diff --git a/src/main/java/com/google/devtools/build/lib/analysis/starlark/BazelBuildApiGlobals.java b/src/main/java/com/google/devtools/build/lib/analysis/starlark/BazelBuildApiGlobals.java
index f22295a104434d..645b423f02b254 100644
--- a/src/main/java/com/google/devtools/build/lib/analysis/starlark/BazelBuildApiGlobals.java
+++ b/src/main/java/com/google/devtools/build/lib/analysis/starlark/BazelBuildApiGlobals.java
@@ -112,6 +112,11 @@ private void checkVisibilityAllowlist(PackageIdentifier pkgId, List<String> allo
       // TODO(b/22193153): This seems incorrect since parse doesn't take into account any repository
       // map. (This shouldn't matter within Google's monorepo, which doesn't use a repo map.)
       try {
+        // Special constant to disable allowlisting. For migration to enable the feature globally.
+        if (allowedPkgString.equals("everyone")) {
+          foundMatch = true;
+          break;
+        }
         PackageIdentifier allowedPkgId = PackageIdentifier.parse(allowedPkgString);
         if (pkgId.equals(allowedPkgId)) {
           foundMatch = true;
diff --git a/src/main/java/com/google/devtools/build/lib/packages/semantics/BuildLanguageOptions.java b/src/main/java/com/google/devtools/build/lib/packages/semantics/BuildLanguageOptions.java
index 4da8f8ab1bee74..d7e4f855e16283 100644
--- a/src/main/java/com/google/devtools/build/lib/packages/semantics/BuildLanguageOptions.java
+++ b/src/main/java/com/google/devtools/build/lib/packages/semantics/BuildLanguageOptions.java
@@ -147,7 +147,8 @@ public final class BuildLanguageOptions extends OptionsBase {
           "A comma-separated list of packages (sans \"//\") which, if --experimental_bzl_visibility"
               + " is enabled, are permitted to contain .bzl files that set a bzl-visibility by"
               + " calling the `visibility()` function. (Known issue: This flag may not work"
-              + " correctly in the presence of repository remapping, which is used by bzlmod.)")
+              + " correctly in the presence of repository remapping, which is used by bzlmod.)"
+              + " If the list includes the special item \"everyone\", all packages are permitted.")
   public List<String> experimentalBzlVisibilityAllowlist;
 
   @Option(
diff --git a/src/main/java/com/google/devtools/build/lib/starlarkbuildapi/StarlarkBuildApiGlobals.java b/src/main/java/com/google/devtools/build/lib/starlarkbuildapi/StarlarkBuildApiGlobals.java
index 34bfeba15c85d3..dd3404ec534cdf 100644
--- a/src/main/java/com/google/devtools/build/lib/starlarkbuildapi/StarlarkBuildApiGlobals.java
+++ b/src/main/java/com/google/devtools/build/lib/starlarkbuildapi/StarlarkBuildApiGlobals.java
@@ -43,7 +43,7 @@ public interface StarlarkBuildApiGlobals {
               + "<li>a list of package paths (e.g. <code>[\"//pkg1\", \"//pkg2/subpkg\","
               + " ...]</code>): the .bzl can be loaded by files in any of the listed packages. Only"
               + " packages in the current repository may be specified; the repository \"@\" syntax"
-              + " is disallowed."
+              + " is disallowed. Subpackage globs (<code>\"//pkg/...\"</code>) are not supported."
               + "</ul>"
               + "<p>Generally, <code>visibility()</code> is called at the top of the .bzl file,"
               + " immediately after its <code>load()</code> statements. (It is poor style to put"
@@ -59,8 +59,8 @@ public interface StarlarkBuildApiGlobals {
             name = "value",
             named = false,
             doc =
-                "The bzl-visibility level to set. May be <code>\"public\"</code> or"
-                    + " <code>\"private\"</code>.")
+                "The bzl-visibility level to set. May be <code>\"public\"</code>,"
+                    + " <code>\"private\"</code>, or a list of packages.")
       },
       // Ordinarily we'd use enableOnlyWithFlag here to gate access on
       // --experimental_bzl_visibility. However, the StarlarkSemantics isn't available at the point
diff --git a/src/test/java/com/google/devtools/build/lib/skyframe/BzlLoadFunctionTest.java b/src/test/java/com/google/devtools/build/lib/skyframe/BzlLoadFunctionTest.java
index 6950384ae648a4..4eea2f0021cecf 100644
--- a/src/test/java/com/google/devtools/build/lib/skyframe/BzlLoadFunctionTest.java
+++ b/src/test/java/com/google/devtools/build/lib/skyframe/BzlLoadFunctionTest.java
@@ -423,6 +423,28 @@ public void testBzlVisibility_disabledWithoutAllowlist() throws Exception {
     assertContainsEvent("`visibility() is not enabled for package //b");
   }
 
+  @Test
+  public void testBzlVisibility_enabledWhenAllowlistDisabled() throws Exception {
+    setBuildLanguageOptions(
+        "--experimental_bzl_visibility=true",
+        // Put unrelated c in allowlist, but not b, to show that "everyone" disables checking when
+        // included as a list item
+        "--experimental_bzl_visibility_allowlist=c,everyone");
+
+    scratch.file("a/BUILD");
+    scratch.file(
+        "a/foo.bzl", //
+        "load(\"//b:bar.bzl\", \"x\")");
+    scratch.file("b/BUILD");
+    scratch.file(
+        "b/bar.bzl", //
+        "visibility(\"public\")",
+        "x = 1");
+
+    checkSuccessfulLookup("//a:foo.bzl");
+    assertNoEvents();
+  }
+
   @Test
   public void testBzlVisibility_malformedAllowlist() throws Exception {
     setBuildLanguageOptions(
@@ -889,7 +911,7 @@ public FileStatus statIfFound(PathFragment path, boolean followSymlinks) throws
     }
 
     @Override
-    protected InputStream getInputStream(PathFragment path) throws IOException {
+    protected synchronized InputStream getInputStream(PathFragment path) throws IOException {
       if (badPathForRead != null && badPathForRead.asFragment().equals(path)) {
         throw new IOException("bad");
       }