diff --git a/src/java.base/share/classes/java/io/ObjectInputFilter.java b/src/java.base/share/classes/java/io/ObjectInputFilter.java
index 879820761c1..8ce95a9a3c2 100644
--- a/src/java.base/share/classes/java/io/ObjectInputFilter.java
+++ b/src/java.base/share/classes/java/io/ObjectInputFilter.java
@@ -25,6 +25,8 @@
 
 package java.io;
 
+import org.jspecify.annotations.Nullable;
+
 import jdk.internal.access.SharedSecrets;
 import jdk.internal.util.StaticProperty;
 
@@ -379,7 +381,7 @@ static ObjectInputFilter rejectFilter(Predicate<Class<?>> predicate, Status othe
      * @return an {@link ObjectInputFilter} that merges the status of the filter and another filter
      * @since 17
      */
-    static ObjectInputFilter merge(ObjectInputFilter filter, ObjectInputFilter anotherFilter) {
+    static ObjectInputFilter merge(ObjectInputFilter filter, @Nullable ObjectInputFilter anotherFilter) {
         Objects.requireNonNull(filter, "filter");
         return (anotherFilter == null) ? filter : new Config.MergeFilter(filter, anotherFilter);
     }
@@ -445,7 +447,7 @@ interface FilterInfo {
          *
          * @return class of an object being deserialized; may be null
          */
-        Class<?> serialClass();
+        @Nullable Class<?> serialClass();
 
         /**
          * The number of array elements when deserializing an array of the class.
@@ -717,7 +719,7 @@ private static void traceFilter(String msg, Object... args) {
          *      system property {@code jdk.serialFilter} or
          *      the security property {@code jdk.serialFilter} fails.
          */
-        public static ObjectInputFilter getSerialFilter() {
+        public static @Nullable ObjectInputFilter getSerialFilter() {
             if (invalidFilterMessage != null) {
                 throw new IllegalStateException(invalidFilterMessage);
             }