diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
index 06797f44d7..4ef23f99d3 100644
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -112,3 +112,6 @@ jobs:
       # does not work in other subdirectories for now
       - run: cargo fmt --check
         working-directory: rust/htp
+      # The ffi crate is cargo fmt clean.
+      - run: cargo fmt --check
+        working-directory: rust/ffi
diff --git a/configure.ac b/configure.ac
index 0c8376358e..f3909ed610 100644
--- a/configure.ac
+++ b/configure.ac
@@ -2558,6 +2558,7 @@ AM_CONDITIONAL([BUILD_SHARED_LIBRARY], [test "x$enable_shared" = "xyes"] && [tes
 
 AC_CONFIG_FILES(Makefile src/Makefile rust/Makefile rust/Cargo.lock rust/Cargo.toml rust/derive/Cargo.toml rust/.cargo/config.toml)
 AC_CONFIG_FILES(rust/sys/Makefile rust/sys/Cargo.toml)
+AC_CONFIG_FILES(rust/ffi/Makefile rust/ffi/Cargo.toml)
 AC_CONFIG_FILES(rust/suricatactl/Makefile rust/suricatactl/Cargo.toml)
 AC_CONFIG_FILES(rust/suricatasc/Makefile rust/suricatasc/Cargo.toml)
 AC_CONFIG_FILES(rust/htp/Makefile rust/htp/Cargo.toml)
diff --git a/rust/Cargo.lock.in b/rust/Cargo.lock.in
index d47cdd197b..283c1aaeae 100644
--- a/rust/Cargo.lock.in
+++ b/rust/Cargo.lock.in
@@ -1603,6 +1603,10 @@ dependencies = [
  "syn 1.0.109",
 ]
 
+[[package]]
+name = "suricata-ffi"
+version = "9.0.0-dev"
+
 [[package]]
 name = "suricata-htp"
 version = "9.0.0-dev"
diff --git a/rust/Cargo.toml.in b/rust/Cargo.toml.in
index 22e1660621..94ddfaa939 100644
--- a/rust/Cargo.toml.in
+++ b/rust/Cargo.toml.in
@@ -13,6 +13,7 @@ members = [
     "suricatactl",
     "suricatasc",
     "sys",
+    "ffi",
     "htp",
 ]
 
diff --git a/rust/Makefile.am b/rust/Makefile.am
index dce38d127e..9d70c6e0db 100644
--- a/rust/Makefile.am
+++ b/rust/Makefile.am
@@ -1,4 +1,5 @@
-SUBDIRS =	htp \
+SUBDIRS =	ffi \
+		htp \
 		sys \
 		suricatasc \
 		suricatactl
@@ -11,6 +12,7 @@ EXTRA_DIST =	.cargo/config.toml.in \
 		derive/Cargo.toml \
 		dist/htp/htp_rs.h \
 		dist/rust-bindings.h \
+		ffi \
 		htp \
 		src \
 		suricatactl \
diff --git a/rust/ffi/Cargo.toml.in b/rust/ffi/Cargo.toml.in
new file mode 100644
index 0000000000..a9d66d3282
--- /dev/null
+++ b/rust/ffi/Cargo.toml.in
@@ -0,0 +1,6 @@
+[package]
+name = "suricata-ffi"
+version = "@PACKAGE_VERSION@"
+edition = "2021"
+license = "GPL-2.0-only"
+description = "Nice wrappers around Suricata C interface"
diff --git a/rust/ffi/Makefile.am b/rust/ffi/Makefile.am
new file mode 100644
index 0000000000..acf00aeb68
--- /dev/null
+++ b/rust/ffi/Makefile.am
@@ -0,0 +1,3 @@
+EXTRA_DIST =	Cargo.toml
+
+all-local: Cargo.toml
diff --git a/rust/ffi/src/lib.rs b/rust/ffi/src/lib.rs
new file mode 100644
index 0000000000..fb5ac17780
--- /dev/null
+++ b/rust/ffi/src/lib.rs
@@ -0,0 +1,16 @@
+/* Copyright (C) 2026 Open Information Security Foundation
+ *
+ * You can copy, redistribute or modify this Program under the terms of
+ * the GNU General Public License version 2 as published by the Free
+ * Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * version 2 along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ */