diff --git a/.baseline/checkstyle/checkstyle.xml b/.baseline/checkstyle/checkstyle.xml
index 2be3288d7..72eb1b14a 100644
--- a/.baseline/checkstyle/checkstyle.xml
+++ b/.baseline/checkstyle/checkstyle.xml
@@ -81,14 +81,7 @@
         </module>
         <module name="AvoidStarImport"/> <!-- Java Style Guide: No wildcard imports -->
         <module name="AvoidStaticImport"> <!-- Java Style Guide: No static imports -->
-            <property name="excludes" value="
-                com.google.common.base.Preconditions.*,
-                com.palantir.logsafe.Preconditions.*,
-                java.util.Collections.*,
-                java.util.stream.Collectors.*,
-                org.apache.commons.lang3.Validate.*,
-                org.assertj.core.api.Assertions.*,
-                org.mockito.Mockito.*"/>
+            <property name="excludes" value="com.google.common.base.Preconditions.*, com.palantir.logsafe.Preconditions.*, java.util.Collections.*, java.util.stream.Collectors.*, org.apache.commons.lang3.Validate.*, org.assertj.core.api.Assertions.*, org.mockito.Mockito.*"/>
         </module>
         <module name="ClassTypeParameterName"> <!-- Java Style Guide: Type variable names -->
             <property name="format" value="(^[A-Z][0-9]?)$|([A-Z][a-zA-Z0-9]*[T]$)"/>
@@ -138,12 +131,12 @@
         <module name="IllegalImport"> <!-- Java Coding Guidelines: Import the canonical package -->
             <property name="id" value="BanShadedClasses"/>
             <property name="illegalPkgs" value=".*\.(repackaged|shaded|thirdparty)"/>
-            <property name="regexp" value="true" />
+            <property name="regexp" value="true"/>
             <message key="import.illegal" value="Must not import repackaged classes."/>
         </module>
         <module name="IllegalImport">
             <property name="illegalPkgs" value="^org\.gradle\.(internal|.*\.internal)"/>
-            <property name="regexp" value="true" />
+            <property name="regexp" value="true"/>
             <message key="import.illegal" value="Do not rely on gradle internal classes as these may change in minor releases - use org.gradle.api versions instead."/>
         </module>
         <module name="IllegalImport">
@@ -358,7 +351,7 @@
         </module>
         <module name="RegexpSinglelineJava">
             <property name="format" value="\bCharset.defaultCharset\("/>
-            <property name="message" value="Use explicit charset (e.g. StandardCharsets.UTF-8) instead of default."/>
+            <property name="message" value="Use explicit charset (e.g. StandardCharsets.UTF_8) instead of default."/>
         </module>
         <module name="RegexpSinglelineJava">
             <property name="format" value="\bIOUtils\.toString\("/>
@@ -397,7 +390,7 @@
         <module name="SuppressWarnings">
             <property name="format" value="serial"/>
         </module>
-        <module name="SuppressWarningsHolder" />  <!-- Required for SuppressWarningsFilter -->
+        <module name="SuppressWarningsHolder"/>  <!-- Required for SuppressWarningsFilter -->
         <module name="TypeName"> <!-- Java Style Guide: Class names -->
             <message key="name.invalidPattern" value="Type name ''{0}'' must match pattern ''{1}''."/>
         </module>
@@ -430,7 +423,7 @@
             <property name="ignoredAnnotations" value="ParameterizedTest, Test, Before, BeforeEach, After, AfterEach, BeforeClass, BeforeAll, AfterClass, AfterAll"/>
         </module>
         <module name="JavadocMethod"> <!-- Java Style Guide: Where Javadoc is used -->
-            <property name="scope" value="public"/>
+            <property name="accessModifiers" value="public"/>
             <property name="allowMissingParamTags" value="true"/>
             <property name="allowMissingReturnTag" value="true"/>
             <property name="allowedAnnotations" value="Override, Test"/>
diff --git a/.baseline/idea/intellij-java-palantir-style.xml b/.baseline/idea/intellij-java-palantir-style.xml
index 945d8bad0..f41e2b8aa 100644
--- a/.baseline/idea/intellij-java-palantir-style.xml
+++ b/.baseline/idea/intellij-java-palantir-style.xml
@@ -44,6 +44,18 @@
               <package name="" withSubpackages="true" static="false" />
             </value>
           </option>
+          <DO_NOT_IMPORT_INNER>
+            <CLASS name="Builder" />
+            <CLASS name="Callback" />
+            <CLASS name="Class" />
+            <CLASS name="Entry" />
+            <CLASS name="Enum" />
+            <CLASS name="Factory" />
+            <CLASS name="Type" />
+            <CLASS name="Key" />
+            <CLASS name="Id" />
+            <CLASS name="Provider" />
+          </DO_NOT_IMPORT_INNER>
         </GroovyCodeStyleSettings>
         <option name="JD_ALIGN_EXCEPTION_COMMENTS" value="false" />
         <option name="JD_ALIGN_PARAM_COMMENTS" value="false" />
diff --git a/build.gradle b/build.gradle
index 54c7adf6a..0fecdbaa5 100644
--- a/build.gradle
+++ b/build.gradle
@@ -7,7 +7,7 @@ buildscript {
     dependencies {
         classpath 'com.palantir.gradle.externalpublish:gradle-external-publish-plugin:1.4.0'
         classpath 'com.github.jengelman.gradle.plugins:shadow:6.1.0'
-        classpath 'com.palantir.baseline:gradle-baseline-java:3.43.0'
+        classpath 'com.palantir.baseline:gradle-baseline-java:4.22.0'
         classpath 'com.palantir.gradle.consistentversions:gradle-consistent-versions:2.0.0'
     }
 }
diff --git a/crypto-core/src/main/java/com/palantir/crypto2/io/ApacheCtrDecryptingSeekableInput.java b/crypto-core/src/main/java/com/palantir/crypto2/io/ApacheCtrDecryptingSeekableInput.java
index 812bfe440..b8518792e 100644
--- a/crypto-core/src/main/java/com/palantir/crypto2/io/ApacheCtrDecryptingSeekableInput.java
+++ b/crypto-core/src/main/java/com/palantir/crypto2/io/ApacheCtrDecryptingSeekableInput.java
@@ -57,8 +57,8 @@ public long getPos() throws IOException {
     }
 
     @Override
-    public int read(byte[] bytes, int offset, int length) throws IOException {
-        return super.read(bytes, offset, length);
+    public int read(byte[] bytes, int off, int len) throws IOException {
+        return super.read(bytes, off, len);
     }
 
     @Override
diff --git a/crypto-keys/src/main/java/com/palantir/crypto2/keys/ChainedKeyStorageStrategy.java b/crypto-keys/src/main/java/com/palantir/crypto2/keys/ChainedKeyStorageStrategy.java
index 5a78dd115..70a794743 100644
--- a/crypto-keys/src/main/java/com/palantir/crypto2/keys/ChainedKeyStorageStrategy.java
+++ b/crypto-keys/src/main/java/com/palantir/crypto2/keys/ChainedKeyStorageStrategy.java
@@ -32,7 +32,7 @@
  */
 public final class ChainedKeyStorageStrategy implements KeyStorageStrategy {
 
-    private static final Logger logger = LoggerFactory.getLogger(ChainedKeyStorageStrategy.class);
+    private static final Logger log = LoggerFactory.getLogger(ChainedKeyStorageStrategy.class);
 
     private final List<KeyStorageStrategy> strategies;
 
@@ -60,7 +60,10 @@ public KeyMaterial get(String fileKey) {
                 return strategy.get(fileKey);
             } catch (Exception e) {
                 suppressedExceptions.add(e);
-                logger.info("Failed to get key material using {}", strategy.getClass().getCanonicalName(), e);
+                log.info(
+                        "Failed to get key material using {}",
+                        strategy.getClass().getCanonicalName(),
+                        e);
             }
         }
         RuntimeException toThrow = new RuntimeException(String.format(
diff --git a/crypto-keys/src/main/java/com/palantir/crypto2/keys/KeyMaterial.java b/crypto-keys/src/main/java/com/palantir/crypto2/keys/KeyMaterial.java
index e277619d5..64c0e8d75 100644
--- a/crypto-keys/src/main/java/com/palantir/crypto2/keys/KeyMaterial.java
+++ b/crypto-keys/src/main/java/com/palantir/crypto2/keys/KeyMaterial.java
@@ -20,6 +20,8 @@
 import org.immutables.value.Value;
 
 // This class is not Jackson serializable due to SecretKey
+// Automatically suppressed to unblock enforcement in new code
+@SuppressWarnings("ImmutablesStyle")
 @Value.Immutable
 @Value.Style(visibility = Value.Style.ImplementationVisibility.PACKAGE, jdkOnly = true)
 public abstract class KeyMaterial {
diff --git a/hadoop-crypto/src/main/java/com/palantir/crypto2/hadoop/DelegatingFileSystem.java b/hadoop-crypto/src/main/java/com/palantir/crypto2/hadoop/DelegatingFileSystem.java
index fbebd2237..c0b6da48d 100644
--- a/hadoop-crypto/src/main/java/com/palantir/crypto2/hadoop/DelegatingFileSystem.java
+++ b/hadoop-crypto/src/main/java/com/palantir/crypto2/hadoop/DelegatingFileSystem.java
@@ -34,7 +34,7 @@
  */
 public abstract class DelegatingFileSystem extends FilterFileSystem {
 
-    public DelegatingFileSystem(FileSystem delegate) {
+    protected DelegatingFileSystem(FileSystem delegate) {
         super(delegate);
         try {
             super.initialize(delegate.getUri(), delegate.getConf());