diff --git a/pom.xml b/pom.xml
index e515a20b..fe1af9f1 100644
--- a/pom.xml
+++ b/pom.xml
@@ -173,6 +173,8 @@
       ~ See: https://bnd.bndtools.org/chapters/330-jpms.html#advanced-options
       -->
     <bnd-extra-module-options />
+    <!-- Allows to extend the `bnd-maven-plugin` configuration with extras: -->
+    <bnd-extra-config />
 
     <!-- dependency versions -->
     <org.eclipse.jgit.version>6.7.0.202309050840-r</org.eclipse.jgit.version>
@@ -719,7 +721,10 @@
             -jpms-module-info: $[bnd-module-name];access=0
 
             # Prevents an execution error in multi-release jars:
-            -fixupmessages: "Classes found in the wrong directory";restrict:=error;is:=warning
+            -fixupmessages.classes_in_wrong_dir: "Classes found in the wrong directory";restrict:=error;is:=warning
+
+            # Convert API leakage warnings to errors
+            -fixupmessages.priv_refs: "private references";restrict:=warning;is:=error
 
             # 1. OSGI modules do not make sense in JPMS
             # 2. BND has a problem detecting the name of multi-release JPMS modules
@@ -740,6 +745,9 @@
 
             # Add manifests and modules for each multi-release version:
             -jpms-multi-release: $[bnd-multi-release]
+
+            # Extra configuration provided by the consumer:
+            ${bnd-extra-config}
           ]]></bnd>
         </configuration>
         <executions>
diff --git a/src/changelog/.10.x.x/add-bnd-extra-config.xml b/src/changelog/.10.x.x/add-bnd-extra-config.xml
new file mode 100644
index 00000000..d3befa2d
--- /dev/null
+++ b/src/changelog/.10.x.x/add-bnd-extra-config.xml
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<entry xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+       xmlns="http://logging.apache.org/log4j/changelog"
+       xsi:schemaLocation="http://logging.apache.org/log4j/changelog https://logging.apache.org/log4j/changelog-0.1.2.xsd"
+       type="added">
+  <issue id="apache/logging-log4j2#1895" link="https://github.com/apache/logging-log4j2/issues/1895"/>
+  <author id="github:vy"/>
+  <description format="asciidoc">Added support to extend the `bnd-maven-plugin` configuration with `bnd-extra-config` property</description>
+</entry>
diff --git a/src/changelog/.10.x.x/fail-bnd-on-api-leak.xml b/src/changelog/.10.x.x/fail-bnd-on-api-leak.xml
new file mode 100644
index 00000000..8daa9074
--- /dev/null
+++ b/src/changelog/.10.x.x/fail-bnd-on-api-leak.xml
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<entry xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+       xmlns="http://logging.apache.org/log4j/changelog"
+       xsi:schemaLocation="http://logging.apache.org/log4j/changelog https://logging.apache.org/log4j/changelog-0.1.2.xsd"
+       type="changed">
+  <issue id="apache/logging-log4j2#1895" link="https://github.com/apache/logging-log4j2/issues/1895"/>
+  <author id="github:vy"/>
+  <description format="asciidoc">Converted `bnd-maven-plugin` API leakage warnings to errors</description>
+</entry>
diff --git a/src/site/_release-notes/_10.x.x.adoc b/src/site/_release-notes/_10.x.x.adoc
index f9156ad3..e196fcc3 100644
--- a/src/site/_release-notes/_10.x.x.adoc
+++ b/src/site/_release-notes/_10.x.x.adoc
@@ -41,7 +41,16 @@
 This minor release contains several small improvements.
 
 
+==== Added
+
+* Added support to extend the `bnd-maven-plugin` configuration with `bnd-extra-config` property (https://github.com/apache/logging-log4j2/issues/1895[apache/logging-log4j2#1895])
+
 ==== Changed
 
+* Converted `bnd-maven-plugin` API leakage warnings to errors (https://github.com/apache/logging-log4j2/issues/1895[apache/logging-log4j2#1895])
 * Update `com.google.errorprone:error_prone_core` to version `2.23.0` (https://github.com/apache/logging-parent/pull/49[49])
 * Update `github/codeql-action` to version `2.22.4` (https://github.com/apache/logging-parent/pull/51[51])
+
+==== Fixed
+
+* Attach `flatten:clean` to `clean` phase