diff --git a/src/hidden-symbols.map b/src/hidden-symbols.map
new file mode 100644
index 000000000000..bea858a839ff
--- /dev/null
+++ b/src/hidden-symbols.map
@@ -0,0 +1,6 @@
+{
+	global:
+		PyInit_*;
+	local:
+		*;
+};
diff --git a/src/meson.build b/src/meson.build
index 077b7f0353b6..bbbd48fff2f0 100644
--- a/src/meson.build
+++ b/src/meson.build
@@ -131,9 +131,19 @@ else
   new_preprocessor = []
 endif
 
+# Even though Meson defaults to hidden visibility, our bundled libraries like FreeType
+# may themselves export their own symbols individually. So force all symbols other than
+# the Python module initialization function to be hidden with a linker version script.
+mapfile = 'hidden-symbols.map'
+vflag = cc.get_supported_link_arguments([
+  '-Wl,--version-script,@0@/@1@'.format(meson.current_source_dir(), mapfile)
+])
+
 foreach ext, kwargs : extension_data
   additions = {
     'cpp_args': [new_preprocessor] + kwargs.get('cpp_args', []),
+    'link_args': [vflag] + kwargs.get('link_args', []),
+    'link_depends': [mapfile] + kwargs.get('link_depends', []),
   }
   py3.extension_module(
     ext,