diff --git a/core/src/main/java/jenkins/security/ResourceDomainConfiguration.java b/core/src/main/java/jenkins/security/ResourceDomainConfiguration.java
index 1b960d0bfc3c..c7016f437a86 100644
--- a/core/src/main/java/jenkins/security/ResourceDomainConfiguration.java
+++ b/core/src/main/java/jenkins/security/ResourceDomainConfiguration.java
@@ -36,6 +36,7 @@
 import org.apache.commons.codec.binary.Base64;
 import org.jenkinsci.Symbol;
 import org.kohsuke.accmod.Restricted;
+import org.kohsuke.accmod.restrictions.Beta;
 import org.kohsuke.accmod.restrictions.NoExternalUse;
 import org.kohsuke.stapler.QueryParameter;
 import org.kohsuke.stapler.Stapler;
@@ -51,6 +52,7 @@
 import java.security.interfaces.RSAPublicKey;
 import java.util.logging.Level;
 import java.util.logging.Logger;
+import javax.annotation.CheckForNull;
 
 import static jenkins.security.ResourceDomainFilter.ERROR_RESPONSE;
 
@@ -61,21 +63,23 @@
  * @see ResourceDomainFilter
  * @see ResourceDomainRootAction
  *
- * @since 2.200
+ * @since 2.200, unrestricted since TODO
  */
 @Extension(ordinal = JenkinsLocationConfiguration.ORDINAL-1) // sort just below the regular location config
-@Restricted(NoExternalUse.class)
+@Restricted(Beta.class)
 @Symbol("resourceRoot")
-public class ResourceDomainConfiguration extends GlobalConfiguration {
+public final class ResourceDomainConfiguration extends GlobalConfiguration {
 
     private static final Logger LOGGER = Logger.getLogger(ResourceDomainConfiguration.class.getName());
 
     private String url;
 
+    @Restricted(NoExternalUse.class)
     public ResourceDomainConfiguration() {
         load();
     }
 
+    @Restricted(NoExternalUse.class)
     @POST
     public FormValidation doCheckUrl(@QueryParameter("url") String resourceRootUrlString) {
         Jenkins.get().checkPermission(Jenkins.ADMINISTER);
@@ -180,11 +184,12 @@ private FormValidation checkUrl(String resourceRootUrlString, boolean allowOnlin
         }
     }
 
+    @CheckForNull
     public String getUrl() {
         return url;
     }
 
-    public void setUrl(String url) {
+    public void setUrl(@CheckForNull String url) {
         if (checkUrl(url, false).kind == FormValidation.Kind.OK) {
             // only accept valid configurations, both with and without URL, but allow for networking issues
             url = Util.fixEmpty(url);
@@ -205,6 +210,7 @@ public void setUrl(String url) {
      * @param req the request to check
      * @return whether the request is a resource URL request
      */
+    @Restricted(NoExternalUse.class)
     public static boolean isResourceRequest(HttpServletRequest req) {
         if (!isResourceDomainConfigured()) {
             return false;
@@ -241,6 +247,7 @@ public static boolean isResourceRequest(HttpServletRequest req) {
      *
      * @return whether a domain has been configured
      */
+    @Restricted(NoExternalUse.class)
     public static boolean isResourceDomainConfigured() {
         String resourceRootUrl = get().getUrl();
         if (resourceRootUrl == null || resourceRootUrl.isEmpty()) {