diff --git a/CLAUDE.md b/CLAUDE.md
index 4edf593..e793e9f 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -28,7 +28,6 @@ mvn verify                     # Run tests and integration checks
 ```bash
 mvn spotless:check             # Check code formatting (Google Java Format)
 mvn spotless:apply             # Apply code formatting
-mvn com.github.spotbugs:spotbugs-maven-plugin:check  # Run SpotBugs static analysis
 mvn pmd:check                  # Run PMD static analysis
 mvn jacoco:check               # Check code coverage requirements
 ```
@@ -76,7 +75,8 @@ mvn site                      # Generate project site with reports
 ### Code Style
 - Google Java Format style enforced via Spotless
 - PMD rules defined in `pmd-ruleset.xml`
-- SpotBugs static analysis with exclusions in `spotbug-exclude-filter.xml`
+- Error Prone and NullAway (JSpecify mode) run during compilation, `-Werror` turns every warning into an error
+- Code is `@NullMarked`; nullable API points are annotated with `org.jspecify.annotations.Nullable`
 - No code comments should be added unless specifically requested
 - Prefer immutable objects and defensive copying
 - Use builder patterns for complex object construction
diff --git a/pom.xml b/pom.xml
index cec11bb..f344570 100644
--- a/pom.xml
+++ b/pom.xml
@@ -48,10 +48,10 @@
 	</scm>
 
 	<properties>
-		<junit.version>6.0.3</junit.version>
+		<junit.version>6.1.3</junit.version>
 		<errorprone.version>2.50.0</errorprone.version>
-		<nullaway.version>0.13.7</nullaway.version>
-		<pmd.version>7.22.0</pmd.version>
+		<nullaway.version>0.14.2</nullaway.version>
+		<pmd.version>7.28.0</pmd.version>
 		<gpg.skip>true</gpg.skip>
 		<maven.compiler.release>25</maven.compiler.release>
 		<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
@@ -97,7 +97,7 @@
 		<dependency>
 			<groupId>org.jspecify</groupId>
 			<artifactId>jspecify</artifactId>
-			<version>1.0.0</version>
+			<version>1.0.1</version>
 			<optional>true</optional>
 		</dependency>
 
@@ -132,7 +132,7 @@
 		<dependency>
 			<groupId>nl.jqno.equalsverifier</groupId>
 			<artifactId>equalsverifier</artifactId>
-			<version>4.4.1</version>
+			<version>4.5.2</version>
 			<scope>test</scope>
 		</dependency>
 
@@ -149,12 +149,12 @@
 		<plugins>
 			<plugin>
 				<artifactId>maven-compiler-plugin</artifactId>
-				<version>3.15.0</version>
+				<version>3.16.0</version>
 				<configuration>
 					<compilerArgs>
 						<arg>-XDcompilePolicy=simple</arg>
 						<arg>--should-stop=ifError=FLOW</arg>
-						<arg>-Xplugin:ErrorProne -Xep:NullAway:ERROR -XepOpt:NullAway:JSpecifyMode=true -XepOpt:NullAway:AnnotatedPackages=com.sitepark.ies</arg>
+						<arg>-Xplugin:ErrorProne -Xep:NullAway:ERROR -XepOpt:NullAway:JSpecifyMode=true -XepOpt:NullAway:AnnotatedPackages=com.sitepark</arg>
 						<!-- Treat every Error Prone / javac warning as a build error. -->
 						<arg>-Werror</arg>
 					</compilerArgs>
@@ -172,8 +172,7 @@
 					</annotationProcessorPaths>
 				</configuration>
 				<executions>
-					<!-- Test code: run Error Prone but disable NullAway. Tests deliberately pass
-					     null to verify rejection, which would otherwise trip NullAway. -->
+					<!-- Test code: Error Prone on, NullAway off (tests pass null intentionally) -->
 					<execution>
 						<id>default-testCompile</id>
 						<configuration>
@@ -188,11 +187,13 @@
 			</plugin>
 			<plugin>
 				<artifactId>maven-jar-plugin</artifactId>
-				<version>3.5.0</version>
+				<version>3.5.1</version>
 			</plugin>
 			<plugin>
+				<!-- Provides the property ${org.mockito:mockito-core:jar} for the Mockito agent -->
 				<groupId>org.apache.maven.plugins</groupId>
 				<artifactId>maven-dependency-plugin</artifactId>
+				<version>3.11.0</version>
 				<executions>
 					<execution>
 						<goals>
@@ -204,8 +205,9 @@
 			<plugin>
 				<groupId>org.apache.maven.plugins</groupId>
 				<artifactId>maven-surefire-plugin</artifactId>
-				<version>3.5.5</version>
+				<version>3.6.0</version>
 				<configuration>
+					<!-- Load Mockito as agent, the JDK blocks its dynamic self-attach in the future -->
 					<argLine>@{argLine} -javaagent:${org.mockito:mockito-core:jar}</argLine>
 					<consoleOutputReporter>
 						<disable>true</disable>
@@ -277,7 +279,7 @@
 			<plugin>
 				<groupId>org.apache.maven.plugins</groupId>
 				<artifactId>maven-enforcer-plugin</artifactId>
-				<version>3.6.2</version>
+				<version>3.6.3</version>
 				<dependencies>
 					<dependency>
 						<groupId>io.github.thefolle</groupId>
@@ -325,7 +327,7 @@
 			<plugin>
 				<groupId>org.jacoco</groupId>
 				<artifactId>jacoco-maven-plugin</artifactId>
-				<version>0.8.14</version>
+				<version>0.8.15</version>
 				<executions>
 					<execution>
 						<goals>
@@ -340,12 +342,17 @@
 						<configuration>
 							<rules>
 								<rule>
-									<element>PACKAGE</element>
+									<element>BUNDLE</element>
 									<limits>
 										<limit>
 											<counter>LINE</counter>
-											<minimum>0.0</minimum>
 											<value>COVEREDRATIO</value>
+											<minimum>0.85</minimum>
+										</limit>
+										<limit>
+											<counter>BRANCH</counter>
+											<value>COVEREDRATIO</value>
+											<minimum>0.80</minimum>
 										</limit>
 									</limits>
 								</rule>
@@ -366,22 +373,19 @@
 				<artifactId>spotless-maven-plugin</artifactId>
 				<version>3.10.3</version>
 				<configuration>
-					<!-- define a language-specific format -->
 					<java>
-						<removeUnusedImports>
-							<engine>google-java-format</engine>
-						</removeUnusedImports>
-
 						<!-- apply a specific flavor of google-java-format and reflow long strings -->
 						<googleJavaFormat>
-							<version>1.31.0</version>
+							<version>1.36.1</version>
 							<style>GOOGLE</style>
 							<reflowLongStrings>true</reflowLongStrings>
 							<formatJavadoc>false</formatJavadoc>
 						</googleJavaFormat>
+						<removeUnusedImports>
+							<engine>google-java-format</engine>
+						</removeUnusedImports>
 					</java>
 					<pom>
-						<!-- These are the defaults, you can override if you want -->
 						<includes>
 							<include>pom.xml</include>
 						</includes>
@@ -392,9 +396,20 @@
 					</pom>
 				</configuration>
 				<executions>
+					<!-- Formats locally; skipped in the ci profile, so that the check below can fail -->
+					<execution>
+						<id>spotless-apply</id>
+						<goals>
+							<goal>apply</goal>
+						</goals>
+						<phase>process-sources</phase>
+						<configuration>
+							<skip>${spotless.apply.skip}</skip>
+						</configuration>
+					</execution>
 					<execution>
-						<?m2e ignore?>
 						<id>spotless-check</id>
+						<?m2e ignore?>
 						<goals>
 							<goal>check</goal>
 						</goals>
@@ -407,14 +422,14 @@
 				<artifactId>maven-pmd-plugin</artifactId>
 				<version>3.28.0</version>
 				<configuration>
+					<failOnViolation>true</failOnViolation>
+					<failurePriority>5</failurePriority>
+					<includeTests>true</includeTests>
+					<linkXRef>false</linkXRef>
+					<printFailingErrors>true</printFailingErrors>
 					<rulesets>
 						<ruleset>pmd-ruleset.xml</ruleset>
 					</rulesets>
-					<includeTests>true</includeTests>
-					<failOnViolation>true</failOnViolation>
-					<failurePriority>1</failurePriority>
-					<printFailingErrors>true</printFailingErrors>
-					<linkXRef>false</linkXRef>
 				</configuration>
 				<dependencies>
 					<dependency>
@@ -460,7 +475,7 @@
 					<plugin>
 						<groupId>org.sonatype.central</groupId>
 						<artifactId>central-publishing-maven-plugin</artifactId>
-						<version>0.10.0</version>
+						<version>0.11.0</version>
 						<extensions>true</extensions>
 						<configuration>
 							<autoPublish>true</autoPublish>
diff --git a/src/main/java/com/sitepark/ies/sharedkernel/base/IdentifierListBuilder.java b/src/main/java/com/sitepark/ies/sharedkernel/base/IdentifierListBuilder.java
index 88c4fe1..058a143 100644
--- a/src/main/java/com/sitepark/ies/sharedkernel/base/IdentifierListBuilder.java
+++ b/src/main/java/com/sitepark/ies/sharedkernel/base/IdentifierListBuilder.java
@@ -5,14 +5,16 @@
 import java.util.Collection;
 import java.util.List;
 import org.jspecify.annotations.NonNull;
+import org.jspecify.annotations.Nullable;
 
+/** Collects identifiers; every method ignores {@code null}, so optional values can be passed as is. */
 @SuppressWarnings("PMD.TooManyMethods")
 public class IdentifierListBuilder {
 
   @NonNull private final List<Identifier> identifiers = new ArrayList<>();
   private boolean changed;
 
-  public IdentifierListBuilder set(String... identifiers) {
+  public IdentifierListBuilder set(String @Nullable ... identifiers) {
     if (identifiers == null) {
       return this;
     }
@@ -24,7 +26,7 @@ public IdentifierListBuilder set(String... identifiers) {
     return this;
   }
 
-  public IdentifierListBuilder set(Collection<String> identifiers) {
+  public IdentifierListBuilder set(@Nullable Collection<String> identifiers) {
     if (identifiers == null) {
       return this;
     }
@@ -36,7 +38,7 @@ public IdentifierListBuilder set(Collection<String> identifiers) {
     return this;
   }
 
-  public IdentifierListBuilder add(String identifier) {
+  public IdentifierListBuilder add(@Nullable String identifier) {
     if (identifier == null) {
       return this;
     }
@@ -45,7 +47,7 @@ public IdentifierListBuilder add(String identifier) {
     return this;
   }
 
-  public IdentifierListBuilder identifiers(Identifier... identifiers) {
+  public IdentifierListBuilder identifiers(Identifier @Nullable ... identifiers) {
     if (identifiers == null) {
       return this;
     }
@@ -57,7 +59,7 @@ public IdentifierListBuilder identifiers(Identifier... identifiers) {
     return this;
   }
 
-  public IdentifierListBuilder identifiers(Collection<Identifier> identifiers) {
+  public IdentifierListBuilder identifiers(@Nullable Collection<Identifier> identifiers) {
     if (identifiers == null) {
       return this;
     }
@@ -69,7 +71,7 @@ public IdentifierListBuilder identifiers(Collection<Identifier> identifiers) {
     return this;
   }
 
-  public IdentifierListBuilder identifier(Identifier identifier) {
+  public IdentifierListBuilder identifier(@Nullable Identifier identifier) {
     if (identifier == null) {
       return this;
     }
@@ -78,7 +80,7 @@ public IdentifierListBuilder identifier(Identifier identifier) {
     return this;
   }
 
-  public IdentifierListBuilder ids(String... ids) {
+  public IdentifierListBuilder ids(String @Nullable ... ids) {
     if (ids == null) {
       return this;
     }
@@ -90,7 +92,7 @@ public IdentifierListBuilder ids(String... ids) {
     return this;
   }
 
-  public IdentifierListBuilder ids(Collection<String> ids) {
+  public IdentifierListBuilder ids(@Nullable Collection<String> ids) {
     if (ids == null) {
       return this;
     }
@@ -102,7 +104,7 @@ public IdentifierListBuilder ids(Collection<String> ids) {
     return this;
   }
 
-  public IdentifierListBuilder id(String id) {
+  public IdentifierListBuilder id(@Nullable String id) {
     if (id == null || id.isBlank()) {
       return this;
     }
@@ -111,7 +113,7 @@ public IdentifierListBuilder id(String id) {
     return this;
   }
 
-  public IdentifierListBuilder anchors(Anchor... anchors) {
+  public IdentifierListBuilder anchors(Anchor @Nullable ... anchors) {
     if (anchors == null) {
       return this;
     }
@@ -123,7 +125,7 @@ public IdentifierListBuilder anchors(Anchor... anchors) {
     return this;
   }
 
-  public IdentifierListBuilder anchors(Collection<Anchor> anchors) {
+  public IdentifierListBuilder anchors(@Nullable Collection<Anchor> anchors) {
     if (anchors == null) {
       return this;
     }
@@ -135,7 +137,7 @@ public IdentifierListBuilder anchors(Collection<Anchor> anchors) {
     return this;
   }
 
-  public IdentifierListBuilder anchor(Anchor anchor) {
+  public IdentifierListBuilder anchor(@Nullable Anchor anchor) {
     if (anchor == null) {
       return this;
     }
diff --git a/src/test/java/com/sitepark/ies/sharedkernel/security/AuthenticationTest.java b/src/test/java/com/sitepark/ies/sharedkernel/security/AuthenticationTest.java
index ed60d62..d6b0b5d 100644
--- a/src/test/java/com/sitepark/ies/sharedkernel/security/AuthenticationTest.java
+++ b/src/test/java/com/sitepark/ies/sharedkernel/security/AuthenticationTest.java
@@ -1,7 +1,10 @@
 package com.sitepark.ies.sharedkernel.security;
 
-import static org.junit.jupiter.api.Assertions.*;
-import static org.mockito.Mockito.*;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.mockito.Mockito.spy;
+import static org.mockito.Mockito.when;
 
 import java.util.List;
 import java.util.Optional;