diff --git a/sdks/java/io/expansion-service/build.gradle b/sdks/java/io/expansion-service/build.gradle
index d7fef3d823324..26a001b6ea240 100644
--- a/sdks/java/io/expansion-service/build.gradle
+++ b/sdks/java/io/expansion-service/build.gradle
@@ -27,6 +27,12 @@ applyJavaNature(
   shadowClosure: {},
 )
 
+// TODO(https://github.com/apache/beam/pull/32486/) Use library.java.kafka_clients once >=3.1.0 is set as default
+configurations.runtimeClasspath {
+  // Pin kafka-clients version due to <3.1.0 missing auth callback classes
+  resolutionStrategy.force 'org.apache.kafka:kafka-clients:3.1.2'
+}
+
 shadowJar {
   mergeServiceFiles()
 }
@@ -52,8 +58,7 @@ dependencies {
   runtimeOnly ("org.apache.iceberg:iceberg-hive-metastore:1.4.2")
   runtimeOnly project(path: ":sdks:java:io:iceberg:hive:exec", configuration: "shadow")
 
-  // TODO(https://github.com/apache/beam/pull/32486/) Use library.java.kafka_clients once 3.1.2 is set as default
-  runtimeOnly ("org.apache.kafka:kafka-clients:3.1.2")
+  runtimeOnly library.java.kafka_clients
   runtimeOnly library.java.slf4j_jdk14
 }