diff --git a/metropolis/node/core/BUILD.bazel b/metropolis/node/core/BUILD.bazel
index 004bbc8..b9d9d03 100644
--- a/metropolis/node/core/BUILD.bazel
+++ b/metropolis/node/core/BUILD.bazel
@@ -39,5 +39,5 @@
     name = "core",
     embed = [":go_default_library"],
     pure = "on",  # keep
-    visibility = ["//visibility:public"],
+    visibility = ["//metropolis/node:__pkg__"],
 )
diff --git a/metropolis/node/core/network/dhcp4c/BUILD.bazel b/metropolis/node/core/network/dhcp4c/BUILD.bazel
index c84bd05..5dc7b9e 100644
--- a/metropolis/node/core/network/dhcp4c/BUILD.bazel
+++ b/metropolis/node/core/network/dhcp4c/BUILD.bazel
@@ -8,7 +8,11 @@
         "lease.go",
     ],
     importpath = "git.monogon.dev/source/nexantic.git/metropolis/node/core/network/dhcp4c",
-    visibility = ["//visibility:public"],
+    visibility = [
+        "//metropolis/node:__subpackages__",
+        # Exception for this package: the DHCP client is also used by nanoswitch.
+        "//metropolis/test/nanoswitch:__subpackages__",
+    ],
     deps = [
         "//metropolis/node/core/network/dhcp4c/transport:go_default_library",
         "//metropolis/pkg/supervisor:go_default_library",
diff --git a/metropolis/node/core/network/dhcp4c/callback/BUILD.bazel b/metropolis/node/core/network/dhcp4c/callback/BUILD.bazel
index ed6f330..a752e52 100644
--- a/metropolis/node/core/network/dhcp4c/callback/BUILD.bazel
+++ b/metropolis/node/core/network/dhcp4c/callback/BUILD.bazel
@@ -5,7 +5,11 @@
     name = "go_default_library",
     srcs = ["callback.go"],
     importpath = "git.monogon.dev/source/nexantic.git/metropolis/node/core/network/dhcp4c/callback",
-    visibility = ["//visibility:public"],
+    visibility = [
+        "//metropolis/node:__subpackages__",
+        # Exception for this package: the DHCP client is also used by nanoswitch.
+        "//metropolis/test/nanoswitch:__subpackages__",
+    ],
     deps = [
         "//metropolis/node/core/network/dhcp4c:go_default_library",
         "@com_github_insomniacslk_dhcp//dhcpv4:go_default_library",
diff --git a/metropolis/node/core/network/dhcp4c/transport/BUILD.bazel b/metropolis/node/core/network/dhcp4c/transport/BUILD.bazel
index edd47a1..23adf2c 100644
--- a/metropolis/node/core/network/dhcp4c/transport/BUILD.bazel
+++ b/metropolis/node/core/network/dhcp4c/transport/BUILD.bazel
@@ -8,7 +8,7 @@
         "transport_unicast.go",
     ],
     importpath = "git.monogon.dev/source/nexantic.git/metropolis/node/core/network/dhcp4c/transport",
-    visibility = ["//visibility:public"],
+    visibility = ["//metropolis/node/core/network/dhcp4c:__subpackages__"],
     deps = [
         "@com_github_google_gopacket//:go_default_library",
         "@com_github_google_gopacket//layers:go_default_library",