diff --git a/buildSrc/src/main/groovy/corda.common-publishing.gradle b/buildSrc/src/main/groovy/corda.common-publishing.gradle
index 20b2d4be8d..a7bb600ab7 100644
--- a/buildSrc/src/main/groovy/corda.common-publishing.gradle
+++ b/buildSrc/src/main/groovy/corda.common-publishing.gradle
@@ -36,6 +36,40 @@ if (System.getenv('CORDA_ARTIFACTORY_USERNAME') != null || project.hasProperty('
                 }
             }
         }
+
+        // Publish the default jar for fat-jar sub-modules that do not currently publish their dependencies.
+        // These are not for external consumption.
+        // We must generate a jar which has a pom.xml with a full dependency list for vulnerability tools to evaluate.
+        // Only do this for builds done within R3.
+        def projectDict = [
+                "testing:testserver": "corda-testserver",
+                "tools:explorer": "corda-tools-explorer",
+                "opentelemetry:opentelemetry-driver": "corda-opentelemetry-driver",
+                "tools:network-builder": "corda-tools-network-builder",
+                "node:capsule": "corda"
+        ]
+        def lookupName = "${project.parent.name}:${project.name}".toString()
+
+        if (projectDict.containsKey(lookupName)) {
+            pluginManager.apply('maven-publish')
+            def jarName = projectDict[lookupName]
+            publishing {
+                publications {
+                    "$jarName-jarPublication"(MavenPublication) {
+                        from components.java
+                        artifactId = "$jarName-thin-with-deps"
+                        pom {
+                            name = "$jarName-thin-with-deps"
+                            description = "Corda ${project.name} for vulnerability checking."
+                        }
+                    }
+                }
+            }
+
+            jar {
+                archiveClassifier = 'R3-internal'
+            }
+        }
     }
 } else {
     logger.info("External user - using standard maven publishing")
diff --git a/opentelemetry/opentelemetry-driver/build.gradle b/opentelemetry/opentelemetry-driver/build.gradle
index 74496d7955..9911f8a5c7 100644
--- a/opentelemetry/opentelemetry-driver/build.gradle
+++ b/opentelemetry/opentelemetry-driver/build.gradle
@@ -26,7 +26,6 @@ publishing {
         shadow(MavenPublication) { publication ->
             artifactId 'corda-opentelemetry-driver'
             artifact shadowJar
-            from components.java
         }
     }
 }