diff --git a/pom.xml b/pom.xml
index dd8c46d6e9b..b7ebd644466 100644
--- a/pom.xml
+++ b/pom.xml
@@ -920,6 +920,9 @@
                     <signaturesFiles>
                         <signaturesFile>${project.basedir}/src/maven/forbiddenapis.txt</signaturesFile>
                     </signaturesFiles>
+                    <excludes>
+                        <exclude>edu/harvard/iq/dataverse/util/xml/XmlUtil.class</exclude>
+                    </excludes>
                     <targetVersion>${target.java.version}</targetVersion>
                 </configuration>
                 <executions>
diff --git a/src/maven/forbiddenapis.txt b/src/maven/forbiddenapis.txt
index 43b2939732b..0c8d257d472 100644
--- a/src/maven/forbiddenapis.txt
+++ b/src/maven/forbiddenapis.txt
@@ -39,4 +39,18 @@ jakarta.json.Json#createMergeDiff(jakarta.json.JsonValue,jakarta.json.JsonValue)
 jakarta.json.Json#createPatchBuilder()
 jakarta.json.Json#createPatchBuilder(jakarta.json.JsonArray)
 jakarta.json.Json#createPointer(java.lang.String)
-jakarta.json.Json#createBuilderFactory(java.util.Map)
\ No newline at end of file
+jakarta.json.Json#createBuilderFactory(java.util.Map)
+
+@defaultMessage Use edu.harvard.iq.dataverse.util.xml.XmlUtil.getSecureDocumentBuilderFactory() instead
+javax.xml.parsers.DocumentBuilderFactory#newInstance()
+javax.xml.parsers.DocumentBuilderFactory#newInstance(java.lang.String,java.lang.ClassLoader)
+
+@defaultMessage Use edu.harvard.iq.dataverse.util.xml.XmlUtil.getSecureXMLReader() instead
+javax.xml.parsers.SAXParserFactory#newInstance()
+javax.xml.parsers.SAXParserFactory#newInstance(java.lang.String,java.lang.ClassLoader)
+
+@defaultMessage Use edu.harvard.iq.dataverse.util.xml.XmlUtil.getSecureXMLInputFactory() instead
+javax.xml.stream.XMLInputFactory#newInstance()
+javax.xml.stream.XMLInputFactory#newInstance(java.lang.String,java.lang.ClassLoader)
+javax.xml.stream.XMLInputFactory#newFactory()
+javax.xml.stream.XMLInputFactory#newFactory(java.lang.String,java.lang.ClassLoader)
\ No newline at end of file