diff --git a/setup/mac/binary_distribution/Brewfile b/setup/mac/binary_distribution/Brewfile
index 3293d39c4115..cbcaa7c3be1b 100644
--- a/setup/mac/binary_distribution/Brewfile
+++ b/setup/mac/binary_distribution/Brewfile
@@ -13,7 +13,6 @@ brew 'glib'
 brew 'graphviz'
 brew 'ipopt'
 brew 'jpeg'
-brew 'libtiff'
 brew 'numpy'
 brew 'openblas'
 brew 'pkg-config'
diff --git a/setup/ubuntu/binary_distribution/packages-focal.txt b/setup/ubuntu/binary_distribution/packages-focal.txt
index 5d81bfb17b4d..36acbf188a72 100644
--- a/setup/ubuntu/binary_distribution/packages-focal.txt
+++ b/setup/ubuntu/binary_distribution/packages-focal.txt
@@ -30,7 +30,6 @@ libqt5widgets5
 libspdlog-dev
 libsqlite3-0
 libtheora0
-libtiff5
 libx11-6
 libxml2
 libxt6
diff --git a/setup/ubuntu/binary_distribution/packages-jammy.txt b/setup/ubuntu/binary_distribution/packages-jammy.txt
index 94dac25d4806..899c4e463cb8 100644
--- a/setup/ubuntu/binary_distribution/packages-jammy.txt
+++ b/setup/ubuntu/binary_distribution/packages-jammy.txt
@@ -27,7 +27,6 @@ libqt5widgets5
 libspdlog-dev
 libsqlite3-0
 libtheora0
-libtiff5
 libx11-6
 libxml2
 libxt6
diff --git a/setup/ubuntu/source_distribution/packages-focal.txt b/setup/ubuntu/source_distribution/packages-focal.txt
index 2d2686bffd86..8f8ecd860108 100644
--- a/setup/ubuntu/source_distribution/packages-focal.txt
+++ b/setup/ubuntu/source_distribution/packages-focal.txt
@@ -14,7 +14,6 @@ libjpeg-turbo8-dev
 liblapack-dev
 libmumps-seq-dev
 libopengl-dev
-libtiff-dev
 libtinyxml-dev
 libtool
 libx11-dev
diff --git a/setup/ubuntu/source_distribution/packages-jammy.txt b/setup/ubuntu/source_distribution/packages-jammy.txt
index 0596ffe141f5..5f64d8534d19 100644
--- a/setup/ubuntu/source_distribution/packages-jammy.txt
+++ b/setup/ubuntu/source_distribution/packages-jammy.txt
@@ -13,7 +13,6 @@ libjpeg-turbo8-dev
 liblapack-dev
 libmumps-seq-dev
 libopengl-dev
-libtiff-dev
 libtinyxml-dev
 libtool
 libx11-dev
diff --git a/tools/wheel/image/dependencies/projects.cmake b/tools/wheel/image/dependencies/projects.cmake
index c13d8b66ddd9..ce2392e8dfd8 100644
--- a/tools/wheel/image/dependencies/projects.cmake
+++ b/tools/wheel/image/dependencies/projects.cmake
@@ -19,27 +19,12 @@ set(bzip2_url "https://sourceware.org/pub/bzip2/bzip2-${bzip2_version}.tar.gz")
 set(bzip2_md5 "67e051268d0c475ea773822f7500d0e5")
 list(APPEND ALL_PROJECTS bzip2)
 
-# xz
-set(xz_version 5.2.5)
-set(xz_url "https://drake-mirror.csail.mit.edu/other/xz/xz-${xz_version}.tar.gz")
-set(xz_md5 "0d270c997aff29708c74d53f599ef717")
-list(APPEND ALL_PROJECTS xz)
-
 # libjpeg-turbo
 set(libjpeg-turbo_version 2.1.4)
 set(libjpeg-turbo_url "https://github.com/libjpeg-turbo/libjpeg-turbo/archive/refs/tags/${libjpeg-turbo_version}.tar.gz")
 set(libjpeg-turbo_md5 "357dc26a802c34387512a42697846d16")
 list(APPEND ALL_PROJECTS libjpeg-turbo)
 
-# TODO(jwnimmer-tri) When we purge `libtiff`, we can also purge `xz`, above.
-# The only user of `xz` is `libtiff`.
-#
-# libtiff
-set(libtiff_version 4.1.0)
-set(libtiff_url "http://download.osgeo.org/libtiff/tiff-${libtiff_version}.tar.gz")
-set(libtiff_md5 "2165e7aba557463acc0664e71a3ed424")
-list(APPEND ALL_PROJECTS libtiff)
-
 # eigen
 if(APPLE)
     # This version mimics homebrew.
diff --git a/tools/wheel/image/dependencies/projects/libtiff.cmake b/tools/wheel/image/dependencies/projects/libtiff.cmake
deleted file mode 100644
index e21140d2e547..000000000000
--- a/tools/wheel/image/dependencies/projects/libtiff.cmake
+++ /dev/null
@@ -1,23 +0,0 @@
-ExternalProject_Add(libtiff
-    DEPENDS zlib xz libjpeg-turbo
-    URL ${libtiff_url}
-    URL_MD5 ${libtiff_md5}
-    ${COMMON_EP_ARGS}
-    ${COMMON_CMAKE_EP_ARGS}
-    CMAKE_ARGS
-        ${COMMON_CMAKE_ARGS}
-        -DJPEG_INCLUDE_DIR=${CMAKE_INSTALL_PREFIX}/include
-        -DJPEG_LIBRARY=${CMAKE_INSTALL_PREFIX}/lib/libjpeg.a
-        -DLIBLZMA_INCLUDE_DIR=${CMAKE_INSTALL_PREFIX}/include
-        -DLIBLZMA_LIBRARY=${CMAKE_INSTALL_PREFIX}/lib/liblzma.a
-        -DZLIB_INCLUDE_DIR=${CMAKE_INSTALL_PREFIX}/include
-        -DZLIB_LIBRARY_DEBUG=${CMAKE_INSTALL_PREFIX}/lib/libz.a
-        -DZLIB_LIBRARY_RELEASE=${CMAKE_INSTALL_PREFIX}/lib/libz.a
-        -Djbig:BOOLEAN=OFF
-        -Dwebp:BOOLEAN=OFF
-        -Dzstd:BOOLEAN=OFF
-        )
-
-extract_license(libtiff
-    COPYRIGHT
-)
diff --git a/tools/wheel/image/dependencies/projects/xz.cmake b/tools/wheel/image/dependencies/projects/xz.cmake
deleted file mode 100644
index bec229a334c4..000000000000
--- a/tools/wheel/image/dependencies/projects/xz.cmake
+++ /dev/null
@@ -1,16 +0,0 @@
-ExternalProject_Add(xz
-    URL ${xz_url}
-    URL_MD5 ${xz_md5}
-    ${COMMON_EP_ARGS}
-    BUILD_IN_SOURCE 1
-    CONFIGURE_COMMAND ./configure
-        --prefix=${CMAKE_INSTALL_PREFIX}
-        --disable-shared
-        CFLAGS=-fPIC
-        CXXFLAGS=-fPIC
-    BUILD_COMMAND make
-    INSTALL_COMMAND make install
-    )
-
-# Note: Although various utilities are under [L]GPL, we only use liblzma, which
-# is Public Domain.
diff --git a/tools/workspace/BUILD.bazel b/tools/workspace/BUILD.bazel
index 5021f7566a17..911f71715ab8 100644
--- a/tools/workspace/BUILD.bazel
+++ b/tools/workspace/BUILD.bazel
@@ -90,6 +90,7 @@ _DRAKE_EXTERNAL_PACKAGE_INSTALLS = ["@%s//:install" % p for p in [
     "ipopt",
     "lcm",
     "libpng_internal",
+    "libtiff_internal",
     "meshcat",
     "msgpack_internal",
     "net_sf_jchart2d",
diff --git a/tools/workspace/default.bzl b/tools/workspace/default.bzl
index 1321693c4547..798e092fe33d 100644
--- a/tools/workspace/default.bzl
+++ b/tools/workspace/default.bzl
@@ -59,6 +59,7 @@ load("//tools/workspace/libpfm:repository.bzl", "libpfm_repository")
 load("//tools/workspace/libpng:repository.bzl", "libpng_repository")
 load("//tools/workspace/libpng_internal:repository.bzl", "libpng_internal_repository")  # noqa
 load("//tools/workspace/libtiff:repository.bzl", "libtiff_repository")
+load("//tools/workspace/libtiff_internal:repository.bzl", "libtiff_internal_repository")  # noqa
 load("//tools/workspace/meshcat:repository.bzl", "meshcat_repository")
 load("//tools/workspace/mosek:repository.bzl", "mosek_repository")
 load("//tools/workspace/msgpack_internal:repository.bzl", "msgpack_internal_repository")  # noqa
@@ -264,7 +265,11 @@ def add_default_repositories(excludes = [], mirrors = DEFAULT_MIRRORS):
     if "libpng_internal" not in excludes:
         libpng_internal_repository(name = "libpng_internal", mirrors = mirrors)
     if "libtiff" not in excludes:
+        # The @libtiff external is deprecated in Drake's WORKSPACE and will be
+        # removed on or after 2024-02-01.
         libtiff_repository(name = "libtiff")
+    if "libtiff_internal" not in excludes:
+        libtiff_internal_repository(name = "libtiff_internal", mirrors = mirrors)  # noqa
     if "meshcat" not in excludes:
         meshcat_repository(name = "meshcat", mirrors = mirrors)
     if "mosek" not in excludes:
diff --git a/tools/workspace/libtiff/repository.bzl b/tools/workspace/libtiff/repository.bzl
index d39b6fced45b..310d462ea725 100644
--- a/tools/workspace/libtiff/repository.bzl
+++ b/tools/workspace/libtiff/repository.bzl
@@ -12,5 +12,6 @@ def libtiff_repository(
         licenses = licenses,
         modname = modname,
         pkg_config_paths = pkg_config_paths,
+        extra_deprecation = "The @libtiff external is deprecated in Drake's WORKSPACE and will be removed on or after 2024-02-01.",  # noqa
         **kwargs
     )
diff --git a/tools/workspace/libtiff_internal/BUILD.bazel b/tools/workspace/libtiff_internal/BUILD.bazel
new file mode 100644
index 000000000000..67914ea7e0a0
--- /dev/null
+++ b/tools/workspace/libtiff_internal/BUILD.bazel
@@ -0,0 +1,3 @@
+load("//tools/lint:lint.bzl", "add_lint_tests")
+
+add_lint_tests()
diff --git a/tools/workspace/libtiff_internal/package.BUILD.bazel b/tools/workspace/libtiff_internal/package.BUILD.bazel
new file mode 100644
index 000000000000..6d7cf0dce101
--- /dev/null
+++ b/tools/workspace/libtiff_internal/package.BUILD.bazel
@@ -0,0 +1,162 @@
+# -*- bazel -*-
+
+load("@drake//tools/install:install.bzl", "install")
+load("@drake//tools/skylark:cc.bzl", "cc_library")
+load(
+    "@drake//tools/workspace:cmake_configure_file.bzl",
+    "cmake_configure_files",
+)
+
+licenses(["notice"])  # libtiff
+
+package(default_visibility = ["//visibility:private"])
+
+_CONFIG_HDRS = [
+    "libtiff/tif_config.h",
+    "libtiff/tiffconf.h",
+    "libtiff/tiffvers.h",
+]
+
+cmake_configure_files(
+    name = "_config_hdrs",
+    srcs = [x + ".cmake.in" for x in _CONFIG_HDRS],
+    outs = _CONFIG_HDRS,
+    defines = [
+        # From configure.ac.
+        "LIBTIFF_VERSION=4.6.0",
+        "LIBTIFF_MAJOR_VERSION=4",
+        "LIBTIFF_MINOR_VERSION=6",
+        "LIBTIFF_MICRO_VERSION=0",
+        # From RELEASE-DATE.
+        "LIBTIFF_RELEASE_DATE=20230908",
+        # Opt-in to compression algorithms that we do want. These are the
+        # built-in algorithms (i.e., no external dependencies) that are
+        # plausible to use on Drake's depth camera images (which are the
+        # only place we use TIFF images).
+        "LOGLUV_SUPPORT=1",
+        "LZW_SUPPORT=1",
+        "PACKBITS_SUPPORT=1",
+        "ZIP_SUPPORT=1",
+        # This is a no-op in tiff 4.6.0, but in case it's ever not a no-op we
+        # should probably leave it enabled.
+        "SUBIFD_SUPPORT=1",
+        # Match the upstream defaults.
+        "DEFAULT_EXTRASAMPLE_AS_ALPHA=1",
+        "STRIPCHOP_DEFAULT=1",
+        "STRIP_SIZE_DEFAULT=8192",
+        # Drake doesn't use directory searching.
+        "TIFF_MAX_DIR_COUNT=1",
+        # Our standard library is just fine, thanks.
+        "TIFF_INT8_T=int8_t",
+        "TIFF_INT16_T=int16_t",
+        "TIFF_INT32_T=int32_t",
+        "TIFF_INT64_T=int64_t",
+        "TIFF_UINT8_T=uint8_t",
+        "TIFF_UINT16_T=uint16_t",
+        "TIFF_UINT32_T=uint32_t",
+        "TIFF_UINT64_T=uint64_t",
+        "TIFF_SSIZE_T=ptrdiff_t",
+        # Drake only supports 64-bit, little-endian hardware.
+        "HOST_BIG_ENDIAN=0",
+        "SIZEOF_SIZE_T=8",
+        # Platform stuff.
+        "HAVE_ASSERT_H=1",
+        "HAVE_FCNTL_H=1",
+        "HAVE_FSEEKO=1",
+        "HAVE_IEEEFP=1",
+        "HAVE_MMAP=1",
+        "HAVE_STRINGS_H=1",
+        "HAVE_SYS_TYPES_H=1",
+        "HAVE_UNISTD_H=1",
+    ],
+    undefines = [
+        # Platform stuff that we don't have or don't want.
+        "CXX_SUPPORT",
+        "HAVE_IO_H",
+        "HAVE_SETMODE",
+        "USE_WIN32_FILEIO",
+        # Opt-out of useless compression algorithms.
+        "CCITT_SUPPORT",
+        "MDI_SUPPORT",
+        "NEXT_SUPPORT",
+        "OJPEG_SUPPORT",
+        "PIXARLOG_SUPPORT",
+        "THUNDER_SUPPORT",
+        # Opt-out of compression algorithms that require external libraries.
+        "HAVE_JBG_NEWLEN",
+        "JBIG_SUPPORT",
+        "LERC_SUPPORT",
+        "LIBDEFLATE_SUPPORT",
+        "LIBJPEG_12_PATH",
+        "LZMA_SUPPORT",
+        "WEBP_SUPPORT",
+        "ZSTD_SUPPORT",
+        # Opt-out of JPEG support. We don't want lossy compression.
+        "CHECK_JPEG_YCBCR_SUBSAMPLING",
+        "CHUNKY_STRIP_READ_SUPPORT",
+        "JPEG_DUAL_MODE_8_12",
+        "JPEG_SUPPORT",
+        # Match the upstream defaults.
+        "DEFER_STRILE_LOAD",
+        # Dead code (unused).
+        "PACKAGE_BUGREPORT",
+        "PACKAGE_NAME",
+        "PACKAGE_TARNAME",
+        "PACKAGE_URL",
+        # We don't use the getopt-based tools.
+        "HAVE_GETOPT",
+        "HAVE_DECL_OPTARG",
+        # Ignore stray @VAR@ in comments.
+        "VAR",
+    ],
+    strict = True,
+)
+
+_PUBLIC_HDRS = [
+    "libtiff/tiff.h",
+    "libtiff/tiffio.h",
+    ":libtiff/tiffvers.h",
+    ":libtiff/tiffconf.h",
+]
+
+_PRIVATE_HDRS = [
+    "libtiff/t4.h",
+    "libtiff/tif_dir.h",
+    "libtiff/tif_fax3.h",
+    "libtiff/tif_hash_set.h",
+    "libtiff/tif_predict.h",
+    "libtiff/tiffiop.h",
+    "libtiff/uvcode.h",
+    ":libtiff/tif_config.h",
+]
+
+_SRCS = glob(
+    [
+        "libtiff/tif*.c",
+    ],
+    exclude = [
+        "**/*win32*",
+    ],
+)
+
+cc_library(
+    name = "libtiff",
+    hdrs = _PUBLIC_HDRS,
+    srcs = _SRCS + _PRIVATE_HDRS,
+    includes = ["libtiff"],
+    copts = [
+        "-fvisibility=hidden",
+        "-w",
+    ],
+    linkstatic = True,
+    deps = [
+        "@zlib",
+    ],
+    visibility = ["//visibility:public"],
+)
+
+install(
+    name = "install",
+    docs = ["LICENSE.md"],
+    visibility = ["//visibility:public"],
+)
diff --git a/tools/workspace/libtiff_internal/repository.bzl b/tools/workspace/libtiff_internal/repository.bzl
new file mode 100644
index 000000000000..4ab47639d1d6
--- /dev/null
+++ b/tools/workspace/libtiff_internal/repository.bzl
@@ -0,0 +1,19 @@
+load("//tools/workspace:github.bzl", "github_archive")
+
+def libtiff_internal_repository(
+        name,
+        mirrors = None):
+    github_archive(
+        name = name,
+        # N.B. Upstream is https://gitlab.com/libtiff/libtiff but this github
+        # mirror seems to be kept up to date.
+        repository = "libsdl-org/libtiff",
+        upgrade_advice = """
+        The package.BUILD.bazel file hard-codes the version number and release
+        date; be sure to update those to match the new commit.
+        """,
+        commit = "v4.6.0",
+        sha256 = "c760de148e0b2ceec115dd5afa660e91617aac4a94da997aa8a8fc2a58f1d378",  # noqa
+        build_file = ":package.BUILD.bazel",
+        mirrors = mirrors,
+    )
diff --git a/tools/workspace/vtk_internal/settings.bzl b/tools/workspace/vtk_internal/settings.bzl
index 7890650649e2..f10380bf2de0 100644
--- a/tools/workspace/vtk_internal/settings.bzl
+++ b/tools/workspace/vtk_internal/settings.bzl
@@ -558,10 +558,7 @@ MODULE_SETTINGS = {
             "VTK_MODULE_USE_EXTERNAL_vtktiff=1",
         ],
         "deps_extra": [
-            # TODO(jwnimmer-tri) VTK is the only user of this library.
-            # We should write our own WORKSPACE rule to build it sensibly,
-            # or switch to VTK's vendored version.
-            "@libtiff",
+            "@libtiff_internal//:libtiff",
         ],
     },
     "VTK::zlib": {