diff --git a/.baseline/checkstyle/checkstyle.xml b/.baseline/checkstyle/checkstyle.xml
index 2be3288d7..af0eb2640 100644
--- a/.baseline/checkstyle/checkstyle.xml
+++ b/.baseline/checkstyle/checkstyle.xml
@@ -81,14 +81,7 @@
         </module>
         <module name="AvoidStarImport"/> <!-- Java Style Guide: No wildcard imports -->
         <module name="AvoidStaticImport"> <!-- Java Style Guide: No static imports -->
-            <property name="excludes" value="
-                com.google.common.base.Preconditions.*,
-                com.palantir.logsafe.Preconditions.*,
-                java.util.Collections.*,
-                java.util.stream.Collectors.*,
-                org.apache.commons.lang3.Validate.*,
-                org.assertj.core.api.Assertions.*,
-                org.mockito.Mockito.*"/>
+            <property name="excludes" value="com.google.common.base.Preconditions.*, com.palantir.logsafe.Preconditions.*, java.util.Collections.*, java.util.stream.Collectors.*, org.apache.commons.lang3.Validate.*, org.assertj.core.api.Assertions.*, org.mockito.Mockito.*"/>
         </module>
         <module name="ClassTypeParameterName"> <!-- Java Style Guide: Type variable names -->
             <property name="format" value="(^[A-Z][0-9]?)$|([A-Z][a-zA-Z0-9]*[T]$)"/>
@@ -138,12 +131,12 @@
         <module name="IllegalImport"> <!-- Java Coding Guidelines: Import the canonical package -->
             <property name="id" value="BanShadedClasses"/>
             <property name="illegalPkgs" value=".*\.(repackaged|shaded|thirdparty)"/>
-            <property name="regexp" value="true" />
+            <property name="regexp" value="true"/>
             <message key="import.illegal" value="Must not import repackaged classes."/>
         </module>
         <module name="IllegalImport">
             <property name="illegalPkgs" value="^org\.gradle\.(internal|.*\.internal)"/>
-            <property name="regexp" value="true" />
+            <property name="regexp" value="true"/>
             <message key="import.illegal" value="Do not rely on gradle internal classes as these may change in minor releases - use org.gradle.api versions instead."/>
         </module>
         <module name="IllegalImport">
@@ -358,7 +351,7 @@
         </module>
         <module name="RegexpSinglelineJava">
             <property name="format" value="\bCharset.defaultCharset\("/>
-            <property name="message" value="Use explicit charset (e.g. StandardCharsets.UTF-8) instead of default."/>
+            <property name="message" value="Use explicit charset (e.g. StandardCharsets.UTF_8) instead of default."/>
         </module>
         <module name="RegexpSinglelineJava">
             <property name="format" value="\bIOUtils\.toString\("/>
@@ -397,7 +390,7 @@
         <module name="SuppressWarnings">
             <property name="format" value="serial"/>
         </module>
-        <module name="SuppressWarningsHolder" />  <!-- Required for SuppressWarningsFilter -->
+        <module name="SuppressWarningsHolder"/>  <!-- Required for SuppressWarningsFilter -->
         <module name="TypeName"> <!-- Java Style Guide: Class names -->
             <message key="name.invalidPattern" value="Type name ''{0}'' must match pattern ''{1}''."/>
         </module>
diff --git a/.baseline/idea/intellij-java-palantir-style.xml b/.baseline/idea/intellij-java-palantir-style.xml
index 945d8bad0..f41e2b8aa 100644
--- a/.baseline/idea/intellij-java-palantir-style.xml
+++ b/.baseline/idea/intellij-java-palantir-style.xml
@@ -44,6 +44,18 @@
               <package name="" withSubpackages="true" static="false" />
             </value>
           </option>
+          <DO_NOT_IMPORT_INNER>
+            <CLASS name="Builder" />
+            <CLASS name="Callback" />
+            <CLASS name="Class" />
+            <CLASS name="Entry" />
+            <CLASS name="Enum" />
+            <CLASS name="Factory" />
+            <CLASS name="Type" />
+            <CLASS name="Key" />
+            <CLASS name="Id" />
+            <CLASS name="Provider" />
+          </DO_NOT_IMPORT_INNER>
         </GroovyCodeStyleSettings>
         <option name="JD_ALIGN_EXCEPTION_COMMENTS" value="false" />
         <option name="JD_ALIGN_PARAM_COMMENTS" value="false" />
diff --git a/build.gradle b/build.gradle
index 3069f9033..ded108cc3 100644
--- a/build.gradle
+++ b/build.gradle
@@ -9,7 +9,7 @@ buildscript {
         classpath 'com.github.jengelman.gradle.plugins:shadow:6.1.0'
         classpath 'com.jfrog.bintray.gradle:gradle-bintray-plugin:1.8.5'
         classpath 'com.netflix.nebula:nebula-publishing-plugin:17.3.2'
-        classpath 'com.palantir.baseline:gradle-baseline-java:3.43.0'
+        classpath 'com.palantir.baseline:gradle-baseline-java:3.74.0'
         classpath 'com.palantir.gradle.consistentversions:gradle-consistent-versions:1.28.0'
     }
 }
diff --git a/crypto-keys/src/main/java/com/palantir/crypto2/keys/ChainedKeyStorageStrategy.java b/crypto-keys/src/main/java/com/palantir/crypto2/keys/ChainedKeyStorageStrategy.java
index 5a78dd115..70a794743 100644
--- a/crypto-keys/src/main/java/com/palantir/crypto2/keys/ChainedKeyStorageStrategy.java
+++ b/crypto-keys/src/main/java/com/palantir/crypto2/keys/ChainedKeyStorageStrategy.java
@@ -32,7 +32,7 @@
  */
 public final class ChainedKeyStorageStrategy implements KeyStorageStrategy {
 
-    private static final Logger logger = LoggerFactory.getLogger(ChainedKeyStorageStrategy.class);
+    private static final Logger log = LoggerFactory.getLogger(ChainedKeyStorageStrategy.class);
 
     private final List<KeyStorageStrategy> strategies;
 
@@ -60,7 +60,10 @@ public KeyMaterial get(String fileKey) {
                 return strategy.get(fileKey);
             } catch (Exception e) {
                 suppressedExceptions.add(e);
-                logger.info("Failed to get key material using {}", strategy.getClass().getCanonicalName(), e);
+                log.info(
+                        "Failed to get key material using {}",
+                        strategy.getClass().getCanonicalName(),
+                        e);
             }
         }
         RuntimeException toThrow = new RuntimeException(String.format(
diff --git a/hadoop-crypto/baseline-class-uniqueness.lock b/hadoop-crypto/baseline-class-uniqueness.lock
new file mode 100644
index 000000000..27e98d5e9
--- /dev/null
+++ b/hadoop-crypto/baseline-class-uniqueness.lock
@@ -0,0 +1,98 @@
+# Danger! Multiple jars contain identically named classes. This may cause different behaviour depending on classpath ordering.
+# Run ./gradlew checkClassUniqueness --write-locks to update this file
+
+## runtimeClasspath
+[commons-beanutils:commons-beanutils, commons-beanutils:commons-beanutils-core, commons-collections:commons-collections]
+  - org.apache.commons.collections.ArrayStack
+  - org.apache.commons.collections.Buffer
+  - org.apache.commons.collections.BufferUnderflowException
+  - org.apache.commons.collections.FastHashMap
+  - org.apache.commons.collections.FastHashMap$1
+  - org.apache.commons.collections.FastHashMap$CollectionView
+  - org.apache.commons.collections.FastHashMap$CollectionView$CollectionViewIterator
+  - org.apache.commons.collections.FastHashMap$EntrySet
+  - org.apache.commons.collections.FastHashMap$KeySet
+  - org.apache.commons.collections.FastHashMap$Values
+[commons-beanutils:commons-beanutils, commons-beanutils:commons-beanutils-core]
+  - org.apache.commons.beanutils.BasicDynaBean
+  - org.apache.commons.beanutils.BasicDynaClass
+  - org.apache.commons.beanutils.BeanAccessLanguageException
+  - org.apache.commons.beanutils.BeanUtils
+  - org.apache.commons.beanutils.BeanUtilsBean
+  - org.apache.commons.beanutils.BeanUtilsBean$1
+  - org.apache.commons.beanutils.ConstructorUtils
+  - org.apache.commons.beanutils.ContextClassLoaderLocal
+  - org.apache.commons.beanutils.ConversionException
+  - org.apache.commons.beanutils.ConvertUtils
+  - org.apache.commons.beanutils.ConvertUtilsBean
+  - org.apache.commons.beanutils.Converter
+  - org.apache.commons.beanutils.ConvertingWrapDynaBean
+  - org.apache.commons.beanutils.DynaBean
+  - org.apache.commons.beanutils.DynaClass
+  - org.apache.commons.beanutils.DynaProperty
+  - org.apache.commons.beanutils.JDBCDynaClass
+  - org.apache.commons.beanutils.LazyDynaBean
+  - org.apache.commons.beanutils.LazyDynaClass
+  - org.apache.commons.beanutils.LazyDynaMap
+  - org.apache.commons.beanutils.MappedPropertyDescriptor
+  - org.apache.commons.beanutils.MethodUtils
+  - org.apache.commons.beanutils.MethodUtils$MethodDescriptor
+  - org.apache.commons.beanutils.MutableDynaClass
+  - org.apache.commons.beanutils.NestedNullException
+  - org.apache.commons.beanutils.PropertyUtils
+  - org.apache.commons.beanutils.PropertyUtilsBean
+  - org.apache.commons.beanutils.ResultSetDynaClass
+  - org.apache.commons.beanutils.ResultSetIterator
+  - org.apache.commons.beanutils.RowSetDynaClass
+  - org.apache.commons.beanutils.WrapDynaBean
+  - org.apache.commons.beanutils.WrapDynaClass
+  - org.apache.commons.beanutils.converters.AbstractArrayConverter
+  - org.apache.commons.beanutils.converters.BigDecimalConverter
+  - org.apache.commons.beanutils.converters.BigIntegerConverter
+  - org.apache.commons.beanutils.converters.BooleanArrayConverter
+  - org.apache.commons.beanutils.converters.BooleanConverter
+  - org.apache.commons.beanutils.converters.ByteArrayConverter
+  - org.apache.commons.beanutils.converters.ByteConverter
+  - org.apache.commons.beanutils.converters.CharacterArrayConverter
+  - org.apache.commons.beanutils.converters.CharacterConverter
+  - org.apache.commons.beanutils.converters.ClassConverter
+  - org.apache.commons.beanutils.converters.DoubleArrayConverter
+  - org.apache.commons.beanutils.converters.DoubleConverter
+  - org.apache.commons.beanutils.converters.FileConverter
+  - org.apache.commons.beanutils.converters.FloatArrayConverter
+  - org.apache.commons.beanutils.converters.FloatConverter
+  - org.apache.commons.beanutils.converters.IntegerArrayConverter
+  - org.apache.commons.beanutils.converters.IntegerConverter
+  - org.apache.commons.beanutils.converters.LongArrayConverter
+  - org.apache.commons.beanutils.converters.LongConverter
+  - org.apache.commons.beanutils.converters.ShortArrayConverter
+  - org.apache.commons.beanutils.converters.ShortConverter
+  - org.apache.commons.beanutils.converters.SqlDateConverter
+  - org.apache.commons.beanutils.converters.SqlTimeConverter
+  - org.apache.commons.beanutils.converters.SqlTimestampConverter
+  - org.apache.commons.beanutils.converters.StringArrayConverter
+  - org.apache.commons.beanutils.converters.StringConverter
+  - org.apache.commons.beanutils.converters.URLConverter
+  - org.apache.commons.beanutils.locale.BaseLocaleConverter
+  - org.apache.commons.beanutils.locale.LocaleBeanUtils
+  - org.apache.commons.beanutils.locale.LocaleBeanUtils$Descriptor
+  - org.apache.commons.beanutils.locale.LocaleBeanUtilsBean
+  - org.apache.commons.beanutils.locale.LocaleBeanUtilsBean$1
+  - org.apache.commons.beanutils.locale.LocaleBeanUtilsBean$Descriptor
+  - org.apache.commons.beanutils.locale.LocaleConvertUtils
+  - org.apache.commons.beanutils.locale.LocaleConvertUtilsBean
+  - org.apache.commons.beanutils.locale.LocaleConverter
+  - org.apache.commons.beanutils.locale.converters.BigDecimalLocaleConverter
+  - org.apache.commons.beanutils.locale.converters.BigIntegerLocaleConverter
+  - org.apache.commons.beanutils.locale.converters.ByteLocaleConverter
+  - org.apache.commons.beanutils.locale.converters.DateLocaleConverter
+  - org.apache.commons.beanutils.locale.converters.DecimalLocaleConverter
+  - org.apache.commons.beanutils.locale.converters.DoubleLocaleConverter
+  - org.apache.commons.beanutils.locale.converters.FloatLocaleConverter
+  - org.apache.commons.beanutils.locale.converters.IntegerLocaleConverter
+  - org.apache.commons.beanutils.locale.converters.LongLocaleConverter
+  - org.apache.commons.beanutils.locale.converters.ShortLocaleConverter
+  - org.apache.commons.beanutils.locale.converters.SqlDateLocaleConverter
+  - org.apache.commons.beanutils.locale.converters.SqlTimeLocaleConverter
+  - org.apache.commons.beanutils.locale.converters.SqlTimestampLocaleConverter
+  - org.apache.commons.beanutils.locale.converters.StringLocaleConverter
diff --git a/hadoop-crypto/src/main/java/com/palantir/crypto2/hadoop/DelegatingFileSystem.java b/hadoop-crypto/src/main/java/com/palantir/crypto2/hadoop/DelegatingFileSystem.java
index fbebd2237..c0b6da48d 100644
--- a/hadoop-crypto/src/main/java/com/palantir/crypto2/hadoop/DelegatingFileSystem.java
+++ b/hadoop-crypto/src/main/java/com/palantir/crypto2/hadoop/DelegatingFileSystem.java
@@ -34,7 +34,7 @@
  */
 public abstract class DelegatingFileSystem extends FilterFileSystem {
 
-    public DelegatingFileSystem(FileSystem delegate) {
+    protected DelegatingFileSystem(FileSystem delegate) {
         super(delegate);
         try {
             super.initialize(delegate.getUri(), delegate.getConf());