diff --git a/httpclient/src/main/java/org/apache/http/client/methods/HttpEntityEnclosingRequestBase.java b/httpclient/src/main/java/org/apache/http/client/methods/HttpEntityEnclosingRequestBase.java
index d6d4f5439..2ee3df85d 100644
--- a/httpclient/src/main/java/org/apache/http/client/methods/HttpEntityEnclosingRequestBase.java
+++ b/httpclient/src/main/java/org/apache/http/client/methods/HttpEntityEnclosingRequestBase.java
@@ -27,6 +27,8 @@
 
 package org.apache.http.client.methods;
 
+import net.jcip.annotations.NotThreadSafe;
+
 import org.apache.http.Header;
 import org.apache.http.HttpEntity;
 import org.apache.http.HttpEntityEnclosingRequest;
@@ -39,6 +41,7 @@ import org.apache.http.protocol.HTTP;
  * 
  * @since 4.0
  */
+@NotThreadSafe // HttpRequestBase is @NotThreadSafe
 public abstract class HttpEntityEnclosingRequestBase 
     extends HttpRequestBase implements HttpEntityEnclosingRequest {
     
diff --git a/httpclient/src/main/java/org/apache/http/client/protocol/RequestClientConnControl.java b/httpclient/src/main/java/org/apache/http/client/protocol/RequestClientConnControl.java
index 26fa91231..6321b030b 100644
--- a/httpclient/src/main/java/org/apache/http/client/protocol/RequestClientConnControl.java
+++ b/httpclient/src/main/java/org/apache/http/client/protocol/RequestClientConnControl.java
@@ -29,6 +29,8 @@ package org.apache.http.client.protocol;
 
 import java.io.IOException;
 
+import net.jcip.annotations.Immutable;
+
 import org.apache.http.HttpException;
 import org.apache.http.HttpRequest;
 import org.apache.http.HttpRequestInterceptor;
@@ -45,6 +47,7 @@ import org.apache.http.protocol.HttpContext;
  * 
  * @since 4.0
  */
+@Immutable
 public class RequestClientConnControl implements HttpRequestInterceptor {
 
     private static final String PROXY_CONN_DIRECTIVE = "Proxy-Connection";
diff --git a/httpclient/src/main/java/org/apache/http/conn/ssl/SSLSocketFactory.java b/httpclient/src/main/java/org/apache/http/conn/ssl/SSLSocketFactory.java
index c65984549..e1fe56581 100644
--- a/httpclient/src/main/java/org/apache/http/conn/ssl/SSLSocketFactory.java
+++ b/httpclient/src/main/java/org/apache/http/conn/ssl/SSLSocketFactory.java
@@ -144,7 +144,7 @@ import java.security.UnrecoverableKeyException;
  *
  * @since 4.0
  */
-@NotThreadSafe
+@NotThreadSafe // [gs]etHostNameVerifier
 public class SSLSocketFactory implements LayeredSocketFactory {
 
     public static final String TLS   = "TLS";
diff --git a/httpclient/src/main/java/org/apache/http/impl/auth/AuthSchemeBase.java b/httpclient/src/main/java/org/apache/http/impl/auth/AuthSchemeBase.java
index cd90f949c..34875f90c 100644
--- a/httpclient/src/main/java/org/apache/http/impl/auth/AuthSchemeBase.java
+++ b/httpclient/src/main/java/org/apache/http/impl/auth/AuthSchemeBase.java
@@ -26,6 +26,8 @@
 
 package org.apache.http.impl.auth;
 
+import net.jcip.annotations.NotThreadSafe;
+
 import org.apache.http.FormattedHeader;
 import org.apache.http.Header;
 import org.apache.http.auth.AUTH;
@@ -44,6 +46,7 @@ import org.apache.http.util.CharArrayBuffer;
  *
  * @since 4.0
  */
+@NotThreadSafe // proxy
 public abstract class AuthSchemeBase implements AuthScheme {
 
     /**
diff --git a/httpclient/src/main/java/org/apache/http/impl/auth/RFC2617Scheme.java b/httpclient/src/main/java/org/apache/http/impl/auth/RFC2617Scheme.java
index 00f5646a1..b34e846f0 100644
--- a/httpclient/src/main/java/org/apache/http/impl/auth/RFC2617Scheme.java
+++ b/httpclient/src/main/java/org/apache/http/impl/auth/RFC2617Scheme.java
@@ -30,6 +30,8 @@ import java.util.HashMap;
 import java.util.Locale;
 import java.util.Map;
 
+import net.jcip.annotations.NotThreadSafe;
+
 import org.apache.http.HeaderElement;
 import org.apache.http.auth.MalformedChallengeException;
 import org.apache.http.message.BasicHeaderValueParser;
@@ -44,6 +46,7 @@ import org.apache.http.util.CharArrayBuffer;
  *
  * @since 4.0
  */
+@NotThreadSafe // AuthSchemeBase, params
 public abstract class RFC2617Scheme extends AuthSchemeBase {
 
     /**
diff --git a/httpclient/src/main/java/org/apache/http/impl/conn/DefaultClientConnection.java b/httpclient/src/main/java/org/apache/http/impl/conn/DefaultClientConnection.java
index 98cf0491f..596d1b1f8 100644
--- a/httpclient/src/main/java/org/apache/http/impl/conn/DefaultClientConnection.java
+++ b/httpclient/src/main/java/org/apache/http/impl/conn/DefaultClientConnection.java
@@ -30,6 +30,8 @@ package org.apache.http.impl.conn;
 import java.io.IOException;
 import java.net.Socket;
 
+import net.jcip.annotations.NotThreadSafe;
+
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 import org.apache.http.Header;
@@ -61,6 +63,7 @@ import org.apache.http.conn.OperatedClientConnection;
  *
  * @since 4.0
  */
+@NotThreadSafe // connSecure, targetHost
 public class DefaultClientConnection extends SocketHttpClientConnection
     implements OperatedClientConnection {
 
diff --git a/httpclient/src/main/java/org/apache/http/impl/cookie/AbstractCookieSpec.java b/httpclient/src/main/java/org/apache/http/impl/cookie/AbstractCookieSpec.java
index e935d2e5a..cfa0bf5cb 100644
--- a/httpclient/src/main/java/org/apache/http/impl/cookie/AbstractCookieSpec.java
+++ b/httpclient/src/main/java/org/apache/http/impl/cookie/AbstractCookieSpec.java
@@ -31,6 +31,8 @@ import java.util.Collection;
 import java.util.HashMap;
 import java.util.Map;
 
+import net.jcip.annotations.NotThreadSafe;
+
 import org.apache.http.cookie.CookieAttributeHandler;
 import org.apache.http.cookie.CookieSpec;
 
@@ -42,6 +44,7 @@ import org.apache.http.cookie.CookieSpec;
  * 
  * @since 4.0 
  */
+@NotThreadSafe // HashMap is not thread-safe
 public abstract class AbstractCookieSpec implements CookieSpec {
     
     /**
diff --git a/httpclient/src/main/java/org/apache/http/impl/cookie/BrowserCompatSpec.java b/httpclient/src/main/java/org/apache/http/impl/cookie/BrowserCompatSpec.java
index da2d30abe..d8b88f3bf 100644
--- a/httpclient/src/main/java/org/apache/http/impl/cookie/BrowserCompatSpec.java
+++ b/httpclient/src/main/java/org/apache/http/impl/cookie/BrowserCompatSpec.java
@@ -31,6 +31,8 @@ import java.util.ArrayList;
 import java.util.List;
 import java.util.Locale;
 
+import net.jcip.annotations.NotThreadSafe;
+
 import org.apache.http.FormattedHeader;
 import org.apache.http.Header;
 import org.apache.http.HeaderElement;
@@ -51,6 +53,7 @@ import org.apache.http.util.CharArrayBuffer;
  * 
  * @since 4.0 
  */
+@NotThreadSafe // superclass is @NotThreadSafe
 public class BrowserCompatSpec extends CookieSpecBase {
     
     @Deprecated
diff --git a/httpclient/src/main/java/org/apache/http/impl/cookie/CookieSpecBase.java b/httpclient/src/main/java/org/apache/http/impl/cookie/CookieSpecBase.java
index 6f1489ecd..cbda26b52 100644
--- a/httpclient/src/main/java/org/apache/http/impl/cookie/CookieSpecBase.java
+++ b/httpclient/src/main/java/org/apache/http/impl/cookie/CookieSpecBase.java
@@ -31,6 +31,8 @@ import java.util.ArrayList;
 import java.util.List;
 import java.util.Locale;
 
+import net.jcip.annotations.NotThreadSafe;
+
 import org.apache.http.HeaderElement;
 import org.apache.http.NameValuePair;
 import org.apache.http.cookie.Cookie;
@@ -44,6 +46,7 @@ import org.apache.http.cookie.MalformedCookieException;
  * 
  * @since 4.0 
  */
+@NotThreadSafe // AbstractCookieSpec is not thread-safe
 public abstract class CookieSpecBase extends AbstractCookieSpec {
     
     protected static String getDefaultPath(final CookieOrigin origin) {
diff --git a/httpclient/src/main/java/org/apache/http/impl/cookie/NetscapeDraftSpec.java b/httpclient/src/main/java/org/apache/http/impl/cookie/NetscapeDraftSpec.java
index 43085b78c..cac9bd213 100644
--- a/httpclient/src/main/java/org/apache/http/impl/cookie/NetscapeDraftSpec.java
+++ b/httpclient/src/main/java/org/apache/http/impl/cookie/NetscapeDraftSpec.java
@@ -30,7 +30,7 @@ package org.apache.http.impl.cookie;
 import java.util.ArrayList;
 import java.util.List;
 
-import net.jcip.annotations.Immutable;
+import net.jcip.annotations.NotThreadSafe;
 
 import org.apache.http.FormattedHeader;
 import org.apache.http.Header;
@@ -52,7 +52,7 @@ import org.apache.http.util.CharArrayBuffer;
  * 
  * @since 4.0 
  */
-@Immutable
+@NotThreadSafe // superclass is @NotThreadSafe
 public class NetscapeDraftSpec extends CookieSpecBase {
 
     protected static final String EXPIRES_PATTERN = "EEE, dd-MMM-yyyy HH:mm:ss z";
diff --git a/httpclient/src/main/java/org/apache/http/impl/cookie/RFC2109Spec.java b/httpclient/src/main/java/org/apache/http/impl/cookie/RFC2109Spec.java
index 7cef0207a..8bbf5f873 100644
--- a/httpclient/src/main/java/org/apache/http/impl/cookie/RFC2109Spec.java
+++ b/httpclient/src/main/java/org/apache/http/impl/cookie/RFC2109Spec.java
@@ -31,7 +31,7 @@ import java.util.ArrayList;
 import java.util.Collections;
 import java.util.List;
 
-import net.jcip.annotations.Immutable;
+import net.jcip.annotations.NotThreadSafe;
 
 import org.apache.http.Header;
 import org.apache.http.HeaderElement;
@@ -54,7 +54,7 @@ import org.apache.http.util.CharArrayBuffer;
  * 
  * @since 4.0 
  */
-@Immutable
+@NotThreadSafe // superclass is @NotThreadSafe
 public class RFC2109Spec extends CookieSpecBase {
 
     private final static CookiePathComparator PATH_COMPARATOR = new CookiePathComparator(); 
diff --git a/httpclient/src/main/java/org/apache/http/impl/cookie/RFC2965Spec.java b/httpclient/src/main/java/org/apache/http/impl/cookie/RFC2965Spec.java
index 83f3333e0..3a7f312e9 100644
--- a/httpclient/src/main/java/org/apache/http/impl/cookie/RFC2965Spec.java
+++ b/httpclient/src/main/java/org/apache/http/impl/cookie/RFC2965Spec.java
@@ -32,6 +32,8 @@ import java.util.List;
 import java.util.Locale;
 import java.util.Map;
 
+import net.jcip.annotations.NotThreadSafe;
+
 import org.apache.http.Header;
 import org.apache.http.HeaderElement;
 import org.apache.http.NameValuePair;
@@ -50,6 +52,7 @@ import org.apache.http.util.CharArrayBuffer;
  *
  * @since 4.0
  */
+@NotThreadSafe // superclass is @NotThreadSafe
 public class RFC2965Spec extends RFC2109Spec {
 
     /**