diff --git a/.gitignore b/.gitignore
index d005c66..4adb35a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,4 @@
 jsr-305-0.4.20090319.tar.xz
 /jsr-305-20130910svn.tgz
 /jsr-305-3.0.2.tar.gz
+/jcip-annotations-1.0-1.tar.gz
diff --git a/jsr-305.spec b/jsr-305.spec
index 13f539c..382d93b 100644
--- a/jsr-305.spec
+++ b/jsr-305.spec
@@ -5,17 +5,16 @@ Version:        3.0.2
 Release:        14%{?dist}
 Summary:        Correctness annotations for Java code
 
-# The majority of code is BSD-licensed, but some Java sources
-# are licensed under CC-BY license, see: $ grep -r Creative .
-License:        BSD-3-Clause AND CC-BY-2.5
+# The majority of code is BSD-licensed.
+# JCIP annotations are Apache-licensed.
+License:        BSD-3-Clause AND Apache-2.0
 URL:            https://code.google.com/p/jsr-305
 BuildArch:      noarch
 ExclusiveArch:  %{java_arches} noarch
 
 # ./generate-tarball.sh
 Source0:        %{name}-%{version}.tar.gz
-# File containing URL to CC-BY license text
-Source1:        NOTICE-CC-BY.txt
+Source1:        https://github.com/stephenc/jcip-annotations/archive/refs/tags/jcip-annotations-1.0-1.tar.gz
 
 %if %{with bootstrap}
 BuildRequires:  javapackages-bootstrap
@@ -33,7 +32,15 @@ Detection.
 
 %prep
 %setup -q
-cp %{SOURCE1} NOTICE-CC-BY
+
+# Replace javax.annotation.concurrent annotations (that are based on
+# code from https://jcip.net/ and are licensed under CC-BY-2.5, which
+# is not Fedora-approved for code) with a clean-room implementation
+# under Apache-2.0 from https://github.com/stephenc/jcip-annotations
+tar xf %{SOURCE1}
+rm -rf ri/src/main/java/javax/annotation/concurrent
+mv jcip-annotations-jcip-annotations-1.0-1/src/main/java/net/jcip/annotations ri/src/main/java/javax/annotation/concurrent
+sed -i /^package/s/net.jcip.annotations/javax.annotation.concurrent/ ri/src/main/java/javax/annotation/concurrent/*
 
 %pom_xpath_set "pom:plugin[pom:artifactId='maven-compiler-plugin']/pom:configuration/*" 1.8
 %pom_remove_plugin :maven-compiler-plugin ri
@@ -63,7 +70,7 @@ sed -i 's|<artifactId>jsr305</artifactId>|<artifactId>ri</artifactId>|' ri/pom.x
 %mvn_install
 
 %files -f .mfiles
-%license ri/LICENSE NOTICE-CC-BY
+%license ri/LICENSE jcip-annotations-jcip-annotations-1.0-1/LICENSE.txt
 %doc sampleUses
 
 %changelog
diff --git a/sources b/sources
index 27a2250..5cb9d46 100644
--- a/sources
+++ b/sources
@@ -1 +1,2 @@
 SHA512 (jsr-305-3.0.2.tar.gz) = 378df0a3bb91d6ebf2e1673ff09e9c416734508a724c772834bed8d15d158d844c437ed126b2b8602997a3241cf2487b8bae9d00aa0cabe6464cebaf25bbcaeb
+SHA512 (jcip-annotations-1.0-1.tar.gz) = 22eb285a445b25a718846dad45581dbe7a324a2d670bd05f4b2aa5e850ae34af6bcedbf143e17a7cd6cf7e510e0dd447992ba1d5316432e8a8db5584a1e1973e