diff --git a/smoke-test/spring-boot-smoke-test-web-method-security/build.gradle b/smoke-test/spring-boot-smoke-test-web-method-security/build.gradle
index d5c24bdfbdc..3332cb448e8 100644
--- a/smoke-test/spring-boot-smoke-test-web-method-security/build.gradle
+++ b/smoke-test/spring-boot-smoke-test-web-method-security/build.gradle
@@ -28,3 +28,7 @@ dependencies {
 	testImplementation(project(":starter:spring-boot-starter-webmvc-test"))
 	testImplementation(project(":starter:spring-boot-starter-test"))
 }
+
+tasks.named("compileTestJava") {
+	options.nullability.checking = "tests"
+}
diff --git a/smoke-test/spring-boot-smoke-test-web-method-security/src/test/java/smoketest/security/method/SampleMethodSecurityApplicationTests.java b/smoke-test/spring-boot-smoke-test-web-method-security/src/test/java/smoketest/security/method/SampleMethodSecurityApplicationTests.java
index f5f791f709e..8c969ad4cec 100644
--- a/smoke-test/spring-boot-smoke-test-web-method-security/src/test/java/smoketest/security/method/SampleMethodSecurityApplicationTests.java
+++ b/smoke-test/spring-boot-smoke-test-web-method-security/src/test/java/smoketest/security/method/SampleMethodSecurityApplicationTests.java
@@ -16,6 +16,7 @@
 
 package smoketest.security.method;
 
+import java.net.URI;
 import java.util.Collections;
 
 import org.junit.jupiter.api.Test;
@@ -74,7 +75,9 @@ class SampleMethodSecurityApplicationTests {
 		ResponseEntity<String> entity = this.restTemplate.exchange("/login", HttpMethod.POST,
 				new HttpEntity<>(form, headers), String.class);
 		assertThat(entity.getStatusCode()).isEqualTo(HttpStatus.FOUND);
-		assertThat(entity.getHeaders().getLocation().toString()).endsWith(this.port + "/");
+		URI location = entity.getHeaders().getLocation();
+		assertThat(location).isNotNull();
+		assertThat(location.toString()).endsWith(this.port + "/");
 	}
 
 	@Test
@@ -89,8 +92,10 @@ class SampleMethodSecurityApplicationTests {
 		assertThat(entity.getStatusCode()).isEqualTo(HttpStatus.FOUND);
 		String cookie = entity.getHeaders().getFirst("Set-Cookie");
 		headers.set("Cookie", cookie);
-		ResponseEntity<String> page = this.restTemplate.exchange(entity.getHeaders().getLocation(), HttpMethod.GET,
-				new HttpEntity<>(headers), String.class);
+		URI location = entity.getHeaders().getLocation();
+		assertThat(location).isNotNull();
+		ResponseEntity<String> page = this.restTemplate.exchange(location, HttpMethod.GET, new HttpEntity<>(headers),
+				String.class);
 		assertThat(page.getStatusCode()).isEqualTo(HttpStatus.FORBIDDEN);
 		assertThat(page.getBody()).contains("Access denied");
 	}