diff --git a/.github/workflows/ci-report.yml b/.github/workflows/ci-report.yml
index 384e4c697a6..e94eadf3ce9 100644
--- a/.github/workflows/ci-report.yml
+++ b/.github/workflows/ci-report.yml
@@ -53,10 +53,10 @@ jobs:
           #  Different branches might have different versions of Develocity, and we want to make sure
           #  that we publish with the one that we built the scan with in the first place.
           ref: ${{ steps.determine_branch_ref.outputs.original_branch_ref }}
-      - name: Set up Java 21
+      - name: Set up Java 25
         uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # 5.0.0
         with:
-          java-version: 21
+          java-version: 25
           distribution: temurin
       # https://github.com/actions/cache/blob/main/examples.md#java---maven
       - name: Cache local Maven repository
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9800d3a871e..ef62d9ea4ef 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -61,10 +61,10 @@ jobs:
       matrix:
         os:
           - {
-            name: "Linux JDK 21",
+            name: "Linux JDK 25",
             runs-on: 'ubuntu-latest',
             java: {
-              version: 21
+              version: 25
             },
             maven: {
               # Since we only start an Elasticsearch container on Linux we add the profile to enable container reuse here:
@@ -75,10 +75,10 @@ jobs:
           # so we can't run Elasticsearch tests.
           # See https://github.com/actions/runner-images/issues/1143#issuecomment-972929995
           - {
-            name: "Windows JDK 21",
+            name: "Windows JDK 25",
             runs-on: 'windows-latest',
             java: {
-              version: 21
+              version: 25
             },
             maven: {
               args: '-Dtest.elasticsearch.skip=true'
diff --git a/Jenkinsfile b/Jenkinsfile
index 9758a5e3825..2e956d634b3 100644
--- a/Jenkinsfile
+++ b/Jenkinsfile
@@ -133,7 +133,7 @@ import org.hibernate.jenkins.pipeline.helpers.alternative.AlternativeMultiMap
  *         pr: ...
  */
 
-@Field final String DEFAULT_JDK_TOOL = 'OpenJDK 21 Latest'
+@Field final String DEFAULT_JDK_TOOL = 'OpenJDK 25 Latest'
 @Field final String MAVEN_TOOL = 'Apache Maven 3.9'
 
 // Default node pattern, to be used for resource-intensive stages.
@@ -174,8 +174,7 @@ stage('Configure') {
 					new JdkBuildEnvironment(version: '17', testCompilerTool: 'OpenJDK 17 Latest',
 							condition: TestCondition.AFTER_MERGE),
 					new JdkBuildEnvironment(version: '21', testCompilerTool: 'OpenJDK 21 Latest',
-							condition: TestCondition.BEFORE_MERGE,
-							isDefault: true),
+							condition: TestCondition.AFTER_MERGE),
 					// We want to enable preview features when testing newer builds of OpenJDK:
 					// even if we don't use these features, just enabling them can cause side effects
 					// and it's useful to test that.
@@ -184,15 +183,10 @@ stage('Configure') {
 					// they require the use of -Dnet.bytebuddy.experimental=true.
 					// Make sure to remove that argument as soon as possible
 					// -- generally that requires upgrading bytebuddy in Hibernate ORM after the JDK goes GA.
-					new JdkBuildEnvironment(version: '23', testCompilerTool: 'OpenJDK 23 Latest',
-							testLauncherArgs: '--enable-preview',
-							condition: TestCondition.AFTER_MERGE),
-					new JdkBuildEnvironment(version: '24', testCompilerTool: 'OpenJDK 24 Latest',
-							testLauncherArgs: '--enable-preview -Dnet.bytebuddy.experimental=true',
-							condition: TestCondition.AFTER_MERGE),
 					new JdkBuildEnvironment(version: '25', testCompilerTool: 'OpenJDK 25 Latest',
 							testLauncherArgs: '--enable-preview -Dnet.bytebuddy.experimental=true',
-							condition: TestCondition.AFTER_MERGE),
+							condition: TestCondition.BEFORE_MERGE,
+							isDefault: true),
 					new JdkBuildEnvironment(version: '26', testCompilerTool: 'OpenJDK 26 Latest',
 							testLauncherArgs: '--enable-preview -Dnet.bytebuddy.experimental=true',
 							condition: TestCondition.AFTER_MERGE)
diff --git a/build/parents/build/pom.xml b/build/parents/build/pom.xml
index 9dd689b140a..3bfa6e104fa 100644
--- a/build/parents/build/pom.xml
+++ b/build/parents/build/pom.xml
@@ -1109,6 +1109,8 @@
                                     <bundledSignature>jdk-deprecated-20</bundledSignature>
                                     <bundledSignature>jdk-deprecated-21</bundledSignature>
                                     <bundledSignature>jdk-deprecated-22</bundledSignature>
+                                    <bundledSignature>jdk-deprecated-23</bundledSignature>
+                                    <bundledSignature>jdk-deprecated-24</bundledSignature>
 
                                     <bundledSignature>jdk-internal-17</bundledSignature>
                                     <bundledSignature>jdk-internal-18</bundledSignature>
@@ -1116,6 +1118,8 @@
                                     <bundledSignature>jdk-internal-20</bundledSignature>
                                     <bundledSignature>jdk-internal-21</bundledSignature>
                                     <bundledSignature>jdk-internal-22</bundledSignature>
+                                    <bundledSignature>jdk-internal-23</bundledSignature>
+                                    <bundledSignature>jdk-internal-24</bundledSignature>
                                 </bundledSignatures>
                                 <signaturesArtifacts>
                                     <signaturesArtifact>
@@ -1149,6 +1153,7 @@
                         <execution>
                             <id>verify-forbidden-apis-main-internal</id>
                             <configuration>
+                                <releaseVersion>24</releaseVersion>
                                 <bundledSignatures>
                                     <!-- This will automatically choose the right signatures based on 'targetVersion': -->
                                     <bundledSignature>jdk-unsafe</bundledSignature>
@@ -1175,6 +1180,7 @@
                         <execution>
                             <id>verify-forbidden-apis-tests</id>
                             <configuration>
+                                <testReleaseVersion>24</testReleaseVersion>
                                 <bundledSignatures>
                                     <!-- This will automatically choose the right signatures based on 'targetVersion': -->
                                     <bundledSignature>jdk-unsafe</bundledSignature>
diff --git a/ci/dependency-update/Jenkinsfile b/ci/dependency-update/Jenkinsfile
index 3791d555d6f..084eaf1b316 100644
--- a/ci/dependency-update/Jenkinsfile
+++ b/ci/dependency-update/Jenkinsfile
@@ -92,7 +92,7 @@ def pullContainerImages() {
 }
 
 def withMavenWorkspace(Closure body) {
-	def actualJdk = settings().testCompilerTool == null ? 'OpenJDK 21 Latest' : settings().testCompilerTool
+	def actualJdk = settings().testCompilerTool == null ? 'OpenJDK 25 Latest' : settings().testCompilerTool
 	withMaven(jdk: actualJdk, maven: 'Apache Maven 3.9',
 			mavenLocalRepo: env.WORKSPACE_TMP + '/.m2repository',
 			options: [
diff --git a/ci/nightly/Jenkinsfile b/ci/nightly/Jenkinsfile
index 36a986205c0..33172296b80 100644
--- a/ci/nightly/Jenkinsfile
+++ b/ci/nightly/Jenkinsfile
@@ -6,7 +6,7 @@
 @Library('hibernate-jenkins-pipeline-helpers') _
 
 def withMavenWorkspace(Closure body) {
-	withMaven(jdk: 'OpenJDK 21 Latest', maven: 'Apache Maven 3.9',
+	withMaven(jdk: 'OpenJDK 25 Latest', maven: 'Apache Maven 3.9',
 			mavenLocalRepo: env.WORKSPACE_TMP + '/.m2repository',
 			options: [
 					// Artifacts are not needed and take up disk space
diff --git a/ci/performance/elasticsearch/Jenkinsfile b/ci/performance/elasticsearch/Jenkinsfile
index af486fd3eef..b4ec8b5e4c3 100644
--- a/ci/performance/elasticsearch/Jenkinsfile
+++ b/ci/performance/elasticsearch/Jenkinsfile
@@ -12,7 +12,7 @@ import groovy.transform.Field
 import org.hibernate.jenkins.pipeline.helpers.job.JobHelper
 
 @Field final String MAVEN_TOOL = 'Apache Maven 3.9'
-@Field final String JDK_TOOL = 'OpenJDK 21 Latest'
+@Field final String JDK_TOOL = 'OpenJDK 25 Latest'
 
 // Performance node pattern, to be used for stages involving performance tests.
 @Field final String PERFORMANCE_NODE_PATTERN = 'Performance'
@@ -119,4 +119,4 @@ class EsAwsBuildEnvironment {
 	String getLockedResourcesLabel() {
 		"es-aws-${nameEmbeddableVersion}"
 	}
-}
\ No newline at end of file
+}
diff --git a/ci/performance/lucene/Jenkinsfile b/ci/performance/lucene/Jenkinsfile
index e216aeb47de..d1c3bfccb97 100644
--- a/ci/performance/lucene/Jenkinsfile
+++ b/ci/performance/lucene/Jenkinsfile
@@ -12,7 +12,7 @@ import groovy.transform.Field
 import org.hibernate.jenkins.pipeline.helpers.job.JobHelper
 
 @Field final String MAVEN_TOOL = 'Apache Maven 3.9'
-@Field final String JDK_TOOL = 'OpenJDK 21 Latest'
+@Field final String JDK_TOOL = 'OpenJDK 25 Latest'
 
 // Performance node pattern, to be used for stages involving performance tests.
 @Field final String PERFORMANCE_NODE_PATTERN = 'Performance'
diff --git a/ci/release/Jenkinsfile b/ci/release/Jenkinsfile
index a968a269ae5..842fdc611d5 100644
--- a/ci/release/Jenkinsfile
+++ b/ci/release/Jenkinsfile
@@ -13,7 +13,7 @@ pipeline {
 	}
 	tools {
 		maven 'Apache Maven 3.9'
-		jdk 'OpenJDK 21 Latest'
+		jdk 'OpenJDK 25 Latest'
 	}
 	options {
 		buildDiscarder logRotator(daysToKeepStr: '30', numToKeepStr: '10')
diff --git a/ci/snapshot-publish/Jenkinsfile b/ci/snapshot-publish/Jenkinsfile
index a0fa2036ffe..39d08238e79 100644
--- a/ci/snapshot-publish/Jenkinsfile
+++ b/ci/snapshot-publish/Jenkinsfile
@@ -18,7 +18,7 @@ pipeline {
 	}
 	tools {
 		maven 'Apache Maven 3.9'
-		jdk 'OpenJDK 21 Latest'
+		jdk 'OpenJDK 25 Latest'
 	}
 	options {
 		// Wait for 1h before publishing snapshots, in case there's more commits.
diff --git a/pom.xml b/pom.xml
index 582b8e7355c..084070f99ac 100644
--- a/pom.xml
+++ b/pom.xml
@@ -208,7 +208,7 @@
 
         <!-- JDK version required for the build; we target 17 but require at least 21 for the build -->
         <!-- Adjust contributing guide when changing the minimum required JDK version -->
-        <jdk.min.version>21</jdk.min.version>
+        <jdk.min.version>25</jdk.min.version>
         <!-- The lowest supported version of Java for applications using Hibernate Search -->
         <!-- Set statically, independently from the current JDK: we want our code to comply with this version -->
         <!-- Adjust the contributing guide when changing the release Java version -->
@@ -216,7 +216,7 @@
         <java-version.main.compiler.java_home>${java.home}</java-version.main.compiler.java_home>
         <java-version.main.compiler>${java-version.main.compiler.java_home}/bin/javac</java-version.main.compiler>
         <!-- The versions of Java documented as supported for applications using Hibernate Search -->
-        <java-version.main.compatible.expected.text>17, 21 or 23</java-version.main.compatible.expected.text>
+        <java-version.main.compatible.expected.text>17, 21 or 25</java-version.main.compatible.expected.text>
         <!-- The version of test bytecode, useful for testing compatibility with newer JDKs -->
         <!-- Set to the expected version of the JDK running Maven by default, but overridden on CI -->
         <java-version.test.release>${jdk.min.version}</java-version.test.release>
@@ -1347,27 +1347,11 @@
             </properties>
         </profile>
 
-        <profile>
-            <id>testWithJdk24</id>
-            <activation>
-                <property>
-                    <name>java-version.test.release</name>
-                    <value>24</value>
-                </property>
-            </activation>
-            <properties>
-                <!-- Spring Boot 3 isn't ready for JDK24 yet -->
-                <failsafe.spring.skip>true</failsafe.spring.skip>
-            </properties>
-        </profile>
-
         <profile>
             <id>testWithJdk25</id>
             <activation>
-                <property>
-                    <name>java-version.test.release</name>
-                    <value>25</value>
-                </property>
+                <!-- Hack to activate by default, except when explicitly disabled -->
+                <jdk>[25,)</jdk>
             </activation>
             <properties>
                 <!-- Spring Boot 3 isn't ready for JDK25 yet -->