diff --git a/pom.xml b/pom.xml
index a35307149d94..044a8c927883 100644
--- a/pom.xml
+++ b/pom.xml
@@ -990,10 +990,12 @@
       -Dorg.apache.hbase.thirdparty.io.netty.leakDetection.level=advanced
       -Dio.opentelemetry.context.enableStrictContext=true</hbase-surefire.cygwin-argLine>
     <!--
-      Keep these options in sync with add_jdk17_jvm_flags() in bin/hbase.
-      Currently, all of these options are known to be required by HBase, and not the test cases
-      java.base/jdk.internal.util.random=ALL-UNNAMED is required by the test code, so we do not
-      need this in bin/hbase
+      Keep these options in sync with add_jdk17_jvm_flags() in bin/hbase, except the below ones
+      which are only used in test code
+      'java.base/jdk.internal.util.random' is required by the test code
+      'java.base/sun.security.x509' and 'java.base/sun.security.util' are required by
+      TestLdapHttpServer, see HBASE-28341
+      'java.base/java.net' is required by TestSecureIPC, see HBASE-28723
     -->
     <hbase-surefire.jdk17.flags>-Dorg.apache.hbase.thirdparty.io.netty.tryReflectionSetAccessible=true
       --add-modules jdk.unsupported
@@ -1011,7 +1013,8 @@
       --add-exports java.base/sun.net.util=ALL-UNNAMED
       --add-opens java.base/jdk.internal.util.random=ALL-UNNAMED
       --add-opens java.base/sun.security.x509=ALL-UNNAMED
-      --add-opens java.base/sun.security.util=ALL-UNNAMED</hbase-surefire.jdk17.flags>
+      --add-opens java.base/sun.security.util=ALL-UNNAMED
+      --add-opens java.base/java.net=ALL-UNNAMED</hbase-surefire.jdk17.flags>
     <!-- Surefire argLine defaults to Linux, cygwin argLine is used in the os.windows profile -->
     <argLine>${hbase-surefire.argLine} @{jacocoArgLine}</argLine>
     <extra.enforcer.version>1.5.1</extra.enforcer.version>