diff --git a/CMakeLists.txt b/CMakeLists.txt
index 05c8c07c..d1857f1e 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -42,6 +42,7 @@ HexVersion(PACKAGE_VERSION_NUM ${PROJECT_VERSION_MAJOR} ${PROJECT_VERSION_MINOR}
 
 include(GNUInstallDirs)
 
+# XXX "check" is treated as "OFF" now, consider detecting it first
 option(ENABLE_WERROR    "Turn on compile time warnings")
 option(ENABLE_DEBUG     "Turn on debug output")
 option(ENABLE_THREADS   "Turn on threading in apps" ON)
diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
index a762b4e3..1c22321e 100644
--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
@@ -130,7 +130,7 @@ if(ENABLE_APP)
   )
 
   if(HAVE_MRUBY)
-    target_include_directories(nghttpx PUBLIC
+    target_include_directories(nghttpx PRIVATE
       "${CMAKE_SOURCE_DIR}/third-party/mruby/include"
       # ${LIBMRUBY_CFLAGS}
     )
@@ -142,7 +142,7 @@ if(ENABLE_APP)
   endif()
 
   if(HAVE_NEVERBLEED)
-    target_include_directories(nghttpx PUBLIC
+    target_include_directories(nghttpx PRIVATE
       "${CMAKE_SOURCE_DIR}/third-party/neverbleed"
     )
     target_link_libraries(nghttpx
@@ -189,7 +189,7 @@ if(ENABLE_APP)
   add_executable(nghttp   ${NGHTTP_SOURCES}   $<TARGET_OBJECTS:http-parser>)
   add_executable(nghttpd  ${NGHTTPD_SOURCES}  $<TARGET_OBJECTS:http-parser>)
   add_executable(nghttpx-bin ${NGHTTPX-bin_SOURCES} $<TARGET_OBJECTS:http-parser>)
-  target_compile_definitions(nghttpx-bin PUBLIC "-DPKGDATADIR=\"${PKGDATADIR}\"")
+  target_compile_definitions(nghttpx-bin PRIVATE "-DPKGDATADIR=\"${PKGDATADIR}\"")
   set_target_properties(nghttpx-bin PROPERTIES OUTPUT_NAME nghttpx)
   target_link_libraries(nghttpx-bin nghttpx)
   add_executable(h2load   ${H2LOAD_SOURCES}   $<TARGET_OBJECTS:http-parser>)
@@ -248,7 +248,7 @@ if(ENABLE_ASIO_LIB)
      ${NGHTTP2_ASIO_SOURCES}
      $<TARGET_OBJECTS:http-parser>
   )
-  target_include_directories(nghttp2_asio PUBLIC
+  target_include_directories(nghttp2_asio PRIVATE
     ${OPENSSL_INCLUDE_DIRS}
     ${Boost_INCLUDE_DIRS}
   )