diff --git a/BUILD b/BUILD
index e8d6f87d3f92c..0f77cbba9e19a 100644
--- a/BUILD
+++ b/BUILD
@@ -46,3 +46,10 @@ package_group(
         "//contrib/...",
     ],
 )
+
+package_group(
+    name = "examples_library",
+    packages = [
+        "//examples/...",
+    ],
+)
diff --git a/source/extensions/access_loggers/filters/cel/BUILD b/source/extensions/access_loggers/filters/cel/BUILD
index 4e53f30780d7a..6dc970abdcc31 100644
--- a/source/extensions/access_loggers/filters/cel/BUILD
+++ b/source/extensions/access_loggers/filters/cel/BUILD
@@ -12,9 +12,6 @@ envoy_cc_extension(
     name = "cel_lib",
     srcs = ["cel.cc"],
     hdrs = ["cel.h"],
-    extra_visibility = [
-        "//test:__subpackages__",
-    ],
     deps = [
         "//envoy/access_log:access_log_interface",
         "//envoy/http:header_map_interface",
@@ -37,8 +34,9 @@ envoy_cc_extension(
             "-DUSE_CEL_PARSER",
         ],
     }),
+    # legacy test use
     extra_visibility = [
-        "//test:__subpackages__",
+        "//test/common/access_log:__subpackages__",
     ],
     deps = [
         ":cel_lib",
diff --git a/source/extensions/common/wasm/BUILD b/source/extensions/common/wasm/BUILD
index 93f33d4a6570a..ddda46e29ea3d 100644
--- a/source/extensions/common/wasm/BUILD
+++ b/source/extensions/common/wasm/BUILD
@@ -28,7 +28,6 @@ envoy_cc_library(
         "wasm.h",
         "wasm_vm.h",
     ],
-    visibility = ["//visibility:public"],
     deps = [
         "//envoy/http:codes_interface",
         "//envoy/http:filter_interface",
@@ -67,7 +66,11 @@ envoy_cc_library(
             "-DWASM_USE_CEL_PARSER",
         ],
     }),
-    visibility = ["//visibility:public"],
+    visibility = [
+        "//source/extensions:__subpackages__",
+        "//test/extensions:__subpackages__",
+        "//test/test_common:__subpackages__",
+    ],
     deps = [
         ":wasm_hdr",
         ":wasm_runtime_factory_interface",
diff --git a/source/extensions/common/wasm/ext/BUILD b/source/extensions/common/wasm/ext/BUILD
index db6c7f19f7dd3..0d29ec27788a0 100644
--- a/source/extensions/common/wasm/ext/BUILD
+++ b/source/extensions/common/wasm/ext/BUILD
@@ -16,7 +16,6 @@ envoy_cc_library(
         "envoy_null_vm_wasm_api.h",
         "envoy_proxy_wasm_api.h",
     ],
-    visibility = ["//visibility:public"],
     deps = [
         "@proxy_wasm_cpp_sdk//:api_lib",
         "@proxy_wasm_cpp_sdk//:common_lib",
@@ -29,7 +28,6 @@ envoy_cc_library(
         "envoy_null_plugin.h",
         "envoy_proxy_wasm_api.h",
     ],
-    visibility = ["//visibility:public"],
     deps = [
         ":declare_property_cc_proto",
         "//source/common/grpc:async_client_lib",
@@ -43,7 +41,6 @@ cc_library(
     srcs = ["envoy_proxy_wasm_api.cc"],
     hdrs = ["envoy_proxy_wasm_api.h"],
     tags = ["manual"],
-    visibility = ["//visibility:public"],
     deps = [
         ":declare_property_cc_proto",
         ":node_subset_cc_proto",
@@ -55,20 +52,17 @@ cc_library(
 filegroup(
     name = "envoy_proxy_wasm_api_js",
     srcs = ["envoy_proxy_wasm_api.js"],
-    visibility = ["//visibility:public"],
 )
 
 # NB: this target is compiled both to native code and to Wasm. Hence the generic rule.
 proto_library(
     name = "declare_property_proto",
     srcs = ["declare_property.proto"],
-    visibility = ["//visibility:public"],
 )
 
 # NB: this target is compiled both to native code and to Wasm. Hence the generic rule.
 cc_proto_library(
     name = "declare_property_cc_proto",
-    visibility = ["//visibility:public"],
     deps = [":declare_property_proto"],
 )
 
@@ -76,7 +70,6 @@ cc_proto_library(
 proto_library(
     name = "node_subset_proto",
     srcs = ["node_subset.proto"],
-    visibility = ["//visibility:public"],
     deps = [
         "@com_google_protobuf//:struct_proto",
     ],
@@ -85,7 +78,6 @@ proto_library(
 # NB: this target is compiled both to native code and to Wasm. Hence the generic rule.
 cc_proto_library(
     name = "node_subset_cc_proto",
-    visibility = ["//visibility:public"],
     deps = [
         ":node_subset_proto",
         # "//external:protobuf_clib",
diff --git a/source/extensions/extensions_build_config.bzl b/source/extensions/extensions_build_config.bzl
index 9bf7950e20ed0..44b80a834300f 100644
--- a/source/extensions/extensions_build_config.bzl
+++ b/source/extensions/extensions_build_config.bzl
@@ -339,6 +339,6 @@ EXTENSIONS = {
 
 # These can be changed to ["//visibility:public"], for  downstream builds which
 # need to directly reference Envoy extensions.
-EXTENSION_CONFIG_VISIBILITY = ["//:extension_config"]
-EXTENSION_PACKAGE_VISIBILITY = ["//:extension_library"]
+EXTENSION_CONFIG_VISIBILITY = ["//:extension_config", "//:contrib_library", "//:examples_library"]
+EXTENSION_PACKAGE_VISIBILITY = ["//:extension_library", "//:contrib_library", "//:examples_library"]
 CONTRIB_EXTENSION_PACKAGE_VISIBILITY = ["//:contrib_library"]
diff --git a/source/extensions/filters/common/expr/BUILD b/source/extensions/filters/common/expr/BUILD
index 42d0bb7a0d2d9..717c298ad31d1 100644
--- a/source/extensions/filters/common/expr/BUILD
+++ b/source/extensions/filters/common/expr/BUILD
@@ -51,7 +51,6 @@ envoy_cc_library(
     hdrs = [
         "cel_state.h",
     ],
-    visibility = ["//visibility:public"],
     deps = [
         "//envoy/stream_info:filter_state_interface",
         "//source/common/protobuf",
diff --git a/source/extensions/filters/common/mutation_rules/BUILD b/source/extensions/filters/common/mutation_rules/BUILD
index 5d028cbb7b841..7f9f59bdf10c3 100644
--- a/source/extensions/filters/common/mutation_rules/BUILD
+++ b/source/extensions/filters/common/mutation_rules/BUILD
@@ -12,7 +12,6 @@ envoy_cc_library(
     name = "mutation_rules_lib",
     srcs = ["mutation_rules.cc"],
     hdrs = ["mutation_rules.h"],
-    visibility = ["//visibility:public"],
     deps = [
         "//envoy/http:header_map_interface",
         "//source/common/common:macros",
diff --git a/source/extensions/filters/http/admission_control/evaluators/BUILD b/source/extensions/filters/http/admission_control/evaluators/BUILD
index 450138656e277..2b7b1b562cf9a 100644
--- a/source/extensions/filters/http/admission_control/evaluators/BUILD
+++ b/source/extensions/filters/http/admission_control/evaluators/BUILD
@@ -17,7 +17,6 @@ envoy_cc_library(
         "response_evaluator.h",
         "success_criteria_evaluator.h",
     ],
-    visibility = ["//visibility:public"],
     deps = [
         "//envoy/grpc:status",
         "//source/common/common:enum_to_int",
diff --git a/source/extensions/filters/http/wasm/BUILD b/source/extensions/filters/http/wasm/BUILD
index 0d71f7bb0fa42..4b5bb15995a31 100644
--- a/source/extensions/filters/http/wasm/BUILD
+++ b/source/extensions/filters/http/wasm/BUILD
@@ -15,7 +15,6 @@ envoy_cc_library(
     name = "wasm_filter_lib",
     srcs = ["wasm_filter.cc"],
     hdrs = ["wasm_filter.h"],
-    visibility = ["//visibility:public"],
     deps = [
         "//envoy/http:codes_interface",
         "//envoy/server:filter_config_interface",
diff --git a/source/extensions/filters/listener/proxy_protocol/BUILD b/source/extensions/filters/listener/proxy_protocol/BUILD
index df415a272426f..7435277bdb7d5 100644
--- a/source/extensions/filters/listener/proxy_protocol/BUILD
+++ b/source/extensions/filters/listener/proxy_protocol/BUILD
@@ -18,7 +18,6 @@ envoy_cc_library(
         "proxy_protocol.h",
         "proxy_protocol_header.h",
     ],
-    visibility = ["//visibility:public"],
     deps = [
         "//envoy/event:dispatcher_interface",
         "//envoy/network:filter_interface",
diff --git a/source/extensions/http/stateful_session/cookie/BUILD b/source/extensions/http/stateful_session/cookie/BUILD
index 0ed5f2b95e160..ceed1d6ff7d9c 100644
--- a/source/extensions/http/stateful_session/cookie/BUILD
+++ b/source/extensions/http/stateful_session/cookie/BUILD
@@ -13,8 +13,6 @@ envoy_cc_library(
     name = "cookie_lib",
     srcs = ["cookie.cc"],
     hdrs = ["cookie.h"],
-    # This extension is core code.
-    visibility = ["//visibility:public"],
     deps = [
         "//envoy/http:stateful_session_interface",
         "//source/common/common:base64_lib",
@@ -28,8 +26,6 @@ envoy_cc_extension(
     name = "config",
     srcs = ["config.cc"],
     hdrs = ["config.h"],
-    # This extension is core code.
-    visibility = ["//visibility:public"],
     deps = [
         ":cookie_lib",
         "//envoy/http:stateful_session_interface",
diff --git a/source/extensions/transport_sockets/starttls/BUILD b/source/extensions/transport_sockets/starttls/BUILD
index 197a0f584be99..6740d1b68f9c8 100644
--- a/source/extensions/transport_sockets/starttls/BUILD
+++ b/source/extensions/transport_sockets/starttls/BUILD
@@ -15,7 +15,6 @@ envoy_cc_extension(
     name = "config",
     srcs = ["config.cc"],
     hdrs = ["config.h"],
-    visibility = ["//visibility:public"],
     deps = [
         ":starttls_socket_lib",
         "//envoy/network:transport_socket_interface",
diff --git a/source/extensions/transport_sockets/tls/cert_validator/spiffe/BUILD b/source/extensions/transport_sockets/tls/cert_validator/spiffe/BUILD
index a0723eb783f29..82f6860d86d72 100644
--- a/source/extensions/transport_sockets/tls/cert_validator/spiffe/BUILD
+++ b/source/extensions/transport_sockets/tls/cert_validator/spiffe/BUILD
@@ -21,7 +21,6 @@ envoy_cc_extension(
         "abseil_base",
         "abseil_hash",
     ],
-    visibility = ["//visibility:public"],
     deps = [
         "//envoy/ssl:context_config_interface",
         "//envoy/ssl:ssl_socket_extended_info_interface",
diff --git a/source/extensions/transport_sockets/tls/private_key/BUILD b/source/extensions/transport_sockets/tls/private_key/BUILD
index a7bae7c825a0f..3d9a42a78c76d 100644
--- a/source/extensions/transport_sockets/tls/private_key/BUILD
+++ b/source/extensions/transport_sockets/tls/private_key/BUILD
@@ -16,7 +16,6 @@ envoy_cc_library(
     hdrs = [
         "private_key_manager_impl.h",
     ],
-    visibility = ["//visibility:public"],
     deps = [
         "//envoy/event:dispatcher_interface",
         "//envoy/registry",