diff --git a/kotlin-analysis-api/build.gradle.kts b/kotlin-analysis-api/build.gradle.kts
index f4df0678eb..6120b8d8e6 100644
--- a/kotlin-analysis-api/build.gradle.kts
+++ b/kotlin-analysis-api/build.gradle.kts
@@ -2,6 +2,7 @@ import com.github.jengelman.gradle.plugins.shadow.tasks.ShadowJar
 import com.google.devtools.ksp.RelativizingInternalPathProvider
 import com.google.devtools.ksp.RelativizingPathProvider
 import java.io.ByteArrayOutputStream
+import java.util.jar.JarFile
 
 description = "Kotlin Symbol Processing implementation using Kotlin Analysis API"
 
@@ -38,6 +39,14 @@ val depSourceJars: Configuration by configurations.creating
 val depJarsForCheck: Configuration by configurations.creating
 val compilerJar: Configuration by configurations.creating
 
+val originalLog4j: Configuration by configurations.creating
+val filteredLog4j = tasks.register<Jar>("filteredLog4j") {
+    from(originalLog4j.map { zipTree(it) }) {
+        exclude("org/apache/log4j/jdbc/**")
+    }
+    archiveFileName.set("log4j-filtered.jar")
+}
+
 dependencies {
     listOf(
         "com.jetbrains.intellij.platform:util-rt",
@@ -91,7 +100,8 @@ dependencies {
     implementation("org.jetbrains.intellij.deps.jna:jna:5.9.0.26") { isTransitive = false }
     implementation("org.jetbrains.intellij.deps.jna:jna-platform:5.9.0.26") { isTransitive = false }
     implementation("org.jetbrains.intellij.deps:trove4j:1.0.20200330") { isTransitive = false }
-    implementation("org.jetbrains.intellij.deps:log4j:1.2.17.2") { isTransitive = false }
+    originalLog4j("org.jetbrains.intellij.deps:log4j:1.2.17.2") { isTransitive = false }
+    implementation(files(filteredLog4j))
     implementation("org.jetbrains.intellij.deps:jdom:2.0.6") { isTransitive = false }
     implementation("io.javaslang:javaslang:2.0.6")
     implementation("javax.inject:javax.inject:1")
@@ -198,7 +208,7 @@ abstract class ValidateShadowJar : DefaultTask() {
                 )
                 standardOutput = stdout
             }
-        } catch (e: org.gradle.process.internal.ExecException) {
+        } catch (_: org.gradle.process.internal.ExecException) {
             throw Exception("Unable to run jdeps")
         }
         val actualOutput = stdout.toString()
@@ -213,6 +223,18 @@ abstract class ValidateShadowJar : DefaultTask() {
                 """.trimIndent()
             )
         }
+
+        JarFile(jarJar).use { jarFile ->
+            jarFile.entries().asSequence().forEach {
+                if (it.name.contains("org/apache/log4j/jdbc")) {
+                    throw Exception(
+                        """
+                        Validation failed: Found unexpected package 'org/apache/log4j/jdbc' in the shadow JAR.
+                        """.trimIndent()
+                    )
+                }
+            }
+        }
     }
 }
 
diff --git a/symbol-processing-aa-embeddable/build.gradle.kts b/symbol-processing-aa-embeddable/build.gradle.kts
index d28446148e..7282755258 100644
--- a/symbol-processing-aa-embeddable/build.gradle.kts
+++ b/symbol-processing-aa-embeddable/build.gradle.kts
@@ -104,11 +104,13 @@ class AAServiceTransformer : Transformer {
                     )
                     putOneEntry(path, more)
                 }
+
                 path == "META-INF/extensions/compiler.xml" -> {
                     // Keep compiler.xml the same, and patch ksp_compiler.xml.
                     putOneEntry(path, original)
                     putOneEntry("META-INF/extensions/ksp_compiler.xml", patched)
                 }
+
                 else -> {
                     putOneEntry(path, patched)
                 }
@@ -158,17 +160,27 @@ tasks.withType(ShadowJar::class.java).configureEach {
 
     // All bundled dependencies should be renamed.
     doLast {
-        val violatingFiles = mutableListOf<String>()
-        archiveFile.get().asFile.let {
-            for (e in ZipFile(it).entries()) {
-                if (e.name.endsWith(".class") and !validPackages.contains(e.name))
-                    violatingFiles.add(e.name)
+        val validationErrors = mutableListOf<String>()
+        archiveFile.get().asFile.let { file ->
+            ZipFile(file).use { zipFile ->
+                val unrelocatedClasses = zipFile.entries().asSequence()
+                    .map { it.name }
+                    .filter {
+                        it.endsWith(".class") &&
+                            // Explicitly blocked packages should never be included (takes precedence over allowed).
+                            // Not explicitly allowed packages should never be included.
+                            (blockedPackages.contains(it) || !allowedPackages.contains(it))
+                    }
+                    .toList()
+
+                validationErrors.addAll(unrelocatedClasses)
             }
         }
-        if (violatingFiles.isNotEmpty()) {
+
+        if (validationErrors.isNotEmpty()) {
             error(
-                "Detected unrelocated classes that may cause conflicts: " +
-                    violatingFiles.joinToString(System.lineSeparator())
+                "Detected unrelocated classes that may cause conflicts: ${System.lineSeparator()}" +
+                    validationErrors.joinToString(System.lineSeparator())
             )
         }
     }
@@ -228,7 +240,8 @@ class Trie(paths: List<String>) {
     }
 }
 
-val validPackages = Trie(validPaths)
+val allowedPackages = Trie(validPaths)
+val blockedPackages = Trie(listOf("ksp/org/apache/log4j/jdbc"))
 
 val copyDeps = tasks.register<Copy>("copyDeps") {
     duplicatesStrategy = DuplicatesStrategy.EXCLUDE