diff --git a/docs/KNOWN-ISSUES.md b/docs/KNOWN-ISSUES.md
index 24ed73a..b719808 100644
--- a/docs/KNOWN-ISSUES.md
+++ b/docs/KNOWN-ISSUES.md
@@ -19,12 +19,11 @@
 
 ## Java
 
-*   Tink supports Java 7 or newer. Please file a ticket if you want to support
-    Java 6.
+*   Tink supports Java 8 or newer. Java 7 support was removed since 1.4.0.
 
-*   Tink is built on top of Java security providers, but, via [Project
-    Wycheproof](https://github.com/google/wycheproof), we found many security
-    issues in popular providers. Tink provides countermeasures for most
+*   Tink is built on top of Java security providers, but, via
+    [Project Wycheproof](https://github.com/google/wycheproof), we found many
+    security issues in popular providers. Tink provides countermeasures for most
     problems, and we've also helped upstream fix many issues. Still, there are
     some issues in old providers that we cannot fix. We recommend use Tink with
     the latest version of Conscrypt, Oracle JDK, OpenJDK or Bouncy Castle. If
diff --git a/docs/TINKEY.md b/docs/TINKEY.md
index 7408a01..2426262 100644
--- a/docs/TINKEY.md
+++ b/docs/TINKEY.md
@@ -5,7 +5,14 @@
 (KMS). Out of the box it supports AWS KMS and Google Cloud KMS. Adding support
 for other KMS is easy, and doesn't require modifying Tinkey.
 
-## Build
+## Install with Homebrew
+
+```sh
+brew tap google/tink https://github.com/google/tink
+brew install tinkey
+```
+
+## Build from source
 
 -   Install [Bazel](https://docs.bazel.build/versions/master/install.html)
 
diff --git a/java_src/src/main/java/com/google/crypto/tink/BUILD.bazel b/java_src/src/main/java/com/google/crypto/tink/BUILD.bazel
index d26eb3b..aaa475d 100644
--- a/java_src/src/main/java/com/google/crypto/tink/BUILD.bazel
+++ b/java_src/src/main/java/com/google/crypto/tink/BUILD.bazel
@@ -1,4 +1,3 @@
-load("//tools/build_defs:javac.bzl", "JAVACOPTS_OSS")
 load("@build_bazel_rules_android//android:rules.bzl", "android_library")
 load("@tink_base//:tink_version.bzl", "TINK_VERSION_LABEL")
 load("@tink_base//tools:common.bzl", "template_rule")
@@ -587,7 +586,6 @@
 java_library(
     name = "primitives",
     srcs = PRIMITIVES_SRCS,
-    javacopts = JAVACOPTS_OSS,
     visibility = ["//visibility:public"],
 )
 
@@ -648,7 +646,6 @@
             "TextFormatKeysetWriters.java",
         ],
     ) + [":version_java"],
-    javacopts = JAVACOPTS_OSS,
     visibility = ["//visibility:public"],
     deps = lite_protos + [
         ":primitives",
@@ -676,7 +673,6 @@
     srcs = [
         ":cleartext_keyset_handle_srcs",
     ],
-    javacopts = JAVACOPTS_OSS,
     deps = lite_protos + [
         ":android",
         "@com_google_protobuf//:protobuf_javalite",
diff --git a/java_src/src/main/java/com/google/crypto/tink/StreamingAead.java b/java_src/src/main/java/com/google/crypto/tink/StreamingAead.java
index 2511084..6805870 100644
--- a/java_src/src/main/java/com/google/crypto/tink/StreamingAead.java
+++ b/java_src/src/main/java/com/google/crypto/tink/StreamingAead.java
@@ -150,9 +150,9 @@
    *       <li>{@code long size()} Returns the size of the plaintext. TODO: Decide whether the
    *           result should be authenticated)
    *       <li>{@code SeekableByteChannel truncate(long size)} throws {@link
-   *           NonWritableChannelException} because the channel is read-only.
-   *       <li>{@code int write(ByteBuffer src)} throws {@link NonWritableChannelException} because
-   *           the channel is read-only.
+   *           java.nio.channels.NonWritableChannelException } because the channel is read-only.
+   *       <li>{@code int write(ByteBuffer src)} throws {@link
+   *           java.nio.channels.NonWritableChannelException } because the channel is read-only.
    *       <li>{@code close()} closes the channel
    *       <li>{@code isOpen()}
    *     </ul>
diff --git a/java_src/src/main/java/com/google/crypto/tink/aead/BUILD.bazel b/java_src/src/main/java/com/google/crypto/tink/aead/BUILD.bazel
index fed96bd..faefc18 100644
--- a/java_src/src/main/java/com/google/crypto/tink/aead/BUILD.bazel
+++ b/java_src/src/main/java/com/google/crypto/tink/aead/BUILD.bazel
@@ -1,4 +1,3 @@
-load("//tools/build_defs:javac.bzl", "JAVACOPTS_OSS")
 load("@build_bazel_rules_android//android:rules.bzl", "android_library")
 
 licenses(["notice"])
@@ -483,7 +482,6 @@
 java_library(
     name = "aead",
     srcs = [":srcs"],
-    javacopts = JAVACOPTS_OSS,
     visibility = ["//visibility:public"],
     deps = full_protos + [
         "//src/main/java/com/google/crypto/tink",
@@ -498,7 +496,6 @@
 java_library(
     name = "android",
     srcs = [":srcs"],
-    javacopts = JAVACOPTS_OSS,
     visibility = ["//visibility:public"],
     deps = lite_protos + [
         "//src/main/java/com/google/crypto/tink:android",
diff --git a/java_src/src/main/java/com/google/crypto/tink/aead/subtle/BUILD.bazel b/java_src/src/main/java/com/google/crypto/tink/aead/subtle/BUILD.bazel
index 2f82d99..b5e1fe0 100644
--- a/java_src/src/main/java/com/google/crypto/tink/aead/subtle/BUILD.bazel
+++ b/java_src/src/main/java/com/google/crypto/tink/aead/subtle/BUILD.bazel
@@ -1,5 +1,3 @@
-load("//tools/build_defs:javac.bzl", "JAVACOPTS_OSS")
-
 licenses(["notice"])
 
 package(default_visibility = ["//:__subpackages__"])
@@ -7,7 +5,6 @@
 java_library(
     name = "aead_factory",
     srcs = ["AeadFactory.java"],
-    javacopts = JAVACOPTS_OSS,
     deps = [
         "//src/main/java/com/google/crypto/tink:aead",
         "@maven//:com_google_errorprone_error_prone_annotations",
@@ -17,7 +14,6 @@
 java_library(
     name = "aes_gcm_factory",
     srcs = ["AesGcmFactory.java"],
-    javacopts = JAVACOPTS_OSS,
     deps = [
         ":aead_factory",
         "//src/main/java/com/google/crypto/tink:aead",
diff --git a/java_src/src/main/java/com/google/crypto/tink/annotations/BUILD.bazel b/java_src/src/main/java/com/google/crypto/tink/annotations/BUILD.bazel
index 44c5b41..812fc38 100644
--- a/java_src/src/main/java/com/google/crypto/tink/annotations/BUILD.bazel
+++ b/java_src/src/main/java/com/google/crypto/tink/annotations/BUILD.bazel
@@ -1,5 +1,3 @@
-load("//tools/build_defs:javac.bzl", "JAVACOPTS_OSS")
-
 licenses(["notice"])
 
 package(default_visibility = ["//visibility:public"])
@@ -16,5 +14,4 @@
     srcs = glob([
         "*.java",
     ]),
-    javacopts = JAVACOPTS_OSS,
 )
diff --git a/java_src/src/main/java/com/google/crypto/tink/config/BUILD.bazel b/java_src/src/main/java/com/google/crypto/tink/config/BUILD.bazel
index 3d4f4e2..d14d203 100644
--- a/java_src/src/main/java/com/google/crypto/tink/config/BUILD.bazel
+++ b/java_src/src/main/java/com/google/crypto/tink/config/BUILD.bazel
@@ -1,4 +1,3 @@
-load("//tools/build_defs:javac.bzl", "JAVACOPTS_OSS")
 load("@build_bazel_rules_android//android:rules.bzl", "android_library")
 
 licenses(["notice"])
@@ -45,7 +44,6 @@
 java_library(
     name = "config",
     srcs = [":srcs"],
-    javacopts = JAVACOPTS_OSS,
     visibility = ["//visibility:public"],
     deps = [
         "//proto:config_java_proto",
@@ -60,7 +58,6 @@
 java_library(
     name = "android",
     srcs = [":srcs"],
-    javacopts = JAVACOPTS_OSS,
     visibility = ["//visibility:public"],
     deps = [
         "//proto:config_java_proto_lite",
diff --git a/java_src/src/main/java/com/google/crypto/tink/daead/BUILD.bazel b/java_src/src/main/java/com/google/crypto/tink/daead/BUILD.bazel
index ea0d75d..4dd54ae 100644
--- a/java_src/src/main/java/com/google/crypto/tink/daead/BUILD.bazel
+++ b/java_src/src/main/java/com/google/crypto/tink/daead/BUILD.bazel
@@ -1,4 +1,3 @@
-load("//tools/build_defs:javac.bzl", "JAVACOPTS_OSS")
 load("@build_bazel_rules_android//android:rules.bzl", "android_library")
 
 licenses(["notice"])
@@ -157,7 +156,6 @@
 java_library(
     name = "daead",
     srcs = [":srcs"],
-    javacopts = JAVACOPTS_OSS,
     visibility = ["//visibility:public"],
     deps = full_protos + [
         "//src/main/java/com/google/crypto/tink",
@@ -170,7 +168,6 @@
 java_library(
     name = "android",
     srcs = [":srcs"],
-    javacopts = JAVACOPTS_OSS,
     visibility = ["//visibility:public"],
     deps = lite_protos + [
         "//src/main/java/com/google/crypto/tink:android",
diff --git a/java_src/src/main/java/com/google/crypto/tink/hybrid/BUILD.bazel b/java_src/src/main/java/com/google/crypto/tink/hybrid/BUILD.bazel
index 5c4cd56..b02c2a6 100644
--- a/java_src/src/main/java/com/google/crypto/tink/hybrid/BUILD.bazel
+++ b/java_src/src/main/java/com/google/crypto/tink/hybrid/BUILD.bazel
@@ -1,4 +1,3 @@
-load("//tools/build_defs:javac.bzl", "JAVACOPTS_OSS")
 load("@build_bazel_rules_android//android:rules.bzl", "android_library")
 
 licenses(["notice"])
@@ -371,7 +370,6 @@
     srcs = [
         ":srcs",
     ],
-    javacopts = JAVACOPTS_OSS,
     visibility = ["//visibility:public"],
     deps = full_protos + [
         "//src/main/java/com/google/crypto/tink",
@@ -388,7 +386,6 @@
     srcs = [
         ":srcs",
     ],
-    javacopts = JAVACOPTS_OSS,
     visibility = ["//visibility:public"],
     deps = lite_protos + [
         "//src/main/java/com/google/crypto/tink:android",
diff --git a/java_src/src/main/java/com/google/crypto/tink/integration/android/AndroidKeystoreKmsClient.java b/java_src/src/main/java/com/google/crypto/tink/integration/android/AndroidKeystoreKmsClient.java
index 31924ba..8f79157 100644
--- a/java_src/src/main/java/com/google/crypto/tink/integration/android/AndroidKeystoreKmsClient.java
+++ b/java_src/src/main/java/com/google/crypto/tink/integration/android/AndroidKeystoreKmsClient.java
@@ -57,7 +57,7 @@
    * Constructs an {@link AndroidKeystoreKmsClient} that is bound to a single key identified by
    * {@code uri}.
    *
-   * @deprecated use {@link AndroidKeystoreKmsClient#Builder}.
+   * @deprecated use {@link AndroidKeystoreKmsClient.Builder}.
    */
   @Deprecated
   public AndroidKeystoreKmsClient(String uri) {
diff --git a/java_src/src/main/java/com/google/crypto/tink/mac/BUILD.bazel b/java_src/src/main/java/com/google/crypto/tink/mac/BUILD.bazel
index 719c12b..a6d2492 100644
--- a/java_src/src/main/java/com/google/crypto/tink/mac/BUILD.bazel
+++ b/java_src/src/main/java/com/google/crypto/tink/mac/BUILD.bazel
@@ -1,4 +1,3 @@
-load("//tools/build_defs:javac.bzl", "JAVACOPTS_OSS")
 load("@build_bazel_rules_android//android:rules.bzl", "android_library")
 
 licenses(["notice"])
@@ -207,7 +206,6 @@
 java_library(
     name = "mac",
     srcs = [":srcs"],
-    javacopts = JAVACOPTS_OSS,
     visibility = ["//visibility:public"],
     deps = full_protos + [
         "//src/main/java/com/google/crypto/tink",
@@ -220,7 +218,6 @@
 java_library(
     name = "android",
     srcs = [":srcs"],
-    javacopts = JAVACOPTS_OSS,
     visibility = ["//visibility:public"],
     deps = lite_protos + [
         "//src/main/java/com/google/crypto/tink:android",
diff --git a/java_src/src/main/java/com/google/crypto/tink/prf/BUILD.bazel b/java_src/src/main/java/com/google/crypto/tink/prf/BUILD.bazel
index a626133..3ad8243 100644
--- a/java_src/src/main/java/com/google/crypto/tink/prf/BUILD.bazel
+++ b/java_src/src/main/java/com/google/crypto/tink/prf/BUILD.bazel
@@ -1,5 +1,3 @@
-load("//tools/build_defs:javac.bzl", "JAVACOPTS_OSS")
-
 licenses(["notice"])
 
 package(default_visibility = ["//visibility:public"])
@@ -7,7 +5,6 @@
 java_library(
     name = "hkdf_prf_key_manager",
     srcs = ["HkdfPrfKeyManager.java"],
-    javacopts = JAVACOPTS_OSS,
     deps = [
         ":prf_set",
         "//proto:common_java_proto",
@@ -29,7 +26,6 @@
 java_library(
     name = "prf_key_templates",
     srcs = ["PrfKeyTemplates.java"],
-    javacopts = JAVACOPTS_OSS,
     visibility = ["//visibility:public"],
     deps = [
         ":hkdf_prf_key_manager",
@@ -42,7 +38,6 @@
 java_library(
     name = "prf_config",
     srcs = ["PrfConfig.java"],
-    javacopts = JAVACOPTS_OSS,
     deps = [
         ":hkdf_prf_key_manager",
         ":prf_set_wrapper",
@@ -55,7 +50,6 @@
         "Prf.java",
         "PrfSet.java",
     ],
-    javacopts = JAVACOPTS_OSS,
     visibility = ["//visibility:public"],
     deps = [
         "@maven//:com_google_errorprone_error_prone_annotations",
@@ -67,7 +61,6 @@
     srcs = [
         "PrfSetWrapper.java",
     ],
-    javacopts = JAVACOPTS_OSS,
     visibility = ["//visibility:public"],
     deps = [
         ":prf_set",
@@ -82,7 +75,6 @@
 java_library(
     name = "hkdf_prf_key_manager-android",
     srcs = ["HkdfPrfKeyManager.java"],
-    javacopts = JAVACOPTS_OSS,
     deps = [
         ":prf_set",
         "//proto:common_java_proto_lite",
@@ -104,7 +96,6 @@
 java_library(
     name = "prf_key_templates-android",
     srcs = ["PrfKeyTemplates.java"],
-    javacopts = JAVACOPTS_OSS,
     deps = [
         ":hkdf_prf_key_manager-android",
         "//proto:common_java_proto_lite",
@@ -116,7 +107,6 @@
 java_library(
     name = "prf_config-android",
     srcs = ["PrfConfig.java"],
-    javacopts = JAVACOPTS_OSS,
     deps = [
         ":hkdf_prf_key_manager-android",
         ":prf_set_wrapper-android",
@@ -126,7 +116,6 @@
 java_library(
     name = "prf_set_wrapper-android",
     srcs = ["PrfSetWrapper.java"],
-    javacopts = JAVACOPTS_OSS,
     deps = [
         ":prf_set",
         "//proto:tink_java_proto_lite",
diff --git a/java_src/src/main/java/com/google/crypto/tink/signature/BUILD.bazel b/java_src/src/main/java/com/google/crypto/tink/signature/BUILD.bazel
index 05c684f..592d22d 100644
--- a/java_src/src/main/java/com/google/crypto/tink/signature/BUILD.bazel
+++ b/java_src/src/main/java/com/google/crypto/tink/signature/BUILD.bazel
@@ -1,4 +1,3 @@
-load("//tools/build_defs:javac.bzl", "JAVACOPTS_OSS")
 load("@build_bazel_rules_android//android:rules.bzl", "android_library")
 
 licenses(["notice"])
@@ -605,7 +604,6 @@
 java_library(
     name = "signature",
     srcs = [":srcs"],
-    javacopts = JAVACOPTS_OSS,
     visibility = ["//visibility:public"],
     deps = full_protos + [
         "//src/main/java/com/google/crypto/tink",
@@ -619,7 +617,6 @@
 java_library(
     name = "android",
     srcs = [":srcs"],
-    javacopts = JAVACOPTS_OSS,
     visibility = ["//visibility:public"],
     deps = lite_protos + [
         "//src/main/java/com/google/crypto/tink:android",
diff --git a/java_src/src/main/java/com/google/crypto/tink/streamingaead/BUILD.bazel b/java_src/src/main/java/com/google/crypto/tink/streamingaead/BUILD.bazel
index 4be763e..937939e 100644
--- a/java_src/src/main/java/com/google/crypto/tink/streamingaead/BUILD.bazel
+++ b/java_src/src/main/java/com/google/crypto/tink/streamingaead/BUILD.bazel
@@ -1,4 +1,3 @@
-load("//tools/build_defs:javac.bzl", "JAVACOPTS_OSS")
 load("@build_bazel_rules_android//android:rules.bzl", "android_library")
 
 licenses(["notice"])
@@ -313,7 +312,6 @@
 java_library(
     name = "streamingaead",
     srcs = [":srcs"],
-    javacopts = JAVACOPTS_OSS,
     visibility = ["//visibility:public"],
     deps = full_protos + [
         "//src/main/java/com/google/crypto/tink",
@@ -327,7 +325,6 @@
 java_library(
     name = "android",
     srcs = [":srcs"],
-    javacopts = JAVACOPTS_OSS,
     visibility = ["//visibility:public"],
     deps = lite_protos + [
         "//src/main/java/com/google/crypto/tink:android",
diff --git a/java_src/src/main/java/com/google/crypto/tink/subtle/BUILD.bazel b/java_src/src/main/java/com/google/crypto/tink/subtle/BUILD.bazel
index d71f0c9..14ed688 100644
--- a/java_src/src/main/java/com/google/crypto/tink/subtle/BUILD.bazel
+++ b/java_src/src/main/java/com/google/crypto/tink/subtle/BUILD.bazel
@@ -1,5 +1,3 @@
-load("//tools/build_defs:javac.bzl", "JAVACOPTS_OSS")
-
 licenses(["notice"])
 
 package(default_visibility = ["//visibility:public"])
@@ -524,7 +522,6 @@
         "SubtleUtil.java",
         "Validators.java",
     ],
-    javacopts = JAVACOPTS_OSS,
 )
 
 # aead subtle
@@ -545,7 +542,6 @@
         "XChaCha20.java",
         "XChaCha20Poly1305.java",
     ],
-    javacopts = JAVACOPTS_OSS,
     deps = [
         ":mac",
         ":subtle",
@@ -560,7 +556,6 @@
     srcs = [
         "AesSiv.java",
     ],
-    javacopts = JAVACOPTS_OSS,
     deps = [
         ":mac",
         ":subtle",
@@ -578,7 +573,6 @@
         "PrfHmacJce.java",
         "PrfMac.java",
     ],
-    javacopts = JAVACOPTS_OSS,
     deps = [
         ":subtle",
         "//src/main/java/com/google/crypto/tink:primitives",
@@ -604,7 +598,6 @@
         "RsaSsaPssSignJce.java",
         "RsaSsaPssVerifyJce.java",
     ],
-    javacopts = JAVACOPTS_OSS,
     deps = [
         ":curve25519",
         ":subtle",
@@ -625,7 +618,6 @@
         "EciesHkdfSenderKem.java",
         "Hkdf.java",
     ],
-    javacopts = JAVACOPTS_OSS,
     deps = [
         ":subtle",
         "//src/main/java/com/google/crypto/tink:primitives",
@@ -650,7 +642,6 @@
         "StreamingAeadEncryptingStream.java",
         "StreamingAeadSeekableDecryptingChannel.java",
     ],
-    javacopts = JAVACOPTS_OSS,
     deps = [
         ":subtle",
         "//src/main/java/com/google/crypto/tink:primitives",
@@ -664,7 +655,6 @@
     srcs = [
         "Kwp.java",
     ],
-    javacopts = JAVACOPTS_OSS,
     deps = [
         ":subtle",
         "//src/main/java/com/google/crypto/tink:primitives",
diff --git a/java_src/src/main/java/com/google/crypto/tink/subtle/prf/BUILD.bazel b/java_src/src/main/java/com/google/crypto/tink/subtle/prf/BUILD.bazel
index ce3c182..159b5c2 100644
--- a/java_src/src/main/java/com/google/crypto/tink/subtle/prf/BUILD.bazel
+++ b/java_src/src/main/java/com/google/crypto/tink/subtle/prf/BUILD.bazel
@@ -1,12 +1,9 @@
-load("//tools/build_defs:javac.bzl", "JAVACOPTS_OSS")
-
 licenses(["notice"])
 
 package(default_visibility = ["//visibility:public"])
 
 java_library(
     name = "prf",
-    javacopts = JAVACOPTS_OSS,
     exports = [
         ":hkdf_streaming_prf",
         ":streaming_prf",
@@ -16,7 +13,6 @@
 java_library(
     name = "streaming_prf",
     srcs = ["StreamingPrf.java"],
-    javacopts = JAVACOPTS_OSS,
     deps = [
         "@maven//:com_google_errorprone_error_prone_annotations",
     ],
@@ -35,7 +31,6 @@
 java_library(
     name = "hkdf_streaming_prf",
     srcs = ["HkdfStreamingPrf.java"],
-    javacopts = JAVACOPTS_OSS,
     deps = [
         ":streaming_prf",
         "//src/main/java/com/google/crypto/tink/subtle",
diff --git a/java_src/src/main/java/com/google/crypto/tink/testing/BUILD.bazel b/java_src/src/main/java/com/google/crypto/tink/testing/BUILD.bazel
index 68b9276..9073f75 100644
--- a/java_src/src/main/java/com/google/crypto/tink/testing/BUILD.bazel
+++ b/java_src/src/main/java/com/google/crypto/tink/testing/BUILD.bazel
@@ -1,5 +1,3 @@
-load("//tools/build_defs:javac.bzl", "JAVACOPTS_OSS")
-
 licenses(["notice"])
 
 package(
@@ -10,7 +8,6 @@
 java_library(
     name = "test_util",
     srcs = ["TestUtil.java"],
-    javacopts = JAVACOPTS_OSS,
     visibility = ["//visibility:public"],
     deps = [
         "//proto:aes_ctr_hmac_aead_java_proto",
@@ -50,7 +47,6 @@
 java_library(
     name = "test_util-android",
     srcs = ["TestUtil.java"],
-    javacopts = JAVACOPTS_OSS,
     deps = [
         "//proto:aes_ctr_hmac_aead_java_proto_lite",
         "//proto:aes_ctr_hmac_streaming_java_proto_lite",
@@ -89,7 +85,6 @@
 java_library(
     name = "streaming_test_util",
     srcs = ["StreamingTestUtil.java"],
-    javacopts = JAVACOPTS_OSS,
     deps = [
         ":test_util",
         "//src/main/java/com/google/crypto/tink:streaming_aead",
@@ -101,7 +96,6 @@
 java_library(
     name = "streaming_test_util-android",
     srcs = ["StreamingTestUtil.java"],
-    javacopts = JAVACOPTS_OSS,
     deps = [
         ":test_util-android",
         "//src/main/java/com/google/crypto/tink:streaming_aead",
@@ -113,7 +107,6 @@
 java_library(
     name = "key_type_manager_test_util",
     srcs = ["KeyTypeManagerTestUtil.java"],
-    javacopts = JAVACOPTS_OSS,
     deps = [
         "//src/main/java/com/google/crypto/tink:key_template",
         "//src/main/java/com/google/crypto/tink:key_type_manager",
@@ -125,7 +118,6 @@
 java_library(
     name = "key_type_manager_test_util-android",
     srcs = ["KeyTypeManagerTestUtil.java"],
-    javacopts = JAVACOPTS_OSS,
     deps = [
         "//src/main/java/com/google/crypto/tink:key_template-android",
         "//src/main/java/com/google/crypto/tink:key_type_manager-android",
@@ -137,7 +129,6 @@
 java_library(
     name = "wycheproof_test_util",
     srcs = ["WycheproofTestUtil.java"],
-    javacopts = JAVACOPTS_OSS,
     deps = [
         ":test_util",
         "//src/main/java/com/google/crypto/tink/subtle:elliptic_curves",
@@ -149,7 +140,6 @@
 java_library(
     name = "wycheproof_test_util-android",
     srcs = ["WycheproofTestUtil.java"],
-    javacopts = JAVACOPTS_OSS,
     deps = [
         ":test_util-android",
         "//src/main/java/com/google/crypto/tink/subtle:elliptic_curves",
diff --git a/java_src/src/main/java/com/google/crypto/tink/util/BUILD.bazel b/java_src/src/main/java/com/google/crypto/tink/util/BUILD.bazel
index b54518e..99143a4 100644
--- a/java_src/src/main/java/com/google/crypto/tink/util/BUILD.bazel
+++ b/java_src/src/main/java/com/google/crypto/tink/util/BUILD.bazel
@@ -1,5 +1,4 @@
 load("@build_bazel_rules_android//android:rules.bzl", "android_library")
-load("//tools/build_defs:javac.bzl", "JAVACOPTS_OSS")
 
 licenses(["notice"])
 
@@ -41,7 +40,6 @@
     srcs = [
         ":srcs",
     ],
-    javacopts = JAVACOPTS_OSS,
     deps = [
         "@maven//:com_google_code_findbugs_jsr305",
         "@maven//:com_google_http_client_google_http_client",
diff --git a/java_src/tools/build_defs/javac.bzl b/java_src/tools/build_defs/javac.bzl
deleted file mode 100644
index 9a37c80..0000000
--- a/java_src/tools/build_defs/javac.bzl
+++ /dev/null
@@ -1,12 +0,0 @@
-"""Build definitions for javac related operations in tink."""
-
-SOURCE_7_TARGET_7 = [
-    "-source 1.7",
-    "-target 1.7",
-]
-
-JAVACOPTS = []
-
-# Compile Tink open source with java 7 and produce java 7 bytecode.
-# This ensures that Tink doesn't use non-java 7 features.
-JAVACOPTS_OSS = SOURCE_7_TARGET_7
diff --git a/java_src/tools/gen_maven_jar_rules.bzl b/java_src/tools/gen_maven_jar_rules.bzl
index fe402bf..8744f7f 100644
--- a/java_src/tools/gen_maven_jar_rules.bzl
+++ b/java_src/tools/gen_maven_jar_rules.bzl
@@ -17,7 +17,7 @@
 load("//tools:javadoc.bzl", "javadoc_library")
 
 _EXTERNAL_JAVADOC_LINKS = [
-    "https://docs.oracle.com/javase/7/docs/api/",
+    "https://docs.oracle.com/javase/8/docs/api/",
     "https://developer.android.com/reference/",
 ]
 
diff --git a/maven/apps-paymentmethodtoken.pom.xml b/maven/apps-paymentmethodtoken.pom.xml
index dc68678..cd377e8 100644
--- a/maven/apps-paymentmethodtoken.pom.xml
+++ b/maven/apps-paymentmethodtoken.pom.xml
@@ -62,7 +62,7 @@
   </scm>
 
   <properties>
-    <java.version>1.7</java.version>
+    <java.version>1.8</java.version>
 
     <!-- library versions -->
     <google-api-client.version>1.22.0</google-api-client.version>
diff --git a/maven/apps-rewardedads.pom.xml b/maven/apps-rewardedads.pom.xml
index a926f46..85686e1 100644
--- a/maven/apps-rewardedads.pom.xml
+++ b/maven/apps-rewardedads.pom.xml
@@ -62,7 +62,7 @@
   </scm>
 
   <properties>
-    <java.version>1.7</java.version>
+    <java.version>1.8</java.version>
 
     <!-- library versions -->
     <google-api-client.version>1.22.0</google-api-client.version>
diff --git a/maven/apps-webpush.pom.xml b/maven/apps-webpush.pom.xml
index fc2a849..9a18176 100644
--- a/maven/apps-webpush.pom.xml
+++ b/maven/apps-webpush.pom.xml
@@ -62,7 +62,7 @@
   </scm>
 
   <properties>
-    <java.version>1.7</java.version>
+    <java.version>1.8</java.version>
   </properties>
 
   <dependencies>
diff --git a/maven/tink-android.pom.xml b/maven/tink-android.pom.xml
index 91bb62c..f27ac5f 100644
--- a/maven/tink-android.pom.xml
+++ b/maven/tink-android.pom.xml
@@ -62,6 +62,6 @@
   </scm>
 
   <properties>
-    <java.version>1.7</java.version>
+    <java.version>1.8</java.version>
   </properties>
 </project>
diff --git a/maven/tink-awskms.pom.xml b/maven/tink-awskms.pom.xml
index 893071f..9f04d9d 100644
--- a/maven/tink-awskms.pom.xml
+++ b/maven/tink-awskms.pom.xml
@@ -61,7 +61,7 @@
   </scm>
 
   <properties>
-    <java.version>1.7</java.version>
+    <java.version>1.8</java.version>
 
     <aws-java-sdk-core.version>1.11.563</aws-java-sdk-core.version>
     <aws-java-sdk-kms.version>1.11.563</aws-java-sdk-kms.version>
diff --git a/maven/tink-gcpkms.pom.xml b/maven/tink-gcpkms.pom.xml
index b7672c2..ce03087 100644
--- a/maven/tink-gcpkms.pom.xml
+++ b/maven/tink-gcpkms.pom.xml
@@ -61,7 +61,7 @@
   </scm>
 
   <properties>
-    <java.version>1.7</java.version>
+    <java.version>1.8</java.version>
 
     <google-api-client.version>1.29.0</google-api-client.version>
     <google-api-services-cloudkms.version>v1-rev88-1.25.0</google-api-services-cloudkms.version>
diff --git a/maven/tink.pom.xml b/maven/tink.pom.xml
index 4872218..08dd239 100644
--- a/maven/tink.pom.xml
+++ b/maven/tink.pom.xml
@@ -62,7 +62,7 @@
   </scm>
 
   <properties>
-    <java.version>1.7</java.version>
+    <java.version>1.8</java.version>
 
     <json.version>20180813</json.version>
     <protobuf.version>3.11.1</protobuf.version>
diff --git a/testing/java_src/BUILD.bazel b/testing/java_src/BUILD.bazel
index 31d2263..4ce93b8 100644
--- a/testing/java_src/BUILD.bazel
+++ b/testing/java_src/BUILD.bazel
@@ -1,4 +1,3 @@
-load("@tink_java//tools/build_defs:javac.bzl", "JAVACOPTS_OSS")
 load("@io_grpc_grpc_java//:java_grpc_library.bzl", "java_grpc_library")
 
 package(default_visibility = ["//visibility:public"])
@@ -31,7 +30,6 @@
         "java/com/google/crypto/tink/testing/SignatureServiceImpl.java",
         "java/com/google/crypto/tink/testing/StreamingAeadServiceImpl.java",
     ],
-    javacopts = JAVACOPTS_OSS,
     deps = [
         ":testing_api_java_grpc",
         ":testing_api_java_proto",
@@ -53,7 +51,6 @@
     srcs = [
         "java/com/google/crypto/tink/testing/TestingServer.java",
     ],
-    javacopts = JAVACOPTS_OSS,
     main_class = "com.google.crypto.tink.testing.TestingServer",
     runtime_deps = [
         "@io_grpc_grpc_java//netty",
diff --git a/tools/testing/BUILD.bazel b/tools/testing/BUILD.bazel
index 7061c26..ee0d9ee 100644
--- a/tools/testing/BUILD.bazel
+++ b/tools/testing/BUILD.bazel
@@ -1,5 +1,3 @@
-load("@tink_java//tools/build_defs:javac.bzl", "JAVACOPTS_OSS")
-
 package(default_visibility = ["//:__subpackages__"])
 
 licenses(["notice"])
@@ -10,7 +8,6 @@
     srcs = [
         "java/com/google/crypto/tink/testing/CliUtil.java",
     ],
-    javacopts = JAVACOPTS_OSS,
     deps = [
         "@tink_java//src/main/java/com/google/crypto/tink:binary_keyset_reader",
         "@tink_java//src/main/java/com/google/crypto/tink:binary_keyset_writer",
@@ -24,7 +21,6 @@
     name = "compare_keysets",
     testonly = 1,
     srcs = ["java/com/google/crypto/tink/testing/CompareKeysets.java"],
-    javacopts = JAVACOPTS_OSS,
     deps = [
         "@tink_java//proto:tink_java_proto",
         "@tink_java//src/main/java/com/google/crypto/tink:privileged_registry",
@@ -35,7 +31,6 @@
     name = "compare_keysets_cli_java",
     testonly = 1,
     srcs = ["java/com/google/crypto/tink/testing/CompareKeysetsCli.java"],
-    javacopts = JAVACOPTS_OSS,
     main_class = "com.google.crypto.tink.testing.CompareKeysetsCli",
     deps = [
         ":cli_util",
@@ -52,7 +47,6 @@
     srcs = [
         "java/com/google/crypto/tink/testing/VersionCli.java",
     ],
-    javacopts = JAVACOPTS_OSS,
     main_class = "com.google.crypto.tink.testing.VersionCli",
     deps = [
         "@tink_java//src/main/java/com/google/crypto/tink:core",
@@ -65,7 +59,6 @@
     srcs = [
         "java/com/google/crypto/tink/testing/AeadCli.java",
     ],
-    javacopts = JAVACOPTS_OSS,
     main_class = "com.google.crypto.tink.testing.AeadCli",
     deps = [
         ":cli_util",
@@ -86,7 +79,6 @@
     srcs = [
         "java/com/google/crypto/tink/testing/DeterministicAeadCli.java",
     ],
-    javacopts = JAVACOPTS_OSS,
     main_class = "com.google.crypto.tink.testing.DeterministicAeadCli",
     deps = [
         ":cli_util",
@@ -101,7 +93,6 @@
     srcs = [
         "java/com/google/crypto/tink/testing/StreamingAeadCli.java",
     ],
-    javacopts = JAVACOPTS_OSS,
     main_class = "com.google.crypto.tink.testing.StreamingAeadCli",
     deps = [
         ":cli_util",
@@ -116,7 +107,6 @@
     srcs = [
         "java/com/google/crypto/tink/testing/MacCli.java",
     ],
-    javacopts = JAVACOPTS_OSS,
     main_class = "com.google.crypto.tink.testing.MacCli",
     deps = [
         ":cli_util",
@@ -131,7 +121,6 @@
     srcs = [
         "java/com/google/crypto/tink/testing/HybridEncryptCli.java",
     ],
-    javacopts = JAVACOPTS_OSS,
     main_class = "com.google.crypto.tink.testing.HybridEncryptCli",
     deps = [
         ":cli_util",
@@ -146,7 +135,6 @@
     srcs = [
         "java/com/google/crypto/tink/testing/HybridDecryptCli.java",
     ],
-    javacopts = JAVACOPTS_OSS,
     main_class = "com.google.crypto.tink.testing.HybridDecryptCli",
     deps = [
         ":cli_util",
@@ -161,7 +149,6 @@
     srcs = [
         "java/com/google/crypto/tink/testing/PublicKeySignCli.java",
     ],
-    javacopts = JAVACOPTS_OSS,
     main_class = "com.google.crypto.tink.testing.PublicKeySignCli",
     deps = [
         ":cli_util",
@@ -176,7 +163,6 @@
     srcs = [
         "java/com/google/crypto/tink/testing/PublicKeyVerifyCli.java",
     ],
-    javacopts = JAVACOPTS_OSS,
     main_class = "com.google.crypto.tink.testing.PublicKeyVerifyCli",
     deps = [
         ":cli_util",
diff --git a/tools/tinkey/BUILD.bazel b/tools/tinkey/BUILD.bazel
index 7b3fbd7..0b5d3e8 100644
--- a/tools/tinkey/BUILD.bazel
+++ b/tools/tinkey/BUILD.bazel
@@ -1,4 +1,3 @@
-load("@tink_java//tools/build_defs:javac.bzl", "JAVACOPTS_OSS")
 load("@tink_java//tools:gen_java_test_rules.bzl", "gen_java_test_rules")
 
 package(default_visibility = ["//:__subpackages__"])
@@ -15,7 +14,6 @@
             "src/main/java/com/google/crypto/tink/tinkey/Tinkey.java",
         ],
     ),
-    javacopts = JAVACOPTS_OSS,
     runtime_deps = [
         # Tinkey automatically loads these KMS clients at runtime.
         "@tink_java//src/main/java/com/google/crypto/tink/integration/awskms:aws_kms_client",
@@ -55,7 +53,6 @@
     srcs = [
         "src/main/java/com/google/crypto/tink/tinkey/Tinkey.java",
     ],
-    javacopts = JAVACOPTS_OSS,
     main_class = "com.google.crypto.tink.tinkey.Tinkey",
     visibility = ["//testing:__subpackages__"],
     deps = [