diff --git a/quic/core/crypto/tls_client_connection.h b/quic/core/crypto/tls_client_connection.h
index c741389..a9212ff 100644
--- a/quic/core/crypto/tls_client_connection.h
+++ b/quic/core/crypto/tls_client_connection.h
@@ -11,7 +11,7 @@
 
 // TlsClientConnection receives calls for client-specific BoringSSL callbacks
 // and calls its Delegate for the implementation of those callbacks.
-class TlsClientConnection : public TlsConnection {
+class QUIC_EXPORT_PRIVATE TlsClientConnection : public TlsConnection {
  public:
   // A TlsClientConnection::Delegate implements the client-specific methods that
   // are set as callbacks for an SSL object.
diff --git a/quic/core/crypto/tls_connection.h b/quic/core/crypto/tls_connection.h
index 15c2b67..c15d920 100644
--- a/quic/core/crypto/tls_connection.h
+++ b/quic/core/crypto/tls_connection.h
@@ -22,7 +22,7 @@
 // The owner of the TlsConnection is responsible for driving the TLS handshake
 // (and other interactions with the SSL*). This class only handles mapping
 // callbacks to the correct instance.
-class TlsConnection {
+class QUIC_EXPORT_PRIVATE TlsConnection {
  public:
   // A TlsConnection::Delegate implements the methods that are set as callbacks
   // of TlsConnection.
diff --git a/quic/core/crypto/tls_server_connection.h b/quic/core/crypto/tls_server_connection.h
index a5d087c..0e78d1b 100644
--- a/quic/core/crypto/tls_server_connection.h
+++ b/quic/core/crypto/tls_server_connection.h
@@ -11,7 +11,7 @@
 
 // TlsServerConnection receives calls for client-specific BoringSSL callbacks
 // and calls its Delegate for the implementation of those callbacks.
-class TlsServerConnection : public TlsConnection {
+class QUIC_EXPORT_PRIVATE TlsServerConnection : public TlsConnection {
  public:
   // A TlsServerConnection::Delegate implement the server-specific methods that
   // are set as callbacks for an SSL object.
diff --git a/quic/core/tls_client_handshaker.h b/quic/core/tls_client_handshaker.h
index d3e1e0c..c22fbe9 100644
--- a/quic/core/tls_client_handshaker.h
+++ b/quic/core/tls_client_handshaker.h
@@ -54,7 +54,7 @@
   CryptoMessageParser* crypto_message_parser() override;
 
  protected:
-  TlsConnection* tls_connection() { return &tls_connection_; }
+  TlsConnection* tls_connection() override { return &tls_connection_; }
 
   void AdvanceHandshake() override;
   void CloseConnection(QuicErrorCode error,
diff --git a/quic/core/tls_server_handshaker.h b/quic/core/tls_server_handshaker.h
index 479342e..cb55d59 100644
--- a/quic/core/tls_server_handshaker.h
+++ b/quic/core/tls_server_handshaker.h
@@ -60,7 +60,7 @@
   CryptoMessageParser* crypto_message_parser() override;
 
  protected:
-  TlsConnection* tls_connection() { return &tls_connection_; }
+  TlsConnection* tls_connection() override { return &tls_connection_; }
 
   // Called when a new message is received on the crypto stream and is available
   // for the TLS stack to read.