diff --git a/.bazelci/presubmit.yml b/.bazelci/presubmit.yml
index 2112294643..c39374e407 100644
--- a/.bazelci/presubmit.yml
+++ b/.bazelci/presubmit.yml
@@ -14,11 +14,9 @@ tasks:
     shell_commands:
       - tests/core/cgo/generate_imported_dylib.sh
     build_flags:
-    - "--incompatible_load_proto_rules_from_bzl"
-    - "--incompatible_enable_cc_toolchain_resolution"
+    - "--config=incompatible"
     test_flags:
-    - "--incompatible_load_proto_rules_from_bzl"
-    - "--incompatible_enable_cc_toolchain_resolution"
+    - "--config=incompatible"
     build_targets:
     - "//..."
     test_targets:
diff --git a/.bazelrc b/.bazelrc
index a2f90a52d0..c5f9ce9ed7 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -10,3 +10,12 @@ build:ci --spawn_strategy=standalone
 build:ci --genrule_strategy=standalone
 test:ci --test_strategy=standalone
 test:ci --test_output=errors
+
+# Incompatible flags to test in a dedicated CI pipeline.
+build:incompatible --incompatible_load_proto_rules_from_bzl
+build:incompatible --incompatible_enable_cc_toolchain_resolution
+build:incompatible --incompatible_config_setting_private_default_visibility
+build:incompatible --incompatible_enforce_config_setting_visibility
+build:incompatible --incompatible_disallow_empty_glob
+# Also enable all incompatible flags in go_bazel_test by default.
+test:incompatible --test_env=GO_BAZEL_TEST_BAZELFLAGS=--incompatible_load_proto_rules_from_bzl --incompatible_enable_cc_toolchain_resolution --incompatible_config_setting_private_default_visibility --incompatible_enforce_config_setting_visibility --incompatible_disallow_empty_glob
diff --git a/go/platform/list.bzl b/go/platform/list.bzl
index 7abc71b8af..8eb8675bd3 100644
--- a/go/platform/list.bzl
+++ b/go/platform/list.bzl
@@ -39,11 +39,13 @@ def declare_config_settings():
         native.config_setting(
             name = goos,
             constraint_values = [Label("//go/toolchain:" + goos)],
+            visibility = ["//visibility:public"],
         )
     for goarch in GOARCH:
         native.config_setting(
             name = goarch,
             constraint_values = [Label("//go/toolchain:" + goarch)],
+            visibility = ["//visibility:public"],
         )
     for goos, goarch in GOOS_GOARCH:
         native.config_setting(
@@ -52,6 +54,7 @@ def declare_config_settings():
                 Label("//go/toolchain:" + goos),
                 Label("//go/toolchain:" + goarch),
             ],
+            visibility = ["//visibility:public"],
         )
 
     # Setting that determines whether cgo is enabled.
diff --git a/go/private/BUILD.bazel b/go/private/BUILD.bazel
index 475b88b342..411412cea3 100644
--- a/go/private/BUILD.bazel
+++ b/go/private/BUILD.bazel
@@ -24,24 +24,10 @@ filegroup(
     visibility = ["//visibility:public"],
 )
 
-config_setting(
-    name = "strip-always",
-    values = {"strip": "always"},
-)
-
-config_setting(
-    name = "strip-sometimes",
-    values = {"strip": "sometimes"},
-)
-
-config_setting(
-    name = "strip-never",
-    values = {"strip": "never"},
-)
-
 config_setting(
     name = "stamp",
     values = {"stamp": "true"},
+    visibility = ["//:__pkg__"],
 )
 
 bzl_library(
@@ -187,6 +173,7 @@ config_setting(
         ":bootstrap_nogo": "False",
         ":request_nogo": "True",
     },
+    visibility = ["//visibility:public"],
 )
 
 bool_setting(
diff --git a/go/private/BUILD.sdk.bazel b/go/private/BUILD.sdk.bazel
index 305fce8c5b..e4aa1eb39d 100644
--- a/go/private/BUILD.sdk.bazel
+++ b/go/private/BUILD.sdk.bazel
@@ -66,6 +66,7 @@ config_setting(
     flag_values = {
         sdk_version_label: "",
     },
+    visibility = ["//visibility:private"],
 )
 
 config_setting(
@@ -73,6 +74,7 @@ config_setting(
     flag_values = {
         sdk_version_label: "{major_version}",
     },
+    visibility = ["//visibility:private"],
 )
 
 config_setting(
@@ -80,6 +82,7 @@ config_setting(
     flag_values = {
         sdk_version_label: "{major_version}.{minor_version}",
     },
+    visibility = ["//visibility:private"],
 )
 
 config_setting(
@@ -87,6 +90,7 @@ config_setting(
     flag_values = {
         sdk_version_label: "{major_version}.{minor_version}.{patch_version}",
     },
+    visibility = ["//visibility:private"],
 )
 
 # If prerelease version is "", this will be the same as ":match_patch_version", but that's fine since we use match_any in config_setting_group.
@@ -95,6 +99,7 @@ config_setting(
     flag_values = {
         sdk_version_label: "{major_version}.{minor_version}.{patch_version}{prerelease_suffix}",
     },
+    visibility = ["//visibility:private"],
 )
 
 config_setting(
@@ -102,6 +107,7 @@ config_setting(
     flag_values = {
         sdk_version_label: "{sdk_type}",
     },
+    visibility = ["//visibility:private"],
 )
 
 selects.config_setting_group(
@@ -114,6 +120,7 @@ selects.config_setting_group(
         ":match_prerelease_version",
         ":match_sdk_type",
     ],
+    visibility = ["//visibility:private"],
 )
 
 declare_toolchains(