diff --git a/examples/hydroelastic/spatula_slip_control/BUILD.bazel b/examples/hydroelastic/spatula_slip_control/BUILD.bazel
index 3eedbe56113e..93bc8dd2f478 100644
--- a/examples/hydroelastic/spatula_slip_control/BUILD.bazel
+++ b/examples/hydroelastic/spatula_slip_control/BUILD.bazel
@@ -6,15 +6,15 @@ load("@drake//tools/lint:lint.bzl", "add_lint_tests")
 load("//tools/install:install_data.bzl", "install_data")
 load("@drake//tools/workspace:forward_files.bzl", "forward_files")
 load(
-    "//tools/workspace/models:files.bzl",
+    "//tools/workspace/models_internal:files.bzl",
     "wsg_50_hydro_bubble_mesh_files",
 )
 
 _WSG_50_HYDRO_BUBBLE_MESHES = forward_files(
-    srcs = ["@models//:" +
+    srcs = ["@models_internal//:" +
             x for x in wsg_50_hydro_bubble_mesh_files()],
     dest_prefix = "",
-    strip_prefix = "@models//:wsg_50_hydro_bubble/",
+    strip_prefix = "@models_internal//:wsg_50_hydro_bubble/",
     visibility = ["//visibility:private"],
 )
 
diff --git a/examples/multibody/strandbeest/BUILD.bazel b/examples/multibody/strandbeest/BUILD.bazel
index 343c21b5575b..da54bc3cc109 100644
--- a/examples/multibody/strandbeest/BUILD.bazel
+++ b/examples/multibody/strandbeest/BUILD.bazel
@@ -3,7 +3,7 @@
 
 load("@drake//tools/skylark:drake_cc.bzl", "drake_cc_binary")
 load("@drake//tools/skylark:drake_py.bzl", "drake_py_unittest")
-load("@drake//tools/workspace/ros_xacro:defs.bzl", "xacro_file")
+load("@drake//tools/workspace/ros_xacro_internal:defs.bzl", "xacro_file")
 load("@drake//tools/lint:lint.bzl", "add_lint_tests")
 
 xacro_file(
diff --git a/examples/quadrotor/BUILD.bazel b/examples/quadrotor/BUILD.bazel
index 407eff395767..844a5d622b8c 100644
--- a/examples/quadrotor/BUILD.bazel
+++ b/examples/quadrotor/BUILD.bazel
@@ -9,7 +9,7 @@ load(
 load("//tools/install:install_data.bzl", "install_data")
 load("//tools/lint:lint.bzl", "add_lint_tests")
 load("//tools/workspace:forward_files.bzl", "forward_files")
-load("//tools/workspace/models:files.bzl", "skydio_2_mesh_files")
+load("//tools/workspace/models_internal:files.bzl", "skydio_2_mesh_files")
 
 package(
     default_visibility = [
@@ -18,9 +18,9 @@ package(
 )
 
 _SKYDIO_2_MESHES = forward_files(
-    srcs = ["@models//:" + x for x in skydio_2_mesh_files()],
+    srcs = ["@models_internal//:" + x for x in skydio_2_mesh_files()],
     dest_prefix = "",
-    strip_prefix = "@models//:skydio_2/",
+    strip_prefix = "@models_internal//:skydio_2/",
     visibility = ["//visibility:private"],
 )
 
diff --git a/geometry/profiling/BUILD.bazel b/geometry/profiling/BUILD.bazel
index c70f8eee725f..f785fe6a4ee7 100644
--- a/geometry/profiling/BUILD.bazel
+++ b/geometry/profiling/BUILD.bazel
@@ -8,9 +8,9 @@ load("//tools/lint:lint.bzl", "add_lint_tests")
 load("@drake//tools/workspace:forward_files.bzl", "forward_files")
 
 _EVO_MESH = forward_files(
-    srcs = ["@models//:dishes/bowls/evo_bowl_no_mtl.obj"],
+    srcs = ["@models_internal//:dishes/bowls/evo_bowl_no_mtl.obj"],
     dest_prefix = "",
-    strip_prefix = "@models//:dishes/bowls/",
+    strip_prefix = "@models_internal//:dishes/bowls/",
     visibility = ["//visibility:private"],
 )
 
diff --git a/manipulation/models/franka_description/BUILD.bazel b/manipulation/models/franka_description/BUILD.bazel
index 8461616e6ff6..445bb3b9ea62 100644
--- a/manipulation/models/franka_description/BUILD.bazel
+++ b/manipulation/models/franka_description/BUILD.bazel
@@ -7,7 +7,10 @@ load(
 load("//tools/install:install_data.bzl", "install_data")
 load("//tools/lint:lint.bzl", "add_lint_tests")
 load("@drake//tools/workspace:forward_files.bzl", "forward_files")
-load("//tools/workspace/models:files.bzl", "franka_description_mesh_files")
+load(
+    "//tools/workspace/models_internal:files.bzl",
+    "franka_description_mesh_files",
+)
 
 # This package is public so that other packages can refer to
 # individual files in model from their bazel rules.
@@ -16,9 +19,12 @@ package(
 )
 
 _FRANKA_DESCRIPTION_MESHES = forward_files(
-    srcs = ["@models//:" + x for x in franka_description_mesh_files()],
+    srcs = [
+        "@models_internal//:" + x
+        for x in franka_description_mesh_files()
+    ],
     dest_prefix = "",
-    strip_prefix = "@models//:franka_description/",
+    strip_prefix = "@models_internal//:franka_description/",
     visibility = ["//visibility:private"],
 )
 
diff --git a/manipulation/models/jaco_description/BUILD.bazel b/manipulation/models/jaco_description/BUILD.bazel
index eee89b6dbb0f..d2a5f625f6a7 100644
--- a/manipulation/models/jaco_description/BUILD.bazel
+++ b/manipulation/models/jaco_description/BUILD.bazel
@@ -7,16 +7,19 @@ load(
 load("//tools/install:install_data.bzl", "install_data")
 load("//tools/lint:lint.bzl", "add_lint_tests")
 load("@drake//tools/workspace:forward_files.bzl", "forward_files")
-load("//tools/workspace/models:files.bzl", "jaco_description_mesh_files")
+load(
+    "//tools/workspace/models_internal:files.bzl",
+    "jaco_description_mesh_files",
+)
 
 package(
     default_visibility = [":__subpackages__"],
 )
 
 _JACO_DESCRIPTION_MESHES = forward_files(
-    srcs = ["@models//:" + x for x in jaco_description_mesh_files()],
+    srcs = ["@models_internal//:" + x for x in jaco_description_mesh_files()],
     dest_prefix = "",
-    strip_prefix = "@models//:jaco_description/",
+    strip_prefix = "@models_internal//:jaco_description/",
     visibility = ["//visibility:private"],
 )
 
diff --git a/manipulation/models/realsense2_description/BUILD.bazel b/manipulation/models/realsense2_description/BUILD.bazel
index 5bffe2a2ccf2..49c61b730958 100644
--- a/manipulation/models/realsense2_description/BUILD.bazel
+++ b/manipulation/models/realsense2_description/BUILD.bazel
@@ -8,7 +8,7 @@ load(
 )
 load("@drake//tools/workspace:forward_files.bzl", "forward_files")
 load(
-    "@drake//tools/workspace/intel_realsense_ros:files.bzl",
+    "@drake//tools/workspace/intel_realsense_ros_internal:files.bzl",
     "realsense2_description_files",
 )
 
@@ -19,10 +19,10 @@ package(
 )
 
 _REALSENSE2_DESCRIPTION_FILES = forward_files(
-    srcs = ["@intel_realsense_ros//:" +
+    srcs = ["@intel_realsense_ros_internal//:" +
             x for x in realsense2_description_files()],
     dest_prefix = "",
-    strip_prefix = "@intel_realsense_ros//:realsense2_description/",
+    strip_prefix = "@intel_realsense_ros_internal//:realsense2_description/",
     visibility = ["//visibility:private"],
 )
 
diff --git a/manipulation/models/wsg_50_description/BUILD.bazel b/manipulation/models/wsg_50_description/BUILD.bazel
index f228c52f5518..dbb7321b29fb 100644
--- a/manipulation/models/wsg_50_description/BUILD.bazel
+++ b/manipulation/models/wsg_50_description/BUILD.bazel
@@ -6,16 +6,22 @@ load(
 load("//tools/install:install_data.bzl", "install_data")
 load("//tools/lint:lint.bzl", "add_lint_tests")
 load("@drake//tools/workspace:forward_files.bzl", "forward_files")
-load("//tools/workspace/models:files.bzl", "wsg_50_description_mesh_files")
+load(
+    "//tools/workspace/models_internal:files.bzl",
+    "wsg_50_description_mesh_files",
+)
 
 package(
     default_visibility = [":__subpackages__"],
 )
 
 _WSG_50_DESCRIPTION_MESHES = forward_files(
-    srcs = ["@models//:" + x for x in wsg_50_description_mesh_files()],
+    srcs = [
+        "@models_internal//:" + x
+        for x in wsg_50_description_mesh_files()
+    ],
     dest_prefix = "",
-    strip_prefix = "@models//:wsg_50_description/",
+    strip_prefix = "@models_internal//:wsg_50_description/",
     visibility = ["//visibility:private"],
 )
 
diff --git a/manipulation/models/ycb/BUILD.bazel b/manipulation/models/ycb/BUILD.bazel
index f50141ebc044..cda4ca2301b6 100644
--- a/manipulation/models/ycb/BUILD.bazel
+++ b/manipulation/models/ycb/BUILD.bazel
@@ -7,7 +7,7 @@ load(
 load("@drake//tools/install:install_data.bzl", "install_data")
 load("//tools/lint:lint.bzl", "add_lint_tests")
 load("@drake//tools/workspace:forward_files.bzl", "forward_files")
-load("//tools/workspace/models:files.bzl", "ycb_mesh_files")
+load("//tools/workspace/models_internal:files.bzl", "ycb_mesh_files")
 
 # This package is public so that other packages can refer to
 # individual files in model from their bazel rules.
@@ -16,9 +16,9 @@ package(
 )
 
 _YCB_MESHES = forward_files(
-    srcs = ["@models//:" + x for x in ycb_mesh_files()],
+    srcs = ["@models_internal//:" + x for x in ycb_mesh_files()],
     dest_prefix = "",
-    strip_prefix = "@models//:ycb/",
+    strip_prefix = "@models_internal//:ycb/",
     visibility = ["//visibility:private"],
 )
 
diff --git a/manipulation/util/show_model.py b/manipulation/util/show_model.py
index e322c06c9aec..2658e38a661c 100644
--- a/manipulation/util/show_model.py
+++ b/manipulation/util/show_model.py
@@ -88,7 +88,7 @@ def add_filename_and_parser_argparse_arguments(args_parser):
         "--find_resource", action="store_true",
         help="Use FindResourceOrThrow to resolve the filename to a Drake "
              "resource. Use this if the supporting data files are a generated "
-             "by Bazel (e.g. the OBJs or PNGs are in @models).")
+             "by Bazel (e.g. the OBJs or PNGs are in @models_internal).")
     args_parser.add_argument(
         "--package_path", type=str, default=None,
         help="Full path to the root package for reading in SDF resources.")
diff --git a/multibody/parsing/BUILD.bazel b/multibody/parsing/BUILD.bazel
index 361de302a9c3..046913d20382 100644
--- a/multibody/parsing/BUILD.bazel
+++ b/multibody/parsing/BUILD.bazel
@@ -9,7 +9,10 @@ load(
 )
 load("//tools/lint:lint.bzl", "add_lint_tests")
 load("@drake//tools/workspace:forward_files.bzl", "forward_files")
-load("//tools/workspace/dm_control:files.bzl", "dm_control_mujoco_files")
+load(
+    "//tools/workspace/dm_control_internal:files.bzl",
+    "dm_control_mujoco_files",
+)
 
 filegroup(
     name = "test_models",
@@ -422,9 +425,9 @@ drake_cc_googletest(
 )
 
 _DM_CONTROL_MUJOCO_FILES = forward_files(
-    srcs = ["@dm_control//:" + x for x in dm_control_mujoco_files()],
+    srcs = ["@dm_control_internal//:" + x for x in dm_control_mujoco_files()],
     dest_prefix = "",
-    strip_prefix = "@dm_control//:",
+    strip_prefix = "@dm_control_internal//:",
     visibility = ["//visibility:private"],
 )
 
diff --git a/tools/release_engineering/BUILD.bazel b/tools/release_engineering/BUILD.bazel
index cee311fbc518..e8d2c349e07d 100644
--- a/tools/release_engineering/BUILD.bazel
+++ b/tools/release_engineering/BUILD.bazel
@@ -17,7 +17,7 @@ drake_py_binary_ubuntu_only(
     name = "relnotes",
     srcs = ["relnotes.py"],
     deps = [
-        "@github3_py",
+        "@github3_py_internal//:github3_py",
     ],
 )
 
diff --git a/tools/workspace/BUILD.bazel b/tools/workspace/BUILD.bazel
index 27f05d04e10d..647a178be129 100644
--- a/tools/workspace/BUILD.bazel
+++ b/tools/workspace/BUILD.bazel
@@ -40,7 +40,7 @@ drake_py_binary(
     visibility = ["//visibility:private"],
     deps = [
         ":module_py",
-        "@github3_py",
+        "@github3_py_internal//:github3_py",
     ],
 )
 
diff --git a/tools/workspace/README.md b/tools/workspace/README.md
index 786363323789..57d9a2383e73 100644
--- a/tools/workspace/README.md
+++ b/tools/workspace/README.md
@@ -26,6 +26,10 @@ Drake is using:
   https://docs.bazel.build/versions/master/be/workspace.html
   https://docs.bazel.build/versions/master/skylark/repository_rules.html
 
+Per the [Stability Guidelines](https://drake.mit.edu/stable.html), externals
+named as "internal" or otherwise documented to be "internal use only" are
+not subject to any deprecation guarantees.
+
 # Semi-automated monthly upgrades
 
 Drake maintainers will use the ``bazel-bin/tools/workspace/new_release`` tool
@@ -222,6 +226,13 @@ difficult to support on multiple platforms.
 TODO(jwnimmer-tri) Add documentation here about how to validate that the new
 software's license is acceptable to use within Drake.
 
+When adding a new external, decide whether it will be covered by our
+[Stability Guidelines](https://drake.mit.edu/stable.html). Broadly speaking,
+dependencies that come from the host operating system can be covered as
+stable, but dependencies that we compile from source code should be internal.
+If the new dependency should be in internal, name it like "foo_internal" (not
+just "foo") throughout all of the below.
+
 Referring to some new third-party software as "foo", the steps to incorporate
 it into Drake are roughly:
 
diff --git a/tools/workspace/clang_cindex_python3/BUILD.bazel b/tools/workspace/clang_cindex_python3_internal/BUILD.bazel
similarity index 100%
rename from tools/workspace/clang_cindex_python3/BUILD.bazel
rename to tools/workspace/clang_cindex_python3_internal/BUILD.bazel
diff --git a/tools/workspace/clang_cindex_python3/package.BUILD.bazel b/tools/workspace/clang_cindex_python3_internal/package.BUILD.bazel
similarity index 100%
rename from tools/workspace/clang_cindex_python3/package.BUILD.bazel
rename to tools/workspace/clang_cindex_python3_internal/package.BUILD.bazel
diff --git a/tools/workspace/clang_cindex_python3/repository.bzl b/tools/workspace/clang_cindex_python3_internal/repository.bzl
similarity index 85%
rename from tools/workspace/clang_cindex_python3/repository.bzl
rename to tools/workspace/clang_cindex_python3_internal/repository.bzl
index ccdf81c04e44..97b1a05661a6 100644
--- a/tools/workspace/clang_cindex_python3/repository.bzl
+++ b/tools/workspace/clang_cindex_python3_internal/repository.bzl
@@ -2,7 +2,7 @@
 
 load("@drake//tools/workspace:github.bzl", "github_archive")
 
-def clang_cindex_python3_repository(
+def clang_cindex_python3_internal_repository(
         name,
         mirrors = None):
     github_archive(
@@ -10,7 +10,7 @@ def clang_cindex_python3_repository(
         repository = "wjakob/clang-cindex-python3",
         commit = "9dcf4f16757c9b6446910e4de51ed27ee962b81b",
         sha256 = "65c26ec7fe09c54479ce5f375ccd5dd11e4e8bb11e47681c254be0d9bcd79164",  # noqa
-        build_file = "@drake//tools/workspace/clang_cindex_python3:package.BUILD.bazel",  # noqa
+        build_file = "@drake//tools/workspace/clang_cindex_python3_internal:package.BUILD.bazel",  # noqa
         mirrors = mirrors,
         patch_cmds = ["mkdir clang && mv *.py clang"],
     )
diff --git a/tools/workspace/default.bzl b/tools/workspace/default.bzl
index 3297231bbc26..15186443b4d1 100644
--- a/tools/workspace/default.bzl
+++ b/tools/workspace/default.bzl
@@ -11,7 +11,7 @@ load("@drake//tools/workspace/buildifier:repository.bzl", "buildifier_repository
 load("@drake//tools/workspace/cc:repository.bzl", "cc_repository")
 load("@drake//tools/workspace/ccd:repository.bzl", "ccd_repository")
 load("@drake//tools/workspace/cds:repository.bzl", "cds_repository")
-load("@drake//tools/workspace/clang_cindex_python3:repository.bzl", "clang_cindex_python3_repository")  # noqa
+load("@drake//tools/workspace/clang_cindex_python3_internal:repository.bzl", "clang_cindex_python3_internal_repository")  # noqa
 load("@drake//tools/workspace/clp:repository.bzl", "clp_repository")
 load("@drake//tools/workspace/com_jidesoft_jide_oss:repository.bzl", "com_jidesoft_jide_oss_repository")  # noqa
 load("@drake//tools/workspace/common_robotics_utilities:repository.bzl", "common_robotics_utilities_repository")  # noqa
@@ -20,7 +20,7 @@ load("@drake//tools/workspace/conex:repository.bzl", "conex_repository")
 load("@drake//tools/workspace/csdp:repository.bzl", "csdp_repository")
 load("@drake//tools/workspace/double_conversion:repository.bzl", "double_conversion_repository")  # noqa
 load("@drake//tools/workspace/doxygen:repository.bzl", "doxygen_repository")
-load("@drake//tools/workspace/dm_control:repository.bzl", "dm_control_repository")  # noqa
+load("@drake//tools/workspace/dm_control_internal:repository.bzl", "dm_control_internal_repository")  # noqa
 load("@drake//tools/workspace/drake_visualizer:repository.bzl", "drake_visualizer_repository")  # noqa
 load("@drake//tools/workspace/dreal:repository.bzl", "dreal_repository")
 load("@drake//tools/workspace/eigen:repository.bzl", "eigen_repository")
@@ -30,7 +30,7 @@ load("@drake//tools/workspace/fmt:repository.bzl", "fmt_repository")
 load("@drake//tools/workspace/gflags:repository.bzl", "gflags_repository")
 load("@drake//tools/workspace/gfortran:repository.bzl", "gfortran_repository")
 load("@drake//tools/workspace/ghc_filesystem:repository.bzl", "ghc_filesystem_repository")  # noqa
-load("@drake//tools/workspace/github3_py:repository.bzl", "github3_py_repository")  # noqa
+load("@drake//tools/workspace/github3_py_internal:repository.bzl", "github3_py_internal_repository")  # noqa
 load("@drake//tools/workspace/glew:repository.bzl", "glew_repository")
 load("@drake//tools/workspace/glib:repository.bzl", "glib_repository")
 load("@drake//tools/workspace/glx:repository.bzl", "glx_repository")
@@ -40,7 +40,7 @@ load("@drake//tools/workspace/gurobi:repository.bzl", "gurobi_repository")
 load("@drake//tools/workspace/gz_math_internal:repository.bzl", "gz_math_internal_repository")  # noqa
 load("@drake//tools/workspace/gz_utils_internal:repository.bzl", "gz_utils_internal_repository")  # noqa
 load("@drake//tools/workspace/ibex:repository.bzl", "ibex_repository")
-load("@drake//tools/workspace/intel_realsense_ros:repository.bzl", "intel_realsense_ros_repository")  # noqa
+load("@drake//tools/workspace/intel_realsense_ros_internal:repository.bzl", "intel_realsense_ros_internal_repository")  # noqa
 load("@drake//tools/workspace/ipopt:repository.bzl", "ipopt_repository")
 load("@drake//tools/workspace/json:repository.bzl", "json_repository")
 load("@drake//tools/workspace/lapack:repository.bzl", "lapack_repository")
@@ -56,7 +56,7 @@ load("@drake//tools/workspace/libpng:repository.bzl", "libpng_repository")
 load("@drake//tools/workspace/libtiff:repository.bzl", "libtiff_repository")
 load("@drake//tools/workspace/meshcat:repository.bzl", "meshcat_repository")
 load("@drake//tools/workspace/meshcat_python:repository.bzl", "meshcat_python_repository")  # noqa
-load("@drake//tools/workspace/models:repository.bzl", "models_repository")
+load("@drake//tools/workspace/models_internal:repository.bzl", "models_internal_repository")  # noqa
 load("@drake//tools/workspace/mosek:repository.bzl", "mosek_repository")
 load("@drake//tools/workspace/msgpack:repository.bzl", "msgpack_repository")
 load("@drake//tools/workspace/net_sf_jchart2d:repository.bzl", "net_sf_jchart2d_repository")  # noqa
@@ -76,7 +76,7 @@ load("@drake//tools/workspace/pygame_py:repository.bzl", "pygame_py_repository")
 load("@drake//tools/workspace/python:repository.bzl", "python_repository")
 load("@drake//tools/workspace/qdldl:repository.bzl", "qdldl_repository")
 load("@drake//tools/workspace/qhull_internal:repository.bzl", "qhull_internal_repository")  # noqa
-load("@drake//tools/workspace/ros_xacro:repository.bzl", "ros_xacro_repository")  # noqa
+load("@drake//tools/workspace/ros_xacro_internal:repository.bzl", "ros_xacro_internal_repository")  # noqa
 load("@drake//tools/workspace/rules_pkg:repository.bzl", "rules_pkg_repository")  # noqa
 load("@drake//tools/workspace/rules_python:repository.bzl", "rules_python_repository")  # noqa
 load("@drake//tools/workspace/scs:repository.bzl", "scs_repository")
@@ -88,7 +88,7 @@ load("@drake//tools/workspace/styleguide:repository.bzl", "styleguide_repository
 load("@drake//tools/workspace/suitesparse:repository.bzl", "suitesparse_repository")  # noqa
 load("@drake//tools/workspace/tinyobjloader:repository.bzl", "tinyobjloader_repository")  # noqa
 load("@drake//tools/workspace/tinyxml2:repository.bzl", "tinyxml2_repository")
-load("@drake//tools/workspace/uritemplate_py:repository.bzl", "uritemplate_py_repository")  # noqa
+load("@drake//tools/workspace/uritemplate_py_internal:repository.bzl", "uritemplate_py_internal_repository")  # noqa
 load("@drake//tools/workspace/usockets:repository.bzl", "usockets_repository")  # noqa
 load("@drake//tools/workspace/uwebsockets:repository.bzl", "uwebsockets_repository")  # noqa
 load("@drake//tools/workspace/voxelized_geometry_tools:repository.bzl", "voxelized_geometry_tools_repository")  # noqa
@@ -126,7 +126,13 @@ def add_default_repositories(excludes = [], mirrors = DEFAULT_MIRRORS):
     if "cds" not in excludes:
         cds_repository(name = "cds", mirrors = mirrors)
     if "clang_cindex_python3" not in excludes:
-        clang_cindex_python3_repository(name = "clang_cindex_python3", mirrors = mirrors)  # noqa
+        add_deprecation(
+            name = "clang_cindex_python3",
+            date = "2022-10-01",
+            py_aliases = {"clang": "@clang_cindex_python3_internal//:clang"},
+        )
+    if "clang_cindex_python3_internal" not in excludes:
+        clang_cindex_python3_internal_repository(name = "clang_cindex_python3_internal", mirrors = mirrors)  # noqa
     if "clp" not in excludes:
         clp_repository(name = "clp")
     if "com_jidesoft_jide_oss" not in excludes:
@@ -144,7 +150,12 @@ def add_default_repositories(excludes = [], mirrors = DEFAULT_MIRRORS):
     if "doxygen" not in excludes:
         doxygen_repository(name = "doxygen", mirrors = mirrors)
     if "dm_control" not in excludes:
-        dm_control_repository(name = "dm_control", mirrors = mirrors)
+        add_deprecation(
+            name = "dm_control",
+            date = "2022-10-01",
+        )
+    if "dm_control_internal" not in excludes:
+        dm_control_internal_repository(name = "dm_control_internal", mirrors = mirrors)  # noqa
     if "drake_detected_os" not in excludes:
         os_repository(name = "drake_detected_os")
     if "drake_visualizer" not in excludes:
@@ -166,7 +177,13 @@ def add_default_repositories(excludes = [], mirrors = DEFAULT_MIRRORS):
     if "ghc_filesystem" not in excludes:
         ghc_filesystem_repository(name = "ghc_filesystem", mirrors = mirrors)
     if "github3_py" not in excludes:
-        github3_py_repository(name = "github3_py", mirrors = mirrors)
+        add_deprecation(
+            name = "github3_py",
+            date = "2022-10-01",
+            py_aliases = {"github3_py": "@github3_py_internal//:github3_py"},
+        )
+    if "github3_py_internal" not in excludes:
+        github3_py_internal_repository(name = "github3_py_internal", mirrors = mirrors)  # noqa
     if "glew" not in excludes:
         glew_repository(name = "glew")
     if "glib" not in excludes:
@@ -198,7 +215,12 @@ def add_default_repositories(excludes = [], mirrors = DEFAULT_MIRRORS):
             cc_aliases = {"ignition_utils": "@gz_utils_internal//:gz_utils"},
         )
     if "intel_realsense_ros" not in excludes:
-        intel_realsense_ros_repository(name = "intel_realsense_ros", mirrors = mirrors)  # noqa
+        add_deprecation(
+            name = "intel_realsense_ros",
+            date = "2022-10-01",
+        )
+    if "intel_realsense_ros_internal" not in excludes:
+        intel_realsense_ros_internal_repository(name = "intel_realsense_ros_internal", mirrors = mirrors)  # noqa
     if "ipopt" not in excludes:
         ipopt_repository(name = "ipopt")
     if "json" not in excludes:
@@ -230,7 +252,12 @@ def add_default_repositories(excludes = [], mirrors = DEFAULT_MIRRORS):
     if "meshcat_python" not in excludes:
         meshcat_python_repository(name = "meshcat_python", mirrors = mirrors)
     if "models" not in excludes:
-        models_repository(name = "models", mirrors = mirrors)
+        add_deprecation(
+            name = "models",
+            date = "2022-10-01",
+        )
+    if "models_internal" not in excludes:
+        models_internal_repository(name = "models_internal", mirrors = mirrors)
     if "mosek" not in excludes:
         mosek_repository(name = "mosek")
     if "msgpack" not in excludes:
@@ -276,7 +303,13 @@ def add_default_repositories(excludes = [], mirrors = DEFAULT_MIRRORS):
     if "qhull_internal" not in excludes:
         qhull_internal_repository(name = "qhull_internal", mirrors = mirrors)
     if "ros_xacro" not in excludes:
-        ros_xacro_repository(name = "ros_xacro", mirrors = mirrors)
+        add_deprecation(
+            name = "ros_xacro",
+            date = "2022-10-01",
+            aliases = {"xacro": "@ros_xacro_internal//:xacro"},
+        )
+    if "ros_xacro_internal" not in excludes:
+        ros_xacro_internal_repository(name = "ros_xacro_internal", mirrors = mirrors)  # noqa
     if "rules_pkg" not in excludes:
         rules_pkg_repository(name = "rules_pkg", mirrors = mirrors)
     if "rules_python" not in excludes:
@@ -306,7 +339,13 @@ def add_default_repositories(excludes = [], mirrors = DEFAULT_MIRRORS):
     if "tinyxml2" not in excludes:
         tinyxml2_repository(name = "tinyxml2")
     if "uritemplate_py" not in excludes:
-        uritemplate_py_repository(name = "uritemplate_py", mirrors = mirrors)
+        add_deprecation(
+            name = "uritemplate_py",
+            date = "2022-10-01",
+            py_aliases = {"uritemplate_py": "@uritemplate_py_internal//:uritemplate_py"},  # noqa
+        )
+    if "uritemplate_py_internal" not in excludes:
+        uritemplate_py_internal_repository(name = "uritemplate_py_internal", mirrors = mirrors)  # noqa
     if "usockets" not in excludes:
         usockets_repository(name = "usockets", mirrors = mirrors)
     if "uwebsockets" not in excludes:
diff --git a/tools/workspace/deprecation.bzl b/tools/workspace/deprecation.bzl
index 91aeb68ebe5e..73e0846ec35a 100644
--- a/tools/workspace/deprecation.bzl
+++ b/tools/workspace/deprecation.bzl
@@ -4,6 +4,8 @@ def _impl(repo_ctx):
     name = repo_ctx.attr.name
     date = repo_ctx.attr.date
     cc_aliases = repo_ctx.attr.cc_aliases
+    py_aliases = repo_ctx.attr.py_aliases
+    aliases = repo_ctx.attr.aliases
 
     build = "package(default_visibility = [\"//visibility:public\"])\n"
     deprecation = "".join([
@@ -16,6 +18,23 @@ def _impl(repo_ctx):
             "deps = [" + repr(actual) + "]",
             "deprecation = " + repr(deprecation),
         ]))
+    for label, actual in py_aliases.items():
+        build += "py_library({})\n".format(", ".join([
+            "name = " + repr(label),
+            "deps = [" + repr(actual) + "]",
+            "deprecation = " + repr(deprecation),
+        ]))
+    for label, actual in aliases.items():
+        # Unfortunately, Bazel does not obey `deprecation = ...` on an alias().
+        build += "alias({})\n".format(", ".join([
+            "name = " + repr(label),
+            "actual = " + repr(actual),
+        ]))
+    if aliases or (not cc_aliases and not py_aliases):
+        # If there are any targets without a deprecation attribute, or if there
+        # are no targets in the first place, then we must deprecated the entire
+        # BUILD file.
+        build += "print(" + repr(deprecation) + ")\n"
 
     repo_ctx.file("BUILD.bazel", build)
 
@@ -41,6 +60,23 @@ add_deprecation = repository_rule(
             deprecated target names, the values are the non-deprecated labels.
             """,
         ),
+        "py_aliases": attr.string_dict(
+            doc = """
+            Optional mapping for py_library deprecations. The keys are
+            deprecated target names, the values are the non-deprecated labels.
+            """,
+        ),
+        "aliases": attr.string_dict(
+            doc = """
+            Optional mapping for any other deprecations. The keys are
+            deprecated target names, the values are the non-deprecated labels.
+
+            Note that (in contrast to the cc or py aliases) these labels
+            do NOT generate deprecation warnings when they are used. Instead,
+            the BUILD file will print a warning when it's loaded, even if none
+            of its targets are used as dependencies.
+            """,
+        ),
     },
     implementation = _impl,
 )
diff --git a/tools/workspace/dm_control/BUILD.bazel b/tools/workspace/dm_control_internal/BUILD.bazel
similarity index 100%
rename from tools/workspace/dm_control/BUILD.bazel
rename to tools/workspace/dm_control_internal/BUILD.bazel
diff --git a/tools/workspace/dm_control/files.bzl b/tools/workspace/dm_control_internal/files.bzl
similarity index 100%
rename from tools/workspace/dm_control/files.bzl
rename to tools/workspace/dm_control_internal/files.bzl
diff --git a/tools/workspace/dm_control/package.BUILD.bazel b/tools/workspace/dm_control_internal/package.BUILD.bazel
similarity index 100%
rename from tools/workspace/dm_control/package.BUILD.bazel
rename to tools/workspace/dm_control_internal/package.BUILD.bazel
diff --git a/tools/workspace/dm_control/repository.bzl b/tools/workspace/dm_control_internal/repository.bzl
similarity index 74%
rename from tools/workspace/dm_control/repository.bzl
rename to tools/workspace/dm_control_internal/repository.bzl
index 34c0bd7cfff1..6c284a8021a7 100644
--- a/tools/workspace/dm_control/repository.bzl
+++ b/tools/workspace/dm_control_internal/repository.bzl
@@ -2,7 +2,7 @@
 
 load("@drake//tools/workspace:github.bzl", "github_archive")
 
-def dm_control_repository(
+def dm_control_internal_repository(
         name,
         mirrors = None):
     github_archive(
@@ -10,6 +10,6 @@ def dm_control_repository(
         repository = "deepmind/dm_control",
         commit = "41d0c7383153f9ca6c12f8e865ef5e73a98759bd",
         sha256 = "712fbc5b81518b640b1f1c084b22bebc558a8acecec4831ef5f6ca63181431d6",  # noqa
-        build_file = "@drake//tools/workspace/dm_control:package.BUILD.bazel",
+        build_file = "@drake//tools/workspace/dm_control_internal:package.BUILD.bazel",  # noqa
         mirrors = mirrors,
     )
diff --git a/tools/workspace/github3_py/BUILD.bazel b/tools/workspace/github3_py_internal/BUILD.bazel
similarity index 100%
rename from tools/workspace/github3_py/BUILD.bazel
rename to tools/workspace/github3_py_internal/BUILD.bazel
diff --git a/tools/workspace/github3_py/package.BUILD.bazel b/tools/workspace/github3_py_internal/package.BUILD.bazel
similarity index 86%
rename from tools/workspace/github3_py/package.BUILD.bazel
rename to tools/workspace/github3_py_internal/package.BUILD.bazel
index 62b1d5cabca2..005c363beded 100644
--- a/tools/workspace/github3_py/package.BUILD.bazel
+++ b/tools/workspace/github3_py_internal/package.BUILD.bazel
@@ -17,6 +17,6 @@ py_library(
         "src",
     ],
     deps = [
-        "@uritemplate_py",
+        "@uritemplate_py_internal//:uritemplate_py",
     ],
 )
diff --git a/tools/workspace/github3_py/repository.bzl b/tools/workspace/github3_py_internal/repository.bzl
similarity index 73%
rename from tools/workspace/github3_py/repository.bzl
rename to tools/workspace/github3_py_internal/repository.bzl
index 5c6d64cde885..152706958ea0 100644
--- a/tools/workspace/github3_py/repository.bzl
+++ b/tools/workspace/github3_py_internal/repository.bzl
@@ -2,7 +2,7 @@
 
 load("@drake//tools/workspace:github.bzl", "github_archive")
 
-def github3_py_repository(
+def github3_py_internal_repository(
         name,
         mirrors = None):
     github_archive(
@@ -10,6 +10,6 @@ def github3_py_repository(
         repository = "sigmavirus24/github3.py",
         commit = "3.2.0",
         sha256 = "42cf8e721437a0bcfb05e767302c3221cdc96f3e9db3d76ce990fd0526af1d99",  # noqa
-        build_file = "@drake//tools/workspace/github3_py:package.BUILD.bazel",
+        build_file = "@drake//tools/workspace/github3_py_internal:package.BUILD.bazel",  # noqa
         mirrors = mirrors,
     )
diff --git a/tools/workspace/intel_realsense_ros/BUILD.bazel b/tools/workspace/intel_realsense_ros_internal/BUILD.bazel
similarity index 100%
rename from tools/workspace/intel_realsense_ros/BUILD.bazel
rename to tools/workspace/intel_realsense_ros_internal/BUILD.bazel
diff --git a/tools/workspace/intel_realsense_ros/files.bzl b/tools/workspace/intel_realsense_ros_internal/files.bzl
similarity index 100%
rename from tools/workspace/intel_realsense_ros/files.bzl
rename to tools/workspace/intel_realsense_ros_internal/files.bzl
diff --git a/tools/workspace/intel_realsense_ros/package.BUILD.bazel b/tools/workspace/intel_realsense_ros_internal/package.BUILD.bazel
similarity index 88%
rename from tools/workspace/intel_realsense_ros/package.BUILD.bazel
rename to tools/workspace/intel_realsense_ros_internal/package.BUILD.bazel
index e7ceed8ead32..4f5ee2cd34b0 100644
--- a/tools/workspace/intel_realsense_ros/package.BUILD.bazel
+++ b/tools/workspace/intel_realsense_ros_internal/package.BUILD.bazel
@@ -1,6 +1,6 @@
 # -*- python -*-
 
-load("@drake//tools/workspace/ros_xacro:defs.bzl", "xacro_file")
+load("@drake//tools/workspace/ros_xacro_internal:defs.bzl", "xacro_file")
 
 licenses(["notice"])  # Apache-2.0
 
diff --git a/tools/workspace/intel_realsense_ros/repository.bzl b/tools/workspace/intel_realsense_ros_internal/repository.bzl
similarity index 94%
rename from tools/workspace/intel_realsense_ros/repository.bzl
rename to tools/workspace/intel_realsense_ros_internal/repository.bzl
index 62e5c0a3f23f..3ecb69470d99 100644
--- a/tools/workspace/intel_realsense_ros/repository.bzl
+++ b/tools/workspace/intel_realsense_ros_internal/repository.bzl
@@ -2,7 +2,7 @@
 
 load("@drake//tools/workspace:github.bzl", "github_archive")
 
-def intel_realsense_ros_repository(
+def intel_realsense_ros_internal_repository(
         name,
         mirrors = None):
     github_archive(
@@ -15,7 +15,7 @@ def intel_realsense_ros_repository(
         # https://github.com/IntelRealSense/realsense-ros/releases
         commit = "2.3.2",
         sha256 = "18c0f90eeea2b64889388e2e441221931e220d1fea06fe6eff8d70442c456459",  # noqa
-        build_file = "@drake//tools/workspace/intel_realsense_ros:package.BUILD.bazel",  # noqa
+        build_file = "@drake//tools/workspace/intel_realsense_ros_internal:package.BUILD.bazel",  # noqa
         patch_cmds = [
             "cp LICENSE realsense2_description/",
             "sed -i.orig -e 's|$(find realsense2_description)/urdf/||' realsense2_description/urdf/*.xacro",  # noqa
diff --git a/tools/workspace/models/BUILD.bazel b/tools/workspace/models_internal/BUILD.bazel
similarity index 100%
rename from tools/workspace/models/BUILD.bazel
rename to tools/workspace/models_internal/BUILD.bazel
diff --git a/tools/workspace/models/files.bzl b/tools/workspace/models_internal/files.bzl
similarity index 100%
rename from tools/workspace/models/files.bzl
rename to tools/workspace/models_internal/files.bzl
diff --git a/tools/workspace/models/package.BUILD.bazel b/tools/workspace/models_internal/package.BUILD.bazel
similarity index 100%
rename from tools/workspace/models/package.BUILD.bazel
rename to tools/workspace/models_internal/package.BUILD.bazel
diff --git a/tools/workspace/models/repository.bzl b/tools/workspace/models_internal/repository.bzl
similarity index 76%
rename from tools/workspace/models/repository.bzl
rename to tools/workspace/models_internal/repository.bzl
index f60c894c1776..f6b5cc996143 100644
--- a/tools/workspace/models/repository.bzl
+++ b/tools/workspace/models_internal/repository.bzl
@@ -2,7 +2,7 @@
 
 load("@drake//tools/workspace:github.bzl", "github_archive")
 
-def models_repository(
+def models_internal_repository(
         name,
         mirrors = None):
     github_archive(
@@ -10,6 +10,6 @@ def models_repository(
         repository = "RobotLocomotion/models",
         commit = "fbc442f5bb609ecd8c32d8ab6e033b998a929692",
         sha256 = "104662b08af4e2681cefa309de5c47c25a6b82531a1cda5f8e554c7b8c296831",  # noqa
-        build_file = "@drake//tools/workspace/models:package.BUILD.bazel",
+        build_file = "@drake//tools/workspace/models_internal:package.BUILD.bazel",  # noqa
         mirrors = mirrors,
     )
diff --git a/tools/workspace/new_release.py b/tools/workspace/new_release.py
index 4a278a855619..50f2f8422db3 100644
--- a/tools/workspace/new_release.py
+++ b/tools/workspace/new_release.py
@@ -54,7 +54,7 @@
 # We'll skip these repositories when making suggestions.
 _IGNORED_REPOSITORIES = [
     # We don't know how to check non-default branches yet.
-    "clang_cindex_python3",
+    "clang_cindex_python3_internal",
     "pybind11",
 ]
 
@@ -64,14 +64,14 @@
 # group in the regex denotes the portion of the tag to lock as invariant.
 # (This can be used to pin to a given major or major.minor release series.)
 _OVERLOOK_RELEASE_REPOSITORIES = {
-    "github3_py": r"^(\d+.)",
+    "github3_py_internal": r"^(\d+.)",
     "gz_math": "",
     "gz_utils": "",
-    "intel_realsense_ros": r"^(\d+\.\d+\.)",
+    "intel_realsense_ros_internal": r"^(\d+\.\d+\.)",
     "petsc": r"^(v)",
     "pycodestyle": "",
     "qhull_internal": r"^(2)",
-    "ros_xacro": r"^(\d+\.\d+\.)",
+    "ros_xacro_internal": r"^(\d+\.\d+\.)",
     "sdformat_internal": "",
 }
 
diff --git a/tools/workspace/pybind11/BUILD.bazel b/tools/workspace/pybind11/BUILD.bazel
index aac28ed2033f..98fb7cca3914 100644
--- a/tools/workspace/pybind11/BUILD.bazel
+++ b/tools/workspace/pybind11/BUILD.bazel
@@ -34,7 +34,7 @@ py_library(
     visibility = ["//visibility:public"],
     deps = [
         ":module_py",
-        "@clang_cindex_python3//:clang",
+        "@clang_cindex_python3_internal//:clang",
     ],
 )
 
@@ -47,7 +47,7 @@ py_binary(
     deps = [
         ":libclang_setup_py",
         ":mkdoc_comment_py",
-        "@clang_cindex_python3//:clang",
+        "@clang_cindex_python3_internal//:clang",
     ],
 )
 
@@ -104,7 +104,7 @@ py_library(
     ],
     deps = [
         ":libclang_setup_py",
-        "@clang_cindex_python3//:clang",
+        "@clang_cindex_python3_internal//:clang",
     ],
 )
 
diff --git a/tools/workspace/ros_xacro/BUILD.bazel b/tools/workspace/ros_xacro_internal/BUILD.bazel
similarity index 100%
rename from tools/workspace/ros_xacro/BUILD.bazel
rename to tools/workspace/ros_xacro_internal/BUILD.bazel
diff --git a/tools/workspace/ros_xacro/defs.bzl b/tools/workspace/ros_xacro_internal/defs.bzl
similarity index 97%
rename from tools/workspace/ros_xacro/defs.bzl
rename to tools/workspace/ros_xacro_internal/defs.bzl
index 205aaadeb4b6..b869777e1857 100644
--- a/tools/workspace/ros_xacro/defs.bzl
+++ b/tools/workspace/ros_xacro_internal/defs.bzl
@@ -27,7 +27,7 @@ _xacro_rule = rule(
             allow_files = True,
         ),
         "_tool": attr.label(
-            default = "@ros_xacro//:xacro",
+            default = "@ros_xacro_internal//:xacro",
             cfg = "host",
             executable = True,
         ),
diff --git a/tools/workspace/ros_xacro/disable-console-print.patch b/tools/workspace/ros_xacro_internal/disable-console-print.patch
similarity index 100%
rename from tools/workspace/ros_xacro/disable-console-print.patch
rename to tools/workspace/ros_xacro_internal/disable-console-print.patch
diff --git a/tools/workspace/ros_xacro/disable-import-warning.patch b/tools/workspace/ros_xacro_internal/disable-import-warning.patch
similarity index 100%
rename from tools/workspace/ros_xacro/disable-import-warning.patch
rename to tools/workspace/ros_xacro_internal/disable-import-warning.patch
diff --git a/tools/workspace/ros_xacro/package.BUILD.bazel b/tools/workspace/ros_xacro_internal/package.BUILD.bazel
similarity index 100%
rename from tools/workspace/ros_xacro/package.BUILD.bazel
rename to tools/workspace/ros_xacro_internal/package.BUILD.bazel
diff --git a/tools/workspace/ros_xacro/repository.bzl b/tools/workspace/ros_xacro_internal/repository.bzl
similarity index 67%
rename from tools/workspace/ros_xacro/repository.bzl
rename to tools/workspace/ros_xacro_internal/repository.bzl
index 7ea12096a8eb..25685787a7d5 100644
--- a/tools/workspace/ros_xacro/repository.bzl
+++ b/tools/workspace/ros_xacro_internal/repository.bzl
@@ -2,7 +2,7 @@
 
 load("@drake//tools/workspace:github.bzl", "github_archive")
 
-def ros_xacro_repository(
+def ros_xacro_internal_repository(
         name,
         mirrors = None):
     github_archive(
@@ -14,10 +14,10 @@ def ros_xacro_repository(
         # https://index.ros.org/p/xacro/github-ros-xacro/#noetic
         commit = "1.14.13",
         sha256 = "e210b1e9c478d53350ef565b502ff5e53f29fd2f78eff04bb16fd465b43f4143",  # noqa
-        build_file = "@drake//tools/workspace/ros_xacro:package.BUILD.bazel",
+        build_file = "@drake//tools/workspace/ros_xacro_internal:package.BUILD.bazel",  # noqa
         patches = [
-            "@drake//tools/workspace/ros_xacro:disable-console-print.patch",
-            "@drake//tools/workspace/ros_xacro:disable-import-warning.patch",
+            "@drake//tools/workspace/ros_xacro_internal:disable-console-print.patch",  # noqa
+            "@drake//tools/workspace/ros_xacro_internal:disable-import-warning.patch",  # noqa
         ],
         mirrors = mirrors,
     )
diff --git a/tools/workspace/ros_xacro/test/box.xml b/tools/workspace/ros_xacro_internal/test/box.xml
similarity index 100%
rename from tools/workspace/ros_xacro/test/box.xml
rename to tools/workspace/ros_xacro_internal/test/box.xml
diff --git a/tools/workspace/ros_xacro/test/sample1.xml.expected b/tools/workspace/ros_xacro_internal/test/sample1.xml.expected
similarity index 87%
rename from tools/workspace/ros_xacro/test/sample1.xml.expected
rename to tools/workspace/ros_xacro_internal/test/sample1.xml.expected
index f3e8cf2c9676..70e0f9e127bc 100644
--- a/tools/workspace/ros_xacro/test/sample1.xml.expected
+++ b/tools/workspace/ros_xacro_internal/test/sample1.xml.expected
@@ -1,6 +1,6 @@
 <?xml version="1.0" ?>
 <!-- =================================================================================== -->
-<!-- |    This document was autogenerated by xacro from tools/workspace/ros_xacro/test/sample1.xml.xacro | -->
+<!-- |    This document was autogenerated by xacro from tools/workspace/ros_xacro_internal/test/sample1.xml.xacro | -->
 <!-- |    EDITING THIS FILE BY HAND IS NOT RECOMMENDED                                 | -->
 <!-- =================================================================================== -->
 <root>
diff --git a/tools/workspace/ros_xacro/test/sample1.xml.xacro b/tools/workspace/ros_xacro_internal/test/sample1.xml.xacro
similarity index 100%
rename from tools/workspace/ros_xacro/test/sample1.xml.xacro
rename to tools/workspace/ros_xacro_internal/test/sample1.xml.xacro
diff --git a/tools/workspace/ros_xacro/test/sample2.xml.expected b/tools/workspace/ros_xacro_internal/test/sample2.xml.expected
similarity index 88%
rename from tools/workspace/ros_xacro/test/sample2.xml.expected
rename to tools/workspace/ros_xacro_internal/test/sample2.xml.expected
index a21bf9de8936..3c6877270162 100644
--- a/tools/workspace/ros_xacro/test/sample2.xml.expected
+++ b/tools/workspace/ros_xacro_internal/test/sample2.xml.expected
@@ -1,6 +1,6 @@
 <?xml version="1.0" ?>
 <!-- =================================================================================== -->
-<!-- |    This document was autogenerated by xacro from tools/workspace/ros_xacro/test/sample2.xml.xacro | -->
+<!-- |    This document was autogenerated by xacro from tools/workspace/ros_xacro_internal/test/sample2.xml.xacro | -->
 <!-- |    EDITING THIS FILE BY HAND IS NOT RECOMMENDED                                 | -->
 <!-- =================================================================================== -->
 <root>
diff --git a/tools/workspace/ros_xacro/test/sample2.xml.xacro b/tools/workspace/ros_xacro_internal/test/sample2.xml.xacro
similarity index 100%
rename from tools/workspace/ros_xacro/test/sample2.xml.xacro
rename to tools/workspace/ros_xacro_internal/test/sample2.xml.xacro
diff --git a/tools/workspace/ros_xacro/test/xacro_smoke_test.py b/tools/workspace/ros_xacro_internal/test/xacro_smoke_test.py
similarity index 79%
rename from tools/workspace/ros_xacro/test/xacro_smoke_test.py
rename to tools/workspace/ros_xacro_internal/test/xacro_smoke_test.py
index 97606af73e36..d0f46f8969be 100644
--- a/tools/workspace/ros_xacro/test/xacro_smoke_test.py
+++ b/tools/workspace/ros_xacro_internal/test/xacro_smoke_test.py
@@ -17,5 +17,5 @@ def _diff_file(self, filename):
     def test_samples(self):
         """Check use of xacro_filegroup and the expected result.
         """
-        self._diff_file("tools/workspace/ros_xacro/test/sample1.xml")
-        self._diff_file("tools/workspace/ros_xacro/test/sample2.xml")
+        self._diff_file("tools/workspace/ros_xacro_internal/test/sample1.xml")
+        self._diff_file("tools/workspace/ros_xacro_internal/test/sample2.xml")
diff --git a/tools/workspace/uritemplate_py/BUILD.bazel b/tools/workspace/uritemplate_py_internal/BUILD.bazel
similarity index 100%
rename from tools/workspace/uritemplate_py/BUILD.bazel
rename to tools/workspace/uritemplate_py_internal/BUILD.bazel
diff --git a/tools/workspace/uritemplate_py/package.BUILD.bazel b/tools/workspace/uritemplate_py_internal/package.BUILD.bazel
similarity index 100%
rename from tools/workspace/uritemplate_py/package.BUILD.bazel
rename to tools/workspace/uritemplate_py_internal/package.BUILD.bazel
diff --git a/tools/workspace/uritemplate_py/repository.bzl b/tools/workspace/uritemplate_py_internal/repository.bzl
similarity index 72%
rename from tools/workspace/uritemplate_py/repository.bzl
rename to tools/workspace/uritemplate_py_internal/repository.bzl
index a29a5429cd2b..cae4b83cafb2 100644
--- a/tools/workspace/uritemplate_py/repository.bzl
+++ b/tools/workspace/uritemplate_py_internal/repository.bzl
@@ -2,7 +2,7 @@
 
 load("@drake//tools/workspace:github.bzl", "github_archive")
 
-def uritemplate_py_repository(
+def uritemplate_py_internal_repository(
         name,
         mirrors = None):
     github_archive(
@@ -10,6 +10,6 @@ def uritemplate_py_repository(
         repository = "python-hyper/uritemplate",
         commit = "4.1.1",
         sha256 = "64cae94edd83bbb0c2c49b15f2cb8192c3f8492af6bc468211d1e8b8496f5791",  # noqa
-        build_file = "@drake//tools/workspace/uritemplate_py:package.BUILD.bazel",  # noqa
+        build_file = "@drake//tools/workspace/uritemplate_py_internal:package.BUILD.bazel",  # noqa
         mirrors = mirrors,
     )