diff --git a/build.gradle.kts b/build.gradle.kts
index ba2f7aaed67e..8e1330de804a 100644
--- a/build.gradle.kts
+++ b/build.gradle.kts
@@ -1056,3 +1056,22 @@ if (project.hasProperty("testJavaVersion")) {
     }
   }
 }
+
+subprojects {
+  configurations {
+    configureEach {
+      resolutionStrategy {
+        dependencySubstitution {
+          // Substitute dependencies (including transitive) on org.lz4:lz4-java regardless of capability conflicts.
+          // All published versions of org.lz4:lz4-java have known vulnerabilities.
+          // At present, all versions of at.yawk.lz4:lz4-java <1.10.1 have known vulnerabilities.
+          // Substituting org.lz4:lz4-java ensures that at.yawk.lz4:lz4-java is always selected.
+          // Gradle resolves version conflicts by selecting the highest version by default.
+          // Gradle only resolves capability conflicts when multiple modules provide the same capability.
+          // This would allow org.lz4:lz4-java to still be selected, which is undesirable because of vulnerabilities.
+          substitute(module("org.lz4:lz4-java")).using(module("at.yawk.lz4:lz4-java:1.10.1"))
+        }
+      }
+    }
+  }
+}
diff --git a/buildSrc/src/main/groovy/org/apache/beam/gradle/BeamModulePlugin.groovy b/buildSrc/src/main/groovy/org/apache/beam/gradle/BeamModulePlugin.groovy
index 3843958f0f3e..51f88d3411d3 100644
--- a/buildSrc/src/main/groovy/org/apache/beam/gradle/BeamModulePlugin.groovy
+++ b/buildSrc/src/main/groovy/org/apache/beam/gradle/BeamModulePlugin.groovy
@@ -954,18 +954,6 @@ class BeamModulePlugin implements Plugin<Project> {
 
     /** ***********************************************************************************************/
 
-    // Resolves a capability conflict for a given configuration by selecting the preferred capability provider.
-    project.ext.resolveCapabilitiesConflict = { Configuration configuration, String capability, String preferred ->
-      configuration.resolutionStrategy.capabilitiesResolution.withCapability(capability) {
-        def candidate = candidates.find { it.id.toString().contains(preferred) }
-        if (candidate != null) {
-          select(candidate)
-        } else {
-          selectHighestVersion()
-        }
-      }
-    }
-
     // Returns a string representing the relocated path to be used with the shadow plugin when
     // given a suffix such as "com.google.common".
     project.ext.getJavaRelocatedPath = { String suffix ->
diff --git a/examples/java/common.gradle b/examples/java/common.gradle
index f32667d733fb..10ea43628bc8 100644
--- a/examples/java/common.gradle
+++ b/examples/java/common.gradle
@@ -35,8 +35,6 @@ configurations.sparkRunnerPreCommit {
   exclude group: "org.slf4j", module: "jul-to-slf4j"
   exclude group: "org.slf4j", module: "slf4j-jdk14"
 }
-resolveCapabilitiesConflict(configurations.flinkRunnerPreCommit, 'org.lz4:lz4-java', 'at.yawk.lz4')
-
 
 dependencies {
   directRunnerPreCommit project(path: ":runners:direct-java", configuration: "shadow")
diff --git a/runners/flink/2.1/build.gradle b/runners/flink/2.1/build.gradle
index 1e0d565b50d9..32c71eb96483 100644
--- a/runners/flink/2.1/build.gradle
+++ b/runners/flink/2.1/build.gradle
@@ -41,10 +41,3 @@ project.ext {
 
 // Load the main build script which contains all build logic.
 apply from: "../flink_runner.gradle"
-
-// Flink 2.1 uses at.yawk.lz4:lz4-java instead of org.lz4:lz4-java
-// Explicitly prefer Flink's at.yawk.lz4 version to resolve capability conflict
-configurations.all {
-  resolveCapabilitiesConflict(it, 'org.lz4:lz4-java', 'at.yawk.lz4')
-}
-
diff --git a/runners/flink/2.1/job-server/build.gradle b/runners/flink/2.1/job-server/build.gradle
index 0910fef11208..3135abcb19b7 100644
--- a/runners/flink/2.1/job-server/build.gradle
+++ b/runners/flink/2.1/job-server/build.gradle
@@ -29,10 +29,3 @@ project.ext {
 
 // Load the main build script which contains all build logic.
 apply from: "$basePath/flink_job_server.gradle"
-
-// Flink 2.1 uses at.yawk.lz4:lz4-java instead of org.lz4:lz4-java
-// Explicitly prefer Flink's at.yawk.lz4 version to resolve capability conflict
-configurations.all {
-  resolveCapabilitiesConflict(it, 'org.lz4:lz4-java', 'at.yawk.lz4')
-}
-
diff --git a/runners/flink/2.2/build.gradle b/runners/flink/2.2/build.gradle
index 0321dcf42d10..1e1d7fdd5e75 100644
--- a/runners/flink/2.2/build.gradle
+++ b/runners/flink/2.2/build.gradle
@@ -56,10 +56,3 @@ project.ext {
 
 // Load the main build script which contains all build logic.
 apply from: "../flink_runner.gradle"
-
-// Flink 2.2 uses at.yawk.lz4:lz4-java instead of org.lz4:lz4-java
-// Explicitly prefer Flink's at.yawk.lz4 version to resolve capability conflict
-configurations.all {
-  resolveCapabilitiesConflict(it, 'org.lz4:lz4-java', 'at.yawk.lz4')
-}
-
diff --git a/runners/flink/2.2/job-server/build.gradle b/runners/flink/2.2/job-server/build.gradle
index f116f5a1dcbf..527245329211 100644
--- a/runners/flink/2.2/job-server/build.gradle
+++ b/runners/flink/2.2/job-server/build.gradle
@@ -29,10 +29,3 @@ project.ext {
 
 // Load the main build script which contains all build logic.
 apply from: "$basePath/flink_job_server.gradle"
-
-// Flink 2.2 uses at.yawk.lz4:lz4-java instead of org.lz4:lz4-java
-// Explicitly prefer Flink's at.yawk.lz4 version to resolve capability conflict
-configurations.all {
-  resolveCapabilitiesConflict(it, 'org.lz4:lz4-java', 'at.yawk.lz4')
-}
-
diff --git a/sdks/java/testing/nexmark/build.gradle b/sdks/java/testing/nexmark/build.gradle
index bd917a3935ad..c974d83c26b4 100644
--- a/sdks/java/testing/nexmark/build.gradle
+++ b/sdks/java/testing/nexmark/build.gradle
@@ -103,10 +103,6 @@ dependencies {
   gradleRun project(path: nexmarkRunnerDependency, configuration: runnerConfiguration)
 }
 
-if (isFlink2) {
-  resolveCapabilitiesConflict(configurations.gradleRun, 'org.lz4:lz4-java', 'at.yawk.lz4')
-}
-
 if (isSparkRunner) {
   configurations.gradleRun {
     // Using Spark runner causes a StackOverflowError if slf4j-jdk14 is on the classpath
diff --git a/sdks/java/testing/tpcds/build.gradle b/sdks/java/testing/tpcds/build.gradle
index 6a05df96ab20..0a9438f83a3d 100644
--- a/sdks/java/testing/tpcds/build.gradle
+++ b/sdks/java/testing/tpcds/build.gradle
@@ -94,10 +94,6 @@ dependencies {
     gradleRun project(path: tpcdsRunnerDependency, configuration: runnerConfiguration)
 }
 
-if (isFlink2) {
-    resolveCapabilitiesConflict(configurations.gradleRun, 'org.lz4:lz4-java', 'at.yawk.lz4')
-}
-
 if (isSpark) {
     configurations.gradleRun {
       exclude group: "org.slf4j", module: "slf4j-jdk14"