diff --git a/docs/ai-generated/tasks/PR#-DependencyVulnerabilityAnalysis/issues/135-t2-12-xerces-default-factory-hardening.md b/docs/ai-generated/tasks/PR#-DependencyVulnerabilityAnalysis/issues/135-t2-12-xerces-default-factory-hardening.md
index dcd4ebfbf..a95b24117 100644
--- a/docs/ai-generated/tasks/PR#-DependencyVulnerabilityAnalysis/issues/135-t2-12-xerces-default-factory-hardening.md
+++ b/docs/ai-generated/tasks/PR#-DependencyVulnerabilityAnalysis/issues/135-t2-12-xerces-default-factory-hardening.md
@@ -17,7 +17,18 @@ Both factories are the JAXP defaults for ~100+ call sites in the project (the gr
 
 ### 1. `modules/utils/.../xml/PSDocumentBuilderFactoryImpl.java`
 
-In the constructor, apply the same secure feature set `PSSecureXMLUtils.enableDBFFeatures` already applies, using the URI constants `PSSecureXMLUtils.DISALLOW_DOCTYPES_FEATURE`, `SAX_GENERAL_EXTERNAL_ENTITIES_FEATURE`, `X1_GENERAL_EXTERNAL_ENTITIES_FEATURE`, `X2_GENERAL_EXTERNAL_ENTITIES_FEATURE`, `SAX_EXTERNAL_PARAMETER_ENTITIES_FEATURE`, `LOAD_EXTERNAL_DTD`, and `XMLConstants.FEATURE_SECURE_PROCESSING`. Each `setFeature` call goes through a new private `setFeatureSafe(...)` helper that catches `ParserConfigurationException` and logs at WARN — missing features are treated as not-enforced rather than fatal, matching the `PSSecureXMLUtils` posture.
+In the constructor, apply the same secure feature set `PSSecureXMLUtils.enableDBFFeatures` already applies, using the URI constants `PSSecureXMLUtils.DISALLOW_DOCTYPES_FEATURE`, `SAX_GENERAL_EXTERNAL_ENTITIES_FEATURE`, `SAX_EXTERNAL_PARAMETER_ENTITIES_FEATURE`, `LOAD_EXTERNAL_DTD`, and `XMLConstants.FEATURE_SECURE_PROCESSING`. Each `setFeature` call goes through a new private `setFeatureSafe(...)` helper that catches `ParserConfigurationException` and logs at WARN — missing features are treated as not-enforced rather than fatal, matching the `PSSecureXMLUtils` posture.
+
+> **Note (post-merge revision):** the Xerces-1 and Xerces-2 feature URIs
+> (`PSSecureXMLUtils.X1_GENERAL_EXTERNAL_ENTITIES_FEATURE` /
+> `X2_GENERAL_EXTERNAL_ENTITIES_FEATURE`) are not recognized by Xerces 2.12.x —
+> modern Xerces consolidated the external-entity controls into the SAX-namespace
+> features and JAXP's `FEATURE_SECURE_PROCESSING`. The original PR copied them
+> in alongside the SAX features and emitted `WARN: T2.12 hardening: could not
+> enforce X1_GENERAL_EXTERNAL_ENTITIES_FEATURE=false on DocumentBuilderFactory:
+> Feature '...' is not recognized.` on every factory instantiation (×10+ at
+> startup). They've been removed; the SAX-namespace features above provide the
+> same control on the actual parser.
 
 Also sets `setXIncludeAware(false)` and `setExpandEntityReferences(false)` (using the `PSSecureXMLUtils.XINCLUDE_AWARE` and `EXPAND_ENTITY_REFERENCES` constants, both `false`).
 
diff --git a/modules/utils/src/main/java/com/percussion/xml/PSDocumentBuilderFactoryImpl.java b/modules/utils/src/main/java/com/percussion/xml/PSDocumentBuilderFactoryImpl.java
index 5449ee630..1c2ccb85f 100644
--- a/modules/utils/src/main/java/com/percussion/xml/PSDocumentBuilderFactoryImpl.java
+++ b/modules/utils/src/main/java/com/percussion/xml/PSDocumentBuilderFactoryImpl.java
@@ -67,14 +67,6 @@ public PSDocumentBuilderFactoryImpl() {
         PSSecureXMLUtils.SAX_GENERAL_EXTERNAL_ENTITIES_FEATURE,
         false,
         "SAX_GENERAL_EXTERNAL_ENTITIES_FEATURE");
-    setFeatureSafe(
-        PSSecureXMLUtils.X1_GENERAL_EXTERNAL_ENTITIES_FEATURE,
-        false,
-        "X1_GENERAL_EXTERNAL_ENTITIES_FEATURE");
-    setFeatureSafe(
-        PSSecureXMLUtils.X2_GENERAL_EXTERNAL_ENTITIES_FEATURE,
-        false,
-        "X2_GENERAL_EXTERNAL_ENTITIES_FEATURE");
     setFeatureSafe(
         PSSecureXMLUtils.SAX_EXTERNAL_PARAMETER_ENTITIES_FEATURE,
         false,