diff --git a/composer.json b/composer.json
index 9f748608..3bbc1211 100755
--- a/composer.json
+++ b/composer.json
@@ -33,7 +33,6 @@
         "symfony/mime": "~6.4",
         "symfony/process": "~6.4",
         "symfony/routing": "~6.4",
-        "symfony/security-core": "~6.4",
         "symfony/translation": "~6.4",
         "voku/portable-ascii": "2.0.3"
     },
diff --git a/src/Illuminate/Contracts/Encryption/StringEncrypter.php b/src/Illuminate/Contracts/Encryption/StringEncrypter.php
new file mode 100644
index 00000000..399d653f
--- /dev/null
+++ b/src/Illuminate/Contracts/Encryption/StringEncrypter.php
@@ -0,0 +1,26 @@
+<?php
+
+namespace Illuminate\Contracts\Encryption;
+
+interface StringEncrypter
+{
+    /**
+     * Encrypt a string without serialization.
+     *
+     * @param  string  $value
+     * @return string
+     *
+     * @throws \Illuminate\Contracts\Encryption\EncryptException
+     */
+    public function encryptString(#[\SensitiveParameter] $value);
+
+    /**
+     * Decrypt the given string without unserialization.
+     *
+     * @param  string  $payload
+     * @return string
+     *
+     * @throws \Illuminate\Contracts\Encryption\DecryptException
+     */
+    public function decryptString($payload);
+}
diff --git a/src/Illuminate/Cookie/Guard.php b/src/Illuminate/Cookie/Guard.php
index efe1fde8..62ddc940 100644
--- a/src/Illuminate/Cookie/Guard.php
+++ b/src/Illuminate/Cookie/Guard.php
@@ -1,7 +1,7 @@
 <?php namespace Illuminate\Cookie;
 
 use Illuminate\Encryption\Encrypter;
-use Illuminate\Encryption\DecryptException;
+use Illuminate\Contracts\Encryption\DecryptException;
 use Symfony\Component\HttpFoundation\Cookie;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
diff --git a/src/Illuminate/Encryption/DecryptException.php b/src/Illuminate/Encryption/DecryptException.php
index b2e4302f..cc1bb109 100644
--- a/src/Illuminate/Encryption/DecryptException.php
+++ b/src/Illuminate/Encryption/DecryptException.php
@@ -1,3 +1,7 @@
 <?php namespace Illuminate\Encryption;
 
-class DecryptException extends \RuntimeException {}
+// @deprecated Canonical location is Illuminate\Contracts\Encryption\DecryptException (L13).
+// Runtime alias keeps existing catch sites working until the illuminate/encryption swap;
+// class_alias makes the two names identical so `catch (Illuminate\Encryption\DecryptException)`
+// still catches the thrown contract exception. App repoint is grep-driven (Psalm-blind to alias).
+class_alias(\Illuminate\Contracts\Encryption\DecryptException::class, __NAMESPACE__.'\\DecryptException');
diff --git a/src/Illuminate/Encryption/Encrypter.php b/src/Illuminate/Encryption/Encrypter.php
index 1ff2124a..60c48289 100755
--- a/src/Illuminate/Encryption/Encrypter.php
+++ b/src/Illuminate/Encryption/Encrypter.php
@@ -1,9 +1,11 @@
 <?php namespace Illuminate\Encryption;
 
-use Symfony\Component\Security\Core\Util\StringUtils;
-use Symfony\Component\Security\Core\Util\SecureRandom;
+use Illuminate\Contracts\Encryption\DecryptException;
+use Illuminate\Contracts\Encryption\EncryptException;
+use Illuminate\Contracts\Encryption\Encrypter as EncrypterContract;
+use Illuminate\Contracts\Encryption\StringEncrypter;
 
-class Encrypter {
+class Encrypter implements EncrypterContract, StringEncrypter {
 
 	/**
 	 * The encryption key.
@@ -71,7 +73,7 @@ public function encrypt($value, $serialize = true): string
         );
 
         if ($value === false) {
-            throw new \RuntimeException('Could not encrypt the data.');
+            throw new EncryptException('Could not encrypt the data.');
         }
 
         // Once we have the encrypted value we will go ahead base64_encode the input
@@ -82,7 +84,7 @@ public function encrypt($value, $serialize = true): string
         $json = json_encode(compact('iv', 'value', 'mac'));
 
         if (! \is_string($json)) {
-            throw new \RuntimeException('Could not encrypt the data.');
+            throw new EncryptException('Could not encrypt the data.');
         }
 
         return base64_encode($json);
@@ -219,6 +221,28 @@ public function getKey(): string
         return $this->key;
     }
 
+    /**
+     * Get the current encryption key and all previous encryption keys.
+     *
+     * @return array
+     */
+    // ponytail: single-key fork; key rotation (previous_keys) arrives with the
+    // illuminate/encryption v13 swap. Contract still satisfied for consumers now.
+    public function getAllKeys(): array
+    {
+        return [$this->key];
+    }
+
+    /**
+     * Get the previous encryption keys.
+     *
+     * @return array
+     */
+    public function getPreviousKeys(): array
+    {
+        return [];
+    }
+
     /**
      * Calculate the hash of the given payload.
      *
@@ -233,15 +257,4 @@ protected function calculateMac($payload, $bytes): string
         );
     }
 
-	/**
-	 * Set the encryption key.
-	 *
-	 * @param  string  $key
-	 * @return void
-	 */
-	public function setKey($key)
-	{
-		$this->key = (string) $key;
-	}
-
 }
diff --git a/src/Illuminate/Filesystem/FileNotFoundException.php b/src/Illuminate/Filesystem/FileNotFoundException.php
index f6ee5dc7..8144e77d 100644
--- a/src/Illuminate/Filesystem/FileNotFoundException.php
+++ b/src/Illuminate/Filesystem/FileNotFoundException.php
@@ -1,3 +1,7 @@
 <?php namespace Illuminate\Filesystem;
 
-class FileNotFoundException extends \Exception {}
+// @deprecated Canonical location is Illuminate\Contracts\Filesystem\FileNotFoundException (L13).
+// Runtime alias keeps existing catch sites working until the illuminate/filesystem swap;
+// class_alias makes the two names identical so `catch (Illuminate\Filesystem\FileNotFoundException)`
+// still catches the thrown contract exception. App repoint is grep-driven (Psalm-blind to alias).
+class_alias(\Illuminate\Contracts\Filesystem\FileNotFoundException::class, __NAMESPACE__.'\\FileNotFoundException');
diff --git a/src/Illuminate/Filesystem/Filesystem.php b/src/Illuminate/Filesystem/Filesystem.php
index 2cb2abf0..b35ed14e 100755
--- a/src/Illuminate/Filesystem/Filesystem.php
+++ b/src/Illuminate/Filesystem/Filesystem.php
@@ -4,6 +4,7 @@
 use Symfony\Component\Finder\Finder;
 use Illuminate\Support\Traits\Macroable;
 use Illuminate\Support\Traits\Conditionable;
+use Illuminate\Contracts\Filesystem\FileNotFoundException;
 
 class Filesystem {
 
diff --git a/src/Illuminate/Foundation/Application.php b/src/Illuminate/Foundation/Application.php
index 8be71722..a6c40860 100755
--- a/src/Illuminate/Foundation/Application.php
+++ b/src/Illuminate/Foundation/Application.php
@@ -1158,6 +1158,10 @@ public function registerCoreContainerAliases()
 
 		// BC: Log\Writer renamed to Log\Logger (task 3.5); keep old name resolvable.
 		$this->alias('log', 'Illuminate\Log\Writer');
+
+		// Encrypter now implements the L13 contracts (task 2.9); resolve them to 'encrypter'.
+		$this->alias('encrypter', 'Illuminate\Contracts\Encryption\Encrypter');
+		$this->alias('encrypter', 'Illuminate\Contracts\Encryption\StringEncrypter');
 	}
 
 }
diff --git a/tests/Encryption/EncrypterTest.php b/tests/Encryption/EncrypterTest.php
index 8edffc06..03c72948 100755
--- a/tests/Encryption/EncrypterTest.php
+++ b/tests/Encryption/EncrypterTest.php
@@ -25,7 +25,7 @@ public function testEncryptionWithCustomCipher()
 
     public function testExceptionThrownWhenPayloadIsInvalid()
     {
-        $this->expectException(Illuminate\Encryption\DecryptException::class);
+        $this->expectException(Illuminate\Contracts\Encryption\DecryptException::class);
         $this->expectExceptionMessage("The payload is invalid.");
         $e = $this->getEncrypter();
         $payload = $e->encrypt('foo');