diff --git a/python/config_settings/BUILD.bazel b/python/config_settings/BUILD.bazel
index c7de1d00da..d92aa4261c 100644
--- a/python/config_settings/BUILD.bazel
+++ b/python/config_settings/BUILD.bazel
@@ -15,6 +15,7 @@ load(
     "VenvsUseDeclareSymlinkFlag",
     rp_string_flag = "string_flag",
 )
+load("//python/private:visibility.bzl", "NOT_ACTUALLY_PUBLIC")  # buildifier: disable=bzl-visibility
 load("//python/private/pypi:flags.bzl", "define_pypi_internal_flags")
 load(":config_settings.bzl", "construct_config_settings")
 
@@ -48,7 +49,7 @@ string_flag(
     build_setting_default = AddSrcsToRunfilesFlag.AUTO,
     values = AddSrcsToRunfilesFlag.flag_values(),
     # NOTE: Only public because it is dependency of public rules.
-    visibility = ["//visibility:public"],
+    visibility = NOT_ACTUALLY_PUBLIC,
 )
 
 string_flag(
@@ -67,7 +68,7 @@ config_setting(
     },
     # NOTE: Only public because it is used in py_toolchain_suite from toolchain
     # repositories
-    visibility = ["//visibility:public"],
+    visibility = NOT_ACTUALLY_PUBLIC,
 )
 
 string_flag(
@@ -75,7 +76,7 @@ string_flag(
     build_setting_default = PrecompileFlag.AUTO,
     values = sorted(PrecompileFlag.__members__.values()),
     # NOTE: Only public because it's an implicit dependency
-    visibility = ["//visibility:public"],
+    visibility = NOT_ACTUALLY_PUBLIC,
 )
 
 string_flag(
@@ -83,7 +84,7 @@ string_flag(
     build_setting_default = ValidateTestMainFlag.AUTO,
     values = ValidateTestMainFlag.flag_values(),
     # NOTE: Only public because it's an implicit dependency of py_test.
-    visibility = ["//visibility:public"],
+    visibility = NOT_ACTUALLY_PUBLIC,
 )
 
 string_flag(
@@ -91,7 +92,7 @@ string_flag(
     build_setting_default = PrecompileSourceRetentionFlag.AUTO,
     values = sorted(PrecompileSourceRetentionFlag.__members__.values()),
     # NOTE: Only public because it's an implicit dependency
-    visibility = ["//visibility:public"],
+    visibility = NOT_ACTUALLY_PUBLIC,
 )
 
 rp_string_flag(
@@ -104,7 +105,7 @@ rp_string_flag(
     }),
     values = sorted(BootstrapImplFlag.__members__.values()),
     # NOTE: Only public because it's an implicit dependency
-    visibility = ["//visibility:public"],
+    visibility = NOT_ACTUALLY_PUBLIC,
 )
 
 label_flag(
@@ -127,7 +128,7 @@ string_flag(
     build_setting_default = LibcFlag.GLIBC,
     values = LibcFlag.flag_values(),
     # NOTE: Only public because it is used in pip hub and toolchain repos.
-    visibility = ["//visibility:public"],
+    visibility = NOT_ACTUALLY_PUBLIC,
 )
 
 string_flag(
@@ -166,21 +167,21 @@ string_flag(
     name = "venv",
     build_setting_default = "auto",
     # NOTE: Only public because it is used in pip hub repos and executable transitions.
-    visibility = ["//visibility:public"],
+    visibility = NOT_ACTUALLY_PUBLIC,
 )
 
 string_flag(
     name = "pip_whl_osx_version",
     build_setting_default = "",
     # NOTE: Only public because it is used in pip hub repos.
-    visibility = ["//visibility:public"],
+    visibility = NOT_ACTUALLY_PUBLIC,
 )
 
 string_flag(
     name = "venvs_site_packages",
     build_setting_default = VenvsSitePackages.NO,
     # NOTE: Only public because it is used in pip hub repos.
-    visibility = ["//visibility:public"],
+    visibility = NOT_ACTUALLY_PUBLIC,
 )
 
 config_setting(
@@ -189,7 +190,7 @@ config_setting(
         ":venvs_site_packages": VenvsSitePackages.YES,
     },
     # NOTE: Only public because it is used in whl_library repos.
-    visibility = ["//visibility:public"],
+    visibility = NOT_ACTUALLY_PUBLIC,
 )
 
 define_pypi_internal_flags(
@@ -200,7 +201,7 @@ label_flag(
     name = "pip_env_marker_config",
     build_setting_default = ":_pip_env_marker_default_config",
     # NOTE: Only public because it is used in pip hub repos.
-    visibility = ["//visibility:public"],
+    visibility = NOT_ACTUALLY_PUBLIC,
 )
 
 bool_flag(
diff --git a/python/private/BUILD.bazel b/python/private/BUILD.bazel
index e4d06d4a89..5f51b7650c 100644
--- a/python/private/BUILD.bazel
+++ b/python/private/BUILD.bazel
@@ -22,6 +22,7 @@ load(":py_interpreter_program.bzl", "py_interpreter_program")
 load(":sentinel_impl.bzl", "sentinel")
 load(":stamp_impl.bzl", "stamp_build_setting")
 load(":uncachable_version_file.bzl", "define_uncachable_version_file")
+load(":visibility.bzl", "NOT_ACTUALLY_PUBLIC")
 
 package(
     default_visibility = [
@@ -95,7 +96,7 @@ exports_files(
     ["python_bootstrap_template.txt"],
     # Not actually public. Only public because it's an implicit dependency of
     # py_runtime.
-    visibility = ["//visibility:public"],
+    visibility = NOT_ACTUALLY_PUBLIC,
 )
 
 filegroup(
@@ -103,7 +104,7 @@ filegroup(
     srcs = ["stage1_bootstrap_template.sh"],
     # Not actually public. Only public because it's an implicit dependency of
     # py_runtime.
-    visibility = ["//visibility:public"],
+    visibility = NOT_ACTUALLY_PUBLIC,
 )
 
 filegroup(
@@ -111,7 +112,7 @@ filegroup(
     srcs = ["stage2_bootstrap_template.py"],
     # Not actually public. Only public because it's an implicit dependency of
     # py_runtime.
-    visibility = ["//visibility:public"],
+    visibility = NOT_ACTUALLY_PUBLIC,
 )
 
 filegroup(
@@ -119,7 +120,7 @@ filegroup(
     srcs = ["site_init_template.py"],
     # Not actually public. Only public because it's an implicit dependency of
     # py_runtime.
-    visibility = ["//visibility:public"],
+    visibility = NOT_ACTUALLY_PUBLIC,
 )
 
 # NOTE: Windows builds don't use this bootstrap. Instead, a native Windows
@@ -133,7 +134,7 @@ alias(
     }),
     # Not actually public. Only public because it's an implicit dependency of
     # py_runtime.
-    visibility = ["//visibility:public"],
+    visibility = NOT_ACTUALLY_PUBLIC,
 )
 
 # Used to determine the use of `--stamp` in Starlark rules
@@ -169,7 +170,7 @@ bool_flag(
     name = "visible_for_testing",
     build_setting_default = False,
     # This is only because it is an implicit dependency by the toolchains.
-    visibility = ["//visibility:public"],
+    visibility = NOT_ACTUALLY_PUBLIC,
 )
 
 # Used for py_console_script_gen rule
@@ -203,7 +204,7 @@ current_interpreter_executable(
     name = "current_interpreter_executable",
     # Not actually public. Only public because it's an implicit dependency of
     # py_exec_tools_toolchain.
-    visibility = ["//visibility:public"],
+    visibility = NOT_ACTUALLY_PUBLIC,
 )
 
 py_library(
@@ -227,7 +228,7 @@ py_interpreter_program(
     main = "py_test_main_validator.py",
     # Not actually public. Only public because it's an implicit dependency of
     # the py_test rule.
-    visibility = ["//visibility:public"],
+    visibility = NOT_ACTUALLY_PUBLIC,
 )
 
 py_library(
@@ -330,6 +331,7 @@ bzl_library(
     deps = [
         ":text_util",
         ":version",
+        ":visibility",
         "@bazel_skylib//lib:selects",
         "@bazel_skylib//rules:common_settings",
     ],
@@ -906,6 +908,12 @@ bzl_library(
     ],
 )
 
+bzl_library(
+    name = "stamp_impl",
+    srcs = ["stamp_impl.bzl"],
+    deps = [":visibility"],
+)
+
 bzl_library(
     name = "bzlmod_enabled",
     srcs = ["bzlmod_enabled.bzl"],
@@ -986,11 +994,6 @@ bzl_library(
     srcs = ["sentinel_impl.bzl"],
 )
 
-bzl_library(
-    name = "stamp_impl",
-    srcs = ["stamp_impl.bzl"],
-)
-
 bzl_library(
     name = "text_util",
     srcs = ["text_util.bzl"],
diff --git a/python/private/api/BUILD.bazel b/python/private/api/BUILD.bazel
index b3cc7360a7..cd7eda1bd2 100644
--- a/python/private/api/BUILD.bazel
+++ b/python/private/api/BUILD.bazel
@@ -13,6 +13,7 @@
 # limitations under the License.
 
 load("@bazel_skylib//:bzl_library.bzl", "bzl_library")
+load("//python/private:visibility.bzl", "NOT_ACTUALLY_PUBLIC")
 load(":py_common_api.bzl", "py_common_api")
 
 package(
@@ -27,7 +28,7 @@ filegroup(
 py_common_api(
     name = "py_common_api_impl",
     # NOTE: Not actually public. Implicit dependency of public rules.
-    visibility = ["//visibility:public"],
+    visibility = NOT_ACTUALLY_PUBLIC,
 )
 
 bzl_library(
diff --git a/python/private/config_settings.bzl b/python/private/config_settings.bzl
index 91fbbba8cb..9cd729aff2 100644
--- a/python/private/config_settings.bzl
+++ b/python/private/config_settings.bzl
@@ -17,8 +17,9 @@
 
 load("@bazel_skylib//lib:selects.bzl", "selects")
 load("@bazel_skylib//rules:common_settings.bzl", "BuildSettingInfo")
-load("//python/private:text_util.bzl", "render")
+load(":text_util.bzl", "render")
 load(":version.bzl", "version")
+load(":visibility.bzl", "NOT_ACTUALLY_PUBLIC")
 
 _PYTHON_VERSION_FLAG = Label("//python/config_settings:python_version")
 _PYTHON_VERSION_MAJOR_MINOR_FLAG = Label("//python/config_settings:python_version_major_minor")
@@ -31,10 +32,6 @@ If the value is missing, then the default value is being used, see documentation
 {docs_url}/python/config_settings
 """
 
-# Indicates something needs public visibility so that other generated code can
-# access it, but it's not intended for general public usage.
-_NOT_ACTUALLY_PUBLIC = ["//visibility:public"]
-
 def construct_config_settings(
         *,
         name,
@@ -93,7 +90,7 @@ def construct_config_settings(
         native.config_setting(
             name = "_" + name,
             flag_values = {":python_version": ver},
-            visibility = ["//visibility:public"],
+            visibility = NOT_ACTUALLY_PUBLIC,
         )
 
         # An alias pointing to an underscore-prefixed config_setting_group
@@ -111,7 +108,7 @@ def construct_config_settings(
         native.alias(
             name = name,
             actual = "_{}_group".format(name),
-            visibility = ["//visibility:public"],
+            visibility = NOT_ACTUALLY_PUBLIC,
         )
 
     # This matches the raw flag value, e.g. --//python/config_settings:python_version=3.8
@@ -156,30 +153,30 @@ def construct_config_settings(
         # `whl_library` in the hub repo created by `pip.parse`.
         flag_values = {"current_config": "will-never-match"},
         # Only public so that PyPI hub repo can access it
-        visibility = _NOT_ACTUALLY_PUBLIC,
+        visibility = NOT_ACTUALLY_PUBLIC,
     )
 
     libc = Label("//python/config_settings:py_linux_libc")
     native.config_setting(
         name = "_is_py_linux_libc_glibc",
         flag_values = {libc: "glibc"},
-        visibility = _NOT_ACTUALLY_PUBLIC,
+        visibility = NOT_ACTUALLY_PUBLIC,
     )
     native.config_setting(
         name = "_is_py_linux_libc_musl",
         flag_values = {libc: "musl"},
-        visibility = _NOT_ACTUALLY_PUBLIC,
+        visibility = NOT_ACTUALLY_PUBLIC,
     )
     freethreaded = Label("//python/config_settings:py_freethreaded")
     native.config_setting(
         name = "_is_py_freethreaded_yes",
         flag_values = {freethreaded: "yes"},
-        visibility = _NOT_ACTUALLY_PUBLIC,
+        visibility = NOT_ACTUALLY_PUBLIC,
     )
     native.config_setting(
         name = "_is_py_freethreaded_no",
         flag_values = {freethreaded: "no"},
-        visibility = _NOT_ACTUALLY_PUBLIC,
+        visibility = NOT_ACTUALLY_PUBLIC,
     )
 
 def _python_version_flag_impl(ctx):
diff --git a/python/private/stamp_impl.bzl b/python/private/stamp_impl.bzl
index 6bc0cd9d23..77e3da1f72 100644
--- a/python/private/stamp_impl.bzl
+++ b/python/private/stamp_impl.bzl
@@ -18,6 +18,8 @@ This module can be removed likely after the following PRs ar addressed:
 - https://github.com/bazelbuild/bazel/issues/11164
 """
 
+load(":visibility.bzl", "NOT_ACTUALLY_PUBLIC")
+
 StampSettingInfo = provider(
     doc = "Information about the `--stamp` command line flag",
     fields = {
@@ -50,7 +52,7 @@ Stamped binaries are not rebuilt unless their dependencies change.
     },
 )
 
-def stamp_build_setting(name, visibility = ["//visibility:public"]):
+def stamp_build_setting(name, visibility = NOT_ACTUALLY_PUBLIC):
     native.config_setting(
         name = "stamp_detect",
         values = {"stamp": "1"},
diff --git a/sphinxdocs/sphinxdocs/private/BUILD.bazel b/sphinxdocs/sphinxdocs/private/BUILD.bazel
index b054ed2611..5c87e77ce2 100644
--- a/sphinxdocs/sphinxdocs/private/BUILD.bazel
+++ b/sphinxdocs/sphinxdocs/private/BUILD.bazel
@@ -16,6 +16,7 @@ load("@bazel_skylib//:bzl_library.bzl", "bzl_library")
 load("@com_google_protobuf//bazel:py_proto_library.bzl", "py_proto_library")
 load("@rules_python//python:py_binary.bzl", "py_binary")
 load("@rules_python//python:py_library.bzl", "py_library")
+load(":visibility.bzl", "NOT_ACTUALLY_PUBLIC")
 
 package(
     default_visibility = ["//:__subpackages__"],
@@ -102,18 +103,23 @@ bzl_library(
     ],
 )
 
+bzl_library(
+    name = "visibility",
+    srcs = ["visibility.bzl"],
+)
+
 py_binary(
     name = "inventory_builder",
     srcs = ["inventory_builder.py"],
     # Only public because it's an implicit attribute
-    visibility = ["//visibility:public"],
+    visibility = NOT_ACTUALLY_PUBLIC,
 )
 
 py_binary(
     name = "proto_to_markdown",
     srcs = ["proto_to_markdown.py"],
     # Only public because it's an implicit attribute
-    visibility = ["//visibility:public"],
+    visibility = NOT_ACTUALLY_PUBLIC,
     deps = [":proto_to_markdown_lib"],
 )
 
@@ -121,7 +127,7 @@ py_library(
     name = "proto_to_markdown_lib",
     srcs = ["proto_to_markdown.py"],
     # Only public because it's an implicit attribute
-    visibility = ["//visibility:public"],
+    visibility = NOT_ACTUALLY_PUBLIC,
     deps = [
         ":stardoc_output_proto_py_pb2",
     ],
diff --git a/sphinxdocs/sphinxdocs/private/visibility.bzl b/sphinxdocs/sphinxdocs/private/visibility.bzl
new file mode 100644
index 0000000000..706be45a3b
--- /dev/null
+++ b/sphinxdocs/sphinxdocs/private/visibility.bzl
@@ -0,0 +1,7 @@
+"""Shared code for use with visibility specs."""
+
+# Use when a target isn't actually public, but needs public
+# visibility to keep Bazel happy.
+# Such cases are typically for defaults of rule attributes or macro args that
+# get used outside of sphinxdocs itself.
+NOT_ACTUALLY_PUBLIC = ["//visibility:public"]
diff --git a/tools/precompiler/BUILD.bazel b/tools/precompiler/BUILD.bazel
index 268f41b032..e055980c72 100644
--- a/tools/precompiler/BUILD.bazel
+++ b/tools/precompiler/BUILD.bazel
@@ -14,6 +14,7 @@
 
 load("@bazel_skylib//rules:common_settings.bzl", "string_list_flag")
 load("//python/private:py_interpreter_program.bzl", "py_interpreter_program")  # buildifier: disable=bzl-visibility
+load("//python/private:visibility.bzl", "NOT_ACTUALLY_PUBLIC")  # buildifier: disable=bzl-visibility
 
 filegroup(
     name = "distribution",
@@ -25,11 +26,9 @@ py_interpreter_program(
     name = "precompiler",
     execution_requirements = ":execution_requirements",
     main = "precompiler.py",
-    visibility = [
-        # Not actually public. Only public so rules_python-generated toolchains
-        # are able to reference it.
-        "//visibility:public",
-    ],
+    # Not actually public. Only public so rules_python-generated toolchains
+    # are able to reference it.
+    visibility = NOT_ACTUALLY_PUBLIC,
 )
 
 string_list_flag(
diff --git a/tools/private/zipapp/BUILD.bazel b/tools/private/zipapp/BUILD.bazel
index 7420776ef3..45bd126c6e 100644
--- a/tools/private/zipapp/BUILD.bazel
+++ b/tools/private/zipapp/BUILD.bazel
@@ -1,5 +1,6 @@
 load("//python:py_library.bzl", "py_library")
 load("//python/private:py_interpreter_program.bzl", "py_interpreter_program")  # buildifier: disable=bzl-visibility
+load("//python/private:visibility.bzl", "NOT_ACTUALLY_PUBLIC")  # buildifier: disable=bzl-visibility
 
 package(
     default_visibility = ["//:__subpackages__"],
@@ -8,11 +9,9 @@ package(
 py_interpreter_program(
     name = "zipper",
     main = "zipper.py",
-    visibility = [
-        # Not actually public. Only public so rules_python-generated toolchains
-        # are able to reference it.
-        "//visibility:public",
-    ],
+    # Not actually public. Only public so rules_python-generated toolchains
+    # are able to reference it.
+    visibility = NOT_ACTUALLY_PUBLIC,
 )
 
 py_library(
@@ -23,11 +22,9 @@ py_library(
 py_interpreter_program(
     name = "exe_zip_maker",
     main = "exe_zip_maker.py",
-    visibility = [
-        # Not actually public. Only public so rules_python-generated toolchains
-        # are able to reference it.
-        "//visibility:public",
-    ],
+    # Not actually public. Only public so rules_python-generated toolchains
+    # are able to reference it.
+    visibility = NOT_ACTUALLY_PUBLIC,
 )
 
 py_library(
@@ -38,11 +35,9 @@ py_library(
 py_interpreter_program(
     name = "zip_main_maker",
     main = "zip_main_maker.py",
-    visibility = [
-        # Not actually public. Only public so rules_python-generated toolchains
-        # are able to reference it.
-        "//visibility:public",
-    ],
+    # Not actually public. Only public so rules_python-generated toolchains
+    # are able to reference it.
+    visibility = NOT_ACTUALLY_PUBLIC,
 )
 
 py_library(