diff --git a/checkstyle.xml b/checkstyle.xml
index 19c7c6fc12..351e462489 100644
--- a/checkstyle.xml
+++ b/checkstyle.xml
@@ -32,6 +32,21 @@
 
   <module name="TreeWalker">
 
+    <!--
+      Inline suppression of the SystemOut rule for a single, justified line. Write the marker as a
+      trailing comment ON the offending line, followed by a reason:
+        someCall(); // checkstyle:ignore SystemOut - why this System.out/err is legitimate here
+      influenceFormat=0 limits the suppression to the commented line only. checkFormat names the
+      checkstyle check that raises the violation (System.out and printStackTrace share the
+      RegexpSinglelineJava check; the distinct "SystemOut" marker keeps the intent readable).
+      Add an analogous filter per rule that needs line-level exceptions.
+    -->
+    <module name="SuppressWithNearbyCommentFilter">
+      <property name="commentFormat" value="checkstyle:ignore\s+SystemOut\b"/>
+      <property name="checkFormat" value="RegexpSinglelineJava"/>
+      <property name="influenceFormat" value="0"/>
+    </module>
+
     <!-- No star imports (coding-conventions: "no star imports are used") -->
     <module name="AvoidStarImport"/>
     <module name="RedundantImport"/>
@@ -60,8 +75,11 @@
         value="LITERAL_IF, LITERAL_ELSE, LITERAL_FOR, LITERAL_WHILE, LITERAL_DO"/>
     </module>
 
-    <!-- No System.out / System.err (coding-conventions: "No System output") -->
+    <!-- No System.out / System.err (coding-conventions: "No System output").
+         id "SystemOut" is the handle used to suppress justified exceptions, e.g.
+         a trailing "// checkstyle:ignore SystemOut - reason" or the log-package filter below. -->
     <module name="RegexpSinglelineJava">
+      <property name="id" value="SystemOut"/>
       <property name="format" value="System\.(out|err)\."/>
       <property name="message"
         value="Do not use System.out/System.err; use the logger (context / SLF4J) instead."/>
@@ -77,4 +95,11 @@
     </module>
 
   </module>
+
+  <!-- The logging implementation in the "log" package IS the console output, so it must write to
+       System.out/System.err directly. Suppress only the SystemOut rule there (other rules stay on). -->
+  <module name="SuppressionSingleFilter">
+    <property name="id" value="SystemOut"/>
+    <property name="files" value="[\\/]ide[\\/]log[\\/][^\\/]+\.java$"/>
+  </module>
 </module>
diff --git a/cli/src/main/java/com/devonfw/tools/ide/cli/GraalVmHelper.java b/cli/src/main/java/com/devonfw/tools/ide/cli/GraalVmHelper.java
index 732c57cbf1..b0d795c920 100644
--- a/cli/src/main/java/com/devonfw/tools/ide/cli/GraalVmHelper.java
+++ b/cli/src/main/java/com/devonfw/tools/ide/cli/GraalVmHelper.java
@@ -44,7 +44,8 @@ public Path getCwd() {
       Path ideasyBinaryPath = Path.of(executableName).toAbsolutePath();
       Path binPath = ideasyBinaryPath.getParent();
       if (!binPath.getFileName().toString().equals("bin")) {
-        System.out.println("WARNING: Expected native image binary to be in bin path but found " + ideasyBinaryPath);
+        // runs during native-image startup before the IDEasy logger is initialized
+        System.out.println("WARNING: Expected native image binary to be in bin path but found " + ideasyBinaryPath); // checkstyle:ignore SystemOut
       }
       cwd = binPath.getParent();
     } else {
diff --git a/cli/src/main/java/com/devonfw/tools/ide/cli/Ideasy.java b/cli/src/main/java/com/devonfw/tools/ide/cli/Ideasy.java
index 74cc95c538..d5e7a0b5f7 100644
--- a/cli/src/main/java/com/devonfw/tools/ide/cli/Ideasy.java
+++ b/cli/src/main/java/com/devonfw/tools/ide/cli/Ideasy.java
@@ -114,7 +114,7 @@ private void initContext(CliArguments arguments) {
         if (property instanceof FlagProperty) {
           ((FlagProperty) property).setValue(Boolean.TRUE);
         } else {
-          System.err.println("Missing value for option " + key);
+          System.err.println("Missing value for option " + key); // checkstyle:ignore SystemOut - option parsing runs before the logger is initialized
         }
       } else {
         property.setValueAsString(value, this.context);
diff --git a/cli/src/main/java/com/devonfw/tools/ide/commandlet/CompleteCommandlet.java b/cli/src/main/java/com/devonfw/tools/ide/commandlet/CompleteCommandlet.java
index b601d89278..f8e8efed08 100644
--- a/cli/src/main/java/com/devonfw/tools/ide/commandlet/CompleteCommandlet.java
+++ b/cli/src/main/java/com/devonfw/tools/ide/commandlet/CompleteCommandlet.java
@@ -55,8 +55,8 @@ protected void doRun() {
     CliArguments arguments = CliArguments.ofCompletion(this.args.asArray());
     List<CompletionCandidate> candidates = ((AbstractIdeContext) this.context).complete(arguments, true);
     for (CompletionCandidate candidate : candidates) {
-      System.out.print(candidate.text()); // enforce output via System.out even if logging is disabled
-      System.out.print('\n'); // do not use println to prevent Carriage-Return character in bash completion on Windows
+      System.out.print(candidate.text()); // checkstyle:ignore SystemOut - completion output must reach stdout even when logging is disabled
+      System.out.print('\n'); // checkstyle:ignore SystemOut - raw newline (not println) avoids a CR char in bash completion on Windows
     }
   }
 }
diff --git a/cli/src/main/java/com/devonfw/tools/ide/context/AbstractIdeContext.java b/cli/src/main/java/com/devonfw/tools/ide/context/AbstractIdeContext.java
index 6663708761..e460c8ee94 100644
--- a/cli/src/main/java/com/devonfw/tools/ide/context/AbstractIdeContext.java
+++ b/cli/src/main/java/com/devonfw/tools/ide/context/AbstractIdeContext.java
@@ -1229,7 +1229,8 @@ public int run(CliArguments arguments) {
       activateLogging(cmd);
       step.error(t, true);
       if (this.logfile != null) {
-        System.err.println("Logfile can be found at " + this.logfile); // do not use logger
+        // logging just failed, so point the user to the logfile directly
+        System.err.println("Logfile can be found at " + this.logfile); // checkstyle:ignore SystemOut
       }
       throw t;
     } finally {
diff --git a/cli/src/main/java/com/devonfw/tools/ide/locking/EclipseWorkspaceLockChecker.java b/cli/src/main/java/com/devonfw/tools/ide/locking/EclipseWorkspaceLockChecker.java
index 263999cb3c..0721cf534a 100644
--- a/cli/src/main/java/com/devonfw/tools/ide/locking/EclipseWorkspaceLockChecker.java
+++ b/cli/src/main/java/com/devonfw/tools/ide/locking/EclipseWorkspaceLockChecker.java
@@ -1,8 +1,12 @@
 package com.devonfw.tools.ide.locking;
 
-import java.io.File;
 import java.io.RandomAccessFile;
 import java.nio.channels.FileLock;
+import java.nio.file.Files;
+import java.nio.file.Path;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 /**
  * Program to check if eclipse workspace is locked. A successful exit (code {@code 0}) indicates that the workspace is free. Otherwise the exit code {@code 1}
@@ -10,6 +14,8 @@
  */
 public class EclipseWorkspaceLockChecker {
 
+  private static final Logger LOG = LoggerFactory.getLogger(EclipseWorkspaceLockChecker.class);
+
   /**
    * @param args the command-line arguments. There is currently only one argument defined which is the path to the lock file.
    */
@@ -23,10 +29,10 @@ public static void main(String[] args) {
   private int run(String[] args) {
 
     if (args.length != 1) {
-      System.out.println("Usage: " + EclipseWorkspaceLockChecker.class.getSimpleName() + " <path2workspace>");
+      LOG.error("Usage: {} <path2workspace>", EclipseWorkspaceLockChecker.class.getSimpleName());
       return -1;
     }
-    File lockfile = new File(args[0]);
+    Path lockfile = Path.of(args[0]);
     boolean locked = isLocked(lockfile);
     if (locked) {
       return 1;
@@ -35,13 +41,13 @@ private int run(String[] args) {
   }
 
   /**
-   * @param lockfile the {@link File} pointing to the lockfile to check.
-   * @return {@code true} if the given {@link File} is locked, {@code false} otherwise.
+   * @param lockfile the {@link Path} pointing to the lockfile to check.
+   * @return {@code true} if the given {@link Path} is locked, {@code false} otherwise.
    */
-  public static boolean isLocked(File lockfile) {
+  public static boolean isLocked(Path lockfile) {
 
-    if (lockfile.isFile()) {
-      try (RandomAccessFile raFile = new RandomAccessFile(lockfile, "rw")) {
+    if (Files.isRegularFile(lockfile)) {
+      try (RandomAccessFile raFile = new RandomAccessFile(lockfile.toFile(), "rw")) {
         FileLock fileLock = raFile.getChannel().tryLock(0, 1, false);
         // success, file was not locked so we immediately unlock again...
         fileLock.release();
diff --git a/cli/src/main/java/com/devonfw/tools/ide/os/OperatingSystem.java b/cli/src/main/java/com/devonfw/tools/ide/os/OperatingSystem.java
index 234f5b807c..0ea110e8ce 100644
--- a/cli/src/main/java/com/devonfw/tools/ide/os/OperatingSystem.java
+++ b/cli/src/main/java/com/devonfw/tools/ide/os/OperatingSystem.java
@@ -56,7 +56,7 @@ public static OperatingSystem ofName(String osName) {
     } else if (os.contains("ix")) {
       return OperatingSystem.LINUX;
     } else {
-      System.err.println("ERROR: Unknown operating system '" + osName + "'");
+      System.err.println("ERROR: Unknown operating system '" + osName + "'"); // checkstyle:ignore SystemOut - static OS detection, no logger available
       // be tolerant: most of our users are working on windows
       // in case of an odd JVM or virtualization issue let us better continue than failing
       return OperatingSystem.WINDOWS;
diff --git a/cli/src/main/java/com/devonfw/tools/ide/url/model/file/UrlSecurityFile.java b/cli/src/main/java/com/devonfw/tools/ide/url/model/file/UrlSecurityFile.java
index 4df3ccd04d..22add16eca 100644
--- a/cli/src/main/java/com/devonfw/tools/ide/url/model/file/UrlSecurityFile.java
+++ b/cli/src/main/java/com/devonfw/tools/ide/url/model/file/UrlSecurityFile.java
@@ -6,6 +6,8 @@
 import java.util.List;
 import java.util.Objects;
 
+import org.jline.utils.Log;
+
 import com.devonfw.tools.ide.context.IdeContext;
 import com.devonfw.tools.ide.json.JsonMapping;
 import com.devonfw.tools.ide.url.model.file.json.Cve;
@@ -68,7 +70,7 @@ protected void doLoad() {
   public void doSave() {
 
     if ((this.security == null || this.security.getIssues().isEmpty()) && !Files.exists(getPath())) {
-      System.out.println("Skipping save for " + getPath() + " (no warnings and file doesn't exist)");
+      Log.debug("Skipping save for {} (no warnings and file doesn't exist)", getPath());
       return;
     }
 
@@ -161,5 +163,3 @@ public boolean contains(VersionIdentifier version) {
 
 
 }
-
-
diff --git a/cli/src/test/java/com/devonfw/tools/ide/io/FileAccessImplTest.java b/cli/src/test/java/com/devonfw/tools/ide/io/FileAccessImplTest.java
index e1d21e97a7..b2e12872b3 100644
--- a/cli/src/test/java/com/devonfw/tools/ide/io/FileAccessImplTest.java
+++ b/cli/src/test/java/com/devonfw/tools/ide/io/FileAccessImplTest.java
@@ -1041,7 +1041,6 @@ void testIsJunctionHandlesBrokenLinks(@TempDir Path tempDir) throws IOException
       fileAccess.symlink(newSource, brokenLink, false);
       assertThat(brokenLink.toRealPath()).isEqualTo(realPath(newSource));
     } else {
-      System.out.println("Test adapted for Windows environment - testing basic junction functionality");
       // On Windows, just test that basic junction functionality works
       Path sourceDir = tempDir.resolve("source");
       Path junctionLink = tempDir.resolve("junction");
diff --git a/cli/src/test/java/com/devonfw/tools/ide/locking/EclipseWorkspaceLockCheckerTest.java b/cli/src/test/java/com/devonfw/tools/ide/locking/EclipseWorkspaceLockCheckerTest.java
index c176defcde..d57bc049a7 100644
--- a/cli/src/test/java/com/devonfw/tools/ide/locking/EclipseWorkspaceLockCheckerTest.java
+++ b/cli/src/test/java/com/devonfw/tools/ide/locking/EclipseWorkspaceLockCheckerTest.java
@@ -1,9 +1,10 @@
 package com.devonfw.tools.ide.locking;
 
-import java.io.File;
 import java.io.IOException;
 import java.io.RandomAccessFile;
 import java.nio.channels.FileLock;
+import java.nio.file.Files;
+import java.nio.file.Path;
 
 import org.assertj.core.api.Assertions;
 import org.junit.jupiter.api.Test;
@@ -14,39 +15,38 @@
 class EclipseWorkspaceLockCheckerTest extends Assertions {
 
   /**
-   * Test of {@link EclipseWorkspaceLockChecker#isLocked(File)} for an unlocked file.
+   * Test of {@link EclipseWorkspaceLockChecker#isLocked(Path)} for an unlocked file.
    */
   @Test
   void testIsLockedUnlockedFile() throws IOException {
-    File tempFile = File.createTempFile("eclipse-lock-test", ".lock");
+    Path tempFile = Files.createTempFile("eclipse-lock-test", ".lock");
     try {
       assertThat(EclipseWorkspaceLockChecker.isLocked(tempFile)).isFalse();
     } finally {
-      tempFile.delete();
+      Files.deleteIfExists(tempFile);
     }
   }
 
   /**
-   * Test of {@link EclipseWorkspaceLockChecker#isLocked(File)} for a locked file.
+   * Test of {@link EclipseWorkspaceLockChecker#isLocked(Path)} for a locked file.
    */
   @Test
   void testIsLockedLockedFile() throws IOException {
-    File tempFile = File.createTempFile("eclipse-lock-test", ".lock");
-    try (RandomAccessFile raFile = new RandomAccessFile(tempFile, "rw");
+    Path tempFile = Files.createTempFile("eclipse-lock-test", ".lock");
+    try (RandomAccessFile raFile = new RandomAccessFile(tempFile.toFile(), "rw");
         FileLock lock = raFile.getChannel().lock()) {
       assertThat(EclipseWorkspaceLockChecker.isLocked(tempFile)).isTrue();
     } finally {
-      tempFile.delete();
+      Files.deleteIfExists(tempFile);
     }
   }
 
   /**
-   * Test of {@link EclipseWorkspaceLockChecker#isLocked(File)} for a non-existent file.
+   * Test of {@link EclipseWorkspaceLockChecker#isLocked(Path)} for a non-existent file.
    */
   @Test
   void testIsLockedNonExistentFile() {
-    File file = new File("non-existent-file.lock");
+    Path file = Path.of("non-existent-file.lock");
     assertThat(EclipseWorkspaceLockChecker.isLocked(file)).isFalse();
   }
 }
-
diff --git a/cli/src/test/java/com/devonfw/tools/ide/tool/intellij/IntellijTest.java b/cli/src/test/java/com/devonfw/tools/ide/tool/intellij/IntellijTest.java
index 94a8b30a07..aa148b2fac 100644
--- a/cli/src/test/java/com/devonfw/tools/ide/tool/intellij/IntellijTest.java
+++ b/cli/src/test/java/com/devonfw/tools/ide/tool/intellij/IntellijTest.java
@@ -93,7 +93,6 @@ void testIntellijRun(String os) {
     SystemInfo systemInfo = SystemInfoMock.of(os);
     this.context.setSystemInfo(systemInfo);
     Intellij commandlet = new Intellij(this.context);
-    System.out.println("Starting testIntellijRun on " + os);
 
     // act
     commandlet.run();
@@ -219,7 +218,7 @@ void testAdjustRequestedEditionSwitchesForUltimateWithoutConfiguredVersion() {
 
   /**
    * Tests whether IDEasy correctly switches editions when the specified version is after 2025.2.6.1
-   */ 
+   */
   @Test
   void testAdjustRequestedEditionSwitchesForUltimateWithVersionAboveCutoff() {
 
@@ -254,7 +253,7 @@ void testAdjustRequestedEditionDoesNotSwitchForUltimateAtCutoffVersion() {
     // assert
     assertThat(adjusted.getEdition().edition()).isEqualTo("ultimate");
   }
-  
+
   /**
    * Tests if the custom jvm options of the ide variable INTELLI_VM_ARGS have been set.
    */
diff --git a/cli/src/test/java/com/devonfw/tools/ide/tool/pycharm/PycharmTest.java b/cli/src/test/java/com/devonfw/tools/ide/tool/pycharm/PycharmTest.java
index 8f6a00ea4c..09046e6b80 100644
--- a/cli/src/test/java/com/devonfw/tools/ide/tool/pycharm/PycharmTest.java
+++ b/cli/src/test/java/com/devonfw/tools/ide/tool/pycharm/PycharmTest.java
@@ -88,7 +88,6 @@ void testPycharmRun(String os) {
     SystemInfo systemInfo = SystemInfoMock.of(os);
     this.context.setSystemInfo(systemInfo);
     Pycharm commandlet = new Pycharm(this.context);
-    System.out.println("Starting testPycharmRun on " + os);
 
     // act
     commandlet.run();