diff --git a/error-prone-contrib/pom.xml b/error-prone-contrib/pom.xml
index 0927880f..40e70dbb 100644
--- a/error-prone-contrib/pom.xml
+++ b/error-prone-contrib/pom.xml
@@ -62,6 +62,16 @@
             <artifactId>auto-value-annotations</artifactId>
             <scope>provided</scope>
         </dependency>
+        <!-- XXX: JSR-305 (meta-)annotation usage by some dependencies triggers
+        NullAway to attempt to load said annotations. As such some modules
+        require these annotations to be on the classpath. Periodically review
+        whether we can drop this dependeny declaration. See
+        https://github.com/uber/NullAway/issues/1171. -->
+        <dependency>
+            <groupId>com.google.code.findbugs</groupId>
+            <artifactId>jsr305</artifactId>
+            <scope>provided</scope>
+        </dependency>
         <dependency>
             <groupId>com.google.errorprone</groupId>
             <artifactId>error_prone_annotation</artifactId>
diff --git a/integration-tests/metrics-init.patch b/integration-tests/metrics-init.patch
index 95c7e3ff..e6cec0bb 100644
--- a/integration-tests/metrics-init.patch
+++ b/integration-tests/metrics-init.patch
@@ -38,7 +38,7 @@
 +            <dependency>
 +                <groupId>com.google.guava</groupId>
 +                <artifactId>guava</artifactId>
-+                <version>33.4.0-jre<!-- Renovate: com.google.guava:guava-bom --></version>
++                <version>33.4.7-jre<!-- Renovate: com.google.guava:guava-bom --></version>
 +            </dependency>
 +        </dependencies>
 +    </dependencyManagement>
diff --git a/pom.xml b/pom.xml
index e64f6791..798449f7 100644
--- a/pom.xml
+++ b/pom.xml
@@ -303,6 +303,16 @@
                 <artifactId>auto-value-annotations</artifactId>
                 <version>${version.auto-value}</version>
             </dependency>
+            <!-- XXX: JSR-305 (meta-)annotation usage by some dependencies
+            triggers NullAway to attempt to load said annotations. As such
+            some modules require these annotations to be on the classpath.
+            Periodically review whether we can drop this dependeny version
+            declaration. See https://github.com/uber/NullAway/issues/1171. -->
+            <dependency>
+                <groupId>com.google.code.findbugs</groupId>
+                <artifactId>jsr305</artifactId>
+                <version>3.0.2</version>
+            </dependency>
             <dependency>
                 <groupId>com.google.errorprone</groupId>
                 <artifactId>error_prone_annotation</artifactId>
@@ -341,7 +351,7 @@
             <dependency>
                 <groupId>com.google.guava</groupId>
                 <artifactId>guava-bom</artifactId>
-                <version>33.4.0-jre</version>
+                <version>33.4.7-jre</version>
                 <type>pom</type>
                 <scope>import</scope>
             </dependency>