diff --git a/build-logic/jvm/src/main/kotlin/build-logic.errorprone.gradle.kts b/build-logic/jvm/src/main/kotlin/build-logic.errorprone.gradle.kts
index 91a1a818..039357fc 100644
--- a/build-logic/jvm/src/main/kotlin/build-logic.errorprone.gradle.kts
+++ b/build-logic/jvm/src/main/kotlin/build-logic.errorprone.gradle.kts
@@ -8,7 +8,7 @@ if (!project.hasProperty("skipErrorprone")) {
     apply(plugin = "net.ltgt.errorprone")
 
     dependencies {
-        "errorprone"("com.google.errorprone:error_prone_core:2.18.0")
+        "errorprone"("com.google.errorprone:error_prone_core:2.20.0")
         "annotationProcessor"("com.google.guava:guava-beta-checker:1.0")
     }
 
diff --git a/sigstore-java/src/main/java/dev/sigstore/tuf/model/Hashes.java b/sigstore-java/src/main/java/dev/sigstore/tuf/model/Hashes.java
index 693f10ce..2f4cd01a 100644
--- a/sigstore-java/src/main/java/dev/sigstore/tuf/model/Hashes.java
+++ b/sigstore-java/src/main/java/dev/sigstore/tuf/model/Hashes.java
@@ -24,11 +24,11 @@
 @Value.Immutable
 public interface Hashes {
 
-  @Nullable
   /** SHA_256 hash of the thing. * */
+  @Nullable
   String getSha256();
 
-  @Nullable
   /** SHA_512 hash of the thing. * */
+  @Nullable
   String getSha512();
 }