diff --git a/apache-maven/pom.xml b/apache-maven/pom.xml
index a73163f5b0..96f72a5d1a 100644
--- a/apache-maven/pom.xml
+++ b/apache-maven/pom.xml
@@ -113,6 +113,10 @@ under the License.
       <groupId>org.fusesource.jansi</groupId>
       <artifactId>jansi</artifactId>
     </dependency>
+    <dependency>
+      <groupId>org.codehaus.plexus</groupId>
+      <artifactId>plexus-cipher</artifactId>
+    </dependency>
   </dependencies>
 
   <build>
diff --git a/maven-compat/pom.xml b/maven-compat/pom.xml
index c94c6a86e2..c838401c7d 100644
--- a/maven-compat/pom.xml
+++ b/maven-compat/pom.xml
@@ -99,6 +99,11 @@ under the License.
       <artifactId>wagon-provider-api</artifactId>
     </dependency>
 
+    <dependency>
+      <groupId>org.codehaus.plexus</groupId>
+      <artifactId>plexus-cipher</artifactId>
+      <scope>test</scope>
+    </dependency>
     <dependency>
       <groupId>org.apache.maven.wagon</groupId>
       <artifactId>wagon-file</artifactId>
diff --git a/maven-core/pom.xml b/maven-core/pom.xml
index cd363f53e3..43a6bee05f 100644
--- a/maven-core/pom.xml
+++ b/maven-core/pom.xml
@@ -118,6 +118,11 @@ under the License.
       <groupId>org.codehaus.plexus</groupId>
       <artifactId>plexus-classworlds</artifactId>
     </dependency>
+    <dependency>
+      <groupId>org.codehaus.plexus</groupId>
+      <artifactId>plexus-cipher</artifactId>
+      <scope>test</scope>
+    </dependency>
     <dependency>
       <groupId>org.apache.commons</groupId>
       <artifactId>commons-lang3</artifactId>
diff --git a/maven-embedder/pom.xml b/maven-embedder/pom.xml
index c5923e90ce..47ab336257 100644
--- a/maven-embedder/pom.xml
+++ b/maven-embedder/pom.xml
@@ -135,7 +135,7 @@ under the License.
       <artifactId>plexus-sec-dispatcher</artifactId>
     </dependency>
     <dependency>
-      <groupId>org.sonatype.plexus</groupId>
+      <groupId>org.codehaus.plexus</groupId>
       <artifactId>plexus-cipher</artifactId>
     </dependency>
     <dependency>
diff --git a/pom.xml b/pom.xml
index b69ac53993..0eb9bf9828 100644
--- a/pom.xml
+++ b/pom.xml
@@ -62,7 +62,7 @@ under the License.
     <wagonVersion>3.3.4</wagonVersion>
     <jsoupVersion>1.12.1</jsoupVersion>
     <securityDispatcherVersion>1.4</securityDispatcherVersion>
-    <cipherVersion>1.7</cipherVersion>
+    <cipherVersion>1.8</cipherVersion>
     <modelloVersion>1.11</modelloVersion>
     <jxpathVersion>1.3</jxpathVersion>
     <resolverVersion>1.4.1</resolverVersion>
@@ -395,9 +395,15 @@ under the License.
         <groupId>org.sonatype.plexus</groupId>
         <artifactId>plexus-sec-dispatcher</artifactId>
         <version>${securityDispatcherVersion}</version>
+        <exclusions>
+          <exclusion>
+            <groupId>org.sonatype.plexus</groupId>
+            <artifactId>plexus-cipher</artifactId>
+          </exclusion>
+        </exclusions>
       </dependency>
       <dependency>
-        <groupId>org.sonatype.plexus</groupId>
+        <groupId>org.codehaus.plexus</groupId>
         <artifactId>plexus-cipher</artifactId>
         <version>${cipherVersion}</version>
       </dependency>
@@ -617,6 +623,32 @@ under the License.
           </excludes>
         </configuration>
       </plugin>
+      <plugin>
+        <groupId>org.apache.maven.plugins</groupId>
+        <artifactId>maven-enforcer-plugin</artifactId>
+        <executions>
+          <execution>
+            <goals>
+              <goal>enforce</goal>
+            </goals>
+            <phase>validate</phase>
+            <id>ensure-no-org.sonatype:plexus-cipher</id>
+            <configuration>
+              <rules>
+                <bannedDependencies>
+                  <excludes>
+                    <exclude>org.sonatype.plexus:plexus-cipher</exclude>
+                  </excludes>
+                  <message>
+                    ensure no more org.sonatype.plexus:plexus-cipher as groupId changed. you have to add some exclusions.
+                  </message>
+                </bannedDependencies>
+              </rules>
+              <fail>true</fail>
+            </configuration>
+          </execution>
+        </executions>
+      </plugin>
     </plugins>
   </build>