diff --git a/buildtools/BUILD.gn b/buildtools/BUILD.gn
index 3b7cc9a..db99b19 100644
--- a/buildtools/BUILD.gn
+++ b/buildtools/BUILD.gn
@@ -15,8 +15,19 @@
 import("//gn/standalone/libc++/libc++.gni")
 import("../gn/perfetto.gni")
 
+# This is to make sure that we don't add accidental dependencies from build
+# files in src/ or include/ to buildtools. All deps (outside of /gn/*) should
+# go via the groups defined in gn/BUILD.gn, not directly into buildtools. This
+# is to allow embedders to re-route targets to their third_party directories.
+_buildtools_visibility = [
+  "./*",
+  "../gn:*",
+  "../gn/standalone:*",
+]
+
 # Used to suppress warnings coming from googletest macros expansions.
 config("test_warning_suppressions") {
+  visibility = _buildtools_visibility
   cflags = [
     "-Wno-unknown-warning-option",
     "-Wno-global-constructors",
@@ -37,6 +48,7 @@
 # and avoid to pull in warning suppressions that are not really necessary for
 # production code.
 config("googletest_prod_config") {
+  visibility = _buildtools_visibility
   cflags = [
     # Using -isystem instead of include_dirs (-I), so we don't need to suppress
     # warnings coming from third-party headers. Doing so would mask warnings in
@@ -47,6 +59,7 @@
 }
 
 config("libunwindstack_config") {
+  visibility = _buildtools_visibility
   cflags = [
     # Using -isystem instead of include_dirs (-I), so we don't need to suppress
     # warnings coming from libunwindstack headers. Doing so would mask warnings
@@ -71,6 +84,7 @@
 
 # Config to include gtest.h in test targets.
 config("googletest_config") {
+  visibility = _buildtools_visibility
   defines = [ "GTEST_LANG_CXX11=1" ]
   cflags = [
     # Using -isystem instead of include_dirs (-I), so we don't need to suppress
@@ -85,6 +99,7 @@
 }
 
 source_set("gtest") {
+  visibility = _buildtools_visibility
   testonly = true
   include_dirs = [ "googletest/googletest" ]
   configs -= [ "//gn/standalone:extra_warnings" ]
@@ -96,6 +111,7 @@
 }
 
 source_set("gtest_main") {
+  visibility = _buildtools_visibility
   testonly = true
   configs -= [ "//gn/standalone:extra_warnings" ]
   configs += [ ":googletest_config" ]
@@ -105,6 +121,7 @@
 }
 
 source_set("gmock") {
+  visibility = _buildtools_visibility
   testonly = true
   include_dirs = [ "googletest/googlemock" ]
   configs -= [ "//gn/standalone:extra_warnings" ]
@@ -122,6 +139,7 @@
 # autogenerated .pb.h headers violate less warnings than the libprotobuf_*
 # library itself.
 config("protobuf_gen_config") {
+  visibility = [ "*" ]  # This is injected by standalone/proto_library.gni
   defines = [
     "GOOGLE_PROTOBUF_NO_RTTI",
     "GOOGLE_PROTOBUF_NO_STATIC_INITIALIZER",
@@ -141,6 +159,8 @@
 
 # Configuration used to build libprotobuf_* and the protoc compiler.
 config("protobuf_config") {
+  visibility = _buildtools_visibility
+
   # Apply the lighter supressions and macro definitions from above.
   configs = [ ":protobuf_gen_config" ]
 
@@ -156,6 +176,7 @@
 }
 
 source_set("protobuf_lite") {
+  visibility = _buildtools_visibility
   sources = [
     "protobuf/src/google/protobuf/arena.cc",
     "protobuf/src/google/protobuf/arenastring.cc",
@@ -187,6 +208,7 @@
 }
 
 source_set("protobuf_full") {
+  visibility = _buildtools_visibility
   deps = [
     ":protobuf_lite",
   ]
@@ -252,6 +274,7 @@
 
 if (current_toolchain == host_toolchain) {
   source_set("protoc_lib") {
+    visibility = _buildtools_visibility
     deps = [
       ":protobuf_full",
     ]
@@ -354,6 +377,7 @@
   }
 
   executable("protoc") {
+    visibility = _buildtools_visibility
     deps = [
       ":protoc_lib",
       "//gn:default_deps",
@@ -368,6 +392,7 @@
 if (use_custom_libcxx) {
   # Config applied to both libc++ and libc++abi targets below.
   config("libc++config") {
+    visibility = _buildtools_visibility
     defines = [
       "LIBCXX_BUILDING_LIBCXXABI",
       "_LIBCXXABI_NO_EXCEPTIONS",
@@ -380,6 +405,7 @@
   }
 
   source_set("libunwind") {
+    visibility = _buildtools_visibility
     sources = [
       "libunwind/src/Unwind-EHABI.cpp",
       "libunwind/src/Unwind-sjlj.c",
@@ -407,6 +433,7 @@
   }
 
   source_set("libc++abi") {
+    visibility = _buildtools_visibility
     sources = [
       "libcxxabi/src/abort_message.cpp",
       "libcxxabi/src/cxa_aux_runtime.cpp",
@@ -453,6 +480,8 @@
   }
 
   target(libcxx_target_type, "libc++") {
+    visibility = _buildtools_visibility
+    visibility += [ "../gn/standalone/libc++:*" ]
     sources = [
       "libcxx/src/algorithm.cpp",
       "libcxx/src/any.cpp",
@@ -503,11 +532,13 @@
 }  # if (use_custom_libcxx)
 
 config("benchmark_config") {
+  visibility = _buildtools_visibility
   include_dirs = [ "benchmark/include" ]
   configs = [ ":test_warning_suppressions" ]
 }
 
 source_set("benchmark") {
+  visibility = _buildtools_visibility
   testonly = true
   sources = [
     "benchmark/include/benchmark/benchmark.h",
@@ -555,6 +586,7 @@
 # On Linux/Android use libbacktrace in debug builds for better stacktraces.
 if (is_linux || is_android) {
   config("libbacktrace_config") {
+    visibility = _buildtools_visibility
     include_dirs = [
       "libbacktrace_config",
       "libbacktrace",
@@ -569,6 +601,7 @@
   }
 
   source_set("libbacktrace") {
+    visibility = _buildtools_visibility
     sources = [
       "libbacktrace/dwarf.c",
       "libbacktrace/elf.c",
@@ -585,6 +618,7 @@
 }
 
 config("sqlite_config") {
+  visibility = _buildtools_visibility
   include_dirs = [ "sqlite" ]
   cflags = [
     "-DSQLITE_THREADSAFE=0",
@@ -605,6 +639,7 @@
 }
 
 source_set("sqlite") {
+  visibility = _buildtools_visibility
   sources = [
     "sqlite/sqlite3.c",
     "sqlite/sqlite3.h",
@@ -616,6 +651,7 @@
 }
 
 source_set("sqlite_shell") {
+  visibility = _buildtools_visibility
   testonly = true
   sources = [
     "sqlite/shell.c",
@@ -627,6 +663,7 @@
 }
 
 source_set("lzma") {
+  visibility = _buildtools_visibility
   defines = [ "_7ZIP_ST" ]
   sources = [
     "lzma/C/7zAlloc.c",
@@ -675,6 +712,7 @@
 }
 
 source_set("zlib") {
+  visibility = _buildtools_visibility
   sources = [
     "zlib/src/adler32.c",
     "zlib/src/compress.c",
@@ -698,6 +736,7 @@
 }
 
 config("zlib_config") {
+  visibility = _buildtools_visibility
   defines = [ "HAVE_HIDDEN" ]
   cflags = [
     # Using -isystem instead of include_dirs (-I), so we don't need to suppress
@@ -709,6 +748,7 @@
 }
 
 source_set("libunwindstack") {
+  visibility = _buildtools_visibility
   include_dirs = [
     "android-core/libunwindstack/include",
     "android-core/libunwindstack",
@@ -770,6 +810,7 @@
 }
 
 config("jsoncpp_config") {
+  visibility = _buildtools_visibility
   cflags = [
     "-DJSON_USE_EXCEPTION=0",
 
@@ -782,6 +823,7 @@
 }
 
 source_set("jsoncpp") {
+  visibility = _buildtools_visibility
   sources = [
     "jsoncpp/src/lib_json/json_reader.cpp",
     "jsoncpp/src/lib_json/json_value.cpp",
@@ -792,6 +834,7 @@
 }
 
 config("linenoise_config") {
+  visibility = _buildtools_visibility
   cflags = [
     # Using -isystem instead of include_dirs (-I), so we don't need to suppress
     # warnings coming from third-party headers. Doing so would mask warnings in
@@ -802,6 +845,7 @@
 }
 
 source_set("linenoise") {
+  visibility = _buildtools_visibility
   sources = [
     "linenoise/linenoise.c",
     "linenoise/linenoise.h",
@@ -812,6 +856,7 @@
 
 if (use_libfuzzer) {
   source_set("libfuzzer") {
+    visibility = _buildtools_visibility
     configs -= [
       "//gn/standalone:extra_warnings",
       "//gn/standalone/sanitizers:sanitizers_cflags",