diff --git a/buildSrc/src/main/groovy/org/elasticsearch/gradle/plugin/PluginBuildPlugin.groovy b/buildSrc/src/main/groovy/org/elasticsearch/gradle/plugin/PluginBuildPlugin.groovy
index 166a9314b2949..523e6274d7cdb 100644
--- a/buildSrc/src/main/groovy/org/elasticsearch/gradle/plugin/PluginBuildPlugin.groovy
+++ b/buildSrc/src/main/groovy/org/elasticsearch/gradle/plugin/PluginBuildPlugin.groovy
@@ -208,7 +208,11 @@ class PluginBuildPlugin implements Plugin<Project> {
         // create the actual bundle task, which zips up all the files for the plugin
         TaskProvider<Zip> bundle = project.tasks.register('bundlePlugin', Zip) {
             from buildProperties
-            from pluginMetadata // metadata (eg custom security policy)
+            from(pluginMetadata) {
+                // metadata (eg custom security policy)
+                // the codebases properties file is only for tests and not needed in production
+                exclude 'plugin-security.codebases'
+            }
             /*
              * If the plugin is using the shadow plugin then we need to bundle
              * that shadow jar.
diff --git a/modules/systemd/src/test/resources/plugin-security.codebases b/modules/systemd/src/main/plugin-metadata/plugin-security.codebases
similarity index 100%
rename from modules/systemd/src/test/resources/plugin-security.codebases
rename to modules/systemd/src/main/plugin-metadata/plugin-security.codebases
diff --git a/plugins/transport-nio/src/main/plugin-metadata/plugin-security.codebases b/plugins/transport-nio/src/main/plugin-metadata/plugin-security.codebases
new file mode 100644
index 0000000000000..ca259d21ad773
--- /dev/null
+++ b/plugins/transport-nio/src/main/plugin-metadata/plugin-security.codebases
@@ -0,0 +1,2 @@
+elasticsearch-nio: org.elasticsearch.nio.ChannelFactory
+netty-common: io.netty.util.NettyRuntime