diff --git a/metropolis/node/BUILD.bazel b/metropolis/node/BUILD.bazel
index b730deb..06ade3c 100644
--- a/metropolis/node/BUILD.bazel
+++ b/metropolis/node/BUILD.bazel
@@ -5,7 +5,7 @@
     name = "go_default_library",
     srcs = ["ports.go"],
     importpath = "git.monogon.dev/source/nexantic.git/metropolis/node",
-    visibility = ["//visibility:public"],
+    visibility = ["//metropolis:__subpackages__"],
 )
 
 # debug_build checks if we're building in debug mode and enables various debug features for the image. Currently this
@@ -88,7 +88,10 @@
     tools = [
         "//metropolis/node/build/mkimage",
     ],
-    visibility = ["//visibility:public"],
+    visibility = [
+        "//metropolis/test/launch:__subpackages__",
+        "//metropolis/test/e2e:__subpackages__",
+    ],
 )
 
 genrule(
@@ -128,7 +131,10 @@
     cp tpm/ca/issuercert.pem $(location tpm/issuercert.pem)
     cp tpm/ca/signkey.pem $(location tpm/signkey.pem)
     """,
-    visibility = ["//visibility:public"],
+    visibility = [
+        "//metropolis/test/launch:__subpackages__",
+        "//metropolis/test/e2e:__subpackages__",
+    ],
 )
 
 load("//metropolis/node/build/genosrelease:defs.bzl", "os_release")