diff --git a/.build/check-code.sh b/.build/check-code.sh
index 28bc5c576a..15ded7d374 100755
--- a/.build/check-code.sh
+++ b/.build/check-code.sh
@@ -23,6 +23,6 @@ command -v ant >/dev/null 2>&1 || { echo >&2 "ant needs to be installed"; exit 1
 [ -d "${CASSANDRA_DIR}" ] || { echo >&2 "Directory ${CASSANDRA_DIR} must exist"; exit 1; }
 [ -f "${CASSANDRA_DIR}/build.xml" ] || { echo >&2 "${CASSANDRA_DIR}/build.xml must exist"; exit 1; }
 
-# execute
-ant -f "${CASSANDRA_DIR}/build.xml" check # dependency-check # FIXME dependency-check now requires NVD key downloaded first
+# execute. memory needs to fit within the specified container size, see .jenkins/Jenkinsfile
+ANT_OPTS="-Xmx1g" ant -f "${CASSANDRA_DIR}/build.xml" check # dependency-check # FIXME dependency-check now requires NVD key downloaded first
 exit $?
diff --git a/.jenkins/Jenkinsfile b/.jenkins/Jenkinsfile
index 163968934e..25cac0c3f8 100644
--- a/.jenkins/Jenkinsfile
+++ b/.jenkins/Jenkinsfile
@@ -166,13 +166,15 @@ def tasks() {
   def buildSteps = [
     'jar': [script: 'build-jars.sh', toCopy: null],
     'artifacts': [script: 'build-artifacts.sh', toCopy: 'apache-cassandra-*.tar.gz,apache-cassandra-*.jar,apache-cassandra-*.pom'],
-    'lint': [script: 'check-code.sh', toCopy: null],
+    'lint': [script: 'check-code.sh', size: 'medium', toCopy: null],
     'debian': [script: 'build-debian.sh', toCopy: 'cassandra_*,cassandra-tools_*'],
     'redhat': [script: 'build-redhat.sh rpm', toCopy: '*.rpm'],
   ]
   buildSteps.each() {
     it.value.put('type', 'build')
-    it.value.put('size', 'small')
+    if (!it.value['size']) {
+        it.value.put('size', 'small')
+    }
     it.value.put('splits', 1)
   }
 
diff --git a/CHANGES.txt b/CHANGES.txt
index a61194e5ef..5c0ff70a6e 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -320,6 +320,7 @@ Merged from 4.1:
  * Disk usage guardrail cannot be disabled when failure threshold is reached (CASSANDRA-21057)
  * ReadCommandController should close fast to avoid deadlock when building secondary index (CASSANDRA-19564)
 Merged from 4.0:
+ * Rate limit password changes (CASSANDRA-21202)
  * Node does not send multiple inflight echos (CASSANDRA-18866)
  * Obsolete expired SSTables before compaction starts (CASSANDRA-19776)
  * Switch lz4-java to at.yawk.lz4 version due to CVE (CASSANDRA-21052)