diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 00000000000..f46712b2646
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,174 @@
+name: CI tests
+
+on:
+  push:
+    branches: [ "master" ]
+  pull_request:
+    branches: [ "master" ]
+
+jobs:
+  # Basic sanity tests on JDK 21.
+  sanity:
+    name: ${{ matrix.script }} on JDK ${{ matrix.java_version }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    strategy:
+      matrix:
+        script: ['cftests-junit', 'cftests-nonjunit']
+        java_version: [21]
+    env:
+      JAVA_VERSION: ${{ matrix.java_version }}
+    steps:
+    - uses: actions/checkout@v4
+    - name: Set up JDK ${{ matrix.java_version }}
+      uses: actions/setup-java@v4
+      with:
+        java-version: ${{ matrix.java_version }}
+        distribution: 'temurin'
+
+    # Configure Gradle for optimal use in GitHub Actions, including caching of downloaded dependencies.
+    # See: https://github.com/gradle/actions/blob/main/setup-gradle/README.md
+    - name: Setup Gradle
+      uses: gradle/actions/setup-gradle@v3.5.0
+
+    - name: Run test script checker/bin-devel/test-${{ matrix.script }}
+      run: ./checker/bin-devel/test-${{ matrix.script }}.sh
+
+  # The remaining tests for JDK 21. Separate from `sanity` to allow parallelism with `otheros`.
+  remainder:
+    name: ${{ matrix.script }} on JDK ${{ matrix.java_version }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    strategy:
+      matrix:
+        # No need to run 'cftests-junit-jdk21' on JDK 21.
+        script: ['typecheck-part1', 'typecheck-part2', 'guava', 'plume-lib', 'jspecify-conformance']
+        java_version: [21]
+    env:
+      JAVA_VERSION: ${{ matrix.java_version }}
+    steps:
+    - uses: actions/checkout@v4
+    - name: Set up JDK ${{ matrix.java_version }}
+      uses: actions/setup-java@v4
+      with:
+        java-version: ${{ matrix.java_version }}
+        distribution: 'temurin'
+
+    # Configure Gradle for optimal use in GitHub Actions, including caching of downloaded dependencies.
+    # See: https://github.com/gradle/actions/blob/main/setup-gradle/README.md
+    - name: Setup Gradle
+      uses: gradle/actions/setup-gradle@v3.5.0
+
+    - name: Run test script checker/bin-devel/test-${{ matrix.script }}
+      run: ./checker/bin-devel/test-${{ matrix.script }}.sh
+
+  otherjdks:
+    name: ${{ matrix.script }} on JDK ${{ matrix.java.version }}
+    runs-on: ubuntu-latest
+    needs: remainder
+    permissions:
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        # jspecify-conformance only tested on JDK 21.
+        script: ['cftests-junit', 'cftests-nonjunit', 'cftests-junit-jdk21', 'typecheck-part1', 'typecheck-part2', 'guava', 'plume-lib']
+        # JDK 21 used by sanity before
+        java: [{version: '8', experimental: false},
+          {version: '11', experimental: false},
+          {version: '17', experimental: false},
+          {version: '22', experimental: true},
+          {version: '23-ea', experimental: true},
+          {version: '24-ea', experimental: true}]
+    env:
+      JAVA_VERSION: ${{ matrix.java.version }}
+    continue-on-error: ${{ matrix.java.experimental }}
+    steps:
+    - uses: actions/checkout@v4
+    - name: Set up JDK ${{ matrix.java.version }}
+      uses: actions/setup-java@v4
+      with:
+        java-version: ${{ matrix.java.version }}
+        distribution: 'temurin'
+    - name: Set up JDK 21 on an experimental platform
+      if: matrix.java.experimental
+      uses: actions/setup-java@v4
+      with:
+        # Install JDK 21 second, to make it the default on which gradle runs.
+        # This unfortunately also means that all tests run on JDK 21 instead of the newer version.
+        java-version: 21
+        distribution: 'temurin'
+
+    # Configure Gradle for optimal use in GitHub Actions, including caching of downloaded dependencies.
+    # See: https://github.com/gradle/actions/blob/main/setup-gradle/README.md
+    - name: Setup Gradle
+      uses: gradle/actions/setup-gradle@v3.5.0
+
+    - name: Run test script checker/bin-devel/test-${{ matrix.script }}
+      run: ./checker/bin-devel/test-${{ matrix.script }}.sh
+      # TODO: it would be nicer to not run the job at all, but GH Actions does
+      # not allow accessing the matrix on the job-if clause. There is also no way
+      # for an earlier step to stop execution successfully.
+      #
+      # At least one plume-lib project no longer works on Java 8.
+      # Java 8 does not allow toolchains, so testing 'cftests-junit-jdk21' is unnecessary.
+      if: matrix.java.version != 8 || (matrix.script != 'plume-lib' && matrix.script != 'cftests-junit-jdk21')
+      # Set the compiler version to use, allowing us to e.g. run Java 23 while gradle does not work
+      # on Java 23 yet. This only tests the compiler, it does not use that version to run the tests.
+      env:
+        ORG_GRADLE_PROJECT_useJdkCompiler: ${{ matrix.java.version }}
+
+  # Sanity tests on Windows and MacOS.
+  otheros:
+    name: ${{ matrix.script }} on JDK ${{ matrix.java_version }} on ${{ matrix.os }}
+    runs-on: "${{ matrix.os }}"
+    needs: sanity
+    permissions:
+      contents: read
+    strategy:
+      matrix:
+        os: ['windows-latest', 'macos-latest']
+        script: ['cftests-junit']
+        java_version: [21]
+    env:
+      JAVA_VERSION: ${{ matrix.java_version }}
+    steps:
+    - uses: actions/checkout@v4
+    - name: Set up JDK ${{ matrix.java_version }}
+      uses: actions/setup-java@v4
+      with:
+        java-version: ${{ matrix.java_version }}
+        distribution: 'temurin'
+
+    # Configure Gradle for optimal use in GitHub Actions, including caching of downloaded dependencies.
+    # See: https://github.com/gradle/actions/blob/main/setup-gradle/README.md
+    - name: Setup Gradle
+      uses: gradle/actions/setup-gradle@v3.5.0
+
+    - name: Install coreutils on MacOS
+      if: matrix.os == 'macos-latest'
+      run: brew install coreutils
+
+    - name: Run test script checker/bin-devel/test-${{ matrix.script }}
+      shell: bash
+      run: ./checker/bin-devel/test-${{ matrix.script }}.sh
+
+  dependency-submission:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+    - uses: actions/checkout@v4
+    - name: Set up JDK 21
+      uses: actions/setup-java@v4
+      with:
+        java-version: '21'
+        distribution: 'temurin'
+
+    # Generates and submits a dependency graph, enabling Dependabot Alerts for all project dependencies.
+    # See: https://github.com/gradle/actions/blob/main/dependency-submission/README.md
+    - name: Generate and submit dependency graph
+      uses: gradle/actions/dependency-submission@v3.5.0
+
diff --git a/azure-pipelines.yml b/azure-pipelines.yml
index d996a8d8ac5..1fd481f3956 100644
--- a/azure-pipelines.yml
+++ b/azure-pipelines.yml
@@ -27,12 +27,12 @@ jobs:
 # Include misc_jdk_latest because JDK 20+ adds more strict checking (e.g., Javadoc)
 - job: canary_jobs
   dependsOn:
-   - junit_jdk21
-   - nonjunit_jdk21
+   # - junit_jdk21
+   # - nonjunit_jdk21
    # - inference_part1_jdk21
    # - inference_part2_jdk21
-   - typecheck_part1_jdk21
-   - typecheck_part2_jdk21
+   # - typecheck_part1_jdk21
+   # - typecheck_part2_jdk21
    - misc_jdk21
    # - misc_jdk_latest
   pool:
@@ -43,14 +43,14 @@ jobs:
 - job: framework_jobs
   dependsOn:
    - canary_jobs
-   - junit_jdk8
-   - junit_jdk11
-   - junit_jdk17
+   # - junit_jdk8
+   # - junit_jdk11
+   # - junit_jdk17
    # - junit_jdk_latest
    # - junit_jdk_next
-   - nonjunit_jdk8
-   - nonjunit_jdk11
-   - nonjunit_jdk17
+   # - nonjunit_jdk8
+   # - nonjunit_jdk11
+   # - nonjunit_jdk17
    # - nonjunit_jdk_latest
    # - nonjunit_jdk_next
    # - inference_jdk8
@@ -58,9 +58,9 @@ jobs:
    # - inference_jdk17
    # - inference_jdk_latest
    # - inference_jdk_next
-   - typecheck_jdk8
-   - typecheck_jdk11
-   - typecheck_jdk17
+   # - typecheck_jdk8
+   # - typecheck_jdk11
+   # - typecheck_jdk17
    # - typecheck_jdk_latest
    # - typecheck_jdk_next
   pool:
@@ -79,24 +79,25 @@ jobs:
    # Not daikon_jdk_next
    # - guava_jdk8
    # - guava_jdk11
-   - guava_jdk17
-   - guava_jdk21
+   # - guava_jdk17
+   # - guava_jdk21
    # - guava_jdk_latest
    # Not guava_jdk_next
    # - plume_lib_jdk8
    # - plume_lib_jdk11
-   - plume_lib_jdk17
-   - plume_lib_jdk21
+   # - plume_lib_jdk17
+   # - plume_lib_jdk21
    # - plume_lib_jdk_latest
    # Not plume_lib_jdk_next
-   - windows_junit_jdk17
-   - jspecify_conformance_jdk21
+   # - windows_junit_jdk17
+   # - jspecify_conformance_jdk21
   pool:
     vmImage: 'ubuntu-latest'
   steps:
    - checkout: none
 
 - job: junit_jdk8
+  condition: false
   dependsOn:
    - canary_jobs
    - junit_jdk21
@@ -115,6 +116,7 @@ jobs:
       artifactName: cf_jdk8
       artifactType: pipeline
 - job: junit_jdk11
+  condition: false
   dependsOn:
    - canary_jobs
    - junit_jdk21
@@ -132,6 +134,7 @@ jobs:
       artifactName: cf_jdk11
       artifactType: pipeline
 - job: junit_jdk17
+  condition: false
   dependsOn:
    - canary_jobs
    - junit_jdk21
@@ -150,6 +153,7 @@ jobs:
       artifactName: cf_jdk17
       artifactType: pipeline
 - job: junit_jdk21
+  condition: false
   pool:
     vmImage: 'ubuntu-latest'
   container: wmdietl/cf-ubuntu-jdk21:latest
@@ -184,6 +188,7 @@ jobs:
 #       artifactName: cf_jdk_latest
 #       artifactType: pipeline
 - job: junit_jdk_next
+  condition: false
   dependsOn:
    - canary_jobs
    - junit_jdk21
@@ -206,6 +211,7 @@ jobs:
       artifactType: pipeline
 
 - job: nonjunit_jdk8
+  condition: false
   dependsOn:
    - canary_jobs
    - nonjunit_jdk21
@@ -218,6 +224,7 @@ jobs:
   - bash: ./checker/bin-devel/test-cftests-nonjunit.sh
     displayName: test-cftests-nonjunit.sh
 - job: nonjunit_jdk11
+  condition: false
   dependsOn:
    - canary_jobs
    - nonjunit_jdk21
@@ -230,6 +237,7 @@ jobs:
   - bash: ./checker/bin-devel/test-cftests-nonjunit.sh
     displayName: test-cftests-nonjunit.sh
 - job: nonjunit_jdk17
+  condition: false
   dependsOn:
    - canary_jobs
    - nonjunit_jdk21
@@ -242,6 +250,7 @@ jobs:
   - bash: ./checker/bin-devel/test-cftests-nonjunit.sh
     displayName: test-cftests-nonjunit.sh
 - job: nonjunit_jdk21
+  condition: false
   pool:
     vmImage: 'ubuntu-latest'
   container: wmdietl/cf-ubuntu-jdk21:latest
@@ -264,6 +273,7 @@ jobs:
 #   - bash: ./checker/bin-devel/test-cftests-nonjunit.sh
 #     displayName: test-cftests-nonjunit.sh
 - job: nonjunit_jdk_next
+  condition: false
   dependsOn:
    - canary_jobs
    - nonjunit_jdk21
@@ -443,6 +453,7 @@ jobs:
     displayName: test-misc.sh
 
 - job: typecheck_jdk8
+  condition: false
   dependsOn:
    - canary_jobs
    - typecheck_jdk21
@@ -455,6 +466,7 @@ jobs:
   - bash: ./checker/bin-devel/test-typecheck.sh
     displayName: test-typecheck.sh
 - job: typecheck_jdk11
+  condition: false
   dependsOn:
    - canary_jobs
    - typecheck_jdk21
@@ -467,6 +479,7 @@ jobs:
   - bash: ./checker/bin-devel/test-typecheck.sh
     displayName: test-typecheck.sh
 - job: typecheck_jdk17
+  condition: false
   dependsOn:
    - canary_jobs
    - typecheck_jdk21
@@ -480,6 +493,7 @@ jobs:
     displayName: test-typecheck.sh
 # Split into part1 and part2 only for the type-checking job that "canary_jobs" depends on.
 - job: typecheck_part1_jdk21
+  condition: false
   pool:
     vmImage: 'ubuntu-latest'
   container: wmdietl/cf-ubuntu-jdk21-plus:latest
@@ -489,6 +503,7 @@ jobs:
   - bash: ./checker/bin-devel/test-typecheck-part1.sh
     displayName: test-typecheck-part1.sh
 - job: typecheck_part2_jdk21
+  condition: false
   pool:
     vmImage: 'ubuntu-latest'
   container: wmdietl/cf-ubuntu-jdk21-plus:latest
@@ -498,6 +513,7 @@ jobs:
   - bash: ./checker/bin-devel/test-typecheck-part2.sh
     displayName: test-typecheck-part2.sh
 - job: typecheck_jdk21
+  condition: false
   dependsOn:
    - typecheck_part1_jdk21
    - typecheck_part2_jdk21
@@ -519,6 +535,7 @@ jobs:
 #  - bash: ./checker/bin-devel/test-typecheck.sh
 #    displayName: test-typecheck.sh
 - job: typecheck_jdk_next
+  condition: false
   dependsOn:
    - canary_jobs
    - typecheck_jdk21
@@ -668,6 +685,7 @@ jobs:
   - bash: ./checker/bin-devel/test-guava.sh
     displayName: test-guava.sh
 - job: guava_jdk17
+  condition: false
   dependsOn:
    - framework_jobs
    - guava_jdk21
@@ -681,6 +699,7 @@ jobs:
   - bash: ./checker/bin-devel/test-guava.sh
     displayName: test-guava.sh
 - job: guava_jdk21
+  condition: false
   dependsOn:
    - canary_jobs
   pool:
@@ -712,6 +731,7 @@ jobs:
 #   - bash: ./checker/bin-devel/test-guava.sh
 #     displayName: test-guava.sh
 - job: guava_jdk_next
+  condition: false
   dependsOn:
    - framework_jobs
    - guava_jdk21
@@ -755,6 +775,7 @@ jobs:
   - bash: ./checker/bin-devel/test-plume-lib.sh
     displayName: test-plume-lib.sh
 - job: plume_lib_jdk17
+  condition: false
   dependsOn:
    - canary_jobs
    - plume_lib_jdk21
@@ -767,6 +788,7 @@ jobs:
   - bash: ./checker/bin-devel/test-plume-lib.sh
     displayName: test-plume-lib.sh
 - job: plume_lib_jdk21
+  condition: false
   dependsOn:
    - canary_jobs
   pool:
@@ -791,6 +813,7 @@ jobs:
 #   - bash: ./checker/bin-devel/test-plume-lib.sh
 #     displayName: test-plume-lib.sh
 - job: plume_lib_jdk_next
+  condition: false
   dependsOn:
    - canary_jobs
    - plume_lib_jdk17
@@ -806,6 +829,7 @@ jobs:
     displayName: test-plume-lib.sh
 
 - job: jspecify_conformance_jdk21
+  condition: false
   dependsOn:
    - junit_jdk21
   pool:
@@ -879,6 +903,7 @@ jobs:
 #     displayName: test-downstream.sh
 
 - job: windows_junit_jdk17
+  condition: false
   dependsOn:
     - junit_jdk21
   pool:
diff --git a/build.gradle b/build.gradle
index 50045fdbd4b..e6d190cb98d 100644
--- a/build.gradle
+++ b/build.gradle
@@ -33,6 +33,14 @@ repositories {
     mavenCentral()
 }
 
+
+def majorVersionToInt(majorVersionString) {
+    if (majorVersionString.endsWith("-ea")) {
+        majorVersionString = majorVersionString.substring(0, majorVersionString.length() - 3)
+    }
+    return Integer.valueOf(majorVersionString)
+}
+
 ext {
     release = false
 
@@ -40,8 +48,11 @@ ext {
     // On a Java 9+ JVM, use the host javac, default source/target, and required module flags.
     isJava8 = JavaVersion.current() == JavaVersion.VERSION_1_8
 
-    // As of 2023-09-23, delombok doesn't yet support JDK 22; see https://projectlombok.org/changelog .
-    skipDelombok = JavaVersion.current() > JavaVersion.VERSION_21
+    // The int corresponding to the major version of the current JVM.
+    currentRuntimeJavaVersion = majorVersionToInt(JavaVersion.current().getMajorVersion())
+
+    // As of 2024-08-06, delombok doesn't yet support JDK 23; see https://projectlombok.org/changelog .
+    skipDelombok = currentRuntimeJavaVersion >= 23
 
     parentDir = file("${rootDir}/../").absolutePath
 
@@ -104,7 +115,7 @@ task installGitHooks(type: Copy, dependsOn: 'setLocalRepo') {
     into localRepo + '/hooks'
 }
 
-if (isJava11plus) {
+if (currentRuntimeJavaVersion >= 11) {
     apply plugin: 'com.diffplug.spotless'
     spotless {
         // Resolve the Spotless plugin dependencies from the buildscript repositories rather than the
@@ -225,7 +236,7 @@ allprojects {
         ]
     }
 
-    if (isJava11plus) {
+    if (currentRuntimeJavaVersion >= 11) {
         apply plugin: 'com.diffplug.spotless'
         spotless {
             // If you add any formatters to this block that require dependencies, then you must also
@@ -241,20 +252,19 @@ allprojects {
                 '**/build/**',
                 '*/dist/**',
             ]
-            if (!isJava14plus) {
+            if (currentRuntimeJavaVersion < 14) {
                 doNotFormat += ['**/*record*/']
             }
-            if (!isJava16plus) {
+            if (currentRuntimeJavaVersion < 16) {
                 // TODO: directories should be renamed `-switchexpr` or some such,
                 // as they  only contain examples for switch expressions, which were
                 // added in Java 14, not Java 17.
                 doNotFormat += ['**/java17/']
             }
-            if (!isJava21plus) {
+            if (currentRuntimeJavaVersion < 21) {
                 doNotFormat += ['**/java21/']
             }
 
-
             format 'misc', {
                 // define the files to apply `misc` to
                 target '*.md', '*.tex', '.gitignore', 'Makefile'
@@ -369,13 +379,23 @@ allprojects {
         // Add standard javac options
         tasks.withType(JavaCompile) { compilationTask ->
             dependsOn(':installGitHooks')
-            boolean jdk17Compiler = project.getProperties().getOrDefault('useJdk17Compiler', false)
-            if (!isJava8 && jdk17Compiler) {
-                // This uses the Java 17 compiler to compile all code.
-                //  https://docs.gradle.org/current/userguide/toolchains.html
-                // This property is final on Java 8, so don't set it then.
-                javaCompiler = javaToolchains.compilerFor {
-                    languageVersion = JavaLanguageVersion.of(17)
+            String useJdkCompilerProp = project.getProperties().get('useJdkCompiler')
+            int useJdkCompiler
+            if (useJdkCompilerProp == null) {
+                // If the property is not given, use the same version as the runtime.
+                useJdkCompiler = currentRuntimeJavaVersion
+            } else {
+                useJdkCompiler = majorVersionToInt(useJdkCompilerProp)
+                boolean useToolchains = (currentRuntimeJavaVersion != useJdkCompiler)
+                if (!isJava8 && useToolchains) {
+                    // This uses the requested Java compiler to compile all code.
+                    // CI test test-cftests-junit-jdk21 runs the JUnit tests on the different JDK versions,
+                    // to ensure there is no version mismatch between compiled-against javac APIs and runtime APIs.
+                    //   https://docs.gradle.org/current/userguide/toolchains.html
+                    // This property is final on Java 8, so don't set it then.
+                    javaCompiler = javaToolchains.compilerFor {
+                        languageVersion = JavaLanguageVersion.of(useJdkCompiler)
+                    }
                 }
             }
 
@@ -439,7 +459,8 @@ allprojects {
             //   warnings are suppressible with a "// fall through" comment.
             // -classfile: classgraph jar file and https://bugs.openjdk.org/browse/JDK-8190452
             String lint = '-Xlint:-options,-fallthrough,-classfile'
-            if (isJava21plus && !jdk17Compiler) {
+            // Java 8 uses the Error Prone javac, not what is requested with useJdkCompiler.
+            if (!isJava8 && useJdkCompiler >= 21) {
                 // TODO: Ignore this-escape for now, we may want to review and suppress each one later.
                 lint +=',-this-escape'
             }
diff --git a/checker/bin-devel/test-cftests-all.sh b/checker/bin-devel/test-cftests-all.sh
index ff590af2764..96830e1e2a5 100755
--- a/checker/bin-devel/test-cftests-all.sh
+++ b/checker/bin-devel/test-cftests-all.sh
@@ -9,13 +9,11 @@ set -o xtrace
 export SHELLOPTS
 echo "SHELLOPTS=${SHELLOPTS}"
 
-export ORG_GRADLE_PROJECT_useJdk17Compiler=true
 SCRIPTDIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
 # shellcheck disable=SC1090 # In newer shellcheck than 0.6.0, pass: "-P SCRIPTDIR" (literally)
 source "$SCRIPTDIR"/clone-related.sh
 
 
-
 ./gradlew allTests --console=plain --warning-mode=all
 # Moved example-tests out of all tests because it fails in
 # the release script because the newest maven artifacts are not published yet.
diff --git a/checker/bin-devel/test-cftests-inference-part1.sh b/checker/bin-devel/test-cftests-inference-part1.sh
index 5e945cdf6f0..2064f33047e 100755
--- a/checker/bin-devel/test-cftests-inference-part1.sh
+++ b/checker/bin-devel/test-cftests-inference-part1.sh
@@ -8,9 +8,7 @@ echo "SHELLOPTS=${SHELLOPTS}"
 
 SCRIPTDIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
 # shellcheck disable=SC1090 # In newer shellcheck than 0.6.0, pass: "-P SCRIPTDIR" (literally)
-export ORG_GRADLE_PROJECT_useJdk17Compiler=true
 source "$SCRIPTDIR"/clone-related.sh
 
 
-
 ./gradlew inferenceTests-part1 --console=plain --warning-mode=all
diff --git a/checker/bin-devel/test-cftests-inference-part2.sh b/checker/bin-devel/test-cftests-inference-part2.sh
index 34fcc84bb76..1f35a502ded 100755
--- a/checker/bin-devel/test-cftests-inference-part2.sh
+++ b/checker/bin-devel/test-cftests-inference-part2.sh
@@ -8,9 +8,7 @@ echo "SHELLOPTS=${SHELLOPTS}"
 
 SCRIPTDIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
 # shellcheck disable=SC1090 # In newer shellcheck than 0.6.0, pass: "-P SCRIPTDIR" (literally)
-export ORG_GRADLE_PROJECT_useJdk17Compiler=true
 source "$SCRIPTDIR"/clone-related.sh
 
 
-
 ./gradlew inferenceTests-part2 --console=plain --warning-mode=all
diff --git a/checker/bin-devel/test-cftests-inference.sh b/checker/bin-devel/test-cftests-inference.sh
index 24584a52183..e9c27a3f8ea 100755
--- a/checker/bin-devel/test-cftests-inference.sh
+++ b/checker/bin-devel/test-cftests-inference.sh
@@ -8,9 +8,7 @@ echo "SHELLOPTS=${SHELLOPTS}"
 
 SCRIPTDIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
 # shellcheck disable=SC1090 # In newer shellcheck than 0.6.0, pass: "-P SCRIPTDIR" (literally)
-export ORG_GRADLE_PROJECT_useJdk17Compiler=true
 source "$SCRIPTDIR"/clone-related.sh
 
 
-
 ./gradlew inferenceTests --console=plain --warning-mode=all
diff --git a/checker/bin-devel/test-cftests-junit-jdk21.sh b/checker/bin-devel/test-cftests-junit-jdk21.sh
new file mode 100755
index 00000000000..fe20e2caf60
--- /dev/null
+++ b/checker/bin-devel/test-cftests-junit-jdk21.sh
@@ -0,0 +1,15 @@
+#!/bin/bash
+
+set -e
+set -o verbose
+set -o xtrace
+export SHELLOPTS
+echo "SHELLOPTS=${SHELLOPTS}"
+
+SCRIPTDIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
+# shellcheck disable=SC1090# In newer shellcheck than 0.6.0, pass: "-P SCRIPTDIR" (literally)
+export ORG_GRADLE_PROJECT_useJdkCompiler=21
+source "$SCRIPTDIR"/clone-related.sh
+
+
+./gradlew test -x javadoc -x allJavadoc --console=plain --warning-mode=all
diff --git a/checker/bin-devel/test-cftests-junit.sh b/checker/bin-devel/test-cftests-junit.sh
index 058d6a7ae9c..92d31565b88 100755
--- a/checker/bin-devel/test-cftests-junit.sh
+++ b/checker/bin-devel/test-cftests-junit.sh
@@ -8,7 +8,6 @@ echo "SHELLOPTS=${SHELLOPTS}"
 
 SCRIPTDIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
 # shellcheck disable=SC1090# In newer shellcheck than 0.6.0, pass: "-P SCRIPTDIR" (literally)
-export ORG_GRADLE_PROJECT_useJdk17Compiler=true
 source "$SCRIPTDIR"/clone-related.sh
 
 
diff --git a/checker/bin-devel/test-cftests-nonjunit.sh b/checker/bin-devel/test-cftests-nonjunit.sh
index c96bdf0bf50..1165c83c415 100755
--- a/checker/bin-devel/test-cftests-nonjunit.sh
+++ b/checker/bin-devel/test-cftests-nonjunit.sh
@@ -8,7 +8,6 @@ echo "SHELLOPTS=${SHELLOPTS}"
 
 SCRIPTDIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
 # shellcheck disable=SC1090# In newer shellcheck than 0.6.0, pass: "-P SCRIPTDIR" (literally)
-export ORG_GRADLE_PROJECT_useJdk17Compiler=true
 source "$SCRIPTDIR"/clone-related.sh
 
 
diff --git a/checker/bin-devel/test-daikon-part1.sh b/checker/bin-devel/test-daikon-part1.sh
index 1a2c7e898a9..627e663eb69 100755
--- a/checker/bin-devel/test-daikon-part1.sh
+++ b/checker/bin-devel/test-daikon-part1.sh
@@ -8,7 +8,6 @@ echo "SHELLOPTS=${SHELLOPTS}"
 
 SCRIPTDIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
 # shellcheck disable=SC1090# In newer shellcheck than 0.6.0, pass: "-P SCRIPTDIR" (literally)
-export ORG_GRADLE_PROJECT_useJdk17Compiler=true
 source "$SCRIPTDIR"/clone-related.sh
 
 # Run assembleForJavac because it does not build the javadoc, so it is faster than assemble.
diff --git a/checker/bin-devel/test-daikon-part2.sh b/checker/bin-devel/test-daikon-part2.sh
index 860e5285192..1cb5e9d3117 100755
--- a/checker/bin-devel/test-daikon-part2.sh
+++ b/checker/bin-devel/test-daikon-part2.sh
@@ -8,7 +8,6 @@ echo "SHELLOPTS=${SHELLOPTS}"
 
 SCRIPTDIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
 # shellcheck disable=SC1090 # In newer shellcheck than 0.6.0, pass: "-P SCRIPTDIR" (literally)
-export ORG_GRADLE_PROJECT_useJdk17Compiler=true
 source "$SCRIPTDIR"/clone-related.sh
 
 # Run assembleForJavac because it does not build the javadoc, so it is faster than assemble.
diff --git a/checker/bin-devel/test-daikon.sh b/checker/bin-devel/test-daikon.sh
index 97c8e8f98c0..7b3b153abfd 100755
--- a/checker/bin-devel/test-daikon.sh
+++ b/checker/bin-devel/test-daikon.sh
@@ -8,7 +8,6 @@ echo "SHELLOPTS=${SHELLOPTS}"
 
 SCRIPTDIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
 # shellcheck disable=SC1090 # In newer shellcheck than 0.6.0, pass: "-P SCRIPTDIR" (literally)
-export ORG_GRADLE_PROJECT_useJdk17Compiler=true
 source "$SCRIPTDIR"/clone-related.sh
 
 # Run assembleForJavac because it does not build the javadoc, so it is faster than assemble.
diff --git a/checker/bin-devel/test-downstream.sh b/checker/bin-devel/test-downstream.sh
index 53be63895f0..95cf1419347 100755
--- a/checker/bin-devel/test-downstream.sh
+++ b/checker/bin-devel/test-downstream.sh
@@ -8,7 +8,6 @@ echo "SHELLOPTS=${SHELLOPTS}"
 
 SCRIPTDIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
 # shellcheck disable=SC1090 # In newer shellcheck than 0.6.0, pass: "-P SCRIPTDIR" (literally)
-export ORG_GRADLE_PROJECT_useJdk17Compiler=true
 source "$SCRIPTDIR"/clone-related.sh
 
 
diff --git a/checker/bin-devel/test-guava-formatter.sh b/checker/bin-devel/test-guava-formatter.sh
index 57eb547766f..63f50e1be7f 100755
--- a/checker/bin-devel/test-guava-formatter.sh
+++ b/checker/bin-devel/test-guava-formatter.sh
@@ -8,7 +8,6 @@ echo "SHELLOPTS=${SHELLOPTS}"
 
 SCRIPTDIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
 # shellcheck disable=SC1090 # In newer shellcheck than 0.6.0, pass: "-P SCRIPTDIR" (literally)
-export ORG_GRADLE_PROJECT_useJdk17Compiler=true
 source "$SCRIPTDIR"/clone-related.sh
 
 
diff --git a/checker/bin-devel/test-guava-index.sh b/checker/bin-devel/test-guava-index.sh
index 32a787cd091..fc1cca0679f 100755
--- a/checker/bin-devel/test-guava-index.sh
+++ b/checker/bin-devel/test-guava-index.sh
@@ -9,7 +9,6 @@ echo "SHELLOPTS=${SHELLOPTS}"
 
 SCRIPTDIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
 # shellcheck disable=SC1090 # In newer shellcheck than 0.6.0, pass: "-P SCRIPTDIR" (literally)
-export ORG_GRADLE_PROJECT_useJdk17Compiler=true
 source "$SCRIPTDIR"/clone-related.sh
 
 
diff --git a/checker/bin-devel/test-guava-interning.sh b/checker/bin-devel/test-guava-interning.sh
index 9dfaa51169b..c44d6320aa6 100755
--- a/checker/bin-devel/test-guava-interning.sh
+++ b/checker/bin-devel/test-guava-interning.sh
@@ -8,7 +8,6 @@ echo "SHELLOPTS=${SHELLOPTS}"
 
 SCRIPTDIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
 # shellcheck disable=SC1090 # In newer shellcheck than 0.6.0, pass: "-P SCRIPTDIR" (literally)
-export ORG_GRADLE_PROJECT_useJdk17Compiler=true
 source "$SCRIPTDIR"/clone-related.sh
 
 
diff --git a/checker/bin-devel/test-guava-lock.sh b/checker/bin-devel/test-guava-lock.sh
index d146d5d1ba7..04200961692 100755
--- a/checker/bin-devel/test-guava-lock.sh
+++ b/checker/bin-devel/test-guava-lock.sh
@@ -8,7 +8,6 @@ echo "SHELLOPTS=${SHELLOPTS}"
 
 SCRIPTDIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
 # shellcheck disable=SC1090 # In newer shellcheck than 0.6.0, pass: "-P SCRIPTDIR" (literally)
-export ORG_GRADLE_PROJECT_useJdk17Compiler=true
 source "$SCRIPTDIR"/clone-related.sh
 
 
diff --git a/checker/bin-devel/test-guava-nullness.sh b/checker/bin-devel/test-guava-nullness.sh
index 4ee36fb5b4a..71b484d655a 100755
--- a/checker/bin-devel/test-guava-nullness.sh
+++ b/checker/bin-devel/test-guava-nullness.sh
@@ -8,7 +8,6 @@ echo "SHELLOPTS=${SHELLOPTS}"
 
 SCRIPTDIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
 # shellcheck disable=SC1090 # In newer shellcheck than 0.6.0, pass: "-P SCRIPTDIR" (literally)
-export ORG_GRADLE_PROJECT_useJdk17Compiler=true
 source "$SCRIPTDIR"/clone-related.sh
 
 
diff --git a/checker/bin-devel/test-guava-regex.sh b/checker/bin-devel/test-guava-regex.sh
index a4f04217206..42dfcaf947e 100755
--- a/checker/bin-devel/test-guava-regex.sh
+++ b/checker/bin-devel/test-guava-regex.sh
@@ -8,7 +8,6 @@ echo "SHELLOPTS=${SHELLOPTS}"
 
 SCRIPTDIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
 # shellcheck disable=SC1090 # In newer shellcheck than 0.6.0, pass: "-P SCRIPTDIR" (literally)
-export ORG_GRADLE_PROJECT_useJdk17Compiler=true
 source "$SCRIPTDIR"/clone-related.sh
 
 
diff --git a/checker/bin-devel/test-guava-signature.sh b/checker/bin-devel/test-guava-signature.sh
index a7ff4ceee08..e7cd12dded8 100755
--- a/checker/bin-devel/test-guava-signature.sh
+++ b/checker/bin-devel/test-guava-signature.sh
@@ -8,7 +8,6 @@ echo "SHELLOPTS=${SHELLOPTS}"
 
 SCRIPTDIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
 # shellcheck disable=SC1090 # In newer shellcheck than 0.6.0, pass: "-P SCRIPTDIR" (literally)
-export ORG_GRADLE_PROJECT_useJdk17Compiler=true
 source "$SCRIPTDIR"/clone-related.sh
 
 
diff --git a/checker/bin-devel/test-guava.sh b/checker/bin-devel/test-guava.sh
index a56e559f03c..93589d4dd66 100755
--- a/checker/bin-devel/test-guava.sh
+++ b/checker/bin-devel/test-guava.sh
@@ -8,7 +8,6 @@ echo "SHELLOPTS=${SHELLOPTS}"
 
 SCRIPTDIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
 # shellcheck disable=SC1090 # In newer shellcheck than 0.6.0, pass: "-P SCRIPTDIR" (literally)
-export ORG_GRADLE_PROJECT_useJdk17Compiler=true
 source "$SCRIPTDIR"/clone-related.sh
 ./gradlew assembleForJavac --console=plain -Dorg.gradle.internal.http.socketTimeout=60000 -Dorg.gradle.internal.http.connectionTimeout=60000
 
diff --git a/checker/bin-devel/test-jspecify-conformance.sh b/checker/bin-devel/test-jspecify-conformance.sh
index 6b47021e1cc..a7247d7f108 100755
--- a/checker/bin-devel/test-jspecify-conformance.sh
+++ b/checker/bin-devel/test-jspecify-conformance.sh
@@ -8,10 +8,10 @@ echo "SHELLOPTS=${SHELLOPTS}"
 
 SCRIPTDIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
 # shellcheck disable=SC1090 # In newer shellcheck than 0.6.0, pass: "-P SCRIPTDIR" (literally)
-export ORG_GRADLE_PROJECT_useJdk17Compiler=true
 source "$SCRIPTDIR"/clone-related.sh
 ./gradlew assembleForJavac --console=plain -Dorg.gradle.internal.http.socketTimeout=60000 -Dorg.gradle.internal.http.connectionTimeout=60000
 
+
 GIT_SCRIPTS="$SCRIPTDIR/.git-scripts"
 "$GIT_SCRIPTS/git-clone-related" eisop jspecify-conformance
 cd ../jspecify-conformance
diff --git a/checker/bin-devel/test-misc.sh b/checker/bin-devel/test-misc.sh
index 7d7ea89cf16..3e21746d48e 100755
--- a/checker/bin-devel/test-misc.sh
+++ b/checker/bin-devel/test-misc.sh
@@ -8,7 +8,6 @@ echo "SHELLOPTS=${SHELLOPTS}"
 
 SCRIPTDIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
 # shellcheck disable=SC1090 # In newer shellcheck than 0.6.0, pass: "-P SCRIPTDIR" (literally)
-export ORG_GRADLE_PROJECT_useJdk17Compiler=true
 source "$SCRIPTDIR"/clone-related.sh
 
 PLUME_SCRIPTS="$SCRIPTDIR/.plume-scripts"
diff --git a/checker/bin-devel/test-plume-lib.sh b/checker/bin-devel/test-plume-lib.sh
index e43f7f64024..3f0f2ddbecf 100755
--- a/checker/bin-devel/test-plume-lib.sh
+++ b/checker/bin-devel/test-plume-lib.sh
@@ -38,7 +38,6 @@ echo "PACKAGES=" "${PACKAGES[@]}"
 
 SCRIPTDIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
 # shellcheck disable=SC1090 # In newer shellcheck than 0.6.0, pass: "-P SCRIPTDIR" (literally)
-export ORG_GRADLE_PROJECT_useJdk17Compiler=true
 source "$SCRIPTDIR"/clone-related.sh
 ./gradlew assembleForJavac --console=plain -Dorg.gradle.internal.http.socketTimeout=60000 -Dorg.gradle.internal.http.connectionTimeout=60000
 
diff --git a/checker/bin-devel/test-typecheck-part1.sh b/checker/bin-devel/test-typecheck-part1.sh
index 2c27f7b1523..69dff413285 100755
--- a/checker/bin-devel/test-typecheck-part1.sh
+++ b/checker/bin-devel/test-typecheck-part1.sh
@@ -8,7 +8,6 @@ echo "SHELLOPTS=${SHELLOPTS}"
 
 SCRIPTDIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
 # shellcheck disable=SC1090 # In newer shellcheck than 0.6.0, pass: "-P SCRIPTDIR" (literally)
-export ORG_GRADLE_PROJECT_useJdk17Compiler=true
 source "$SCRIPTDIR"/clone-related.sh
 
 
diff --git a/checker/bin-devel/test-typecheck-part2.sh b/checker/bin-devel/test-typecheck-part2.sh
index 0d512a6ea2b..87182e11038 100755
--- a/checker/bin-devel/test-typecheck-part2.sh
+++ b/checker/bin-devel/test-typecheck-part2.sh
@@ -8,7 +8,6 @@ echo "SHELLOPTS=${SHELLOPTS}"
 
 SCRIPTDIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
 # shellcheck disable=SC1090 # In newer shellcheck than 0.6.0, pass: "-P SCRIPTDIR" (literally)
-export ORG_GRADLE_PROJECT_useJdk17Compiler=true
 source "$SCRIPTDIR"/clone-related.sh
 
 
diff --git a/checker/bin-devel/test-typecheck.sh b/checker/bin-devel/test-typecheck.sh
index 5afee821003..ec4c0bcd1b1 100755
--- a/checker/bin-devel/test-typecheck.sh
+++ b/checker/bin-devel/test-typecheck.sh
@@ -8,7 +8,6 @@ echo "SHELLOPTS=${SHELLOPTS}"
 
 SCRIPTDIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
 # shellcheck disable=SC1090 # In newer shellcheck than 0.6.0, pass: "-P SCRIPTDIR" (literally)
-export ORG_GRADLE_PROJECT_useJdk17Compiler=true
 source "$SCRIPTDIR"/clone-related.sh
 
 
diff --git a/checker/build.gradle b/checker/build.gradle
index 0c280e2749f..213043ca59a 100644
--- a/checker/build.gradle
+++ b/checker/build.gradle
@@ -76,7 +76,7 @@ dependencies {
     testImplementation 'com.amazonaws:aws-java-sdk-ec2'
     testImplementation 'com.amazonaws:aws-java-sdk-kms'
     // The AWS SDK is used for testing the Called Methods Checker.
-    testImplementation platform('com.amazonaws:aws-java-sdk-bom:1.12.670')
+    testImplementation platform('com.amazonaws:aws-java-sdk-bom:1.12.767')
     // For the Resource Leak Checker's support for JavaEE.
     testImplementation 'javax.servlet:javax.servlet-api:4.0.1'
     // For the Resource Leak Checker's support for IOUtils.
diff --git a/javacutil/src/main/java/org/checkerframework/javacutil/Resolver.java b/javacutil/src/main/java/org/checkerframework/javacutil/Resolver.java
index 122dfe64881..a58399afcc8 100644
--- a/javacutil/src/main/java/org/checkerframework/javacutil/Resolver.java
+++ b/javacutil/src/main/java/org/checkerframework/javacutil/Resolver.java
@@ -64,8 +64,8 @@ public class Resolver {
     /** Whether we are running on at least Java 13. */
     private static final boolean atLeastJava13;
 
-    /** Whether we are running on at least Java 24. */
-    private static final boolean atLeastJava24;
+    /** Whether we are running on at least Java 23. */
+    private static final boolean atLeastJava23;
 
     /**
      * Determines whether the given {@link SourceVersion} release version string is supported.
@@ -90,7 +90,7 @@ private static boolean atLeastJava(String release) {
     static {
         try {
             atLeastJava13 = atLeastJava("RELEASE_13");
-            atLeastJava24 = atLeastJava("RELEASE_24");
+            atLeastJava23 = atLeastJava("RELEASE_23");
 
             FIND_METHOD =
                     Resolve.class.getDeclaredMethod(
@@ -104,7 +104,7 @@ private static boolean atLeastJava(String release) {
                             boolean.class);
             FIND_METHOD.setAccessible(true);
 
-            if (atLeastJava24) {
+            if (atLeastJava23) {
                 // Changed in
                 // https://github.com/openjdk/jdk/commit/e227c7e37d4de0656f013f3a936b1acfa56cc2e0
                 FIND_VAR =
@@ -332,7 +332,7 @@ public Env<AttrContext> getEnvForPath(TreePath path) {
             Env<AttrContext> env = getEnvForPath(path);
             // Either a VariableElement or a SymbolNotFoundError.
             Element res;
-            if (atLeastJava24) {
+            if (atLeastJava23) {
                 DiagnosticPosition pos = (DiagnosticPosition) path.getLeaf();
                 res = wrapInvocationOnResolveInstance(FIND_VAR, pos, env, names.fromString(name));
             } else {