diff --git a/pom.xml b/pom.xml
index e5f227eb0..8429d70e8 100644
--- a/pom.xml
+++ b/pom.xml
@@ -232,10 +232,6 @@ THE SOFTWARE.
                     <compatibleSinceVersion>1.45</compatibleSinceVersion>
                 </configuration>
             </plugin>
-            <plugin>
-                <groupId>com.github.spotbugs</groupId>
-                <artifactId>spotbugs-maven-plugin</artifactId>
-            </plugin>
         </plugins>
     </build>
 </project>
diff --git a/src/spotbugs/excludesFilter.xml b/src/spotbugs/excludesFilter.xml
new file mode 100644
index 000000000..967bff18c
--- /dev/null
+++ b/src/spotbugs/excludesFilter.xml
@@ -0,0 +1,29 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<FindBugsFilter>
+  <!--
+    Exclusions in this section have been triaged and determined to be
+    false positives.
+  -->
+  <Match>
+    <!-- These primitive attributes need to be public to preserve the API -->
+    <Bug pattern="PA_PUBLIC_PRIMITIVE_ATTRIBUTE" />
+    <Or>
+      <Class name="hudson.plugins.ec2.EC2AbstractSlave" />
+      <Class name="hudson.plugins.ec2.SlaveTemplate" />
+    </Or>
+  </Match>
+
+  <!--
+    Here lies technical debt. Exclusions in this section have not yet
+    been triaged. When working on this section, pick an exclusion to
+    triage, then:
+
+    - Add a @SuppressFBWarnings(value = "[...]", justification = "[...]")
+      annotation if it is a false positive.  Indicate the reason why
+      it is a false positive, then remove the exclusion from this
+      section.
+
+    - If it is not a false positive, fix the bug, then remove the
+      exclusion from this section.
+   -->
+</FindBugsFilter>
diff --git a/src/test/java/hudson/plugins/ec2/EC2RetentionStrategyTest.java b/src/test/java/hudson/plugins/ec2/EC2RetentionStrategyTest.java
index c54c91aeb..4e4ad5bb3 100644
--- a/src/test/java/hudson/plugins/ec2/EC2RetentionStrategyTest.java
+++ b/src/test/java/hudson/plugins/ec2/EC2RetentionStrategyTest.java
@@ -2,6 +2,7 @@
 
 import com.amazonaws.AmazonClientException;
 import com.amazonaws.services.ec2.model.InstanceType;
+import edu.umd.cs.findbugs.annotations.NonNull;
 import hudson.model.Executor;
 import hudson.model.Node;
 import hudson.model.Label;
@@ -30,7 +31,6 @@
 import org.testcontainers.shaded.org.bouncycastle.jce.provider.BouncyCastleProvider;
 import org.jvnet.hudson.test.LoggerRule;
 
-import javax.annotation.Nonnull;
 import java.security.Security;
 import java.time.Clock;
 import java.time.Duration;
@@ -141,10 +141,10 @@ public String getShortDescription() {
             }
         } : null;
         return new AccessControlledTask() {
-            @Nonnull
+            @NonNull
             public ACL getACL() {
                 return new ACL() {
-                    public boolean hasPermission(@Nonnull Authentication a, @Nonnull Permission permission) {
+                    public boolean hasPermission(@NonNull Authentication a, @NonNull Permission permission) {
                         return true;
                     }
                 };