diff --git a/client/internal/pqkem/callbacks.go b/client/internal/pqkem/callbacks.go
new file mode 100644
index 000000000..c1578f64a
--- /dev/null
+++ b/client/internal/pqkem/callbacks.go
@@ -0,0 +1,19 @@
+package pqkem
+
+// WGCallbackHandler is implemented by the host (the NetBird wiring layer) and
+// invoked by the library. The library only reports events; the host owns the
+// WireGuard reaction. Keeping this an interface — rather than calling wgctrl
+// directly — is what lets the KEM code be extracted as a standalone library.
+type WGCallbackHandler interface {
+	// OnNewPSKReady fires when a fresh post-quantum PSK has been derived for a
+	// peer and must be programmed on the WireGuard interface. It is invoked at the
+	// commit point of each side: the initiator on receiving the answer, the
+	// responder on receiving the confirm.
+	OnNewPSKReady(remoteWgKey string, psk PSK) error
+
+	// OnRekeyFailed fires when an exchange fails to converge within the allotted
+	// time. The host should tear the peer connection down so ICE re-establishes,
+	// and log a WARN. The library reports the event; it does not dictate the
+	// reaction.
+	OnRekeyFailed(remoteWgKey string) error
+}