diff --git a/quic/core/crypto/tls_client_connection.h b/quic/core/crypto/tls_client_connection.h
index c741389..a9212ff 100644
--- a/quic/core/crypto/tls_client_connection.h
+++ b/quic/core/crypto/tls_client_connection.h
@@ -11,7 +11,7 @@
 
 // TlsClientConnection receives calls for client-specific BoringSSL callbacks
 // and calls its Delegate for the implementation of those callbacks.
-class TlsClientConnection : public TlsConnection {
+class QUIC_EXPORT_PRIVATE TlsClientConnection : public TlsConnection {
  public:
   // A TlsClientConnection::Delegate implements the client-specific methods that
   // are set as callbacks for an SSL object.
diff --git a/quic/core/crypto/tls_connection.h b/quic/core/crypto/tls_connection.h
index 15c2b67..c15d920 100644
--- a/quic/core/crypto/tls_connection.h
+++ b/quic/core/crypto/tls_connection.h
@@ -22,7 +22,7 @@
 // The owner of the TlsConnection is responsible for driving the TLS handshake
 // (and other interactions with the SSL*). This class only handles mapping
 // callbacks to the correct instance.
-class TlsConnection {
+class QUIC_EXPORT_PRIVATE TlsConnection {
  public:
   // A TlsConnection::Delegate implements the methods that are set as callbacks
   // of TlsConnection.
diff --git a/quic/core/crypto/tls_server_connection.h b/quic/core/crypto/tls_server_connection.h
index a5d087c..0e78d1b 100644
--- a/quic/core/crypto/tls_server_connection.h
+++ b/quic/core/crypto/tls_server_connection.h
@@ -11,7 +11,7 @@
 
 // TlsServerConnection receives calls for client-specific BoringSSL callbacks
 // and calls its Delegate for the implementation of those callbacks.
-class TlsServerConnection : public TlsConnection {
+class QUIC_EXPORT_PRIVATE TlsServerConnection : public TlsConnection {
  public:
   // A TlsServerConnection::Delegate implement the server-specific methods that
   // are set as callbacks for an SSL object.