diff --git a/.github/ci-files/run-sanity-check.sh b/.github/ci-files/run-sanity-check.sh
new file mode 100644
index 000000000000..32356f804fb4
--- /dev/null
+++ b/.github/ci-files/run-sanity-check.sh
@@ -0,0 +1,15 @@
+#!/bin/bash
+
+set +e
+
+./gradlew rewriteDryRun -Dorg.gradle.jvmargs=-Xmx8G \
+  --configure-on-demand \
+  --console plain \
+  --max-workers=1 \
+  -Pqa --profile
+
+gradle_return_code=$?
+
+set -e
+
+exit $gradle_return_code
diff --git a/build.gradle b/build.gradle
index c6b738eb4c09..79bc4cf4e597 100644
--- a/build.gradle
+++ b/build.gradle
@@ -3,16 +3,16 @@ import org.sonar.build.BlackBoxTest
 
 import static org.gradle.api.JavaVersion.VERSION_17
 
-plugins {
-  // Ordered alphabetically
+plugins { // natural order
   id 'com.github.hierynomus.license' version '0.16.1'
-  id "com.github.hierynomus.license-report" version "0.16.1" apply false
-  id 'com.gradleup.shadow' version '8.3.6' apply false
+  id 'com.github.hierynomus.license-report' version '0.16.1' apply false
   id 'com.google.protobuf' version '0.8.19' apply false
+  id 'com.gradleup.shadow' version '8.3.6' apply false
   id 'com.jfrog.artifactory' version '6.0.2'
-  id "de.undercouch.download" version "5.6.0" apply false
+  id 'de.undercouch.download' version '5.6.0' apply false
   id 'io.spring.dependency-management' version '1.1.7'
-  id "org.cyclonedx.bom" version "2.3.1" apply false
+  id 'org.cyclonedx.bom' version '2.3.1' apply false
+  id 'org.openrewrite.rewrite' version '7.19.0' apply false
   id 'org.sonarqube' version '7.0.0.6105'
 }
 
@@ -200,7 +200,10 @@ allprojects {
   }
 }
 
+apply from: 'gradle/rewrite.gradle'
+
 apply plugin: 'org.sonarqube'
+
 sonar {
   properties {
     property 'sonar.projectName', projectTitle
diff --git a/gradle.properties b/gradle.properties
index 4cf1c47953e0..8e498ff7120c 100644
--- a/gradle.properties
+++ b/gradle.properties
@@ -10,6 +10,7 @@ pluginApiVersion=13.3.0.3209
 description=Open source platform for continuous inspection of code quality
 projectTitle=SonarQube
 org.gradle.jvmargs=-Xmx2048m
+org.gradle.parallel=true
 org.gradle.caching=true
 org.gradle.vfs.watch=true
 elasticSearchServerVersion=8.16.6
diff --git a/gradle/rewrite.gradle b/gradle/rewrite.gradle
new file mode 100644
index 000000000000..51d9f12b255d
--- /dev/null
+++ b/gradle/rewrite.gradle
@@ -0,0 +1,25 @@
+/*
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * The OpenSearch Contributors require contributions made to
+ * this file be licensed under the Apache-2.0 license or a
+ * compatible open source license.
+ */
+
+apply plugin: 'org.openrewrite.rewrite'
+
+rewrite {
+  activeRecipe('org.opensearch.openrewrite.SanityCheck')
+  exclusion('**package-info.java')
+  setExportDatatables(true)
+  setFailOnDryRunResults(true)
+}
+
+dependencies {
+  rewrite(platform('org.openrewrite.recipe:rewrite-recipe-bom:3.17.0'))
+  rewrite('org.openrewrite.recipe:rewrite-migrate-java:3.20.0')
+  rewrite('org.openrewrite.recipe:rewrite-java-security:3.19.2')
+  rewrite('org.openrewrite.recipe:rewrite-rewrite:0.14.1')
+  rewrite('org.openrewrite.recipe:rewrite-static-analysis:2.20.0')
+  rewrite('org.openrewrite.recipe:rewrite-third-party:0.30.0')
+}
diff --git a/gradle/wrapper/gradle-wrapper.jar b/gradle/wrapper/gradle-wrapper.jar
index 2c3521197d7c..f8e1ee3125fe 100644
Binary files a/gradle/wrapper/gradle-wrapper.jar and b/gradle/wrapper/gradle-wrapper.jar differ
diff --git a/gradle/wrapper/gradle-wrapper.properties b/gradle/wrapper/gradle-wrapper.properties
index 7705927e949f..a8eccb6a331e 100644
--- a/gradle/wrapper/gradle-wrapper.properties
+++ b/gradle/wrapper/gradle-wrapper.properties
@@ -1,7 +1,8 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.3-all.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-9.2.0-bin.zip
 networkTimeout=10000
 validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME
 zipStorePath=wrapper/dists
+distributionSha256Sum=df67a32e86e3276d011735facb1535f64d0d88df84fa87521e90becc2d735444
diff --git a/gradlew b/gradlew
index f5feea6d6b11..cd69147b477b 100755
--- a/gradlew
+++ b/gradlew
@@ -1,7 +1,7 @@
 #!/bin/sh
 
 #
-# Copyright © 2015-2021 the original authors.
+# Copyright © 2015 the original authors.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -86,8 +86,7 @@ done
 # shellcheck disable=SC2034
 APP_BASE_NAME=${0##*/}
 # Discard cd standard output in case $CDPATH is set (https://github.com/gradle/gradle/issues/25036)
-APP_HOME=$( cd -P "${APP_HOME:-./}" > /dev/null && printf '%s
-' "$PWD" ) || exit
+APP_HOME=$( cd -P "${APP_HOME:-./}" > /dev/null && printf '%s\n' "$PWD" ) || exit
 
 # Use the maximum available, or set MAX_FD != -1 to use that value.
 MAX_FD=maximum
@@ -115,7 +114,7 @@ case "$( uname )" in                #(
   NONSTOP* )        nonstop=true ;;
 esac
 
-CLASSPATH=$APP_HOME/gradle/wrapper/gradle-wrapper.jar
+CLASSPATH="\\\"\\\""
 
 
 # Determine the Java command to use to start the JVM.
@@ -203,10 +202,10 @@ fi
 
 
 # Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
-DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
+DEFAULT_JVM_OPTS=
 
 # Collect all arguments for the java command:
-#   * DEFAULT_JVM_OPTS, JAVA_OPTS, JAVA_OPTS, and optsEnvironmentVar are not allowed to contain shell fragments,
+#   * DEFAULT_JVM_OPTS, JAVA_OPTS, and optsEnvironmentVar are not allowed to contain shell fragments,
 #     and any embedded shellness will be escaped.
 #   * For example: A user cannot expect ${Hostname} to be expanded, as it is an environment variable and will be
 #     treated as '${Hostname}' itself on the command line.
@@ -214,7 +213,7 @@ DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
 set -- \
         "-Dorg.gradle.appname=$APP_BASE_NAME" \
         -classpath "$CLASSPATH" \
-        org.gradle.wrapper.GradleWrapperMain \
+        -jar "$APP_HOME/gradle/wrapper/gradle-wrapper.jar" \
         "$@"
 
 # Stop when "xargs" is not available.
diff --git a/gradlew.bat b/gradlew.bat
old mode 100644
new mode 100755
index 9b42019c7915..53c7bc8d9d39
--- a/gradlew.bat
+++ b/gradlew.bat
@@ -36,7 +36,7 @@ set APP_HOME=%DIRNAME%
 for %%i in ("%APP_HOME%") do set APP_HOME=%%~fi
 
 @rem Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
-set DEFAULT_JVM_OPTS="-Xmx64m" "-Xms64m"
+set DEFAULT_JVM_OPTS=
 
 @rem Find java.exe
 if defined JAVA_HOME goto findJavaFromJavaHome
@@ -70,11 +70,10 @@ goto fail
 :execute
 @rem Setup the command line
 
-set CLASSPATH=%APP_HOME%\gradle\wrapper\gradle-wrapper.jar
 
 
 @rem Execute Gradle
-"%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -classpath "%CLASSPATH%" org.gradle.wrapper.GradleWrapperMain %*
+"%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -jar "%APP_HOME%\gradle\wrapper\gradle-wrapper.jar" %*
 
 :end
 @rem End local scope for the variables with windows NT shell
diff --git a/rewrite.yml b/rewrite.yml
new file mode 100644
index 000000000000..5b62b3be73f8
--- /dev/null
+++ b/rewrite.yml
@@ -0,0 +1,15 @@
+---
+type: specs.openrewrite.org/v1beta/recipe
+name: org.opensearch.openrewrite.SanityCheck
+displayName: Apply all Java & Gradle best practices
+description: Comprehensive code quality recipe combining modernization, security, and best practices.
+tags:
+  - java
+  - gradle
+  - static-analysis
+  - cleanup
+recipeList:
+  - org.openrewrite.gradle.EnableGradleBuildCache
+  - org.openrewrite.gradle.EnableGradleParallelExecution
+  - org.openrewrite.gradle.GradleBestPractices
+---