diff --git a/build.xml b/build.xml
index ecc92de49..b4781cd38 100644
--- a/build.xml
+++ b/build.xml
@@ -580,8 +580,15 @@ under the License.
     <target name="fetch-ooxml-jars" depends="check-ooxml-jars" unless="ooxml.jars.present">
         <mkdir dir="${ooxml.lib}"/>
         <downloadfile src="${ooxml.curvesapi.url}" dest="${ooxml.curvesapi.jar}"/>
-        <downloadfile src="${ooxml.xmlbeans23.url}" dest="${ooxml.xmlbeans23.jar}"/>
-        <downloadfile src="${ooxml.xmlbeans26.url}" dest="${ooxml.xmlbeans26.jar}"/>
+        <downloadfile src="${ooxml.xmlbeans23.url}" dest="${ooxml.xmlbeans23.jar}.orig"/>
+        <downloadfile src="${ooxml.xmlbeans26.url}" dest="${ooxml.xmlbeans26.jar}.orig"/>
+    	<!-- remove piccolo parser, so we don't use unsafe calls to it instead of using jaxp -->
+    	<zip destfile="${ooxml.xmlbeans23.jar}">
+    		<zipfileset src="${ooxml.xmlbeans23.jar}.orig" excludes="org/apache/xmlbeans/impl/piccolo/**"/>
+    	</zip>
+        <zip destfile="${ooxml.xmlbeans26.jar}">
+            <zipfileset src="${ooxml.xmlbeans26.jar}.orig" excludes="org/apache/xmlbeans/impl/piccolo/**"/>
+        </zip>
     </target>
 
     <target name="check-ooxml-xsds">
diff --git a/src/ooxml/java/org/apache/poi/POIXMLTypeLoader.java b/src/ooxml/java/org/apache/poi/POIXMLTypeLoader.java
index 1fd55628c..5304b3121 100644
--- a/src/ooxml/java/org/apache/poi/POIXMLTypeLoader.java
+++ b/src/ooxml/java/org/apache/poi/POIXMLTypeLoader.java
@@ -53,7 +53,10 @@ public class POIXMLTypeLoader {
         DEFAULT_XML_OPTIONS.setUseDefaultNamespace();
         DEFAULT_XML_OPTIONS.setSaveAggressiveNamespaces();
         DEFAULT_XML_OPTIONS.setCharacterEncoding("UTF-8");
-        DEFAULT_XML_OPTIONS.setLoadEntityBytesLimit(4096);
+        // Piccolo is disabled for POI builts, i.e. JAXP is used for parsing
+        // so only user code using XmlObject/XmlToken.Factory.parse
+        // directly can bypass the entity check, which is probably unlikely (... and not within our responsibility :)) 
+        // DEFAULT_XML_OPTIONS.setLoadEntityBytesLimit(4096);
 
         Map<String, String> map = new HashMap<String, String>();
         map.put("http://schemas.openxmlformats.org/drawingml/2006/main", "a");