diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 77604dc..0a23e09 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -25,8 +25,10 @@ jobs:
           cache: maven
       - run: ./mvnw -V --no-transfer-progress clean package
         if: matrix.java != 17
-      - run: ./mvnw -V --no-transfer-progress clean package spotbugs:check git-commit-id:validateRevision -DperformRelease
-        if: matrix.java == 17
+      - run: |
+          ./mvnw -V --no-transfer-progress clean package spotbugs:check git-commit-id:validateRevision -DperformRelease
+          scripts/check-forbidden-classes.sh
+        if: matrix.java == 17 && runner.os != 'Linux'
       # https://github.com/marketplace/actions/codecov
       - uses: codecov/codecov-action@v4
         env:
diff --git a/scripts/check-forbidden-classes.sh b/scripts/check-forbidden-classes.sh
new file mode 100755
index 0000000..7c17503
--- /dev/null
+++ b/scripts/check-forbidden-classes.sh
@@ -0,0 +1,21 @@
+#!/bin/bash
+set -eEuo pipefail
+
+# cd to project root dir
+cd "${0%/*}"/..
+
+readonly forbidden_classes=(
+  javax.annotation.Nullable
+  javax.annotation.Nonnull
+  org.jetbrains.annotations.Nullable
+  org.jetbrains.annotations.NotNull
+)
+
+grep_options=()
+[[ "${GITHUB_ACTIONS:-}" = true || -t 1 ]] && grep_options=(--color=always)
+readonly grep_options=(-F ${grep_options[@]:+"${grep_options[@]}"} -n -C2 -r src/)
+
+! grep "$(printf "%s\n" "${forbidden_classes[@]}")" "${grep_options[@]}" || {
+  printf '\n\e[1;31m%s\e[0m\n' "Forbidden classes found, remove them."
+  exit 1
+}