diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5fea049ec0..bbab846c91 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -13,6 +13,37 @@ Increment the:
 * MINOR version when you add functionality in a backwards compatible manner, and
 * PATCH version when you make backwards compatible bug fixes.
 
+## [2.0.0] TBD
+
+### Breaking Changes
+
+* [BUILD] Narrow ext:headers Bazel target to match CMake install manifest
+  [#4625](https://github.com/open-telemetry/opentelemetry-cpp/pull/4625)
+  * The `ext` Bazel target now exposes only 4 public headers, matching
+    CMakeLists.txt behavior (unchanged for 2+ years). These 6 headers are
+    no longer part of the public API:
+    * `opentelemetry/ext/http/client/curl/http_client_curl.h`
+    * `opentelemetry/ext/http/client/curl/http_operation_curl.h`
+    * `opentelemetry/ext/http/client/curl/http_time_util.h`
+    * `opentelemetry/ext/http/client/detail/default_factory.h`
+    * `opentelemetry/ext/http/server/http_server.h`
+    * `opentelemetry/ext/http/server/socket_tools.h`
+  * Code that included any of these headers must migrate to new internal
+    targets:
+    * Curl implementation details: depend on `//ext/src/http/client/curl:implementation_headers`
+    * Factory helper: depend on `//ext:http_client_detail`
+    * Server headers: depend on `//ext:server_headers`
+  * The public API (4 stable headers) remains unchanged:
+    * `opentelemetry/ext/http/client/http_client.h`
+    * `opentelemetry/ext/http/client/http_client_factory.h`
+    * `opentelemetry/ext/http/client/curl/http_client_factory_curl.h`
+    * `opentelemetry/ext/http/common/url_parser.h`
+  * Reason for change: Bazel target was using glob pattern that exposed
+    implementation details. CMake build has maintained explicit header list
+    for production use. This change aligns both build systems and prevents
+    accidental exposure of internal APIs.
+  * Related: #4327 (CMake narrowing), #4332 (server header relocation to test_common)
+
 ## [Unreleased]
 
 * [LOGS] Fix undefined behavior in `Logger::EmitLogRecord()` when a logger is
diff --git a/examples/http/BUILD b/examples/http/BUILD
index 4dbf46f621..63c7b695dc 100644
--- a/examples/http/BUILD
+++ b/examples/http/BUILD
@@ -39,6 +39,7 @@ cc_binary(
         "//api",
         "//exporters/ostream:ostream_span_exporter",
         "//ext:headers",
+        "//ext:server_headers",
         "//sdk/src/trace",
     ],
 )
diff --git a/exporters/elasticsearch/BUILD b/exporters/elasticsearch/BUILD
index 71ff5f39d2..b7061fb055 100644
--- a/exporters/elasticsearch/BUILD
+++ b/exporters/elasticsearch/BUILD
@@ -28,6 +28,7 @@ cc_library(
     tags = ["es"],
     deps = [
         "//ext:headers",
+        "//ext:http_client_detail",
         "//ext/src/http/client/curl:http_client_curl",
         "//sdk/src/logs",
         "@curl",
diff --git a/exporters/otlp/BUILD b/exporters/otlp/BUILD
index ad9ac5d294..b5eed3d774 100644
--- a/exporters/otlp/BUILD
+++ b/exporters/otlp/BUILD
@@ -116,6 +116,7 @@ cc_library(
     deps = [
         ":otlp_common",
         "//ext:headers",
+        "//ext:http_client_detail",
         "//sdk:headers",
         "//sdk/src/common:global_log_handler",
         "@com_github_grpc_grpc//:grpc++",
@@ -166,6 +167,7 @@ cc_library(
         ":otlp_recordable",
         ":otlp_grpc_client",
         "//ext:headers",
+        "//ext:http_client_detail",
         "//sdk/src/trace",
 
         # For gRPC
@@ -392,6 +394,7 @@ cc_library(
         ":otlp_recordable",
         ":otlp_grpc_client",
         "//ext:headers",
+        "//ext:http_client_detail",
         "//sdk/src/metrics",
 
         # For gRPC
@@ -650,6 +653,7 @@ cc_library(
         ":otlp_recordable",
         ":otlp_grpc_client",
         "//ext:headers",
+        "//ext:http_client_detail",
         "//sdk/src/logs",
         # For gRPC
         "@com_github_opentelemetry_proto//:logs_service_grpc_cc",
@@ -805,6 +809,7 @@ cc_test(
     deps = [
         ":otlp_http_exporter",
         "//api",
+        "//ext:server_headers",
         "//sdk/src/metrics",
         "//test_common/src/http/client/nosend:http_client_nosend",
         "@com_google_googletest//:gtest_main",
diff --git a/ext/BUILD b/ext/BUILD
index 82ff180a0e..f8f4a05e62 100644
--- a/ext/BUILD
+++ b/ext/BUILD
@@ -5,13 +5,84 @@ load("@rules_cc//cc:cc_library.bzl", "cc_library")
 
 package(default_visibility = ["//visibility:public"])
 
+# Public API: 4 stable headers forming the interface for HTTP clients
 cc_library(
     name = "headers",
-    hdrs = glob(["include/**/*.h"]),
+    hdrs = [
+        "include/opentelemetry/ext/http/client/curl/http_client_factory_curl.h",
+        "include/opentelemetry/ext/http/client/http_client.h",
+        "include/opentelemetry/ext/http/client/http_client_factory.h",
+        "include/opentelemetry/ext/http/common/url_parser.h",
+    ],
+    strip_include_prefix = "include",
+    deps = [
+        "//api",
+    ],
+)
+
+# Internal: curl implementation headers
+# Used by: the curl client itself, its tests, and the w3c test server
+# These are implementation details and are not installed by CMake
+cc_library(
+    name = "curl_implementation_headers",
+    hdrs = [
+        "include/opentelemetry/ext/http/client/curl/http_client_curl.h",
+        "include/opentelemetry/ext/http/client/curl/http_operation_curl.h",
+        "include/opentelemetry/ext/http/client/curl/http_time_util.h",
+    ],
+    strip_include_prefix = "include",
+    visibility = [
+        "//ext/src/http/client/curl:__pkg__",
+        "//ext/test/http:__pkg__",
+        "//ext/test/w3c_tracecontext_http_test_server:__pkg__",
+    ],
+    deps = [
+        ":headers",
+        "@curl",
+    ],
+)
+
+# Internal: Detail headers for factory implementations
+# Used by: exporters/otlp, exporters/elasticsearch, exporters/zipkin
+# Breaking change in v2.0.0: moved from public to internal target
+cc_library(
+    name = "http_client_detail",
+    hdrs = [
+        "include/opentelemetry/ext/http/client/detail/default_factory.h",
+    ],
+    strip_include_prefix = "include",
+    visibility = [
+        "//exporters/elasticsearch:__pkg__",
+        "//exporters/otlp:__pkg__",
+        "//exporters/zipkin:__pkg__",
+        "//ext/src/http/client/curl:__pkg__",
+    ],
+    deps = [
+        ":headers",
+    ],
+)
+
+# Internal: Embedded HTTP server headers (test and example use only)
+# TODO: Move to test_common per issue #4332
+# These are test infrastructure, not part of the public API
+cc_library(
+    name = "server_headers",
+    hdrs = [
+        "include/opentelemetry/ext/http/server/http_server.h",
+        "include/opentelemetry/ext/http/server/socket_tools.h",
+    ],
     linkopts = select({
-        # socket_tools.h calls Winsock; declare it on the interface so consumers link it too.
         "//bazel:windows": ["-DEFAULTLIB:Ws2_32.lib"],
         "//conditions:default": [],
     }),
     strip_include_prefix = "include",
+    visibility = [
+        "//examples/http:__pkg__",
+        "//exporters/otlp:__pkg__",
+        "//ext/test/http:__pkg__",
+        "//ext/test/w3c_tracecontext_http_test_server:__pkg__",
+    ],
+    deps = [
+        "//api",
+    ],
 )
diff --git a/ext/src/http/client/curl/BUILD b/ext/src/http/client/curl/BUILD
index 77cee338e8..5fffaff911 100644
--- a/ext/src/http/client/curl/BUILD
+++ b/ext/src/http/client/curl/BUILD
@@ -30,7 +30,9 @@ cc_library(
     linkstatic = True,
     deps = [
         "//api",
+        "//ext:curl_implementation_headers",
         "//ext:headers",
+        "//ext:http_client_detail",
         "//sdk:headers",
         "//sdk/src/common:random",
         "@curl",
diff --git a/ext/test/http/BUILD b/ext/test/http/BUILD
index a94a2d19e3..eb6f3473d0 100644
--- a/ext/test/http/BUILD
+++ b/ext/test/http/BUILD
@@ -8,11 +8,10 @@ cc_test(
     srcs = [
         "socket_tools_test.cc",
     ],
-    # ws2_32 is an interface linkopt of //ext:headers, so it is inherited here rather than
-    # relinked, which also lets the test verify the public target's usage requirements.
     tags = ["test"],
     deps = [
         "//ext:headers",
+        "//ext:server_headers",
         "@com_google_googletest//:gtest_main",
     ],
 )
@@ -25,7 +24,9 @@ cc_test(
     defines = ["ENABLE_OTLP_RETRY_PREVIEW"],
     tags = ["test"],
     deps = [
+        "//ext:curl_implementation_headers",
         "//ext:headers",
+        "//ext:server_headers",
         "//ext/src/http/client/curl:http_client_curl",
         "//sdk/src/trace",
         "@com_google_googletest//:gtest_main",
diff --git a/ext/test/w3c_tracecontext_http_test_server/BUILD b/ext/test/w3c_tracecontext_http_test_server/BUILD
index 5c3b197155..6ae95e4460 100644
--- a/ext/test/w3c_tracecontext_http_test_server/BUILD
+++ b/ext/test/w3c_tracecontext_http_test_server/BUILD
@@ -19,7 +19,9 @@ cc_binary(
     deps = [
         "//api",
         "//exporters/ostream:ostream_span_exporter",
+        "//ext:curl_implementation_headers",
         "//ext:headers",
+        "//ext:server_headers",
         "//ext/src/http/client/curl:http_client_curl",
         "//sdk/src/trace",
         "@curl",