@Extension on static field is not kosher

core/src/main/java/hudson/security/LegacySecurityRealm.java

@@ -26,6 +26,8 @@ package hudson.security;
 import org.acegisecurity.AuthenticationManager;
 import org.acegisecurity.Authentication;
 import org.acegisecurity.AuthenticationException;
+import org.kohsuke.accmod.Restricted;
+import org.kohsuke.accmod.restrictions.NoExternalUse;
 import org.springframework.web.context.WebApplicationContext;
 import org.kohsuke.stapler.StaplerRequest;
 import groovy.lang.Binding;
@@ -88,8 +90,19 @@ public final class LegacySecurityRealm extends SecurityRealm implements Authenti
         return (Filter) context.getBean("legacy");
     }
 
+    /**
+     * @deprecated as of 2.0
+     *      Don't use this field, use injection.
+     */
+    @Restricted(NoExternalUse.class)
+    public static /*almost final*/ Descriptor<SecurityRealm> DESCRIPTOR;
+
     @Extension
-    public static final Descriptor<SecurityRealm> DESCRIPTOR = new Descriptor<SecurityRealm>() {
+    public static class DescriptorImpl extends  Descriptor<SecurityRealm> {
+        public DescriptorImpl() {
+            DESCRIPTOR = this;
+        }
+
         public SecurityRealm newInstance(StaplerRequest req, JSONObject formData) throws FormException {
             return new LegacySecurityRealm();
         }