diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0f73c175a..f5a7b15b8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -11,19 +11,27 @@ env:
   MVN_CMD: ./mvnw --no-transfer-progress -B
 
 jobs:
+  # Oracle only provides JDK 17+, so test against 17, 21, and 25
   oracle:
-    strategy:
-      matrix:
-        java: [ '17' ]
     runs-on: 'ubuntu-latest'
-    name: jdk-${{ matrix.java }}-oracle
+    name: oracle
     steps:
       - uses: actions/checkout@v4
+      # Install test-only JDKs first; each call appends an entry to ~/.m2/toolchains.xml
       - name: Set up JDK
-        uses: actions/setup-java@v4.7.0
+        uses: actions/setup-java@v4
+        with:
+          distribution: oracle
+          java-version: |
+            21
+            25
+      # Build JDK last so it ends up as the active JAVA_HOME / PATH entry
+      - name: Set up JDK 17 (build)
+        uses: actions/setup-java@v4
         with:
           distribution: oracle
-          java-version: ${{ matrix.java }}
+          java-version: '17'
+          cache: 'maven'
       - name: Install softhsm2
         run: sudo apt-get install -y softhsm2
       - name: Install opensc
@@ -35,51 +43,29 @@ jobs:
       - name: Build
         # run a full build, just as we would for a release (i.e. the `ossrh` profile), but don't use gpg
         # to sign artifacts, since we don't want to mess with storing signing credentials in CI:
-        run: ${{env.MVN_CMD}} verify -Possrh -Dgpg.skip=true
+        run: ${{env.MVN_CMD}} verify -Possrh -Dgpg.skip=true -P jdk-17,jdk-21,jdk-25
 
   temurin:
-    strategy:
-      matrix:
-        java: [ '8', '11', '17', '18' ]
     runs-on: 'ubuntu-latest'
-    name: jdk-${{ matrix.java }}-temurin
+    name: temurin
     steps:
       - uses: actions/checkout@v4
+      # Install test-only JDKs first; each call appends an entry to ~/.m2/toolchains.xml
       - name: Set up JDK
         uses: actions/setup-java@v4
         with:
-          java-version: ${{ matrix.java }}
           distribution: 'temurin'
-          cache: 'maven'
-          check-latest: true
-      - name: Install softhsm2
-        run: sudo apt-get install -y softhsm2
-      - name: Install opensc
-        run: sudo apt-get install -y opensc
-      - name: Ensure SoftHSM user configuration
-        run: impl/src/test/scripts/softhsm configure
-      - name: Populate SoftHSM with JJWT test keys
-        run: impl/src/test/scripts/softhsm import
-      - name: Build
-        # run a full build, just as we would for a release (i.e. the `ossrh` profile), but don't use gpg
-        # to sign artifacts, since we don't want to mess with storing signing credentials in CI:
-        run: ${{env.MVN_CMD}} verify -Possrh -Dgpg.skip=true
-
-  zulu:
-    strategy:
-      matrix:
-        java: [ '7', '8', '9', '11', '12', '13', '14', '15', '16', '17', '18', '21' ]
-    runs-on: 'ubuntu-latest'
-    env:
-      JDK_MAJOR_VERSION: ${{ matrix.java }}
-    name: jdk-${{ matrix.java }}-zulu
-    steps:
-      - uses: actions/checkout@v4
-      - name: Set up JDK
+          java-version: |
+            8
+            11
+            21
+            25
+      # Build JDK last so it ends up as the active JAVA_HOME / PATH entry
+      - name: Set up JDK 17 (build)
         uses: actions/setup-java@v4
         with:
-          java-version: ${{ matrix.java }}
-          distribution: 'zulu'
+          java-version: '17'
+          distribution: 'temurin'
           cache: 'maven'
           check-latest: true
       - name: Install softhsm2
@@ -93,9 +79,7 @@ jobs:
       - name: Build
         # run a full build, just as we would for a release (i.e. the `ossrh` profile), but don't use gpg
         # to sign artifacts, since we don't want to mess with storing signing credentials in CI:
-        run: |
-          if [ "$JDK_MAJOR_VERSION" == "7" ]; then export MAVEN_OPTS="-Xmx512m -XX:MaxPermSize=128m"; fi
-          ${{env.MVN_CMD}} verify -Possrh -Dgpg.skip=true
+        run: ${{env.MVN_CMD}} verify -Possrh -Dgpg.skip=true -P jdk-8,jdk-11,jdk-17,jdk-21,jdk-25
 
   # ensure all of our files have the correct/updated license header
   license-check:
@@ -107,8 +91,8 @@ jobs:
       - name: Set up JDK
         uses: actions/setup-java@v4
         with:
-          distribution: 'zulu'
-          java-version: '8'
+          distribution: 'temurin'
+          java-version: '17'
           cache: 'maven'
           check-latest: true
       - name: License Check
@@ -117,14 +101,14 @@ jobs:
           ${{env.MVN_CMD}} license:check
 
   code-coverage:
-    needs: [oracle, temurin, zulu]
+    needs: [oracle, temurin]
     runs-on: 'ubuntu-latest'
     steps:
       - uses: actions/checkout@v4
       - name: Set up JDK
         uses: actions/setup-java@v4
         with:
-          distribution: 'zulu'
+          distribution: 'temurin'
           java-version: '17'
           cache: 'maven'
           check-latest: true
diff --git a/impl/src/test/groovy/io/jsonwebtoken/impl/security/JcaTemplateTest.groovy b/impl/src/test/groovy/io/jsonwebtoken/impl/security/JcaTemplateTest.groovy
index bf1037276..549df50f6 100644
--- a/impl/src/test/groovy/io/jsonwebtoken/impl/security/JcaTemplateTest.groovy
+++ b/impl/src/test/groovy/io/jsonwebtoken/impl/security/JcaTemplateTest.groovy
@@ -266,12 +266,8 @@ class JcaTemplateTest {
             template.generatePrivate(new X509EncodedKeySpec(invalid))
             fail()
         } catch (SecurityException expected) {
-            boolean jdk11OrLater = Classes.isAvailable('java.security.interfaces.XECPrivateKey')
-            String msg = 'KeyFactory callback execution failed: key spec not recognized'
-            if (jdk11OrLater) {
-                msg = 'KeyFactory callback execution failed: Only PKCS8EncodedKeySpec and XECPrivateKeySpec supported'
-            }
-            assertEquals msg, expected.getMessage()
+            String msg = expected.getMessage()
+            assertTrue msg, msg.startsWith('KeyFactory callback execution failed:')
         }
     }
 
diff --git a/impl/src/test/groovy/io/jsonwebtoken/impl/security/TestProvider.groovy b/impl/src/test/java/io/jsonwebtoken/impl/security/TestProvider.java
similarity index 50%
rename from impl/src/test/groovy/io/jsonwebtoken/impl/security/TestProvider.groovy
rename to impl/src/test/java/io/jsonwebtoken/impl/security/TestProvider.java
index 197a253ec..ce8d18aca 100644
--- a/impl/src/test/groovy/io/jsonwebtoken/impl/security/TestProvider.groovy
+++ b/impl/src/test/java/io/jsonwebtoken/impl/security/TestProvider.java
@@ -13,17 +13,23 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package io.jsonwebtoken.impl.security
+package io.jsonwebtoken.impl.security;
 
-import java.security.Provider
+import java.security.Provider;
 
-class TestProvider extends Provider {
+/**
+ * Test-only {@link Provider} subclass. Defined in Java (not Groovy) because Groovy 4 cannot resolve
+ * the {@code protected} {@code Provider} constructor via its meta-class on JDK 17+.
+ */
+public class TestProvider extends Provider {
 
-    TestProvider() {
-        this('test')
+    public TestProvider() {
+        this("test");
     }
 
-    TestProvider(String name) {
-        super(name, 1.0d, 'info')
+    public TestProvider(String name) {
+        //noinspection deprecation - double constructor used for Java 8 source compatibility;
+        // the (String, String, String) replacement was added in Java 9
+        super(name, 1.0d, "info");
     }
 }
diff --git a/install-test-jdks.sh b/install-test-jdks.sh
new file mode 100755
index 000000000..4aa0dc2c2
--- /dev/null
+++ b/install-test-jdks.sh
@@ -0,0 +1,63 @@
+#!/usr/bin/env bash
+# install-test-jdks.sh
+#
+# Installs all JDK versions needed to run the full multi-JDK test matrix locally via SDKMAN,
+# then generates ~/.m2/toolchains.xml from the discovered JDKs.
+#
+# Usage:
+#   ./install-test-jdks.sh
+#
+# After running this script, activate each profile you want to test against, e.g.:
+#   ./mvnw verify -P jdk-8,jdk-11,jdk-21,jdk-25
+#
+# The build JDK must be JDK 17+. If you are not already on JDK 17:
+#   sdk use java <17.x.x-tem>
+
+set -euo pipefail
+
+# ============================================================
+# JDK versions to install.
+# Update these when new patch releases are available.
+# Find current versions with: sdk list java
+#
+# NOTE: Temurin does not provide JDK 8 on all platforms (e.g.
+# macOS/ARM). Zulu is used for JDK 8 as a reliable fallback.
+# ============================================================
+JDKS=(
+  "8.0.492-zulu"   # JDK 8  - minimum supported runtime
+  "11.0.31-tem"    # JDK 11
+  "17.0.19-tem"    # JDK 17 - required build JDK
+  "21.0.11-tem"    # JDK 21
+  "25.0.3-tem"     # JDK 25
+)
+# ============================================================
+
+if ! command -v sdk &>/dev/null; then
+  echo "ERROR: SDKMAN not found. Install it from https://sdkman.io" >&2
+  exit 1
+fi
+
+# Source SDKMAN so 'sdk' commands work in this script
+# shellcheck disable=SC1090
+source "${SDKMAN_DIR:-$HOME/.sdkman}/bin/sdkman-init.sh"
+
+echo "Installing test JDKs via SDKMAN..."
+echo "(Already-installed versions will be skipped)"
+echo
+
+for jdk in "${JDKS[@]}"; do
+  sdk install java "$jdk" || true
+done
+
+echo
+echo "Done. Generating ~/.m2/toolchains.xml from discovered JDKs..."
+./mvnw --no-transfer-progress -q \
+  org.apache.maven.plugins:maven-toolchains-plugin:3.2.0:generate-jdk-toolchains-xml \
+  -Dtoolchain.file="${HOME}/.m2/toolchains.xml"
+
+echo
+echo "To run the full multi-JDK test matrix:"
+echo "  ./mvnw verify -P jdk-8,jdk-11,jdk-17,jdk-21,jdk-25"
+echo
+echo "To run a single JDK profile (e.g., JDK 8 only):"
+echo "  ./mvnw verify -P jdk-8"
diff --git a/pom.xml b/pom.xml
index e3124e814..92d56ec90 100644
--- a/pom.xml
+++ b/pom.xml
@@ -97,16 +97,27 @@
 
         <maven.jar.version>3.3.0</maven.jar.version>
         <maven.compiler.version>3.11.0</maven.compiler.version>
-        <maven.javadoc.version>3.1.1</maven.javadoc.version> <!-- max version allowed for JDK 7 builds -->
+        <maven.javadoc.version>3.6.3</maven.javadoc.version>
         <maven.source.version>3.2.1</maven.source.version>
         <maven.resources.version>3.1.0</maven.resources.version>
-        <maven.gpg.version>1.6</maven.gpg.version> <!-- max version allowed for JDK 7 builds -->
-        <maven.japicmp.version>0.13.1</maven.japicmp.version> <!-- max version allowed for JDK 7 builds -->
-        <gmavenplus.version>1.6.1</gmavenplus.version> <!-- higher version used in jdk8AndLater profile below -->
+        <maven.gpg.version>3.1.0</maven.gpg.version>
+        <maven.japicmp.version>0.15.6</maven.japicmp.version>
+        <maven.toolchains.version>3.2.0</maven.toolchains.version>
+        <gmavenplus.version>4.2.0</gmavenplus.version>
         <maven.license.version>4.2.rc3</maven.license.version>
         <maven.license.skipExistingHeaders>true</maven.license.skipExistingHeaders>
 
-        <jdk.version>7</jdk.version>
+        <!-- Source/bytecode compatibility target for the compiled library.
+             Build requires JDK 17+. -->
+        <jdk.release.version>8</jdk.release.version>
+        <!-- Used by javadoc plugin <source> parameter -->
+        <jdk.version>8</jdk.version>
+
+        <!-- Minimum JDK required to test this module. Modules requiring JDK 17+
+             set both skip flags to true in their own pom.xml to skip lower-JDK
+             test executions (jdk-8 and jdk-11 profiles). -->
+        <module.skip.jdk8.tests>false</module.skip.jdk8.tests>
+        <module.skip.jdk11.tests>false</module.skip.jdk11.tests>
         <buildNumber>${user.name}-${maven.build.timestamp}</buildNumber>
 
         <jackson.version>2.12.7.1</jackson.version>
@@ -114,22 +125,24 @@
         <gson.version>2.11.0</gson.version>
 
         <maven.javadoc.additionalOptions />
-
         <!-- Optional Runtime Dependencies: -->
         <bouncycastle.version>1.78.1</bouncycastle.version>
         <bcprov.artifactId>bcprov-jdk18on</bcprov.artifactId>
         <bcpkix.artifactId>bcpkix-jdk18on</bcpkix.artifactId>
 
         <!-- Test Dependencies: Only required for testing when building.  Not required by users at runtime: -->
-        <groovy.version>2.5.16</groovy.version> <!-- higher version used in jdk8AndLater profile below -->
-        <easymock.version>3.6</easymock.version> <!-- higher version used in jdk8AndLater profile below -->
+        <groovy.version>4.0.31</groovy.version>
+        <easymock.version>4.2</easymock.version>
         <junit.version>4.12</junit.version>
-        <powermock.version>2.0.0-beta.5</powermock.version> <!-- higher version used in jdk8AndLater profile below -->
-        <failsafe.plugin.version>3.0.0-M5</failsafe.plugin.version>
-        <surefire.plugin.version>3.0.0-M5</surefire.plugin.version>
-        <clover.version>4.3.1</clover.version> <!-- max version allowed for JDK 7 builds -->
+        <powermock.version>2.0.7</powermock.version>
+        <failsafe.plugin.version>3.1.2</failsafe.plugin.version>
+        <surefire.plugin.version>3.1.2</surefire.plugin.version>
+        <clover.version>4.3.1</clover.version>
         <clover.db>${jjwt.root}/target/clover/clover.db</clover.db>
-        <surefire.argLine />
+        <!-- Default surefire argLine for JDK 17 (the required build JDK).
+             Individual jdk-N profiles override this for their toolchain executions. -->
+        <surefire.useModulePath>false</surefire.useModulePath>
+        <surefire.argLine>${test.addOpens}</surefire.argLine>
         <test.addOpens>
             --add-opens java.base/java.lang=ALL-UNNAMED, <!-- Needed by EasyMock/cglib -->
             --add-opens java.desktop/java.beans=ALL-UNNAMED, <!-- Needed by EasyMock/cglib -->
@@ -211,7 +224,7 @@
     <dependencies>
         <!-- Test Dependencies: Only required for testing when building.  Not required by users at runtime: -->
         <dependency>
-            <groupId>org.codehaus.groovy</groupId>
+            <groupId>org.apache.groovy</groupId>
             <artifactId>groovy</artifactId>
             <version>${groovy.version}</version>
             <scope>test</scope>
@@ -321,7 +334,8 @@
                                     <exclude>**/*.test.override</exclude>
                                     <exclude>**/*.bnd</exclude>
                                     <exclude>LICENSE</exclude>
-                                    <exclude>**/mvnw</exclude>
+                                     <exclude>**/mvnw</exclude>
+                                     <exclude>**/install-test-jdks.sh</exclude>
                                     <exclude>**/lombok.config</exclude>
                                     <exclude>.gitattributes</exclude>
                                     <exclude>**/genkeys</exclude>
@@ -362,16 +376,8 @@
                         <source>${jdk.version}</source>
                         <failOnError>true</failOnError>
                         <failOnWarnings>false</failOnWarnings>
-                        <additionalOptions>${maven.javadoc.additionalOptions}</additionalOptions>
+                        <additionalOptions>-html5 ${maven.javadoc.additionalOptions}</additionalOptions>
                     </configuration>
-                    <dependencies>
-                        <!-- Workaround for Java 9 -->
-                        <dependency>
-                            <groupId>commons-lang</groupId>
-                            <artifactId>commons-lang</artifactId>
-                            <version>2.6</version>
-                        </dependency>
-                    </dependencies>
                 </plugin>
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>
@@ -496,7 +502,7 @@
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-enforcer-plugin</artifactId>
-                <version>1.4.1</version>
+                <version>3.4.1</version>
                 <executions>
                     <execution>
                         <id>enforce-banned-dependencies</id>
@@ -515,49 +521,30 @@
                             <fail>true</fail>
                         </configuration>
                     </execution>
+                    <execution>
+                        <id>enforce-java-17</id>
+                        <goals>
+                            <goal>enforce</goal>
+                        </goals>
+                        <configuration>
+                            <rules>
+                                <requireJavaVersion>
+                                    <!-- JDK 17+ is required to run Maven. -->
+                                    <version>[17,)</version>
+                                    <message>Build requires JDK 17 or later. Use SDKMAN: sdk install java 17.x.x-tem</message>
+                                </requireJavaVersion>
+                            </rules>
+                            <fail>true</fail>
+                        </configuration>
+                    </execution>
                 </executions>
             </plugin>
-<!--            <plugin>-->
-<!--                <groupId>org.apache.maven.plugins</groupId>-->
-<!--                <artifactId>maven-compiler-plugin</artifactId>-->
-<!--                <version>${maven.compiler.version}</version>-->
-<!--                <executions>-->
-<!--                    <execution>-->
-<!--                        <id>default-compile</id>-->
-<!--                        <configuration>-->
-<!--                            <release>9</release>-->
-<!--                            &lt;!&ndash; no excludes: compile everything to ensure module-info contains right entries &ndash;&gt;-->
-<!--                        </configuration>-->
-<!--                    </execution>-->
-<!--                    <execution>-->
-<!--                        <id>base-compile</id>-->
-<!--                        <goals>-->
-<!--                            <goal>compile</goal>-->
-<!--                        </goals>-->
-<!--                        <configuration>-->
-<!--                            &lt;!&ndash; recompile everything for target VM except the module-info.java &ndash;&gt;-->
-<!--                            <excludes>-->
-<!--                                <exclude>module-info.java</exclude>-->
-<!--                            </excludes>-->
-<!--                        </configuration>-->
-<!--                    </execution>-->
-<!--                </executions>-->
-<!--                &lt;!&ndash; defaults for compile and testCompile &ndash;&gt;-->
-<!--                <configuration>-->
-<!--                    <release>${jdk.version}</release>-->
-<!--&lt;!&ndash;                    &lt;!&ndash; Only required when Maven runtime JAVA_HOME isn't at least Java 9 and when haven't configured the maven-toolchains-plugin &ndash;&gt;&ndash;&gt;-->
-<!--&lt;!&ndash;                    <jdkToolchain>&ndash;&gt;-->
-<!--&lt;!&ndash;                        <version>9</version>&ndash;&gt;-->
-<!--&lt;!&ndash;                    </jdkToolchain>&ndash;&gt;-->
-<!--                </configuration>-->
-<!--            </plugin>-->
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-compiler-plugin</artifactId>
                 <version>${maven.compiler.version}</version>
                 <configuration>
-                    <source>${jdk.version}</source>
-                    <target>${jdk.version}</target>
+                    <release>${jdk.release.version}</release>
                     <encoding>${project.build.sourceEncoding}</encoding>
                 </configuration>
             </plugin>
@@ -582,7 +569,7 @@
                 </executions>
                 <dependencies>
                     <dependency>
-                        <groupId>org.codehaus.groovy</groupId>
+                        <groupId>org.apache.groovy</groupId>
                         <artifactId>groovy</artifactId>
                         <version>${groovy.version}</version>
                     </dependency>
@@ -594,6 +581,7 @@
                 <version>${surefire.plugin.version}</version>
                 <configuration>
                     <argLine>${surefire.argLine}</argLine>
+                    <forkMode>once</forkMode>
                 </configuration>
             </plugin>
             <plugin>
@@ -681,91 +669,157 @@
         </plugins>
     </build>
     <profiles>
+        <!--
+            Multi-JDK test profiles. Activate one or more to run an extra surefire execution
+            under that JDK via Surefire's jdkToolchain parameter. Example:
+                ./mvnw verify -P jdk-8,jdk-11,jdk-21,jdk-25
+
+            Local setup (SDKMAN): run ./install-test-jdks.sh to install required JDKs and
+            generate ~/.m2/toolchains.xml via maven-toolchains-plugin:generate-jdk-toolchains-xml.
+
+            CI: actions/setup-java is called once per target JDK (appending to ~/.m2/toolchains.xml),
+            then all profiles are activated in a single Maven invocation.
+
+            Compilation always uses the build JDK (17+). The jdkToolchain parameter in each surefire
+            execution selects which JDK runs the tests, independently of compilation.
+        -->
+
+        <!-- ==================== JDK 8 test execution ==================== -->
         <profile>
-            <id>jdk7</id>
-            <activation>
-                <jdk>1.7</jdk>
-            </activation>
-            <properties>
-                <maven.jar.version>3.2.2</maven.jar.version>
-                <maven.compiler.version>3.8.1</maven.compiler.version>
-                <orgjson.version>20230618</orgjson.version>
-                <bcprov.artifactId>bcprov-jdk15to18</bcprov.artifactId>
-                <bcpkix.artifactId>bcpkix-jdk15to18</bcpkix.artifactId>
-            </properties>
+            <id>jdk-8</id>
+            <build>
+                <plugins>
+                    <plugin>
+                        <groupId>org.apache.maven.plugins</groupId>
+                        <artifactId>maven-surefire-plugin</artifactId>
+                        <version>${surefire.plugin.version}</version>
+                        <executions>
+                            <execution>
+                                <id>test-jdk-8</id>
+                                <goals><goal>test</goal></goals>
+                                <configuration combine.self="override">
+                                    <skip>${module.skip.jdk8.tests}</skip>
+                                    <jdkToolchain>
+                                        <version>[1.8,1.9),[8,9)</version>
+                                    </jdkToolchain>
+                                    <!-- No add-opens flags on JDK 8 -->
+                                    <argLine></argLine>
+                                    <forkMode>once</forkMode>
+                                </configuration>
+                            </execution>
+                        </executions>
+                    </plugin>
+                </plugins>
+            </build>
         </profile>
+
+        <!-- ==================== JDK 11 test execution ==================== -->
         <profile>
-            <id>jdk8AndLater</id>
-            <activation>
-                <jdk>[1.8,)</jdk>
-            </activation>
-            <properties>
-                <gmavenplus.version>3.0.2</gmavenplus.version>
-                <groovy.version>3.0.19</groovy.version>
-                <easymock.version>4.2</easymock.version>
-                <powermock.version>2.0.7</powermock.version>
-                <maven.japicmp.version>0.15.6</maven.japicmp.version>
-                <failsafe.plugin.version>3.1.2</failsafe.plugin.version>
-                <surefire.plugin.version>3.1.2</surefire.plugin.version>
-            </properties>
+            <id>jdk-11</id>
+            <build>
+                <plugins>
+                    <plugin>
+                        <groupId>org.apache.maven.plugins</groupId>
+                        <artifactId>maven-surefire-plugin</artifactId>
+                        <version>${surefire.plugin.version}</version>
+                        <executions>
+                            <execution>
+                                <id>test-jdk-11</id>
+                                <goals><goal>test</goal></goals>
+                                <configuration>
+                                    <skip>${module.skip.jdk11.tests}</skip>
+                                    <jdkToolchain>
+                                        <version>[11,12)</version>
+                                    </jdkToolchain>
+                                    <argLine>${test.addOpens}</argLine>
+                                </configuration>
+                            </execution>
+                        </executions>
+                    </plugin>
+                </plugins>
+            </build>
         </profile>
-<!--        <profile>-->
-<!--            <id>jdk7And8</id>-->
-<!--            <activation>-->
-<!--                <jdk>[1.7,9)</jdk>-->
-<!--            </activation>-->
-<!--            <build>-->
-<!--                <plugins>-->
-<!--                    <plugin>-->
-<!--                        <groupId>org.apache.maven.plugins</groupId>-->
-<!--                        <artifactId>maven-compiler-plugin</artifactId>-->
-<!--                        <version>${maven.compiler.version}</version>-->
-<!--                        <configuration>-->
-<!--                            <source>${jdk.version}</source>-->
-<!--                            <target>${jdk.version}</target>-->
-<!--                            <release />-->
-<!--                            <encoding>${project.build.sourceEncoding}</encoding>-->
-<!--                            <excludes>-->
-<!--                                <exclude>module-info.java</exclude>-->
-<!--                            </excludes>-->
-<!--                        </configuration>-->
-<!--                    </plugin>-->
-<!--                </plugins>-->
-<!--            </build>-->
-<!--        </profile>-->
+
+        <!-- ==================== JDK 17 test execution ==================== -->
+        <!-- No toolchain needed: the build JDK is JDK 17+. Activating this profile
+             simply re-runs tests under JDK 17 (useful as the CI matrix entry). -->
         <profile>
-            <!-- Added profile to address https://github.com/jwtk/jjwt/issues/364 -->
-            <id>jdk9AndLater</id>
-            <activation>
-                <jdk>[1.9,)</jdk>
-            </activation>
-            <properties>
-                <maven.compiler.version>3.11.0</maven.compiler.version>
-                <surefire.useModulePath>false</surefire.useModulePath>
-                <maven.javadoc.additionalOptions>-html5</maven.javadoc.additionalOptions>
-                <surefire.argLine>${test.addOpens}, --illegal-access=debug</surefire.argLine>
-            </properties>
+            <id>jdk-17</id>
+            <build>
+                <plugins>
+                    <plugin>
+                        <groupId>org.apache.maven.plugins</groupId>
+                        <artifactId>maven-surefire-plugin</artifactId>
+                        <version>${surefire.plugin.version}</version>
+                        <executions>
+                            <execution>
+                                <id>test-jdk-17</id>
+                                <goals><goal>test</goal></goals>
+                                <configuration>
+                                    <jdkToolchain>
+                                        <version>[17,18)</version>
+                                    </jdkToolchain>
+                                    <argLine>${test.addOpens}</argLine>
+                                </configuration>
+                            </execution>
+                        </executions>
+                    </plugin>
+                </plugins>
+            </build>
         </profile>
+
+        <!-- ==================== JDK 21 test execution ==================== -->
         <profile>
-            <id>jdk17AndLater</id>
-            <activation>
-                <jdk>[17,)</jdk>
-            </activation>
-            <properties>
-                <maven.javadoc.additionalOptions>-html5</maven.javadoc.additionalOptions>
-                <surefire.argLine>${test.addOpens}</surefire.argLine>
-            </properties>
+            <id>jdk-21</id>
+            <build>
+                <plugins>
+                    <plugin>
+                        <groupId>org.apache.maven.plugins</groupId>
+                        <artifactId>maven-surefire-plugin</artifactId>
+                        <version>${surefire.plugin.version}</version>
+                        <executions>
+                            <execution>
+                                <id>test-jdk-21</id>
+                                <goals><goal>test</goal></goals>
+                                <configuration>
+                                    <jdkToolchain>
+                                        <version>[21,22)</version>
+                                    </jdkToolchain>
+                                    <argLine>${test.addOpens}</argLine>
+                                </configuration>
+                            </execution>
+                        </executions>
+                    </plugin>
+                </plugins>
+            </build>
         </profile>
+
+        <!-- ==================== JDK 25 test execution ==================== -->
         <profile>
-            <id>jdk21AndLater</id>
-            <activation>
-                <jdk>[21,)</jdk>
-            </activation>
-            <properties>
-                <!-- normally this is 1.7, but as of 21, JDK 8 is the lowest source/target -->
-                <jdk.version>8</jdk.version>
-            </properties>
+            <id>jdk-25</id>
+            <build>
+                <plugins>
+                    <plugin>
+                        <groupId>org.apache.maven.plugins</groupId>
+                        <artifactId>maven-surefire-plugin</artifactId>
+                        <version>${surefire.plugin.version}</version>
+                        <executions>
+                            <execution>
+                                <id>test-jdk-25</id>
+                                <goals><goal>test</goal></goals>
+                                <configuration>
+                                    <jdkToolchain>
+                                        <version>[25,26)</version>
+                                    </jdkToolchain>
+                                    <argLine>${test.addOpens}</argLine>
+                                </configuration>
+                            </execution>
+                        </executions>
+                    </plugin>
+                </plugins>
+            </build>
         </profile>
+
         <profile>
             <id>docs</id>
             <build>