diff --git a/maven-resolver-transport-http/pom.xml b/maven-resolver-transport-http/pom.xml
index 82930f44a..6899746f9 100644
--- a/maven-resolver-transport-http/pom.xml
+++ b/maven-resolver-transport-http/pom.xml
@@ -37,17 +37,6 @@
     <jettyVersion>9.4.51.v20230217</jettyVersion>
   </properties>
 
-  <dependencyManagement>
-    <dependencies>
-      <!-- HttpClient pulls in 1.11 that has CVE. Is not used directly in code -->
-      <dependency>
-        <groupId>commons-codec</groupId>
-        <artifactId>commons-codec</artifactId>
-        <version>1.15</version>
-      </dependency>
-    </dependencies>
-  </dependencyManagement>
-
   <dependencies>
     <dependency>
       <groupId>org.apache.maven.resolver</groupId>
@@ -71,6 +60,11 @@
           <groupId>commons-logging</groupId>
           <artifactId>commons-logging</artifactId>
         </exclusion>
+        <exclusion>
+          <!-- httpclient uses old codec -->
+          <groupId>commons-codec</groupId>
+          <artifactId>commons-codec</artifactId>
+        </exclusion>
       </exclusions>
     </dependency>
     <dependency>
@@ -78,6 +72,12 @@
       <artifactId>httpcore</artifactId>
       <version>4.4.16</version>
     </dependency>
+    <dependency>
+      <groupId>commons-codec</groupId>
+      <artifactId>commons-codec</artifactId>
+      <version>1.15</version>
+      <scope>runtime</scope>
+    </dependency>
     <dependency>
       <groupId>org.slf4j</groupId>
       <artifactId>jcl-over-slf4j</artifactId>