diff --git a/javascript/ql/lib/semmle/javascript/DOM.qll b/javascript/ql/lib/semmle/javascript/DOM.qll
index 21854c1a9d0..97f6bc43546 100644
--- a/javascript/ql/lib/semmle/javascript/DOM.qll
+++ b/javascript/ql/lib/semmle/javascript/DOM.qll
@@ -192,6 +192,7 @@ module DOM {
    * A data flow node or other program element that may refer to
    * a DOM element.
    */
+  overlay[global]
   abstract class Element extends Locatable {
     ElementDefinition defn;
 
diff --git a/javascript/ql/lib/semmle/javascript/frameworks/EventEmitter.qll b/javascript/ql/lib/semmle/javascript/frameworks/EventEmitter.qll
index f466d96dd9d..67a5a99fdc1 100644
--- a/javascript/ql/lib/semmle/javascript/frameworks/EventEmitter.qll
+++ b/javascript/ql/lib/semmle/javascript/frameworks/EventEmitter.qll
@@ -94,6 +94,7 @@ module EventRegistration {
   /**
    * A registration of an event handler on an EventEmitter.
    */
+  overlay[global]
   abstract class Range extends DataFlow::Node {
     EventEmitter::Range emitter;
 
@@ -148,6 +149,7 @@ module EventDispatch {
   /**
    * A dispatch of an event on an EventEmitter.
    */
+  overlay[global]
   abstract class Range extends DataFlow::Node {
     EventEmitter::Range emitter;
 
diff --git a/javascript/ql/lib/semmle/javascript/frameworks/NodeJSLib.qll b/javascript/ql/lib/semmle/javascript/frameworks/NodeJSLib.qll
index b6506ddd648..10801d96654 100644
--- a/javascript/ql/lib/semmle/javascript/frameworks/NodeJSLib.qll
+++ b/javascript/ql/lib/semmle/javascript/frameworks/NodeJSLib.qll
@@ -260,6 +260,7 @@ module NodeJSLib {
     DataFlow::Node getRouteHandlerNode() { result = handler }
   }
 
+  overlay[global]
   abstract private class HeaderDefinition extends Http::Servers::StandardHeaderDefinition {
     ResponseNode r;
 
diff --git a/javascript/ql/lib/semmle/javascript/frameworks/SQL.qll b/javascript/ql/lib/semmle/javascript/frameworks/SQL.qll
index 9d106251a21..bcc89813220 100644
--- a/javascript/ql/lib/semmle/javascript/frameworks/SQL.qll
+++ b/javascript/ql/lib/semmle/javascript/frameworks/SQL.qll
@@ -16,6 +16,7 @@ module SQL {
    * An dataflow node that sanitizes a string to make it safe to embed into
    * a SQL command.
    */
+  overlay[global]
   abstract class SqlSanitizer extends DataFlow::Node {
     DataFlow::Node input;
     DataFlow::Node output;
diff --git a/javascript/ql/lib/semmle/javascript/security/dataflow/SecondOrderCommandInjectionCustomizations.qll b/javascript/ql/lib/semmle/javascript/security/dataflow/SecondOrderCommandInjectionCustomizations.qll
index 416ad56bef1..afac6f91d07 100644
--- a/javascript/ql/lib/semmle/javascript/security/dataflow/SecondOrderCommandInjectionCustomizations.qll
+++ b/javascript/ql/lib/semmle/javascript/security/dataflow/SecondOrderCommandInjectionCustomizations.qll
@@ -129,6 +129,7 @@ module SecondOrderCommandInjection {
   /**
    * A sink that invokes a command described by the `VulnerableCommand` class.
    */
+  overlay[global]
   abstract class VulnerableCommandSink extends Sink {
     VulnerableCommand cmd;
 
diff --git a/javascript/ql/lib/semmle/javascript/security/dataflow/TaintedPathCustomizations.qll b/javascript/ql/lib/semmle/javascript/security/dataflow/TaintedPathCustomizations.qll
index f863b86a3b5..a09edf432f6 100644
--- a/javascript/ql/lib/semmle/javascript/security/dataflow/TaintedPathCustomizations.qll
+++ b/javascript/ql/lib/semmle/javascript/security/dataflow/TaintedPathCustomizations.qll
@@ -194,6 +194,7 @@ module TaintedPath {
      * There are currently four flow labels, representing the different combinations of
      * normalization and absoluteness.
      */
+    overlay[global]
     abstract class PosixPath extends DataFlow::FlowLabel {
       Normalization normalization;
       Relativeness relativeness;
diff --git a/javascript/ql/lib/semmle/javascript/security/dataflow/UnsafeHtmlConstructionCustomizations.qll b/javascript/ql/lib/semmle/javascript/security/dataflow/UnsafeHtmlConstructionCustomizations.qll
index 06bad34b80c..ab22c794fa5 100644
--- a/javascript/ql/lib/semmle/javascript/security/dataflow/UnsafeHtmlConstructionCustomizations.qll
+++ b/javascript/ql/lib/semmle/javascript/security/dataflow/UnsafeHtmlConstructionCustomizations.qll
@@ -101,6 +101,7 @@ module UnsafeHtmlConstruction {
    * A sink for `js/html-constructed-from-input` that constructs some HTML where
    * that HTML is later used in `xssSink`.
    */
+  overlay[global]
   abstract class XssSink extends Sink {
     DomBasedXss::Sink xssSink;