diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5c1329f0..b3f07a9d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -975,18 +975,19 @@ jobs:
 
       # The binding links the C ABI hub at runtime through the Java FFM API; build
       # it first so WickraNative's development fallback finds
-      # target/release/wickra.{so,dylib,dll}. JDK 22+ is required for the final FFM
-      # API, so it is installed explicitly (runners ship 17/21).
+      # target/release/wickra.{so,dylib,dll}. The FFM API is final since JDK 22; we
+      # build on the 25 LTS (22 is EOL; the pom pins bytecode to release 22 so the
+      # runtime floor stays Java 22). Installed explicitly (runners ship 17/21).
       - name: Build the C ABI library
         run: cargo build -p wickra-c --release
 
-      - name: Set up JDK 22
+      - name: Set up JDK 25
         id: setup-java
         continue-on-error: true
         uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           distribution: temurin
-          java-version: "22"
+          java-version: "25"
           cache: maven
 
       - name: Retry JDK setup (CDN flake)
@@ -996,12 +997,12 @@ jobs:
           echo "::warning::setup-java failed (likely CDN flake), waiting 30s before retry..."
           sleep 30
 
-      - name: Set up JDK 22 (retry)
+      - name: Set up JDK 25 (retry)
         if: steps.setup-java.outcome == 'failure'
         uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           distribution: temurin
-          java-version: "22"
+          java-version: "25"
           cache: maven
 
       - name: Java info
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b33e5e71..576fc1c5 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -757,11 +757,11 @@ jobs:
 
       # setup-java writes a settings.xml with the 'central' server credentials
       # (mapped from the env vars below) and imports the GPG signing key.
-      - name: Set up JDK 22 + Maven Central credentials + GPG
+      - name: Set up JDK 25 + Maven Central credentials + GPG
         uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           distribution: temurin
-          java-version: "22"
+          java-version: "25"
           server-id: central
           server-username: CENTRAL_USERNAME
           server-password: CENTRAL_PASSWORD