diff --git a/src/main/java/com/google/devtools/build/lib/bazel/bzlmod/BazelDepGraphFunction.java b/src/main/java/com/google/devtools/build/lib/bazel/bzlmod/BazelDepGraphFunction.java
index 3091a04226fb96..dcc6b8e94d9034 100644
--- a/src/main/java/com/google/devtools/build/lib/bazel/bzlmod/BazelDepGraphFunction.java
+++ b/src/main/java/com/google/devtools/build/lib/bazel/bzlmod/BazelDepGraphFunction.java
@@ -69,11 +69,11 @@ public SkyValue compute(SkyKey skyKey, Environment env)
               PackageIdentifier.create(module.getCanonicalRepoName(), PathFragment.EMPTY_FRAGMENT),
               module.getRepoMappingWithBazelDepsOnly());
       for (ModuleExtensionUsage usage : module.getExtensionUsages()) {
+        ModuleExtensionId moduleExtensionId;
         try {
-          ModuleExtensionId moduleExtensionId =
+          moduleExtensionId =
               ModuleExtensionId.create(
                   labelConverter.convert(usage.getExtensionBzlFile()), usage.getExtensionName());
-          extensionUsagesTableBuilder.put(moduleExtensionId, module.getKey(), usage);
         } catch (LabelSyntaxException e) {
           throw new BazelModuleResolutionFunctionException(
               ExternalDepsException.withCauseAndMessage(
@@ -83,6 +83,16 @@ public SkyValue compute(SkyKey skyKey, Environment env)
                   usage.getLocation()),
               Transience.PERSISTENT);
         }
+        if (!moduleExtensionId.getBzlFileLabel().getRepository().isVisible()) {
+          throw new BazelModuleResolutionFunctionException(
+              ExternalDepsException.withMessage(
+                  Code.BAD_MODULE,
+                  "invalid label for module extension found at %s: no repo visible as '@%s' here",
+                  usage.getLocation(),
+                  moduleExtensionId.getBzlFileLabel().getRepository().getName()),
+              Transience.PERSISTENT);
+        }
+        extensionUsagesTableBuilder.put(moduleExtensionId, module.getKey(), usage);
       }
     }
     ImmutableTable<ModuleExtensionId, ModuleKey, ModuleExtensionUsage> extensionUsagesById =
diff --git a/src/test/java/com/google/devtools/build/lib/bazel/bzlmod/BazelDepGraphFunctionTest.java b/src/test/java/com/google/devtools/build/lib/bazel/bzlmod/BazelDepGraphFunctionTest.java
index bdba9bca8400e3..08cb330253d37b 100644
--- a/src/test/java/com/google/devtools/build/lib/bazel/bzlmod/BazelDepGraphFunctionTest.java
+++ b/src/test/java/com/google/devtools/build/lib/bazel/bzlmod/BazelDepGraphFunctionTest.java
@@ -329,6 +329,23 @@ public void createValue_moduleExtensions() throws Exception {
                 "dep~2.0~myext2~myext"));
   }
 
+  @Test
+  public void useExtensionBadLabelFails() throws Exception {
+    Module root =
+        Module.builder()
+            .addExtensionUsage(createModuleExtensionUsage("@foo//:defs.bzl", "bar"))
+            .build();
+    ImmutableMap<ModuleKey, Module> depGraph = ImmutableMap.of(ModuleKey.ROOT, root);
+
+    resolutionFunctionMock.setDepGraph(depGraph);
+    EvaluationResult<BazelDepGraphValue> result =
+        evaluator.evaluate(ImmutableList.of(BazelDepGraphValue.KEY), evaluationContext);
+    if (!result.hasError()) {
+      fail("expected error about @foo not being visible, but succeeded");
+    }
+    assertThat(result.getError().toString()).contains("no repo visible as '@foo' here");
+  }
+
   private static class BazelModuleResolutionFunctionMock implements SkyFunction {
 
     private ImmutableMap<ModuleKey, Module> depGraph = ImmutableMap.of();