diff --git a/core/pom.xml b/core/pom.xml
index c828513bb9..12ec84c05e 100644
--- a/core/pom.xml
+++ b/core/pom.xml
@@ -36,6 +36,18 @@
 
     <build>
         <plugins>
+            <plugin>
+                <artifactId>maven-compiler-plugin</artifactId>
+                <configuration>
+                    <annotationProcessorPaths>
+                        <annotationProcessorPath>
+                            <groupId>org.projectlombok</groupId>
+                            <artifactId>lombok</artifactId>
+                            <version>${lombok.version}</version>
+                        </annotationProcessorPath>
+                    </annotationProcessorPaths>
+                </configuration>
+            </plugin>
             <!-- collect the test classes so they can be referenced by other modules -->
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
@@ -175,6 +187,13 @@
             <version>${mockito.version}</version>
             <scope>test</scope>
         </dependency>
+        <dependency>
+            <groupId>org.projectlombok</groupId>
+            <artifactId>lombok</artifactId>
+            <version>${lombok.version}</version>
+            <scope>provided</scope>
+            <optional>true</optional>
+        </dependency>
 
         <!-- JDBC Realm tests: -->
         <dependency>
diff --git a/core/src/test/java/org/apache/shiro/SecurityUtilsUnwrapTest.java b/core/src/test/java/org/apache/shiro/SecurityUtilsUnwrapTest.java
index 838043d882..35cf3e1db1 100644
--- a/core/src/test/java/org/apache/shiro/SecurityUtilsUnwrapTest.java
+++ b/core/src/test/java/org/apache/shiro/SecurityUtilsUnwrapTest.java
@@ -18,8 +18,14 @@
  */
 package org.apache.shiro;
 
+import lombok.RequiredArgsConstructor;
+import lombok.experimental.Delegate;
+import org.apache.shiro.mgt.DefaultSecurityManager;
 import org.apache.shiro.mgt.SecurityManager;
 import org.apache.shiro.mgt.SessionsSecurityManager;
+import org.apache.shiro.mgt.WrappedSecurityManager;
+import org.apache.shiro.subject.Subject;
+import org.apache.shiro.subject.SubjectContext;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.ExtendWith;
 import org.mockito.Mock;
@@ -29,11 +35,42 @@
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.verifyNoMoreInteractions;
+import static org.mockito.Mockito.when;
 
 @ExtendWith(MockitoExtension.class)
 class SecurityUtilsUnwrapTest {
     @Mock
     SecurityManager securityManager;
+    @Mock
+    DefaultSecurityManager defaultSecurityManager;
+    @Mock
+    Subject subject;
+    @Mock
+    SubjectContext subjectContext;
+
+    @RequiredArgsConstructor
+    static class Wrapped implements WrappedSecurityManager, SecurityManager {
+        private final @Delegate SecurityManager securityManager;
+
+        @Override
+        @SuppressWarnings("unchecked")
+        public <SM extends SecurityManager> SM unwrap() {
+            return (SM) securityManager;
+        }
+    }
+
+    @RequiredArgsConstructor
+    static class InvalidWrapped implements WrappedSecurityManager, SecurityManager {
+        private final @Delegate SecurityManager securityManager;
+
+        @Override
+        @SuppressWarnings("unchecked")
+        public <SM extends SecurityManager> SM unwrap() {
+            return (SM) this;
+        }
+    }
 
     @Test
     void basicUnwrap() {
@@ -52,4 +89,51 @@ void failedTypeUnwrap() {
             SessionsSecurityManager ssm = unwrapSecurityManager(securityManager, SessionsSecurityManager.class);
         });
     }
+
+    @Test
+    void defaultSecurityManager() {
+        var dsm = unwrapSecurityManager(defaultSecurityManager, DefaultSecurityManager.class);
+        assertEquals(defaultSecurityManager, dsm);
+        when(defaultSecurityManager.createSubject(subjectContext)).thenReturn(subject);
+        Subject subject = dsm.createSubject(subjectContext);
+        assertEquals(this.subject, subject);
+        verify(defaultSecurityManager).createSubject(subjectContext);
+        verifyNoMoreInteractions(defaultSecurityManager, this.subject, subjectContext);
+    }
+
+    @Test
+    void invalidCast() {
+        SecurityManager wrapped = new Wrapped(defaultSecurityManager);
+        assertThrows(ClassCastException.class, () -> {
+            DefaultSecurityManager sm = (DefaultSecurityManager) wrapped;
+        });
+    }
+
+    @Test
+    void unwrapOne() {
+        SecurityManager wrapped = new Wrapped(defaultSecurityManager);
+        assertEquals(defaultSecurityManager, unwrapSecurityManager(wrapped, DefaultSecurityManager.class));
+    }
+
+    @Test
+    void unwrapTwo() {
+        SecurityManager wrapped = new Wrapped(new Wrapped(defaultSecurityManager));
+        assertEquals(defaultSecurityManager, unwrapSecurityManager(wrapped, DefaultSecurityManager.class));
+    }
+
+    @Test
+    void invalidWrap() {
+        SecurityManager wrapped = new Wrapped(new InvalidWrapped(defaultSecurityManager));
+        assertThrows(IllegalStateException.class, () -> {
+            assertEquals(defaultSecurityManager, unwrapSecurityManager(wrapped, DefaultSecurityManager.class));
+        });
+    }
+
+    @Test
+    void invalidWrapInverted() {
+        SecurityManager wrapped = new InvalidWrapped(new Wrapped(defaultSecurityManager));
+        assertThrows(IllegalStateException.class, () -> {
+            assertEquals(defaultSecurityManager, unwrapSecurityManager(wrapped, DefaultSecurityManager.class));
+        });
+    }
 }