diff --git a/BUCK b/BUCK
index a4c0227..3f8c588 100644
--- a/BUCK
+++ b/BUCK
@@ -8,6 +8,9 @@
     'Implementation-Title: Secure-Config plugin',
     'Implementation-URL: https://gerrit-review.googlesource.com/#/admin/projects/plugins/secure-config',
   ],
+  provided_deps = [
+    '//lib/commons:codec',
+  ],
   deps = [
   ],
 )
diff --git a/src/main/java/com/googlesource/gerrit/plugins/secureconfig/Codec.java b/src/main/java/com/googlesource/gerrit/plugins/secureconfig/Codec.java
index 27868a5..9d17050 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/secureconfig/Codec.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/secureconfig/Codec.java
@@ -14,7 +14,23 @@
 
 package com.googlesource.gerrit.plugins.secureconfig;
 
-public interface Codec {
+import com.google.common.base.Function;
+
+public abstract class Codec {
+
+  public Function<String, String> decodeFun = new Function<String, String>() {
+    @Override
+    public String apply(String input) {
+      return decode(input);
+    }
+  };
+
+  public Function<String, String> encodeFun = new Function<String, String>() {
+    @Override
+    public String apply(String input) {
+      return encode(input);
+    }
+  };
 
   public abstract String encode(String plain);
 
diff --git a/src/main/java/com/googlesource/gerrit/plugins/secureconfig/PBECodec.java b/src/main/java/com/googlesource/gerrit/plugins/secureconfig/PBECodec.java
index 9b7c1ba..88af1f5 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/secureconfig/PBECodec.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/secureconfig/PBECodec.java
@@ -17,6 +17,7 @@
 import com.google.inject.Inject;
 import com.google.inject.Singleton;
 
+import org.apache.commons.codec.binary.Base64;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -26,7 +27,6 @@
 import java.security.Provider;
 import java.security.Security;
 import java.security.spec.InvalidKeySpecException;
-import java.util.Base64;
 
 import javax.crypto.Cipher;
 import javax.crypto.NoSuchPaddingException;
@@ -35,7 +35,7 @@
 import javax.crypto.spec.PBEParameterSpec;
 
 @Singleton
-public class PBECodec implements Codec {
+public class PBECodec extends Codec {
   private static final Logger log = LoggerFactory.getLogger(PBECodec.class);
   byte[] salt = new byte[] {0x7d, 0x60, 0x43, 0x5f, 0x02, (byte) 0xe9,
       (byte) 0xe0, (byte) 0xae};
@@ -57,7 +57,7 @@
       Cipher encoder = getCipher();
 
       encoder.init(Cipher.ENCRYPT_MODE, sKey, getCipherParameterSpec());
-      return new String(Base64.getEncoder().encodeToString(
+      return new String(Base64.encodeBase64(
           encoder.doFinal(s.getBytes(config.getEncoding()))));
 
     } catch (Exception e) {
@@ -73,7 +73,7 @@
       Key sKey = generateKey();
 
       encoder.init(Cipher.DECRYPT_MODE, sKey, getCipherParameterSpec());
-      return new String(encoder.doFinal(Base64.getDecoder().decode(s)),
+      return new String(encoder.doFinal(Base64.decodeBase64(s)),
           config.getEncoding());
 
     } catch (Exception e) {
diff --git a/src/main/java/com/googlesource/gerrit/plugins/secureconfig/SecureConfigSettings.java b/src/main/java/com/googlesource/gerrit/plugins/secureconfig/SecureConfigSettings.java
index e5f3b3c..407321d 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/secureconfig/SecureConfigSettings.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/secureconfig/SecureConfigSettings.java
@@ -18,6 +18,8 @@
 import com.google.inject.Inject;
 import com.google.inject.Singleton;
 
+import org.apache.commons.codec.binary.Base64;
+
 import org.eclipse.jgit.errors.ConfigInvalidException;
 import org.eclipse.jgit.lib.Config;
 import org.eclipse.jgit.storage.file.FileBasedConfig;
@@ -27,7 +29,6 @@
 import java.io.IOException;
 import java.nio.file.Path;
 import java.nio.file.Paths;
-import java.util.Base64;
 
 @Singleton
 public class SecureConfigSettings {
@@ -84,7 +85,7 @@
           new byte[gerritConfig.getInt(SECURE_CONFIG, PASSWORD_LENGTH,
               DEF_PASSWORD_LENGTH)];
       in.read(passphrase);
-      return new String(Base64.getEncoder().encode(passphrase)).toCharArray();
+      return new String(Base64.encodeBase64(passphrase)).toCharArray();
     }
   }
 }
diff --git a/src/main/java/com/googlesource/gerrit/plugins/secureconfig/SecureConfigStore.java b/src/main/java/com/googlesource/gerrit/plugins/secureconfig/SecureConfigStore.java
index 9d657d3..d1a5466 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/secureconfig/SecureConfigStore.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/secureconfig/SecureConfigStore.java
@@ -34,7 +34,6 @@
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
-import java.util.stream.Collectors;
 
 @Singleton
 public class SecureConfigStore extends SecureStore {
@@ -58,9 +57,9 @@
 
   @Override
   public String[] getList(String section, String subsection, String name) {
-    return Arrays.stream(sec.getStringList(section, subsection, name))
-        .map(codec::decode)
-        .toArray(String[]::new);
+    return FluentIterable
+        .from(Arrays.asList(sec.getStringList(section, subsection, name)))
+        .transform(codec.decodeFun).toArray(String.class);
   }
 
   @Override
@@ -82,9 +81,11 @@
         }
       }
     }
+
     return cfg != null ? FluentIterable
-        .from(cfg.getStringList(section, subsection, name))
-        .transform(codec::decode).toArray(String.class) : null;
+        .from(Arrays.asList(cfg.getStringList(section, subsection, name)))
+        .transform(codec.decodeFun)
+        .toArray(String.class) : null;
   }
 
   @Override
@@ -92,9 +93,9 @@
       List<String> values) {
     if (values != null) {
       sec.setStringList(section, subsection, name,
-          values.stream()
-          .map(codec::encode)
-          .collect(Collectors.toList()));
+          FluentIterable.from(values)
+          .transform(codec.encodeFun)
+          .toList());
     } else {
       sec.unset(section, subsection, name);
     }