diff --git a/.github/workflows/java.yml b/.github/workflows/java.yml
index 7ebc17304..95e8ccf8d 100644
--- a/.github/workflows/java.yml
+++ b/.github/workflows/java.yml
@@ -83,8 +83,8 @@ jobs:
       - name: Check on failures
         if: always() && steps.unit_tests.outcome != 'success'
         run: |
-          cat /home/runner/java-sdk/core-api/build/reports/findbugs/main.html
-          cat /home/runner/java-sdk/core-api/build/reports/findbugs/test.html
+          cat /Users/runner/work/java-sdk/core-api/build/reports/spotbugs/main.html
+          cat /Users/runner/work/java-sdk/core-api/build/reports/spotbugs/test.html
       - name: Check on success
         if: always() && steps.unit_tests.outcome == 'success'
         run: |
diff --git a/README.md b/README.md
index b4b1f0be1..1a7370c43 100644
--- a/README.md
+++ b/README.md
@@ -70,7 +70,7 @@ You can run all unit tests with:
 
 ### Checking for bugs
 
-We utilize [FindBugs](http://findbugs.sourceforge.net/) to identify possible bugs in the SDK. To run the check:
+We utilize [SpotBugs](https://spotbugs.github.io/) to identify possible bugs in the SDK. To run the check:
 
 ```
 
diff --git a/build.gradle b/build.gradle
index 4c8c2a513..54426f6e7 100644
--- a/build.gradle
+++ b/build.gradle
@@ -4,7 +4,7 @@ plugins {
     id 'me.champeau.gradle.jmh' version '0.5.3'
     id 'nebula.optional-base' version '3.2.0'
     id 'com.github.hierynomus.license' version '0.16.1'
-    id 'com.github.spotbugs' version "4.5.0"
+    id 'com.github.spotbugs' version "6.0.14"
     id 'maven-publish'
 }
 
@@ -73,6 +73,7 @@ configure(publishedProjects) {
 
     spotbugs {
         spotbugsJmh.enabled = false
+        reportLevel = com.github.spotbugs.snom.Confidence.valueOf('HIGH')
     }
 
     test {
diff --git a/core-httpclient-impl/build.gradle b/core-httpclient-impl/build.gradle
index 4affcda17..ab5644555 100644
--- a/core-httpclient-impl/build.gradle
+++ b/core-httpclient-impl/build.gradle
@@ -2,6 +2,7 @@ dependencies {
     implementation project(':core-api')
     implementation group: 'org.apache.httpcomponents', name: 'httpclient', version: httpClientVersion
     implementation group: 'org.slf4j', name: 'slf4j-api', version: slf4jVersion
+    implementation group: 'com.google.code.findbugs', name: 'annotations', version: findbugsAnnotationVersion
     implementation group: 'com.google.code.findbugs', name: 'jsr305', version: findbugsJsrVersion
     testImplementation 'org.mock-server:mockserver-netty:5.1.1'
 }
diff --git a/core-httpclient-impl/src/main/java/com/optimizely/ab/config/HttpProjectConfigManager.java b/core-httpclient-impl/src/main/java/com/optimizely/ab/config/HttpProjectConfigManager.java
index 095e32a67..2e99d3ae9 100644
--- a/core-httpclient-impl/src/main/java/com/optimizely/ab/config/HttpProjectConfigManager.java
+++ b/core-httpclient-impl/src/main/java/com/optimizely/ab/config/HttpProjectConfigManager.java
@@ -24,6 +24,7 @@
 import java.util.concurrent.ThreadFactory;
 import java.util.concurrent.locks.ReentrantLock;
 import javax.annotation.Nullable;
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
 import org.apache.http.*;
 import org.apache.http.client.ClientProtocolException;
 import org.apache.http.client.methods.CloseableHttpResponse;
@@ -309,6 +310,7 @@ public Builder withPollingInterval(Long period, TimeUnit timeUnit) {
             return this;
         }
 
+        @SuppressFBWarnings("EI_EXPOSE_REP2")
         public Builder withNotificationCenter(NotificationCenter notificationCenter) {
             this.notificationCenter = notificationCenter;
             return this;