diff --git a/web/src/main/java/org/springframework/security/web/ObservationFilterChainDecorator.java b/web/src/main/java/org/springframework/security/web/ObservationFilterChainDecorator.java
index 5cca192101..f571ea02f4 100644
--- a/web/src/main/java/org/springframework/security/web/ObservationFilterChainDecorator.java
+++ b/web/src/main/java/org/springframework/security/web/ObservationFilterChainDecorator.java
@@ -37,7 +37,6 @@ import jakarta.servlet.ServletResponse;
 import jakarta.servlet.http.HttpServletRequest;
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
-import org.jspecify.annotations.NullUnmarked;
 import org.jspecify.annotations.Nullable;
 
 import org.springframework.core.log.LogMessage;
@@ -51,7 +50,6 @@ import org.springframework.util.StringUtils;
  * @author Nikita Konev
  * @since 6.0
  */
-@NullUnmarked // https://github.com/spring-projects/spring-security/issues/17815
 public final class ObservationFilterChainDecorator implements FilterChainProxy.FilterChainDecorator {
 
 	private static final Log logger = LogFactory.getLog(FilterChainProxy.class);
@@ -107,7 +105,8 @@ public final class ObservationFilterChainDecorator implements FilterChainProxy.F
 	}
 
 	static AroundFilterObservation observation(HttpServletRequest request) {
-		return (AroundFilterObservation) request.getAttribute(ATTRIBUTE);
+		AroundFilterObservation observation = (AroundFilterObservation) request.getAttribute(ATTRIBUTE);
+		return (observation != null) ? observation : AroundFilterObservation.NOOP;
 	}
 
 	private static final class VirtualFilterChain implements FilterChain {
@@ -377,11 +376,10 @@ public final class ObservationFilterChainDecorator implements FilterChainProxy.F
 
 				private final Observation observation;
 
-				private volatile Observation.Scope scope;
+				private volatile Observation.Scope scope = Observation.Scope.NOOP;
 
 				private ObservationReference(Observation observation) {
 					this.observation = observation;
-					this.scope = Observation.Scope.NOOP;
 				}
 
 				private void start() {
@@ -510,7 +508,7 @@ public final class ObservationFilterChainDecorator implements FilterChainProxy.F
 
 		private final String filterSection;
 
-		private @Nullable String filterName;
+		@Nullable private String filterName;
 
 		private int chainPosition;
 
diff --git a/web/src/main/java/org/springframework/security/web/server/ObservationWebFilterChainDecorator.java b/web/src/main/java/org/springframework/security/web/server/ObservationWebFilterChainDecorator.java
index 8c473a07d4..d247540d51 100644
--- a/web/src/main/java/org/springframework/security/web/server/ObservationWebFilterChainDecorator.java
+++ b/web/src/main/java/org/springframework/security/web/server/ObservationWebFilterChainDecorator.java
@@ -20,16 +20,7 @@ import java.util.ArrayList;
 import java.util.List;
 import java.util.ListIterator;
 
-import io.micrometer.common.KeyValue;
-import io.micrometer.common.KeyValues;
-import io.micrometer.observation.Observation;
-import io.micrometer.observation.ObservationConvention;
-import io.micrometer.observation.ObservationRegistry;
-import io.micrometer.observation.contextpropagation.ObservationThreadLocalAccessor;
-import org.jspecify.annotations.NullUnmarked;
 import org.jspecify.annotations.Nullable;
-import reactor.core.publisher.Mono;
-
 import org.springframework.util.Assert;
 import org.springframework.util.StringUtils;
 import org.springframework.web.server.ServerWebExchange;
@@ -37,6 +28,14 @@ import org.springframework.web.server.WebFilter;
 import org.springframework.web.server.WebFilterChain;
 import org.springframework.web.server.WebHandler;
 
+import io.micrometer.common.KeyValue;
+import io.micrometer.common.KeyValues;
+import io.micrometer.observation.Observation;
+import io.micrometer.observation.ObservationConvention;
+import io.micrometer.observation.ObservationRegistry;
+import io.micrometer.observation.contextpropagation.ObservationThreadLocalAccessor;
+import reactor.core.publisher.Mono;
+
 /**
  * A
  * {@link org.springframework.security.web.server.WebFilterChainProxy.WebFilterChainDecorator}
@@ -45,7 +44,6 @@ import org.springframework.web.server.WebHandler;
  * @author Josh Cummings
  * @since 6.0
  */
-@NullUnmarked // https://github.com/spring-projects/spring-security/issues/17815
 public final class ObservationWebFilterChainDecorator implements WebFilterChainProxy.WebFilterChainDecorator {
 
 	private static final String ATTRIBUTE = ObservationWebFilterChainDecorator.class + ".observation";
@@ -70,8 +68,9 @@ public final class ObservationWebFilterChainDecorator implements WebFilterChainP
 		return new ObservationWebFilterChain(wrapSecured(original)::filter, wrap(filters));
 	}
 
-	private static @Nullable AroundWebFilterObservation observation(ServerWebExchange exchange) {
-		return exchange.getAttribute(ATTRIBUTE);
+	private static AroundWebFilterObservation observation(ServerWebExchange exchange) {
+		AroundWebFilterObservation observation = exchange.getAttribute(ATTRIBUTE);
+		return (observation != null) ? observation : AroundWebFilterObservation.NOOP;
 	}
 
 	private WebFilterChain wrapSecured(WebFilterChain original) {
@@ -218,7 +217,7 @@ public final class ObservationWebFilterChainDecorator implements WebFilterChainP
 			});
 		}
 
-		private AroundWebFilterObservation parent(ServerWebExchange exchange, Observation parentObservation) {
+		private AroundWebFilterObservation parent(ServerWebExchange exchange, @Nullable Observation parentObservation) {
 			WebFilterChainObservationContext beforeContext = WebFilterChainObservationContext.before();
 			WebFilterChainObservationContext afterContext = WebFilterChainObservationContext.after();
 			Observation before = Observation.createNotStarted(this.convention, () -> beforeContext, this.registry)
@@ -575,7 +574,7 @@ public final class ObservationWebFilterChainDecorator implements WebFilterChainP
 
 		private final String filterSection;
 
-		private @Nullable String filterName;
+		@Nullable private String filterName;
 
 		private int chainPosition;