diff --git a/gerrit-acceptance-tests/tests.bzl b/gerrit-acceptance-tests/tests.bzl
index 3b1a4f4be6..594e58394d 100644
--- a/gerrit-acceptance-tests/tests.bzl
+++ b/gerrit-acceptance-tests/tests.bzl
@@ -10,8 +10,6 @@ def acceptance_tests(
     name = group,
     deps = deps + [
       '//gerrit-acceptance-tests:lib',
-      "//lib/bouncycastle:bcpkix",
-      "//lib/bouncycastle:bcpg",
     ],
     tags = labels + [
       'acceptance',
diff --git a/gerrit-gpg/BUILD b/gerrit-gpg/BUILD
index 1d949d15d8..680071f3da 100644
--- a/gerrit-gpg/BUILD
+++ b/gerrit-gpg/BUILD
@@ -19,8 +19,8 @@ java_library(
     srcs = glob(["src/main/java/**/*.java"]),
     visibility = ["//visibility:public"],
     deps = DEPS + [
-        "//lib/bouncycastle:bcpg",
-        "//lib/bouncycastle:bcprov",
+        "//lib/bouncycastle:bcpg-neverlink",
+        "//lib/bouncycastle:bcprov-neverlink",
     ],
 )
 
@@ -32,9 +32,9 @@ java_library(
     srcs = TESTUTIL_SRCS,
     visibility = ["//visibility:public"],
     deps = DEPS + [
+        "//lib/bouncycastle:bcpg-neverlink",
+        "//lib/bouncycastle:bcprov-neverlink",
         ":gpg",
-        "//lib/bouncycastle:bcpg",
-        "//lib/bouncycastle:bcprov",
     ],
 )
 
diff --git a/gerrit-server/BUILD b/gerrit-server/BUILD
index a8ac50d759..adfe7a46b1 100644
--- a/gerrit-server/BUILD
+++ b/gerrit-server/BUILD
@@ -55,8 +55,8 @@ java_library(
         "//lib:velocity",
         "//lib/antlr:java_runtime",
         "//lib/auto:auto-value",
-        "//lib/bouncycastle:bcpkix",
-        "//lib/bouncycastle:bcprov",
+        "//lib/bouncycastle:bcpkix-neverlink",
+        "//lib/bouncycastle:bcprov-neverlink",
         "//lib/commons:codec",
         "//lib/commons:compress",
         "//lib/commons:dbcp",
@@ -230,6 +230,7 @@ junit_tests(
         "//lib:guava-retrying",
         "//lib:protobuf",
         "//lib/bouncycastle:bcprov",
+        "//lib/bouncycastle:bcpkix",
         "//lib/dropwizard:dropwizard-core",
         "//lib/guice:guice-assistedinject",
         "//lib/prolog:runtime",
diff --git a/gerrit-sshd/BUILD b/gerrit-sshd/BUILD
index 2288e5d3bf..db27f02597 100644
--- a/gerrit-sshd/BUILD
+++ b/gerrit-sshd/BUILD
@@ -23,7 +23,7 @@ java_library(
         "//lib:jsch",
         "//lib:servlet-api-3_1",
         "//lib/auto:auto-value",
-        "//lib/bouncycastle:bcprov",
+        "//lib/bouncycastle:bcprov-neverlink",
         "//lib/commons:codec",
         "//lib/dropwizard:dropwizard-core",
         "//lib/guice",
diff --git a/lib/bouncycastle/BUILD b/lib/bouncycastle/BUILD
index 746a982cff..cf3e996263 100644
--- a/lib/bouncycastle/BUILD
+++ b/lib/bouncycastle/BUILD
@@ -18,3 +18,27 @@ java_library(
     visibility = ["//visibility:public"],
     exports = ["@bcpkix//jar"],
 )
+
+java_library(
+    name = "bcprov-neverlink",
+    data = ["//lib:LICENSE-bouncycastle"],
+    neverlink = 1,
+    visibility = ["//visibility:public"],
+    exports = ["@bcprov//jar"],
+)
+
+java_library(
+    name = "bcpg-neverlink",
+    data = ["//lib:LICENSE-bouncycastle"],
+    neverlink = 1,
+    visibility = ["//visibility:public"],
+    exports = ["@bcpg//jar"],
+)
+
+java_library(
+    name = "bcpkix-neverlink",
+    data = ["//lib:LICENSE-bouncycastle"],
+    neverlink = 1,
+    visibility = ["//visibility:public"],
+    exports = ["@bcpkix//jar"],
+)
diff --git a/tools/bzl/pkg_war.bzl b/tools/bzl/pkg_war.bzl
index 7eebcd3d82..edaaab044a 100644
--- a/tools/bzl/pkg_war.bzl
+++ b/tools/bzl/pkg_war.bzl
@@ -21,6 +21,9 @@ LIBS = [
     "//gerrit-war:log4j-config",
     "//gerrit-war:version",
     "//lib:postgresql",
+    "//lib/bouncycastle:bcpkix",
+    "//lib/bouncycastle:bcprov",
+    "//lib/bouncycastle:bcpg",
     "//lib/log:impl_log4j",
 ]
 
diff --git a/tools/bzl/plugin.bzl b/tools/bzl/plugin.bzl
index de82af804d..59e7335e59 100644
--- a/tools/bzl/plugin.bzl
+++ b/tools/bzl/plugin.bzl
@@ -12,7 +12,12 @@ load(
 
 PLUGIN_DEPS = ["//gerrit-plugin-api:lib"]
 
-PLUGIN_TEST_DEPS = ["//gerrit-acceptance-framework:lib"]
+PLUGIN_TEST_DEPS = [
+    "//gerrit-acceptance-framework:lib",
+    "//lib/bouncycastle:bcpg",
+    "//lib/bouncycastle:bcpkix",
+    "//lib/bouncycastle:bcprov",
+]
 
 def gerrit_plugin(
     name,