diff --git a/core/src/main/java/org/eclipse/gemini/blueprint/config/internal/adapter/OsgiServiceLifecycleListenerAdapter.java b/core/src/main/java/org/eclipse/gemini/blueprint/config/internal/adapter/OsgiServiceLifecycleListenerAdapter.java
index afa1911..8b9e6c4 100644
--- a/core/src/main/java/org/eclipse/gemini/blueprint/config/internal/adapter/OsgiServiceLifecycleListenerAdapter.java
+++ b/core/src/main/java/org/eclipse/gemini/blueprint/config/internal/adapter/OsgiServiceLifecycleListenerAdapter.java
@@ -14,20 +14,12 @@
 
 package org.eclipse.gemini.blueprint.config.internal.adapter;
 
-import java.lang.reflect.Method;
-import java.security.AccessControlContext;
-import java.security.AccessController;
-import java.security.PrivilegedAction;
-import java.security.PrivilegedActionException;
-import java.security.PrivilegedExceptionAction;
-import java.util.List;
-import java.util.Map;
-
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 import org.eclipse.gemini.blueprint.context.support.internal.security.SecurityUtils;
 import org.eclipse.gemini.blueprint.service.importer.ImportedOsgiServiceProxy;
 import org.eclipse.gemini.blueprint.service.importer.OsgiServiceLifecycleListener;
+import org.eclipse.gemini.blueprint.service.importer.ServiceReferenceProxy;
 import org.eclipse.gemini.blueprint.util.internal.ReflectionUtils;
 import org.osgi.framework.ServiceReference;
 import org.springframework.beans.BeansException;
@@ -38,6 +30,15 @@
 import org.springframework.util.ObjectUtils;
 import org.springframework.util.StringUtils;
 
+import java.lang.reflect.Method;
+import java.security.AccessControlContext;
+import java.security.AccessController;
+import java.security.PrivilegedAction;
+import java.security.PrivilegedActionException;
+import java.security.PrivilegedExceptionAction;
+import java.util.List;
+import java.util.Map;
+
 /**
  * OsgiServiceLifecycleListener wrapper for custom beans, useful when custom methods are being used.
  * 
@@ -205,6 +206,11 @@
 			ServiceReference ref =
 					(service != null ? ((ImportedOsgiServiceProxy) service).getServiceReference() : null);
 
+			// Never expose the internal proxies; they cannot be used to safely obtain service instances.
+			if (ref != null) {
+				ref = ((ServiceReferenceProxy) ref).getTargetServiceReference();
+			}
+
 			try {
 				ReflectionUtils.invokeMethod(method, target, new Object[] { ref });
 			}
diff --git a/core/src/main/java/org/eclipse/gemini/blueprint/config/internal/adapter/OsgiServiceRegistrationListenerAdapter.java b/core/src/main/java/org/eclipse/gemini/blueprint/config/internal/adapter/OsgiServiceRegistrationListenerAdapter.java
index 2aecba4..d45eaa4 100644
--- a/core/src/main/java/org/eclipse/gemini/blueprint/config/internal/adapter/OsgiServiceRegistrationListenerAdapter.java
+++ b/core/src/main/java/org/eclipse/gemini/blueprint/config/internal/adapter/OsgiServiceRegistrationListenerAdapter.java
@@ -14,15 +14,6 @@
 
 package org.eclipse.gemini.blueprint.config.internal.adapter;
 
-import java.lang.reflect.Method;
-import java.security.AccessControlContext;
-import java.security.AccessController;
-import java.security.PrivilegedAction;
-import java.security.PrivilegedActionException;
-import java.security.PrivilegedExceptionAction;
-import java.util.List;
-import java.util.Map;
-
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 import org.eclipse.gemini.blueprint.context.support.internal.security.SecurityUtils;
@@ -33,6 +24,15 @@
 import org.springframework.util.Assert;
 import org.springframework.util.StringUtils;
 
+import java.lang.reflect.Method;
+import java.security.AccessControlContext;
+import java.security.AccessController;
+import java.security.PrivilegedAction;
+import java.security.PrivilegedActionException;
+import java.security.PrivilegedExceptionAction;
+import java.util.List;
+import java.util.Map;
+
 /**
  * Adapter/wrapper class that handles listener with custom method invocation. Similar in functionality to
  * {@link org.eclipse.gemini.blueprint.config.internal.adapter.OsgiServiceLifecycleListenerAdapter}.
@@ -140,12 +140,10 @@
 
 			try {
 				if (isSecurityEnabled) {
-					AccessController.doPrivileged(new PrivilegedExceptionAction<Object>() {
-						public Object run() throws Exception {
-							((OsgiServiceRegistrationListener) target).registered(service, serviceProperties);
-							return null;
-						}
-					}, acc);
+					AccessController.doPrivileged((PrivilegedExceptionAction<Object>) () -> {
+                        ((OsgiServiceRegistrationListener) target).registered(service, serviceProperties);
+                        return null;
+                    }, acc);
 				} else {
 					((OsgiServiceRegistrationListener) target).registered(service, serviceProperties);
 				}
@@ -158,13 +156,11 @@
 		}
 
 		if (isSecurityEnabled) {
-			AccessController.doPrivileged(new PrivilegedAction<Object>() {
-				public Object run() {
-					CustomListenerAdapterUtils.invokeCustomMethods(target, registrationMethods, service,
-							serviceProperties);
-					return null;
-				}
-			}, acc);
+			AccessController.doPrivileged((PrivilegedAction<Object>) () -> {
+                CustomListenerAdapterUtils.invokeCustomMethods(target, registrationMethods, service,
+                        serviceProperties);
+                return null;
+            }, acc);
 		} else {
 			CustomListenerAdapterUtils.invokeCustomMethods(target, registrationMethods, service, serviceProperties);
 		}
@@ -194,12 +190,10 @@
 
 			try {
 				if (isSecurityEnabled) {
-					AccessController.doPrivileged(new PrivilegedExceptionAction<Object>() {
-						public Object run() throws Exception {
-							((OsgiServiceRegistrationListener) target).unregistered(service, serviceProperties);
-							return null;
-						}
-					}, acc);
+					AccessController.doPrivileged((PrivilegedExceptionAction<Object>) () -> {
+                        ((OsgiServiceRegistrationListener) target).unregistered(service, serviceProperties);
+                        return null;
+                    }, acc);
 				} else {
 					((OsgiServiceRegistrationListener) target).unregistered(service, serviceProperties);
 				}
@@ -209,13 +203,11 @@
 		}
 
 		if (isSecurityEnabled) {
-			AccessController.doPrivileged(new PrivilegedAction<Object>() {
-				public Object run() {
-					CustomListenerAdapterUtils.invokeCustomMethods(target, unregistrationMethods, service,
-							serviceProperties);
-					return null;
-				}
-			}, acc);
+			AccessController.doPrivileged((PrivilegedAction<Object>) () -> {
+                CustomListenerAdapterUtils.invokeCustomMethods(target, unregistrationMethods, service,
+                        serviceProperties);
+                return null;
+            }, acc);
 		} else {
 			CustomListenerAdapterUtils.invokeCustomMethods(target, unregistrationMethods, service, serviceProperties);
 		}