diff --git a/oauth2_http/java/com/google/auth/mtls/MtlsHttpTransportFactory.java b/oauth2_http/java/com/google/auth/mtls/MtlsHttpTransportFactory.java
index fe4c14209..fef033350 100644
--- a/oauth2_http/java/com/google/auth/mtls/MtlsHttpTransportFactory.java
+++ b/oauth2_http/java/com/google/auth/mtls/MtlsHttpTransportFactory.java
@@ -32,6 +32,7 @@
 package com.google.auth.mtls;
 
 import com.google.api.client.http.javanet.NetHttpTransport;
+import com.google.api.core.InternalApi;
 import com.google.auth.http.HttpTransportFactory;
 import java.security.GeneralSecurityException;
 import java.security.KeyStore;
@@ -45,6 +46,7 @@
  * <p><b>Warning:</b> This class is considered internal and is not intended for direct use by
  * library consumers. Its API and behavior may change without notice.
  */
+@InternalApi
 public class MtlsHttpTransportFactory implements HttpTransportFactory {
   private final KeyStore mtlsKeyStore;
 
diff --git a/oauth2_http/java/com/google/auth/oauth2/OAuth2Utils.java b/oauth2_http/java/com/google/auth/oauth2/OAuth2Utils.java
index 21278e8b6..7efec082f 100644
--- a/oauth2_http/java/com/google/auth/oauth2/OAuth2Utils.java
+++ b/oauth2_http/java/com/google/auth/oauth2/OAuth2Utils.java
@@ -41,6 +41,7 @@
 import com.google.api.client.util.PemReader;
 import com.google.api.client.util.PemReader.Section;
 import com.google.api.client.util.SecurityUtils;
+import com.google.api.core.InternalApi;
 import com.google.auth.http.AuthHttpConstants;
 import com.google.auth.http.HttpTransportFactory;
 import com.google.common.base.Strings;
@@ -78,6 +79,7 @@
  * com.google.auth} family. Application developers should avoid using these classes directly; they
  * are not part of the public API.
  */
+@InternalApi
 public class OAuth2Utils {
 
   static final String SIGNATURE_ALGORITHM = "SHA256withRSA";