diff --git a/build/sdk/sdk.gni b/build/sdk/sdk.gni
index 31f21a79a96aaa9a1db147664a373f194175e146..05f5bb91df5dc863b58d3ce09a35802dcefdd85c 100644
--- a/build/sdk/sdk.gni
+++ b/build/sdk/sdk.gni
@@ -90,19 +90,22 @@ template("sdk") {
 
   # Generates the manifest.
   sdk_molecule(generation_target_name) {
+    # Do not expose this molecule to other targets. Depending directly on the
+    # contents of an SDK foregoes API verification, which is not desirable.
+    visibility = [ ":$verify_api_target_name" ]
+
     forward_variables_from(invoker,
-                           "*",
                            [
-                             "api",
-                             "export",
+                             "assert_no_deps",
+                             "category",
+                             "deps",
+                             "testonly",
                            ])
 
     if (!defined(deps)) {
       deps = []
     }
     deps += [ "//build/sdk:schemas" ]
-
-    category = invoker.category
   }
 
   intermediate_manifest_file = "$target_gen_dir/$generation_target_name.sdk"
diff --git a/build/sdk/sdk_molecule.gni b/build/sdk/sdk_molecule.gni
index dfdeaaeee8a69719cb6e5d0e7886a58e677cb260..3143927d01834ba48ffb3c2474cdf0a8422a3259 100644
--- a/build/sdk/sdk_molecule.gni
+++ b/build/sdk/sdk_molecule.gni
@@ -39,6 +39,7 @@ template("sdk_molecule") {
                            [
                              "assert_no_deps",
                              "testonly",
+                             "visibility",
                            ])
 
     manifest = "$target_gen_dir/$target_name.sdk"