diff --git a/.bazelrc b/.bazelrc
index e2d273661de61..66892483690ac 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -31,8 +31,9 @@ build --action_env=PATH --host_action_env=PATH
 build --enable_platform_specific_config
 build --test_summary=terse
 
-# TODO(keith): Remove once this is the default
+# TODO(keith): Remove once these 2 are the default
 build --incompatible_config_setting_private_default_visibility
+build --incompatible_enforce_config_setting_visibility
 
 # Allow tags to influence execution requirements
 common --experimental_allow_tags_propagation
diff --git a/bazel/repositories.bzl b/bazel/repositories.bzl
index 00cf975b305e1..db2f8f638bf4a 100644
--- a/bazel/repositories.bzl
+++ b/bazel/repositories.bzl
@@ -221,7 +221,12 @@ def envoy_dependencies(skip_targets = []):
     external_http_archive("bazel_toolchains")
     external_http_archive("bazel_compdb")
     external_http_archive("envoy_build_tools")
-    external_http_archive("rules_pkg")
+
+    # TODO(keith): Remove patch when we update rules_pkg
+    external_http_archive(
+        "rules_pkg",
+        patches = ["@envoy//bazel:rules_pkg.patch"],
+    )
     external_http_archive("com_github_aignas_rules_shellcheck")
     external_http_archive("aspect_bazel_lib")
     _com_github_fdio_vpp_vcl()
diff --git a/bazel/rules_pkg.patch b/bazel/rules_pkg.patch
new file mode 100644
index 0000000000000..a7365962e2981
--- /dev/null
+++ b/bazel/rules_pkg.patch
@@ -0,0 +1,12 @@
+--- pkg/private/BUILD
++++ pkg/private/BUILD
+@@ -55,6 +55,9 @@ exports_files(
+ config_setting(
+     name = "private_stamp_detect",
+     values = {"stamp": "1"},
++    # When --incompatible_config_setting_private_default_visibility is set, this fails unless this is public.
++    # TODO: refactor to clear up confusion that this is a "private" target with public access.
++    visibility = ["//visibility:public"],
+ )
+
+ py_library(