diff --git a/pkl-core/src/main/java/org/pkl/core/http/DummyHttpClient.java b/pkl-core/src/main/java/org/pkl/core/http/DummyHttpClient.java
index 6af91aab..cc9380fe 100644
--- a/pkl-core/src/main/java/org/pkl/core/http/DummyHttpClient.java
+++ b/pkl-core/src/main/java/org/pkl/core/http/DummyHttpClient.java
@@ -15,11 +15,13 @@
  */
 package org.pkl.core.http;
 
+import com.google.errorprone.annotations.ThreadSafe;
 import java.net.http.HttpRequest;
 import java.net.http.HttpResponse;
 import java.net.http.HttpResponse.BodyHandler;
 
 /** An {@code HttpClient} implementation that throws {@code AssertionError} on every send. */
+@ThreadSafe
 final class DummyHttpClient implements HttpClient {
   @Override
   public <T> HttpResponse<T> send(HttpRequest request, BodyHandler<T> responseBodyHandler) {
diff --git a/pkl-core/src/main/java/org/pkl/core/http/JdkHttpClient.java b/pkl-core/src/main/java/org/pkl/core/http/JdkHttpClient.java
index f2f0c331..6c2092cf 100644
--- a/pkl-core/src/main/java/org/pkl/core/http/JdkHttpClient.java
+++ b/pkl-core/src/main/java/org/pkl/core/http/JdkHttpClient.java
@@ -15,6 +15,7 @@
  */
 package org.pkl.core.http;
 
+import com.google.errorprone.annotations.ThreadSafe;
 import java.io.ByteArrayInputStream;
 import java.io.IOException;
 import java.io.InputStream;
@@ -49,6 +50,7 @@ import org.pkl.core.util.ErrorMessages;
 import org.pkl.core.util.Exceptions;
 
 /** An {@code HttpClient} implementation backed by {@link java.net.http.HttpClient}. */
+@ThreadSafe
 final class JdkHttpClient implements HttpClient {
   // non-private for testing
   final java.net.http.HttpClient underlying;
diff --git a/pkl-core/src/main/java/org/pkl/core/http/LazyHttpClient.java b/pkl-core/src/main/java/org/pkl/core/http/LazyHttpClient.java
index 4d2a6262..5696e2d1 100644
--- a/pkl-core/src/main/java/org/pkl/core/http/LazyHttpClient.java
+++ b/pkl-core/src/main/java/org/pkl/core/http/LazyHttpClient.java
@@ -15,6 +15,7 @@
  */
 package org.pkl.core.http;
 
+import com.google.errorprone.annotations.ThreadSafe;
 import com.google.errorprone.annotations.concurrent.GuardedBy;
 import java.io.IOException;
 import java.net.http.HttpRequest;
@@ -28,6 +29,7 @@ import org.jspecify.annotations.Nullable;
  * An {@code HttpClient} decorator that defers creating the underlying HTTP client until the first
  * send.
  */
+@ThreadSafe
 final class LazyHttpClient implements HttpClient {
   private final Supplier<HttpClient> supplier;
   private final Object lock = new Object();
diff --git a/pkl-core/src/main/java/org/pkl/core/http/RequestRewritingClient.java b/pkl-core/src/main/java/org/pkl/core/http/RequestRewritingClient.java
index 09f2d513..7b7d39e2 100644
--- a/pkl-core/src/main/java/org/pkl/core/http/RequestRewritingClient.java
+++ b/pkl-core/src/main/java/org/pkl/core/http/RequestRewritingClient.java
@@ -15,6 +15,7 @@
  */
 package org.pkl.core.http;
 
+import com.google.errorprone.annotations.ThreadSafe;
 import java.io.IOException;
 import java.net.URI;
 import java.net.URISyntaxException;
@@ -49,6 +50,7 @@ import org.pkl.core.util.Pair;
  * <p>Both {@code User-Agent} header and default request timeout are configurable through {@link
  * HttpClient.Builder}.
  */
+@ThreadSafe
 final class RequestRewritingClient implements HttpClient {
   // non-private for testing
   final String userAgent;
diff --git a/pkl-core/src/main/java/org/pkl/core/util/StringSimilarity.java b/pkl-core/src/main/java/org/pkl/core/util/StringSimilarity.java
index 51ff92e9..3b735074 100644
--- a/pkl-core/src/main/java/org/pkl/core/util/StringSimilarity.java
+++ b/pkl-core/src/main/java/org/pkl/core/util/StringSimilarity.java
@@ -15,6 +15,7 @@
  */
 package org.pkl.core.util;
 
+import com.google.errorprone.annotations.Immutable;
 import java.util.Arrays;
 
 /**
@@ -27,6 +28,7 @@ import java.util.Arrays;
  *
  * @author Thibault Debatty
  */
+@Immutable
 public final class StringSimilarity {
   private static final double DEFAULT_THRESHOLD = 0.7;
   private static final int THREE = 3;