diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0e3af49..1e50297 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -36,7 +36,7 @@ jobs:
           restore-keys: |
             bazel-
       - name: 'Set up JDK ${{ matrix.java }}'
-        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
+        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
         with:
           java-version: ${{ matrix.java }}
           distribution: 'temurin'
diff --git a/api/BUILD b/api/BUILD
index 325b6cc..f610301 100644
--- a/api/BUILD
+++ b/api/BUILD
@@ -95,6 +95,7 @@ java_library(
 java_library(
     name = "checks",
     srcs = CHECKS,
+    visibility = ["//visibility:private"],
     deps = [
         "@google_bazel_common//third_party/java/error_prone:annotations",
     ],