diff --git a/.github/workflows/maven-build.yml b/.github/workflows/maven-build.yml
index abcec091..9933e1a7 100644
--- a/.github/workflows/maven-build.yml
+++ b/.github/workflows/maven-build.yml
@@ -5,6 +5,7 @@ env:
   JAVA_TOOL_OPTIONS: >-
     -XX:TieredStopAtLevel=1
     -XX:+UseParallelGC
+    --illegal-access=deny
 
 jobs:
   build:
diff --git a/.mvn/jvm.config b/.mvn/jvm.config
new file mode 100644
index 00000000..c155c15e
--- /dev/null
+++ b/.mvn/jvm.config
@@ -0,0 +1 @@
+--add-opens java.base/java.lang=ALL-UNNAMED
diff --git a/README.md b/README.md
index c3a73ab0..f151cd28 100644
--- a/README.md
+++ b/README.md
@@ -9,6 +9,27 @@ This plugin provides the ability to use
 [ktlint](https://github.com/pinterest/ktlint) to format and check your source
 code against the ktlint anti-bikeshedding code style.
 
+## Using Java 17 and later
+
+Java 17 is the first LTS release to enforce strong encapsulation. For `ktlint`
+to work we need to add `--add-opens java.base/java.lang=ALL-UNNAMED` to the JVM
+arguments.
+
+We recommend that you add a `.mvn/jvm.config` file (relative to the top level
+project directory) to all of your projects using this plugin. The file should
+have the following contents:
+
+```
+--add-opens java.base/java.lang=ALL-UNNAMED
+```
+
+We also recommend adding this to all of your projects using this plugin and
+building with Java 11, as it'll suppress an illegal-access warning during the
+build.
+
+For other options see:
+[https://maven.apache.org/configure.html](https://maven.apache.org/configure.html)
+
 ## Goals Overview
 
   * [ktlint:format](http://gantsign.com/ktlint-maven-plugin/format-mojo.html)
diff --git a/src/it/check/.mvn/jvm.config b/src/it/check/.mvn/jvm.config
new file mode 100644
index 00000000..c155c15e
--- /dev/null
+++ b/src/it/check/.mvn/jvm.config
@@ -0,0 +1 @@
+--add-opens java.base/java.lang=ALL-UNNAMED
diff --git a/src/it/checkstyle/.mvn/jvm.config b/src/it/checkstyle/.mvn/jvm.config
new file mode 100644
index 00000000..c155c15e
--- /dev/null
+++ b/src/it/checkstyle/.mvn/jvm.config
@@ -0,0 +1 @@
+--add-opens java.base/java.lang=ALL-UNNAMED
diff --git a/src/it/format/.mvn/jvm.config b/src/it/format/.mvn/jvm.config
new file mode 100644
index 00000000..c155c15e
--- /dev/null
+++ b/src/it/format/.mvn/jvm.config
@@ -0,0 +1 @@
+--add-opens java.base/java.lang=ALL-UNNAMED
diff --git a/src/it/report/.mvn/jvm.config b/src/it/report/.mvn/jvm.config
new file mode 100644
index 00000000..c155c15e
--- /dev/null
+++ b/src/it/report/.mvn/jvm.config
@@ -0,0 +1 @@
+--add-opens java.base/java.lang=ALL-UNNAMED