diff --git a/core/CHANGELOG.md b/core/CHANGELOG.md
index ea2d14a3..44be3acd 100644
--- a/core/CHANGELOG.md
+++ b/core/CHANGELOG.md
@@ -23,10 +23,15 @@
 - Add `global_only::Transport` that refuses to dial IP addresses from private ranges.
   See [PR 3814].
 
+- Remove `upgrade::{apply, apply_inbound, apply_outbound, InboundUpgradeApply, OutboundUpgradeApply}` from public API.
+  These are implementation details that should not be depended on.
+  See [PR 3915].
+
 [spec]: https://github.com/libp2p/specs/blob/master/connections/README.md#multistream-select
 [PR 3746]: https://github.com/libp2p/rust-libp2p/pull/3746
 [PR 3883]: https://github.com/libp2p/rust-libp2p/pull/3883
 [PR 3814]: https://github.com/libp2p/rust-libp2p/pull/3814
+[PR 3915]: https://github.com/libp2p/rust-libp2p/pull/3915
 
 ## 0.39.2
 
diff --git a/core/src/upgrade.rs b/core/src/upgrade.rs
index 3d0b752f..8219ac03 100644
--- a/core/src/upgrade.rs
+++ b/core/src/upgrade.rs
@@ -66,10 +66,12 @@ mod ready;
 mod select;
 mod transfer;
 
+pub(crate) use apply::{
+    apply, apply_inbound, apply_outbound, InboundUpgradeApply, OutboundUpgradeApply,
+};
 use futures::future::Future;
 
 pub use self::{
-    apply::{apply, apply_inbound, apply_outbound, InboundUpgradeApply, OutboundUpgradeApply},
     denied::DeniedUpgrade,
     error::UpgradeError,
     pending::PendingUpgrade,
diff --git a/core/src/upgrade/apply.rs b/core/src/upgrade/apply.rs
index 1dca0be4..50aa8e2c 100644
--- a/core/src/upgrade/apply.rs
+++ b/core/src/upgrade/apply.rs
@@ -29,7 +29,7 @@ pub(crate) use multistream_select::Version;
 
 // TODO: Still needed?
 /// Applies an upgrade to the inbound and outbound direction of a connection or substream.
-pub fn apply<C, U>(
+pub(crate) fn apply<C, U>(
     conn: C,
     up: U,
     cp: ConnectedPoint,
@@ -48,7 +48,7 @@ where
 }
 
 /// Tries to perform an upgrade on an inbound connection or substream.
-pub fn apply_inbound<C, U>(conn: C, up: U) -> InboundUpgradeApply<C, U>
+pub(crate) fn apply_inbound<C, U>(conn: C, up: U) -> InboundUpgradeApply<C, U>
 where
     C: AsyncRead + AsyncWrite + Unpin,
     U: InboundUpgrade<Negotiated<C>>,
@@ -62,7 +62,7 @@ where
 }
 
 /// Tries to perform an upgrade on an outbound connection or substream.
-pub fn apply_outbound<C, U>(conn: C, up: U, v: Version) -> OutboundUpgradeApply<C, U>
+pub(crate) fn apply_outbound<C, U>(conn: C, up: U, v: Version) -> OutboundUpgradeApply<C, U>
 where
     C: AsyncRead + AsyncWrite + Unpin,
     U: OutboundUpgrade<Negotiated<C>>,