diff --git a/deps/rabbit/app.bzl b/deps/rabbit/app.bzl
index 31770a1730d3..fb247074626f 100644
--- a/deps/rabbit/app.bzl
+++ b/deps/rabbit/app.bzl
@@ -527,7 +527,7 @@ def all_srcs(name = "all_srcs"):
             "include/amqqueue.hrl",
             "include/amqqueue_v2.hrl",
             "include/internal_user.hrl",
-            "include/khepri.hrl",
+            "include/rabbit_khepri.hrl",
             "include/mc.hrl",
             "include/rabbit_amqp.hrl",
             "include/rabbit_global_counters.hrl",
diff --git a/deps/rabbit/include/khepri.hrl b/deps/rabbit/include/khepri.hrl
deleted file mode 100644
index 31c5b03c9d02..000000000000
--- a/deps/rabbit/include/khepri.hrl
+++ /dev/null
@@ -1,9 +0,0 @@
-%% This Source Code Form is subject to the terms of the Mozilla Public
-%% License, v. 2.0. If a copy of the MPL was not distributed with this
-%% file, You can obtain one at https://mozilla.org/MPL/2.0/.
-%%
-%% Copyright (c) 2024 Broadcom. All Rights Reserved. The term “Broadcom”
-%% refers to Broadcom Inc. and/or its subsidiaries. All rights reserved.
-%%
-
--define(KHEPRI_ROOT_PATH, [rabbitmq]).
diff --git a/deps/rabbit/include/rabbit_khepri.hrl b/deps/rabbit/include/rabbit_khepri.hrl
new file mode 100644
index 000000000000..47a246d1fbd6
--- /dev/null
+++ b/deps/rabbit/include/rabbit_khepri.hrl
@@ -0,0 +1,64 @@
+%% This Source Code Form is subject to the terms of the Mozilla Public
+%% License, v. 2.0. If a copy of the MPL was not distributed with this
+%% file, You can obtain one at https://mozilla.org/MPL/2.0/.
+%%
+%% Copyright (c) 2024 Broadcom. All Rights Reserved. The term “Broadcom”
+%% refers to Broadcom Inc. and/or its subsidiaries. All rights reserved.
+%%
+
+%% This header has macros that define the `khepri_path:native_pattern()'
+%% path patterns used for each piece of metadata in the store. We use macros
+%% for these so that we can pattern match on these path patterns as well as
+%% create them as new terms.
+%%
+%% If you are creating a path pattern to use in a call to the Khepri API (for
+%% example `rabbit_khepri:get/1') you should prefer using the
+%% `khepri_<entity>_path' function from the `rabbit_db_<entity>' modules
+%% instead, for example `rabbit_db_queue:khepri_queue_path/2', since those
+%% functions have guards to assert that the variables passed are valid pattern
+%% components.
+
+-define(RABBITMQ_KHEPRI_ROOT_PATH, ?RABBITMQ_KHEPRI_ROOT_PATH([])).
+-define(RABBITMQ_KHEPRI_ROOT_PATH(Rest), [rabbitmq | Rest]).
+
+-define(RABBITMQ_KHEPRI_MAINTENANCE_PATH(Node),
+        ?RABBITMQ_KHEPRI_ROOT_PATH([node_maintenance, Node])).
+
+-define(RABBITMQ_KHEPRI_GLOBAL_RUNTIME_PARAM_PATH(Key),
+        ?RABBITMQ_KHEPRI_ROOT_PATH([runtime_params, Key])).
+
+-define(RABBITMQ_KHEPRI_USER_PATH(Username),
+        ?RABBITMQ_KHEPRI_ROOT_PATH([users, Username])).
+
+-define(RABBITMQ_KHEPRI_MIRRORED_SUPERVISOR_PATH(Group, Id),
+        ?RABBITMQ_KHEPRI_ROOT_PATH([mirrored_supervisors, Group, Id])).
+
+-define(RABBITMQ_KHEPRI_VHOST_PATH(Name),
+        ?RABBITMQ_KHEPRI_VHOST_PATH(Name, [])).
+-define(RABBITMQ_KHEPRI_VHOST_PATH(Name, Rest),
+        ?RABBITMQ_KHEPRI_ROOT_PATH([vhosts, Name | Rest])).
+
+-define(RABBITMQ_KHEPRI_VHOST_RUNTIME_PARAM_PATH(VHost, Component, Name),
+        ?RABBITMQ_KHEPRI_VHOST_PATH(VHost, [runtime_params, Component, Name])).
+
+-define(RABBITMQ_KHEPRI_USER_PERMISSION_PATH(VHost, Username),
+        ?RABBITMQ_KHEPRI_VHOST_PATH(VHost, [user_permissions, Username])).
+
+-define(RABBITMQ_KHEPRI_EXCHANGE_PATH(VHost, Name),
+        ?RABBITMQ_KHEPRI_EXCHANGE_PATH(VHost, Name, [])).
+-define(RABBITMQ_KHEPRI_EXCHANGE_PATH(VHost, Name, Rest),
+        ?RABBITMQ_KHEPRI_VHOST_PATH(VHost, [exchanges, Name | Rest])).
+
+-define(RABBITMQ_KHEPRI_EXCHANGE_SERIAL_PATH(VHost, Name),
+        ?RABBITMQ_KHEPRI_EXCHANGE_PATH(VHost, Name, [serial])).
+
+-define(RABBITMQ_KHEPRI_TOPIC_PERMISSION_PATH(VHost, Exchange, Username),
+        ?RABBITMQ_KHEPRI_EXCHANGE_PATH(
+          VHost, Exchange, [user_permissions, Username])).
+
+-define(RABBITMQ_KHEPRI_ROUTE_PATH(VHost, SrcName, Kind, DstName, RoutingKey),
+        ?RABBITMQ_KHEPRI_EXCHANGE_PATH(
+          VHost, SrcName, [bindings, Kind, DstName, RoutingKey])).
+
+-define(RABBITMQ_KHEPRI_QUEUE_PATH(VHost, Name),
+        ?RABBITMQ_KHEPRI_VHOST_PATH(VHost, [queues, Name])).
diff --git a/deps/rabbit/src/rabbit_db_binding.erl b/deps/rabbit/src/rabbit_db_binding.erl
index 942b3a648110..37bc82ba246c 100644
--- a/deps/rabbit/src/rabbit_db_binding.erl
+++ b/deps/rabbit/src/rabbit_db_binding.erl
@@ -10,6 +10,8 @@
 -include_lib("khepri/include/khepri.hrl").
 -include_lib("rabbit_common/include/rabbit.hrl").
 
+-include("include/rabbit_khepri.hrl").
+
 -export([exists/1,
          create/2,
          delete/2,
@@ -1014,8 +1016,7 @@ khepri_route_path(VHost, SrcName, Kind, DstName, RoutingKey)
   when ?IS_KHEPRI_PATH_CONDITION(Kind) andalso
        ?IS_KHEPRI_PATH_CONDITION(DstName) andalso
        ?IS_KHEPRI_PATH_CONDITION(RoutingKey) ->
-    ExchangePath = rabbit_db_exchange:khepri_exchange_path(VHost, SrcName),
-    ExchangePath ++ [bindings, Kind, DstName, RoutingKey].
+    ?RABBITMQ_KHEPRI_ROUTE_PATH(VHost, SrcName, Kind, DstName, RoutingKey).
 
 khepri_route_path_to_args(Path) ->
     Pattern = khepri_route_path(
diff --git a/deps/rabbit/src/rabbit_db_exchange.erl b/deps/rabbit/src/rabbit_db_exchange.erl
index f8c37a22428f..5d434563f7e3 100644
--- a/deps/rabbit/src/rabbit_db_exchange.erl
+++ b/deps/rabbit/src/rabbit_db_exchange.erl
@@ -10,7 +10,7 @@
 -include_lib("khepri/include/khepri.hrl").
 -include_lib("rabbit_common/include/rabbit.hrl").
 
--include("include/khepri.hrl").
+-include("include/rabbit_khepri.hrl").
 
 -export([
          get_all/0,
@@ -960,11 +960,15 @@ maybe_auto_delete_in_khepri(XName, OnlyDurable) ->
 khepri_exchange_path(#resource{virtual_host = VHost, name = Name}) ->
     khepri_exchange_path(VHost, Name).
 
-khepri_exchange_path(VHost, Name) when ?IS_KHEPRI_PATH_CONDITION(Name) ->
-    rabbit_db_vhost:khepri_vhost_path(VHost) ++ [exchanges, Name].
+khepri_exchange_path(VHost, Name)
+  when ?IS_KHEPRI_PATH_CONDITION(VHost) andalso
+       ?IS_KHEPRI_PATH_CONDITION(Name) ->
+    ?RABBITMQ_KHEPRI_EXCHANGE_PATH(VHost, Name).
 
-khepri_exchange_serial_path(#resource{} = Resource) ->
-    khepri_exchange_path(Resource) ++ [serial].
+khepri_exchange_serial_path(#resource{virtual_host = VHost, name = Name}) ->
+    khepri_exchange_serial_path(VHost, Name).
 
-khepri_exchange_serial_path(VHost, Name) ->
-    khepri_exchange_path(VHost, Name) ++ [serial].
+khepri_exchange_serial_path(VHost, Name)
+  when ?IS_KHEPRI_PATH_CONDITION(VHost) andalso
+       ?IS_KHEPRI_PATH_CONDITION(Name) ->
+    ?RABBITMQ_KHEPRI_EXCHANGE_SERIAL_PATH(VHost, Name).
diff --git a/deps/rabbit/src/rabbit_db_maintenance.erl b/deps/rabbit/src/rabbit_db_maintenance.erl
index de7162ee70ae..c295c08fcb13 100644
--- a/deps/rabbit/src/rabbit_db_maintenance.erl
+++ b/deps/rabbit/src/rabbit_db_maintenance.erl
@@ -10,7 +10,7 @@
 -include_lib("khepri/include/khepri.hrl").
 -include_lib("rabbit_common/include/rabbit.hrl").
 
--include("include/khepri.hrl").
+-include("include/rabbit_khepri.hrl").
 
 -export([
          table_definitions/0,
@@ -170,4 +170,4 @@ get_consistent_in_khepri(Node) ->
 %% -------------------------------------------------------------------
 
 khepri_maintenance_path(Node) when ?IS_KHEPRI_PATH_CONDITION(Node) ->
-    ?KHEPRI_ROOT_PATH ++ [node_maintenance, Node].
+    ?RABBITMQ_KHEPRI_MAINTENANCE_PATH(Node).
diff --git a/deps/rabbit/src/rabbit_db_msup.erl b/deps/rabbit/src/rabbit_db_msup.erl
index 152cb71f9acb..a4bbb68d7e40 100644
--- a/deps/rabbit/src/rabbit_db_msup.erl
+++ b/deps/rabbit/src/rabbit_db_msup.erl
@@ -10,7 +10,7 @@
 -include_lib("khepri/include/khepri.hrl").
 -include("mirrored_supervisor.hrl").
 
--include("include/khepri.hrl").
+-include("include/rabbit_khepri.hrl").
 
 -export([
          create_tables/0,
@@ -328,8 +328,8 @@ clear_in_khepri() ->
 khepri_mirrored_supervisor_path(Group, Id)
   when ?IS_KHEPRI_PATH_CONDITION(Group) andalso
        ?IS_KHEPRI_PATH_CONDITION(Id) ->
-    ?KHEPRI_ROOT_PATH ++ [mirrored_supervisors, Group, Id];
+    ?RABBITMQ_KHEPRI_MIRRORED_SUPERVISOR_PATH(Group, Id);
 khepri_mirrored_supervisor_path(Group, Id)
   when is_atom(Group) ->
     IdPath = Group:id_to_khepri_path(Id),
-    ?KHEPRI_ROOT_PATH ++ [mirrored_supervisors, Group] ++ IdPath.
+    ?RABBITMQ_KHEPRI_ROOT_PATH ++ [mirrored_supervisors, Group] ++ IdPath.
diff --git a/deps/rabbit/src/rabbit_db_queue.erl b/deps/rabbit/src/rabbit_db_queue.erl
index 1e64a7f78c08..542410fab2f3 100644
--- a/deps/rabbit/src/rabbit_db_queue.erl
+++ b/deps/rabbit/src/rabbit_db_queue.erl
@@ -13,6 +13,8 @@
 -include_lib("rabbit_common/include/rabbit.hrl").
 -include("amqqueue.hrl").
 
+-include("include/rabbit_khepri.hrl").
+
 -export([
          get/1,
          get_many/1,
@@ -1394,5 +1396,7 @@ list_with_possible_retry_in_khepri(Fun) ->
 khepri_queue_path(#resource{virtual_host = VHost, name = Name}) ->
     khepri_queue_path(VHost, Name).
 
-khepri_queue_path(VHost, Name) when ?IS_KHEPRI_PATH_CONDITION(Name) ->
-    rabbit_db_vhost:khepri_vhost_path(VHost) ++ [queues, Name].
+khepri_queue_path(VHost, Name)
+  when ?IS_KHEPRI_PATH_CONDITION(VHost) andalso
+       ?IS_KHEPRI_PATH_CONDITION(Name) ->
+    ?RABBITMQ_KHEPRI_QUEUE_PATH(VHost, Name).
diff --git a/deps/rabbit/src/rabbit_db_rtparams.erl b/deps/rabbit/src/rabbit_db_rtparams.erl
index f57642ee953b..74e9a6a1f3dc 100644
--- a/deps/rabbit/src/rabbit_db_rtparams.erl
+++ b/deps/rabbit/src/rabbit_db_rtparams.erl
@@ -10,7 +10,7 @@
 -include_lib("khepri/include/khepri.hrl").
 -include_lib("rabbit_common/include/rabbit.hrl").
 
--include("include/khepri.hrl").
+-include("include/rabbit_khepri.hrl").
 
 -export([set/2, set/4,
          get/1,
@@ -364,10 +364,9 @@ khepri_rp_path(Key) ->
     khepri_global_rp_path(Key).
 
 khepri_global_rp_path(Key) when ?IS_KHEPRI_PATH_CONDITION(Key) ->
-    ?KHEPRI_ROOT_PATH ++ [runtime_params, Key].
+    ?RABBITMQ_KHEPRI_GLOBAL_RUNTIME_PARAM_PATH(Key).
 
 khepri_vhost_rp_path(VHost, Component, Name)
   when ?IS_KHEPRI_PATH_CONDITION(Component) andalso
        ?IS_KHEPRI_PATH_CONDITION(Name) ->
-    VHostPath = rabbit_db_vhost:khepri_vhost_path(VHost),
-    VHostPath ++ [runtime_params, Component, Name].
+    ?RABBITMQ_KHEPRI_VHOST_RUNTIME_PARAM_PATH(VHost, Component, Name).
diff --git a/deps/rabbit/src/rabbit_db_user.erl b/deps/rabbit/src/rabbit_db_user.erl
index e1589db3d082..3dfdbf8716b2 100644
--- a/deps/rabbit/src/rabbit_db_user.erl
+++ b/deps/rabbit/src/rabbit_db_user.erl
@@ -12,7 +12,7 @@
 -include_lib("khepri/include/khepri.hrl").
 -include_lib("rabbit_common/include/rabbit.hrl").
 
--include("include/khepri.hrl").
+-include("include/rabbit_khepri.hrl").
 
 -export([create/1,
          update/2,
@@ -1094,14 +1094,15 @@ clear_in_khepri() ->
 
 khepri_user_path(Username)
   when ?IS_KHEPRI_PATH_CONDITION(Username) ->
-    ?KHEPRI_ROOT_PATH ++ [users, Username].
+    ?RABBITMQ_KHEPRI_USER_PATH(Username).
 
 khepri_user_permission_path(Username, VHostName)
-  when ?IS_KHEPRI_PATH_CONDITION(Username) ->
-    (rabbit_db_vhost:khepri_vhost_path(VHostName) ++
-     [user_permissions, Username]).
+  when ?IS_KHEPRI_PATH_CONDITION(Username) andalso
+       ?IS_KHEPRI_PATH_CONDITION(VHostName) ->
+    ?RABBITMQ_KHEPRI_USER_PERMISSION_PATH(VHostName, Username).
 
 khepri_topic_permission_path(Username, VHostName, Exchange)
-  when ?IS_KHEPRI_PATH_CONDITION(Username) ->
-    (rabbit_db_exchange:khepri_exchange_path(VHostName, Exchange) ++
-     [user_permissions, Username]).
+  when ?IS_KHEPRI_PATH_CONDITION(Username) andalso
+       ?IS_KHEPRI_PATH_CONDITION(VHostName) andalso
+       ?IS_KHEPRI_PATH_CONDITION(Exchange) ->
+    ?RABBITMQ_KHEPRI_TOPIC_PERMISSION_PATH(VHostName, Exchange, Username).
diff --git a/deps/rabbit/src/rabbit_db_vhost.erl b/deps/rabbit/src/rabbit_db_vhost.erl
index 42453faea251..a4a0b32dc533 100644
--- a/deps/rabbit/src/rabbit_db_vhost.erl
+++ b/deps/rabbit/src/rabbit_db_vhost.erl
@@ -11,7 +11,7 @@
 -include_lib("rabbit_common/include/logging.hrl").
 -include_lib("khepri/include/khepri.hrl").
 
--include("include/khepri.hrl").
+-include("include/rabbit_khepri.hrl").
 -include("vhost.hrl").
 
 -export([create_or_get/3,
@@ -533,4 +533,4 @@ clear_in_khepri() ->
 %% --------------------------------------------------------------
 
 khepri_vhost_path(VHost) when ?IS_KHEPRI_PATH_CONDITION(VHost) ->
-    ?KHEPRI_ROOT_PATH ++ [vhosts, VHost].
+    ?RABBITMQ_KHEPRI_VHOST_PATH(VHost).
diff --git a/deps/rabbit/src/rabbit_khepri.erl b/deps/rabbit/src/rabbit_khepri.erl
index 1b80ae4ebf80..506c2c9a7b69 100644
--- a/deps/rabbit/src/rabbit_khepri.erl
+++ b/deps/rabbit/src/rabbit_khepri.erl
@@ -96,7 +96,7 @@
 -include_lib("rabbit_common/include/logging.hrl").
 -include_lib("rabbit_common/include/rabbit.hrl").
 
--include("include/khepri.hrl").
+-include("include/rabbit_khepri.hrl").
 
 -export([setup/0,
          setup/1,
@@ -946,7 +946,7 @@ cluster_status_from_khepri() ->
 %% This path must be prepended to all paths used by RabbitMQ subsystems.
 
 root_path() ->
-    ?KHEPRI_ROOT_PATH.
+    ?RABBITMQ_KHEPRI_ROOT_PATH.
 
 %% -------------------------------------------------------------------
 %% "Proxy" functions to Khepri API.