diff --git a/CMakeLists.txt b/CMakeLists.txt
index 2b7737146d..520a96efdc 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -271,6 +271,8 @@ else()
   try_append_c_flags(-Wundef)
 endif()
 
+set(CMAKE_C_VISIBILITY_PRESET hidden)
+
 set(print_msan_notice)
 if(SECP256K1_BUILD_CTIME_TESTS)
   include(CheckMemorySanitizer)
diff --git a/configure.ac b/configure.ac
index 406227fcd1..71df0e3d08 100644
--- a/configure.ac
+++ b/configure.ac
@@ -45,6 +45,7 @@ AS_UNSET(ac_cv_prog_AR)
 AS_UNSET(ac_cv_prog_ac_ct_AR)
 LT_INIT([win32-dll])
 
+SECP_CONFIG_DEFINES="$SECP_CONFIG_DEFINES -DSECP256K1_AUTOTOOLS_BUILD=1"
 build_windows=no
 
 case $host_os in
@@ -111,6 +112,7 @@ AC_DEFUN([SECP_TRY_APPEND_DEFAULT_CFLAGS], [
       SECP_TRY_APPEND_CFLAGS([-Wcast-align=strict], $1) # GCC >= 8.0
       SECP_TRY_APPEND_CFLAGS([-Wconditional-uninitialized], $1) # Clang >= 3.0 only
       SECP_TRY_APPEND_CFLAGS([-Wreserved-identifier], $1) # Clang >= 13.0 only
+      SECP_TRY_APPEND_CFLAGS([-fvisibility=hidden], $1) # GCC >= 4.0
 
       CFLAGS="$SECP_TRY_APPEND_DEFAULT_CFLAGS_saved_CFLAGS"
     fi
diff --git a/include/secp256k1.h b/include/secp256k1.h
index 1d25a02ab2..bd051729e4 100644
--- a/include/secp256k1.h
+++ b/include/secp256k1.h
@@ -129,10 +129,11 @@ typedef int (*secp256k1_nonce_function)(
    * Attributes" in the GCC manual and the recommendations in
    * https://gcc.gnu.org/wiki/Visibility. */
 # if defined(SECP256K1_BUILD)
-#  if defined(DLL_EXPORT) || defined(SECP256K1_DLL_EXPORT)
+#  if defined(DLL_EXPORT) || defined(SECP256K1_CMAKE_SHARED_BUILD) || defined(SECP256K1_DLL_EXPORT)
     /* Building libsecp256k1 as a DLL.
      * 1. If using Libtool, it defines DLL_EXPORT automatically.
-     * 2. In other cases, SECP256K1_DLL_EXPORT must be defined. */
+     * 2. If using CMake, it defines SECP256K1_CMAKE_SHARED_BUILD automatically.
+     * 3. In other cases, SECP256K1_DLL_EXPORT must be defined. */
 #   define SECP256K1_API extern __declspec (dllexport)
 #  else
     /* Building libsecp256k1 as a static library on Windows.
@@ -155,11 +156,16 @@ typedef int (*secp256k1_nonce_function)(
 /* All cases not captured by the Windows-specific logic. */
 # if defined(__GNUC__) && (__GNUC__ >= 4) && defined(SECP256K1_BUILD)
    /* Building libsecp256k1 using GCC or compatible. */
-#  define SECP256K1_API extern __attribute__ ((visibility ("default")))
-# else
+#  if !defined(SECP256K1_NO_EXPORT_SYMBOLS)
+#   if defined(SECP256K1_CMAKE_SHARED_BUILD) || defined(SECP256K1_AUTOTOOLS_BUILD)
+#    define SECP256K1_API extern __attribute__ ((visibility ("default")))
+#   endif
+#  endif
+# endif
+#endif
+#ifndef SECP256K1_API
    /* Fall back to standard C's extern. */
 #  define SECP256K1_API extern
-# endif
 #endif
 
 /* Warning attributes
diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
index f31b8c8f55..d390b44cee 100644
--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
@@ -20,9 +20,9 @@ if(SECP256K1_ASM STREQUAL "arm32")
   target_link_libraries(secp256k1_asm INTERFACE secp256k1_asm_arm)
 endif()
 
+# Define our export symbol only for shared libs.
+set_target_properties(secp256k1 PROPERTIES DEFINE_SYMBOL SECP256K1_CMAKE_SHARED_BUILD)
 if(WIN32)
-  # Define our export symbol only for shared libs.
-  set_target_properties(secp256k1 PROPERTIES DEFINE_SYMBOL SECP256K1_DLL_EXPORT)
   target_compile_definitions(secp256k1 INTERFACE $<$<NOT:$<BOOL:${BUILD_SHARED_LIBS}>>:SECP256K1_STATIC>)
 endif()