diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 83dc4afd..a13bf1c1 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,6 +1,37 @@
 version: 2
 updates:
   - package-ecosystem: gradle
+    directory: /
+    schedule:
+      interval: weekly
+      day: saturday
+    ignore:
+      - dependency-name: '*'
+        update-types:
+          - version-update:semver-major
+          - version-update:semver-minor
+    open-pull-requests-limit: 10
+    labels:
+      - 'type: dependency-upgrade'
+    groups:
+      development-dependencies:
+        update-types:
+          - patch
+        patterns:
+          - com.gradle.*
+          - io.spring.*
+          - org.ajoberstar.grgit
+          - org.antora
+          - io.micrometer:micrometer-docs-generator
+          - org.hibernate.validator:hibernate-validator
+          - org.awaitility:awaitility
+          - net.ltgt.errorprone
+          - com.uber.nullaway*
+          - org.springframework.boot*
+          - com.google.errorprone*
+
+  - package-ecosystem: gradle
+    target-branch: 3.3.x
     directory: /
     schedule:
       interval: weekly
@@ -69,6 +100,19 @@ updates:
         patterns:
           - '*'
 
+  - package-ecosystem: github-actions
+    target-branch: 3.3.x
+    directory: /
+    schedule:
+      interval: weekly
+      day: saturday
+    labels:
+      - 'type: task'
+    groups:
+      development-dependencies:
+        patterns:
+          - '*'
+
   - package-ecosystem: github-actions
     target-branch: 3.2.x
     directory: /
diff --git a/.github/workflows/merge-dependabot-pr.yml b/.github/workflows/merge-dependabot-pr.yml
index f513c725..d6612691 100644
--- a/.github/workflows/merge-dependabot-pr.yml
+++ b/.github/workflows/merge-dependabot-pr.yml
@@ -12,7 +12,7 @@ jobs:
   merge-dependabot-pr:
     permissions: write-all
 
-    uses: spring-io/spring-github-workflows/.github/workflows/spring-merge-dependabot-pr.yml@v5
+    uses: spring-io/spring-github-workflows/.github/workflows/spring-merge-dependabot-pr.yml@main
     with:
       mergeArguments: --auto --squash
-      autoMergeSnapshots: true
\ No newline at end of file
+      autoMergeSnapshots: true
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ecb6c196..b4f179e8 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -13,6 +13,8 @@ jobs:
       issues: write
 
     uses: spring-io/spring-github-workflows/.github/workflows/spring-artifactory-gradle-release.yml@main
+    with:
+      deployMilestoneToCentral: true
     secrets:
       GH_ACTIONS_REPO_TOKEN: ${{ secrets.GH_ACTIONS_REPO_TOKEN }}
       DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
diff --git a/build.gradle b/build.gradle
index cbfea32a..20bd730c 100644
--- a/build.gradle
+++ b/build.gradle
@@ -22,6 +22,7 @@ plugins {
 	id 'io.spring.dependency-management' version '1.1.7' apply false
 	id 'com.github.spotbugs' version '6.1.2'
 	id 'io.freefair.aggregate-javadoc' version '8.11'
+	id 'net.ltgt.errorprone' version '4.1.0' apply false
 }
 
 apply plugin: 'io.spring.nohttp'
@@ -127,6 +128,7 @@ configure(javaProjects) { subproject ->
 	apply plugin: 'checkstyle'
 	apply plugin: 'kotlin'
 	apply plugin: 'kotlin-spring'
+	apply plugin: 'net.ltgt.errorprone'
 
 	apply from: "${rootProject.projectDir}/gradle/publish-maven.gradle"
 
@@ -141,14 +143,18 @@ configure(javaProjects) { subproject ->
 		}
 	}
 
-	compileJava {
-		options.release = 17
-	}
-
-	compileTestJava {
+	tasks.withType(JavaCompile).configureEach {
 		sourceCompatibility = JavaVersion.VERSION_17
-		targetCompatibility = JavaVersion.VERSION_17
 		options.encoding = 'UTF-8'
+		options.errorprone {
+			disableAllChecks = true
+			if (!name.toLowerCase().contains('test')) {
+				option('NullAway:OnlyNullMarked', 'true')
+				option('NullAway:CustomContractAnnotations', 'org.springframework.lang.Contract')
+				option('NullAway:JSpecifyMode', 'true')
+				error('NullAway')
+			}
+		}
 	}
 
 	compileTestKotlin {
@@ -185,6 +191,9 @@ configure(javaProjects) { subproject ->
 		}
 		testImplementation "org.hamcrest:hamcrest-core:$hamcrestVersion"
 		optionalApi "org.assertj:assertj-core:$assertjVersion"
+
+		errorprone 'com.uber.nullaway:nullaway:0.12.3'
+		errorprone 'com.google.errorprone:error_prone_core:2.36.0'
 	}
 
 	// enable all compiler warnings; individual projects may customize further