diff --git a/build.gradle.kts b/build.gradle.kts
index 0b6cea0..85ff274 100644
--- a/build.gradle.kts
+++ b/build.gradle.kts
@@ -83,6 +83,7 @@ subprojects {
 
         options.errorprone {
             check("NullAway", CheckSeverity.ERROR)
+            check("RequireExplicitNullMarking", CheckSeverity.ERROR)
             option("NullAway:AnnotatedPackages", "it.aboutbits.postgresql")
             option("NullAway:JSpecifyMode", "true")
         }
diff --git a/operator/src/main/java/it/aboutbits/postgresql/PostgreSQLInstanceReadinessCheck.java b/operator/src/main/java/it/aboutbits/postgresql/PostgreSQLInstanceReadinessCheck.java
index 3b86277..4db2e36 100644
--- a/operator/src/main/java/it/aboutbits/postgresql/PostgreSQLInstanceReadinessCheck.java
+++ b/operator/src/main/java/it/aboutbits/postgresql/PostgreSQLInstanceReadinessCheck.java
@@ -15,9 +15,9 @@
  * configured PostgreSQL instances. Each instance is probed with a lightweight
  * operation, and the aggregated status is exposed.
  */
-@NullMarked
 @Readiness
 @RequiredArgsConstructor
+@NullMarked
 public class PostgreSQLInstanceReadinessCheck implements HealthCheck {
     private final PostgreSQLContextFactory postgreSQLContextFactory;
 
diff --git a/operator/src/main/java/it/aboutbits/postgresql/core/BaseReconciler.java b/operator/src/main/java/it/aboutbits/postgresql/core/BaseReconciler.java
index 306b069..e5c2807 100644
--- a/operator/src/main/java/it/aboutbits/postgresql/core/BaseReconciler.java
+++ b/operator/src/main/java/it/aboutbits/postgresql/core/BaseReconciler.java
@@ -14,8 +14,8 @@
 import java.util.Optional;
 import java.util.concurrent.TimeUnit;
 
-@NullMarked
 @Slf4j
+@NullMarked
 public abstract class BaseReconciler<CR extends CustomResource<?, S> & Named, S extends CRStatus> {
     protected abstract S newStatus();
 
diff --git a/operator/src/main/java/it/aboutbits/postgresql/core/CRStatus.java b/operator/src/main/java/it/aboutbits/postgresql/core/CRStatus.java
index db7ac62..e476e43 100644
--- a/operator/src/main/java/it/aboutbits/postgresql/core/CRStatus.java
+++ b/operator/src/main/java/it/aboutbits/postgresql/core/CRStatus.java
@@ -15,16 +15,15 @@
  * <p>
  * This object captures the current state of a Custom Resource as observed by the reconciler.
  */
-@NullMarked
 @Getter
 @Setter
 @Accessors(chain = true)
+@NullMarked
 public class CRStatus {
     /**
      * The Custom Resource name (may differ from metadata.name).
      */
-    @Nullable
-    private String name = null;
+    private @Nullable String name = null;
 
     /**
      * Current lifecycle phase of the Bucket.
@@ -35,21 +34,18 @@ public class CRStatus {
     /**
      * Human-readable message providing details about the current state.
      */
-    @Nullable
-    private String message = null;
+    private @Nullable String message = null;
 
     /**
      * Last time the condition was probed/updated.
      */
-    @Nullable
-    private OffsetDateTime lastProbeTime = null;
+    private @Nullable OffsetDateTime lastProbeTime = null;
 
     /**
      * Last time the condition transitioned from one status to another.
      */
-    @Nullable
     @Setter(AccessLevel.NONE)
-    private OffsetDateTime lastPhaseTransitionTime = null;
+    private @Nullable OffsetDateTime lastPhaseTransitionTime = null;
 
     /**
      * Observed resource generation that the controller acted upon.
diff --git a/operator/src/main/java/it/aboutbits/postgresql/core/KubernetesService.java b/operator/src/main/java/it/aboutbits/postgresql/core/KubernetesService.java
index 203cdd5..a5763ba 100644
--- a/operator/src/main/java/it/aboutbits/postgresql/core/KubernetesService.java
+++ b/operator/src/main/java/it/aboutbits/postgresql/core/KubernetesService.java
@@ -8,8 +8,8 @@
 import java.nio.charset.Charset;
 import java.util.Base64;
 
-@NullMarked
 @Singleton
+@NullMarked
 public final class KubernetesService {
     public static final String SECRET_TYPE_BASIC_AUTH = "kubernetes.io/basic-auth";
     public static final String SECRET_DATA_BASIC_AUTH_USERNAME_KEY = "username";
diff --git a/operator/src/main/java/it/aboutbits/postgresql/core/PostgreSQLAuthenticationService.java b/operator/src/main/java/it/aboutbits/postgresql/core/PostgreSQLAuthenticationService.java
index 4f6c849..967ff2d 100644
--- a/operator/src/main/java/it/aboutbits/postgresql/core/PostgreSQLAuthenticationService.java
+++ b/operator/src/main/java/it/aboutbits/postgresql/core/PostgreSQLAuthenticationService.java
@@ -21,9 +21,9 @@
 
 import static it.aboutbits.postgresql.core.infrastructure.persistence.Tables.PG_AUTHID;
 
-@NullMarked
 @Slf4j
 @Singleton
+@NullMarked
 public final class PostgreSQLAuthenticationService {
     private static final String MD5 = "MD5";
     private static final String SHA_256 = "SHA-256";
diff --git a/operator/src/main/java/it/aboutbits/postgresql/core/PostgreSQLContextFactory.java b/operator/src/main/java/it/aboutbits/postgresql/core/PostgreSQLContextFactory.java
index 216a4fe..c2a2faa 100644
--- a/operator/src/main/java/it/aboutbits/postgresql/core/PostgreSQLContextFactory.java
+++ b/operator/src/main/java/it/aboutbits/postgresql/core/PostgreSQLContextFactory.java
@@ -11,9 +11,9 @@
 
 import java.util.Properties;
 
-@NullMarked
 @ApplicationScoped
 @RequiredArgsConstructor
+@NullMarked
 public class PostgreSQLContextFactory {
     private static final String POSTGRESQL_AUTHENTICATION_USER_KEY = "user";
     private static final String POSTGRESQL_AUTHENTICATION_PASSWORD_KEY = "password";
diff --git a/operator/src/main/java/it/aboutbits/postgresql/core/Privilege.java b/operator/src/main/java/it/aboutbits/postgresql/core/Privilege.java
index a0735b0..91c80ad 100644
--- a/operator/src/main/java/it/aboutbits/postgresql/core/Privilege.java
+++ b/operator/src/main/java/it/aboutbits/postgresql/core/Privilege.java
@@ -15,10 +15,10 @@
  * https://www.postgresql.org/docs/current/sql-grant.html
  * </a>
  */
-@NullMarked
 @Getter
 @Accessors(fluent = true)
 @RequiredArgsConstructor
+@NullMarked
 public enum Privilege {
     SELECT(null),
     INSERT(null),
@@ -33,8 +33,7 @@ public enum Privilege {
     USAGE(null),
     MAINTAIN(17);
 
-    @Nullable
-    private final Integer minimumPostgresVersion;
+    private final @Nullable Integer minimumPostgresVersion;
 
     @JsonValue
     public String toValue() {
diff --git a/operator/src/main/java/it/aboutbits/postgresql/core/ReclaimPolicy.java b/operator/src/main/java/it/aboutbits/postgresql/core/ReclaimPolicy.java
index 07edc92..3a3662b 100644
--- a/operator/src/main/java/it/aboutbits/postgresql/core/ReclaimPolicy.java
+++ b/operator/src/main/java/it/aboutbits/postgresql/core/ReclaimPolicy.java
@@ -4,8 +4,8 @@
 import lombok.RequiredArgsConstructor;
 import org.jspecify.annotations.NullMarked;
 
-@NullMarked
 @RequiredArgsConstructor
+@NullMarked
 public enum ReclaimPolicy {
     RETAIN("Retain"),
     DELETE("Delete");
diff --git a/operator/src/main/java/it/aboutbits/postgresql/core/ResourceRef.java b/operator/src/main/java/it/aboutbits/postgresql/core/ResourceRef.java
index 549380e..1286782 100644
--- a/operator/src/main/java/it/aboutbits/postgresql/core/ResourceRef.java
+++ b/operator/src/main/java/it/aboutbits/postgresql/core/ResourceRef.java
@@ -26,17 +26,16 @@
 /// |-------------------|-----------------------------------------------------|
 /// | non-null          | the explicit namespace                              |
 /// | `null` (omitted)  | the namespace of the CR that owns this reference    |
-@NullMarked
 @Getter
 @Setter
 @SchemaCustomizer(KubernetesNameCustomizer.class)
+@NullMarked
 public class ResourceRef {
     /// The namespace of the referenced Kubernetes resource.
     /// If `null`, defaults to the namespace of the CR that defines this reference.
-    @Nullable
-    @Max(63)
     @io.fabric8.generator.annotation.Nullable
-    private String namespace;
+    @Max(63)
+    private @Nullable String namespace;
 
     @Required
     @Max(63)
diff --git a/operator/src/main/java/it/aboutbits/postgresql/crd/clusterconnection/ClusterConnection.java b/operator/src/main/java/it/aboutbits/postgresql/crd/clusterconnection/ClusterConnection.java
index f7d820b..9607119 100644
--- a/operator/src/main/java/it/aboutbits/postgresql/crd/clusterconnection/ClusterConnection.java
+++ b/operator/src/main/java/it/aboutbits/postgresql/crd/clusterconnection/ClusterConnection.java
@@ -14,7 +14,6 @@
 import java.nio.charset.StandardCharsets;
 import java.util.StringJoiner;
 
-@NullMarked
 @Version("v1")
 @Group("postgresql.aboutbits.it")
 @AdditionalPrinterColumn(
@@ -42,6 +41,7 @@
         jsonPath = ".metadata.creationTimestamp",
         type = AdditionalPrinterColumn.Type.DATE
 )
+@NullMarked
 public class ClusterConnection
         extends CustomResource<ClusterConnectionSpec, CRStatus>
         implements Namespaced, Named {
diff --git a/operator/src/main/java/it/aboutbits/postgresql/crd/clusterconnection/ClusterConnectionReconciler.java b/operator/src/main/java/it/aboutbits/postgresql/crd/clusterconnection/ClusterConnectionReconciler.java
index a5aca3a..fa6009e 100644
--- a/operator/src/main/java/it/aboutbits/postgresql/crd/clusterconnection/ClusterConnectionReconciler.java
+++ b/operator/src/main/java/it/aboutbits/postgresql/crd/clusterconnection/ClusterConnectionReconciler.java
@@ -11,9 +11,9 @@
 import lombok.extern.slf4j.Slf4j;
 import org.jspecify.annotations.NullMarked;
 
-@NullMarked
 @Slf4j
 @RequiredArgsConstructor
+@NullMarked
 public class ClusterConnectionReconciler
         extends BaseReconciler<ClusterConnection, CRStatus>
         implements Reconciler<ClusterConnection> {
diff --git a/operator/src/main/java/it/aboutbits/postgresql/crd/clusterconnection/ClusterConnectionSpec.java b/operator/src/main/java/it/aboutbits/postgresql/crd/clusterconnection/ClusterConnectionSpec.java
index 0fe7123..41d7914 100644
--- a/operator/src/main/java/it/aboutbits/postgresql/crd/clusterconnection/ClusterConnectionSpec.java
+++ b/operator/src/main/java/it/aboutbits/postgresql/crd/clusterconnection/ClusterConnectionSpec.java
@@ -14,10 +14,10 @@
 import java.util.HashMap;
 import java.util.Map;
 
-@NullMarked
 @Getter
 @Setter
 @SchemaCustomizer(value = HostCustomizer.class, input = "host")
+@NullMarked
 public class ClusterConnectionSpec {
     @Required
     @ValidationRule(
diff --git a/operator/src/main/java/it/aboutbits/postgresql/crd/database/Database.java b/operator/src/main/java/it/aboutbits/postgresql/crd/database/Database.java
index c652060..c3123df 100644
--- a/operator/src/main/java/it/aboutbits/postgresql/crd/database/Database.java
+++ b/operator/src/main/java/it/aboutbits/postgresql/crd/database/Database.java
@@ -9,7 +9,6 @@
 import it.aboutbits.postgresql.core.Named;
 import org.jspecify.annotations.NullMarked;
 
-@NullMarked
 @Version("v1")
 @Group("postgresql.aboutbits.it")
 @AdditionalPrinterColumn(
@@ -37,6 +36,7 @@
         jsonPath = ".metadata.creationTimestamp",
         type = AdditionalPrinterColumn.Type.DATE
 )
+@NullMarked
 public class Database
         extends CustomResource<DatabaseSpec, CRStatus>
         implements Namespaced, Named {
diff --git a/operator/src/main/java/it/aboutbits/postgresql/crd/database/DatabaseReconciler.java b/operator/src/main/java/it/aboutbits/postgresql/crd/database/DatabaseReconciler.java
index 111af70..db3cee1 100644
--- a/operator/src/main/java/it/aboutbits/postgresql/crd/database/DatabaseReconciler.java
+++ b/operator/src/main/java/it/aboutbits/postgresql/crd/database/DatabaseReconciler.java
@@ -19,9 +19,9 @@
 import java.util.Objects;
 import java.util.concurrent.TimeUnit;
 
-@NullMarked
 @Slf4j
 @RequiredArgsConstructor
+@NullMarked
 public class DatabaseReconciler
         extends BaseReconciler<Database, CRStatus>
         implements Reconciler<Database>, Cleaner<Database> {
diff --git a/operator/src/main/java/it/aboutbits/postgresql/crd/database/DatabaseService.java b/operator/src/main/java/it/aboutbits/postgresql/crd/database/DatabaseService.java
index 975c8f2..bbec077 100644
--- a/operator/src/main/java/it/aboutbits/postgresql/crd/database/DatabaseService.java
+++ b/operator/src/main/java/it/aboutbits/postgresql/crd/database/DatabaseService.java
@@ -11,8 +11,8 @@
 import static org.jooq.impl.DSL.role;
 import static org.jooq.impl.DSL.selectOne;
 
-@NullMarked
 @Singleton
+@NullMarked
 public class DatabaseService {
     public boolean databaseExists(
             DSLContext dsl,
diff --git a/operator/src/main/java/it/aboutbits/postgresql/crd/database/DatabaseSpec.java b/operator/src/main/java/it/aboutbits/postgresql/crd/database/DatabaseSpec.java
index 168d1c7..0683fae 100644
--- a/operator/src/main/java/it/aboutbits/postgresql/crd/database/DatabaseSpec.java
+++ b/operator/src/main/java/it/aboutbits/postgresql/crd/database/DatabaseSpec.java
@@ -9,9 +9,9 @@
 import org.jspecify.annotations.NullMarked;
 import org.jspecify.annotations.Nullable;
 
-@NullMarked
 @Getter
 @Setter
+@NullMarked
 public class DatabaseSpec {
     @Required
     private ResourceRef clusterRef = new ResourceRef();
@@ -33,7 +33,6 @@ public class DatabaseSpec {
 
     /// The owner of the database.
     /// If not specified, the database will be owned by the logged-in admin user specified in the clusterRef -> ClusterConnection#adminSecretRef CR instance.
-    @Nullable
     @io.fabric8.generator.annotation.Nullable
-    private String owner = null;
+    private @Nullable String owner = null;
 }
diff --git a/operator/src/main/java/it/aboutbits/postgresql/crd/defaultprivilege/DefaultPrivilege.java b/operator/src/main/java/it/aboutbits/postgresql/crd/defaultprivilege/DefaultPrivilege.java
index 016747f..2df81a1 100644
--- a/operator/src/main/java/it/aboutbits/postgresql/crd/defaultprivilege/DefaultPrivilege.java
+++ b/operator/src/main/java/it/aboutbits/postgresql/crd/defaultprivilege/DefaultPrivilege.java
@@ -10,7 +10,6 @@
 import it.aboutbits.postgresql.core.Named;
 import org.jspecify.annotations.NullMarked;
 
-@NullMarked
 @Version("v1")
 @Group("postgresql.aboutbits.it")
 @AdditionalPrinterColumn(
@@ -38,6 +37,7 @@
         jsonPath = ".metadata.creationTimestamp",
         type = AdditionalPrinterColumn.Type.DATE
 )
+@NullMarked
 public class DefaultPrivilege
         extends CustomResource<DefaultPrivilegeSpec, CRStatus>
         implements Namespaced, Named {
diff --git a/operator/src/main/java/it/aboutbits/postgresql/crd/defaultprivilege/DefaultPrivilegeObjectType.java b/operator/src/main/java/it/aboutbits/postgresql/crd/defaultprivilege/DefaultPrivilegeObjectType.java
index f444d73..d3834dd 100644
--- a/operator/src/main/java/it/aboutbits/postgresql/crd/defaultprivilege/DefaultPrivilegeObjectType.java
+++ b/operator/src/main/java/it/aboutbits/postgresql/crd/defaultprivilege/DefaultPrivilegeObjectType.java
@@ -28,9 +28,9 @@
  * https://www.postgresql.org/docs/current/sql-alterdefaultprivileges.html
  * </a>
  */
-@NullMarked
 @Getter
 @Accessors(fluent = true)
+@NullMarked
 public enum DefaultPrivilegeObjectType {
     SCHEMA(
             "n",
diff --git a/operator/src/main/java/it/aboutbits/postgresql/crd/defaultprivilege/DefaultPrivilegeReconciler.java b/operator/src/main/java/it/aboutbits/postgresql/crd/defaultprivilege/DefaultPrivilegeReconciler.java
index 038c131..16dd501 100644
--- a/operator/src/main/java/it/aboutbits/postgresql/crd/defaultprivilege/DefaultPrivilegeReconciler.java
+++ b/operator/src/main/java/it/aboutbits/postgresql/crd/defaultprivilege/DefaultPrivilegeReconciler.java
@@ -22,9 +22,9 @@
 import java.util.function.Function;
 import java.util.stream.Collectors;
 
-@NullMarked
 @Slf4j
 @RequiredArgsConstructor
+@NullMarked
 public class DefaultPrivilegeReconciler
         extends BaseReconciler<DefaultPrivilege, CRStatus>
         implements Reconciler<DefaultPrivilege>, Cleaner<DefaultPrivilege> {
diff --git a/operator/src/main/java/it/aboutbits/postgresql/crd/defaultprivilege/DefaultPrivilegeService.java b/operator/src/main/java/it/aboutbits/postgresql/crd/defaultprivilege/DefaultPrivilegeService.java
index 990dc87..da6d621 100644
--- a/operator/src/main/java/it/aboutbits/postgresql/crd/defaultprivilege/DefaultPrivilegeService.java
+++ b/operator/src/main/java/it/aboutbits/postgresql/crd/defaultprivilege/DefaultPrivilegeService.java
@@ -22,8 +22,8 @@
 import static org.jooq.impl.DSL.sql;
 import static org.jooq.impl.DSL.val;
 
-@NullMarked
 @Singleton
+@NullMarked
 public class DefaultPrivilegeService {
     private static final DataType<Long> OID_DATA_TYPE = SQLDataType.BIGINT;
 
diff --git a/operator/src/main/java/it/aboutbits/postgresql/crd/defaultprivilege/DefaultPrivilegeSpec.java b/operator/src/main/java/it/aboutbits/postgresql/crd/defaultprivilege/DefaultPrivilegeSpec.java
index a29afa0..2b02db3 100644
--- a/operator/src/main/java/it/aboutbits/postgresql/crd/defaultprivilege/DefaultPrivilegeSpec.java
+++ b/operator/src/main/java/it/aboutbits/postgresql/crd/defaultprivilege/DefaultPrivilegeSpec.java
@@ -14,13 +14,13 @@
 import java.util.ArrayList;
 import java.util.List;
 
-@NullMarked
 @Getter
 @Setter
 @ValidationRule(
         value = "self.objectType == 'schema' ? !has(self.schema) : (has(self.schema) && self.schema.trim().size() > 0)",
         message = "The DefaultPrivilege schema must be not set if objectType is 'schema', for all other objectType's it is required."
 )
+@NullMarked
 public class DefaultPrivilegeSpec {
     @Required
     private ResourceRef clusterRef = new ResourceRef();
@@ -62,7 +62,6 @@ public class DefaultPrivilegeSpec {
     private String owner = "";
 
     /// The database schema to grant default privileges on for this role
-    @Nullable
     @io.fabric8.generator.annotation.Nullable
     @JsonInclude(JsonInclude.Include.NON_NULL)
     @ValidationRule(
@@ -73,7 +72,7 @@ public class DefaultPrivilegeSpec {
             value = "self.trim().size() > 0",
             message = "The DefaultPrivilege schema must not be empty."
     )
-    private String schema = null;
+    private @Nullable String schema = null;
 
     /// The PostgreSQL object type to grant default privileges on.
     ///
diff --git a/operator/src/main/java/it/aboutbits/postgresql/crd/grant/Grant.java b/operator/src/main/java/it/aboutbits/postgresql/crd/grant/Grant.java
index 32e05e6..8d62f50 100644
--- a/operator/src/main/java/it/aboutbits/postgresql/crd/grant/Grant.java
+++ b/operator/src/main/java/it/aboutbits/postgresql/crd/grant/Grant.java
@@ -10,7 +10,6 @@
 import it.aboutbits.postgresql.core.Named;
 import org.jspecify.annotations.NullMarked;
 
-@NullMarked
 @Version("v1")
 @Group("postgresql.aboutbits.it")
 @AdditionalPrinterColumn(
@@ -38,6 +37,7 @@
         jsonPath = ".metadata.creationTimestamp",
         type = AdditionalPrinterColumn.Type.DATE
 )
+@NullMarked
 public class Grant
         extends CustomResource<GrantSpec, CRStatus>
         implements Namespaced, Named {
diff --git a/operator/src/main/java/it/aboutbits/postgresql/crd/grant/GrantObjectType.java b/operator/src/main/java/it/aboutbits/postgresql/crd/grant/GrantObjectType.java
index 05e1296..559c531 100644
--- a/operator/src/main/java/it/aboutbits/postgresql/crd/grant/GrantObjectType.java
+++ b/operator/src/main/java/it/aboutbits/postgresql/crd/grant/GrantObjectType.java
@@ -30,9 +30,9 @@
  * https://www.postgresql.org/docs/current/sql-grant.html
  * </a>
  */
-@NullMarked
 @Getter
 @Accessors(fluent = true)
+@NullMarked
 public enum GrantObjectType {
     DATABASE(
             List.of(
diff --git a/operator/src/main/java/it/aboutbits/postgresql/crd/grant/GrantReconciler.java b/operator/src/main/java/it/aboutbits/postgresql/crd/grant/GrantReconciler.java
index 4739683..ead867b 100644
--- a/operator/src/main/java/it/aboutbits/postgresql/crd/grant/GrantReconciler.java
+++ b/operator/src/main/java/it/aboutbits/postgresql/crd/grant/GrantReconciler.java
@@ -27,9 +27,9 @@
 
 import static org.jooq.impl.DSL.quotedName;
 
-@NullMarked
 @Slf4j
 @RequiredArgsConstructor
+@NullMarked
 public class GrantReconciler
         extends BaseReconciler<Grant, CRStatus>
         implements Reconciler<Grant>, Cleaner<Grant> {
diff --git a/operator/src/main/java/it/aboutbits/postgresql/crd/grant/GrantService.java b/operator/src/main/java/it/aboutbits/postgresql/crd/grant/GrantService.java
index b80b749..c411175 100644
--- a/operator/src/main/java/it/aboutbits/postgresql/crd/grant/GrantService.java
+++ b/operator/src/main/java/it/aboutbits/postgresql/crd/grant/GrantService.java
@@ -30,8 +30,8 @@
 import static org.jooq.impl.DSL.role;
 import static org.jooq.impl.DSL.val;
 
-@NullMarked
 @Singleton
+@NullMarked
 public class GrantService {
     private static final DataType<Long> OID_DATA_TYPE = SQLDataType.BIGINT;
 
diff --git a/operator/src/main/java/it/aboutbits/postgresql/crd/grant/GrantSpec.java b/operator/src/main/java/it/aboutbits/postgresql/crd/grant/GrantSpec.java
index 09b3568..27348aa 100644
--- a/operator/src/main/java/it/aboutbits/postgresql/crd/grant/GrantSpec.java
+++ b/operator/src/main/java/it/aboutbits/postgresql/crd/grant/GrantSpec.java
@@ -14,7 +14,6 @@
 import java.util.ArrayList;
 import java.util.List;
 
-@NullMarked
 @Getter
 @Setter
 @ValidationRule(
@@ -25,6 +24,7 @@
         value = "self.objectType in ['database', 'schema'] ? !has(self.objects) : has(self.objects)",
         message = "The Grant objects must be not set if objectType is 'database' or 'schema', for all other objectType's a list is required."
 )
+@NullMarked
 public class GrantSpec {
     @Required
     private ResourceRef clusterRef = new ResourceRef();
@@ -54,7 +54,6 @@ public class GrantSpec {
     private String role = "";
 
     /// The database schema to grant privileges on for this role (required except if objectType is "database")
-    @Nullable
     @io.fabric8.generator.annotation.Nullable
     @JsonInclude(JsonInclude.Include.NON_NULL)
     @ValidationRule(
@@ -65,7 +64,7 @@ public class GrantSpec {
             value = "self.trim().size() > 0",
             message = "The Grant schema must not be empty."
     )
-    private String schema = null;
+    private @Nullable String schema = null;
 
     /// The PostgreSQL object type to grant the privileges on.
     ///
@@ -85,10 +84,9 @@ public class GrantSpec {
     /// The PostgreSQL objects to grant privileges on.
     /// As these are quoted, case-sensitivity is very important.
     /// In PostgreSQL leave everything as lower-case except you have a special case.
-    @Nullable
     @io.fabric8.generator.annotation.Nullable
     @JsonInclude(JsonInclude.Include.NON_NULL)
-    private List<String> objects = null;
+    private @Nullable List<String> objects = null;
 
     /// The privileges to grant on the PostgreSQL objects.
     /// The Operator also validates if the objectType supports the privileges.
diff --git a/operator/src/main/java/it/aboutbits/postgresql/crd/role/Role.java b/operator/src/main/java/it/aboutbits/postgresql/crd/role/Role.java
index c56df40..121d06d 100644
--- a/operator/src/main/java/it/aboutbits/postgresql/crd/role/Role.java
+++ b/operator/src/main/java/it/aboutbits/postgresql/crd/role/Role.java
@@ -10,7 +10,6 @@
 import it.aboutbits.postgresql.core.Named;
 import org.jspecify.annotations.NullMarked;
 
-@NullMarked
 @Version("v1")
 @Group("postgresql.aboutbits.it")
 @AdditionalPrinterColumn(
@@ -38,6 +37,7 @@
         jsonPath = ".metadata.creationTimestamp",
         type = AdditionalPrinterColumn.Type.DATE
 )
+@NullMarked
 public class Role
         extends CustomResource<RoleSpec, CRStatus>
         implements Namespaced, Named {
diff --git a/operator/src/main/java/it/aboutbits/postgresql/crd/role/RoleFlag.java b/operator/src/main/java/it/aboutbits/postgresql/crd/role/RoleFlag.java
index 1731ed2..771fb58 100644
--- a/operator/src/main/java/it/aboutbits/postgresql/crd/role/RoleFlag.java
+++ b/operator/src/main/java/it/aboutbits/postgresql/crd/role/RoleFlag.java
@@ -5,10 +5,10 @@
 import lombok.experimental.Accessors;
 import org.jspecify.annotations.NullMarked;
 
-@NullMarked
 @Getter
 @Accessors(fluent = true)
 @RequiredArgsConstructor
+@NullMarked
 public enum RoleFlag {
     SUPERUSER("SUPERUSER"),
     NO_SUPERUSER("NOSUPERUSER"),
diff --git a/operator/src/main/java/it/aboutbits/postgresql/crd/role/RoleReconciler.java b/operator/src/main/java/it/aboutbits/postgresql/crd/role/RoleReconciler.java
index 6ac0d10..8e98b77 100644
--- a/operator/src/main/java/it/aboutbits/postgresql/crd/role/RoleReconciler.java
+++ b/operator/src/main/java/it/aboutbits/postgresql/crd/role/RoleReconciler.java
@@ -32,7 +32,6 @@
 import java.util.concurrent.TimeUnit;
 import java.util.stream.Collectors;
 
-@NullMarked
 @Slf4j
 @AdditionalRBACRules({
         @RBACRule(
@@ -42,6 +41,7 @@
         )
 })
 @RequiredArgsConstructor
+@NullMarked
 public class RoleReconciler
         extends BaseReconciler<Role, CRStatus>
         implements Reconciler<Role>, Cleaner<Role> {
diff --git a/operator/src/main/java/it/aboutbits/postgresql/crd/role/RoleService.java b/operator/src/main/java/it/aboutbits/postgresql/crd/role/RoleService.java
index 3565434..daa3c2f 100644
--- a/operator/src/main/java/it/aboutbits/postgresql/crd/role/RoleService.java
+++ b/operator/src/main/java/it/aboutbits/postgresql/crd/role/RoleService.java
@@ -27,8 +27,8 @@
 import static org.jooq.impl.DSL.sql;
 import static org.jooq.impl.DSL.val;
 
-@NullMarked
 @Singleton
+@NullMarked
 public final class RoleService {
     public boolean roleExists(
             DSLContext tx,
diff --git a/operator/src/main/java/it/aboutbits/postgresql/crd/role/RoleSpec.java b/operator/src/main/java/it/aboutbits/postgresql/crd/role/RoleSpec.java
index 55775db..e794a09 100644
--- a/operator/src/main/java/it/aboutbits/postgresql/crd/role/RoleSpec.java
+++ b/operator/src/main/java/it/aboutbits/postgresql/crd/role/RoleSpec.java
@@ -13,9 +13,9 @@
 import java.util.ArrayList;
 import java.util.List;
 
-@NullMarked
 @Getter
 @Setter
+@NullMarked
 public class RoleSpec {
     @Required
     private ResourceRef clusterRef = new ResourceRef();
@@ -31,13 +31,11 @@ public class RoleSpec {
     )
     private String name = "";
 
-    @Nullable
     @io.fabric8.generator.annotation.Nullable
-    private String comment;
+    private @Nullable String comment;
 
-    @Nullable
     @io.fabric8.generator.annotation.Nullable
-    private ResourceRef passwordSecretRef;
+    private @Nullable ResourceRef passwordSecretRef;
 
     @io.fabric8.generator.annotation.Nullable
     private Flags flags = new Flags();
@@ -69,9 +67,8 @@ public static class Flags {
         @io.fabric8.generator.annotation.Nullable
         private int connectionLimit = -1;
 
-        @Nullable
         @io.fabric8.generator.annotation.Nullable
-        private OffsetDateTime validUntil = null;
+        private @Nullable OffsetDateTime validUntil = null;
 
         @io.fabric8.generator.annotation.Nullable
         private List<String> inRole = new ArrayList<>();
diff --git a/operator/src/main/java/it/aboutbits/postgresql/crd/schema/Schema.java b/operator/src/main/java/it/aboutbits/postgresql/crd/schema/Schema.java
index 233254a..8358018 100644
--- a/operator/src/main/java/it/aboutbits/postgresql/crd/schema/Schema.java
+++ b/operator/src/main/java/it/aboutbits/postgresql/crd/schema/Schema.java
@@ -9,7 +9,6 @@
 import it.aboutbits.postgresql.core.Named;
 import org.jspecify.annotations.NullMarked;
 
-@NullMarked
 @Version("v1")
 @Group("postgresql.aboutbits.it")
 @AdditionalPrinterColumn(
@@ -37,6 +36,7 @@
         jsonPath = ".metadata.creationTimestamp",
         type = AdditionalPrinterColumn.Type.DATE
 )
+@NullMarked
 public class Schema
         extends CustomResource<SchemaSpec, CRStatus>
         implements Namespaced, Named {
diff --git a/operator/src/main/java/it/aboutbits/postgresql/crd/schema/SchemaReconciler.java b/operator/src/main/java/it/aboutbits/postgresql/crd/schema/SchemaReconciler.java
index b05f6d9..4ceaa57 100644
--- a/operator/src/main/java/it/aboutbits/postgresql/crd/schema/SchemaReconciler.java
+++ b/operator/src/main/java/it/aboutbits/postgresql/crd/schema/SchemaReconciler.java
@@ -19,9 +19,9 @@
 import java.util.Objects;
 import java.util.concurrent.TimeUnit;
 
-@NullMarked
 @Slf4j
 @RequiredArgsConstructor
+@NullMarked
 public class SchemaReconciler
         extends BaseReconciler<Schema, CRStatus>
         implements Reconciler<Schema>, Cleaner<Schema> {
diff --git a/operator/src/main/java/it/aboutbits/postgresql/crd/schema/SchemaService.java b/operator/src/main/java/it/aboutbits/postgresql/crd/schema/SchemaService.java
index faf89d8..92263f7 100644
--- a/operator/src/main/java/it/aboutbits/postgresql/crd/schema/SchemaService.java
+++ b/operator/src/main/java/it/aboutbits/postgresql/crd/schema/SchemaService.java
@@ -11,8 +11,8 @@
 import static org.jooq.impl.DSL.role;
 import static org.jooq.impl.DSL.selectOne;
 
-@NullMarked
 @Singleton
+@NullMarked
 public class SchemaService {
     public boolean schemaExists(
             DSLContext tx,
diff --git a/operator/src/main/java/it/aboutbits/postgresql/crd/schema/SchemaSpec.java b/operator/src/main/java/it/aboutbits/postgresql/crd/schema/SchemaSpec.java
index 6843400..dfaa1f8 100644
--- a/operator/src/main/java/it/aboutbits/postgresql/crd/schema/SchemaSpec.java
+++ b/operator/src/main/java/it/aboutbits/postgresql/crd/schema/SchemaSpec.java
@@ -9,9 +9,9 @@
 import org.jspecify.annotations.NullMarked;
 import org.jspecify.annotations.Nullable;
 
-@NullMarked
 @Getter
 @Setter
+@NullMarked
 public class SchemaSpec {
     @Required
     private ResourceRef clusterRef = new ResourceRef();
@@ -44,7 +44,6 @@ public class SchemaSpec {
 
     /// The owner of the schema.
     /// If not specified, the schema will be owned by the logged-in admin user specified in the clusterRef -> ClusterConnection#adminSecretRef CR instance.
-    @Nullable
     @io.fabric8.generator.annotation.Nullable
-    private String owner = null;
+    private @Nullable String owner = null;
 }
diff --git a/operator/src/test/java/it/aboutbits/postgresql/PostgreSQLInstanceReadinessCheckTest.java b/operator/src/test/java/it/aboutbits/postgresql/PostgreSQLInstanceReadinessCheckTest.java
index d2b7464..d97d38e 100644
--- a/operator/src/test/java/it/aboutbits/postgresql/PostgreSQLInstanceReadinessCheckTest.java
+++ b/operator/src/test/java/it/aboutbits/postgresql/PostgreSQLInstanceReadinessCheckTest.java
@@ -16,8 +16,8 @@
 
 import static org.assertj.core.api.Assertions.assertThat;
 
-@NullMarked
 @QuarkusTest
+@NullMarked
 class PostgreSQLInstanceReadinessCheckTest {
     @Inject
     Given given;
diff --git a/operator/src/test/java/it/aboutbits/postgresql/_support/testdata/persisted/Given.java b/operator/src/test/java/it/aboutbits/postgresql/_support/testdata/persisted/Given.java
index 3f3ab98..298ee42 100644
--- a/operator/src/test/java/it/aboutbits/postgresql/_support/testdata/persisted/Given.java
+++ b/operator/src/test/java/it/aboutbits/postgresql/_support/testdata/persisted/Given.java
@@ -16,9 +16,9 @@
 
 import java.net.URI;
 
-@NullMarked
 @ApplicationScoped
 @RequiredArgsConstructor
+@NullMarked
 public class Given {
     private final KubernetesClient kubernetesClient;
 
diff --git a/operator/src/test/java/it/aboutbits/postgresql/_support/testdata/persisted/creator/ClusterConnectionCreate.java b/operator/src/test/java/it/aboutbits/postgresql/_support/testdata/persisted/creator/ClusterConnectionCreate.java
index d1f1699..fe2d70b 100644
--- a/operator/src/test/java/it/aboutbits/postgresql/_support/testdata/persisted/creator/ClusterConnectionCreate.java
+++ b/operator/src/test/java/it/aboutbits/postgresql/_support/testdata/persisted/creator/ClusterConnectionCreate.java
@@ -17,37 +17,31 @@
 import java.util.Objects;
 import java.util.concurrent.TimeUnit;
 
-@NullMarked
 @Setter
 @Accessors(fluent = true, chain = true)
+@NullMarked
 public class ClusterConnectionCreate extends TestDataCreator<ClusterConnection> {
     private final Given given;
 
     private final KubernetesClient kubernetesClient;
     private final Given.DBConnectionDetails dbConnectionDetails;
 
-    @Nullable
-    private String withNamespace;
+    private @Nullable String withNamespace;
+
     @Setter(AccessLevel.NONE)
     private boolean withoutNamespace = false;
 
-    @Nullable
-    private String withName;
+    private @Nullable String withName;
 
-    @Nullable
-    private String withHost;
+    private @Nullable String withHost;
 
-    @Nullable
-    private Integer withPort;
+    private @Nullable Integer withPort;
 
-    @Nullable
-    private String withDatabase;
+    private @Nullable String withDatabase;
 
-    @Nullable
-    private ResourceRef withAdminSecretRef;
+    private @Nullable ResourceRef withAdminSecretRef;
 
-    @Nullable
-    private String withApplicationName;
+    private @Nullable String withApplicationName;
 
     public ClusterConnectionCreate(
             int numberOfItems,
@@ -107,8 +101,7 @@ protected ClusterConnection create(int index) {
                 );
     }
 
-    @Nullable
-    private String getNamespace() {
+    private @Nullable String getNamespace() {
         if (withoutNamespace) {
             return null;
         }
diff --git a/operator/src/test/java/it/aboutbits/postgresql/_support/testdata/persisted/creator/DatabaseCreate.java b/operator/src/test/java/it/aboutbits/postgresql/_support/testdata/persisted/creator/DatabaseCreate.java
index 9125706..ef07261 100644
--- a/operator/src/test/java/it/aboutbits/postgresql/_support/testdata/persisted/creator/DatabaseCreate.java
+++ b/operator/src/test/java/it/aboutbits/postgresql/_support/testdata/persisted/creator/DatabaseCreate.java
@@ -16,32 +16,28 @@
 
 import java.util.concurrent.TimeUnit;
 
-@NullMarked
 @Setter
 @Accessors(fluent = true, chain = true)
+@NullMarked
 public class DatabaseCreate extends TestDataCreator<Database> {
     private final Given given;
 
     private final KubernetesClient kubernetesClient;
 
-    @Nullable
-    private String withNamespace;
+    private @Nullable String withNamespace;
+
     @Setter(AccessLevel.NONE)
     private boolean withoutNamespace = false;
 
-    @Nullable
-    private String withName;
+    private @Nullable String withName;
 
-    @Nullable
-    private String withClusterConnectionName;
+    private @Nullable String withClusterConnectionName;
 
-    @Nullable
-    private String withClusterConnectionNamespace;
+    private @Nullable String withClusterConnectionNamespace;
 
     private ReclaimPolicy withReclaimPolicy = ReclaimPolicy.RETAIN;
 
-    @Nullable
-    private String withOwner;
+    private @Nullable String withOwner;
 
     public DatabaseCreate(
             int numberOfItems,
@@ -101,8 +97,7 @@ protected Database create(int index) {
                 );
     }
 
-    @Nullable
-    private String getNamespace() {
+    private @Nullable String getNamespace() {
         if (withoutNamespace) {
             return null;
         }
diff --git a/operator/src/test/java/it/aboutbits/postgresql/_support/testdata/persisted/creator/DefaultPrivilegeCreate.java b/operator/src/test/java/it/aboutbits/postgresql/_support/testdata/persisted/creator/DefaultPrivilegeCreate.java
index ec88f17..9840374 100644
--- a/operator/src/test/java/it/aboutbits/postgresql/_support/testdata/persisted/creator/DefaultPrivilegeCreate.java
+++ b/operator/src/test/java/it/aboutbits/postgresql/_support/testdata/persisted/creator/DefaultPrivilegeCreate.java
@@ -21,39 +21,32 @@
 
 import static it.aboutbits.postgresql.core.ReclaimPolicy.DELETE;
 
-@NullMarked
 @Setter
 @Accessors(fluent = true, chain = true)
+@NullMarked
 public class DefaultPrivilegeCreate extends TestDataCreator<DefaultPrivilege> {
     private final Given given;
 
     private final KubernetesClient kubernetesClient;
 
-    @Nullable
-    private String withNamespace;
+    private @Nullable String withNamespace;
+
     @Setter(AccessLevel.NONE)
     private boolean withoutNamespace = false;
 
-    @Nullable
-    private String withName;
+    private @Nullable String withName;
 
-    @Nullable
-    private String withClusterConnectionName;
+    private @Nullable String withClusterConnectionName;
 
-    @Nullable
-    private String withClusterConnectionNamespace;
+    private @Nullable String withClusterConnectionNamespace;
 
-    @Nullable
-    private String withDatabase;
+    private @Nullable String withDatabase;
 
-    @Nullable
-    private String withRole;
+    private @Nullable String withRole;
 
-    @Nullable
-    private String withOwner;
+    private @Nullable String withOwner;
 
-    @Nullable
-    private String withSchema;
+    private @Nullable String withSchema;
 
     private DefaultPrivilegeObjectType withObjectType = DefaultPrivilegeObjectType.SCHEMA;
 
@@ -140,8 +133,7 @@ protected DefaultPrivilege create(int index) {
                 );
     }
 
-    @Nullable
-    private String getNamespace() {
+    private @Nullable String getNamespace() {
         if (withoutNamespace) {
             return null;
         }
diff --git a/operator/src/test/java/it/aboutbits/postgresql/_support/testdata/persisted/creator/GrantCreate.java b/operator/src/test/java/it/aboutbits/postgresql/_support/testdata/persisted/creator/GrantCreate.java
index 0dd78f9..42c900c 100644
--- a/operator/src/test/java/it/aboutbits/postgresql/_support/testdata/persisted/creator/GrantCreate.java
+++ b/operator/src/test/java/it/aboutbits/postgresql/_support/testdata/persisted/creator/GrantCreate.java
@@ -21,42 +21,35 @@
 
 import static it.aboutbits.postgresql.core.ReclaimPolicy.DELETE;
 
-@NullMarked
 @Setter
 @Accessors(fluent = true, chain = true)
+@NullMarked
 public class GrantCreate extends TestDataCreator<Grant> {
     private final Given given;
 
     private final KubernetesClient kubernetesClient;
 
-    @Nullable
-    private String withNamespace;
+    private @Nullable String withNamespace;
+
     @Setter(AccessLevel.NONE)
     private boolean withoutNamespace = false;
 
-    @Nullable
-    private String withName;
+    private @Nullable String withName;
 
-    @Nullable
-    private String withClusterConnectionName;
+    private @Nullable String withClusterConnectionName;
 
-    @Nullable
-    private String withClusterConnectionNamespace;
+    private @Nullable String withClusterConnectionNamespace;
 
-    @Nullable
-    private String withDatabase;
+    private @Nullable String withDatabase;
 
-    @Nullable
-    private String withRole;
+    private @Nullable String withRole;
 
-    @Nullable
-    private String withSchema;
+    private @Nullable String withSchema;
 
     private GrantObjectType withObjectType = GrantObjectType.DATABASE;
 
-    @Nullable
     @Setter(AccessLevel.NONE)
-    private List<String> withObjects = null;
+    private @Nullable List<String> withObjects = null;
 
     @Setter(AccessLevel.NONE)
     private List<Privilege> withPrivileges = new ArrayList<>();
@@ -158,8 +151,7 @@ protected Grant create(int index) {
                 );
     }
 
-    @Nullable
-    private String getNamespace() {
+    private @Nullable String getNamespace() {
         if (withoutNamespace) {
             return null;
         }
diff --git a/operator/src/test/java/it/aboutbits/postgresql/_support/testdata/persisted/creator/RoleCreate.java b/operator/src/test/java/it/aboutbits/postgresql/_support/testdata/persisted/creator/RoleCreate.java
index 9d5ca0e..064ede8 100644
--- a/operator/src/test/java/it/aboutbits/postgresql/_support/testdata/persisted/creator/RoleCreate.java
+++ b/operator/src/test/java/it/aboutbits/postgresql/_support/testdata/persisted/creator/RoleCreate.java
@@ -15,33 +15,28 @@
 
 import java.util.concurrent.TimeUnit;
 
-@NullMarked
 @Setter
 @Accessors(fluent = true, chain = true)
+@NullMarked
 public class RoleCreate extends TestDataCreator<Role> {
     private final Given given;
 
     private final KubernetesClient kubernetesClient;
 
-    @Nullable
-    private String withNamespace;
+    private @Nullable String withNamespace;
+
     @Setter(AccessLevel.NONE)
     private boolean withoutNamespace = false;
 
-    @Nullable
-    private String withName;
+    private @Nullable String withName;
 
-    @Nullable
-    private String withComment;
+    private @Nullable String withComment;
 
-    @Nullable
-    private String withClusterConnectionName;
+    private @Nullable String withClusterConnectionName;
 
-    @Nullable
-    private String withClusterConnectionNamespace;
+    private @Nullable String withClusterConnectionNamespace;
 
-    @Nullable
-    private ResourceRef withPasswordSecretRef;
+    private @Nullable ResourceRef withPasswordSecretRef;
 
     private RoleSpec.@Nullable Flags withFlags;
 
@@ -125,8 +120,7 @@ protected Role create(int index) {
                 );
     }
 
-    @Nullable
-    private String getNamespace() {
+    private @Nullable String getNamespace() {
         if (withoutNamespace) {
             return null;
         }
diff --git a/operator/src/test/java/it/aboutbits/postgresql/_support/testdata/persisted/creator/SchemaCreate.java b/operator/src/test/java/it/aboutbits/postgresql/_support/testdata/persisted/creator/SchemaCreate.java
index 14ac58f..27f9a16 100644
--- a/operator/src/test/java/it/aboutbits/postgresql/_support/testdata/persisted/creator/SchemaCreate.java
+++ b/operator/src/test/java/it/aboutbits/postgresql/_support/testdata/persisted/creator/SchemaCreate.java
@@ -18,35 +18,30 @@
 
 import static it.aboutbits.postgresql.core.ReclaimPolicy.DELETE;
 
-@NullMarked
 @Setter
 @Accessors(fluent = true, chain = true)
+@NullMarked
 public class SchemaCreate extends TestDataCreator<Schema> {
     private final Given given;
 
     private final KubernetesClient kubernetesClient;
 
-    @Nullable
-    private String withNamespace;
+    private @Nullable String withNamespace;
+
     @Setter(AccessLevel.NONE)
     private boolean withoutNamespace = false;
 
-    @Nullable
-    private String withName;
+    private @Nullable String withName;
 
-    @Nullable
-    private String withClusterConnectionName;
+    private @Nullable String withClusterConnectionName;
 
-    @Nullable
-    private String withClusterConnectionNamespace;
+    private @Nullable String withClusterConnectionNamespace;
 
-    @Nullable
-    private String withDatabase;
+    private @Nullable String withDatabase;
 
     private ReclaimPolicy withReclaimPolicy = ReclaimPolicy.RETAIN;
 
-    @Nullable
-    private String withOwner;
+    private @Nullable String withOwner;
 
     public SchemaCreate(
             int numberOfItems,
@@ -110,8 +105,7 @@ protected Schema create(int index) {
                 );
     }
 
-    @Nullable
-    private String getNamespace() {
+    private @Nullable String getNamespace() {
         if (withoutNamespace) {
             return null;
         }
diff --git a/operator/src/test/java/it/aboutbits/postgresql/_support/testdata/persisted/creator/SecretRefCreate.java b/operator/src/test/java/it/aboutbits/postgresql/_support/testdata/persisted/creator/SecretRefCreate.java
index d085751..82ad9ed 100644
--- a/operator/src/test/java/it/aboutbits/postgresql/_support/testdata/persisted/creator/SecretRefCreate.java
+++ b/operator/src/test/java/it/aboutbits/postgresql/_support/testdata/persisted/creator/SecretRefCreate.java
@@ -14,27 +14,26 @@
 import static it.aboutbits.postgresql.core.KubernetesService.SECRET_DATA_BASIC_AUTH_USERNAME_KEY;
 import static it.aboutbits.postgresql.core.KubernetesService.SECRET_TYPE_BASIC_AUTH;
 
-@NullMarked
 @Setter
 @Accessors(fluent = true, chain = true)
+@NullMarked
 public class SecretRefCreate extends TestDataCreator<ResourceRef> {
     private final KubernetesClient kubernetesClient;
 
-    @Nullable
-    private String withNamespace;
+    private @Nullable String withNamespace;
+
     @Setter(AccessLevel.NONE)
     private boolean withoutNamespace = false;
 
-    @Nullable
-    private String withName;
+    private @Nullable String withName;
+
+    private @Nullable String withUsername;
 
-    @Nullable
-    private String withUsername;
     @Setter(AccessLevel.NONE)
     private boolean withoutUsername = false;
 
-    @Nullable
-    private String withPassword;
+    private @Nullable String withPassword;
+
     @Setter(AccessLevel.NONE)
     private boolean withoutPassword = false;
 
@@ -91,8 +90,7 @@ protected ResourceRef create(int index) {
         return secretRef;
     }
 
-    @Nullable
-    private String getNamespace() {
+    private @Nullable String getNamespace() {
         if (withoutNamespace) {
             return null;
         }
@@ -116,8 +114,7 @@ private String getName() {
         return withName;
     }
 
-    @Nullable
-    private String getUsername() {
+    private @Nullable String getUsername() {
         if (withoutUsername) {
             return null;
         }
@@ -131,8 +128,7 @@ private String getUsername() {
         return withUsername;
     }
 
-    @Nullable
-    private String getPassword() {
+    private @Nullable String getPassword() {
         if (withoutPassword) {
             return null;
         }
diff --git a/operator/src/test/java/it/aboutbits/postgresql/_support/valuesource/BlankSource.java b/operator/src/test/java/it/aboutbits/postgresql/_support/valuesource/BlankSource.java
index 16e6a76..2f84814 100644
--- a/operator/src/test/java/it/aboutbits/postgresql/_support/valuesource/BlankSource.java
+++ b/operator/src/test/java/it/aboutbits/postgresql/_support/valuesource/BlankSource.java
@@ -1,5 +1,6 @@
 package it.aboutbits.postgresql._support.valuesource;
 
+import org.jspecify.annotations.NullMarked;
 import org.junit.jupiter.params.provider.ValueSource;
 
 import java.lang.annotation.Documented;
@@ -12,5 +13,6 @@
 @Retention(RetentionPolicy.RUNTIME)
 @Documented
 @ValueSource(strings = {"", " ", "         ", "\t", "\r", "\n", "\r\n", "\f", "\u000B"})
+@NullMarked
 public @interface BlankSource {
 }
diff --git a/operator/src/test/java/it/aboutbits/postgresql/crd/clusterconnection/ClusterConnectionReconcilerErrorTest.java b/operator/src/test/java/it/aboutbits/postgresql/crd/clusterconnection/ClusterConnectionReconcilerErrorTest.java
index 54627af..e45799a 100644
--- a/operator/src/test/java/it/aboutbits/postgresql/crd/clusterconnection/ClusterConnectionReconcilerErrorTest.java
+++ b/operator/src/test/java/it/aboutbits/postgresql/crd/clusterconnection/ClusterConnectionReconcilerErrorTest.java
@@ -20,8 +20,8 @@
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.when;
 
-@NullMarked
 @QuarkusTest
+@NullMarked
 class ClusterConnectionReconcilerErrorTest {
     @SuppressWarnings("NullAway.Init")
     @InjectMock
diff --git a/operator/src/test/java/it/aboutbits/postgresql/crd/clusterconnection/ClusterConnectionReconcilerTest.java b/operator/src/test/java/it/aboutbits/postgresql/crd/clusterconnection/ClusterConnectionReconcilerTest.java
index 4b7ba1f..22054be 100644
--- a/operator/src/test/java/it/aboutbits/postgresql/crd/clusterconnection/ClusterConnectionReconcilerTest.java
+++ b/operator/src/test/java/it/aboutbits/postgresql/crd/clusterconnection/ClusterConnectionReconcilerTest.java
@@ -25,9 +25,9 @@
 import static org.assertj.core.api.Assertions.assertThatNoException;
 import static org.assertj.core.api.Assertions.within;
 
-@NullMarked
 @QuarkusTest
 @RequiredArgsConstructor
+@NullMarked
 class ClusterConnectionReconcilerTest {
     private final Given given;
 
diff --git a/operator/src/test/java/it/aboutbits/postgresql/crd/database/DatabaseReconcilerTest.java b/operator/src/test/java/it/aboutbits/postgresql/crd/database/DatabaseReconcilerTest.java
index ff9f09c..e948317 100644
--- a/operator/src/test/java/it/aboutbits/postgresql/crd/database/DatabaseReconcilerTest.java
+++ b/operator/src/test/java/it/aboutbits/postgresql/crd/database/DatabaseReconcilerTest.java
@@ -19,9 +19,9 @@
 import static it.aboutbits.postgresql.core.ReclaimPolicy.DELETE;
 import static org.assertj.core.api.Assertions.assertThat;
 
-@NullMarked
 @QuarkusTest
 @RequiredArgsConstructor
+@NullMarked
 class DatabaseReconcilerTest {
     private final Given given;
 
diff --git a/operator/src/test/java/it/aboutbits/postgresql/crd/defaultprivilege/DefaultPrivilegeReconcilerTest.java b/operator/src/test/java/it/aboutbits/postgresql/crd/defaultprivilege/DefaultPrivilegeReconcilerTest.java
index f727fb4..f093d34 100644
--- a/operator/src/test/java/it/aboutbits/postgresql/crd/defaultprivilege/DefaultPrivilegeReconcilerTest.java
+++ b/operator/src/test/java/it/aboutbits/postgresql/crd/defaultprivilege/DefaultPrivilegeReconcilerTest.java
@@ -41,9 +41,9 @@
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
 
-@NullMarked
 @QuarkusTest
 @RequiredArgsConstructor
+@NullMarked
 class DefaultPrivilegeReconcilerTest {
     private final Given given;
 
diff --git a/operator/src/test/java/it/aboutbits/postgresql/crd/grant/GrantReconcilerTest.java b/operator/src/test/java/it/aboutbits/postgresql/crd/grant/GrantReconcilerTest.java
index 8db9801..f37df7f 100644
--- a/operator/src/test/java/it/aboutbits/postgresql/crd/grant/GrantReconcilerTest.java
+++ b/operator/src/test/java/it/aboutbits/postgresql/crd/grant/GrantReconcilerTest.java
@@ -46,9 +46,9 @@
 import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
 import static org.jooq.impl.DSL.quotedName;
 
-@NullMarked
 @QuarkusTest
 @RequiredArgsConstructor
+@NullMarked
 class GrantReconcilerTest {
     private final Given given;
 
diff --git a/operator/src/test/java/it/aboutbits/postgresql/crd/role/RoleReconcilerTest.java b/operator/src/test/java/it/aboutbits/postgresql/crd/role/RoleReconcilerTest.java
index 16b312b..89551fc 100644
--- a/operator/src/test/java/it/aboutbits/postgresql/crd/role/RoleReconcilerTest.java
+++ b/operator/src/test/java/it/aboutbits/postgresql/crd/role/RoleReconcilerTest.java
@@ -37,9 +37,9 @@
 import static org.awaitility.Awaitility.await;
 import static org.jooq.impl.DSL.role;
 
-@NullMarked
 @QuarkusTest
 @RequiredArgsConstructor
+@NullMarked
 class RoleReconcilerTest {
     private final Given given;
 
diff --git a/operator/src/test/java/it/aboutbits/postgresql/crd/schema/SchemaReconcilerTest.java b/operator/src/test/java/it/aboutbits/postgresql/crd/schema/SchemaReconcilerTest.java
index 633927c..db930fc 100644
--- a/operator/src/test/java/it/aboutbits/postgresql/crd/schema/SchemaReconcilerTest.java
+++ b/operator/src/test/java/it/aboutbits/postgresql/crd/schema/SchemaReconcilerTest.java
@@ -19,9 +19,9 @@
 import static it.aboutbits.postgresql.core.ReclaimPolicy.DELETE;
 import static org.assertj.core.api.Assertions.assertThat;
 
-@NullMarked
 @QuarkusTest
 @RequiredArgsConstructor
+@NullMarked
 class SchemaReconcilerTest {
     private final Given given;