diff --git a/generator/src/main/java/io/wcm/devops/conga/generator/ContextPropertiesBuilder.java b/generator/src/main/java/io/wcm/devops/conga/generator/ContextPropertiesBuilder.java
index df0bf929..61d1fd75 100644
--- a/generator/src/main/java/io/wcm/devops/conga/generator/ContextPropertiesBuilder.java
+++ b/generator/src/main/java/io/wcm/devops/conga/generator/ContextPropertiesBuilder.java
@@ -82,6 +82,7 @@ private ContextPropertiesBuilder() {
    * @param variableStringResolver Variable string resolver
    * @return Context variables map
    */
+  @SuppressWarnings("java:S3776") // ignore complexity
   public static Map<String, Object> buildEnvironmentContextVariables(String environmentName,
       Environment environment, String version,
       VariableObjectTreeResolver variableObjectTreeResolver, VariableStringResolver variableStringResolver) {
diff --git a/generator/src/main/java/io/wcm/devops/conga/generator/EnvironmentGenerator.java b/generator/src/main/java/io/wcm/devops/conga/generator/EnvironmentGenerator.java
index 3a531d43..6b78a15e 100644
--- a/generator/src/main/java/io/wcm/devops/conga/generator/EnvironmentGenerator.java
+++ b/generator/src/main/java/io/wcm/devops/conga/generator/EnvironmentGenerator.java
@@ -239,8 +239,7 @@ private void generateNode(Node node) {
           mergedConfig.putAll(ContextPropertiesBuilder.buildCurrentContextVariables(node, nodeRole));
 
           // collect role and tenant information for export model
-          ExportNodeRoleData exportNodeRoleData = exportModelGenerator.addRole(roleName, variants, mergedConfig,
-              role.getSensitiveConfigParameters());
+          ExportNodeRoleData exportNodeRoleData = exportModelGenerator.addRole(roleName, variants, mergedConfig);
 
           // generate files
           List<GeneratedFileContext> allFiles = new ArrayList<>();
@@ -319,6 +318,7 @@ private String getEscapingStrategy(RoleFile roleFile) {
         .getName();
   }
 
+  @SuppressWarnings("java:S107") // allow many parameters
   private void multiplyFiles(Role role, RoleFile roleFile, Map<String, Object> config, File nodeDir, Template template,
       String roleName, List<String> roleVariantNames, String templateName, List<GeneratedFileContext> generatedFiles) {
     MultiplyPlugin multiplyPlugin = defaultMultiplyPlugin;
@@ -365,7 +365,10 @@ private void multiplyFiles(Role role, RoleFile roleFile, Map<String, Object> con
     }
   }
 
-  @SuppressWarnings("PMD.PreserveStackTrace")
+  @SuppressWarnings({
+      "PMD.PreserveStackTrace",
+      "java:S107" // allow many parameters
+  })
   @SuppressFBWarnings("RV_RETURN_VALUE_IGNORED_BAD_PRACTICE")
   private Collection<GeneratedFileContext> generateFile(RoleFile roleFile, String dir,
       String fileName, String url, String symlinkTarget,
diff --git a/generator/src/main/java/io/wcm/devops/conga/generator/FileGenerator.java b/generator/src/main/java/io/wcm/devops/conga/generator/FileGenerator.java
index 3be609c9..09f233e3 100644
--- a/generator/src/main/java/io/wcm/devops/conga/generator/FileGenerator.java
+++ b/generator/src/main/java/io/wcm/devops/conga/generator/FileGenerator.java
@@ -97,14 +97,13 @@ class FileGenerator {
   static final String POSTPROCESSOR_KEY_FILE_HEADER = "postProcessor.fileHeader";
   static final String POSTPROCESSOR_KEY_VALIDATORS = "postProcessor.validators";
 
-  //CHECKSTYLE:OFF
+  @SuppressWarnings({ "java:S107", "checkstyle:ParameterNumberCheck" }) // allow many parameters
   FileGenerator(GeneratorOptions options, String environmentName,
       String roleName, List<String> roleVariantNames, String templateName,
       File nodeDir, File file, String url, String symlinkTarget,
       RoleFile roleFile, Map<String, Object> config, Template template,
       VariableMapResolver variableMapResolver, UrlFileManager urlFileManager, PluginContextOptions pluginContextOptions,
       Collection<String> dependencyVersions) {
-    //CHECKSTYLE:ON
     this.environmentName = environmentName;
     this.roleName = roleName;
     this.roleVariantNames = roleVariantNames;
@@ -206,6 +205,10 @@ private List<String> formatFileHeaderCommentLines(List<String> lines) {
    * @return List of files that where generated directly or indirectly (by post processors).
    */
   @SuppressFBWarnings({ "ST_WRITE_TO_STATIC_FROM_INSTANCE_METHOD", "RV_RETURN_VALUE_IGNORED_BAD_PRACTICE" })
+  @SuppressWarnings({
+      "java:S3776", // ignore complexity
+      "java:S2696" // static variable set by intention
+  })
   public Collection<GeneratedFileContext> generate() throws IOException {
     File dir = file.getParentFile();
     if (!dir.exists()) {
diff --git a/generator/src/main/java/io/wcm/devops/conga/generator/Generator.java b/generator/src/main/java/io/wcm/devops/conga/generator/Generator.java
index 59d5d420..03217b42 100644
--- a/generator/src/main/java/io/wcm/devops/conga/generator/Generator.java
+++ b/generator/src/main/java/io/wcm/devops/conga/generator/Generator.java
@@ -72,6 +72,7 @@ public void generate(String[] environmentNames) {
    * @param nodeNames Node names to generate. If none specified all nodes are generated.
    */
   @SuppressFBWarnings("RV_RETURN_VALUE_IGNORED_BAD_PRACTICE")
+  @SuppressWarnings("java:S3776") // ignore complexity
   public void generate(String[] environmentNames, String[] nodeNames) {
     Map<String, Environment> selectedEnvironments = new HashMap<>();
     if (environmentNames == null || environmentNames.length == 0) {
diff --git a/generator/src/main/java/io/wcm/devops/conga/generator/export/NodeModelExport.java b/generator/src/main/java/io/wcm/devops/conga/generator/export/NodeModelExport.java
index ae82efc4..6ec58493 100644
--- a/generator/src/main/java/io/wcm/devops/conga/generator/export/NodeModelExport.java
+++ b/generator/src/main/java/io/wcm/devops/conga/generator/export/NodeModelExport.java
@@ -71,6 +71,7 @@ public final class NodeModelExport {
    *          environment.
    * @param yamlRepresenter YAML representer
    */
+  @SuppressWarnings("java:S107") // allow many parameters
   public NodeModelExport(File nodeDir, Node node, Environment environment, ModelExport modelExport,
       VariableStringResolver variableStringResolver, VariableMapResolver variableMapResolver,
       Map<String, String> containerVersionInfo, PluginContextOptions pluginContextOptions,
@@ -105,11 +106,9 @@ private boolean isActive() {
    * @param role Role name
    * @param roleVariants Role variant name
    * @param config Merged configuration (unresolved)
-   * @param sensitiveConfigParametersList List of configuration parameter names that contain sensitive data
    * @return Node role data
    */
-  public ExportNodeRoleData addRole(String role, List<String> roleVariants, Map<String, Object> config,
-      List<String> sensitiveConfigParametersList) {
+  public ExportNodeRoleData addRole(String role, List<String> roleVariants, Map<String, Object> config) {
     if (!isActive()) {
       return new ExportNodeRoleData();
     }
diff --git a/generator/src/main/java/io/wcm/devops/conga/generator/plugins/fileheader/AbstractFileHeader.java b/generator/src/main/java/io/wcm/devops/conga/generator/plugins/fileheader/AbstractFileHeader.java
index ba213fd9..2e918eac 100644
--- a/generator/src/main/java/io/wcm/devops/conga/generator/plugins/fileheader/AbstractFileHeader.java
+++ b/generator/src/main/java/io/wcm/devops/conga/generator/plugins/fileheader/AbstractFileHeader.java
@@ -136,6 +136,7 @@ protected final FileHeaderContext extractFileHeaderBetweenBlockStartEnd(FileCont
    * @param file File File
    * @return File header or null
    */
+  @SuppressWarnings("java:S3776") // ignore complexity
   protected final FileHeaderContext extractFileHeaderWithLinePrefixes(FileContext file) {
     try {
       if (StringUtils.isNotEmpty(getLineBreak()) && StringUtils.isNotEmpty(getCommentLinePrefix())) {
diff --git a/generator/src/main/java/io/wcm/devops/conga/generator/plugins/urlfile/FilesystemUrlFilePlugin.java b/generator/src/main/java/io/wcm/devops/conga/generator/plugins/urlfile/FilesystemUrlFilePlugin.java
index 40b9bac8..6ae89d3e 100644
--- a/generator/src/main/java/io/wcm/devops/conga/generator/plugins/urlfile/FilesystemUrlFilePlugin.java
+++ b/generator/src/main/java/io/wcm/devops/conga/generator/plugins/urlfile/FilesystemUrlFilePlugin.java
@@ -70,7 +70,7 @@ public String getFileName(String url, UrlFilePluginContext context) {
   public InputStream getFile(String url, UrlFilePluginContext context) throws IOException {
     File file = getFileInternal(url, context);
     if (!file.exists()) {
-      throw new FileNotFoundException("File does not exist: " + FileUtil.getCanonicalPath(file));
+      throwFileNotFoundException(file);
     }
     return new BufferedInputStream(new FileInputStream(file));
   }
@@ -79,7 +79,7 @@ public InputStream getFile(String url, UrlFilePluginContext context) throws IOEx
   public URL getFileUrl(String url, UrlFilePluginContext context) throws IOException {
     File file = getFileInternal(url, context);
     if (!file.exists()) {
-      throw new FileNotFoundException("File does not exist: " + FileUtil.getCanonicalPath(file));
+      throwFileNotFoundException(file);
     }
     return file.toURI().toURL();
   }
@@ -89,7 +89,7 @@ public URL getFileUrl(String url, UrlFilePluginContext context) throws IOExcepti
   public void deleteFile(String url, UrlFilePluginContext context) throws IOException {
     File file = getFileInternal(url, context);
     if (!file.exists()) {
-      throw new FileNotFoundException("File does not exist: " + FileUtil.getCanonicalPath(file));
+      throwFileNotFoundException(file);
     }
     Files.delete(file.toPath());
   }
@@ -115,4 +115,8 @@ else if (StringUtils.startsWith(url, PREFIX_NODE)) {
     }
   }
 
+  private static void throwFileNotFoundException(File file) throws FileNotFoundException {
+    throw new FileNotFoundException("File does not exist: " + FileUtil.getCanonicalPath(file));
+  }
+
 }
diff --git a/generator/src/main/java/io/wcm/devops/conga/generator/util/VariableStringResolver.java b/generator/src/main/java/io/wcm/devops/conga/generator/util/VariableStringResolver.java
index 06a47f6f..db2f7b04 100644
--- a/generator/src/main/java/io/wcm/devops/conga/generator/util/VariableStringResolver.java
+++ b/generator/src/main/java/io/wcm/devops/conga/generator/util/VariableStringResolver.java
@@ -41,6 +41,7 @@ public final class VariableStringResolver {
    * ${provider::var1}
    * ${provider::Var1:defaultValue}
    */
+  @SuppressWarnings("java:S125") // no commented out code
   private static final String NAME_PATTERN_STRING = "[^\\}\\{\\$\\:()'\"/\\#,;\\+\\*@!\\^\\s]";
   private static final String NAME_PATTERN_STRING_NOT_EMPTY = NAME_PATTERN_STRING + "+";
   private static final String NAME_PATTERN_STRING_OR_EMPTY = NAME_PATTERN_STRING + "*";
@@ -172,6 +173,7 @@ private Object resolve(String value, Map<String, Object> variables, int iteratio
     }
   }
 
+  @SuppressWarnings("java:S3776") // ignore complexity
   private Object resolveSingle(Matcher matcher, Map<String, Object> variables, int iterationCount) {
     boolean escapedVariable = StringUtils.equals(matcher.group(EXPRESSION_POS_DOLLAR_SIGN), "\\$");
     String expression = matcher.group(EXPRESSION_POS_EXPRESSION);
@@ -224,6 +226,7 @@ private Object resolveSingle(Matcher matcher, Map<String, Object> variables, int
     }
   }
 
+  @SuppressWarnings("java:S3776") // ignore complexity
   private Object resolveMulti(Matcher matcher, Map<String, Object> variables, int iterationCount) {
     StringBuffer sb = new StringBuffer();
     boolean replacedAny = false;
diff --git a/generator/src/test/java/io/wcm/devops/conga/generator/GeneratorTest.java b/generator/src/test/java/io/wcm/devops/conga/generator/GeneratorTest.java
index 7f5e794e..3992fc13 100644
--- a/generator/src/test/java/io/wcm/devops/conga/generator/GeneratorTest.java
+++ b/generator/src/test/java/io/wcm/devops/conga/generator/GeneratorTest.java
@@ -50,6 +50,7 @@ void setUp(TestInfo testInfo) throws IOException {
   }
 
   @Test
+  @SuppressWarnings("java:S5961") // number of asserts
   void testAllEnvironments() {
     File node1Dir = assertDirectory(destDir, "env1/node1");
 
diff --git a/model/src/main/java/io/wcm/devops/conga/model/util/MapMerger.java b/model/src/main/java/io/wcm/devops/conga/model/util/MapMerger.java
index 1a31cc16..47aeb805 100644
--- a/model/src/main/java/io/wcm/devops/conga/model/util/MapMerger.java
+++ b/model/src/main/java/io/wcm/devops/conga/model/util/MapMerger.java
@@ -48,7 +48,11 @@ private MapMerger() {
    * @param map2 Map 2
    * @return Merged map
    */
-  @SuppressWarnings("unchecked")
+  @SuppressWarnings({
+      "unchecked",
+      "java:S3776", // ignore complexity
+      "java:S2234" // parameter arguments switched by intention
+  })
   public static <K> Map<K, Object> merge(Map<K, Object> map1, Map<K, Object> map2) {
     Map<K, Object> merged = new HashMap<>();
     if (map1 == null || map2 == null) {
diff --git a/model/src/main/java/io/wcm/devops/conga/model/util/MapSplitter.java b/model/src/main/java/io/wcm/devops/conga/model/util/MapSplitter.java
index 0e50e6ba..e1da0627 100644
--- a/model/src/main/java/io/wcm/devops/conga/model/util/MapSplitter.java
+++ b/model/src/main/java/io/wcm/devops/conga/model/util/MapSplitter.java
@@ -43,7 +43,10 @@ private MapSplitter() {
    * @return Result with the first map (matching) with all matching values, and the second map (unmatching) with all
    *         values that do not match.
    */
-  @SuppressWarnings("unchecked")
+  @SuppressWarnings({
+      "unchecked",
+      "java:S135" // multiple continue statements
+  })
   public static @NotNull SplitResult splitMap(Map<String, Object> map,
       @NotNull Predicate<Map.Entry<String, Object>> matcher) {
     Map<String, Object> matching = new HashMap<>();
diff --git a/model/src/test/java/io/wcm/devops/conga/model/reader/EnvironmentReaderTest.java b/model/src/test/java/io/wcm/devops/conga/model/reader/EnvironmentReaderTest.java
index d255d738..48aaafde 100644
--- a/model/src/test/java/io/wcm/devops/conga/model/reader/EnvironmentReaderTest.java
+++ b/model/src/test/java/io/wcm/devops/conga/model/reader/EnvironmentReaderTest.java
@@ -118,13 +118,13 @@ void testTenant() {
   }
 
   @Test
-  void testEnvironmentWithNullTenant() {
-    assertThrows(ConstructorException.class, () -> {
-      EnvironmentReader reader = new EnvironmentReader();
-      try (InputStream is = getClass().getResourceAsStream("/environment_null_tenant.yaml")) {
+  void testEnvironmentWithNullTenant() throws IOException {
+    EnvironmentReader reader = new EnvironmentReader();
+    try (InputStream is = getClass().getResourceAsStream("/environment_null_tenant.yaml")) {
+      assertThrows(ConstructorException.class, () -> {
         reader.read(is);
-      }
-    });
+      });
+    }
   }
 
   @Test
diff --git a/tooling/conga-maven-plugin/src/main/java/io/wcm/devops/conga/tooling/maven/plugin/AbstractCongaMojo.java b/tooling/conga-maven-plugin/src/main/java/io/wcm/devops/conga/tooling/maven/plugin/AbstractCongaMojo.java
index d1584d90..2bea94af 100644
--- a/tooling/conga-maven-plugin/src/main/java/io/wcm/devops/conga/tooling/maven/plugin/AbstractCongaMojo.java
+++ b/tooling/conga-maven-plugin/src/main/java/io/wcm/devops/conga/tooling/maven/plugin/AbstractCongaMojo.java
@@ -279,6 +279,7 @@ private File buildJarFile(File contentDirectory) throws MojoExecutionException {
     return jarFile;
   }
 
+  @SuppressWarnings("java:S1168") // null array is allowed
   private String[] toArray(List<String> values) {
     if (values == null || values.isEmpty()) {
       return null;
diff --git a/tooling/conga-maven-plugin/src/main/java/io/wcm/devops/conga/tooling/maven/plugin/PackageMojo.java b/tooling/conga-maven-plugin/src/main/java/io/wcm/devops/conga/tooling/maven/plugin/PackageMojo.java
index bef29bb2..51c122f2 100644
--- a/tooling/conga-maven-plugin/src/main/java/io/wcm/devops/conga/tooling/maven/plugin/PackageMojo.java
+++ b/tooling/conga-maven-plugin/src/main/java/io/wcm/devops/conga/tooling/maven/plugin/PackageMojo.java
@@ -77,7 +77,10 @@ public void execute() throws MojoExecutionException, MojoFailureException {
   }
 
 
-  @SuppressWarnings("PMD.UseStringBufferForStringAppends")
+  @SuppressWarnings({
+      "PMD.UseStringBufferForStringAppends",
+      "java:S3776" // ignore complexity
+  })
   private void buildGeneratedConfigurationAttachments() throws MojoExecutionException, MojoFailureException {
     Set<String> selectedEnvironments;
     if (environments != null && environments.length > 0) {
@@ -167,6 +170,7 @@ private File buildZipFile(File contentDirectory, String classifier) throws MojoE
    * @param basePath Base path
    * @param directory Directory to include
    */
+  @SuppressWarnings("java:S3776") // ignore complexity
   private void addZipDirectory(String basePath, File directory) throws MojoExecutionException {
     String directoryPath = toZipDirectoryPath(directory);
     if (StringUtils.startsWith(directoryPath, basePath)) {