diff --git a/metropolis/node/build/genosrelease/BUILD.bazel b/metropolis/node/build/genosrelease/BUILD.bazel
index 9403d72..c5b7759 100644
--- a/metropolis/node/build/genosrelease/BUILD.bazel
+++ b/metropolis/node/build/genosrelease/BUILD.bazel
@@ -11,5 +11,5 @@
 go_binary(
     name = "genosrelease",
     embed = [":go_default_library"],
-    visibility = ["//visibility:public"],
+    visibility = ["//metropolis/node:__pkg__"],
 )
diff --git a/metropolis/node/build/kconfig-patcher/BUILD.bazel b/metropolis/node/build/kconfig-patcher/BUILD.bazel
index 55b2b52..3ce0f74 100644
--- a/metropolis/node/build/kconfig-patcher/BUILD.bazel
+++ b/metropolis/node/build/kconfig-patcher/BUILD.bazel
@@ -10,7 +10,10 @@
 go_binary(
     name = "kconfig-patcher",
     embed = [":go_default_library"],
-    visibility = ["//visibility:public"],
+    visibility = [
+        "//metropolis/node:__pkg__",
+        "//metropolis/test/ktest:__pkg__",
+    ],
 )
 
 go_test(
diff --git a/metropolis/node/build/mkimage/BUILD.bazel b/metropolis/node/build/mkimage/BUILD.bazel
index b489002..2b59adf 100644
--- a/metropolis/node/build/mkimage/BUILD.bazel
+++ b/metropolis/node/build/mkimage/BUILD.bazel
@@ -16,5 +16,5 @@
 go_binary(
     name = "mkimage",
     embed = [":go_default_library"],
-    visibility = ["//visibility:public"],
+    visibility = ["//metropolis/node:__pkg__"],
 )