diff --git a/build.gradle b/build.gradle
index 1266a79..b3763f1 100644
--- a/build.gradle
+++ b/build.gradle
@@ -31,6 +31,7 @@ dependencies {
     implementation("org.openrewrite.recipe:rewrite-spring:$rewriteVersion")
     implementation("com.nimbusds:nimbus-jose-jwt:9.+")
 
+    implementation "org.jspecify:jspecify:1.0.0"
     runtimeOnly("org.openrewrite:rewrite-java-17")
 
     testImplementation("org.junit.jupiter:junit-jupiter-api:latest.release")
diff --git a/src/main/java/org/openrewrite/java/security/FindTextDirectionChanges.java b/src/main/java/org/openrewrite/java/security/FindTextDirectionChanges.java
index e65cf03..8cfc5db 100644
--- a/src/main/java/org/openrewrite/java/security/FindTextDirectionChanges.java
+++ b/src/main/java/org/openrewrite/java/security/FindTextDirectionChanges.java
@@ -15,11 +15,11 @@
  */
 package org.openrewrite.java.security;
 
+import org.jspecify.annotations.Nullable;
 import org.openrewrite.ExecutionContext;
 import org.openrewrite.Recipe;
 import org.openrewrite.Tree;
 import org.openrewrite.TreeVisitor;
-import org.openrewrite.internal.lang.Nullable;
 import org.openrewrite.java.JavaIsoVisitor;
 import org.openrewrite.java.tree.Comment;
 import org.openrewrite.java.tree.J;
diff --git a/src/main/java/org/openrewrite/java/security/PartialPathTraversalVulnerability.java b/src/main/java/org/openrewrite/java/security/PartialPathTraversalVulnerability.java
index 8c4b669..669a955 100644
--- a/src/main/java/org/openrewrite/java/security/PartialPathTraversalVulnerability.java
+++ b/src/main/java/org/openrewrite/java/security/PartialPathTraversalVulnerability.java
@@ -17,6 +17,7 @@
 
 import lombok.AllArgsConstructor;
 import lombok.Value;
+import org.jspecify.annotations.Nullable;
 import org.openrewrite.*;
 import org.openrewrite.analysis.InvocationMatcher;
 import org.openrewrite.analysis.dataflow.DataFlowNode;
@@ -24,7 +25,6 @@
 import org.openrewrite.analysis.dataflow.Dataflow;
 import org.openrewrite.analysis.search.UsesAllInvocations;
 import org.openrewrite.analysis.trait.expr.Call;
-import org.openrewrite.internal.lang.Nullable;
 import org.openrewrite.java.JavaIsoVisitor;
 import org.openrewrite.java.JavaTemplate;
 import org.openrewrite.java.security.internal.CursorUtil;
@@ -185,7 +185,7 @@ public boolean isSink(DataFlowNode sinkNode) {
         static class ExpressionWithTry {
             Expression expression;
 
-            @Nullable J.Try maybeTryStatement;
+            J.@Nullable Try maybeTryStatement;
         }
 
         private static @Nullable J.Try findNearestRelevantTry(Cursor startCursor) {
diff --git a/src/main/java/org/openrewrite/java/security/PathTraversalGuardInsertionVisitor.java b/src/main/java/org/openrewrite/java/security/PathTraversalGuardInsertionVisitor.java
index abec938..4435169 100644
--- a/src/main/java/org/openrewrite/java/security/PathTraversalGuardInsertionVisitor.java
+++ b/src/main/java/org/openrewrite/java/security/PathTraversalGuardInsertionVisitor.java
@@ -18,6 +18,8 @@
 import lombok.AllArgsConstructor;
 import lombok.EqualsAndHashCode;
 import lombok.Value;
+import org.jspecify.annotations.NonNull;
+import org.jspecify.annotations.Nullable;
 import org.openrewrite.Cursor;
 import org.openrewrite.Incubating;
 import org.openrewrite.Tree;
@@ -25,8 +27,6 @@
 import org.openrewrite.analysis.controlflow.Guard;
 import org.openrewrite.analysis.dataflow.*;
 import org.openrewrite.analysis.trait.expr.Call;
-import org.openrewrite.internal.lang.NonNull;
-import org.openrewrite.internal.lang.Nullable;
 import org.openrewrite.java.*;
 import org.openrewrite.java.security.internal.CursorUtil;
 import org.openrewrite.java.security.internal.FileConstructorFixVisitor;
diff --git a/src/main/java/org/openrewrite/java/security/SecureTempFileCreation.java b/src/main/java/org/openrewrite/java/security/SecureTempFileCreation.java
index d5658b3..2baba5d 100644
--- a/src/main/java/org/openrewrite/java/security/SecureTempFileCreation.java
+++ b/src/main/java/org/openrewrite/java/security/SecureTempFileCreation.java
@@ -17,11 +17,11 @@
 
 import lombok.EqualsAndHashCode;
 import lombok.Value;
+import org.jspecify.annotations.Nullable;
 import org.openrewrite.ExecutionContext;
 import org.openrewrite.Preconditions;
 import org.openrewrite.Recipe;
 import org.openrewrite.TreeVisitor;
-import org.openrewrite.internal.lang.Nullable;
 import org.openrewrite.java.JavaIsoVisitor;
 import org.openrewrite.java.JavaTemplate;
 import org.openrewrite.java.MethodMatcher;
diff --git a/src/main/java/org/openrewrite/java/security/UseFilesCreateTempDirectory.java b/src/main/java/org/openrewrite/java/security/UseFilesCreateTempDirectory.java
index f43fbe2..bda5e5c 100644
--- a/src/main/java/org/openrewrite/java/security/UseFilesCreateTempDirectory.java
+++ b/src/main/java/org/openrewrite/java/security/UseFilesCreateTempDirectory.java
@@ -17,10 +17,10 @@
 
 import lombok.AllArgsConstructor;
 import lombok.NoArgsConstructor;
+import org.jspecify.annotations.Nullable;
 import org.openrewrite.*;
 import org.openrewrite.analysis.InvocationMatcher;
 import org.openrewrite.internal.ListUtils;
-import org.openrewrite.internal.lang.Nullable;
 import org.openrewrite.java.*;
 import org.openrewrite.java.marker.JavaVersion;
 import org.openrewrite.java.search.UsesMethod;
diff --git a/src/main/java/org/openrewrite/java/security/XmlParserXXEVulnerability.java b/src/main/java/org/openrewrite/java/security/XmlParserXXEVulnerability.java
index 55d5010..9b3eb44 100644
--- a/src/main/java/org/openrewrite/java/security/XmlParserXXEVulnerability.java
+++ b/src/main/java/org/openrewrite/java/security/XmlParserXXEVulnerability.java
@@ -15,8 +15,8 @@
  */
 package org.openrewrite.java.security;
 
+import org.jspecify.annotations.Nullable;
 import org.openrewrite.*;
-import org.openrewrite.internal.lang.Nullable;
 import org.openrewrite.java.security.xml.DocumentBuilderFactoryFixVisitor;
 import org.openrewrite.java.security.xml.ExternalDTDAccumulator;
 import org.openrewrite.java.security.xml.TransformerFactoryFixVisitor;
diff --git a/src/main/java/org/openrewrite/java/security/internal/package-info.java b/src/main/java/org/openrewrite/java/security/internal/package-info.java
index a0a32bb..b77a775 100644
--- a/src/main/java/org/openrewrite/java/security/internal/package-info.java
+++ b/src/main/java/org/openrewrite/java/security/internal/package-info.java
@@ -13,7 +13,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-@NonNullApi
+@NullMarked
 package org.openrewrite.java.security.internal;
 
-import org.openrewrite.internal.lang.NonNullApi;
+import org.jspecify.annotations.NullMarked;
diff --git a/src/main/java/org/openrewrite/java/security/marshalling/SecureSnakeYamlConstructor.java b/src/main/java/org/openrewrite/java/security/marshalling/SecureSnakeYamlConstructor.java
index c74edfd..5e85830 100644
--- a/src/main/java/org/openrewrite/java/security/marshalling/SecureSnakeYamlConstructor.java
+++ b/src/main/java/org/openrewrite/java/security/marshalling/SecureSnakeYamlConstructor.java
@@ -15,11 +15,11 @@
  */
 package org.openrewrite.java.security.marshalling;
 
+import org.jspecify.annotations.Nullable;
 import org.openrewrite.Cursor;
 import org.openrewrite.ExecutionContext;
 import org.openrewrite.Recipe;
 import org.openrewrite.TreeVisitor;
-import org.openrewrite.internal.lang.Nullable;
 import org.openrewrite.java.*;
 import org.openrewrite.java.tree.J;
 import org.openrewrite.java.tree.JavaType;
diff --git a/src/main/java/org/openrewrite/java/security/marshalling/package-info.java b/src/main/java/org/openrewrite/java/security/marshalling/package-info.java
index 61586f0..44cd07e 100644
--- a/src/main/java/org/openrewrite/java/security/marshalling/package-info.java
+++ b/src/main/java/org/openrewrite/java/security/marshalling/package-info.java
@@ -13,7 +13,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-@NonNullApi
+@NullMarked
 package org.openrewrite.java.security.marshalling;
 
-import org.openrewrite.internal.lang.NonNullApi;
+import org.jspecify.annotations.NullMarked;
diff --git a/src/main/java/org/openrewrite/java/security/package-info.java b/src/main/java/org/openrewrite/java/security/package-info.java
index 5bd1c2a..af8c11e 100644
--- a/src/main/java/org/openrewrite/java/security/package-info.java
+++ b/src/main/java/org/openrewrite/java/security/package-info.java
@@ -13,7 +13,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-@NonNullApi
+@NullMarked
 package org.openrewrite.java.security;
 
-import org.openrewrite.internal.lang.NonNullApi;
+import org.jspecify.annotations.NullMarked;
diff --git a/src/main/java/org/openrewrite/java/security/search/FindSensitiveApiEndpoints.java b/src/main/java/org/openrewrite/java/security/search/FindSensitiveApiEndpoints.java
index e004135..79f2d5c 100644
--- a/src/main/java/org/openrewrite/java/security/search/FindSensitiveApiEndpoints.java
+++ b/src/main/java/org/openrewrite/java/security/search/FindSensitiveApiEndpoints.java
@@ -17,8 +17,8 @@
 
 import lombok.EqualsAndHashCode;
 import lombok.Value;
+import org.jspecify.annotations.Nullable;
 import org.openrewrite.*;
-import org.openrewrite.internal.lang.Nullable;
 import org.openrewrite.java.AnnotationMatcher;
 import org.openrewrite.java.JavaIsoVisitor;
 import org.openrewrite.java.security.table.SensitiveApiEndpoints;
diff --git a/src/main/java/org/openrewrite/java/security/search/package-info.java b/src/main/java/org/openrewrite/java/security/search/package-info.java
index bcbf7bb..c67c2f4 100644
--- a/src/main/java/org/openrewrite/java/security/search/package-info.java
+++ b/src/main/java/org/openrewrite/java/security/search/package-info.java
@@ -13,7 +13,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-@NonNullApi
+@NullMarked
 package org.openrewrite.java.security.search;
 
-import org.openrewrite.internal.lang.NonNullApi;
+import org.jspecify.annotations.NullMarked;
diff --git a/src/main/java/org/openrewrite/java/security/secrets/FindJwtSecrets.java b/src/main/java/org/openrewrite/java/security/secrets/FindJwtSecrets.java
index 1c15c8d..3690250 100644
--- a/src/main/java/org/openrewrite/java/security/secrets/FindJwtSecrets.java
+++ b/src/main/java/org/openrewrite/java/security/secrets/FindJwtSecrets.java
@@ -16,10 +16,10 @@
 package org.openrewrite.java.security.secrets;
 
 import com.nimbusds.jwt.JWTParser;
+import org.jspecify.annotations.Nullable;
 import org.openrewrite.ExecutionContext;
 import org.openrewrite.Recipe;
 import org.openrewrite.TreeVisitor;
-import org.openrewrite.internal.lang.Nullable;
 
 import java.text.ParseException;
 import java.util.regex.Pattern;
diff --git a/src/main/java/org/openrewrite/java/security/secrets/FindSecretsByPattern.java b/src/main/java/org/openrewrite/java/security/secrets/FindSecretsByPattern.java
index ec438ce..cf4972d 100644
--- a/src/main/java/org/openrewrite/java/security/secrets/FindSecretsByPattern.java
+++ b/src/main/java/org/openrewrite/java/security/secrets/FindSecretsByPattern.java
@@ -17,8 +17,8 @@
 
 import lombok.EqualsAndHashCode;
 import lombok.Value;
+import org.jspecify.annotations.Nullable;
 import org.openrewrite.*;
-import org.openrewrite.internal.lang.Nullable;
 
 import java.util.regex.Pattern;
 
diff --git a/src/main/java/org/openrewrite/java/security/secrets/FindSecretsVisitor.java b/src/main/java/org/openrewrite/java/security/secrets/FindSecretsVisitor.java
index b66b5b2..3060c52 100644
--- a/src/main/java/org/openrewrite/java/security/secrets/FindSecretsVisitor.java
+++ b/src/main/java/org/openrewrite/java/security/secrets/FindSecretsVisitor.java
@@ -15,11 +15,11 @@
  */
 package org.openrewrite.java.security.secrets;
 
+import org.jspecify.annotations.Nullable;
 import org.openrewrite.ExecutionContext;
 import org.openrewrite.Tree;
 import org.openrewrite.TreeVisitor;
 import org.openrewrite.internal.ListUtils;
-import org.openrewrite.internal.lang.Nullable;
 import org.openrewrite.java.JavaVisitor;
 import org.openrewrite.java.tree.J;
 import org.openrewrite.java.tree.JavaType;
diff --git a/src/main/java/org/openrewrite/java/security/secrets/FindSlackSecrets.java b/src/main/java/org/openrewrite/java/security/secrets/FindSlackSecrets.java
index 1418b3f..7c1ef16 100644
--- a/src/main/java/org/openrewrite/java/security/secrets/FindSlackSecrets.java
+++ b/src/main/java/org/openrewrite/java/security/secrets/FindSlackSecrets.java
@@ -15,8 +15,8 @@
  */
 package org.openrewrite.java.security.secrets;
 
+import org.jspecify.annotations.Nullable;
 import org.openrewrite.*;
-import org.openrewrite.internal.lang.Nullable;
 
 import java.util.regex.Pattern;
 
diff --git a/src/main/java/org/openrewrite/java/security/secrets/package-info.java b/src/main/java/org/openrewrite/java/security/secrets/package-info.java
index 1ac31b7..258535c 100644
--- a/src/main/java/org/openrewrite/java/security/secrets/package-info.java
+++ b/src/main/java/org/openrewrite/java/security/secrets/package-info.java
@@ -13,7 +13,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-@NonNullApi
+@NullMarked
 package org.openrewrite.java.security.secrets;
 
-import org.openrewrite.internal.lang.NonNullApi;
+import org.jspecify.annotations.NullMarked;
diff --git a/src/main/java/org/openrewrite/java/security/servlet/package-info.java b/src/main/java/org/openrewrite/java/security/servlet/package-info.java
index 75887c5..bf84211 100644
--- a/src/main/java/org/openrewrite/java/security/servlet/package-info.java
+++ b/src/main/java/org/openrewrite/java/security/servlet/package-info.java
@@ -13,7 +13,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-@NonNullApi
+@NullMarked
 package org.openrewrite.java.security.servlet;
 
-import org.openrewrite.internal.lang.NonNullApi;
+import org.jspecify.annotations.NullMarked;
diff --git a/src/main/java/org/openrewrite/java/security/spring/CsrfProtection.java b/src/main/java/org/openrewrite/java/security/spring/CsrfProtection.java
index 78a5f8a..62b3b81 100644
--- a/src/main/java/org/openrewrite/java/security/spring/CsrfProtection.java
+++ b/src/main/java/org/openrewrite/java/security/spring/CsrfProtection.java
@@ -17,8 +17,8 @@
 
 import lombok.EqualsAndHashCode;
 import lombok.Value;
+import org.jspecify.annotations.Nullable;
 import org.openrewrite.*;
-import org.openrewrite.internal.lang.Nullable;
 import org.openrewrite.java.*;
 import org.openrewrite.java.tree.J;
 import org.openrewrite.java.tree.JavaSourceFile;
diff --git a/src/main/java/org/openrewrite/java/security/spring/InsecureSpringServiceExporter.java b/src/main/java/org/openrewrite/java/security/spring/InsecureSpringServiceExporter.java
index c457aed..56187ed 100644
--- a/src/main/java/org/openrewrite/java/security/spring/InsecureSpringServiceExporter.java
+++ b/src/main/java/org/openrewrite/java/security/spring/InsecureSpringServiceExporter.java
@@ -15,11 +15,11 @@
  */
 package org.openrewrite.java.security.spring;
 
+import org.jspecify.annotations.Nullable;
 import org.openrewrite.ExecutionContext;
 import org.openrewrite.Recipe;
 import org.openrewrite.Tree;
 import org.openrewrite.TreeVisitor;
-import org.openrewrite.internal.lang.Nullable;
 import org.openrewrite.java.JavaIsoVisitor;
 import org.openrewrite.java.tree.J;
 import org.openrewrite.java.tree.JavaSourceFile;
diff --git a/src/main/java/org/openrewrite/java/security/spring/PreventClickjacking.java b/src/main/java/org/openrewrite/java/security/spring/PreventClickjacking.java
index 044035d..2030a74 100644
--- a/src/main/java/org/openrewrite/java/security/spring/PreventClickjacking.java
+++ b/src/main/java/org/openrewrite/java/security/spring/PreventClickjacking.java
@@ -17,8 +17,8 @@
 
 import lombok.EqualsAndHashCode;
 import lombok.Value;
+import org.jspecify.annotations.Nullable;
 import org.openrewrite.*;
-import org.openrewrite.internal.lang.Nullable;
 import org.openrewrite.java.*;
 import org.openrewrite.java.search.HasTypeOnClasspathSourceSet;
 import org.openrewrite.java.tree.J;
diff --git a/src/main/java/org/openrewrite/java/security/spring/package-info.java b/src/main/java/org/openrewrite/java/security/spring/package-info.java
index 56f0404..775b5a3 100644
--- a/src/main/java/org/openrewrite/java/security/spring/package-info.java
+++ b/src/main/java/org/openrewrite/java/security/spring/package-info.java
@@ -13,7 +13,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-@NonNullApi
+@NullMarked
 package org.openrewrite.java.security.spring;
 
-import org.openrewrite.internal.lang.NonNullApi;
+import org.jspecify.annotations.NullMarked;
diff --git a/src/main/java/org/openrewrite/java/security/xml/package-info.java b/src/main/java/org/openrewrite/java/security/xml/package-info.java
index 6a638cf..75105e7 100644
--- a/src/main/java/org/openrewrite/java/security/xml/package-info.java
+++ b/src/main/java/org/openrewrite/java/security/xml/package-info.java
@@ -13,7 +13,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-@NonNullApi
+@NullMarked
 package org.openrewrite.java.security.xml;
 
-import org.openrewrite.internal.lang.NonNullApi;
+import org.jspecify.annotations.NullMarked;
diff --git a/src/test/java/org/openrewrite/java/security/SecureTempFileCreationFilteringTest.java b/src/test/java/org/openrewrite/java/security/SecureTempFileCreationFilteringTest.java
index 7b9269a..ac85b0d 100644
--- a/src/test/java/org/openrewrite/java/security/SecureTempFileCreationFilteringTest.java
+++ b/src/test/java/org/openrewrite/java/security/SecureTempFileCreationFilteringTest.java
@@ -16,12 +16,12 @@
 package org.openrewrite.java.security;
 
 import org.intellij.lang.annotations.Language;
+import org.jspecify.annotations.Nullable;
 import org.junit.jupiter.api.Test;
 import org.openrewrite.ExecutionContext;
 import org.openrewrite.ScanningRecipe;
 import org.openrewrite.Tree;
 import org.openrewrite.TreeVisitor;
-import org.openrewrite.internal.lang.Nullable;
 import org.openrewrite.java.search.IsLikelyNotTest;
 import org.openrewrite.test.RecipeSpec;
 import org.openrewrite.test.RewriteTest;
diff --git a/src/test/java/org/openrewrite/java/security/spring/CsrfProtectionTest.java b/src/test/java/org/openrewrite/java/security/spring/CsrfProtectionTest.java
index 1a66f19..631ad3e 100644
--- a/src/test/java/org/openrewrite/java/security/spring/CsrfProtectionTest.java
+++ b/src/test/java/org/openrewrite/java/security/spring/CsrfProtectionTest.java
@@ -15,9 +15,9 @@
  */
 package org.openrewrite.java.security.spring;
 
+import org.jspecify.annotations.Nullable;
 import org.junit.jupiter.api.Test;
 import org.openrewrite.InMemoryExecutionContext;
-import org.openrewrite.internal.lang.Nullable;
 import org.openrewrite.java.JavaParser;
 import org.openrewrite.test.RecipeSpec;
 import org.openrewrite.test.RewriteTest;
diff --git a/src/test/java/org/openrewrite/java/security/spring/PreventClickjackingTest.java b/src/test/java/org/openrewrite/java/security/spring/PreventClickjackingTest.java
index 4765928..acf5af9 100644
--- a/src/test/java/org/openrewrite/java/security/spring/PreventClickjackingTest.java
+++ b/src/test/java/org/openrewrite/java/security/spring/PreventClickjackingTest.java
@@ -15,9 +15,9 @@
  */
 package org.openrewrite.java.security.spring;
 
+import org.jspecify.annotations.Nullable;
 import org.junit.jupiter.api.Test;
 import org.openrewrite.InMemoryExecutionContext;
-import org.openrewrite.internal.lang.Nullable;
 import org.openrewrite.java.JavaParser;
 import org.openrewrite.test.RecipeSpec;
 import org.openrewrite.test.RewriteTest;