diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 6f878a0573..c75f707d0a 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -31,9 +31,9 @@ jobs:
       with:
         languages: java
 
-    - uses: actions/setup-java@v4
+    - uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
       with:
-        java-version: 17
+        java-version-file: .java-version
         distribution: temurin
 
     - name: Cache local Maven repository
diff --git a/.github/workflows/docker-build-smoke-tests-fake-backend.yml b/.github/workflows/docker-build-smoke-tests-fake-backend.yml
index 1f8dcf4609..3ad1d3f6de 100644
--- a/.github/workflows/docker-build-smoke-tests-fake-backend.yml
+++ b/.github/workflows/docker-build-smoke-tests-fake-backend.yml
@@ -21,9 +21,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
-      - uses: actions/setup-java@v4
+      - uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
         with:
-          java-version: 17
+          java-version-file: .java-version
           distribution: 'temurin'
         # cache local patch outputs
       - name: Cache local Maven repository
diff --git a/.github/workflows/e2e-tests-app-with-java-agent.yml b/.github/workflows/e2e-tests-app-with-java-agent.yml
index d24f4540e0..df1f06307a 100644
--- a/.github/workflows/e2e-tests-app-with-java-agent.yml
+++ b/.github/workflows/e2e-tests-app-with-java-agent.yml
@@ -29,9 +29,9 @@ jobs:
         with:
           fetch-depth: 0
 
-      - uses: actions/setup-java@v4
+      - uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
         with:
-          java-version: 17
+          java-version-file: .java-version
           distribution: temurin
 
       # cache local patch outputs
@@ -81,9 +81,9 @@ jobs:
     steps:
       - uses: actions/checkout@v5
 
-      - uses: actions/setup-java@v4
+      - uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
         with:
-          java-version: 17
+          java-version-file: .java-version
           distribution: 'temurin'
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v4
@@ -112,9 +112,9 @@ jobs:
     steps:
       - uses: actions/checkout@v5
 
-      - uses: actions/setup-java@v4
+      - uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
         with:
-          java-version: 17
+          java-version-file: .java-version
           distribution: 'temurin'
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v4
@@ -143,9 +143,9 @@ jobs:
     steps:
       - uses: actions/checkout@v5
 
-      - uses: actions/setup-java@v4
+      - uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
         with:
-          java-version: 17
+          java-version-file: .java-version
           distribution: 'temurin'
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v4
diff --git a/.github/workflows/e2e-tests-with-operator.yml b/.github/workflows/e2e-tests-with-operator.yml
index ab207d1a6d..92dfbee4f9 100644
--- a/.github/workflows/e2e-tests-with-operator.yml
+++ b/.github/workflows/e2e-tests-with-operator.yml
@@ -38,9 +38,9 @@ jobs:
         with:
           fetch-depth: 0
 
-      - uses: actions/setup-java@v4
+      - uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
         with:
-          java-version: 17
+          java-version-file: .java-version
           distribution: temurin
 
       # cache local patch outputs
@@ -132,7 +132,7 @@ jobs:
           path: aws-otel-java-instrumentation
 
       - name: Set up JDK 11
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
         with:
           distribution: 'zulu'
           java-version: '11'
diff --git a/.github/workflows/main-build.yml b/.github/workflows/main-build.yml
index 191d545ff0..26f3ba2067 100644
--- a/.github/workflows/main-build.yml
+++ b/.github/workflows/main-build.yml
@@ -23,9 +23,9 @@ jobs:
     runs-on: aws-otel-java-instrumentation_ubuntu-latest_32-core
     steps:
       - uses: actions/checkout@v5
-      - uses: actions/setup-java@v4
+      - uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
         with:
-          java-version: 17
+          java-version-file: .java-version
           distribution: temurin
       # vaadin 14 tests fail with node 18
       - name: Set up Node
@@ -57,9 +57,9 @@ jobs:
       - uses: actions/checkout@v5
         with:
           fetch-depth: 0
-      - uses: actions/setup-java@v4
+      - uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
         with:
-          java-version: 17
+          java-version-file: .java-version
           distribution: temurin
 
         # cache local patch outputs
@@ -192,7 +192,7 @@ jobs:
       - uses: actions/checkout@v5
         with:
           fetch-depth: 0
-      - uses: actions/setup-java@v4
+      - uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
         with:
           java-version: 23
           distribution: 'temurin'
@@ -232,9 +232,9 @@ jobs:
       - uses: actions/checkout@v5
         with:
           fetch-depth: 0
-      - uses: actions/setup-java@v4
+      - uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
         with:
-          java-version: 17
+          java-version-file: .java-version
           distribution: 'temurin'
       - name: Build Application Signals Lambda Layer
         working-directory: lambda-layer
diff --git a/.github/workflows/nightly-upstream-snapshot-build.yml b/.github/workflows/nightly-upstream-snapshot-build.yml
index 408419033d..7be913ca15 100644
--- a/.github/workflows/nightly-upstream-snapshot-build.yml
+++ b/.github/workflows/nightly-upstream-snapshot-build.yml
@@ -27,9 +27,9 @@ jobs:
         with:
           fetch-depth: 0
 
-      - uses: actions/setup-java@v4
+      - uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
         with:
-          java-version: 17
+          java-version-file: .java-version
           distribution: 'temurin'
 
         # cache local patch outputs
@@ -132,7 +132,7 @@ jobs:
       - uses: actions/checkout@v5
         with:
           fetch-depth: 0
-      - uses: actions/setup-java@v4
+      - uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
         with:
           java-version: 23
           distribution: 'temurin'
diff --git a/.github/workflows/owasp.yml b/.github/workflows/owasp.yml
index a505a4f865..6a3dbd5949 100644
--- a/.github/workflows/owasp.yml
+++ b/.github/workflows/owasp.yml
@@ -31,9 +31,9 @@ jobs:
           fetch-depth: 0
 
       - name: Set up Java for dependency scan
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
         with:
-          java-version: 17
+          java-version-file: .java-version
           distribution: 'temurin'
 
       - name: Configure AWS credentials for dependency scan
diff --git a/.github/workflows/patch-release-build.yml b/.github/workflows/patch-release-build.yml
index 725661e5aa..4da82f9a43 100644
--- a/.github/workflows/patch-release-build.yml
+++ b/.github/workflows/patch-release-build.yml
@@ -61,9 +61,9 @@ jobs:
         with:
           ref: ${{ needs.prepare-release-branch.outputs.release-branch-name }}
 
-      - uses: actions/setup-java@v4
+      - uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
         with:
-          java-version: 17
+          java-version-file: .java-version
           distribution: 'temurin'
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v4
diff --git a/.github/workflows/pr-build.yml b/.github/workflows/pr-build.yml
index 14e71745cd..87ecee6357 100644
--- a/.github/workflows/pr-build.yml
+++ b/.github/workflows/pr-build.yml
@@ -14,9 +14,9 @@ jobs:
     steps:
       - uses: actions/checkout@v5
 
-      - uses: actions/setup-java@v4
+      - uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
         with:
-          java-version: 17
+          java-version-file: .java-version
           distribution: temurin
       # vaadin 14 tests fail with node 18
       - name: Set up Node
@@ -56,9 +56,9 @@ jobs:
     steps:
       - uses: actions/checkout@v5
 
-      - uses: actions/setup-java@v4
+      - uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
         with:
-          java-version: 17
+          java-version-file: .java-version
           distribution: temurin
 
       - uses: gradle/actions/wrapper-validation@017a9effdb900e5b5b2fddfb590a105619dca3c3 # v4.4.2
@@ -93,7 +93,7 @@ jobs:
           ./gradlew build -p exporters/aws-distro-opentelemetry-xray-udp-span-exporter
 
       - name: Set up Java version for tests
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
         with:
           java-version: 23
           distribution: temurin
@@ -109,9 +109,9 @@ jobs:
           arguments: contractTests -PlocalDocker=true -i
 
       - name: Set up Java version for image build
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
         with:
-          java-version: 17
+          java-version-file: .java-version
           distribution: temurin
 
       - name: Get current version
@@ -168,9 +168,9 @@ jobs:
         uses: actions/checkout@v5
 
       - name: Setup Java
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
         with:
-          java-version: 17
+          java-version-file: .java-version
           distribution: temurin
 
       - name: Build layer
diff --git a/.github/workflows/release-build.yml b/.github/workflows/release-build.yml
index b73636e488..41862f5c08 100644
--- a/.github/workflows/release-build.yml
+++ b/.github/workflows/release-build.yml
@@ -25,9 +25,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
-      - uses: actions/setup-java@v4
+      - uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
         with:
-          java-version: 17
+          java-version-file: .java-version
           distribution: 'temurin'
       - uses: gradle/actions/wrapper-validation@017a9effdb900e5b5b2fddfb590a105619dca3c3 # v4.4.2
 
diff --git a/.github/workflows/release-lambda.yml b/.github/workflows/release-lambda.yml
index e85e9d1ed3..fbd12eb653 100644
--- a/.github/workflows/release-lambda.yml
+++ b/.github/workflows/release-lambda.yml
@@ -42,9 +42,9 @@ jobs:
       - name: Checkout Repo @ SHA - ${{ github.sha }}
         uses: actions/checkout@v5
 
-      - uses: actions/setup-java@v4
+      - uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
         with:
-          java-version: 17
+          java-version-file: .java-version
           distribution: 'temurin'
 
       - name: Build layers
diff --git a/.github/workflows/release-udp-exporter.yml b/.github/workflows/release-udp-exporter.yml
index 8d39e7308c..c72b8f7a77 100644
--- a/.github/workflows/release-udp-exporter.yml
+++ b/.github/workflows/release-udp-exporter.yml
@@ -29,9 +29,9 @@ jobs:
         uses: actions/checkout@v5
 
       - name: Set up Java
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
         with:
-          java-version: '17'
+          java-version-file: .java-version
           distribution: 'temurin'
           cache: 'gradle'
 
diff --git a/.github/workflows/udp-exporter-e2e-test.yml b/.github/workflows/udp-exporter-e2e-test.yml
index 33ad3d756a..a3e4631db8 100644
--- a/.github/workflows/udp-exporter-e2e-test.yml
+++ b/.github/workflows/udp-exporter-e2e-test.yml
@@ -16,9 +16,9 @@ jobs:
         uses: actions/checkout@v5
 
       - name: Set up Java
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
         with:
-          java-version: '17'
+          java-version-file: .java-version
           distribution: 'temurin'
           cache: 'gradle'
 
diff --git a/.java-version b/.java-version
new file mode 100644
index 0000000000..aabe6ec390
--- /dev/null
+++ b/.java-version
@@ -0,0 +1 @@
+21