diff --git a/gradle/java-module.gradle b/gradle/java-module.gradle
index a840f90db0..70f6ce9c51 100644
--- a/gradle/java-module.gradle
+++ b/gradle/java-module.gradle
@@ -14,7 +14,7 @@ buildscript {
 		mavenCentral()
 	}
 	dependencies {
-		classpath 'de.thetaphi:forbiddenapis:3.5.1'
+		classpath 'de.thetaphi:forbiddenapis:3.7'
 	}
 }
 
@@ -32,6 +32,7 @@ apply plugin: 'org.hibernate.orm.database-service'
 apply plugin: 'org.hibernate.orm.build.java-module'
 
 apply plugin: 'org.checkerframework'
+apply plugin: 'de.thetaphi.forbiddenapis'
 
 apply plugin: "jacoco"
 apply plugin: 'checkstyle'
@@ -488,43 +489,20 @@ checkerFramework {
 	]
 }
 
+tasks.forbiddenApisMain {
+	// unfortunately we currently have many uses of default Locale implicitly (~370)
+	// which need to be fixed before we can enable the "unsafe" check
+	//bundledSignatures += ["jdk-system-out", "jdk-non-portable", "jdk-unsafe-${jdkVersions.baseline}"]
+	bundledSignatures += ["jdk-system-out", "jdk-non-portable"]
 
-task forbiddenApisSystemOut(type: CheckForbiddenApis, dependsOn: compileJava) {
-	bundledSignatures += 'jdk-system-out'
-	suppressAnnotations += ['org.hibernate.internal.build.AllowSysOut', 'org.hibernate.internal.build.AllowPrintStacktrace']
+	suppressAnnotations += [
+			"org.hibernate.internal.build.AllowSysOut",
+			"org.hibernate.internal.build.AllowPrintStacktrace",
+			"org.hibernate.internal.build.AllowNonPortable"
+	]
 }
 
-task forbiddenApisUnsafe(type: CheckForbiddenApis, dependsOn: compileJava) {
-	bundledSignatures += "jdk-unsafe-${jdkVersions.baseline}".toString()
-
-	// unfortunately we currently have many uses of default Locale implicitly (~370) which need to be fixed
-	// before we can fully enabled this check
-	//
-	// No idea how findbugs was missing these b4
-	ignoreFailures = true
+tasks.forbiddenApisTest {
+	enabled = false
 }
 
-task forbiddenApisNonPortable(type: CheckForbiddenApis, dependsOn: compileJava) {
-	bundledSignatures += 'jdk-non-portable'
-	suppressAnnotations += ['org.hibernate.internal.build.AllowNonPortable']
-}
-
-task forbiddenApis {
-	description 'Grouping task for all defined forbidden-apis tasks'
-}
-
-project.tasks.withType( CheckForbiddenApis ) {
-	outputs.upToDateWhen { true }
-
-	classesDirs = project.sourceSets.main.output
-	classpath = configurations.runtimeClasspath + configurations.compileClasspath
-	targetCompatibility = project.forbiddenAPITargetJDKCompatibility
-
-	// This slows down the checks a little, but is necessary to avoid the gradle daemon holding on
-	// to class definitions loaded previously - even possibly in a previous build.
-	disableClassloadingCache = true
-
-	tasks.forbiddenApis.finalizedBy it
-}
-
-project.tasks.check.finalizedBy tasks.forbiddenApis
diff --git a/hibernate-testing/src/main/java/org/hibernate/testing/schema/SchemaCreateHelper.java b/hibernate-testing/src/main/java/org/hibernate/testing/schema/SchemaCreateHelper.java
index 338bb4f211..8e6ea31c13 100644
--- a/hibernate-testing/src/main/java/org/hibernate/testing/schema/SchemaCreateHelper.java
+++ b/hibernate-testing/src/main/java/org/hibernate/testing/schema/SchemaCreateHelper.java
@@ -80,6 +80,7 @@ public class SchemaCreateHelper {
 		);
 	}
 
+	@AllowSysOut
 	public static void createOnlyToStdOut(Metadata metadata, ServiceRegistry serviceRegistry) {
 		createOnlyToWriter( metadata, serviceRegistry, new OutputStreamWriter( System.out ) );
 	}