diff --git a/deps/amqp10_client/BUILD.bazel b/deps/amqp10_client/BUILD.bazel
index 4fdb8e84b3..50a4adb530 100644
--- a/deps/amqp10_client/BUILD.bazel
+++ b/deps/amqp10_client/BUILD.bazel
@@ -1,3 +1,4 @@
+load("@bazel-erlang//:xref.bzl", "xref")
 load("@bazel-erlang//:ct.bzl", "ct_suite")
 load("//:rabbitmq_home.bzl", "rabbitmq_home")
 load("//:rabbitmq_run.bzl", "rabbitmq_run")
@@ -37,6 +38,8 @@ rabbitmq_lib(
     deps = DEPS,
 )
 
+xref(tags = ["xref"])
+
 rabbitmq_suite(
     name = "msg_SUITE",
     deps = DEPS,
diff --git a/deps/amqp10_common/BUILD.bazel b/deps/amqp10_common/BUILD.bazel
index 5d647cf54e..a7f2651eda 100644
--- a/deps/amqp10_common/BUILD.bazel
+++ b/deps/amqp10_common/BUILD.bazel
@@ -4,6 +4,7 @@ load(
     "bazel_erlang_lib",
     "erlc",
 )
+load("@bazel-erlang//:xref.bzl", "xref")
 load("@bazel-erlang//:ct.bzl", "ct_suite")
 load(
     "//:rabbitmq.bzl",
@@ -89,6 +90,8 @@ bazel_erlang_lib(
     visibility = ["//visibility:public"],
 )
 
+xref(tags = ["xref"])
+
 ct_suite(
     name = "binary_generator_SUITE",
     erlc_opts = RABBITMQ_TEST_ERLC_OPTS,
diff --git a/deps/amqp_client/BUILD.bazel b/deps/amqp_client/BUILD.bazel
index 6fbf3f6737..7aaaf1bd7c 100644
--- a/deps/amqp_client/BUILD.bazel
+++ b/deps/amqp_client/BUILD.bazel
@@ -1,3 +1,4 @@
+load("@bazel-erlang//:xref.bzl", "xref")
 load("@bazel-erlang//:ct.bzl", "ct_suite")
 load("//:rabbitmq_home.bzl", "rabbitmq_home")
 load("//:rabbitmq_run.bzl", "rabbitmq_run")
@@ -36,6 +37,8 @@ rabbitmq_lib(
     deps = DEPS,
 )
 
+xref(tags = ["xref"])
+
 rabbitmq_home(
     name = "broker-for-tests-home",
     plugins = [
diff --git a/deps/rabbit/BUILD.bazel b/deps/rabbit/BUILD.bazel
index eb1ae2eb6a..d537418458 100644
--- a/deps/rabbit/BUILD.bazel
+++ b/deps/rabbit/BUILD.bazel
@@ -209,7 +209,7 @@ rabbitmq_lib(
     deps = DEPS,
 )
 
-xref()
+xref(tags = ["xref"])
 
 bats(
     srcs = glob(["test/**/*.bats"]),
diff --git a/deps/rabbit_common/BUILD.bazel b/deps/rabbit_common/BUILD.bazel
index cc1b7958e6..66f3f186dd 100644
--- a/deps/rabbit_common/BUILD.bazel
+++ b/deps/rabbit_common/BUILD.bazel
@@ -1,4 +1,5 @@
 load("@bazel-erlang//:bazel_erlang_lib.bzl", "app_file", "bazel_erlang_lib", "erlc")
+load("@bazel-erlang//:xref.bzl", "xref")
 load("@bazel-erlang//:ct.bzl", "ct_test")
 load("//:rabbitmq.bzl", "APP_VERSION", "RABBITMQ_ERLC_OPTS", "RABBITMQ_TEST_ERLC_OPTS")
 
@@ -163,6 +164,8 @@ bazel_erlang_lib(
     deps = DEPS + RUNTIME_DEPS,
 )
 
+xref(tags = ["xref"])
+
 erlc(
     name = "rabbit_env_SUITE_beam_files",
     testonly = True,
diff --git a/deps/rabbitmq_amqp1_0/BUILD.bazel b/deps/rabbitmq_amqp1_0/BUILD.bazel
index e88cfe75e6..b1432e5f68 100644
--- a/deps/rabbitmq_amqp1_0/BUILD.bazel
+++ b/deps/rabbitmq_amqp1_0/BUILD.bazel
@@ -1,3 +1,4 @@
+load("@bazel-erlang//:xref.bzl", "xref")
 load(
     "//:rabbitmq.bzl",
     "broker_for_integration_suites",
@@ -39,6 +40,8 @@ rabbitmq_lib(
     deps = DEPS,
 )
 
+xref(tags = ["xref"])
+
 broker_for_integration_suites()
 
 PACKAGE = "deps/rabbitmq_amqp1_0"
diff --git a/deps/rabbitmq_amqp1_0/src/Elixir.RabbitMQ.CLI.Ctl.Commands.ListAmqp10ConnectionsCommand.erl b/deps/rabbitmq_amqp1_0/src/Elixir.RabbitMQ.CLI.Ctl.Commands.ListAmqp10ConnectionsCommand.erl
index 9199332587..24a60b2ce1 100644
--- a/deps/rabbitmq_amqp1_0/src/Elixir.RabbitMQ.CLI.Ctl.Commands.ListAmqp10ConnectionsCommand.erl
+++ b/deps/rabbitmq_amqp1_0/src/Elixir.RabbitMQ.CLI.Ctl.Commands.ListAmqp10ConnectionsCommand.erl
@@ -9,6 +9,15 @@
 -behaviour('Elixir.RabbitMQ.CLI.CommandBehaviour').
 -include("rabbit_amqp1_0.hrl").
 
+-ignore_xref([
+    {'Elixir.RabbitMQ.CLI.DefaultOutput', output, 1},
+    {'Elixir.RabbitMQ.CLI.Core.Helpers', nodes_in_cluster, 1},
+    {'Elixir.RabbitMQ.CLI.Ctl.InfoKeys', prepare_info_keys, 1},
+    {'Elixir.RabbitMQ.CLI.Ctl.RpcStream', receive_list_items, 7},
+    {'Elixir.RabbitMQ.CLI.Ctl.InfoKeys', validate_info_keys, 2},
+    {'Elixir.Enum', join, 2}
+]).
+
 -export([formatter/0,
          scopes/0,
          switches/0,
diff --git a/deps/rabbitmq_auth_backend_cache/BUILD.bazel b/deps/rabbitmq_auth_backend_cache/BUILD.bazel
index 24b5758a52..b862ce424c 100644
--- a/deps/rabbitmq_auth_backend_cache/BUILD.bazel
+++ b/deps/rabbitmq_auth_backend_cache/BUILD.bazel
@@ -1,3 +1,4 @@
+load("@bazel-erlang//:xref.bzl", "xref")
 load(
     "//:rabbitmq.bzl",
     "broker_for_integration_suites",
@@ -42,6 +43,8 @@ rabbitmq_lib(
     deps = DEPS,
 )
 
+xref(tags = ["xref"])
+
 broker_for_integration_suites()
 
 PACKAGE = "deps/rabbitmq_auth_backend_cache"
diff --git a/deps/rabbitmq_auth_backend_http/BUILD.bazel b/deps/rabbitmq_auth_backend_http/BUILD.bazel
index d784947050..dbe0ee954b 100644
--- a/deps/rabbitmq_auth_backend_http/BUILD.bazel
+++ b/deps/rabbitmq_auth_backend_http/BUILD.bazel
@@ -1,3 +1,4 @@
+load("@bazel-erlang//:xref.bzl", "xref")
 load("@bazel-erlang//:ct.bzl", "ct_suite")
 load(
     "//:rabbitmq.bzl",
@@ -44,6 +45,8 @@ rabbitmq_lib(
     deps = DEPS,
 )
 
+xref(tags = ["xref"])
+
 broker_for_integration_suites()
 
 PACKAGE = "deps/rabbitmq_auth_backend_http"
diff --git a/deps/rabbitmq_auth_backend_ldap/BUILD.bazel b/deps/rabbitmq_auth_backend_ldap/BUILD.bazel
index 777c517add..90b39a9d06 100644
--- a/deps/rabbitmq_auth_backend_ldap/BUILD.bazel
+++ b/deps/rabbitmq_auth_backend_ldap/BUILD.bazel
@@ -1,3 +1,4 @@
+load("@bazel-erlang//:xref.bzl", "xref")
 load("//:rabbitmq_home.bzl", "rabbitmq_home")
 load("//:rabbitmq_run.bzl", "rabbitmq_run")
 load(
@@ -60,6 +61,8 @@ rabbitmq_lib(
     deps = DEPS,
 )
 
+xref(tags = ["xref"])
+
 broker_for_integration_suites()
 
 PACKAGE = "deps/rabbitmq_auth_backend_ldap"
diff --git a/deps/rabbitmq_auth_backend_oauth2/BUILD.bazel b/deps/rabbitmq_auth_backend_oauth2/BUILD.bazel
index f28d81a89f..a5c3e3728b 100644
--- a/deps/rabbitmq_auth_backend_oauth2/BUILD.bazel
+++ b/deps/rabbitmq_auth_backend_oauth2/BUILD.bazel
@@ -1,4 +1,5 @@
 load("@bazel-erlang//:bazel_erlang_lib.bzl", "erlc")
+load("@bazel-erlang//:xref.bzl", "xref")
 load(
     "//:rabbitmq.bzl",
     "RABBITMQ_TEST_ERLC_OPTS",
@@ -23,6 +24,7 @@ DEPS = [
 
 RUNTIME_DEPS = [
     "//deps/rabbit:bazel_erlang_lib",
+    "@base64url//:bazel_erlang_lib",
     "@cowlib//:bazel_erlang_lib",
 ]
 
@@ -34,6 +36,8 @@ rabbitmq_lib(
     deps = DEPS,
 )
 
+xref(tags = ["xref"])
+
 broker_for_integration_suites()
 
 erlc(
diff --git a/deps/rabbitmq_auth_backend_oauth2/Makefile b/deps/rabbitmq_auth_backend_oauth2/Makefile
index d950bf3951..0613aa9c2c 100644
--- a/deps/rabbitmq_auth_backend_oauth2/Makefile
+++ b/deps/rabbitmq_auth_backend_oauth2/Makefile
@@ -2,13 +2,14 @@ PROJECT = rabbitmq_auth_backend_oauth2
 PROJECT_DESCRIPTION = OAuth 2 and JWT-based AuthN and AuthZ backend
 
 BUILD_DEPS = rabbit_common
-DEPS = rabbit cowlib jose
+DEPS = rabbit cowlib jose base64url
 TEST_DEPS = cowboy rabbitmq_web_dispatch rabbitmq_ct_helpers rabbitmq_ct_client_helpers amqp_client
 
 DEP_EARLY_PLUGINS = rabbit_common/mk/rabbitmq-early-plugin.mk
 DEP_PLUGINS = rabbit_common/mk/rabbitmq-plugin.mk
 
 dep_jose = hex 1.11.1
+dep_base64url = hex 1.0.1
 
 # FIXME: Use erlang.mk patched for RabbitMQ, while waiting for PRs to be
 # reviewed and merged.
diff --git a/deps/rabbitmq_auth_backend_oauth2/src/Elixir.RabbitMQ.CLI.Ctl.Commands.AddUaaKeyCommand.erl b/deps/rabbitmq_auth_backend_oauth2/src/Elixir.RabbitMQ.CLI.Ctl.Commands.AddUaaKeyCommand.erl
index 800dd55528..6b78f02340 100644
--- a/deps/rabbitmq_auth_backend_oauth2/src/Elixir.RabbitMQ.CLI.Ctl.Commands.AddUaaKeyCommand.erl
+++ b/deps/rabbitmq_auth_backend_oauth2/src/Elixir.RabbitMQ.CLI.Ctl.Commands.AddUaaKeyCommand.erl
@@ -8,6 +8,10 @@
 
 -behaviour('Elixir.RabbitMQ.CLI.CommandBehaviour').
 
+-ignore_xref([
+    {'Elixir.RabbitMQ.CLI.DefaultOutput', output, 1}
+]).
+
 -export([
          usage/0,
          validate/2,
diff --git a/deps/rabbitmq_auth_mechanism_ssl/BUILD.bazel b/deps/rabbitmq_auth_mechanism_ssl/BUILD.bazel
index dcf57129d3..f37ef01e8f 100644
--- a/deps/rabbitmq_auth_mechanism_ssl/BUILD.bazel
+++ b/deps/rabbitmq_auth_mechanism_ssl/BUILD.bazel
@@ -1,3 +1,4 @@
+load("@bazel-erlang//:xref.bzl", "xref")
 load("@bazel-erlang//:ct.bzl", "ct_suite")
 load("//:rabbitmq_home.bzl", "rabbitmq_home")
 load("//:rabbitmq_run.bzl", "rabbitmq_run")
@@ -29,3 +30,5 @@ rabbitmq_lib(
     runtime_deps = RUNTIME_DEPS,
     deps = DEPS,
 )
+
+xref(tags = ["xref"])
diff --git a/deps/rabbitmq_aws/BUILD.bazel b/deps/rabbitmq_aws/BUILD.bazel
index 23bdb14720..dfae573791 100644
--- a/deps/rabbitmq_aws/BUILD.bazel
+++ b/deps/rabbitmq_aws/BUILD.bazel
@@ -1,4 +1,5 @@
 load("@bazel-erlang//:eunit.bzl", "eunit")
+load("@bazel-erlang//:xref.bzl", "xref")
 load("//:rabbitmq.bzl", "RABBITMQ_TEST_ERLC_OPTS", "rabbitmq_lib")
 
 APP_NAME = "rabbitmq_aws"
@@ -31,6 +32,16 @@ rabbitmq_lib(
     extra_apps = EXTRA_APPS,
 )
 
+xref(
+    additional_libs = [
+        "//deps/rabbit_common:bazel_erlang_lib",
+        "@credentials_obfuscation//:bazel_erlang_lib",
+        "@jsx//:bazel_erlang_lib",
+        "@recon//:bazel_erlang_lib",
+    ],
+    tags = ["xref"],
+)
+
 eunit(
     erlc_opts = RABBITMQ_TEST_ERLC_OPTS + [
         "-I deps/rabbitmq_aws",
diff --git a/deps/rabbitmq_consistent_hash_exchange/BUILD.bazel b/deps/rabbitmq_consistent_hash_exchange/BUILD.bazel
index f6a56a5bf9..7e01b6d00e 100644
--- a/deps/rabbitmq_consistent_hash_exchange/BUILD.bazel
+++ b/deps/rabbitmq_consistent_hash_exchange/BUILD.bazel
@@ -1,3 +1,4 @@
+load("@bazel-erlang//:xref.bzl", "xref")
 load(
     "//:rabbitmq.bzl",
     "broker_for_integration_suites",
@@ -29,6 +30,8 @@ rabbitmq_lib(
     deps = DEPS,
 )
 
+xref(tags = ["xref"])
+
 broker_for_integration_suites()
 
 PACKAGE = "deps/rabbitmq_consistent_hash_exchange"
diff --git a/deps/rabbitmq_consistent_hash_exchange/src/Elixir.RabbitMQ.CLI.Diagnostics.Commands.ConsistentHashExchangeRingStateCommand.erl b/deps/rabbitmq_consistent_hash_exchange/src/Elixir.RabbitMQ.CLI.Diagnostics.Commands.ConsistentHashExchangeRingStateCommand.erl
index 0afd14a170..bb00ccf01e 100644
--- a/deps/rabbitmq_consistent_hash_exchange/src/Elixir.RabbitMQ.CLI.Diagnostics.Commands.ConsistentHashExchangeRingStateCommand.erl
+++ b/deps/rabbitmq_consistent_hash_exchange/src/Elixir.RabbitMQ.CLI.Diagnostics.Commands.ConsistentHashExchangeRingStateCommand.erl
@@ -12,6 +12,11 @@
 
 -behaviour('Elixir.RabbitMQ.CLI.CommandBehaviour').
 
+-ignore_xref([
+    {'Elixir.RabbitMQ.CLI.Core.ExitCodes', exit_dataerr, 0},
+    {'Elixir.RabbitMQ.CLI.DefaultOutput', output, 1}
+]).
+
 -export([
          usage/0,
          usage_additional/0,
diff --git a/deps/rabbitmq_event_exchange/BUILD.bazel b/deps/rabbitmq_event_exchange/BUILD.bazel
index 5e2686f623..4a08838c58 100644
--- a/deps/rabbitmq_event_exchange/BUILD.bazel
+++ b/deps/rabbitmq_event_exchange/BUILD.bazel
@@ -1,3 +1,4 @@
+load("@bazel-erlang//:xref.bzl", "xref")
 load(
     "//:rabbitmq.bzl",
     "broker_for_integration_suites",
@@ -21,6 +22,8 @@ rabbitmq_lib(
     deps = DEPS,
 )
 
+xref(tags = ["xref"])
+
 broker_for_integration_suites()
 
 PACKAGE = "deps/rabbitmq_event_exchange"
diff --git a/deps/rabbitmq_federation/BUILD.bazel b/deps/rabbitmq_federation/BUILD.bazel
index f868a14ad0..be50634fa6 100644
--- a/deps/rabbitmq_federation/BUILD.bazel
+++ b/deps/rabbitmq_federation/BUILD.bazel
@@ -1,4 +1,5 @@
 load("@bazel-erlang//:bazel_erlang_lib.bzl", "erlc")
+load("@bazel-erlang//:xref.bzl", "xref")
 load(
     "//:rabbitmq.bzl",
     "RABBITMQ_TEST_ERLC_OPTS",
@@ -38,6 +39,8 @@ rabbitmq_lib(
     deps = DEPS,
 )
 
+xref(tags = ["xref"])
+
 broker_for_integration_suites()
 
 erlc(
diff --git a/deps/rabbitmq_federation/src/Elixir.RabbitMQ.CLI.Ctl.Commands.FederationStatusCommand.erl b/deps/rabbitmq_federation/src/Elixir.RabbitMQ.CLI.Ctl.Commands.FederationStatusCommand.erl
index a318dde98a..e613ea65b6 100644
--- a/deps/rabbitmq_federation/src/Elixir.RabbitMQ.CLI.Ctl.Commands.FederationStatusCommand.erl
+++ b/deps/rabbitmq_federation/src/Elixir.RabbitMQ.CLI.Ctl.Commands.FederationStatusCommand.erl
@@ -11,6 +11,8 @@
 
 -behaviour('Elixir.RabbitMQ.CLI.CommandBehaviour').
 
+-ignore_xref({'Elixir.RabbitMQ.CLI.DefaultOutput', output, 1}).
+
 -export([
          usage/0,
          usage_additional/0,
diff --git a/deps/rabbitmq_federation/src/Elixir.RabbitMQ.CLI.Ctl.Commands.RestartFederationLinkCommand.erl b/deps/rabbitmq_federation/src/Elixir.RabbitMQ.CLI.Ctl.Commands.RestartFederationLinkCommand.erl
index d215a89c4c..68e740ba1c 100644
--- a/deps/rabbitmq_federation/src/Elixir.RabbitMQ.CLI.Ctl.Commands.RestartFederationLinkCommand.erl
+++ b/deps/rabbitmq_federation/src/Elixir.RabbitMQ.CLI.Ctl.Commands.RestartFederationLinkCommand.erl
@@ -11,6 +11,8 @@
 
 -behaviour('Elixir.RabbitMQ.CLI.CommandBehaviour').
 
+-ignore_xref({'Elixir.RabbitMQ.CLI.DefaultOutput', output, 1}).
+
 -export([
          usage/0,
          usage_additional/0,
diff --git a/deps/rabbitmq_federation_management/BUILD.bazel b/deps/rabbitmq_federation_management/BUILD.bazel
index 5f9e4404df..8b06fc2376 100644
--- a/deps/rabbitmq_federation_management/BUILD.bazel
+++ b/deps/rabbitmq_federation_management/BUILD.bazel
@@ -1,4 +1,5 @@
 load("@bazel-erlang//:bazel_erlang_lib.bzl", "erlc")
+load("@bazel-erlang//:xref.bzl", "xref")
 load(
     "//:rabbitmq.bzl",
     "broker_for_integration_suites",
@@ -36,6 +37,8 @@ rabbitmq_lib(
     deps = DEPS,
 )
 
+xref(tags = ["xref"])
+
 broker_for_integration_suites()
 
 PACKAGE = "deps/rabbitmq_federation_management"
diff --git a/deps/rabbitmq_jms_topic_exchange/BUILD.bazel b/deps/rabbitmq_jms_topic_exchange/BUILD.bazel
index ed9d74323b..5ef8c53342 100644
--- a/deps/rabbitmq_jms_topic_exchange/BUILD.bazel
+++ b/deps/rabbitmq_jms_topic_exchange/BUILD.bazel
@@ -1,3 +1,4 @@
+load("@bazel-erlang//:xref.bzl", "xref")
 load(
     "//:rabbitmq.bzl",
     "broker_for_integration_suites",
@@ -28,6 +29,8 @@ rabbitmq_lib(
     deps = DEPS,
 )
 
+xref(tags = ["xref"])
+
 broker_for_integration_suites()
 
 PACKAGE = "deps/rabbitmq_jms_topic_exchange"
diff --git a/deps/rabbitmq_management/BUILD.bazel b/deps/rabbitmq_management/BUILD.bazel
index d4fee6c5c7..afd555e7ff 100644
--- a/deps/rabbitmq_management/BUILD.bazel
+++ b/deps/rabbitmq_management/BUILD.bazel
@@ -1,4 +1,5 @@
 load("@bazel-erlang//:bazel_erlang_lib.bzl", "erlc")
+load("@bazel-erlang//:xref.bzl", "xref")
 load(
     "//:rabbitmq.bzl",
     "broker_for_integration_suites",
@@ -61,6 +62,8 @@ rabbitmq_lib(
     deps = DEPS,
 )
 
+xref(tags = ["xref"])
+
 broker_for_integration_suites()
 
 erlc(
diff --git a/deps/rabbitmq_management_agent/BUILD.bazel b/deps/rabbitmq_management_agent/BUILD.bazel
index 1bb4483c74..8fa6e5a9ea 100644
--- a/deps/rabbitmq_management_agent/BUILD.bazel
+++ b/deps/rabbitmq_management_agent/BUILD.bazel
@@ -1,4 +1,5 @@
 load("@bazel-erlang//:bazel_erlang_lib.bzl", "erlc")
+load("@bazel-erlang//:xref.bzl", "xref")
 load(
     "//:rabbitmq.bzl",
     "broker_for_integration_suites",
@@ -50,6 +51,8 @@ rabbitmq_lib(
     deps = DEPS,
 )
 
+xref(tags = ["xref"])
+
 broker_for_integration_suites()
 
 PACKAGE = "deps/rabbitmq_management_agent"
diff --git a/deps/rabbitmq_management_agent/src/Elixir.RabbitMQ.CLI.Ctl.Commands.ResetStatsDbCommand.erl b/deps/rabbitmq_management_agent/src/Elixir.RabbitMQ.CLI.Ctl.Commands.ResetStatsDbCommand.erl
index 07c385e38a..ef6ac55b66 100644
--- a/deps/rabbitmq_management_agent/src/Elixir.RabbitMQ.CLI.Ctl.Commands.ResetStatsDbCommand.erl
+++ b/deps/rabbitmq_management_agent/src/Elixir.RabbitMQ.CLI.Ctl.Commands.ResetStatsDbCommand.erl
@@ -9,6 +9,8 @@
 
 -behaviour('Elixir.RabbitMQ.CLI.CommandBehaviour').
 
+-ignore_xref({'Elixir.RabbitMQ.CLI.DefaultOutput', output, 1}).
+
 -export([
          usage/0,
          validate/2,
diff --git a/deps/rabbitmq_mqtt/BUILD.bazel b/deps/rabbitmq_mqtt/BUILD.bazel
index 329d9f9b56..4315c01985 100644
--- a/deps/rabbitmq_mqtt/BUILD.bazel
+++ b/deps/rabbitmq_mqtt/BUILD.bazel
@@ -1,4 +1,5 @@
 load("@bazel-erlang//:bazel_erlang_lib.bzl", "erlc")
+load("@bazel-erlang//:xref.bzl", "xref")
 load(
     "//:rabbitmq.bzl",
     "RABBITMQ_TEST_ERLC_OPTS",
@@ -67,6 +68,8 @@ rabbitmq_lib(
     deps = DEPS,
 )
 
+xref(tags = ["xref"])
+
 broker_for_integration_suites()
 
 erlc(
diff --git a/deps/rabbitmq_mqtt/src/Elixir.RabbitMQ.CLI.Ctl.Commands.DecommissionMqttNodeCommand.erl b/deps/rabbitmq_mqtt/src/Elixir.RabbitMQ.CLI.Ctl.Commands.DecommissionMqttNodeCommand.erl
index 205799f2a9..6b75e63bda 100644
--- a/deps/rabbitmq_mqtt/src/Elixir.RabbitMQ.CLI.Ctl.Commands.DecommissionMqttNodeCommand.erl
+++ b/deps/rabbitmq_mqtt/src/Elixir.RabbitMQ.CLI.Ctl.Commands.DecommissionMqttNodeCommand.erl
@@ -10,6 +10,8 @@
 
 -behaviour('Elixir.RabbitMQ.CLI.CommandBehaviour').
 
+-ignore_xref({'Elixir.RabbitMQ.CLI.DefaultOutput', output, 1}).
+
 -export([scopes/0,
          switches/0,
          aliases/0,
diff --git a/deps/rabbitmq_mqtt/src/Elixir.RabbitMQ.CLI.Ctl.Commands.ListMqttConnectionsCommand.erl b/deps/rabbitmq_mqtt/src/Elixir.RabbitMQ.CLI.Ctl.Commands.ListMqttConnectionsCommand.erl
index 45d49fa600..bbacf9245f 100644
--- a/deps/rabbitmq_mqtt/src/Elixir.RabbitMQ.CLI.Ctl.Commands.ListMqttConnectionsCommand.erl
+++ b/deps/rabbitmq_mqtt/src/Elixir.RabbitMQ.CLI.Ctl.Commands.ListMqttConnectionsCommand.erl
@@ -10,6 +10,14 @@
 
 -behaviour('Elixir.RabbitMQ.CLI.CommandBehaviour').
 
+-ignore_xref([
+    {'Elixir.RabbitMQ.CLI.DefaultOutput', output, 1},
+    {'Elixir.RabbitMQ.CLI.Ctl.InfoKeys', prepare_info_keys, 1},
+    {'Elixir.RabbitMQ.CLI.Ctl.RpcStream', receive_list_items, 7},
+    {'Elixir.RabbitMQ.CLI.Ctl.InfoKeys', validate_info_keys, 2},
+    {'Elixir.Enum', join, 2}
+]).
+
 -export([formatter/0,
          scopes/0,
          switches/0,
diff --git a/deps/rabbitmq_peer_discovery_aws/BUILD.bazel b/deps/rabbitmq_peer_discovery_aws/BUILD.bazel
index eb1260822f..c2c442ff97 100644
--- a/deps/rabbitmq_peer_discovery_aws/BUILD.bazel
+++ b/deps/rabbitmq_peer_discovery_aws/BUILD.bazel
@@ -1,3 +1,4 @@
+load("@bazel-erlang//:xref.bzl", "xref")
 load(
     "//:rabbitmq.bzl",
     "broker_for_integration_suites",
@@ -32,6 +33,8 @@ rabbitmq_lib(
     deps = DEPS,
 )
 
+xref(tags = ["xref"])
+
 broker_for_integration_suites()
 
 PACKAGE = "deps/rabbitmq_peer_discovery_aws"
diff --git a/deps/rabbitmq_peer_discovery_common/BUILD.bazel b/deps/rabbitmq_peer_discovery_common/BUILD.bazel
index 5244dcd9bc..f3fee9c5b9 100644
--- a/deps/rabbitmq_peer_discovery_common/BUILD.bazel
+++ b/deps/rabbitmq_peer_discovery_common/BUILD.bazel
@@ -1,4 +1,5 @@
 load("@bazel-erlang//:bazel_erlang_lib.bzl", "erlc")
+load("@bazel-erlang//:xref.bzl", "xref")
 load(
     "//:rabbitmq.bzl",
     "RABBITMQ_ERLC_OPTS",
@@ -45,6 +46,8 @@ rabbitmq_lib(
     deps = DEPS,
 )
 
+xref(tags = ["xref"])
+
 broker_for_integration_suites()
 
 PACKAGE = "deps/rabbitmq_peer_discovery_common"
diff --git a/deps/rabbitmq_peer_discovery_consul/BUILD.bazel b/deps/rabbitmq_peer_discovery_consul/BUILD.bazel
index e01babfe1b..77b28c7c76 100644
--- a/deps/rabbitmq_peer_discovery_consul/BUILD.bazel
+++ b/deps/rabbitmq_peer_discovery_consul/BUILD.bazel
@@ -1,3 +1,4 @@
+load("@bazel-erlang//:xref.bzl", "xref")
 load(
     "//:rabbitmq.bzl",
     "broker_for_integration_suites",
@@ -29,6 +30,8 @@ rabbitmq_lib(
     deps = DEPS,
 )
 
+xref(tags = ["xref"])
+
 broker_for_integration_suites()
 
 PACKAGE = "deps/rabbitmq_peer_discovery_consul"
diff --git a/deps/rabbitmq_peer_discovery_etcd/BUILD.bazel b/deps/rabbitmq_peer_discovery_etcd/BUILD.bazel
index b63fe77ea1..d22d97cb41 100644
--- a/deps/rabbitmq_peer_discovery_etcd/BUILD.bazel
+++ b/deps/rabbitmq_peer_discovery_etcd/BUILD.bazel
@@ -1,3 +1,4 @@
+load("@bazel-erlang//:xref.bzl", "xref")
 load(
     "//:rabbitmq.bzl",
     "broker_for_integration_suites",
@@ -31,6 +32,8 @@ rabbitmq_lib(
     deps = DEPS,
 )
 
+xref(tags = ["xref"])
+
 broker_for_integration_suites()
 
 PACKAGE = "deps/rabbitmq_peer_discovery_etcd"
diff --git a/deps/rabbitmq_peer_discovery_k8s/BUILD.bazel b/deps/rabbitmq_peer_discovery_k8s/BUILD.bazel
index 515722565b..221666d66d 100644
--- a/deps/rabbitmq_peer_discovery_k8s/BUILD.bazel
+++ b/deps/rabbitmq_peer_discovery_k8s/BUILD.bazel
@@ -1,3 +1,4 @@
+load("@bazel-erlang//:xref.bzl", "xref")
 load(
     "//:rabbitmq.bzl",
     "broker_for_integration_suites",
@@ -29,6 +30,8 @@ rabbitmq_lib(
     deps = DEPS,
 )
 
+xref(tags = ["xref"])
+
 broker_for_integration_suites()
 
 PACKAGE = "deps/rabbitmq_peer_discovery_k8s"
diff --git a/deps/rabbitmq_prometheus/BUILD.bazel b/deps/rabbitmq_prometheus/BUILD.bazel
index 21ddfebd45..e6720f187d 100644
--- a/deps/rabbitmq_prometheus/BUILD.bazel
+++ b/deps/rabbitmq_prometheus/BUILD.bazel
@@ -1,3 +1,4 @@
+load("@bazel-erlang//:xref.bzl", "xref")
 load(
     "//:rabbitmq.bzl",
     "broker_for_integration_suites",
@@ -37,6 +38,8 @@ rabbitmq_lib(
     deps = DEPS,
 )
 
+xref(tags = ["xref"])
+
 broker_for_integration_suites()
 
 PACKAGE = "deps/rabbitmq_prometheus"
diff --git a/workspace_helpers.bzl b/workspace_helpers.bzl
index ad416c1dc5..8c22004134 100644
--- a/workspace_helpers.bzl
+++ b/workspace_helpers.bzl
@@ -19,6 +19,12 @@ def rabbitmq_external_deps(rabbitmq_workspace = "@rabbitmq-server"):
         version = "0.5.6",
     )
 
+    hex_pm_bazel_erlang_lib(
+        name = "base64url",
+        version = "1.0.1",
+        sha256 = "f9b3add4731a02a9b0410398b475b33e7566a695365237a6bdee1bb447719f5c",
+    )
+
     new_git_repository(
         name = "bats",
         remote = "https://github.com/sstephenson/bats",