diff --git a/benchmarks/build.gradle b/benchmarks/build.gradle
index 2693a05fb72..6f1cb0a0e27 100644
--- a/benchmarks/build.gradle
+++ b/benchmarks/build.gradle
@@ -48,7 +48,7 @@ compileJava.options.compilerArgs.addAll(["-processor", "org.openjdk.jmh.generato
 run.executable = "${BuildParams.runtimeJavaHome}/bin/java"
 
 // classes generated by JMH can use all sorts of forbidden APIs but we have no influence at all and cannot exclude these classes
-forbiddenApisMain.enabled = false
+disableTasks('forbiddenApisMain')
 
 // No licenses for our benchmark deps (we don't ship benchmarks)
 dependencyLicenses.enabled = false
diff --git a/build.gradle b/build.gradle
index 7db7db85cb6..436719208c4 100644
--- a/build.gradle
+++ b/build.gradle
@@ -537,3 +537,11 @@ subprojects {
     }
   }
 }
+
+subprojects {
+  project.ext.disableTasks = { String... tasknames ->
+    for (String taskname : tasknames) {
+      project.tasks.named(taskname).configure { onlyIf { false } }
+    }
+  }
+}
diff --git a/buildSrc/build.gradle b/buildSrc/build.gradle
index c446a5cf30d..62d89e839b1 100644
--- a/buildSrc/build.gradle
+++ b/buildSrc/build.gradle
@@ -168,9 +168,7 @@ if (project != rootProject) {
   // build-tools is not ready for primetime with these...
   dependencyLicenses.enabled = false
   dependenciesInfo.enabled = false
-  forbiddenApisMain.enabled = false
-  forbiddenApisMinimumRuntime.enabled = false
-  forbiddenApisTest.enabled = false
+  disableTasks('forbiddenApisMain', 'forbiddenApisMinimumRuntime', 'forbiddenApisTest')
   jarHell.enabled = false
   thirdPartyAudit.enabled = false
   if (Boolean.parseBoolean(System.getProperty("tests.fips.enabled"))){
diff --git a/buildSrc/src/testKit/elasticsearch.build/build.gradle b/buildSrc/src/testKit/elasticsearch.build/build.gradle
index 1f3e00efa3b..b505a11b519 100644
--- a/buildSrc/src/testKit/elasticsearch.build/build.gradle
+++ b/buildSrc/src/testKit/elasticsearch.build/build.gradle
@@ -17,8 +17,8 @@ repositories {
 }
 
 // todo remove offending rules
-forbiddenApisMain.enabled = false
-forbiddenApisTest.enabled = false
+tasks.named('forbiddenApisMain').configure { onlyIf { false } }
+tasks.named('forbiddenApisTest').configure { onlyIf { false } }
 // requires dependency on testing fw
 jarHell.enabled = false
 // we don't have tests for now
diff --git a/client/rest-high-level/build.gradle b/client/rest-high-level/build.gradle
index d5b8589a147..1d5684c19dd 100644
--- a/client/rest-high-level/build.gradle
+++ b/client/rest-high-level/build.gradle
@@ -78,7 +78,7 @@ dependencyLicenses {
   }
 }
 
-forbiddenApisMain {
+tasks.named('forbiddenApisMain').configure {
   // core does not depend on the httpclient for compile so we add the signatures here. We don't add them for test as they are already
   // specified
   addSignatureFiles 'http-signatures'
diff --git a/client/rest/build.gradle b/client/rest/build.gradle
index dfe3fd59eda..6721e7a9d77 100644
--- a/client/rest/build.gradle
+++ b/client/rest/build.gradle
@@ -51,7 +51,7 @@ dependencies {
   testCompile "org.elasticsearch:mocksocket:${versions.mocksocket}"
 }
 
-tasks.withType(CheckForbiddenApis) {
+tasks.withType(CheckForbiddenApis).configureEach {
   //client does not depend on server, so only jdk and http signatures should be checked
   replaceSignatureFiles('jdk-signatures', 'http-signatures')
 }
@@ -60,7 +60,7 @@ forbiddenPatterns {
   exclude '**/*.der'
 }
 
-forbiddenApisTest {
+tasks.named('forbiddenApisTest').configure {
   //we are using jdk-internal instead of jdk-non-portable to allow for com.sun.net.httpserver.* usage
   bundledSignatures -= 'jdk-non-portable'
   bundledSignatures += 'jdk-internal'
diff --git a/client/sniffer/build.gradle b/client/sniffer/build.gradle
index 82eebef6a27..33820e3139e 100644
--- a/client/sniffer/build.gradle
+++ b/client/sniffer/build.gradle
@@ -48,12 +48,12 @@ dependencies {
   testCompile "org.elasticsearch:mocksocket:${versions.mocksocket}"
 }
 
-forbiddenApisMain {
+tasks.named('forbiddenApisMain').configure {
   //client does not depend on server, so only jdk signatures should be checked
   replaceSignatureFiles 'jdk-signatures'
 }
 
-forbiddenApisTest {
+tasks.named('forbiddenApisTest').configure {
   //we are using jdk-internal instead of jdk-non-portable to allow for com.sun.net.httpserver.* usage
   bundledSignatures -= 'jdk-non-portable'
   bundledSignatures += 'jdk-internal'
diff --git a/client/test/build.gradle b/client/test/build.gradle
index a863bf7c311..039701e3513 100644
--- a/client/test/build.gradle
+++ b/client/test/build.gradle
@@ -30,12 +30,12 @@ dependencies {
   compile "org.hamcrest:hamcrest:${versions.hamcrest}"
 }
 
-forbiddenApisMain {
+tasks.named('forbiddenApisMain').configure {
   //client does not depend on core, so only jdk signatures should be checked
   replaceSignatureFiles 'jdk-signatures'
 }
 
-forbiddenApisTest {
+tasks.named('forbiddenApisTest').configure {
   //we are using jdk-internal instead of jdk-non-portable to allow for com.sun.net.httpserver.* usage
   bundledSignatures -= 'jdk-non-portable'
   bundledSignatures += 'jdk-internal'
diff --git a/distribution/tools/java-version-checker/build.gradle b/distribution/tools/java-version-checker/build.gradle
index e9ac7cfa287..4d49d4fd2c7 100644
--- a/distribution/tools/java-version-checker/build.gradle
+++ b/distribution/tools/java-version-checker/build.gradle
@@ -3,7 +3,7 @@ apply plugin: 'elasticsearch.build'
 targetCompatibility = JavaVersion.VERSION_1_7
 
 // java_version_checker do not depend on core so only JDK signatures should be checked
-forbiddenApisMain {
+tasks.named('forbiddenApisMain').configure {
   replaceSignatureFiles 'jdk-signatures'
 }
 
diff --git a/distribution/tools/launchers/build.gradle b/distribution/tools/launchers/build.gradle
index 4b1fdf668ae..4dcca1ea6e0 100644
--- a/distribution/tools/launchers/build.gradle
+++ b/distribution/tools/launchers/build.gradle
@@ -29,7 +29,7 @@ dependencies {
 
 archivesBaseName = 'elasticsearch-launchers'
 
-tasks.withType(CheckForbiddenApis) {
+tasks.withType(CheckForbiddenApis).configureEach {
   replaceSignatureFiles 'jdk-signatures'
 }
 
diff --git a/libs/cli/build.gradle b/libs/cli/build.gradle
index e5aa2336b61..4363d4c1398 100644
--- a/libs/cli/build.gradle
+++ b/libs/cli/build.gradle
@@ -29,6 +29,6 @@ test.enabled = false
 // Since CLI does not depend on :server, it cannot run the jarHell task
 jarHell.enabled = false
 
-forbiddenApisMain {
+tasks.named('forbiddenApisMain').configure {
   replaceSignatureFiles 'jdk-signatures'
 }
diff --git a/libs/core/build.gradle b/libs/core/build.gradle
index c4aa6099bb0..0ca0148e765 100644
--- a/libs/core/build.gradle
+++ b/libs/core/build.gradle
@@ -88,7 +88,7 @@ dependencies {
   }
 }
 
-forbiddenApisMain {
+tasks.named('forbiddenApisMain').configure {
   // :libs:elasticsearch-core does not depend on server
   // TODO: Need to decide how we want to handle for forbidden signatures with the changes to server
   replaceSignatureFiles 'jdk-signatures'
diff --git a/libs/dissect/build.gradle b/libs/dissect/build.gradle
index f0791ea5a69..f9ff076ba9c 100644
--- a/libs/dissect/build.gradle
+++ b/libs/dissect/build.gradle
@@ -26,7 +26,7 @@ dependencies {
   testCompile "com.fasterxml.jackson.core:jackson-databind:${versions.jackson}"
 }
 
-forbiddenApisMain {
+tasks.named('forbiddenApisMain').configure {
   replaceSignatureFiles 'jdk-signatures'
 }
 
diff --git a/libs/geo/build.gradle b/libs/geo/build.gradle
index 5e7cfb90f1e..38055d92810 100644
--- a/libs/geo/build.gradle
+++ b/libs/geo/build.gradle
@@ -26,7 +26,7 @@ dependencies {
   }
 }
 
-forbiddenApisMain {
+tasks.named('forbiddenApisMain').configure {
   // geo does not depend on server
   // TODO: Need to decide how we want to handle for forbidden signatures with the changes to core
   replaceSignatureFiles 'jdk-signatures'
diff --git a/libs/grok/build.gradle b/libs/grok/build.gradle
index ba5811077ff..28f1ed26b42 100644
--- a/libs/grok/build.gradle
+++ b/libs/grok/build.gradle
@@ -27,6 +27,6 @@ dependencies {
   }
 }
 
-forbiddenApisMain {
+tasks.named('forbiddenApisMain').configure {
   replaceSignatureFiles 'jdk-signatures'
 }
diff --git a/libs/nio/build.gradle b/libs/nio/build.gradle
index a2e47250a90..4661e56a2e9 100644
--- a/libs/nio/build.gradle
+++ b/libs/nio/build.gradle
@@ -31,7 +31,7 @@ dependencies {
 }
 
 
-forbiddenApisMain {
+tasks.named('forbiddenApisMain').configure {
   // nio does not depend on core, so only jdk signatures should be checked
   // es-all is not checked as we connect and accept sockets
   replaceSignatureFiles 'jdk-signatures'
diff --git a/libs/plugin-classloader/build.gradle b/libs/plugin-classloader/build.gradle
index d6af6600d34..94f5cbcde4e 100644
--- a/libs/plugin-classloader/build.gradle
+++ b/libs/plugin-classloader/build.gradle
@@ -20,5 +20,5 @@
 test.enabled = false
 
 // test depend on ES core...
-forbiddenApisMain.enabled = false
+disableTasks('forbiddenApisMain')
 jarHell.enabled = false
diff --git a/libs/secure-sm/build.gradle b/libs/secure-sm/build.gradle
index 4cb0b89a16d..254b8d2f979 100644
--- a/libs/secure-sm/build.gradle
+++ b/libs/secure-sm/build.gradle
@@ -30,7 +30,7 @@ dependencies {
   }
 }
 
-forbiddenApisMain {
+tasks.named('forbiddenApisMain').configure {
   replaceSignatureFiles 'jdk-signatures'
 }
 
diff --git a/libs/ssl-config/build.gradle b/libs/ssl-config/build.gradle
index d835e1be2f3..ab6ec04bc84 100644
--- a/libs/ssl-config/build.gradle
+++ b/libs/ssl-config/build.gradle
@@ -31,7 +31,7 @@ dependencies {
 }
 
 
-forbiddenApisMain {
+tasks.named('forbiddenApisMain').configure {
   replaceSignatureFiles 'jdk-signatures'
 }
 
diff --git a/libs/x-content/build.gradle b/libs/x-content/build.gradle
index 2c7c6cc9401..9819417f262 100644
--- a/libs/x-content/build.gradle
+++ b/libs/x-content/build.gradle
@@ -39,7 +39,7 @@ dependencies {
 
 }
 
-forbiddenApisMain {
+tasks.named('forbiddenApisMain').configure {
   // x-content does not depend on server
   // TODO: Need to decide how we want to handle for forbidden signatures with the changes to core
   replaceSignatureFiles 'jdk-signatures'
diff --git a/plugins/analysis-icu/build.gradle b/plugins/analysis-icu/build.gradle
index 419f0bebbac..58a2276a85b 100644
--- a/plugins/analysis-icu/build.gradle
+++ b/plugins/analysis-icu/build.gradle
@@ -25,7 +25,7 @@ esplugin {
   hasClientJar = true
 }
 
-tasks.withType(CheckForbiddenApis) {
+tasks.withType(CheckForbiddenApis).configureEach {
   signatures += [
     "com.ibm.icu.text.Collator#getInstance() @ Don't use default locale, use getInstance(ULocale) instead"
   ]
diff --git a/qa/os/build.gradle b/qa/os/build.gradle
index 476488430dc..3385a2a5b40 100644
--- a/qa/os/build.gradle
+++ b/qa/os/build.gradle
@@ -42,7 +42,7 @@ dependencies {
   testCompile "com.fasterxml.jackson.core:jackson-databind:${versions.jackson}"
 }
 
-forbiddenApisTest {
+tasks.named('forbiddenApisTest').configure {
   replaceSignatureFiles 'jdk-signatures'
 }
 
@@ -58,7 +58,7 @@ tasks.dependenciesInfo.enabled = false
 tasks.thirdPartyAudit.ignoreMissingClasses()
 
 tasks.register('destructivePackagingTest') {
-  dependsOn 'destructiveDistroTest' 
+  dependsOn 'destructiveDistroTest'
 }
 
 processTestResources {
diff --git a/server/build.gradle b/server/build.gradle
index eafb5a8bc24..fb892e5a713 100644
--- a/server/build.gradle
+++ b/server/build.gradle
@@ -56,7 +56,7 @@ if (!isEclipse) {
     targetCompatibility = 11
   }
 
-  forbiddenApisJava11 {
+  tasks.named('forbiddenApisJava11').configure {
     doFirst {
       if (BuildParams.runtimeJavaVersion < JavaVersion.VERSION_11) {
         targetCompatibility = JavaVersion.VERSION_11.getMajorVersion()
diff --git a/test/fixtures/build.gradle b/test/fixtures/build.gradle
index 221008cd4e4..72fc923853c 100644
--- a/test/fixtures/build.gradle
+++ b/test/fixtures/build.gradle
@@ -1,4 +1,4 @@
 subprojects {
   // fixtures are mostly external and by default we don't want to check forbidden apis
-  forbiddenApisMain.enabled = false
+  disableTasks('forbiddenApisMain')
 }
diff --git a/test/framework/build.gradle b/test/framework/build.gradle
index 35978bb4ddd..74a3d51964c 100644
--- a/test/framework/build.gradle
+++ b/test/framework/build.gradle
@@ -38,7 +38,7 @@ compileJava.options.compilerArgs << '-Xlint:-cast,-rawtypes,-unchecked'
 compileTestJava.options.compilerArgs << '-Xlint:-rawtypes'
 
 // the main files are actually test files, so use the appropriate forbidden api sigs
-forbiddenApisMain {
+tasks.named('forbiddenApisMain').configure {
   replaceSignatureFiles 'jdk-signatures', 'es-all-signatures', 'es-test-signatures'
 }
 
diff --git a/test/logger-usage/build.gradle b/test/logger-usage/build.gradle
index dc8db713d59..d57dacc590c 100644
--- a/test/logger-usage/build.gradle
+++ b/test/logger-usage/build.gradle
@@ -27,8 +27,7 @@ dependencies {
 
 loggerUsageCheck.enabled = false
 
-forbiddenApisMain.enabled = true // disabled by parent project
-forbiddenApisMain {
+tasks.named('forbiddenApisMain').configure {
   replaceSignatureFiles 'jdk-signatures' // does not depend on core, only jdk signatures
 }
 jarHell.enabled = true // disabled by parent project
diff --git a/x-pack/plugin/core/build.gradle b/x-pack/plugin/core/build.gradle
index 41e3188e731..f28173ed3ba 100644
--- a/x-pack/plugin/core/build.gradle
+++ b/x-pack/plugin/core/build.gradle
@@ -90,7 +90,7 @@ forbiddenPatterns {
   exclude '**/*.zip'
 }
 
-forbiddenApisMain {
+tasks.named('forbiddenApisMain').configure {
   signaturesFiles += files('forbidden/hasher-signatures.txt')
 }
 
diff --git a/x-pack/plugin/identity-provider/build.gradle b/x-pack/plugin/identity-provider/build.gradle
index 4575307ea98..5355bc188e0 100644
--- a/x-pack/plugin/identity-provider/build.gradle
+++ b/x-pack/plugin/identity-provider/build.gradle
@@ -69,7 +69,7 @@ forbiddenPatterns {
   exclude '**/*.zip'
 }
 
-forbiddenApisMain {
+tasks.named('forbiddenApisMain').configure {
   signaturesFiles += files('forbidden/xml-signatures.txt')
 }
 
diff --git a/x-pack/plugin/security/build.gradle b/x-pack/plugin/security/build.gradle
index 866e8c2b3da..72d100342ec 100644
--- a/x-pack/plugin/security/build.gradle
+++ b/x-pack/plugin/security/build.gradle
@@ -172,7 +172,7 @@ forbiddenPatterns {
   exclude '**/*.zip'
 }
 
-forbiddenApisMain {
+tasks.named('forbiddenApisMain').configure {
   signaturesFiles += files('forbidden/ldap-signatures.txt', 'forbidden/xml-signatures.txt', 'forbidden/oidc-signatures.txt')
 }
 
diff --git a/x-pack/plugin/security/cli/build.gradle b/x-pack/plugin/security/cli/build.gradle
index efefb6dc3e7..0f83334fa67 100644
--- a/x-pack/plugin/security/cli/build.gradle
+++ b/x-pack/plugin/security/cli/build.gradle
@@ -42,7 +42,7 @@ if (BuildParams.inFipsJvm) {
   testingConventions.enabled = false
   // Forbiden APIs non-portable checks fail because bouncy castle classes being used from the FIPS JDK since those are
   // not part of the Java specification - all of this is as designed, so we have to relax this check for FIPS.
-  tasks.withType(CheckForbiddenApis) {
+  tasks.withType(CheckForbiddenApis).configureEach {
     bundledSignatures -= "jdk-non-portable"
   }
 }
diff --git a/x-pack/plugin/sql/jdbc/build.gradle b/x-pack/plugin/sql/jdbc/build.gradle
index badecb59777..42ced945167 100644
--- a/x-pack/plugin/sql/jdbc/build.gradle
+++ b/x-pack/plugin/sql/jdbc/build.gradle
@@ -5,7 +5,7 @@ apply plugin: 'com.github.johnrengelman.shadow'
 description = 'JDBC driver for Elasticsearch'
 archivesBaseName = "x-pack-sql-jdbc"
 
-forbiddenApisMain {
+tasks.named('forbiddenApisMain').configure {
   // does not depend on core, so only jdk and http signatures should be checked
   replaceSignatureFiles 'jdk-signatures'
 }
diff --git a/x-pack/plugin/sql/qa/build.gradle b/x-pack/plugin/sql/qa/build.gradle
index 2acbb966776..d5c23ac68cc 100644
--- a/x-pack/plugin/sql/qa/build.gradle
+++ b/x-pack/plugin/sql/qa/build.gradle
@@ -39,7 +39,7 @@ dependencyLicenses.enabled = false
 dependenciesInfo.enabled = false
 
 // the main files are actually test files, so use the appropriate forbidden api sigs
-forbiddenApisMain {
+tasks.named('forbiddenApisMain').configure {
   replaceSignatureFiles 'es-all-signatures', 'es-test-signatures'
 }
 
diff --git a/x-pack/plugin/sql/sql-action/build.gradle b/x-pack/plugin/sql/sql-action/build.gradle
index 4e74d9be353..764831bfdd1 100644
--- a/x-pack/plugin/sql/sql-action/build.gradle
+++ b/x-pack/plugin/sql/sql-action/build.gradle
@@ -28,7 +28,7 @@ dependencies {
   testCompile project(":test:framework")
 }
 
-forbiddenApisMain {
+tasks.named('forbiddenApisMain').configure {
   //sql does not depend on server, so only jdk signatures should be checked
   replaceSignatureFiles 'jdk-signatures'
 }
diff --git a/x-pack/plugin/sql/sql-cli/build.gradle b/x-pack/plugin/sql/sql-cli/build.gradle
index 2b7e4436508..d3291ca5ec0 100644
--- a/x-pack/plugin/sql/sql-cli/build.gradle
+++ b/x-pack/plugin/sql/sql-cli/build.gradle
@@ -55,7 +55,7 @@ shadowJar {
   }
 }
 
-forbiddenApisMain {
+tasks.named('forbiddenApisMain').configure {
   //sql does not depend on server, so only jdk signatures should be checked
   replaceSignatureFiles 'jdk-signatures'
   signaturesFiles += files('src/forbidden/cli-signatures.txt')
diff --git a/x-pack/plugin/sql/sql-client/build.gradle b/x-pack/plugin/sql/sql-client/build.gradle
index 0679a3fe509..b83db0d1b16 100644
--- a/x-pack/plugin/sql/sql-client/build.gradle
+++ b/x-pack/plugin/sql/sql-client/build.gradle
@@ -21,12 +21,12 @@ dependencyLicenses {
   ignoreSha 'elasticsearch-core'
 }
 
-forbiddenApisMain {
+tasks.named('forbiddenApisMain').configure {
   // does not depend on core, so only jdk and http signatures should be checked
   replaceSignatureFiles 'jdk-signatures'
 }
 
-forbiddenApisTest {
+tasks.named('forbiddenApisTest').configure {
   bundledSignatures -= 'jdk-non-portable'
   bundledSignatures += 'jdk-internal'
 }
diff --git a/x-pack/plugin/sql/sql-proto/build.gradle b/x-pack/plugin/sql/sql-proto/build.gradle
index dac036ecf6b..d3fc8e579a2 100644
--- a/x-pack/plugin/sql/sql-proto/build.gradle
+++ b/x-pack/plugin/sql/sql-proto/build.gradle
@@ -18,7 +18,7 @@ dependencies {
   testCompile project(":test:framework")
 }
 
-forbiddenApisMain {
+tasks.named('forbiddenApisMain').configure {
   //sql does not depend on server, so only jdk signatures should be checked
   replaceSignatureFiles 'jdk-signatures'
 }