diff --git a/core/src/main/kotlin/com/r3corda/core/protocols/ProtocolLogicRef.kt b/core/src/main/kotlin/com/r3corda/core/protocols/ProtocolLogicRef.kt
index c63bfeb6cc..5b0154cb81 100644
--- a/core/src/main/kotlin/com/r3corda/core/protocols/ProtocolLogicRef.kt
+++ b/core/src/main/kotlin/com/r3corda/core/protocols/ProtocolLogicRef.kt
@@ -39,7 +39,9 @@ class ProtocolLogicRefFactory(private val protocolWhitelist: Map<String, Set<Str
     // Pending real dependence on AppContext for class loading etc
     @Suppress("UNUSED_PARAMETER")
     private fun validateArgClassName(className: String, argClassName: String, appContext: AppContext) {
-        // Accept standard java.lang.* and kotlin.* types
+        // TODO: consider more carefully what to whitelist and how to secure protocols
+        // For now automatically accept standard java.lang.* and kotlin.* types.
+        // All other types require manual specification at ProtocolLogicRefFactory construction time.
         if (argClassName.startsWith("java.lang.") || argClassName.startsWith("kotlin.")) {
             return
         }
diff --git a/node/src/main/kotlin/com/r3corda/node/internal/AbstractNode.kt b/node/src/main/kotlin/com/r3corda/node/internal/AbstractNode.kt
index aafd6fc5da..f21b8708be 100644
--- a/node/src/main/kotlin/com/r3corda/node/internal/AbstractNode.kt
+++ b/node/src/main/kotlin/com/r3corda/node/internal/AbstractNode.kt
@@ -134,9 +134,10 @@ abstract class AbstractNode(val dir: Path, val configuration: NodeConfiguration,
     val networkMapRegistrationFuture: ListenableFuture<Unit>
         get() = _networkMapRegistrationFuture
 
-    /** fetch CordaPluginRegistry classes registered in META-INF/services/com.r3corda.core.node.CordaPluginRegistry files that exist in the classpath */
-    protected val pluginRegistries: List<CordaPluginRegistry>
-        get() = ServiceLoader.load(CordaPluginRegistry::class.java).toList()
+    /** Fetch CordaPluginRegistry classes registered in META-INF/services/com.r3corda.core.node.CordaPluginRegistry files that exist in the classpath */
+    protected val pluginRegistries: List<CordaPluginRegistry> by lazy {
+        ServiceLoader.load(CordaPluginRegistry::class.java).toList()
+    }
 
     /** Set to true once [start] has been successfully called. */
     @Volatile var started = false