diff --git a/build-logic/src/main/kotlin/pklKotlinBase.gradle.kts b/build-logic/src/main/kotlin/pklKotlinBase.gradle.kts
index 6516cc40..e8214c88 100644
--- a/build-logic/src/main/kotlin/pklKotlinBase.gradle.kts
+++ b/build-logic/src/main/kotlin/pklKotlinBase.gradle.kts
@@ -44,7 +44,6 @@ kotlin {
     freeCompilerArgs.addAll(
       "-jvm-default=no-compatibility", // was: -Xjvm-default=all
       "-Xjdk-release=${buildInfo.jvmTarget}",
-      "-Xjsr305=strict",
     )
   }
 }
diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml
index ffdd347e..56d623c9 100644
--- a/gradle/libs.versions.toml
+++ b/gradle/libs.versions.toml
@@ -36,7 +36,6 @@ jline = "4.0.14"
 jmh = "1.37"
 jmhPlugin = "0.7.3"
 jspecify = "1.0.0"
-jsr305 = "3.0.2"
 junit = "6.0.3"
 # 1.7+ generates much more verbose code
 kotlinPoet = "1.6.0"
@@ -74,6 +73,7 @@ commonMarkTables = { group = "org.commonmark", name = "commonmark-ext-gfm-tables
 downloadTaskPlugin = { group = "de.undercouch", name = "gradle-download-task", version.ref = "downloadTaskPlugin" }
 #noinspection UnusedVersionCatalogEntry
 errorProne = { group = "com.google.errorprone", name = "error_prone_core", version.ref = "errorProne" }
+errorProneAnnotations = { group = "com.google.errorprone", name = "error_prone_annotations", version.ref = "errorProne" }
 errorPronePlugin = { group = "net.ltgt.gradle", name = "gradle-errorprone-plugin", version.ref = "errorPronePlugin" }
 geantyref = { group = "io.leangen.geantyref", name = "geantyref", version.ref = "geantyref" }
 graalCompiler = { group = "org.graalvm.compiler", name = "compiler", version.ref = "graalVm" }
@@ -87,7 +87,6 @@ jlineTerminal = { group = "org.jline", name = "jline-terminal", version.ref = "j
 jlineTerminalJni = { group = "org.jline", name = "jline-terminal-jni", version.ref = "jline" }
 #noinspection UnusedVersionCatalogEntry
 jspecify = { group = "org.jspecify", name = "jspecify", version.ref = "jspecify" }
-jsr305 = { group = "com.google.code.findbugs", name = "jsr305", version.ref = "jsr305" }
 junitApi = { group = "org.junit.jupiter", name = "junit-jupiter-api", version.ref = "junit" }
 junitEngine = { group = "org.junit.jupiter", name = "junit-jupiter-engine", version.ref = "junit" }
 junitParams = { group = "org.junit.jupiter", name = "junit-jupiter-params", version.ref = "junit" }
diff --git a/pkl-core/pkl-core.gradle.kts b/pkl-core/pkl-core.gradle.kts
index 698444be..5ca8c2f1 100644
--- a/pkl-core/pkl-core.gradle.kts
+++ b/pkl-core/pkl-core.gradle.kts
@@ -43,7 +43,7 @@ dependencies {
   annotationProcessor(libs.truffleDslProcessor)
   annotationProcessor(generatorSourceSet.get().runtimeClasspath)
 
-  compileOnly(libs.jsr305)
+  compileOnly(libs.errorProneAnnotations)
   // pkl-core implements pkl-executor's ExecutorSpi, but the SPI doesn't ship with pkl-core
   compileOnly(projects.pklExecutor)
 
diff --git a/pkl-core/src/main/java/org/pkl/core/externalreader/ExternalReaderProcessImpl.java b/pkl-core/src/main/java/org/pkl/core/externalreader/ExternalReaderProcessImpl.java
index 583f8f5b..c26e925d 100644
--- a/pkl-core/src/main/java/org/pkl/core/externalreader/ExternalReaderProcessImpl.java
+++ b/pkl-core/src/main/java/org/pkl/core/externalreader/ExternalReaderProcessImpl.java
@@ -15,6 +15,7 @@
  */
 package org.pkl.core.externalreader;
 
+import com.google.errorprone.annotations.concurrent.GuardedBy;
 import java.io.IOException;
 import java.lang.ProcessBuilder.Redirect;
 import java.time.Duration;
@@ -26,7 +27,6 @@ import java.util.concurrent.CompletableFuture;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.Future;
 import java.util.concurrent.TimeUnit;
-import javax.annotation.concurrent.GuardedBy;
 import org.jspecify.annotations.Nullable;
 import org.pkl.core.evaluatorSettings.PklEvaluatorSettings.ExternalReader;
 import org.pkl.core.externalreader.ExternalReaderMessages.*;
diff --git a/pkl-core/src/main/java/org/pkl/core/http/DummyHttpClient.java b/pkl-core/src/main/java/org/pkl/core/http/DummyHttpClient.java
index 145aef56..6af91aab 100644
--- a/pkl-core/src/main/java/org/pkl/core/http/DummyHttpClient.java
+++ b/pkl-core/src/main/java/org/pkl/core/http/DummyHttpClient.java
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -18,10 +18,8 @@ package org.pkl.core.http;
 import java.net.http.HttpRequest;
 import java.net.http.HttpResponse;
 import java.net.http.HttpResponse.BodyHandler;
-import javax.annotation.concurrent.ThreadSafe;
 
 /** An {@code HttpClient} implementation that throws {@code AssertionError} on every send. */
-@ThreadSafe
 final class DummyHttpClient implements HttpClient {
   @Override
   public <T> HttpResponse<T> send(HttpRequest request, BodyHandler<T> responseBodyHandler) {
diff --git a/pkl-core/src/main/java/org/pkl/core/http/JdkHttpClient.java b/pkl-core/src/main/java/org/pkl/core/http/JdkHttpClient.java
index 0758830c..f2f0c331 100644
--- a/pkl-core/src/main/java/org/pkl/core/http/JdkHttpClient.java
+++ b/pkl-core/src/main/java/org/pkl/core/http/JdkHttpClient.java
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -41,7 +41,6 @@ import java.time.Duration;
 import java.util.ArrayList;
 import java.util.Collection;
 import java.util.List;
-import javax.annotation.concurrent.ThreadSafe;
 import javax.net.ssl.SSLContext;
 import javax.net.ssl.SSLException;
 import javax.net.ssl.SSLHandshakeException;
@@ -50,7 +49,6 @@ import org.pkl.core.util.ErrorMessages;
 import org.pkl.core.util.Exceptions;
 
 /** An {@code HttpClient} implementation backed by {@link java.net.http.HttpClient}. */
-@ThreadSafe
 final class JdkHttpClient implements HttpClient {
   // non-private for testing
   final java.net.http.HttpClient underlying;
diff --git a/pkl-core/src/main/java/org/pkl/core/http/LazyHttpClient.java b/pkl-core/src/main/java/org/pkl/core/http/LazyHttpClient.java
index dce69d73..4d2a6262 100644
--- a/pkl-core/src/main/java/org/pkl/core/http/LazyHttpClient.java
+++ b/pkl-core/src/main/java/org/pkl/core/http/LazyHttpClient.java
@@ -15,21 +15,19 @@
  */
 package org.pkl.core.http;
 
+import com.google.errorprone.annotations.concurrent.GuardedBy;
 import java.io.IOException;
 import java.net.http.HttpRequest;
 import java.net.http.HttpResponse;
 import java.net.http.HttpResponse.BodyHandler;
 import java.util.Optional;
 import java.util.function.Supplier;
-import javax.annotation.concurrent.GuardedBy;
-import javax.annotation.concurrent.ThreadSafe;
 import org.jspecify.annotations.Nullable;
 
 /**
  * An {@code HttpClient} decorator that defers creating the underlying HTTP client until the first
  * send.
  */
-@ThreadSafe
 final class LazyHttpClient implements HttpClient {
   private final Supplier<HttpClient> supplier;
   private final Object lock = new Object();
diff --git a/pkl-core/src/main/java/org/pkl/core/http/RequestRewritingClient.java b/pkl-core/src/main/java/org/pkl/core/http/RequestRewritingClient.java
index 068ffe05..09f2d513 100644
--- a/pkl-core/src/main/java/org/pkl/core/http/RequestRewritingClient.java
+++ b/pkl-core/src/main/java/org/pkl/core/http/RequestRewritingClient.java
@@ -30,7 +30,6 @@ import java.util.Map.Entry;
 import java.util.Objects;
 import java.util.concurrent.atomic.AtomicBoolean;
 import java.util.regex.Pattern;
-import javax.annotation.concurrent.ThreadSafe;
 import org.jspecify.annotations.Nullable;
 import org.pkl.core.PklBugException;
 import org.pkl.core.util.HttpUtils;
@@ -50,7 +49,6 @@ import org.pkl.core.util.Pair;
  * <p>Both {@code User-Agent} header and default request timeout are configurable through {@link
  * HttpClient.Builder}.
  */
-@ThreadSafe
 final class RequestRewritingClient implements HttpClient {
   // non-private for testing
   final String userAgent;
diff --git a/pkl-core/src/main/java/org/pkl/core/module/ModuleKeyFactories.java b/pkl-core/src/main/java/org/pkl/core/module/ModuleKeyFactories.java
index d920815b..fed1a364 100644
--- a/pkl-core/src/main/java/org/pkl/core/module/ModuleKeyFactories.java
+++ b/pkl-core/src/main/java/org/pkl/core/module/ModuleKeyFactories.java
@@ -15,6 +15,7 @@
  */
 package org.pkl.core.module;
 
+import com.google.errorprone.annotations.concurrent.GuardedBy;
 import java.io.IOException;
 import java.net.URI;
 import java.net.URISyntaxException;
@@ -26,7 +27,6 @@ import java.util.Collections;
 import java.util.List;
 import java.util.Optional;
 import java.util.ServiceLoader;
-import javax.annotation.concurrent.GuardedBy;
 import org.jspecify.annotations.Nullable;
 import org.pkl.core.Closeables;
 import org.pkl.core.externalreader.ExternalModuleResolver;
diff --git a/pkl-core/src/main/java/org/pkl/core/module/ModulePathResolver.java b/pkl-core/src/main/java/org/pkl/core/module/ModulePathResolver.java
index 7174b462..6fdd6764 100644
--- a/pkl-core/src/main/java/org/pkl/core/module/ModulePathResolver.java
+++ b/pkl-core/src/main/java/org/pkl/core/module/ModulePathResolver.java
@@ -15,6 +15,7 @@
  */
 package org.pkl.core.module;
 
+import com.google.errorprone.annotations.concurrent.GuardedBy;
 import java.io.FileNotFoundException;
 import java.io.IOException;
 import java.io.UncheckedIOException;
@@ -27,7 +28,6 @@ import java.util.Collections;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
-import javax.annotation.concurrent.GuardedBy;
 import org.jspecify.annotations.Nullable;
 import org.pkl.core.module.PathElement.TreePathElement;
 import org.pkl.core.runtime.FileSystemManager;
diff --git a/pkl-core/src/main/java/org/pkl/core/module/ProjectDependenciesManager.java b/pkl-core/src/main/java/org/pkl/core/module/ProjectDependenciesManager.java
index 1b8c09cc..c9a58ec6 100644
--- a/pkl-core/src/main/java/org/pkl/core/module/ProjectDependenciesManager.java
+++ b/pkl-core/src/main/java/org/pkl/core/module/ProjectDependenciesManager.java
@@ -15,12 +15,12 @@
  */
 package org.pkl.core.module;
 
+import com.google.errorprone.annotations.concurrent.GuardedBy;
 import java.io.IOException;
 import java.net.URI;
 import java.util.HashMap;
 import java.util.Map;
 import java.util.Objects;
-import javax.annotation.concurrent.GuardedBy;
 import org.graalvm.collections.EconomicMap;
 import org.jspecify.annotations.Nullable;
 import org.pkl.core.PklBugException;
diff --git a/pkl-core/src/main/java/org/pkl/core/packages/PackageResolvers.java b/pkl-core/src/main/java/org/pkl/core/packages/PackageResolvers.java
index 6519bae4..b8c8f52a 100644
--- a/pkl-core/src/main/java/org/pkl/core/packages/PackageResolvers.java
+++ b/pkl-core/src/main/java/org/pkl/core/packages/PackageResolvers.java
@@ -15,6 +15,7 @@
  */
 package org.pkl.core.packages;
 
+import com.google.errorprone.annotations.concurrent.GuardedBy;
 import java.io.ByteArrayInputStream;
 import java.io.FileNotFoundException;
 import java.io.IOException;
@@ -42,7 +43,6 @@ import java.util.concurrent.atomic.AtomicBoolean;
 import java.util.stream.Collectors;
 import java.util.stream.StreamSupport;
 import java.util.zip.ZipInputStream;
-import javax.annotation.concurrent.GuardedBy;
 import org.graalvm.collections.EconomicMap;
 import org.jspecify.annotations.Nullable;
 import org.pkl.core.SecurityManager;
diff --git a/pkl-core/src/main/java/org/pkl/core/runtime/VmClass.java b/pkl-core/src/main/java/org/pkl/core/runtime/VmClass.java
index 59d8d20e..14db5a83 100644
--- a/pkl-core/src/main/java/org/pkl/core/runtime/VmClass.java
+++ b/pkl-core/src/main/java/org/pkl/core/runtime/VmClass.java
@@ -15,6 +15,7 @@
  */
 package org.pkl.core.runtime;
 
+import com.google.errorprone.annotations.concurrent.GuardedBy;
 import com.oracle.truffle.api.CompilerDirectives.CompilationFinal;
 import com.oracle.truffle.api.CompilerDirectives.TruffleBoundary;
 import com.oracle.truffle.api.dsl.Idempotent;
@@ -22,7 +23,6 @@ import com.oracle.truffle.api.frame.FrameDescriptor;
 import com.oracle.truffle.api.source.SourceSection;
 import java.util.*;
 import java.util.function.*;
-import javax.annotation.concurrent.GuardedBy;
 import org.graalvm.collections.*;
 import org.jspecify.annotations.Nullable;
 import org.pkl.core.Member.SourceLocation;
diff --git a/pkl-core/src/main/java/org/pkl/core/runtime/VmMapping.java b/pkl-core/src/main/java/org/pkl/core/runtime/VmMapping.java
index eb80f303..c7444345 100644
--- a/pkl-core/src/main/java/org/pkl/core/runtime/VmMapping.java
+++ b/pkl-core/src/main/java/org/pkl/core/runtime/VmMapping.java
@@ -15,11 +15,11 @@
  */
 package org.pkl.core.runtime;
 
+import com.google.errorprone.annotations.concurrent.GuardedBy;
 import com.oracle.truffle.api.CompilerDirectives.TruffleBoundary;
 import com.oracle.truffle.api.frame.MaterializedFrame;
 import java.util.HashSet;
 import java.util.Map;
-import javax.annotation.concurrent.GuardedBy;
 import org.graalvm.collections.UnmodifiableEconomicMap;
 import org.pkl.core.ast.member.ListingOrMappingTypeCastNode;
 import org.pkl.core.ast.member.ObjectMember;
diff --git a/pkl-core/src/main/java/org/pkl/core/runtime/VmTypeAlias.java b/pkl-core/src/main/java/org/pkl/core/runtime/VmTypeAlias.java
index 4a97079f..3de9ffad 100644
--- a/pkl-core/src/main/java/org/pkl/core/runtime/VmTypeAlias.java
+++ b/pkl-core/src/main/java/org/pkl/core/runtime/VmTypeAlias.java
@@ -15,6 +15,7 @@
  */
 package org.pkl.core.runtime;
 
+import com.google.errorprone.annotations.concurrent.GuardedBy;
 import com.oracle.truffle.api.CompilerDirectives.TruffleBoundary;
 import com.oracle.truffle.api.frame.Frame;
 import com.oracle.truffle.api.frame.MaterializedFrame;
@@ -22,7 +23,6 @@ import com.oracle.truffle.api.source.SourceSection;
 import java.net.URI;
 import java.util.ArrayList;
 import java.util.List;
-import javax.annotation.concurrent.GuardedBy;
 import org.jspecify.annotations.Nullable;
 import org.pkl.core.Member.SourceLocation;
 import org.pkl.core.PClassInfo;
diff --git a/pkl-core/src/main/java/org/pkl/core/util/StringSimilarity.java b/pkl-core/src/main/java/org/pkl/core/util/StringSimilarity.java
index 4c19dec8..51ff92e9 100644
--- a/pkl-core/src/main/java/org/pkl/core/util/StringSimilarity.java
+++ b/pkl-core/src/main/java/org/pkl/core/util/StringSimilarity.java
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -16,7 +16,6 @@
 package org.pkl.core.util;
 
 import java.util.Arrays;
-import javax.annotation.concurrent.Immutable;
 
 /**
  * The Jaro–Winkler distance metric is designed and best suited for short strings such as person
@@ -28,7 +27,6 @@ import javax.annotation.concurrent.Immutable;
  *
  * @author Thibault Debatty
  */
-@Immutable
 public final class StringSimilarity {
   private static final double DEFAULT_THRESHOLD = 0.7;
   private static final int THREE = 3;
@@ -54,7 +52,7 @@ public final class StringSimilarity {
    *
    * @return the current value of the threshold
    */
-  public final double getThreshold() {
+  public double getThreshold() {
     return threshold;
   }
 
@@ -65,7 +63,7 @@ public final class StringSimilarity {
    * @param s2 The second string to compare.
    * @return The Jaro-Winkler similarity in the range [0, 1]
    */
-  public final double similarity(final String s1, final String s2) {
+  public double similarity(final String s1, final String s2) {
     if (s1.equals(s2)) {
       return 1;
     }
@@ -90,7 +88,7 @@ public final class StringSimilarity {
    * @param s2 The second string to compare.
    * @return 1 - similarity.
    */
-  public final double distance(final String s1, final String s2) {
+  public double distance(final String s1, final String s2) {
     return 1.0 - similarity(s1, s2);
   }