diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 82a7601b..03bcd41a 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -26,7 +26,7 @@ jobs:
     strategy:
       max-parallel: 4
       matrix:
-        java-version: [17, 21, 24]
+        java-version: [21, 24]
     steps:
       - uses: actions/checkout@v5
         with:
@@ -46,7 +46,7 @@ jobs:
       - name: Spotless Check
           # Spotless must run in a different invocation, because
           # it has some weird Gradle configuration/variant issue
-        if: ${{ matrix.java-version == '17' }}
+        if: ${{ matrix.java-version == '21' }}
         run: ./gradlew spotlessCheck --scan
 
       - name: Build
@@ -61,7 +61,7 @@ jobs:
         run: ./gradlew jmh
 
       - name: Cache Bazel stuff
-        if: ${{ matrix.java-version == '17' }}
+        if: ${{ matrix.java-version == '21' }}
         uses: actions/cache@v4
         with:
           path: |
@@ -70,7 +70,7 @@ jobs:
           restore-keys: bazel-
 
       - name: Conformance tests
-        if: ${{ matrix.java-version == '17' }}
+        if: ${{ matrix.java-version == '21' }}
         run: conformance/run-conformance-tests.sh
 
       - name: Capture test results
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 001f4074..93ab0452 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -61,11 +61,11 @@ jobs:
           SHA=$(git rev-parse HEAD)
           gh api repos/projectnessie/cel-java/commits/${SHA}/check-runs --jq 'if ([.check_runs[] | select(.name | endswith("Release") or startswith("Dependabot ") or startswith("codecov/") or startswith("Report") | not ) | .conclusion // "pending" ] | unique == ["success"] or unique == []) then "OK" else error("Commit checks are not OK") end'
 
-      - name: Set up JDK 11
+      - name: Set up JDK
         uses: actions/setup-java@v5
         with:
           distribution: 'temurin'
-          java-version: 17
+          java-version: 21
           gpg-private-key: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }}
           gpg-passphrase: MAVEN_GPG_PASSPHRASE
 
diff --git a/.gitignore b/.gitignore
index 3c666e73..116162cd 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,6 +2,7 @@
 # Gradle
 build/
 .gradle/
+buildSrc/.kotlin/
 
 # Maven
 **/.mvn/wrapper/maven-wrapper.jar
diff --git a/README.md b/README.md
index 5a4cc55a..f0310719 100644
--- a/README.md
+++ b/README.md
@@ -296,7 +296,7 @@ Those submodules are required to build the CEL-Java project.
 You need to run `git submodule init` and `git submodule update` after a fresh clone of this repo.
 
 Build requirements:
-* Java 11 or newer, it's a Gradle-wrapper build (it's fast ;) )
+* Java 21 or newer, it's a Gradle-wrapper build (it's fast ;) )
 
 Runtime requirements:
 * Java 8 or newer
diff --git a/buildSrc/build.gradle.kts b/buildSrc/build.gradle.kts
index 63a64c77..3156bac0 100644
--- a/buildSrc/build.gradle.kts
+++ b/buildSrc/build.gradle.kts
@@ -34,4 +34,4 @@ dependencies {
   implementation(libs.errorprone.plugin)
 }
 
-java { toolchain { languageVersion.set(JavaLanguageVersion.of(11)) } }
+java { toolchain { languageVersion.set(JavaLanguageVersion.of(21)) } }
diff --git a/conformance/README.md b/conformance/README.md
index ef4fab0b..8854a558 100644
--- a/conformance/README.md
+++ b/conformance/README.md
@@ -10,7 +10,7 @@ If your environment is already setup, just run the shell script
 The CEL-spec conformance test suite is written in Go and uses the bazel build tool.
 
 Required tools:
-* [Bazel build tool](https://bazel.build/)
+* [Bazel build tool](https://bazel.build/) (see [bazelisk](https://github.com/bazelbuild/bazelisk?tab=readme-ov-file#installation))
   
     See [Bazel web site](https://bazel.build/install) for installation instructions.
     Do **not** use the `bazel-bootstrap` package on Ubuntu, because it comes with