diff --git a/core/spring-boot/src/main/java/org/springframework/boot/support/SpringApplicationJsonEnvironmentPostProcessor.java b/core/spring-boot/src/main/java/org/springframework/boot/support/SpringApplicationJsonEnvironmentPostProcessor.java
index 16747285d2b..3d134be4907 100644
--- a/core/spring-boot/src/main/java/org/springframework/boot/support/SpringApplicationJsonEnvironmentPostProcessor.java
+++ b/core/spring-boot/src/main/java/org/springframework/boot/support/SpringApplicationJsonEnvironmentPostProcessor.java
@@ -128,7 +128,7 @@ public class SpringApplicationJsonEnvironmentPostProcessor implements Environmen
 	}
 
 	@SuppressWarnings("unchecked")
-	private void extract(String name, Map<String, Object> result, Object value) {
+	private void extract(String name, Map<String, Object> result, @Nullable Object value) {
 		if (value instanceof Map<?, ?> map) {
 			if (CollectionUtils.isEmpty(map)) {
 				result.put(name, value);
diff --git a/module/spring-boot-cloudfoundry/src/main/java/org/springframework/boot/cloudfoundry/autoconfigure/actuate/endpoint/reactive/SecurityService.java b/module/spring-boot-cloudfoundry/src/main/java/org/springframework/boot/cloudfoundry/autoconfigure/actuate/endpoint/reactive/SecurityService.java
index a26ea579c18..52f074044dc 100644
--- a/module/spring-boot-cloudfoundry/src/main/java/org/springframework/boot/cloudfoundry/autoconfigure/actuate/endpoint/reactive/SecurityService.java
+++ b/module/spring-boot-cloudfoundry/src/main/java/org/springframework/boot/cloudfoundry/autoconfigure/actuate/endpoint/reactive/SecurityService.java
@@ -153,6 +153,7 @@ class SecurityService {
 		Assert.state(keys != null, "'keys' must not be null");
 		for (Object key : keys) {
 			Map<?, ?> tokenKey = (Map<?, ?>) key;
+			Assert.state(tokenKey != null, "'tokenKey' must not be null");
 			tokenKeys.put((String) tokenKey.get("kid"), (String) tokenKey.get("value"));
 		}
 		return tokenKeys;
diff --git a/module/spring-boot-cloudfoundry/src/main/java/org/springframework/boot/cloudfoundry/autoconfigure/actuate/endpoint/servlet/SecurityService.java b/module/spring-boot-cloudfoundry/src/main/java/org/springframework/boot/cloudfoundry/autoconfigure/actuate/endpoint/servlet/SecurityService.java
index 9078796dbef..6ec4cd96a8b 100644
--- a/module/spring-boot-cloudfoundry/src/main/java/org/springframework/boot/cloudfoundry/autoconfigure/actuate/endpoint/servlet/SecurityService.java
+++ b/module/spring-boot-cloudfoundry/src/main/java/org/springframework/boot/cloudfoundry/autoconfigure/actuate/endpoint/servlet/SecurityService.java
@@ -118,6 +118,7 @@ class SecurityService {
 		Assert.state(keys != null, "'keys' must not be null");
 		for (Object key : keys) {
 			Map<?, ?> tokenKey = (Map<?, ?>) key;
+			Assert.state(tokenKey != null, "'tokenKey' must not be null");
 			tokenKeys.put((String) tokenKey.get("kid"), (String) tokenKey.get("value"));
 		}
 		return tokenKeys;