAccess,
-        clock::MockClock,
+        Pagination, RepositoryAccess,
         compat::{
             CompatAccessTokenRepository, CompatRefreshTokenRepository, CompatSessionFilter,
             CompatSessionRepository, CompatSsoLoginFilter,
diff --git a/crates/storage-pg/src/compat/refresh_token.rs b/crates/storage-pg/src/compat/refresh_token.rs
index 67a2b839e..5c6add046 100644
--- a/crates/storage-pg/src/compat/refresh_token.rs
+++ b/crates/storage-pg/src/compat/refresh_token.rs
@@ -7,9 +7,9 @@
 use async_trait::async_trait;
 use chrono::{DateTime, Utc};
 use mas_data_model::{
-    CompatAccessToken, CompatRefreshToken, CompatRefreshTokenState, CompatSession,
+    Clock, CompatAccessToken, CompatRefreshToken, CompatRefreshTokenState, CompatSession,
 };
-use mas_storage::{Clock, compat::CompatRefreshTokenRepository};
+use mas_storage::compat::CompatRefreshTokenRepository;
 use rand::RngCore;
 use sqlx::PgConnection;
 use ulid::Ulid;
diff --git a/crates/storage-pg/src/compat/session.rs b/crates/storage-pg/src/compat/session.rs
index d5d41fb7b..4ba5ee726 100644
--- a/crates/storage-pg/src/compat/session.rs
+++ b/crates/storage-pg/src/compat/session.rs
@@ -9,11 +9,11 @@ use std::net::IpAddr;
 use async_trait::async_trait;
 use chrono::{DateTime, Utc};
 use mas_data_model::{
-    BrowserSession, CompatSession, CompatSessionState, CompatSsoLogin, CompatSsoLoginState, Device,
-    User,
+    BrowserSession, Clock, CompatSession, CompatSessionState, CompatSsoLogin, CompatSsoLoginState,
+    Device, User,
 };
 use mas_storage::{
-    Clock, Page, Pagination,
+    Page, Pagination,
     compat::{CompatSessionFilter, CompatSessionRepository},
 };
 use rand::RngCore;
diff --git a/crates/storage-pg/src/compat/sso_login.rs b/crates/storage-pg/src/compat/sso_login.rs
index 822812ae5..eeadff164 100644
--- a/crates/storage-pg/src/compat/sso_login.rs
+++ b/crates/storage-pg/src/compat/sso_login.rs
@@ -6,9 +6,9 @@
 
 use async_trait::async_trait;
 use chrono::{DateTime, Utc};
-use mas_data_model::{BrowserSession, CompatSession, CompatSsoLogin, CompatSsoLoginState};
+use mas_data_model::{BrowserSession, Clock, CompatSession, CompatSsoLogin, CompatSsoLoginState};
 use mas_storage::{
-    Clock, Page, Pagination,
+    Page, Pagination,
     compat::{CompatSsoLoginFilter, CompatSsoLoginRepository},
 };
 use rand::RngCore;
diff --git a/crates/storage-pg/src/lib.rs b/crates/storage-pg/src/lib.rs
index 108248537..908058df6 100644
--- a/crates/storage-pg/src/lib.rs
+++ b/crates/storage-pg/src/lib.rs
@@ -22,7 +22,7 @@
 //! # use async_trait::async_trait;
 //! # use ulid::Ulid;
 //! # use rand::RngCore;
-//! # use mas_storage::Clock;
+//! # use mas_data_model::Clock;
 //! # use mas_storage_pg::{DatabaseError, ExecuteExt};
 //! # use sqlx::PgConnection;
 //! # use uuid::Uuid;
diff --git a/crates/storage-pg/src/oauth2/access_token.rs b/crates/storage-pg/src/oauth2/access_token.rs
index fb5406285..63790b77e 100644
--- a/crates/storage-pg/src/oauth2/access_token.rs
+++ b/crates/storage-pg/src/oauth2/access_token.rs
@@ -6,8 +6,8 @@
 
 use async_trait::async_trait;
 use chrono::{DateTime, Duration, Utc};
-use mas_data_model::{AccessToken, AccessTokenState, Session};
-use mas_storage::{Clock, oauth2::OAuth2AccessTokenRepository};
+use mas_data_model::{AccessToken, AccessTokenState, Clock, Session};
+use mas_storage::oauth2::OAuth2AccessTokenRepository;
 use rand::RngCore;
 use sqlx::PgConnection;
 use ulid::Ulid;
diff --git a/crates/storage-pg/src/oauth2/authorization_grant.rs b/crates/storage-pg/src/oauth2/authorization_grant.rs
index d9727ead0..b8af0e535 100644
--- a/crates/storage-pg/src/oauth2/authorization_grant.rs
+++ b/crates/storage-pg/src/oauth2/authorization_grant.rs
@@ -7,10 +7,10 @@
 use async_trait::async_trait;
 use chrono::{DateTime, Utc};
 use mas_data_model::{
-    AuthorizationCode, AuthorizationGrant, AuthorizationGrantStage, Client, Pkce, Session,
+    AuthorizationCode, AuthorizationGrant, AuthorizationGrantStage, Client, Clock, Pkce, Session,
 };
 use mas_iana::oauth::PkceCodeChallengeMethod;
-use mas_storage::{Clock, oauth2::OAuth2AuthorizationGrantRepository};
+use mas_storage::oauth2::OAuth2AuthorizationGrantRepository;
 use oauth2_types::{requests::ResponseMode, scope::Scope};
 use rand::RngCore;
 use sqlx::PgConnection;
diff --git a/crates/storage-pg/src/oauth2/client.rs b/crates/storage-pg/src/oauth2/client.rs
index 2c76f484d..ae7b03ac9 100644
--- a/crates/storage-pg/src/oauth2/client.rs
+++ b/crates/storage-pg/src/oauth2/client.rs
@@ -10,10 +10,10 @@ use std::{
 };
 
 use async_trait::async_trait;
-use mas_data_model::{Client, JwksOrJwksUri};
+use mas_data_model::{Client, Clock, JwksOrJwksUri};
 use mas_iana::{jose::JsonWebSignatureAlg, oauth::OAuthClientAuthenticationMethod};
 use mas_jose::jwk::PublicJsonWebKeySet;
-use mas_storage::{Clock, oauth2::OAuth2ClientRepository};
+use mas_storage::oauth2::OAuth2ClientRepository;
 use oauth2_types::{oidc::ApplicationType, requests::GrantType};
 use opentelemetry_semantic_conventions::attribute::DB_QUERY_TEXT;
 use rand::RngCore;
diff --git a/crates/storage-pg/src/oauth2/device_code_grant.rs b/crates/storage-pg/src/oauth2/device_code_grant.rs
index d7b3f0977..57c057503 100644
--- a/crates/storage-pg/src/oauth2/device_code_grant.rs
+++ b/crates/storage-pg/src/oauth2/device_code_grant.rs
@@ -8,11 +8,8 @@ use std::net::IpAddr;
 
 use async_trait::async_trait;
 use chrono::{DateTime, Utc};
-use mas_data_model::{BrowserSession, DeviceCodeGrant, DeviceCodeGrantState, Session};
-use mas_storage::{
-    Clock,
-    oauth2::{OAuth2DeviceCodeGrantParams, OAuth2DeviceCodeGrantRepository},
-};
+use mas_data_model::{BrowserSession, Clock, DeviceCodeGrant, DeviceCodeGrantState, Session};
+use mas_storage::oauth2::{OAuth2DeviceCodeGrantParams, OAuth2DeviceCodeGrantRepository};
 use oauth2_types::scope::Scope;
 use rand::RngCore;
 use sqlx::PgConnection;
diff --git a/crates/storage-pg/src/oauth2/mod.rs b/crates/storage-pg/src/oauth2/mod.rs
index 547128d10..6b1c81d46 100644
--- a/crates/storage-pg/src/oauth2/mod.rs
+++ b/crates/storage-pg/src/oauth2/mod.rs
@@ -24,10 +24,9 @@ pub use self::{
 #[cfg(test)]
 mod tests {
     use chrono::Duration;
-    use mas_data_model::AuthorizationCode;
+    use mas_data_model::{AuthorizationCode, Clock, clock::MockClock};
     use mas_storage::{
-        Clock, Pagination,
-        clock::MockClock,
+        Pagination,
         oauth2::{OAuth2DeviceCodeGrantParams, OAuth2SessionFilter, OAuth2SessionRepository},
     };
     use oauth2_types::{
diff --git a/crates/storage-pg/src/oauth2/refresh_token.rs b/crates/storage-pg/src/oauth2/refresh_token.rs
index 225bccaa8..5b49e4bd7 100644
--- a/crates/storage-pg/src/oauth2/refresh_token.rs
+++ b/crates/storage-pg/src/oauth2/refresh_token.rs
@@ -6,8 +6,8 @@
 
 use async_trait::async_trait;
 use chrono::{DateTime, Utc};
-use mas_data_model::{AccessToken, RefreshToken, RefreshTokenState, Session};
-use mas_storage::{Clock, oauth2::OAuth2RefreshTokenRepository};
+use mas_data_model::{AccessToken, Clock, RefreshToken, RefreshTokenState, Session};
+use mas_storage::oauth2::OAuth2RefreshTokenRepository;
 use rand::RngCore;
 use sqlx::PgConnection;
 use ulid::Ulid;
diff --git a/crates/storage-pg/src/oauth2/session.rs b/crates/storage-pg/src/oauth2/session.rs
index 3ab210eda..c04e03df0 100644
--- a/crates/storage-pg/src/oauth2/session.rs
+++ b/crates/storage-pg/src/oauth2/session.rs
@@ -8,9 +8,9 @@ use std::net::IpAddr;
 
 use async_trait::async_trait;
 use chrono::{DateTime, Utc};
-use mas_data_model::{BrowserSession, Client, Session, SessionState, User};
+use mas_data_model::{BrowserSession, Client, Clock, Session, SessionState, User};
 use mas_storage::{
-    Clock, Page, Pagination,
+    Page, Pagination,
     oauth2::{OAuth2SessionFilter, OAuth2SessionRepository},
 };
 use oauth2_types::scope::{Scope, ScopeToken};
diff --git a/crates/storage-pg/src/policy_data.rs b/crates/storage-pg/src/policy_data.rs
index 0ce9b15fa..3bcb34d61 100644
--- a/crates/storage-pg/src/policy_data.rs
+++ b/crates/storage-pg/src/policy_data.rs
@@ -7,8 +7,8 @@
 //! storage.
 
 use async_trait::async_trait;
-use mas_data_model::PolicyData;
-use mas_storage::{Clock, policy_data::PolicyDataRepository};
+use mas_data_model::{Clock, PolicyData};
+use mas_storage::policy_data::PolicyDataRepository;
 use rand::RngCore;
 use serde_json::Value;
 use sqlx::{PgConnection, types::Json};
@@ -151,7 +151,8 @@ impl PolicyDataRepository for PgPolicyDataRepository<'_> {
 
 #[cfg(test)]
 mod tests {
-    use mas_storage::{clock::MockClock, policy_data::PolicyDataRepository};
+    use mas_data_model::clock::MockClock;
+    use mas_storage::policy_data::PolicyDataRepository;
     use rand::SeedableRng;
     use rand_chacha::ChaChaRng;
     use serde_json::json;
diff --git a/crates/storage-pg/src/queue/job.rs b/crates/storage-pg/src/queue/job.rs
index c2208c515..a7f9e5591 100644
--- a/crates/storage-pg/src/queue/job.rs
+++ b/crates/storage-pg/src/queue/job.rs
@@ -8,10 +8,8 @@
 
 use async_trait::async_trait;
 use chrono::{DateTime, Duration, Utc};
-use mas_storage::{
-    Clock,
-    queue::{Job, QueueJobRepository, Worker},
-};
+use mas_data_model::Clock;
+use mas_storage::queue::{Job, QueueJobRepository, Worker};
 use opentelemetry_semantic_conventions::trace::DB_QUERY_TEXT;
 use rand::RngCore;
 use sqlx::PgConnection;
diff --git a/crates/storage-pg/src/queue/worker.rs b/crates/storage-pg/src/queue/worker.rs
index 3aa21d5ce..c7dbc1f87 100644
--- a/crates/storage-pg/src/queue/worker.rs
+++ b/crates/storage-pg/src/queue/worker.rs
@@ -8,10 +8,8 @@
 
 use async_trait::async_trait;
 use chrono::Duration;
-use mas_storage::{
-    Clock,
-    queue::{QueueWorkerRepository, Worker},
-};
+use mas_data_model::Clock;
+use mas_storage::queue::{QueueWorkerRepository, Worker};
 use rand::RngCore;
 use sqlx::PgConnection;
 use ulid::Ulid;
diff --git a/crates/storage-pg/src/upstream_oauth2/link.rs b/crates/storage-pg/src/upstream_oauth2/link.rs
index 4d04cb68e..6f671655d 100644
--- a/crates/storage-pg/src/upstream_oauth2/link.rs
+++ b/crates/storage-pg/src/upstream_oauth2/link.rs
@@ -6,9 +6,9 @@
 
 use async_trait::async_trait;
 use chrono::{DateTime, Utc};
-use mas_data_model::{UpstreamOAuthLink, UpstreamOAuthProvider, User};
+use mas_data_model::{Clock, UpstreamOAuthLink, UpstreamOAuthProvider, User};
 use mas_storage::{
-    Clock, Page, Pagination,
+    Page, Pagination,
     upstream_oauth2::{UpstreamOAuthLinkFilter, UpstreamOAuthLinkRepository},
 };
 use opentelemetry_semantic_conventions::trace::DB_QUERY_TEXT;
diff --git a/crates/storage-pg/src/upstream_oauth2/mod.rs b/crates/storage-pg/src/upstream_oauth2/mod.rs
index 0ec2c3670..6381c9b7f 100644
--- a/crates/storage-pg/src/upstream_oauth2/mod.rs
+++ b/crates/storage-pg/src/upstream_oauth2/mod.rs
@@ -21,12 +21,11 @@ mod tests {
     use chrono::Duration;
     use mas_data_model::{
         UpstreamOAuthProviderClaimsImports, UpstreamOAuthProviderOnBackchannelLogout,
-        UpstreamOAuthProviderTokenAuthMethod,
+        UpstreamOAuthProviderTokenAuthMethod, clock::MockClock,
     };
     use mas_iana::jose::JsonWebSignatureAlg;
     use mas_storage::{
         Pagination, RepositoryAccess,
-        clock::MockClock,
         upstream_oauth2::{
             UpstreamOAuthLinkFilter, UpstreamOAuthLinkRepository, UpstreamOAuthProviderFilter,
             UpstreamOAuthProviderParams, UpstreamOAuthProviderRepository,
diff --git a/crates/storage-pg/src/upstream_oauth2/provider.rs b/crates/storage-pg/src/upstream_oauth2/provider.rs
index 364a81c90..583f8ec0c 100644
--- a/crates/storage-pg/src/upstream_oauth2/provider.rs
+++ b/crates/storage-pg/src/upstream_oauth2/provider.rs
@@ -6,9 +6,9 @@
 
 use async_trait::async_trait;
 use chrono::{DateTime, Utc};
-use mas_data_model::{UpstreamOAuthProvider, UpstreamOAuthProviderClaimsImports};
+use mas_data_model::{Clock, UpstreamOAuthProvider, UpstreamOAuthProviderClaimsImports};
 use mas_storage::{
-    Clock, Page, Pagination,
+    Page, Pagination,
     upstream_oauth2::{
         UpstreamOAuthProviderFilter, UpstreamOAuthProviderParams, UpstreamOAuthProviderRepository,
     },
diff --git a/crates/storage-pg/src/upstream_oauth2/session.rs b/crates/storage-pg/src/upstream_oauth2/session.rs
index 8cc04eeb6..8b37aae2e 100644
--- a/crates/storage-pg/src/upstream_oauth2/session.rs
+++ b/crates/storage-pg/src/upstream_oauth2/session.rs
@@ -7,11 +7,11 @@
 use async_trait::async_trait;
 use chrono::{DateTime, Utc};
 use mas_data_model::{
-    UpstreamOAuthAuthorizationSession, UpstreamOAuthAuthorizationSessionState, UpstreamOAuthLink,
-    UpstreamOAuthProvider,
+    Clock, UpstreamOAuthAuthorizationSession, UpstreamOAuthAuthorizationSessionState,
+    UpstreamOAuthLink, UpstreamOAuthProvider,
 };
 use mas_storage::{
-    Clock, Page, Pagination,
+    Page, Pagination,
     upstream_oauth2::{UpstreamOAuthSessionFilter, UpstreamOAuthSessionRepository},
 };
 use rand::RngCore;
diff --git a/crates/storage-pg/src/user/email.rs b/crates/storage-pg/src/user/email.rs
index ba7f1a35f..916874ae8 100644
--- a/crates/storage-pg/src/user/email.rs
+++ b/crates/storage-pg/src/user/email.rs
@@ -7,11 +7,11 @@
 use async_trait::async_trait;
 use chrono::{DateTime, Utc};
 use mas_data_model::{
-    BrowserSession, User, UserEmail, UserEmailAuthentication, UserEmailAuthenticationCode,
+    BrowserSession, Clock, User, UserEmail, UserEmailAuthentication, UserEmailAuthenticationCode,
     UserRegistration,
 };
 use mas_storage::{
-    Clock, Page, Pagination,
+    Page, Pagination,
     user::{UserEmailFilter, UserEmailRepository},
 };
 use rand::RngCore;
diff --git a/crates/storage-pg/src/user/mod.rs b/crates/storage-pg/src/user/mod.rs
index 6d03e9bf7..8af61b61c 100644
--- a/crates/storage-pg/src/user/mod.rs
+++ b/crates/storage-pg/src/user/mod.rs
@@ -8,11 +8,8 @@
 //! repositories
 
 use async_trait::async_trait;
-use mas_data_model::User;
-use mas_storage::{
-    Clock,
-    user::{UserFilter, UserRepository},
-};
+use mas_data_model::{Clock, User};
+use mas_storage::user::{UserFilter, UserRepository};
 use rand::RngCore;
 use sea_query::{Expr, PostgresQueryBuilder, Query};
 use sea_query_binder::SqlxBinder;
diff --git a/crates/storage-pg/src/user/password.rs b/crates/storage-pg/src/user/password.rs
index ad59a99b4..ca6161270 100644
--- a/crates/storage-pg/src/user/password.rs
+++ b/crates/storage-pg/src/user/password.rs
@@ -6,8 +6,8 @@
 
 use async_trait::async_trait;
 use chrono::{DateTime, Utc};
-use mas_data_model::{Password, User};
-use mas_storage::{Clock, user::UserPasswordRepository};
+use mas_data_model::{Clock, Password, User};
+use mas_storage::user::UserPasswordRepository;
 use rand::RngCore;
 use sqlx::PgConnection;
 use ulid::Ulid;
diff --git a/crates/storage-pg/src/user/recovery.rs b/crates/storage-pg/src/user/recovery.rs
index 25de80a38..30ab64bcb 100644
--- a/crates/storage-pg/src/user/recovery.rs
+++ b/crates/storage-pg/src/user/recovery.rs
@@ -8,8 +8,8 @@ use std::net::IpAddr;
 
 use async_trait::async_trait;
 use chrono::{DateTime, Duration, Utc};
-use mas_data_model::{UserEmail, UserRecoverySession, UserRecoveryTicket};
-use mas_storage::{Clock, user::UserRecoveryRepository};
+use mas_data_model::{Clock, UserEmail, UserRecoverySession, UserRecoveryTicket};
+use mas_storage::user::UserRecoveryRepository;
 use rand::RngCore;
 use sqlx::PgConnection;
 use ulid::Ulid;
diff --git a/crates/storage-pg/src/user/registration.rs b/crates/storage-pg/src/user/registration.rs
index fdbdb7139..fc62c1cd8 100644
--- a/crates/storage-pg/src/user/registration.rs
+++ b/crates/storage-pg/src/user/registration.rs
@@ -8,9 +8,10 @@ use std::net::IpAddr;
 use async_trait::async_trait;
 use chrono::{DateTime, Utc};
 use mas_data_model::{
-    UserEmailAuthentication, UserRegistration, UserRegistrationPassword, UserRegistrationToken,
+    Clock, UserEmailAuthentication, UserRegistration, UserRegistrationPassword,
+    UserRegistrationToken,
 };
-use mas_storage::{Clock, user::UserRegistrationRepository};
+use mas_storage::user::UserRegistrationRepository;
 use rand::RngCore;
 use sqlx::PgConnection;
 use ulid::Ulid;
@@ -432,8 +433,7 @@ impl UserRegistrationRepository for PgUserRegistrationRepository<'_> {
 mod tests {
     use std::net::{IpAddr, Ipv4Addr};
 
-    use mas_data_model::UserRegistrationPassword;
-    use mas_storage::{Clock, clock::MockClock};
+    use mas_data_model::{Clock, UserRegistrationPassword, clock::MockClock};
     use rand::SeedableRng;
     use rand_chacha::ChaChaRng;
     use sqlx::PgPool;
diff --git a/crates/storage-pg/src/user/registration_token.rs b/crates/storage-pg/src/user/registration_token.rs
index b748c4645..f64c8136d 100644
--- a/crates/storage-pg/src/user/registration_token.rs
+++ b/crates/storage-pg/src/user/registration_token.rs
@@ -5,9 +5,9 @@
 
 use async_trait::async_trait;
 use chrono::{DateTime, Utc};
-use mas_data_model::UserRegistrationToken;
+use mas_data_model::{Clock, UserRegistrationToken};
 use mas_storage::{
-    Clock, Page, Pagination,
+    Page, Pagination,
     user::{UserRegistrationTokenFilter, UserRegistrationTokenRepository},
 };
 use rand::RngCore;
@@ -429,7 +429,7 @@ impl UserRegistrationTokenRepository for PgUserRegistrationTokenRepository<'_> {
     async fn add(
         &mut self,
         rng: &mut (dyn RngCore + Send),
-        clock: &dyn mas_storage::Clock,
+        clock: &dyn mas_data_model::Clock,
         token: String,
         usage_limit: Option<u32>,
         expires_at: Option<DateTime<Utc>>,
@@ -655,9 +655,8 @@ impl UserRegistrationTokenRepository for PgUserRegistrationTokenRepository<'_> {
 #[cfg(test)]
 mod tests {
     use chrono::Duration;
-    use mas_storage::{
-        Clock as _, Pagination, clock::MockClock, user::UserRegistrationTokenFilter,
-    };
+    use mas_data_model::{Clock as _, clock::MockClock};
+    use mas_storage::{Pagination, user::UserRegistrationTokenFilter};
     use rand::SeedableRng;
     use rand_chacha::ChaChaRng;
     use sqlx::PgPool;
diff --git a/crates/storage-pg/src/user/session.rs b/crates/storage-pg/src/user/session.rs
index db8a8cacf..a8c5ab458 100644
--- a/crates/storage-pg/src/user/session.rs
+++ b/crates/storage-pg/src/user/session.rs
@@ -9,11 +9,11 @@ use std::net::IpAddr;
 use async_trait::async_trait;
 use chrono::{DateTime, Utc};
 use mas_data_model::{
-    Authentication, AuthenticationMethod, BrowserSession, Password,
+    Authentication, AuthenticationMethod, BrowserSession, Clock, Password,
     UpstreamOAuthAuthorizationSession, User,
 };
 use mas_storage::{
-    Clock, Page, Pagination,
+    Page, Pagination,
     user::{BrowserSessionFilter, BrowserSessionRepository},
 };
 use rand::RngCore;
diff --git a/crates/storage-pg/src/user/terms.rs b/crates/storage-pg/src/user/terms.rs
index b40716569..df83d9375 100644
--- a/crates/storage-pg/src/user/terms.rs
+++ b/crates/storage-pg/src/user/terms.rs
@@ -5,8 +5,8 @@
 // Please see LICENSE files in the repository root for full details.
 
 use async_trait::async_trait;
-use mas_data_model::User;
-use mas_storage::{Clock, user::UserTermsRepository};
+use mas_data_model::{Clock, User};
+use mas_storage::user::UserTermsRepository;
 use rand::RngCore;
 use sqlx::PgConnection;
 use ulid::Ulid;
diff --git a/crates/storage-pg/src/user/tests.rs b/crates/storage-pg/src/user/tests.rs
index 3225c8bbd..0880c1032 100644
--- a/crates/storage-pg/src/user/tests.rs
+++ b/crates/storage-pg/src/user/tests.rs
@@ -5,10 +5,10 @@
 // Please see LICENSE files in the repository root for full details.
 
 use chrono::Duration;
+use mas_data_model::{Clock, clock::MockClock};
 use mas_iana::jose::JsonWebSignatureAlg;
 use mas_storage::{
-    Clock, Pagination, RepositoryAccess,
-    clock::MockClock,
+    Pagination, RepositoryAccess,
     upstream_oauth2::{UpstreamOAuthProviderParams, UpstreamOAuthSessionFilter},
     user::{
         BrowserSessionFilter, BrowserSessionRepository, UserEmailFilter, UserEmailRepository,
diff --git a/crates/storage/src/app_session.rs b/crates/storage/src/app_session.rs
index 65e5669b4..d649ff35e 100644
--- a/crates/storage/src/app_session.rs
+++ b/crates/storage/src/app_session.rs
@@ -8,9 +8,9 @@
 
 use async_trait::async_trait;
 use chrono::{DateTime, Utc};
-use mas_data_model::{BrowserSession, CompatSession, Device, Session, User};
+use mas_data_model::{BrowserSession, Clock, CompatSession, Device, Session, User};
 
-use crate::{Clock, Page, Pagination, repository_impl};
+use crate::{Page, Pagination, repository_impl};
 
 /// The state of a session
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
diff --git a/crates/storage/src/compat/access_token.rs b/crates/storage/src/compat/access_token.rs
index d927009b7..8dd41ba43 100644
--- a/crates/storage/src/compat/access_token.rs
+++ b/crates/storage/src/compat/access_token.rs
@@ -6,11 +6,11 @@
 
 use async_trait::async_trait;
 use chrono::Duration;
-use mas_data_model::{CompatAccessToken, CompatSession};
+use mas_data_model::{Clock, CompatAccessToken, CompatSession};
 use rand_core::RngCore;
 use ulid::Ulid;
 
-use crate::{Clock, repository_impl};
+use crate::repository_impl;
 
 /// A [`CompatAccessTokenRepository`] helps interacting with
 /// [`CompatAccessToken`] saved in the storage backend
diff --git a/crates/storage/src/compat/refresh_token.rs b/crates/storage/src/compat/refresh_token.rs
index ca37278cc..6ffefbc69 100644
--- a/crates/storage/src/compat/refresh_token.rs
+++ b/crates/storage/src/compat/refresh_token.rs
@@ -5,11 +5,11 @@
 // Please see LICENSE files in the repository root for full details.
 
 use async_trait::async_trait;
-use mas_data_model::{CompatAccessToken, CompatRefreshToken, CompatSession};
+use mas_data_model::{Clock, CompatAccessToken, CompatRefreshToken, CompatSession};
 use rand_core::RngCore;
 use ulid::Ulid;
 
-use crate::{Clock, repository_impl};
+use crate::repository_impl;
 
 /// A [`CompatRefreshTokenRepository`] helps interacting with
 /// [`CompatRefreshToken`] saved in the storage backend
diff --git a/crates/storage/src/compat/session.rs b/crates/storage/src/compat/session.rs
index 5287b4cee..d16351c0a 100644
--- a/crates/storage/src/compat/session.rs
+++ b/crates/storage/src/compat/session.rs
@@ -8,11 +8,11 @@ use std::net::IpAddr;
 
 use async_trait::async_trait;
 use chrono::{DateTime, Utc};
-use mas_data_model::{BrowserSession, CompatSession, CompatSsoLogin, Device, User};
+use mas_data_model::{BrowserSession, Clock, CompatSession, CompatSsoLogin, Device, User};
 use rand_core::RngCore;
 use ulid::Ulid;
 
-use crate::{Clock, Page, Pagination, repository_impl, user::BrowserSessionFilter};
+use crate::{Page, Pagination, repository_impl, user::BrowserSessionFilter};
 
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub enum CompatSessionState {
diff --git a/crates/storage/src/compat/sso_login.rs b/crates/storage/src/compat/sso_login.rs
index 90cc42750..69de52948 100644
--- a/crates/storage/src/compat/sso_login.rs
+++ b/crates/storage/src/compat/sso_login.rs
@@ -5,12 +5,12 @@
 // Please see LICENSE files in the repository root for full details.
 
 use async_trait::async_trait;
-use mas_data_model::{BrowserSession, CompatSession, CompatSsoLogin, User};
+use mas_data_model::{BrowserSession, Clock, CompatSession, CompatSsoLogin, User};
 use rand_core::RngCore;
 use ulid::Ulid;
 use url::Url;
 
-use crate::{Clock, Pagination, pagination::Page, repository_impl};
+use crate::{Pagination, pagination::Page, repository_impl};
 
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub enum CompatSsoLoginState {
diff --git a/crates/storage/src/lib.rs b/crates/storage/src/lib.rs
index 11191e092..605dea279 100644
--- a/crates/storage/src/lib.rs
+++ b/crates/storage/src/lib.rs
@@ -15,13 +15,6 @@
 //! without caring about the underlying storage backend, and without carrying
 //! around the generic type parameter.
 //!
-//! This crate also defines a [`Clock`] trait that can be used to abstract the
-//! way the current time is retrieved. It has two implementation:
-//! [`SystemClock`] that uses the system time and [`MockClock`] which is useful
-//! for testing.
-//!
-//! [`MockClock`]: crate::clock::MockClock
-//!
 //! # Defining a new repository
 //!
 //! To define a new repository, you have to:
@@ -86,9 +79,9 @@
 //!      and use that error type
 //!   2. Lookups return an `Result<Option<T>, Self::Error>`, because 'not found'
 //!      errors are usually cases that are handled differently
-//!   3. Operations that need to record the current type use a [`Clock`]
-//!      parameter. Operations that need to generate new IDs also use a random
-//!      number generator.
+//!   3. Operations that need to record the current type use a
+//!      [`mas_data_model::Clock`] parameter. Operations that need to generate
+//!      new IDs also use a random number generator.
 //!   4. All the methods use an `&mut self`. This is ensures only one operation
 //!      is done at a time on a single repository instance.
 //!
@@ -111,7 +104,6 @@
 #![deny(clippy::future_not_send, missing_docs)]
 #![allow(clippy::module_name_repetitions)]
 
-pub mod clock;
 pub mod pagination;
 pub(crate) mod repository;
 mod utils;
@@ -125,11 +117,10 @@ pub mod upstream_oauth2;
 pub mod user;
 
 pub use self::{
-    clock::{Clock, SystemClock},
     pagination::{Page, Pagination},
     repository::{
         BoxRepository, BoxRepositoryFactory, Repository, RepositoryAccess, RepositoryError,
         RepositoryFactory, RepositoryTransaction,
     },
-    utils::{BoxClock, BoxRng, MapErr},
+    utils::MapErr,
 };
diff --git a/crates/storage/src/oauth2/access_token.rs b/crates/storage/src/oauth2/access_token.rs
index 1ffc4d82d..a678bc59e 100644
--- a/crates/storage/src/oauth2/access_token.rs
+++ b/crates/storage/src/oauth2/access_token.rs
@@ -6,11 +6,11 @@
 
 use async_trait::async_trait;
 use chrono::Duration;
-use mas_data_model::{AccessToken, Session};
+use mas_data_model::{AccessToken, Clock, Session};
 use rand_core::RngCore;
 use ulid::Ulid;
 
-use crate::{Clock, repository_impl};
+use crate::repository_impl;
 
 /// An [`OAuth2AccessTokenRepository`] helps interacting with [`AccessToken`]
 /// saved in the storage backend
diff --git a/crates/storage/src/oauth2/authorization_grant.rs b/crates/storage/src/oauth2/authorization_grant.rs
index f87c07df0..c019f6bd7 100644
--- a/crates/storage/src/oauth2/authorization_grant.rs
+++ b/crates/storage/src/oauth2/authorization_grant.rs
@@ -5,13 +5,13 @@
 // Please see LICENSE files in the repository root for full details.
 
 use async_trait::async_trait;
-use mas_data_model::{AuthorizationCode, AuthorizationGrant, Client, Session};
+use mas_data_model::{AuthorizationCode, AuthorizationGrant, Client, Clock, Session};
 use oauth2_types::{requests::ResponseMode, scope::Scope};
 use rand_core::RngCore;
 use ulid::Ulid;
 use url::Url;
 
-use crate::{Clock, repository_impl};
+use crate::repository_impl;
 
 /// An [`OAuth2AuthorizationGrantRepository`] helps interacting with
 /// [`AuthorizationGrant`] saved in the storage backend
diff --git a/crates/storage/src/oauth2/client.rs b/crates/storage/src/oauth2/client.rs
index 779b754ca..7e376e1c3 100644
--- a/crates/storage/src/oauth2/client.rs
+++ b/crates/storage/src/oauth2/client.rs
@@ -7,7 +7,7 @@
 use std::collections::{BTreeMap, BTreeSet};
 
 use async_trait::async_trait;
-use mas_data_model::Client;
+use mas_data_model::{Client, Clock};
 use mas_iana::{jose::JsonWebSignatureAlg, oauth::OAuthClientAuthenticationMethod};
 use mas_jose::jwk::PublicJsonWebKeySet;
 use oauth2_types::{oidc::ApplicationType, requests::GrantType};
@@ -15,7 +15,7 @@ use rand_core::RngCore;
 use ulid::Ulid;
 use url::Url;
 
-use crate::{Clock, repository_impl};
+use crate::repository_impl;
 
 /// An [`OAuth2ClientRepository`] helps interacting with [`Client`] saved in the
 /// storage backend
diff --git a/crates/storage/src/oauth2/device_code_grant.rs b/crates/storage/src/oauth2/device_code_grant.rs
index 89bcb61f1..b1b1bd14e 100644
--- a/crates/storage/src/oauth2/device_code_grant.rs
+++ b/crates/storage/src/oauth2/device_code_grant.rs
@@ -8,12 +8,12 @@ use std::net::IpAddr;
 
 use async_trait::async_trait;
 use chrono::Duration;
-use mas_data_model::{BrowserSession, Client, DeviceCodeGrant, Session};
+use mas_data_model::{BrowserSession, Client, Clock, DeviceCodeGrant, Session};
 use oauth2_types::scope::Scope;
 use rand_core::RngCore;
 use ulid::Ulid;
 
-use crate::{Clock, repository_impl};
+use crate::repository_impl;
 
 /// Parameters used to create a new [`DeviceCodeGrant`]
 pub struct OAuth2DeviceCodeGrantParams<'a> {
diff --git a/crates/storage/src/oauth2/refresh_token.rs b/crates/storage/src/oauth2/refresh_token.rs
index b50295e4f..b81420a08 100644
--- a/crates/storage/src/oauth2/refresh_token.rs
+++ b/crates/storage/src/oauth2/refresh_token.rs
@@ -5,11 +5,11 @@
 // Please see LICENSE files in the repository root for full details.
 
 use async_trait::async_trait;
-use mas_data_model::{AccessToken, RefreshToken, Session};
+use mas_data_model::{AccessToken, Clock, RefreshToken, Session};
 use rand_core::RngCore;
 use ulid::Ulid;
 
-use crate::{Clock, repository_impl};
+use crate::repository_impl;
 
 /// An [`OAuth2RefreshTokenRepository`] helps interacting with [`RefreshToken`]
 /// saved in the storage backend
diff --git a/crates/storage/src/oauth2/session.rs b/crates/storage/src/oauth2/session.rs
index 5d217c1e2..30ac1abe1 100644
--- a/crates/storage/src/oauth2/session.rs
+++ b/crates/storage/src/oauth2/session.rs
@@ -8,12 +8,12 @@ use std::net::IpAddr;
 
 use async_trait::async_trait;
 use chrono::{DateTime, Utc};
-use mas_data_model::{BrowserSession, Client, Device, Session, User};
+use mas_data_model::{BrowserSession, Client, Clock, Device, Session, User};
 use oauth2_types::scope::Scope;
 use rand_core::RngCore;
 use ulid::Ulid;
 
-use crate::{Clock, Pagination, pagination::Page, repository_impl, user::BrowserSessionFilter};
+use crate::{Pagination, pagination::Page, repository_impl, user::BrowserSessionFilter};
 
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub enum OAuth2SessionState {
diff --git a/crates/storage/src/policy_data.rs b/crates/storage/src/policy_data.rs
index ec3b29c5a..68f0040ab 100644
--- a/crates/storage/src/policy_data.rs
+++ b/crates/storage/src/policy_data.rs
@@ -6,10 +6,10 @@
 //! Repositories to interact with the policy data saved in the storage backend.
 
 use async_trait::async_trait;
-use mas_data_model::PolicyData;
+use mas_data_model::{Clock, PolicyData};
 use rand_core::RngCore;
 
-use crate::{Clock, repository_impl};
+use crate::repository_impl;
 
 /// A [`PolicyDataRepository`] helps interacting with the policy data saved in
 /// the storage backend.
diff --git a/crates/storage/src/queue/job.rs b/crates/storage/src/queue/job.rs
index 30a5368c9..1fd21f442 100644
--- a/crates/storage/src/queue/job.rs
+++ b/crates/storage/src/queue/job.rs
@@ -7,6 +7,7 @@
 
 use async_trait::async_trait;
 use chrono::{DateTime, Duration, Utc};
+use mas_data_model::Clock;
 use opentelemetry::trace::TraceContextExt;
 use rand_core::RngCore;
 use serde::{Deserialize, Serialize};
@@ -14,7 +15,7 @@ use tracing_opentelemetry::OpenTelemetrySpanExt;
 use ulid::Ulid;
 
 use super::Worker;
-use crate::{Clock, repository_impl};
+use crate::repository_impl;
 
 /// Represents a job in the job queue
 pub struct Job {
diff --git a/crates/storage/src/queue/worker.rs b/crates/storage/src/queue/worker.rs
index d2d96ecfa..c937134fe 100644
--- a/crates/storage/src/queue/worker.rs
+++ b/crates/storage/src/queue/worker.rs
@@ -7,10 +7,11 @@
 
 use async_trait::async_trait;
 use chrono::Duration;
+use mas_data_model::Clock;
 use rand_core::RngCore;
 use ulid::Ulid;
 
-use crate::{Clock, repository_impl};
+use crate::repository_impl;
 
 /// A worker is an entity which can execute jobs.
 pub struct Worker {
diff --git a/crates/storage/src/upstream_oauth2/link.rs b/crates/storage/src/upstream_oauth2/link.rs
index a3672f361..092ad8d31 100644
--- a/crates/storage/src/upstream_oauth2/link.rs
+++ b/crates/storage/src/upstream_oauth2/link.rs
@@ -5,11 +5,11 @@
 // Please see LICENSE files in the repository root for full details.
 
 use async_trait::async_trait;
-use mas_data_model::{UpstreamOAuthLink, UpstreamOAuthProvider, User};
+use mas_data_model::{Clock, UpstreamOAuthLink, UpstreamOAuthProvider, User};
 use rand_core::RngCore;
 use ulid::Ulid;
 
-use crate::{Clock, Pagination, pagination::Page, repository_impl};
+use crate::{Pagination, pagination::Page, repository_impl};
 
 /// Filter parameters for listing upstream OAuth links
 #[derive(Clone, Copy, Debug, PartialEq, Eq, Default)]
diff --git a/crates/storage/src/upstream_oauth2/provider.rs b/crates/storage/src/upstream_oauth2/provider.rs
index bc44bfab7..256a74968 100644
--- a/crates/storage/src/upstream_oauth2/provider.rs
+++ b/crates/storage/src/upstream_oauth2/provider.rs
@@ -8,9 +8,10 @@ use std::marker::PhantomData;
 
 use async_trait::async_trait;
 use mas_data_model::{
-    UpstreamOAuthProvider, UpstreamOAuthProviderClaimsImports, UpstreamOAuthProviderDiscoveryMode,
-    UpstreamOAuthProviderOnBackchannelLogout, UpstreamOAuthProviderPkceMode,
-    UpstreamOAuthProviderResponseMode, UpstreamOAuthProviderTokenAuthMethod,
+    Clock, UpstreamOAuthProvider, UpstreamOAuthProviderClaimsImports,
+    UpstreamOAuthProviderDiscoveryMode, UpstreamOAuthProviderOnBackchannelLogout,
+    UpstreamOAuthProviderPkceMode, UpstreamOAuthProviderResponseMode,
+    UpstreamOAuthProviderTokenAuthMethod,
 };
 use mas_iana::jose::JsonWebSignatureAlg;
 use oauth2_types::scope::Scope;
@@ -18,7 +19,7 @@ use rand_core::RngCore;
 use ulid::Ulid;
 use url::Url;
 
-use crate::{Clock, Pagination, pagination::Page, repository_impl};
+use crate::{Pagination, pagination::Page, repository_impl};
 
 /// Structure which holds parameters when inserting or updating an upstream
 /// OAuth 2.0 provider
diff --git a/crates/storage/src/upstream_oauth2/session.rs b/crates/storage/src/upstream_oauth2/session.rs
index d6505285b..f9a902ec2 100644
--- a/crates/storage/src/upstream_oauth2/session.rs
+++ b/crates/storage/src/upstream_oauth2/session.rs
@@ -5,11 +5,13 @@
 // Please see LICENSE files in the repository root for full details.
 
 use async_trait::async_trait;
-use mas_data_model::{UpstreamOAuthAuthorizationSession, UpstreamOAuthLink, UpstreamOAuthProvider};
+use mas_data_model::{
+    Clock, UpstreamOAuthAuthorizationSession, UpstreamOAuthLink, UpstreamOAuthProvider,
+};
 use rand_core::RngCore;
 use ulid::Ulid;
 
-use crate::{Clock, Pagination, pagination::Page, repository_impl};
+use crate::{Pagination, pagination::Page, repository_impl};
 
 /// Filter parameters for listing upstream OAuth sessions
 #[derive(Clone, Copy, Debug, PartialEq, Eq, Default)]
diff --git a/crates/storage/src/user/email.rs b/crates/storage/src/user/email.rs
index daaead638..7e973510a 100644
--- a/crates/storage/src/user/email.rs
+++ b/crates/storage/src/user/email.rs
@@ -6,13 +6,13 @@
 
 use async_trait::async_trait;
 use mas_data_model::{
-    BrowserSession, User, UserEmail, UserEmailAuthentication, UserEmailAuthenticationCode,
+    BrowserSession, Clock, User, UserEmail, UserEmailAuthentication, UserEmailAuthenticationCode,
     UserRegistration,
 };
 use rand_core::RngCore;
 use ulid::Ulid;
 
-use crate::{Clock, Pagination, pagination::Page, repository_impl};
+use crate::{Pagination, pagination::Page, repository_impl};
 
 /// Filter parameters for listing user emails
 #[derive(Clone, Copy, Debug, PartialEq, Eq, Default)]
diff --git a/crates/storage/src/user/mod.rs b/crates/storage/src/user/mod.rs
index f864157b1..0294d83b4 100644
--- a/crates/storage/src/user/mod.rs
+++ b/crates/storage/src/user/mod.rs
@@ -7,11 +7,11 @@
 //! Repositories to interact with entities related to user accounts
 
 use async_trait::async_trait;
-use mas_data_model::User;
+use mas_data_model::{Clock, User};
 use rand_core::RngCore;
 use ulid::Ulid;
 
-use crate::{Clock, Page, Pagination, repository_impl};
+use crate::{Page, Pagination, repository_impl};
 
 mod email;
 mod password;
diff --git a/crates/storage/src/user/password.rs b/crates/storage/src/user/password.rs
index a4e01957f..fff0298e9 100644
--- a/crates/storage/src/user/password.rs
+++ b/crates/storage/src/user/password.rs
@@ -5,10 +5,10 @@
 // Please see LICENSE files in the repository root for full details.
 
 use async_trait::async_trait;
-use mas_data_model::{Password, User};
+use mas_data_model::{Clock, Password, User};
 use rand_core::RngCore;
 
-use crate::{Clock, repository_impl};
+use crate::repository_impl;
 
 /// A [`UserPasswordRepository`] helps interacting with [`Password`] saved in
 /// the storage backend
diff --git a/crates/storage/src/user/recovery.rs b/crates/storage/src/user/recovery.rs
index 81f17acc7..2bed10dfc 100644
--- a/crates/storage/src/user/recovery.rs
+++ b/crates/storage/src/user/recovery.rs
@@ -7,11 +7,11 @@
 use std::net::IpAddr;
 
 use async_trait::async_trait;
-use mas_data_model::{UserEmail, UserRecoverySession, UserRecoveryTicket};
+use mas_data_model::{Clock, UserEmail, UserRecoverySession, UserRecoveryTicket};
 use rand_core::RngCore;
 use ulid::Ulid;
 
-use crate::{Clock, repository_impl};
+use crate::repository_impl;
 
 /// A [`UserRecoveryRepository`] helps interacting with [`UserRecoverySession`]
 /// and [`UserRecoveryTicket`] saved in the storage backend
diff --git a/crates/storage/src/user/registration.rs b/crates/storage/src/user/registration.rs
index de7b6ef1b..0d32684d4 100644
--- a/crates/storage/src/user/registration.rs
+++ b/crates/storage/src/user/registration.rs
@@ -6,12 +6,12 @@
 use std::net::IpAddr;
 
 use async_trait::async_trait;
-use mas_data_model::{UserEmailAuthentication, UserRegistration, UserRegistrationToken};
+use mas_data_model::{Clock, UserEmailAuthentication, UserRegistration, UserRegistrationToken};
 use rand_core::RngCore;
 use ulid::Ulid;
 use url::Url;
 
-use crate::{Clock, repository_impl};
+use crate::repository_impl;
 
 /// A [`UserRegistrationRepository`] helps interacting with [`UserRegistration`]
 /// saved in the storage backend
diff --git a/crates/storage/src/user/registration_token.rs b/crates/storage/src/user/registration_token.rs
index ef37c7a84..1fb98550e 100644
--- a/crates/storage/src/user/registration_token.rs
+++ b/crates/storage/src/user/registration_token.rs
@@ -5,11 +5,11 @@
 
 use async_trait::async_trait;
 use chrono::{DateTime, Utc};
-use mas_data_model::UserRegistrationToken;
+use mas_data_model::{Clock, UserRegistrationToken};
 use rand_core::RngCore;
 use ulid::Ulid;
 
-use crate::{Clock, repository_impl};
+use crate::repository_impl;
 
 /// A filter to apply when listing [`UserRegistrationToken`]s
 #[derive(Debug, Clone, Copy)]
diff --git a/crates/storage/src/user/session.rs b/crates/storage/src/user/session.rs
index 23736bbfc..155556454 100644
--- a/crates/storage/src/user/session.rs
+++ b/crates/storage/src/user/session.rs
@@ -9,14 +9,13 @@ use std::net::IpAddr;
 use async_trait::async_trait;
 use chrono::{DateTime, Utc};
 use mas_data_model::{
-    Authentication, BrowserSession, Password, UpstreamOAuthAuthorizationSession, User,
+    Authentication, BrowserSession, Clock, Password, UpstreamOAuthAuthorizationSession, User,
 };
 use rand_core::RngCore;
 use ulid::Ulid;
 
 use crate::{
-    Clock, Pagination, pagination::Page, repository_impl,
-    upstream_oauth2::UpstreamOAuthSessionFilter,
+    Pagination, pagination::Page, repository_impl, upstream_oauth2::UpstreamOAuthSessionFilter,
 };
 
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
diff --git a/crates/storage/src/user/terms.rs b/crates/storage/src/user/terms.rs
index d24f9272b..155360973 100644
--- a/crates/storage/src/user/terms.rs
+++ b/crates/storage/src/user/terms.rs
@@ -5,11 +5,11 @@
 // Please see LICENSE files in the repository root for full details.
 
 use async_trait::async_trait;
-use mas_data_model::User;
+use mas_data_model::{Clock, User};
 use rand_core::RngCore;
 use url::Url;
 
-use crate::{Clock, repository_impl};
+use crate::repository_impl;
 
 /// A [`UserTermsRepository`] helps interacting with the terms of service agreed
 /// by a [`User`]
diff --git a/crates/storage/src/utils.rs b/crates/storage/src/utils.rs
index ad1aacbb7..a6f380fe7 100644
--- a/crates/storage/src/utils.rs
+++ b/crates/storage/src/utils.rs
@@ -6,10 +6,6 @@
 
 //! Wrappers and useful type aliases
 
-use rand_core::CryptoRngCore;
-
-use crate::Clock;
-
 /// A wrapper which is used to map the error type of a repository to another
 pub struct MapErr<R, F> {
     pub(crate) inner: R,
@@ -30,12 +26,6 @@ impl<R, F> MapErr<R, F> {
     }
 }
 
-/// A boxed [`Clock`]
-pub type BoxClock = Box<dyn Clock + Send>;
-
-/// A boxed random number generator
-pub type BoxRng = Box<dyn CryptoRngCore + Send>;
-
 /// A macro to implement a repository trait for the [`MapErr`] wrapper and for
 /// [`Box<R>`]
 #[macro_export]
diff --git a/crates/syn2mas/Cargo.toml b/crates/syn2mas/Cargo.toml
index 9dfee658b..ca278bee2 100644
--- a/crates/syn2mas/Cargo.toml
+++ b/crates/syn2mas/Cargo.toml
@@ -28,6 +28,7 @@ futures-util.workspace = true
 mas-config.workspace = true
 mas-iana.workspace = true
 mas-storage.workspace = true
+mas-data-model.workspace = true
 oauth2-types.workspace = true
 opentelemetry-semantic-conventions.workspace = true
 opentelemetry.workspace = true
diff --git a/crates/syn2mas/src/migration.rs b/crates/syn2mas/src/migration.rs
index 358470034..e32bfd6b9 100644
--- a/crates/syn2mas/src/migration.rs
+++ b/crates/syn2mas/src/migration.rs
@@ -16,7 +16,7 @@ use std::time::Instant;
 use chrono::{DateTime, Utc};
 use compact_str::CompactString;
 use futures_util::{SinkExt, StreamExt as _, TryFutureExt, TryStreamExt as _};
-use mas_storage::Clock;
+use mas_data_model::Clock;
 use rand::{RngCore, SeedableRng};
 use thiserror::Error;
 use thiserror_ext::ContextInto;
diff --git a/crates/tasks/src/lib.rs b/crates/tasks/src/lib.rs
index e2f539047..a480a8d50 100644
--- a/crates/tasks/src/lib.rs
+++ b/crates/tasks/src/lib.rs
@@ -6,11 +6,11 @@
 
 use std::sync::{Arc, LazyLock};
 
-use mas_data_model::SiteConfig;
+use mas_data_model::{Clock, SiteConfig};
 use mas_email::Mailer;
 use mas_matrix::HomeserverConnection;
 use mas_router::UrlBuilder;
-use mas_storage::{BoxRepository, Clock, RepositoryError, RepositoryFactory};
+use mas_storage::{BoxRepository, RepositoryError, RepositoryFactory};
 use mas_storage_pg::PgRepositoryFactory;
 use new_queue::QueueRunnerError;
 use opentelemetry::metrics::Meter;
diff --git a/crates/tasks/src/new_queue.rs b/crates/tasks/src/new_queue.rs
index 06f358f31..df0fb4cd7 100644
--- a/crates/tasks/src/new_queue.rs
+++ b/crates/tasks/src/new_queue.rs
@@ -9,8 +9,9 @@ use async_trait::async_trait;
 use chrono::{DateTime, Duration, Utc};
 use cron::Schedule;
 use mas_context::LogContext;
+use mas_data_model::Clock;
 use mas_storage::{
-    Clock, RepositoryAccess, RepositoryError,
+    RepositoryAccess, RepositoryError,
     queue::{InsertableJob, Job, JobMetadata, Worker},
 };
 use mas_storage_pg::{DatabaseError, PgRepository};