diff --git a/build-logic/src/main/groovy/org.minidns.java-conventions.gradle b/build-logic/src/main/groovy/org.minidns.java-conventions.gradle
index 1eec20ac..0b6e7f07 100644
--- a/build-logic/src/main/groovy/org.minidns.java-conventions.gradle
+++ b/build-logic/src/main/groovy/org.minidns.java-conventions.gradle
@@ -151,7 +151,7 @@ jar {
 }
 
 checkstyle {
-	toolVersion = '8.27'
+	toolVersion = '10.18.2'
 
 	if (project in gplLicensedProjects) {
 		configProperties.checkstyleLicenseHeader = "${project.name}-gplv3-license-header"
diff --git a/minidns-async/src/main/java/org/minidns/source/async/AsyncNetworkDataSource.java b/minidns-async/src/main/java/org/minidns/source/async/AsyncNetworkDataSource.java
index f2beaa23..acec5234 100644
--- a/minidns-async/src/main/java/org/minidns/source/async/AsyncNetworkDataSource.java
+++ b/minidns-async/src/main/java/org/minidns/source/async/AsyncNetworkDataSource.java
@@ -138,7 +138,7 @@ void cancelled(AsyncDnsRequest asyncDnsRequest) {
         SELECTOR.wakeup();
     }
 
-    private static class Reactor implements Runnable {
+    private static final class Reactor implements Runnable {
         @Override
         public void run() {
             while (!Thread.interrupted()) {
diff --git a/minidns-client/src/main/java/org/minidns/source/DnsDataSource.java b/minidns-client/src/main/java/org/minidns/source/DnsDataSource.java
index cec6cf49..4a51e6b2 100644
--- a/minidns-client/src/main/java/org/minidns/source/DnsDataSource.java
+++ b/minidns-client/src/main/java/org/minidns/source/DnsDataSource.java
@@ -40,7 +40,7 @@ public interface DnsDataSource {
      */
     void setTimeout(int timeout);
 
-    public interface OnResponseCallback {
+    interface OnResponseCallback {
         void onResponse(DnsMessage request, DnsQueryResult result);
     }
 
diff --git a/minidns-core/src/main/java/org/minidns/dnslabel/DnsLabel.java b/minidns-core/src/main/java/org/minidns/dnslabel/DnsLabel.java
index 75f6f596..cba1f3eb 100644
--- a/minidns-core/src/main/java/org/minidns/dnslabel/DnsLabel.java
+++ b/minidns-core/src/main/java/org/minidns/dnslabel/DnsLabel.java
@@ -235,12 +235,14 @@ public static String toSafeRepesentation(String dnsLabel) {
     }
 
     private static boolean isLdhOrMaybeUnderscore(char c, boolean underscore) {
+            // CHECKSTYLE:OFF
             return (c >= 'a' && c <= 'z')
                     || (c >= 'A' && c <= 'Z')
                     || (c >= '0' && c <= '9')
                     || c == '-'
                     || (underscore && c == '_')
                     ;
+            // CHECKSTYLE:ON
     }
 
     private static boolean consistsOnlyOfLdhAndMaybeUnderscore(String string, boolean underscore) {
@@ -265,7 +267,7 @@ public static boolean consistsOnlyOfLettersDigitsHypenAndUnderscore(String strin
     public static class LabelToLongException extends IllegalArgumentException {
 
         /**
-         * 
+         *
          */
         private static final long serialVersionUID = 1L;
 
diff --git a/minidns-core/src/main/java/org/minidns/record/Record.java b/minidns-core/src/main/java/org/minidns/record/Record.java
index 98e35920..0e6317c5 100644
--- a/minidns-core/src/main/java/org/minidns/record/Record.java
+++ b/minidns-core/src/main/java/org/minidns/record/Record.java
@@ -484,8 +484,8 @@ public String toString() {
      * @return True if this record is a valid answer.
      */
     public boolean isAnswer(Question q) {
-        return ((q.type == type) || (q.type == TYPE.ANY)) &&
-               ((q.clazz == clazz) || (q.clazz == CLASS.ANY)) &&
+        return (q.type == type || q.type == TYPE.ANY) &&
+               (q.clazz == clazz || q.clazz == CLASS.ANY) &&
                q.name.equals(name);
     }
 
diff --git a/minidns-dnssec/src/main/java/org/minidns/dnssec/DnssecClient.java b/minidns-dnssec/src/main/java/org/minidns/dnssec/DnssecClient.java
index aaa8e9a8..b7e85869 100644
--- a/minidns-dnssec/src/main/java/org/minidns/dnssec/DnssecClient.java
+++ b/minidns-dnssec/src/main/java/org/minidns/dnssec/DnssecClient.java
@@ -271,7 +271,7 @@ private Set<DnssecUnverifiedReason> verifyNsec(DnsMessage dnsMessage) throws IOE
         return result;
     }
 
-    private static class VerifySignaturesResult {
+    private static final class VerifySignaturesResult {
         boolean sepSignatureRequired = false;
         boolean sepSignaturePresent = false;
         Set<DnssecUnverifiedReason> reasons = new HashSet<>();