diff --git a/config/findbugs-exclude.xml b/config/spotbugs-exclude.xml
similarity index 100%
rename from config/findbugs-exclude.xml
rename to config/spotbugs-exclude.xml
diff --git a/graylog-project-parent/pom.xml b/graylog-project-parent/pom.xml
index 07d03f7f0d..2672b950c4 100644
--- a/graylog-project-parent/pom.xml
+++ b/graylog-project-parent/pom.xml
@@ -391,9 +391,16 @@
             </dependency>
 
             <dependency>
-                <groupId>com.google.code.findbugs</groupId>
-                <artifactId>jsr305</artifactId>
-                <version>${jsr305.version}</version>
+                <groupId>net.jcip</groupId>
+                <artifactId>jcip-annotations</artifactId>
+                <version>${jcip-annotations.version}</version>
+                <scope>provided</scope>
+            </dependency>
+            <dependency>
+                <groupId>com.github.spotbugs</groupId>
+                <artifactId>spotbugs-annotations</artifactId>
+                <version>${spotbugs-annotations.version}</version>
+                <scope>provided</scope>
             </dependency>
 
             <dependency>
@@ -720,10 +727,10 @@
             <build>
                 <plugins>
                     <plugin>
-                        <groupId>org.codehaus.mojo</groupId>
-                        <artifactId>findbugs-maven-plugin</artifactId>
+                        <groupId>com.github.spotbugs</groupId>
+                        <artifactId>spotbugs-maven-plugin</artifactId>
                         <configuration>
-                            <excludeFilterFile>config/findbugs-exclude.xml</excludeFilterFile>
+                            <excludeFilterFile>config/spotbugs-exclude.xml</excludeFilterFile>
                             <effort>Max</effort>
                             <threshold>Default</threshold>
                             <failOnError>false</failOnError>
@@ -737,7 +744,7 @@
                                 <plugin>
                                     <groupId>com.mebigfatguy.fb-contrib</groupId>
                                     <artifactId>fb-contrib</artifactId>
-                                    <version>7.0.5</version>
+                                    <version>7.0.5.sb</version>
                                 </plugin>
                             </plugins>
                         </configuration>
diff --git a/graylog2-server/pom.xml b/graylog2-server/pom.xml
index dd0cdd8b63..54f0f09bb4 100644
--- a/graylog2-server/pom.xml
+++ b/graylog2-server/pom.xml
@@ -477,8 +477,12 @@
         </dependency>
         <!-- used for sanity -->
         <dependency>
-            <groupId>com.google.code.findbugs</groupId>
-            <artifactId>jsr305</artifactId>
+            <groupId>net.jcip</groupId>
+            <artifactId>jcip-annotations</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>com.github.spotbugs</groupId>
+            <artifactId>spotbugs-annotations</artifactId>
         </dependency>
         <dependency>
             <groupId>com.google.auto.value</groupId>
diff --git a/graylog2-web-interface/travis/graylog2-server.sh b/graylog2-web-interface/travis/graylog2-server.sh
index 0999151d69..b7cfe7457c 100755
--- a/graylog2-web-interface/travis/graylog2-server.sh
+++ b/graylog2-web-interface/travis/graylog2-server.sh
@@ -10,7 +10,7 @@ sh install-syslog4j-jar.sh
 
 echo 'Building graylog2-server...'
 mvn --batch-mode --fail-fast --quiet -DskipTests=true \
-  -Dmaven.javadoc.skip=true -Dmaven.findbugs.skip=true -Dsource.skip=true \
+  -Dmaven.javadoc.skip=true -Dspotbugs.skip=true -Dsource.skip=true \
   clean install
 
 echo 'Starting graylog2-server...'
diff --git a/integration-tests/pom.xml b/integration-tests/pom.xml
index b6e4ddd1dd..29c3b94898 100644
--- a/integration-tests/pom.xml
+++ b/integration-tests/pom.xml
@@ -121,8 +121,12 @@
         </dependency>
         <!-- used for sanity -->
         <dependency>
-            <groupId>com.google.code.findbugs</groupId>
-            <artifactId>jsr305</artifactId>
+            <groupId>net.jcip</groupId>
+            <artifactId>jcip-annotations</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>com.github.spotbugs</groupId>
+            <artifactId>spotbugs-annotations</artifactId>
         </dependency>
         <dependency>
             <groupId>com.google.auto.value</groupId>
diff --git a/pom.xml b/pom.xml
index 278bcbee88..756427f6c0 100644
--- a/pom.xml
+++ b/pom.xml
@@ -111,12 +111,12 @@
         <javax.inject.version>1</javax.inject.version>
         <javax.ws.rs-api.version>2.0.1</javax.ws.rs-api.version>
         <jbcrypt.version>0.4</jbcrypt.version>
+        <jcip-annotations.version>1.0</jcip-annotations.version>
         <jersey.version>2.25.1</jersey.version>
         <jmte.version>4.0.0</jmte.version>
         <jna.version>4.1.0</jna.version> <!-- for ES, make sure to use the version that ES uses -->
         <joda-time.version>2.9.9</joda-time.version>
         <json-path.version>2.4.0</json-path.version>
-        <jsr305.version>3.0.2</jsr305.version>
         <kafka.version>0.9.0.1</kafka.version>
         <log4j.version>2.9.1</log4j.version>
         <metrics.version>3.2.5</metrics.version>
@@ -134,6 +134,7 @@
         <shiro.version>1.4.0</shiro.version>
         <sigar.version>1.6.4</sigar.version>
         <slf4j.version>1.7.25</slf4j.version>
+        <spotbugs-annotations.version>3.1.0</spotbugs-annotations.version>
         <swagger.version>1.5.13</swagger.version>
         <syslog4j.version>0.9.60</syslog4j.version>
         <uuid.version>3.2</uuid.version>
@@ -270,9 +271,9 @@
                     <version>2.5</version>
                 </plugin>
                 <plugin>
-                    <groupId>org.codehaus.mojo</groupId>
-                    <artifactId>findbugs-maven-plugin</artifactId>
-                    <version>3.0.5</version>
+                    <groupId>com.github.spotbugs</groupId>
+                    <artifactId>spotbugs-maven-plugin</artifactId>
+                    <version>3.1.0-RC8</version>
                 </plugin>
                 <plugin>
                     <groupId>org.codehaus.mojo</groupId>