diff --git a/java-util/src/main/java/org/apache/druid/java/util/common/DateTimes.java b/java-util/src/main/java/org/apache/druid/java/util/common/DateTimes.java
index 74e221cb9a2..f9a708d7e3b 100644
--- a/java-util/src/main/java/org/apache/druid/java/util/common/DateTimes.java
+++ b/java-util/src/main/java/org/apache/druid/java/util/common/DateTimes.java
@@ -19,6 +19,7 @@
 
 package org.apache.druid.java.util.common;
 
+import io.netty.util.SuppressForbidden;
 import org.joda.time.Chronology;
 import org.joda.time.DateTime;
 import org.joda.time.DateTimeZone;
@@ -40,6 +41,7 @@ public final class DateTimes
       ISODateTimeFormat.dateTimeParser().withOffsetParsed()
   );
 
+  @SuppressForbidden(reason = "DateTimeZone#forID")
   public static DateTimeZone inferTzfromString(String tzId)
   {
     try {
@@ -65,6 +67,7 @@ public final class DateTimes
       this.innerFormatter = innerFormatter.withChronology(ISOChronology.getInstanceUTC());
     }
 
+    @SuppressForbidden(reason = "DateTimeFormatter#parseDateTime")
     public DateTime parse(final String instant)
     {
       return innerFormatter.parseDateTime(instant);
diff --git a/pom.xml b/pom.xml
index c5767599e49..8da6770f56b 100644
--- a/pom.xml
+++ b/pom.xml
@@ -931,15 +931,12 @@
                         <signaturesFile>${session.executionRootDirectory}/codestyle/joda-time-forbidden-apis.txt</signaturesFile>
                         <signaturesFile>${session.executionRootDirectory}/codestyle/druid-forbidden-apis.txt</signaturesFile>
                     </signaturesFiles>
-                    <excludes>
-                        <exclude>org/apache/druid/java/util/common/DateTimes$UtcFormatter.class</exclude>
-                        <exclude>org/apache/druid/java/util/common/DateTimes.class</exclude>
-                    </excludes>
+                    <suppressAnnotations><annotation>**.SuppressForbidden</annotation></suppressAnnotations>
                 </configuration>
                 <executions>
                     <execution>
-                        <id>validate</id>
-                        <phase>validate</phase>
+                        <id>compile</id>
+                        <phase>compile</phase>
                         <goals>
                             <goal>check</goal>
                         </goals>
@@ -952,8 +949,8 @@
                         </configuration>
                     </execution>
                     <execution>
-                        <id>testValidate</id>
-                        <phase>validate</phase>
+                        <id>testCompile</id>
+                        <phase>test-compile</phase>
                         <goals>
                             <goal>testCheck</goal>
                         </goals>
diff --git a/services/src/main/java/org/apache/druid/cli/DumpSegment.java b/services/src/main/java/org/apache/druid/cli/DumpSegment.java
index 28bfe0e71fc..abe25128640 100644
--- a/services/src/main/java/org/apache/druid/cli/DumpSegment.java
+++ b/services/src/main/java/org/apache/druid/cli/DumpSegment.java
@@ -36,6 +36,7 @@ import com.google.inject.Module;
 import com.google.inject.name.Names;
 import io.airlift.airline.Command;
 import io.airlift.airline.Option;
+import io.netty.util.SuppressForbidden;
 import org.apache.druid.collections.bitmap.BitmapFactory;
 import org.apache.druid.collections.bitmap.ConciseBitmapFactory;
 import org.apache.druid.collections.bitmap.ImmutableBitmap;
@@ -417,6 +418,7 @@ public class DumpSegment extends GuiceRunnable
     return ImmutableList.copyOf(columnNames);
   }
 
+  @SuppressForbidden(reason = "System#out")
   private <T> T withOutputStream(Function<OutputStream, T> f) throws IOException
   {
     if (outputFileName == null) {
diff --git a/services/src/main/java/org/apache/druid/cli/Main.java b/services/src/main/java/org/apache/druid/cli/Main.java
index 0c0b0c6bbad..9f77bb3ef1e 100644
--- a/services/src/main/java/org/apache/druid/cli/Main.java
+++ b/services/src/main/java/org/apache/druid/cli/Main.java
@@ -23,6 +23,7 @@ import com.google.inject.Injector;
 import io.airlift.airline.Cli;
 import io.airlift.airline.Help;
 import io.airlift.airline.ParseException;
+import io.netty.util.SuppressForbidden;
 import org.apache.druid.cli.validate.DruidJsonValidator;
 import org.apache.druid.guice.ExtensionsConfig;
 import org.apache.druid.guice.GuiceInjectors;
@@ -45,6 +46,7 @@ public class Main
   }
 
   @SuppressWarnings("unchecked")
+  @SuppressForbidden(reason = "System#out")
   public static void main(String[] args)
   {
     final Cli.CliBuilder<Runnable> builder = Cli.builder("druid");
diff --git a/services/src/main/java/org/apache/druid/cli/PullDependencies.java b/services/src/main/java/org/apache/druid/cli/PullDependencies.java
index 58e7c70652e..e2a9b286595 100644
--- a/services/src/main/java/org/apache/druid/cli/PullDependencies.java
+++ b/services/src/main/java/org/apache/druid/cli/PullDependencies.java
@@ -27,6 +27,7 @@ import com.google.common.collect.Sets;
 import com.google.inject.Inject;
 import io.airlift.airline.Command;
 import io.airlift.airline.Option;
+import io.netty.util.SuppressForbidden;
 import org.apache.druid.guice.ExtensionsConfig;
 import org.apache.druid.indexing.common.config.TaskConfig;
 import org.apache.druid.java.util.common.ISE;
@@ -414,6 +415,7 @@ public class PullDependencies implements Runnable
     log.info("Finish downloading extension [%s]", versionedArtifact);
   }
 
+  @SuppressForbidden(reason = "System#out")
   private DefaultTeslaAether getAetherClient()
   {
     /*
diff --git a/services/src/main/java/org/apache/druid/cli/Version.java b/services/src/main/java/org/apache/druid/cli/Version.java
index ab85fe35794..c919a080aad 100644
--- a/services/src/main/java/org/apache/druid/cli/Version.java
+++ b/services/src/main/java/org/apache/druid/cli/Version.java
@@ -20,6 +20,7 @@
 package org.apache.druid.cli;
 
 import io.airlift.airline.Command;
+import io.netty.util.SuppressForbidden;
 import org.apache.druid.initialization.DruidModule;
 import org.apache.druid.initialization.Initialization;
 import org.apache.druid.server.StatusResource;
@@ -31,6 +32,7 @@ import org.apache.druid.server.StatusResource;
 public class Version implements Runnable
 {
   @Override
+  @SuppressForbidden(reason = "System#out")
   public void run()
   {
     System.out.println(new StatusResource.Status(Initialization.getLoadedImplementations(DruidModule.class)));
diff --git a/services/src/main/java/org/apache/druid/cli/validate/DruidJsonValidator.java b/services/src/main/java/org/apache/druid/cli/validate/DruidJsonValidator.java
index dab54a2cd01..dac7a711f5e 100644
--- a/services/src/main/java/org/apache/druid/cli/validate/DruidJsonValidator.java
+++ b/services/src/main/java/org/apache/druid/cli/validate/DruidJsonValidator.java
@@ -32,6 +32,7 @@ import com.google.inject.Injector;
 import com.google.inject.name.Names;
 import io.airlift.airline.Command;
 import io.airlift.airline.Option;
+import io.netty.util.SuppressForbidden;
 import org.apache.druid.cli.GuiceRunnable;
 import org.apache.druid.data.input.InputRow;
 import org.apache.druid.data.input.impl.StringInputRowParser;
@@ -69,6 +70,7 @@ import java.util.List;
     name = "validator",
     description = "Validates that a given Druid JSON object is correctly formatted"
 )
+@SuppressForbidden(reason = "System#out")
 public class DruidJsonValidator extends GuiceRunnable
 {
   private static final Logger LOG = new Logger(DruidJsonValidator.class);