diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 0a7aa09530a8..ee98704d35a2 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -57,7 +57,7 @@ jobs:
         - language: go
           build-mode: manual
         - language: java-kotlin
-          build-mode: autobuild
+          build-mode: manual
         - language: javascript-typescript
           build-mode: none
         - language: python
@@ -82,6 +82,12 @@ jobs:
       with:
         go-version-file: 'sdks/go.mod'
 
+    - name: Setup environment for Java
+      if: matrix.language == 'java-kotlin'
+      uses: ./.github/actions/setup-environment-action
+      with:
+        java-version: default
+
     # Add any setup steps before running the `github/codeql-action/init` action.
     # This includes steps like installing compilers or runtimes (`actions/setup-node`
     # or others). This is typically only required for manual builds.
@@ -123,6 +129,9 @@ jobs:
 
           echo "Building learning/tour-of-beam/backend module..."
           (cd learning/tour-of-beam/backend && go build ./cmd/... ./internal/... ./playground_api/...)
+        elif [ "${{ matrix.language }}" = "java-kotlin" ]; then
+          echo "Building Java classes for CodeQL analysis..."
+          ./gradlew compileJava -x test -x check -PdisableSpotlessCheck=true -PdisableCheckStyle=true --no-daemon
         else
           echo "No manual build steps defined for ${{ matrix.language }}"
           exit 1
diff --git a/buildSrc/src/main/groovy/org/apache/beam/gradle/VendorJavaPlugin.groovy b/buildSrc/src/main/groovy/org/apache/beam/gradle/VendorJavaPlugin.groovy
index f6a581b4fc68..832b34dea416 100644
--- a/buildSrc/src/main/groovy/org/apache/beam/gradle/VendorJavaPlugin.groovy
+++ b/buildSrc/src/main/groovy/org/apache/beam/gradle/VendorJavaPlugin.groovy
@@ -86,7 +86,9 @@ class VendorJavaPlugin implements Plugin<Project> {
 
       // plugin to support repository authentication via ~/.m2/settings.xml
       // https://github.com/mark-vieira/gradle-maven-settings-plugin/
-      project.apply plugin: 'net.linguica.maven-settings'
+      if (isRelease(project) || project.hasProperty('publishing')) {
+        project.apply plugin: 'net.linguica.maven-settings'
+      }
 
       // Projects should only depend on the shadowJar output
       project.jar.enabled = false