diff --git a/checks/spotbugs-exclude.xml b/checks/spotbugs-exclude.xml
index e5e6a79..1d7554e 100644
--- a/checks/spotbugs-exclude.xml
+++ b/checks/spotbugs-exclude.xml
@@ -24,6 +24,9 @@
   <Match>
     <Bug pattern="EI_EXPOSE_REP" />
   </Match>
+  <Match>
+    <Bug pattern="EI_EXPOSE_REP2" />
+  </Match>
   <Match>
     <Bug pattern="CT_CONSTRUCTOR_THROW" />
   </Match>
diff --git a/scram-client/src/main/java/com/ongres/scram/client/ScramClient.java b/scram-client/src/main/java/com/ongres/scram/client/ScramClient.java
index 6b6814d..c965502 100644
--- a/scram-client/src/main/java/com/ongres/scram/client/ScramClient.java
+++ b/scram-client/src/main/java/com/ongres/scram/client/ScramClient.java
@@ -376,12 +376,13 @@ public interface FinalBuildStage {
      *          supply a binding type or data this builder does not compute itself, such as
      *          {@code tls-exporter} from a non-JDK TLS stack.
      *
-     * @param serverCertificate the server's end-entity (leaf) TLS certificate to bind to
+     * @param serverCertificate the server's end-entity (leaf) TLS certificate to bind to,
+     *        or {@code null} to configure no binding
      * @return {@code this} builder for use in a chained invocation
      * @see #channelBinding(String, byte[])
      * @see ChannelBindingPolicy
      */
-    FinalBuildStage channelBinding(@NotNull X509Certificate serverCertificate);
+    FinalBuildStage channelBinding(@Nullable X509Certificate serverCertificate);
 
     /**
      * Sets the StringPreparation, is recommended to leave the default SASL_PREPARATION.
@@ -501,14 +502,17 @@ public FinalBuildStage channelBindingPolicy(@NotNull ChannelBindingPolicy policy
     }
 
     @Override
-    public FinalBuildStage channelBinding(@NotNull X509Certificate serverCertificate) {
+    public FinalBuildStage channelBinding(@Nullable X509Certificate serverCertificate) {
+      if (serverCertificate == null) {
+        return this;
+      }
       if (cbindConfigured) {
         throw new IllegalStateException(
             "channelBinding(X509Certificate) called but channel binding was already configured "
                 + "via channelBinding(String, byte[])");
       }
       cbindConfigured = true;
-      this.serverCertificate = checkNotNull(serverCertificate, "serverCertificate");
+      this.serverCertificate = serverCertificate;
       return this;
     }
 
diff --git a/scram-client/src/test/java/com/example/ChannelBindingNegotiationTest.java b/scram-client/src/test/java/com/example/ChannelBindingNegotiationTest.java
index b3ad217..65e4b5b 100644
--- a/scram-client/src/test/java/com/example/ChannelBindingNegotiationTest.java
+++ b/scram-client/src/test/java/com/example/ChannelBindingNegotiationTest.java
@@ -253,6 +253,16 @@ void policyRequire_DualSet_ThrowsException() {
           + "was already configured via channelBinding(String, byte[])", ex2.getMessage());
     }
 
+    @Test
+    @DisplayName("Allows null channel binding certificate")
+    void policyRequire_DualSet_NullCertificate() {
+      assertDoesNotThrow(
+          () -> createBaseBuilder(BARE_AND_PLUS)
+              .channelBinding(null)
+              .channelBinding(null, null)
+              .build());
+    }
+
     @Test
     @DisplayName("REQUIRE: Aborts initialization if the server fails to advertise a -PLUS mechanism")
     void policyRequire_ServerLacksPlus_ThrowsException() {