diff --git a/src/main/java/com/googlesource/gerrit/plugins/replication/AutoReloadConfigDecorator.java b/src/main/java/com/googlesource/gerrit/plugins/replication/AutoReloadConfigDecorator.java
index 62cad2c..6b1687c 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/replication/AutoReloadConfigDecorator.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/replication/AutoReloadConfigDecorator.java
@@ -13,6 +13,7 @@
 // limitations under the License.
 package com.googlesource.gerrit.plugins.replication;
 
+import com.google.gerrit.common.FileUtil;
 import com.google.gerrit.server.PluginUser;
 import com.google.gerrit.server.account.GroupBackend;
 import com.google.gerrit.server.config.SitePaths;
@@ -57,10 +58,14 @@
     this.gitRepositoryManager = grm;
     this.groupBackend = gb;
     this.currentConfig = loadConfig();
-    this.currentConfigTs = currentConfig.getCfgPath().lastModified();
+    this.currentConfigTs = getLastModified(currentConfig);
     this.workQueue = workQueue;
   }
 
+  private static long getLastModified(ReplicationFileBasedConfig cfg) {
+    return FileUtil.lastModified(cfg.getCfgPath());
+  }
+
   private ReplicationFileBasedConfig loadConfig()
       throws ConfigInvalidException, IOException {
     return new ReplicationFileBasedConfig(injector, site,
@@ -79,25 +84,27 @@
   }
 
   private void reloadIfNeeded() {
-    if (isAutoReload()
-        && currentConfig.getCfgPath().lastModified() > currentConfigTs) {
-      try {
-        ReplicationFileBasedConfig newConfig = loadConfig();
-        newConfig.startup(workQueue);
-        int discarded = currentConfig.shutdown();
+    try {
+      if (isAutoReload()) {
+        long lastModified = getLastModified(currentConfig);
+        if (lastModified > currentConfigTs) {
+          ReplicationFileBasedConfig newConfig = loadConfig();
+          newConfig.startup(workQueue);
+          int discarded = currentConfig.shutdown();
 
-        this.currentConfig = newConfig;
-        this.currentConfigTs = currentConfig.getCfgPath().lastModified();
-        log.info("Configuration reloaded: "
+          this.currentConfig = newConfig;
+          this.currentConfigTs = lastModified;
+          log.info("Configuration reloaded: "
             + currentConfig.getDestinations(FilterType.ALL).size() + " destinations, "
             + discarded + " replication events discarded");
 
-      } catch (Exception e) {
-        log.error(
-            "Cannot reload replication configuration: keeping existing settings",
-            e);
-        return;
+        }
       }
+    } catch (Exception e) {
+      log.error(
+          "Cannot reload replication configuration: keeping existing settings",
+          e);
+      return;
     }
   }
 
diff --git a/src/main/java/com/googlesource/gerrit/plugins/replication/AutoReloadSecureCredentialsFactoryDecorator.java b/src/main/java/com/googlesource/gerrit/plugins/replication/AutoReloadSecureCredentialsFactoryDecorator.java
index 4017822..3a0cc3f 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/replication/AutoReloadSecureCredentialsFactoryDecorator.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/replication/AutoReloadSecureCredentialsFactoryDecorator.java
@@ -11,18 +11,20 @@
 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 // See the License for the specific language governing permissions and
 // limitations under the License.
+
 package com.googlesource.gerrit.plugins.replication;
 
+import static com.google.gerrit.common.FileUtil.lastModified;
+
 import com.google.gerrit.server.config.SitePaths;
 import com.google.inject.Inject;
 
 import org.eclipse.jgit.errors.ConfigInvalidException;
-import org.eclipse.jgit.storage.file.FileBasedConfig;
-import org.eclipse.jgit.util.FS;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
 import java.io.IOException;
+import java.nio.file.Files;
 import java.util.concurrent.atomic.AtomicReference;
 
 public class AutoReloadSecureCredentialsFactoryDecorator implements
@@ -47,32 +49,29 @@
   }
 
   private long getSecureConfigLastEditTs() {
-    FileBasedConfig cfg = new FileBasedConfig(site.secure_config, FS.DETECTED);
-    if (cfg.getFile().exists()) {
-      return cfg.getFile().lastModified();
-    } else {
+    if (!Files.exists(site.secure_config)) {
       return 0L;
     }
+    return lastModified(site.secure_config);
   }
 
   @Override
   public SecureCredentialsProvider create(String remoteName) {
-    if (needsReload()) {
-      try {
+    try {
+      if (needsReload()) {
         secureCredentialsFactory.compareAndSet(secureCredentialsFactory.get(),
             new SecureCredentialsFactory(site));
         secureCredentialsFactoryLoadTs = getSecureConfigLastEditTs();
         log.info("secure.config reloaded as it was updated on the file system");
-      } catch (Exception e) {
-        log.error("Unexpected error while trying to reload "
-            + "secure.config: keeping existing credentials", e);
       }
+    } catch (Exception e) {
+      log.error("Unexpected error while trying to reload "
+          + "secure.config: keeping existing credentials", e);
     }
 
     return secureCredentialsFactory.get().create(remoteName);
   }
 
-
   private boolean needsReload() {
     return config.getConfig().getBoolean("gerrit", "autoReload", false) &&
         getSecureConfigLastEditTs() != secureCredentialsFactoryLoadTs;
diff --git a/src/main/java/com/googlesource/gerrit/plugins/replication/PushOne.java b/src/main/java/com/googlesource/gerrit/plugins/replication/PushOne.java
index 0614959..96156b7 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/replication/PushOne.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/replication/PushOne.java
@@ -611,7 +611,7 @@
     stateMap.clear();
   }
 
-  public class LockFailureException extends TransportException {
+  public static class LockFailureException extends TransportException {
     private static final long serialVersionUID = 1L;
 
     public LockFailureException(URIish uri, String message) {
diff --git a/src/main/java/com/googlesource/gerrit/plugins/replication/ReplicationFileBasedConfig.java b/src/main/java/com/googlesource/gerrit/plugins/replication/ReplicationFileBasedConfig.java
index f56185d..c360f75 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/replication/ReplicationFileBasedConfig.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/replication/ReplicationFileBasedConfig.java
@@ -35,9 +35,9 @@
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-import java.io.File;
 import java.io.IOException;
 import java.net.URISyntaxException;
+import java.nio.file.Path;
 import java.util.Collections;
 import java.util.List;
 import java.util.Set;
@@ -46,7 +46,7 @@
 public class ReplicationFileBasedConfig implements ReplicationConfig {
   static final Logger log = LoggerFactory.getLogger(ReplicationFileBasedConfig.class);
   private List<Destination> destinations;
-  private File cfgPath;
+  private Path cfgPath;
   private boolean replicateAllOnPluginStart;
   private boolean defaultForceUpdate;
   private Injector injector;
@@ -61,13 +61,13 @@
       final RemoteSiteUser.Factory ruf, final PluginUser pu,
       final GitRepositoryManager grm,
       final GroupBackend gb) throws ConfigInvalidException, IOException {
-    this.cfgPath = new File(site.etc_dir, "replication.config");
+    this.cfgPath = site.etc_dir.resolve("replication.config");
     this.injector = injector;
     this.replicationUserFactory = ruf;
     this.pluginUser = pu;
     this.gitRepositoryManager = grm;
     this.groupBackend = gb;
-    this.config = new FileBasedConfig(cfgPath, FS.DETECTED);
+    this.config = new FileBasedConfig(cfgPath.toFile(), FS.DETECTED);
     this.destinations = allDestinations();
   }
 
@@ -215,7 +215,7 @@
     return destinations.isEmpty();
   }
 
-  File getCfgPath() {
+  Path getCfgPath() {
     return cfgPath;
   }
 
diff --git a/src/main/java/com/googlesource/gerrit/plugins/replication/SecureCredentialsFactory.java b/src/main/java/com/googlesource/gerrit/plugins/replication/SecureCredentialsFactory.java
index 32d3905..a10f62f 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/replication/SecureCredentialsFactory.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/replication/SecureCredentialsFactory.java
@@ -36,7 +36,8 @@
 
   private static Config load(SitePaths site)
       throws ConfigInvalidException, IOException {
-    FileBasedConfig cfg = new FileBasedConfig(site.secure_config, FS.DETECTED);
+    FileBasedConfig cfg =
+        new FileBasedConfig(site.secure_config.toFile(), FS.DETECTED);
     if (cfg.getFile().exists() && cfg.getFile().length() > 0) {
       try {
         cfg.load();