diff --git a/bin/idea.sh b/bin/idea.sh
index eb37964f396..a184884b61a 100644
--- a/bin/idea.sh
+++ b/bin/idea.sh
@@ -125,7 +125,8 @@ if [ -d "$TOPLEVEL_DIR/.hg" ] ; then
     VCS_TYPE="hg4idea"
 fi
 
-if [ -d "$TOPLEVEL_DIR/.git" ] ; then
+# Git worktrees use a '.git' file rather than directory, so test both.
+if [ -d "$TOPLEVEL_DIR/.git" -o -f "$TOPLEVEL_DIR/.git" ] ; then
     VCS_TYPE="Git"
 fi
 
diff --git a/make/test/BuildMicrobenchmark.gmk b/make/test/BuildMicrobenchmark.gmk
index 44737179792..78601c2c698 100644
--- a/make/test/BuildMicrobenchmark.gmk
+++ b/make/test/BuildMicrobenchmark.gmk
@@ -92,6 +92,7 @@ $(eval $(call SetupJavaCompilation, BUILD_JDK_MICROBENCHMARK, \
         --add-exports java.base/jdk.internal.classfile.impl=ALL-UNNAMED \
         --add-exports java.base/jdk.internal.event=ALL-UNNAMED \
         --add-exports java.base/jdk.internal.foreign=ALL-UNNAMED \
+        --add-exports java.base/jdk.internal.jimage=ALL-UNNAMED \
         --add-exports java.base/jdk.internal.misc=ALL-UNNAMED \
         --add-exports java.base/jdk.internal.util=ALL-UNNAMED \
         --add-exports java.base/jdk.internal.value=ALL-UNNAMED \
diff --git a/src/java.base/share/classes/jdk/internal/jimage/ImageReader.java b/src/java.base/share/classes/jdk/internal/jimage/ImageReader.java
index f12c39f3e81..e062e1629ff 100644
--- a/src/java.base/share/classes/jdk/internal/jimage/ImageReader.java
+++ b/src/java.base/share/classes/jdk/internal/jimage/ImageReader.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2014, 2022, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2014, 2025, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -25,16 +25,14 @@
 package jdk.internal.jimage;
 
 import java.io.IOException;
-import java.io.InputStream;
-import java.io.UncheckedIOException;
 import java.nio.ByteBuffer;
 import java.nio.ByteOrder;
 import java.nio.IntBuffer;
 import java.nio.file.Files;
-import java.nio.file.attribute.BasicFileAttributes;
-import java.nio.file.attribute.FileTime;
 import java.nio.file.Path;
+import java.nio.file.attribute.BasicFileAttributes;
 import java.util.ArrayList;
+import java.util.Arrays;
 import java.util.Collections;
 import java.util.HashMap;
 import java.util.HashSet;
@@ -42,9 +40,36 @@
 import java.util.Map;
 import java.util.Objects;
 import java.util.Set;
-import java.util.function.Consumer;
+import java.util.function.Function;
+import java.util.function.Supplier;
+import java.util.stream.Stream;
 
 /**
+ * A view over the entries of a jimage file with a unified namespace suitable
+ * for file system use. The jimage entries (resources, module and package
+ * information) are mapped into a unified hierarchy of named nodes, which serve
+ * as the underlying structure for {@code JrtFileSystem} and other utilities.
+ *
+ * <p>Entries in jimage are expressed as one of three {@link Node} types;
+ * resource nodes, directory nodes and link nodes.
+ *
+ * <p>When remapping jimage entries, jimage location names (e.g. {@code
+ * "/java.base/java/lang/Integer.class"}) are prefixed with {@code "/modules"}
+ * to form the names of resource nodes. This aligns with the naming of module
+ * entries in jimage (e.g. "/modules/java.base/java/lang"), which appear as
+ * directory nodes in {@code ImageReader}.
+ *
+ * <p>Package entries (e.g. {@code "/packages/java.lang"} appear as directory
+ * nodes containing link nodes, which resolve back to the root directory of the
+ * module in which that package exists (e.g. {@code "/modules/java.base"}).
+ * Unlike other nodes, the jimage file does not contain explicit entries for
+ * link nodes, and their existence is derived only from the contents of the
+ * parent directory.
+ *
+ * <p>While similar to {@code BasicImageReader}, this class is not a conceptual
+ * subtype of it, and deliberately hides types such as {@code ImageLocation} to
+ * give a focused API based only on nodes.
+ *
  * @implNote This class needs to maintain JDK 8 source compatibility.
  *
  * It is used internally in the JDK to implement jimage/jrtfs access,
@@ -60,6 +85,10 @@ private ImageReader(SharedImageReader reader) {
         this.reader = reader;
     }
 
+    /**
+     * Opens an image reader for a jimage file at the specified path, using the
+     * given byte order.
+     */
     public static ImageReader open(Path imagePath, ByteOrder byteOrder) throws IOException {
         Objects.requireNonNull(imagePath);
         Objects.requireNonNull(byteOrder);
@@ -67,6 +96,10 @@ public static ImageReader open(Path imagePath, ByteOrder byteOrder) throws IOExc
         return SharedImageReader.open(imagePath, byteOrder);
     }
 
+    /**
+     * Opens an image reader for a jimage file at the specified path, using the
+     * platform native byte order.
+     */
     public static ImageReader open(Path imagePath) throws IOException {
         return open(imagePath, ByteOrder.nativeOrder());
     }
@@ -92,146 +125,152 @@ private void requireOpen() {
         }
     }
 
-    // directory management interface
-    public Directory getRootDirectory() throws IOException {
-        ensureOpen();
-        return reader.getRootDirectory();
-    }
-
-
+    /**
+     * Finds the node with the given name.
+     *
+     * @param name a node name of the form {@code "/modules/<module>/...} or
+     *     {@code "/packages/<package>/...}.
+     * @return a node representing a resource, directory or symbolic link.
+     */
     public Node findNode(String name) throws IOException {
         ensureOpen();
         return reader.findNode(name);
     }
 
-    public byte[] getResource(Node node) throws IOException {
+    /**
+     * Returns a resource node in the given module, or null if no resource of
+     * that name exists.
+     *
+     * <p>This is equivalent to:
+     * <pre>{@code
+     * findNode("/modules/" + moduleName + "/" + resourcePath)
+     * }</pre>
+     * but more performant, and returns {@code null} for directories.
+     *
+     * @param moduleName The module name of the requested resource.
+     * @param resourcePath Trailing module-relative resource path, not starting
+     *     with {@code '/'}.
+     */
+    public Node findResourceNode(String moduleName, String resourcePath)
+            throws IOException {
         ensureOpen();
-        return reader.getResource(node);
-    }
-
-    public byte[] getResource(Resource rs) throws IOException {
+        return reader.findResourceNode(moduleName, resourcePath);
+    }
+
+    /**
+     * Returns whether a resource exists in the given module.
+     *
+     * <p>This is equivalent to:
+     * <pre>{@code
+     * findResourceNode(moduleName, resourcePath) != null
+     * }</pre>
+     * but more performant, and will not create or cache new nodes.
+     *
+     * @param moduleName The module name of the resource being tested for.
+     * @param resourcePath Trailing module-relative resource path, not starting
+     *     with {@code '/'}.
+     */
+    public boolean containsResource(String moduleName, String resourcePath)
+            throws IOException {
         ensureOpen();
-        return reader.getResource(rs);
+        return reader.containsResource(moduleName, resourcePath);
     }
 
-    public ImageHeader getHeader() {
-        requireOpen();
-        return reader.getHeader();
+    /**
+     * Returns a copy of the content of a resource node. The buffer returned by
+     * this method is not cached by the node, and each call returns a new array
+     * instance.
+     *
+     * @throws IOException if the content cannot be returned (including if the
+     * given node is not a resource node).
+     */
+    public byte[] getResource(Node node) throws IOException {
+        ensureOpen();
+        return reader.getResource(node);
     }
 
+    /**
+     * Releases a (possibly cached) {@link ByteBuffer} obtained via
+     * {@link #getResourceBuffer(Node)}.
+     *
+     * <p>Note that no testing is performed to check whether the buffer about
+     * to be released actually came from a call to {@code getResourceBuffer()}.
+     */
     public static void releaseByteBuffer(ByteBuffer buffer) {
         BasicImageReader.releaseByteBuffer(buffer);
     }
 
-    public String getName() {
-        requireOpen();
-        return reader.getName();
-    }
-
-    public ByteOrder getByteOrder() {
-        requireOpen();
-        return reader.getByteOrder();
-    }
-
-    public Path getImagePath() {
-        requireOpen();
-        return reader.getImagePath();
-    }
-
-    public ImageStringsReader getStrings() {
+    /**
+     * Returns the content of a resource node in a possibly cached byte buffer.
+     * Callers of this method must call {@link #releaseByteBuffer(ByteBuffer)}
+     * when they are finished with it.
+     */
+    public ByteBuffer getResourceBuffer(Node node) {
         requireOpen();
-        return reader.getStrings();
-    }
-
-    public ImageLocation findLocation(String mn, String rn) {
-        requireOpen();
-        return reader.findLocation(mn, rn);
-    }
-
-    public boolean verifyLocation(String mn, String rn) {
-        requireOpen();
-        return reader.verifyLocation(mn, rn);
-    }
-
-    public ImageLocation findLocation(String name) {
-        requireOpen();
-        return reader.findLocation(name);
-    }
-
-    public String[] getEntryNames() {
-        requireOpen();
-        return reader.getEntryNames();
-    }
-
-    public String[] getModuleNames() {
-        requireOpen();
-        int off = "/modules/".length();
-        return reader.findNode("/modules")
-                     .getChildren()
-                     .stream()
-                     .map(Node::getNameString)
-                     .map(s -> s.substring(off, s.length()))
-                     .toArray(String[]::new);
-    }
-
-    public long[] getAttributes(int offset) {
-        requireOpen();
-        return reader.getAttributes(offset);
-    }
-
-    public String getString(int offset) {
-        requireOpen();
-        return reader.getString(offset);
-    }
-
-    public byte[] getResource(String name) {
-        requireOpen();
-        return reader.getResource(name);
-    }
-
-    public byte[] getResource(ImageLocation loc) {
-        requireOpen();
-        return reader.getResource(loc);
-    }
-
-    public ByteBuffer getResourceBuffer(ImageLocation loc) {
-        requireOpen();
-        return reader.getResourceBuffer(loc);
-    }
-
-    public InputStream getResourceStream(ImageLocation loc) {
-        requireOpen();
-        return reader.getResourceStream(loc);
+        if (!node.isResource()) {
+            throw new IllegalArgumentException("Not a resource node: " + node);
+        }
+        return reader.getResourceBuffer(node.getLocation());
     }
 
     private static final class SharedImageReader extends BasicImageReader {
-        static final int SIZE_OF_OFFSET = Integer.BYTES;
-
-        static final Map<Path, SharedImageReader> OPEN_FILES = new HashMap<>();
+        private static final Map<Path, SharedImageReader> OPEN_FILES = new HashMap<>();
+        private static final String MODULES_ROOT = "/modules";
+        private static final String PACKAGES_ROOT = "/packages";
+        // There are >30,000 nodes in a complete jimage tree, and even relatively
+        // common tasks (e.g. starting up javac) load somewhere in the region of
+        // 1000 classes. Thus, an initial capacity of 2000 is a reasonable guess.
+        private static final int INITIAL_NODE_CACHE_CAPACITY = 2000;
 
         // List of openers for this shared image.
-        final Set<ImageReader> openers;
+        private final Set<ImageReader> openers = new HashSet<>();
 
-        // attributes of the .jimage file. jimage file does not contain
+        // Attributes of the jimage file. The jimage file does not contain
         // attributes for the individual resources (yet). We use attributes
         // of the jimage file itself (creation, modification, access times).
-        // Iniitalized lazily, see {@link #imageFileAttributes()}.
-        BasicFileAttributes imageFileAttributes;
+        private final BasicFileAttributes imageFileAttributes;
 
-        // directory management implementation
-        final HashMap<String, Node> nodes;
-        volatile Directory rootDir;
-
-        Directory packagesDir;
-        Directory modulesDir;
+        // Cache of all user visible nodes, guarded by synchronizing 'this' instance.
+        private final Map<String, Node> nodes;
+        // Used to classify ImageLocation instances without string comparison.
+        private final int modulesStringOffset;
+        private final int packagesStringOffset;
 
         private SharedImageReader(Path imagePath, ByteOrder byteOrder) throws IOException {
             super(imagePath, byteOrder);
-            this.openers = new HashSet<>();
-            this.nodes = new HashMap<>();
+            this.imageFileAttributes = Files.readAttributes(imagePath, BasicFileAttributes.class);
+            this.nodes = new HashMap<>(INITIAL_NODE_CACHE_CAPACITY);
+            // Pick stable jimage names from which to extract string offsets (we cannot
+            // use "/modules" or "/packages", since those have a module offset of zero).
+            this.modulesStringOffset = getModuleOffset("/modules/java.base");
+            this.packagesStringOffset = getModuleOffset("/packages/java.lang");
+
+            // Node creation is very lazy, so we can just make the top-level directories
+            // now without the risk of triggering the building of lots of other nodes.
+            Directory packages = newDirectory(PACKAGES_ROOT);
+            nodes.put(packages.getName(), packages);
+            Directory modules = newDirectory(MODULES_ROOT);
+            nodes.put(modules.getName(), modules);
+
+            Directory root = newDirectory("/");
+            root.setChildren(Arrays.asList(packages, modules));
+            nodes.put(root.getName(), root);
+        }
+
+        /**
+         * Returns the offset of the string denoting the leading "module" segment in
+         * the given path (e.g. {@code <module>/<path>}). We can't just pass in the
+         * {@code /<module>} string here because that has a module offset of zero.
+         */
+        private int getModuleOffset(String path) {
+            ImageLocation location = findLocation(path);
+            assert location != null : "Cannot find expected jimage location: " + path;
+            int offset = location.getModuleOffset();
+            assert offset != 0 : "Invalid module offset for jimage location: " + path;
+            return offset;
         }
 
-        public static ImageReader open(Path imagePath, ByteOrder byteOrder) throws IOException {
+        private static ImageReader open(Path imagePath, ByteOrder byteOrder) throws IOException {
             Objects.requireNonNull(imagePath);
             Objects.requireNonNull(byteOrder);
 
@@ -264,7 +303,6 @@ public void close(ImageReader image) throws IOException {
                 if (openers.isEmpty()) {
                     close();
                     nodes.clear();
-                    rootDir = null;
 
                     if (!OPEN_FILES.remove(this.getImagePath(), this)) {
                         throw new IOException("image file not found in open list");
@@ -273,448 +311,461 @@ public void close(ImageReader image) throws IOException {
             }
         }
 
-        void addOpener(ImageReader reader) {
-            synchronized (OPEN_FILES) {
-                openers.add(reader);
-            }
-        }
-
-        boolean removeOpener(ImageReader reader) {
-            synchronized (OPEN_FILES) {
-                return openers.remove(reader);
+        /**
+         * Returns a node with the given name, or null if no resource or directory of
+         * that name exists.
+         *
+         * <p>Note that there is no reentrant calling back to this method from within
+         * the node handling code.
+         *
+         * @param name an absolute, {@code /}-separated path string, prefixed with either
+         *     "/modules" or "/packages".
+         */
+        synchronized Node findNode(String name) {
+            Node node = nodes.get(name);
+            if (node == null) {
+                // We cannot get the root paths ("/modules" or "/packages") here
+                // because those nodes are already in the nodes cache.
+                if (name.startsWith(MODULES_ROOT + "/")) {
+                    // This may perform two lookups, one for a directory (in
+                    // "/modules/...") and one for a non-prefixed resource
+                    // (with "/modules" removed).
+                    node = buildModulesNode(name);
+                } else if (name.startsWith(PACKAGES_ROOT + "/")) {
+                    node = buildPackagesNode(name);
+                }
+                if (node != null) {
+                    nodes.put(node.getName(), node);
+                }
+            } else if (!node.isCompleted()) {
+                // Only directories can be incomplete.
+                assert node instanceof Directory : "Invalid incomplete node: " + node;
+                completeDirectory((Directory) node);
             }
-        }
-
-        // directory management interface
-        Directory getRootDirectory() {
-            return buildRootDirectory();
+            assert node == null || node.isCompleted() : "Incomplete node: " + node;
+            return node;
         }
 
         /**
-         * Lazily build a node from a name.
+         * Returns a resource node in the given module, or null if no resource of
+         * that name exists.
+         *
+         * <p>Note that there is no reentrant calling back to this method from within
+         * the node handling code.
          */
-        synchronized Node buildNode(String name) {
-            Node n;
-            boolean isPackages = name.startsWith("/packages");
-            boolean isModules = !isPackages && name.startsWith("/modules");
-
-            if (!(isModules || isPackages)) {
-                return null;
+        Node findResourceNode(String moduleName, String resourcePath) {
+            // Unlike findNode(), this method makes only one lookup in the
+            // underlying jimage, but can only reliably return resource nodes.
+            if (moduleName.indexOf('/') >= 0) {
+                throw new IllegalArgumentException("invalid module name: " + moduleName);
             }
-
-            ImageLocation loc = findLocation(name);
-
-            if (loc != null) { // A sub tree node
-                if (isPackages) {
-                    n = handlePackages(name, loc);
-                } else { // modules sub tree
-                    n = handleModulesSubTree(name, loc);
-                }
-            } else { // Asking for a resource? /modules/java.base/java/lang/Object.class
-                if (isModules) {
-                    n = handleResource(name);
+            String nodeName = MODULES_ROOT + "/" + moduleName + "/" + resourcePath;
+            // Synchronize as tightly as possible to reduce locking contention.
+            synchronized (this) {
+                Node node = nodes.get(nodeName);
+                if (node == null) {
+                    ImageLocation loc = findLocation(moduleName, resourcePath);
+                    if (loc != null && isResource(loc)) {
+                        node = newResource(nodeName, loc);
+                        nodes.put(node.getName(), node);
+                    }
+                    return node;
                 } else {
-                    // Possibly ask for /packages/java.lang/java.base
-                    // although /packages/java.base not created
-                    n = handleModuleLink(name);
+                    return node.isResource() ? node : null;
                 }
             }
-            return n;
-        }
-
-        synchronized Directory buildRootDirectory() {
-            Directory root = rootDir; // volatile read
-            if (root != null) {
-                return root;
-            }
-
-            root = newDirectory(null, "/");
-            root.setIsRootDir();
-
-            // /packages dir
-            packagesDir = newDirectory(root, "/packages");
-            packagesDir.setIsPackagesDir();
-
-            // /modules dir
-            modulesDir = newDirectory(root, "/modules");
-            modulesDir.setIsModulesDir();
-
-            root.setCompleted(true);
-            return rootDir = root;
         }
 
         /**
-         * To visit sub tree resources.
+         * Returns whether a resource exists in the given module.
+         *
+         * <p>This method is expected to be called frequently for resources
+         * which do not exist in the given module (e.g. as part of classpath
+         * search). As such, it skips checking the nodes cache and only checks
+         * for an entry in the jimage file, as this is faster if the resource
+         * is not present. This also means it doesn't need synchronization.
          */
-        interface LocationVisitor {
-            void visit(ImageLocation loc);
-        }
-
-        void visitLocation(ImageLocation loc, LocationVisitor visitor) {
-            byte[] offsets = getResource(loc);
-            ByteBuffer buffer = ByteBuffer.wrap(offsets);
-            buffer.order(getByteOrder());
-            IntBuffer intBuffer = buffer.asIntBuffer();
-            for (int i = 0; i < offsets.length / SIZE_OF_OFFSET; i++) {
-                int offset = intBuffer.get(i);
-                ImageLocation pkgLoc = getLocation(offset);
-                visitor.visit(pkgLoc);
+        boolean containsResource(String moduleName, String resourcePath) {
+            if (moduleName.indexOf('/') >= 0) {
+                throw new IllegalArgumentException("invalid module name: " + moduleName);
             }
+            // If the given module name is 'modules', then 'isResource()'
+            // returns false to prevent false positives.
+            ImageLocation loc = findLocation(moduleName, resourcePath);
+            return loc != null && isResource(loc);
         }
 
-        void visitPackageLocation(ImageLocation loc) {
-            // Retrieve package name
-            String pkgName = getBaseExt(loc);
-            // Content is array of offsets in Strings table
-            byte[] stringsOffsets = getResource(loc);
-            ByteBuffer buffer = ByteBuffer.wrap(stringsOffsets);
-            buffer.order(getByteOrder());
-            IntBuffer intBuffer = buffer.asIntBuffer();
-            // For each module, create a link node.
-            for (int i = 0; i < stringsOffsets.length / SIZE_OF_OFFSET; i++) {
-                // skip empty state, useless.
-                intBuffer.get(i);
-                i++;
-                int offset = intBuffer.get(i);
-                String moduleName = getString(offset);
-                Node targetNode = findNode("/modules/" + moduleName);
-                if (targetNode != null) {
-                    String pkgDirName = packagesDir.getName() + "/" + pkgName;
-                    Directory pkgDir = (Directory) nodes.get(pkgDirName);
-                    newLinkNode(pkgDir, pkgDir.getName() + "/" + moduleName, targetNode);
-                }
+        /**
+         * Builds a node in the "/modules/..." namespace.
+         *
+         * <p>Called by {@link #findNode(String)} if a {@code /modules/...} node
+         * is not present in the cache.
+         */
+        private Node buildModulesNode(String name) {
+            assert name.startsWith(MODULES_ROOT + "/") : "Invalid module node name: " + name;
+            // Returns null for non-directory resources, since the jimage name does not
+            // start with "/modules" (e.g. "/java.base/java/lang/Object.class").
+            ImageLocation loc = findLocation(name);
+            if (loc != null) {
+                assert name.equals(loc.getFullName()) : "Mismatched location for directory: " + name;
+                assert isModulesSubdirectory(loc) : "Invalid modules directory: " + name;
+                return completeModuleDirectory(newDirectory(name), loc);
             }
+            // Now try the non-prefixed resource name, but be careful to avoid false
+            // positives for names like "/modules/modules/xxx" which could return a
+            // location of a directory entry.
+            loc = findLocation(name.substring(MODULES_ROOT.length()));
+            return loc != null && isResource(loc) ? newResource(name, loc) : null;
         }
 
-        Node handlePackages(String name, ImageLocation loc) {
-            long size = loc.getUncompressedSize();
-            Node n = null;
-            // Only possibilities are /packages, /packages/package/module
-            if (name.equals("/packages")) {
-                visitLocation(loc, (childloc) -> {
-                    findNode(childloc.getFullName());
-                });
-                packagesDir.setCompleted(true);
-                n = packagesDir;
+        /**
+         * Builds a node in the "/packages/..." namespace.
+         *
+         * <p>Called by {@link #findNode(String)} if a {@code /packages/...} node
+         * is not present in the cache.
+         */
+        private Node buildPackagesNode(String name) {
+            // There are only locations for the root "/packages" or "/packages/xxx"
+            // directories, but not the symbolic links below them (the links can be
+            // entirely derived from the name information in the parent directory).
+            // However, unlike resources this means that we do not have a constant
+            // time lookup for link nodes when creating them.
+            int packageStart = PACKAGES_ROOT.length() + 1;
+            int packageEnd = name.indexOf('/', packageStart);
+            if (packageEnd == -1) {
+                ImageLocation loc = findLocation(name);
+                return loc != null ? completePackageDirectory(newDirectory(name), loc) : null;
             } else {
-                if (size != 0) { // children are offsets to module in StringsTable
-                    String pkgName = getBaseExt(loc);
-                    Directory pkgDir = newDirectory(packagesDir, packagesDir.getName() + "/" + pkgName);
-                    visitPackageLocation(loc);
-                    pkgDir.setCompleted(true);
-                    n = pkgDir;
-                } else { // Link to module
-                    String pkgName = loc.getParent();
-                    String modName = getBaseExt(loc);
-                    Node targetNode = findNode("/modules/" + modName);
-                    if (targetNode != null) {
-                        String pkgDirName = packagesDir.getName() + "/" + pkgName;
-                        Directory pkgDir = (Directory) nodes.get(pkgDirName);
-                        Node linkNode = newLinkNode(pkgDir, pkgDir.getName() + "/" + modName, targetNode);
-                        n = linkNode;
-                    }
-                }
-            }
-            return n;
-        }
-
-        // Asking for /packages/package/module although
-        // /packages/<pkg>/ not yet created, need to create it
-        // prior to return the link to module node.
-        Node handleModuleLink(String name) {
-            // eg: unresolved /packages/package/module
-            // Build /packages/package node
-            Node ret = null;
-            String radical = "/packages/";
-            String path = name;
-            if (path.startsWith(radical)) {
-                int start = radical.length();
-                int pkgEnd = path.indexOf('/', start);
-                if (pkgEnd != -1) {
-                    String pkg = path.substring(start, pkgEnd);
-                    String pkgPath = radical + pkg;
-                    Node n = findNode(pkgPath);
-                    // If not found means that this is a symbolic link such as:
-                    // /packages/java.util/java.base/java/util/Vector.class
-                    // and will be done by a retry of the filesystem
-                    for (Node child : n.getChildren()) {
-                        if (child.name.equals(name)) {
-                            ret = child;
-                            break;
-                        }
+                // We cannot assume that the parent directory exists for a link node, since
+                // the given name is untrusted and could reference a non-existent link.
+                // However, if the parent directory is present, we can conclude that the
+                // given name was not a valid link (or else it would already be cached).
+                String dirName = name.substring(0, packageEnd);
+                if (!nodes.containsKey(dirName)) {
+                    ImageLocation loc = findLocation(dirName);
+                    // If the parent location doesn't exist, the link node cannot exist.
+                    if (loc != null) {
+                        nodes.put(dirName, completePackageDirectory(newDirectory(dirName), loc));
+                        // When the parent is created its child nodes are created and cached,
+                        // but this can still return null if given name wasn't a valid link.
+                        return nodes.get(name);
                     }
                 }
             }
-            return ret;
-        }
-
-        Node handleModulesSubTree(String name, ImageLocation loc) {
-            Node n;
-            assert (name.equals(loc.getFullName()));
-            Directory dir = makeDirectories(name);
-            visitLocation(loc, (childloc) -> {
-                String path = childloc.getFullName();
-                if (path.startsWith("/modules")) { // a package
-                    makeDirectories(path);
-                } else { // a resource
-                    makeDirectories(childloc.buildName(true, true, false));
-                    // if we have already created a resource for this name previously, then don't
-                    // recreate it
-                    if (!nodes.containsKey(childloc.getFullName(true))) {
-                        newResource(dir, childloc);
-                    }
-                }
-            });
-            dir.setCompleted(true);
-            n = dir;
-            return n;
+            return null;
         }
 
-        Node handleResource(String name) {
-            Node n = null;
-            if (!name.startsWith("/modules/")) {
-                return null;
-            }
-            // Make sure that the thing that follows "/modules/" is a module name.
-            int moduleEndIndex = name.indexOf('/', "/modules/".length());
-            if (moduleEndIndex == -1) {
-                return null;
-            }
-            ImageLocation moduleLoc = findLocation(name.substring(0, moduleEndIndex));
-            if (moduleLoc == null || moduleLoc.getModuleOffset() == 0) {
-                return null;
-            }
-
-            String locationPath = name.substring("/modules".length());
-            ImageLocation resourceLoc = findLocation(locationPath);
-            if (resourceLoc != null) {
-                Directory dir = makeDirectories(resourceLoc.buildName(true, true, false));
-                Resource res = newResource(dir, resourceLoc);
-                n = res;
+        /** Completes a directory by ensuring its child list is populated correctly. */
+        private void completeDirectory(Directory dir) {
+            String name = dir.getName();
+            // Since the node exists, we can assert that its name starts with
+            // either "/modules" or "/packages", making differentiation easy.
+            // It also means that the name is valid, so it must yield a location.
+            assert name.startsWith(MODULES_ROOT) || name.startsWith(PACKAGES_ROOT);
+            ImageLocation loc = findLocation(name);
+            assert loc != null && name.equals(loc.getFullName()) : "Invalid location for name: " + name;
+            // We cannot use 'isXxxSubdirectory()' methods here since we could
+            // be given a top-level directory (for which that test doesn't work).
+            // The string MUST start "/modules" or "/packages" here.
+            if (name.charAt(1) == 'm') {
+                completeModuleDirectory(dir, loc);
+            } else {
+                completePackageDirectory(dir, loc);
             }
-            return n;
+            assert dir.isCompleted() : "Directory must be complete by now: " + dir;
         }
 
-        String getBaseExt(ImageLocation loc) {
-            String base = loc.getBase();
-            String ext = loc.getExtension();
-            if (ext != null && !ext.isEmpty()) {
-                base = base + "." + ext;
-            }
-            return base;
+        /**
+         * Completes a modules directory by setting the list of child nodes.
+         *
+         * <p>The given directory can be the top level {@code /modules} directory,
+         * so it is NOT safe to use {@code isModulesSubdirectory(loc)} here.
+         */
+        private Directory completeModuleDirectory(Directory dir, ImageLocation loc) {
+            assert dir.getName().equals(loc.getFullName()) : "Mismatched location for directory: " + dir;
+            List<Node> children = createChildNodes(loc, childLoc -> {
+                if (isModulesSubdirectory(childLoc)) {
+                    return nodes.computeIfAbsent(childLoc.getFullName(), this::newDirectory);
+                } else {
+                    // Add "/modules" prefix to image location paths to get node names.
+                    String resourceName = childLoc.getFullName(true);
+                    return nodes.computeIfAbsent(resourceName, n -> newResource(n, childLoc));
+                }
+            });
+            dir.setChildren(children);
+            return dir;
         }
 
-        synchronized Node findNode(String name) {
-            buildRootDirectory();
-            Node n = nodes.get(name);
-            if (n == null || !n.isCompleted()) {
-                n = buildNode(name);
+        /**
+         * Completes a package directory by setting the list of child nodes.
+         *
+         * <p>The given directory can be the top level {@code /packages} directory,
+         * so it is NOT safe to use {@code isPackagesSubdirectory(loc)} here.
+         */
+        private Directory completePackageDirectory(Directory dir, ImageLocation loc) {
+            assert dir.getName().equals(loc.getFullName()) : "Mismatched location for directory: " + dir;
+            // The only directories in the "/packages" namespace are "/packages" or
+            // "/packages/<package>". However, unlike "/modules" directories, the
+            // location offsets mean different things.
+            List<Node> children;
+            if (dir.getName().equals(PACKAGES_ROOT)) {
+                // Top-level directory just contains a list of subdirectories.
+                children = createChildNodes(loc, c -> nodes.computeIfAbsent(c.getFullName(), this::newDirectory));
+            } else {
+                // A package directory's content is array of offset PAIRS in the
+                // Strings table, but we only need the 2nd value of each pair.
+                IntBuffer intBuffer = getOffsetBuffer(loc);
+                int offsetCount = intBuffer.capacity();
+                assert (offsetCount & 0x1) == 0 : "Offset count must be even: " + offsetCount;
+                children = new ArrayList<>(offsetCount / 2);
+                // Iterate the 2nd offset in each pair (odd indices).
+                for (int i = 1; i < offsetCount; i += 2) {
+                    String moduleName = getString(intBuffer.get(i));
+                    children.add(nodes.computeIfAbsent(
+                            dir.getName() + "/" + moduleName,
+                            n -> newLinkNode(n, MODULES_ROOT + "/" + moduleName)));
+                }
             }
-            return n;
+            // This only happens once and "completes" the directory.
+            dir.setChildren(children);
+            return dir;
         }
 
         /**
-         * Returns the file attributes of the image file.
+         * Creates the list of child nodes for a {@code Directory} based on a given
+         *
+         * <p>Note: This cannot be used for package subdirectories as they have
+         * child offsets stored differently to other directories.
          */
-        BasicFileAttributes imageFileAttributes() {
-            BasicFileAttributes attrs = imageFileAttributes;
-            if (attrs == null) {
-                try {
-                    Path file = getImagePath();
-                    attrs = Files.readAttributes(file, BasicFileAttributes.class);
-                } catch (IOException ioe) {
-                    throw new UncheckedIOException(ioe);
-                }
-                imageFileAttributes = attrs;
+        private List<Node> createChildNodes(ImageLocation loc, Function<ImageLocation, Node> newChildFn) {
+            IntBuffer offsets = getOffsetBuffer(loc);
+            int childCount = offsets.capacity();
+            List<Node> children = new ArrayList<>(childCount);
+            for (int i = 0; i < childCount; i++) {
+                children.add(newChildFn.apply(getLocation(offsets.get(i))));
             }
-            return attrs;
+            return children;
         }
 
-        Directory newDirectory(Directory parent, String name) {
-            Directory dir = Directory.create(parent, name, imageFileAttributes());
-            nodes.put(dir.getName(), dir);
-            return dir;
+        /** Helper to extract the integer offset buffer from a directory location. */
+        private IntBuffer getOffsetBuffer(ImageLocation dir) {
+            assert !isResource(dir) : "Not a directory: " + dir.getFullName();
+            byte[] offsets = getResource(dir);
+            ByteBuffer buffer = ByteBuffer.wrap(offsets);
+            buffer.order(getByteOrder());
+            return buffer.asIntBuffer();
         }
 
-        Resource newResource(Directory parent, ImageLocation loc) {
-            Resource res = Resource.create(parent, loc, imageFileAttributes());
-            nodes.put(res.getName(), res);
-            return res;
+        /**
+         * Efficiently determines if an image location is a resource.
+         *
+         * <p>A resource must have a valid module associated with it, so its
+         * module offset must be non-zero, and not equal to the offsets for
+         * "/modules/..." or "/packages/..." entries.
+         */
+        private boolean isResource(ImageLocation loc) {
+            int moduleOffset = loc.getModuleOffset();
+            return moduleOffset != 0
+                    && moduleOffset != modulesStringOffset
+                    && moduleOffset != packagesStringOffset;
         }
 
-        LinkNode newLinkNode(Directory dir, String name, Node link) {
-            LinkNode linkNode = LinkNode.create(dir, name, link);
-            nodes.put(linkNode.getName(), linkNode);
-            return linkNode;
+        /**
+         * Determines if an image location is a directory in the {@code /modules}
+         * namespace (if so, the location name is the node name).
+         *
+         * <p>In jimage, every {@code ImageLocation} under {@code /modules/} is a
+         * directory and has the same value for {@code getModule()}, and {@code
+         * getModuleOffset()}.
+         */
+        private boolean isModulesSubdirectory(ImageLocation loc) {
+            return loc.getModuleOffset() == modulesStringOffset;
         }
 
-        Directory makeDirectories(String parent) {
-            Directory last = rootDir;
-            for (int offset = parent.indexOf('/', 1);
-                    offset != -1;
-                    offset = parent.indexOf('/', offset + 1)) {
-                String dir = parent.substring(0, offset);
-                last = makeDirectory(dir, last);
-            }
-            return makeDirectory(parent, last);
+        /**
+         * Creates an "incomplete" directory node with no child nodes set.
+         * Directories need to be "completed" before they are returned by
+         * {@link #findNode(String)}.
+         */
+        private Directory newDirectory(String name) {
+            return new Directory(name, imageFileAttributes);
+        }
 
+        /**
+         * Creates a new resource from an image location. This is the only case
+         * where the image location name does not match the requested node name.
+         * In image files, resource locations are NOT prefixed by {@code /modules}.
+         */
+        private Resource newResource(String name, ImageLocation loc) {
+            assert name.equals(loc.getFullName(true)) : "Mismatched location for resource: " + name;
+            return new Resource(name, loc, imageFileAttributes);
         }
 
-        Directory makeDirectory(String dir, Directory last) {
-            Directory nextDir = (Directory) nodes.get(dir);
-            if (nextDir == null) {
-                nextDir = newDirectory(last, dir);
-            }
-            return nextDir;
+        /**
+         * Creates a new link node pointing at the given target name.
+         *
+         * <p>Note that target node is resolved each time {@code resolve()} is called,
+         * so if a link node is retained after its reader is closed, it will fail.
+         */
+        private LinkNode newLinkNode(String name, String targetName) {
+            return new LinkNode(name, () -> findNode(targetName), imageFileAttributes);
         }
 
-        byte[] getResource(Node node) throws IOException {
+        /** Returns the content of a resource node. */
+        private byte[] getResource(Node node) throws IOException {
+            // We could have been given a non-resource node here.
             if (node.isResource()) {
                 return super.getResource(node.getLocation());
             }
             throw new IOException("Not a resource: " + node);
         }
-
-        byte[] getResource(Resource rs) throws IOException {
-            return super.getResource(rs.getLocation());
-        }
     }
 
-    // jimage file does not store directory structure. We build nodes
-    // using the "path" strings found in the jimage file.
-    // Node can be a directory or a resource
+    /**
+     * A directory, resource or symbolic link.
+     *
+     * <h3 id="node_equality">Node Equality</h3>
+     *
+     * Nodes are identified solely by their name, and it is not valid to attempt
+     * to compare nodes from different reader instances. Different readers may
+     * produce nodes with the same names, but different contents.
+     *
+     * <p>Furthermore, since a {@link ImageReader} provides "perfect" caching of
+     * nodes, equality of nodes from the same reader is equivalent to instance
+     * identity.
+     */
     public abstract static class Node {
-        private static final int ROOT_DIR = 0b0000_0000_0000_0001;
-        private static final int PACKAGES_DIR = 0b0000_0000_0000_0010;
-        private static final int MODULES_DIR = 0b0000_0000_0000_0100;
-
-        private int flags;
         private final String name;
         private final BasicFileAttributes fileAttrs;
-        private boolean completed;
-
-        protected Node(String name, BasicFileAttributes fileAttrs) {
-            this.name = Objects.requireNonNull(name);
-            this.fileAttrs = Objects.requireNonNull(fileAttrs);
-        }
 
         /**
-         * A node is completed when all its direct children have been built.
+         * Creates an abstract {@code Node}, which is either a resource, directory
+         * or symbolic link.
          *
-         * @return
+         * <p>This constructor is only non-private so it can be used by the
+         * {@code ExplodedImage} class, and must not be used otherwise.
          */
-        public boolean isCompleted() {
-            return completed;
-        }
-
-        public void setCompleted(boolean completed) {
-            this.completed = completed;
-        }
-
-        public final void setIsRootDir() {
-            flags |= ROOT_DIR;
-        }
-
-        public final boolean isRootDir() {
-            return (flags & ROOT_DIR) != 0;
-        }
-
-        public final void setIsPackagesDir() {
-            flags |= PACKAGES_DIR;
-        }
-
-        public final boolean isPackagesDir() {
-            return (flags & PACKAGES_DIR) != 0;
+        protected Node(String name, BasicFileAttributes fileAttrs) {
+            this.name = Objects.requireNonNull(name);
+            this.fileAttrs = Objects.requireNonNull(fileAttrs);
         }
 
-        public final void setIsModulesDir() {
-            flags |= MODULES_DIR;
+        // A node is completed when all its direct children have been built.
+        // As such, non-directory nodes are always complete.
+        boolean isCompleted() {
+            return true;
         }
 
-        public final boolean isModulesDir() {
-            return (flags & MODULES_DIR) != 0;
+        // Only resources can return a location.
+        ImageLocation getLocation() {
+            throw new IllegalStateException("not a resource: " + getName());
         }
 
+        /**
+         * Returns the name of this node (e.g. {@code
+         * "/modules/java.base/java/lang/Object.class"} or {@code
+         * "/packages/java.lang"}).
+         *
+         * <p>Note that for resource nodes this is NOT the underlying jimage
+         * resource name (it is prefixed with {@code "/modules"}).
+         */
         public final String getName() {
             return name;
         }
 
+        /**
+         * Returns file attributes for this node. The value returned may be the
+         * same for all nodes, and should not be relied upon for accuracy.
+         */
         public final BasicFileAttributes getFileAttributes() {
             return fileAttrs;
         }
 
-        // resolve this Node (if this is a soft link, get underlying Node)
+        /**
+         * Resolves a symbolic link to its target node. If this code is not a
+         * symbolic link, then it resolves to itself.
+         */
         public final Node resolveLink() {
             return resolveLink(false);
         }
 
+        /**
+         * Resolves a symbolic link to its target node. If this code is not a
+         * symbolic link, then it resolves to itself.
+         */
         public Node resolveLink(boolean recursive) {
             return this;
         }
 
-        // is this a soft link Node?
+        /** Returns whether this node is a symbolic link. */
         public boolean isLink() {
             return false;
         }
 
+        /**
+         * Returns whether this node is a directory. Directory nodes can have
+         * {@link #getChildNames()} invoked to get the fully qualified names
+         * of any child nodes.
+         */
         public boolean isDirectory() {
             return false;
         }
 
-        public List<Node> getChildren() {
-            throw new IllegalArgumentException("not a directory: " + getNameString());
-        }
-
+        /**
+         * Returns whether this node is a resource. Resource nodes can have
+         * their contents obtained via {@link ImageReader#getResource(Node)}
+         * or {@link ImageReader#getResourceBuffer(Node)}.
+         */
         public boolean isResource() {
             return false;
         }
 
-        public ImageLocation getLocation() {
-            throw new IllegalArgumentException("not a resource: " + getNameString());
+        /**
+         * Returns the fully qualified names of any child nodes for a directory.
+         *
+         * <p>By default, this method throws {@link IllegalStateException} and
+         * is overridden for directories.
+         */
+        public Stream<String> getChildNames() {
+            throw new IllegalStateException("not a directory: " + getName());
         }
 
+        /**
+         * Returns the uncompressed size of this node's content. If this node is
+         * not a resource, this method returns zero.
+         */
         public long size() {
             return 0L;
         }
 
+        /**
+         * Returns the compressed size of this node's content. If this node is
+         * not a resource, this method returns zero.
+         */
         public long compressedSize() {
             return 0L;
         }
 
+        /**
+         * Returns the extension string of a resource node. If this node is not
+         * a resource, this method returns null.
+         */
         public String extension() {
             return null;
         }
 
-        public long contentOffset() {
-            return 0L;
-        }
-
-        public final FileTime creationTime() {
-            return fileAttrs.creationTime();
-        }
-
-        public final FileTime lastAccessTime() {
-            return fileAttrs.lastAccessTime();
-        }
-
-        public final FileTime lastModifiedTime() {
-            return fileAttrs.lastModifiedTime();
-        }
-
-        public final String getNameString() {
-            return name;
-        }
-
         @Override
         public final String toString() {
-            return getNameString();
+            return getName();
         }
 
+        /** See <a href="#node_equality">Node Equality</a>. */
         @Override
         public final int hashCode() {
             return name.hashCode();
         }
 
+        /** See <a href="#node_equality">Node Equality</a>. */
         @Override
         public final boolean equals(Object other) {
             if (this == other) {
@@ -729,21 +780,40 @@ public final boolean equals(Object other) {
         }
     }
 
-    // directory node - directory has full path name without '/' at end.
-    static final class Directory extends Node {
-        private final List<Node> children;
+    /**
+     * Directory node (referenced from a full path, without a trailing '/').
+     *
+     * <p>Directory nodes have two distinct states:
+     * <ul>
+     *     <li>Incomplete: The child list has not been set.
+     *     <li>Complete: The child list has been set.
+     * </ul>
+     *
+     * <p>When a directory node is returned by {@link ImageReader#findNode(String)}
+     * it is always complete, but this DOES NOT mean that its child nodes are
+     * complete yet.
+     *
+     * <p>To avoid users being able to access incomplete child nodes, the
+     * {@code Node} API offers only a way to obtain child node names, forcing
+     * callers to invoke {@code findNode()} if they need to access the child
+     * node itself.
+     *
+     * <p>This approach allows directories to be implemented lazily with respect
+     * to child nodes, while retaining efficiency when child nodes are accessed
+     * (since any incomplete nodes will be created and placed in the node cache
+     * when the parent was first returned to the user).
+     */
+    private static final class Directory extends Node {
+        // Monotonic reference, will be set to the unmodifiable child list exactly once.
+        private List<Node> children = null;
 
         private Directory(String name, BasicFileAttributes fileAttrs) {
             super(name, fileAttrs);
-            children = new ArrayList<>();
         }
 
-        static Directory create(Directory parent, String name, BasicFileAttributes fileAttrs) {
-            Directory d = new Directory(name, fileAttrs);
-            if (parent != null) {
-                parent.addChild(d);
-            }
-            return d;
+        @Override
+        boolean isCompleted() {
+            return children != null;
         }
 
         @Override
@@ -752,46 +822,41 @@ public boolean isDirectory() {
         }
 
         @Override
-        public List<Node> getChildren() {
-            return Collections.unmodifiableList(children);
-        }
-
-        void addChild(Node node) {
-            assert !children.contains(node) : "Child " + node + " already added";
-            children.add(node);
-        }
-
-        public void walk(Consumer<? super Node> consumer) {
-            consumer.accept(this);
-            for (Node child : children) {
-                if (child.isDirectory()) {
-                    ((Directory)child).walk(consumer);
-                } else {
-                    consumer.accept(child);
-                }
+        public Stream<String> getChildNames() {
+            if (children != null) {
+                return children.stream().map(Node::getName);
             }
-        }
-    }
-
-    // "resource" is .class or any other resource (compressed/uncompressed) in a jimage.
-    // full path of the resource is the "name" of the resource.
-    static class Resource extends Node {
+            throw new IllegalStateException("Cannot get child nodes of an incomplete directory: " + getName());
+        }
+
+        private void setChildren(List<Node> children) {
+            assert this.children == null : this + ": Cannot set child nodes twice!";
+            this.children = Collections.unmodifiableList(children);
+        }
+    }
+    /**
+     * Resource node (e.g. a ".class" entry, or any other data resource).
+     *
+     * <p>Resources are leaf nodes referencing an underlying image location. They
+     * are lightweight, and do not cache their contents.
+     *
+     * <p>Unlike directories (where the node name matches the jimage path for the
+     * corresponding {@code ImageLocation}), resource node names are NOT the same
+     * as the corresponding jimage path. The difference is that node names for
+     * resources are prefixed with "/modules", which is missing from the
+     * equivalent jimage path.
+     */
+    private static class Resource extends Node {
         private final ImageLocation loc;
 
-        private Resource(ImageLocation loc, BasicFileAttributes fileAttrs) {
-            super(loc.getFullName(true), fileAttrs);
+        private Resource(String name, ImageLocation loc, BasicFileAttributes fileAttrs) {
+            super(name, fileAttrs);
             this.loc = loc;
         }
 
-        static Resource create(Directory parent, ImageLocation loc, BasicFileAttributes fileAttrs) {
-            Resource rs = new Resource(loc, fileAttrs);
-            parent.addChild(rs);
-            return rs;
-        }
-
         @Override
-        public boolean isCompleted() {
-            return true;
+        ImageLocation getLocation() {
+            return loc;
         }
 
         @Override
@@ -799,11 +864,6 @@ public boolean isResource() {
             return true;
         }
 
-        @Override
-        public ImageLocation getLocation() {
-            return loc;
-        }
-
         @Override
         public long size() {
             return loc.getUncompressedSize();
@@ -818,36 +878,29 @@ public long compressedSize() {
         public String extension() {
             return loc.getExtension();
         }
-
-        @Override
-        public long contentOffset() {
-            return loc.getContentOffset();
-        }
     }
 
-    // represents a soft link to another Node
-    static class LinkNode extends Node {
-        private final Node link;
+    /**
+     * Link node (a symbolic link to a top-level modules directory).
+     *
+     * <p>Link nodes resolve their target by invoking a given supplier, and do
+     * not cache the result. Since nodes are cached by the {@code ImageReader},
+     * this means that only the first call to {@link #resolveLink(boolean)}
+     * could do any significant work.
+     */
+    private static class LinkNode extends Node {
+        private final Supplier<Node> link;
 
-        private LinkNode(String name, Node link) {
-            super(name, link.getFileAttributes());
+        private LinkNode(String name, Supplier<Node> link, BasicFileAttributes fileAttrs) {
+            super(name, fileAttrs);
             this.link = link;
         }
 
-        static LinkNode create(Directory parent, String name, Node link) {
-            LinkNode ln = new LinkNode(name, link);
-            parent.addChild(ln);
-            return ln;
-        }
-
-        @Override
-        public boolean isCompleted() {
-            return true;
-        }
-
         @Override
         public Node resolveLink(boolean recursive) {
-            return (recursive && link instanceof LinkNode) ? ((LinkNode)link).resolveLink(true) : link;
+            // No need to use or propagate the recursive flag, since the target
+            // cannot possibly be a link node (links only point to directories).
+            return link.get();
         }
 
         @Override
diff --git a/src/java.base/share/classes/jdk/internal/jrtfs/ExplodedImage.java b/src/java.base/share/classes/jdk/internal/jrtfs/ExplodedImage.java
index e2c17f8ca25..4fe6612a8ed 100644
--- a/src/java.base/share/classes/jdk/internal/jrtfs/ExplodedImage.java
+++ b/src/java.base/share/classes/jdk/internal/jrtfs/ExplodedImage.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2015, 2022, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2015, 2025, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -27,17 +27,15 @@
 import java.io.IOException;
 import java.io.UncheckedIOException;
 import java.nio.file.DirectoryStream;
-import java.nio.file.FileSystem;
 import java.nio.file.FileSystemException;
-import java.nio.file.FileSystems;
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.nio.file.attribute.BasicFileAttributes;
 import java.util.ArrayList;
-import java.util.Collections;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
+import java.util.Objects;
 import java.util.stream.Stream;
 
 import jdk.internal.jimage.ImageReader.Node;
@@ -56,16 +54,15 @@ class ExplodedImage extends SystemImage {
 
     private static final String MODULES = "/modules/";
     private static final String PACKAGES = "/packages/";
-    private static final int PACKAGES_LEN = PACKAGES.length();
 
-    private final FileSystem defaultFS;
+    private final Path modulesDir;
     private final String separator;
-    private final Map<String, PathNode> nodes = Collections.synchronizedMap(new HashMap<>());
+    private final Map<String, PathNode> nodes = new HashMap<>();
     private final BasicFileAttributes modulesDirAttrs;
 
     ExplodedImage(Path modulesDir) throws IOException {
-        defaultFS = FileSystems.getDefault();
-        String str = defaultFS.getSeparator();
+        this.modulesDir = modulesDir;
+        String str = modulesDir.getFileSystem().getSeparator();
         separator = str.equals("/") ? null : str;
         modulesDirAttrs = Files.readAttributes(modulesDir, BasicFileAttributes.class);
         initNodes();
@@ -79,21 +76,26 @@ private final class PathNode extends Node {
         private PathNode link;
         private List<Node> children;
 
-        PathNode(String name, Path path, BasicFileAttributes attrs) {  // path
+        private PathNode(String name, Path path, BasicFileAttributes attrs) {  // path
             super(name, attrs);
             this.path = path;
         }
 
-        PathNode(String name, Node link) {              // link
+        private PathNode(String name, Node link) {              // link
             super(name, link.getFileAttributes());
             this.link = (PathNode)link;
         }
 
-        PathNode(String name, List<Node> children) {    // dir
+        private PathNode(String name, List<Node> children) {    // dir
             super(name, modulesDirAttrs);
             this.children = children;
         }
 
+        @Override
+        public boolean isResource() {
+            return link == null && !getFileAttributes().isDirectory();
+        }
+
         @Override
         public boolean isDirectory() {
             return children != null ||
@@ -112,21 +114,21 @@ public PathNode resolveLink(boolean recursive) {
             return recursive && link.isLink() ? link.resolveLink(true) : link;
         }
 
-        byte[] getContent() throws IOException {
+        private byte[] getContent() throws IOException {
             if (!getFileAttributes().isRegularFile())
                 throw new FileSystemException(getName() + " is not file");
             return Files.readAllBytes(path);
         }
 
         @Override
-        public List<Node> getChildren() {
+        public Stream<String> getChildNames() {
             if (!isDirectory())
-                throw new IllegalArgumentException("not a directory: " + getNameString());
+                throw new IllegalArgumentException("not a directory: " + getName());
             if (children == null) {
                 List<Node> list = new ArrayList<>();
                 try (DirectoryStream<Path> stream = Files.newDirectoryStream(path)) {
                     for (Path p : stream) {
-                        p = explodedModulesDir.relativize(p);
+                        p = modulesDir.relativize(p);
                         String pName = MODULES + nativeSlashToFrontSlash(p.toString());
                         Node node = findNode(pName);
                         if (node != null) {  // findNode may choose to hide certain files!
@@ -138,7 +140,7 @@ public List<Node> getChildren() {
                 }
                 children = list;
             }
-            return children;
+            return children.stream().map(Node::getName);
         }
 
         @Override
@@ -152,7 +154,7 @@ public long size() {
     }
 
     @Override
-    public void close() throws IOException {
+    public synchronized void close() throws IOException {
         nodes.clear();
     }
 
@@ -161,74 +163,78 @@ public byte[] getResource(Node node) throws IOException {
         return ((PathNode)node).getContent();
     }
 
-    // find Node for the given Path
     @Override
-    public synchronized Node findNode(String str) {
-        Node node = findModulesNode(str);
+    public synchronized Node findNode(String name) {
+        PathNode node = nodes.get(name);
         if (node != null) {
             return node;
         }
-        // lazily created for paths like /packages/<package>/<module>/xyz
-        // For example /packages/java.lang/java.base/java/lang/
-        if (str.startsWith(PACKAGES)) {
-            // pkgEndIdx marks end of <package> part
-            int pkgEndIdx = str.indexOf('/', PACKAGES_LEN);
-            if (pkgEndIdx != -1) {
-                // modEndIdx marks end of <module> part
-                int modEndIdx = str.indexOf('/', pkgEndIdx + 1);
-                if (modEndIdx != -1) {
-                    // make sure we have such module link!
-                    // ie., /packages/<package>/<module> is valid
-                    Node linkNode = nodes.get(str.substring(0, modEndIdx));
-                    if (linkNode == null || !linkNode.isLink()) {
-                        return null;
-                    }
-                    // map to "/modules/zyz" path and return that node
-                    // For example, "/modules/java.base/java/lang" for
-                    // "/packages/java.lang/java.base/java/lang".
-                    String mod = MODULES + str.substring(pkgEndIdx + 1);
-                    return findModulesNode(mod);
-                }
-            }
+        // If null, this was not the name of "/modules/..." node, and since all
+        // "/packages/..." nodes were created and cached in advance, the name
+        // cannot reference a valid node.
+        Path path = underlyingModulesPath(name);
+        if (path == null) {
+            return null;
         }
-        return null;
+        // This can still return null for hidden files.
+        return createModulesNode(name, path);
     }
 
-    // find a Node for a path that starts like "/modules/..."
-    Node findModulesNode(String str) {
-        PathNode node = nodes.get(str);
-        if (node != null) {
-            return node;
-        }
-        // lazily created "/modules/xyz/abc/" Node
-        // This is mapped to default file system path "<JDK_MODULES_DIR>/xyz/abc"
-        Path p = underlyingPath(str);
-        if (p != null) {
-            try {
-                BasicFileAttributes attrs = Files.readAttributes(p, BasicFileAttributes.class);
-                if (attrs.isRegularFile()) {
-                    Path f = p.getFileName();
-                    if (f.toString().startsWith("_the."))
-                        return null;
+    /**
+     * Lazily creates and caches a {@code Node} for the given "/modules/..." name
+     * and corresponding path to a file or directory.
+     *
+     * @param name a resource or directory node name, of the form "/modules/...".
+     * @param path the path of a file for a resource or directory.
+     * @return the newly created and cached node, or {@code null} if the given
+     *     path references a file which must be hidden in the node hierarchy.
+     */
+    private Node createModulesNode(String name, Path path) {
+        assert !nodes.containsKey(name) : "Node must not already exist: " + name;
+        assert isNonEmptyModulesPath(name) : "Invalid modules name: " + name;
+
+        try {
+            // We only know if we're creating a resource of directory when we
+            // look up file attributes, and we only do that once. Thus, we can
+            // only reject "marker files" here, rather than by inspecting the
+            // given name string, since it doesn't apply to directories.
+            BasicFileAttributes attrs = Files.readAttributes(path, BasicFileAttributes.class);
+            if (attrs.isRegularFile()) {
+                Path f = path.getFileName();
+                if (f.toString().startsWith("_the.")) {
+                    return null;
                 }
-                node = new PathNode(str, p, attrs);
-                nodes.put(str, node);
-                return node;
-            } catch (IOException x) {
-                // does not exists or unable to determine
+            } else if (!attrs.isDirectory()) {
+                return null;
             }
+            PathNode node = new PathNode(name, path, attrs);
+            nodes.put(name, node);
+            return node;
+        } catch (IOException x) {
+            // Since the path reference a file, any errors should not be ignored.
+            throw new UncheckedIOException(x);
         }
-        return null;
     }
 
-    Path underlyingPath(String str) {
-        if (str.startsWith(MODULES)) {
-            str = frontSlashToNativeSlash(str.substring("/modules".length()));
-            return defaultFS.getPath(explodedModulesDir.toString(), str);
+    /**
+     * Returns the expected file path for name in the "/modules/..." namespace,
+     * or {@code null} if the name is not in the "/modules/..." namespace or the
+     * path does not reference a file.
+     */
+    private Path underlyingModulesPath(String name) {
+        if (isNonEmptyModulesPath(name)) {
+            Path path = modulesDir.resolve(frontSlashToNativeSlash(name.substring(MODULES.length())));
+            return Files.exists(path) ? path : null;
         }
         return null;
     }
 
+    private static boolean isNonEmptyModulesPath(String name) {
+        // Don't just check the prefix, there must be something after it too
+        // (otherwise you end up with an empty string after trimming).
+        return name.startsWith(MODULES) && name.length() > MODULES.length();
+    }
+
     // convert "/" to platform path separator
     private String frontSlashToNativeSlash(String str) {
         return separator == null ? str : str.replace("/", separator);
@@ -249,24 +255,21 @@ private void initNodes() throws IOException {
         // same package prefix may exist in multiple modules. This Map
         // is filled by walking "jdk modules" directory recursively!
         Map<String, List<String>> packageToModules = new HashMap<>();
-        try (DirectoryStream<Path> stream = Files.newDirectoryStream(explodedModulesDir)) {
+        try (DirectoryStream<Path> stream = Files.newDirectoryStream(modulesDir)) {
             for (Path module : stream) {
                 if (Files.isDirectory(module)) {
                     String moduleName = module.getFileName().toString();
                     // make sure "/modules/<moduleName>" is created
-                    findModulesNode(MODULES + moduleName);
+                    Objects.requireNonNull(createModulesNode(MODULES + moduleName, module));
                     try (Stream<Path> contentsStream = Files.walk(module)) {
                         contentsStream.filter(Files::isDirectory).forEach((p) -> {
                             p = module.relativize(p);
                             String pkgName = slashesToDots(p.toString());
                             // skip META-INF and empty strings
                             if (!pkgName.isEmpty() && !pkgName.startsWith("META-INF")) {
-                                List<String> moduleNames = packageToModules.get(pkgName);
-                                if (moduleNames == null) {
-                                    moduleNames = new ArrayList<>();
-                                    packageToModules.put(pkgName, moduleNames);
-                                }
-                                moduleNames.add(moduleName);
+                                packageToModules
+                                        .computeIfAbsent(pkgName, k -> new ArrayList<>())
+                                        .add(moduleName);
                             }
                         });
                     }
@@ -275,8 +278,8 @@ private void initNodes() throws IOException {
         }
         // create "/modules" directory
         // "nodes" map contains only /modules/<foo> nodes only so far and so add all as children of /modules
-        PathNode modulesDir = new PathNode("/modules", new ArrayList<>(nodes.values()));
-        nodes.put(modulesDir.getName(), modulesDir);
+        PathNode modulesRootNode = new PathNode("/modules", new ArrayList<>(nodes.values()));
+        nodes.put(modulesRootNode.getName(), modulesRootNode);
 
         // create children under "/packages"
         List<Node> packagesChildren = new ArrayList<>(packageToModules.size());
@@ -285,7 +288,7 @@ private void initNodes() throws IOException {
             List<String> moduleNameList = entry.getValue();
             List<Node> moduleLinkNodes = new ArrayList<>(moduleNameList.size());
             for (String moduleName : moduleNameList) {
-                Node moduleNode = findModulesNode(MODULES + moduleName);
+                Node moduleNode = Objects.requireNonNull(nodes.get(MODULES + moduleName));
                 PathNode linkNode = new PathNode(PACKAGES + pkgName + "/" + moduleName, moduleNode);
                 nodes.put(linkNode.getName(), linkNode);
                 moduleLinkNodes.add(linkNode);
@@ -295,13 +298,13 @@ private void initNodes() throws IOException {
             packagesChildren.add(pkgDir);
         }
         // "/packages" dir
-        PathNode packagesDir = new PathNode("/packages", packagesChildren);
-        nodes.put(packagesDir.getName(), packagesDir);
+        PathNode packagesRootNode = new PathNode("/packages", packagesChildren);
+        nodes.put(packagesRootNode.getName(), packagesRootNode);
 
         // finally "/" dir!
         List<Node> rootChildren = new ArrayList<>();
-        rootChildren.add(packagesDir);
-        rootChildren.add(modulesDir);
+        rootChildren.add(packagesRootNode);
+        rootChildren.add(modulesRootNode);
         PathNode root = new PathNode("/", rootChildren);
         nodes.put(root.getName(), root);
     }
diff --git a/src/java.base/share/classes/jdk/internal/jrtfs/JrtFileAttributes.java b/src/java.base/share/classes/jdk/internal/jrtfs/JrtFileAttributes.java
index f0804b58c1c..e1eb1115260 100644
--- a/src/java.base/share/classes/jdk/internal/jrtfs/JrtFileAttributes.java
+++ b/src/java.base/share/classes/jdk/internal/jrtfs/JrtFileAttributes.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2016, 2024, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2016, 2025, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -49,7 +49,7 @@ final class JrtFileAttributes  implements BasicFileAttributes {
     //-------- basic attributes --------
     @Override
     public FileTime creationTime() {
-        return node.creationTime();
+        return node.getFileAttributes().creationTime();
     }
 
     @Override
@@ -69,12 +69,12 @@ public boolean isRegularFile() {
 
     @Override
     public FileTime lastAccessTime() {
-        return node.lastAccessTime();
+        return node.getFileAttributes().lastAccessTime();
     }
 
     @Override
     public FileTime lastModifiedTime() {
-        return node.lastModifiedTime();
+        return node.getFileAttributes().lastModifiedTime();
     }
 
     @Override
diff --git a/src/java.base/share/classes/jdk/internal/jrtfs/JrtFileSystem.java b/src/java.base/share/classes/jdk/internal/jrtfs/JrtFileSystem.java
index 9a8d9d22dfa..6530bd1f90a 100644
--- a/src/java.base/share/classes/jdk/internal/jrtfs/JrtFileSystem.java
+++ b/src/java.base/share/classes/jdk/internal/jrtfs/JrtFileSystem.java
@@ -54,7 +54,6 @@
 import java.nio.file.attribute.FileTime;
 import java.nio.file.attribute.UserPrincipalLookupService;
 import java.nio.file.spi.FileSystemProvider;
-import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Collections;
 import java.util.HashSet;
@@ -64,7 +63,6 @@
 import java.util.Set;
 import java.util.regex.Pattern;
 import jdk.internal.jimage.ImageReader.Node;
-import static java.util.stream.Collectors.toList;
 
 /**
  * jrt file system implementation built on System jimage files.
@@ -225,19 +223,19 @@ Iterator<Path> iteratorOf(JrtPath path, DirectoryStream.Filter<? super Path> fil
             throw new NotDirectoryException(path.getName());
         }
         if (filter == null) {
-            return node.getChildren()
-                       .stream()
-                       .map(child -> (Path)(path.resolve(new JrtPath(this, child.getNameString()).getFileName())))
-                       .iterator();
+            return node.getChildNames()
+                    .map(child -> (Path) (path.resolve(new JrtPath(this, child).getFileName())))
+                    .iterator();
         }
-        return node.getChildren()
-                   .stream()
-                   .map(child -> (Path)(path.resolve(new JrtPath(this, child.getNameString()).getFileName())))
-                   .filter(p ->  { try { return filter.accept(p);
-                                   } catch (IOException x) {}
-                                   return false;
-                                  })
-                   .iterator();
+        return node.getChildNames()
+                .map(child -> (Path) (path.resolve(new JrtPath(this, child).getFileName())))
+                .filter(p -> {
+                    try {
+                        return filter.accept(p);
+                    } catch (IOException x) {}
+                    return false;
+                })
+                .iterator();
     }
 
     // returns the content of the file resource specified by the path
diff --git a/src/java.base/share/classes/jdk/internal/jrtfs/SystemImage.java b/src/java.base/share/classes/jdk/internal/jrtfs/SystemImage.java
index 88cdf724e7d..b38e953a5f9 100644
--- a/src/java.base/share/classes/jdk/internal/jrtfs/SystemImage.java
+++ b/src/java.base/share/classes/jdk/internal/jrtfs/SystemImage.java
@@ -58,7 +58,6 @@ static SystemImage open() throws IOException {
         if (modulesImageExists) {
             // open a .jimage and build directory structure
             final ImageReader image = ImageReader.open(moduleImageFile);
-            image.getRootDirectory();
             return new SystemImage() {
                 @Override
                 Node findNode(String path) throws IOException {
@@ -79,13 +78,13 @@ void close() throws IOException {
         return new ExplodedImage(explodedModulesDir);
     }
 
-    static final String RUNTIME_HOME;
+    private static final String RUNTIME_HOME;
     // "modules" jimage file Path
-    static final Path moduleImageFile;
+    private static final Path moduleImageFile;
     // "modules" jimage exists or not?
-    static final boolean modulesImageExists;
+    private static final boolean modulesImageExists;
     // <JAVA_HOME>/modules directory Path
-    static final Path explodedModulesDir;
+    private static final Path explodedModulesDir;
 
     static {
         PrivilegedAction<String> pa = SystemImage::findHome;
diff --git a/src/java.base/share/classes/jdk/internal/module/SystemModuleFinders.java b/src/java.base/share/classes/jdk/internal/module/SystemModuleFinders.java
index c520e6e636a..370c151af84 100644
--- a/src/java.base/share/classes/jdk/internal/module/SystemModuleFinders.java
+++ b/src/java.base/share/classes/jdk/internal/module/SystemModuleFinders.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2015, 2024, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2015, 2025, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -34,7 +34,6 @@
 import java.lang.module.ModuleReference;
 import java.lang.reflect.Constructor;
 import java.net.URI;
-import java.net.URLConnection;
 import java.nio.ByteBuffer;
 import java.nio.file.Files;
 import java.nio.file.Path;
@@ -54,7 +53,6 @@
 import java.util.stream.Stream;
 import java.util.stream.StreamSupport;
 
-import jdk.internal.jimage.ImageLocation;
 import jdk.internal.jimage.ImageReader;
 import jdk.internal.jimage.ImageReaderFactory;
 import jdk.internal.access.JavaNetUriAccess;
@@ -210,7 +208,7 @@ public static ModuleFinder ofSystem() {
     }
 
     /**
-     * Parses the module-info.class of all module in the runtime image and
+     * Parses the {@code module-info.class} of all modules in the runtime image and
      * returns a ModuleFinder to find the modules.
      *
      * @apiNote The returned ModuleFinder is thread safe.
@@ -219,20 +217,16 @@ private static ModuleFinder ofModuleInfos() {
         // parse the module-info.class in every module
         Map<String, ModuleInfo.Attributes> nameToAttributes = new HashMap<>();
         Map<String, byte[]> nameToHash = new HashMap<>();
-        ImageReader reader = SystemImage.reader();
-        for (String mn : reader.getModuleNames()) {
-            ImageLocation loc = reader.findLocation(mn, "module-info.class");
-            ModuleInfo.Attributes attrs
-                = ModuleInfo.read(reader.getResourceBuffer(loc), null);
 
-            nameToAttributes.put(mn, attrs);
+        allModuleAttributes().forEach(attrs -> {
+            nameToAttributes.put(attrs.descriptor().name(), attrs);
             ModuleHashes hashes = attrs.recordedHashes();
             if (hashes != null) {
                 for (String name : hashes.names()) {
                     nameToHash.computeIfAbsent(name, k -> hashes.hashFor(name));
                 }
             }
-        }
+        });
 
         // create a ModuleReference for each module
         Set<ModuleReference> mrefs = new HashSet<>();
@@ -253,6 +247,40 @@ private static ModuleFinder ofModuleInfos() {
         return new SystemModuleFinder(mrefs, nameToModule);
     }
 
+    /**
+     * Parses the {@code module-info.class} of all modules in the runtime image and
+     * returns a stream of {@link ModuleInfo.Attributes Attributes} for them. The
+     * returned attributes are in no specific order.
+     */
+    private static Stream<ModuleInfo.Attributes> allModuleAttributes() {
+        // System-wide image reader.
+        ImageReader reader = SystemImage.reader();
+        try {
+            return reader.findNode("/modules")
+                    .getChildNames()
+                    .map(mn -> readModuleAttributes(reader, mn));
+        } catch (IOException e) {
+            throw new Error("Error reading root /modules entry", e);
+        }
+    }
+
+    /**
+     * Returns the module's "module-info", returning a holder for its class file
+     * attributes. Every module is required to have a valid {@code module-info.class}.
+     */
+    private static ModuleInfo.Attributes readModuleAttributes(ImageReader reader, String moduleName) {
+        Exception err = null;
+        try {
+            ImageReader.Node node = reader.findNode(moduleName + "/module-info.class");
+            if (node != null && node.isResource()) {
+                return ModuleInfo.read(reader.getResourceBuffer(node), null);
+            }
+        } catch (IOException | UncheckedIOException e) {
+            err = e;
+        }
+        throw new Error("Missing or invalid module-info.class for module: " + moduleName, err);
+    }
+
     /**
      * A ModuleFinder that finds module in an array or set of modules.
      */
@@ -382,43 +410,21 @@ private static class SystemModuleReader implements ModuleReader {
             this.module = module;
         }
 
-        /**
-         * Returns the ImageLocation for the given resource, {@code null}
-         * if not found.
-         */
-        private ImageLocation findImageLocation(String name) throws IOException {
-            Objects.requireNonNull(name);
-            if (closed)
-                throw new IOException("ModuleReader is closed");
-            ImageReader imageReader = SystemImage.reader();
-            if (imageReader != null) {
-                return imageReader.findLocation(module, name);
-            } else {
-                // not an images build
-                return null;
-            }
-        }
-
         /**
          * Returns {@code true} if the given resource exists, {@code false}
          * if not found.
          */
-        private boolean containsImageLocation(String name) throws IOException {
+        private boolean containsResource(String module, String name) throws IOException {
             Objects.requireNonNull(name);
             if (closed)
                 throw new IOException("ModuleReader is closed");
             ImageReader imageReader = SystemImage.reader();
-            if (imageReader != null) {
-                return imageReader.verifyLocation(module, name);
-            } else {
-                // not an images build
-                return false;
-            }
+            return imageReader != null && imageReader.containsResource(module, name);
         }
 
         @Override
         public Optional<URI> find(String name) throws IOException {
-            if (containsImageLocation(name)) {
+            if (containsResource(module, name)) {
                 URI u = JNUA.create("jrt", "/" + module + "/" + name);
                 return Optional.of(u);
             } else {
@@ -442,14 +448,23 @@ private InputStream toInputStream(ByteBuffer bb) { // ## -> ByteBuffer?
             }
         }
 
+        /**
+         * Returns the node for the given resource if found. If the name references
+         * a non-resource node, then {@code null} is returned.
+         */
+        private ImageReader.Node findResource(ImageReader reader, String name) throws IOException {
+            Objects.requireNonNull(name);
+            if (closed) {
+                throw new IOException("ModuleReader is closed");
+            }
+            return reader.findResourceNode(module, name);
+        }
+
         @Override
         public Optional<ByteBuffer> read(String name) throws IOException {
-            ImageLocation location = findImageLocation(name);
-            if (location != null) {
-                return Optional.of(SystemImage.reader().getResourceBuffer(location));
-            } else {
-                return Optional.empty();
-            }
+            ImageReader reader = SystemImage.reader();
+            return Optional.ofNullable(findResource(reader, name))
+                    .map(reader::getResourceBuffer);
         }
 
         @Override
@@ -481,7 +496,7 @@ public void close() {
     private static class ModuleContentSpliterator implements Spliterator<String> {
         final String moduleRoot;
         final Deque<ImageReader.Node> stack;
-        Iterator<ImageReader.Node> iterator;
+        Iterator<String> iterator;
 
         ModuleContentSpliterator(String module) throws IOException {
             moduleRoot = "/modules/" + module;
@@ -502,13 +517,10 @@ private static class ModuleContentSpliterator implements Spliterator<String> {
         private String next() throws IOException {
             for (;;) {
                 while (iterator.hasNext()) {
-                    ImageReader.Node node = iterator.next();
-                    String name = node.getName();
+                    String name = iterator.next();
+                    ImageReader.Node node = SystemImage.reader().findNode(name);
                     if (node.isDirectory()) {
-                        // build node
-                        ImageReader.Node dir = SystemImage.reader().findNode(name);
-                        assert dir.isDirectory();
-                        stack.push(dir);
+                        stack.push(node);
                     } else {
                         // strip /modules/$MODULE/ prefix
                         return name.substring(moduleRoot.length() + 1);
@@ -520,7 +532,7 @@ private String next() throws IOException {
                 } else {
                     ImageReader.Node dir = stack.poll();
                     assert dir.isDirectory();
-                    iterator = dir.getChildren().iterator();
+                    iterator = dir.getChildNames().iterator();
                 }
             }
         }
diff --git a/src/java.base/share/classes/sun/net/www/protocol/jrt/JavaRuntimeURLConnection.java b/src/java.base/share/classes/sun/net/www/protocol/jrt/JavaRuntimeURLConnection.java
index 20b735fbdf3..71080950b80 100644
--- a/src/java.base/share/classes/sun/net/www/protocol/jrt/JavaRuntimeURLConnection.java
+++ b/src/java.base/share/classes/sun/net/www/protocol/jrt/JavaRuntimeURLConnection.java
@@ -87,8 +87,8 @@ private synchronized Node connectResourceNode() throws IOException {
             if (module.isEmpty() || path == null) {
                 throw new IOException("cannot connect to jrt:/" + module);
             }
-            Node node = READER.findNode("/modules/" + module + "/" + path);
-            if (node == null || !node.isResource()) {
+            Node node = READER.findResourceNode(module, path);
+            if (node == null) {
                 throw new IOException(module + "/" + path + " not found");
             }
             this.resourceNode = node;
diff --git a/src/jdk.compiler/share/classes/com/sun/tools/javac/file/FSInfo.java b/src/jdk.compiler/share/classes/com/sun/tools/javac/file/FSInfo.java
index e2ab9b1679c..420ef59a647 100644
--- a/src/jdk.compiler/share/classes/com/sun/tools/javac/file/FSInfo.java
+++ b/src/jdk.compiler/share/classes/com/sun/tools/javac/file/FSInfo.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2008, 2022, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2008, 2025, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -25,19 +25,19 @@
 
 package com.sun.tools.javac.file;
 
-import java.io.IOError;
 import java.io.IOException;
 import java.net.MalformedURLException;
+import java.net.URI;
 import java.net.URISyntaxException;
 import java.net.URL;
-import java.nio.file.FileSystems;
 import java.nio.file.Files;
-import java.nio.file.InvalidPathException;
 import java.nio.file.Path;
 import java.nio.file.spi.FileSystemProvider;
 import java.util.ArrayList;
 import java.util.Collections;
+import java.util.HashMap;
 import java.util.List;
+import java.util.Map;
 import java.util.StringTokenizer;
 import java.util.jar.Attributes;
 import java.util.jar.JarFile;
@@ -163,4 +163,30 @@ public synchronized FileSystemProvider getJarFSProvider() {
         return null;
     }
 
+    // Must match the keys/values expected by ZipFileSystem.java.
+    private static final Map<String, String> READ_ONLY_JARFS_ENV = Map.of(
+            // Jar files opened by Javac should always be read-only.
+            "accessMode", "readOnly",
+            // ignores timestamps not stored in ZIP central directory, reducing I/O.
+            "zipinfo-time", "false");
+
+    /**
+     * Returns a {@link java.nio.file.FileSystem FileSystem} environment map
+     * suitable for creating read-only JAR file-systems with default timestamp
+     * information via {@link FileSystemProvider#newFileSystem(Path, Map)}
+     * or {@link java.nio.file.FileSystems#newFileSystem(Path, Map)}.
+     *
+     * @param releaseVersion the release version to use when creating a
+     *                       file-system from a multi-release JAR (or
+     *                       {@code null} to ignore release versioning).
+     */
+    public Map<String, ?> readOnlyJarFSEnv(String releaseVersion) {
+        if (releaseVersion == null) {
+            return READ_ONLY_JARFS_ENV;
+        }
+        // Multi-release JARs need an additional attribute.
+        Map<String, String> env = new HashMap<>(READ_ONLY_JARFS_ENV);
+        env.put("releaseVersion", releaseVersion);
+        return Collections.unmodifiableMap(env);
+    }
 }
diff --git a/src/jdk.compiler/share/classes/com/sun/tools/javac/file/JavacFileManager.java b/src/jdk.compiler/share/classes/com/sun/tools/javac/file/JavacFileManager.java
index 28274d26542..885d377e137 100644
--- a/src/jdk.compiler/share/classes/com/sun/tools/javac/file/JavacFileManager.java
+++ b/src/jdk.compiler/share/classes/com/sun/tools/javac/file/JavacFileManager.java
@@ -561,15 +561,10 @@ private final class ArchiveContainer implements Container {
 
         public ArchiveContainer(Path archivePath) throws IOException, ProviderNotFoundException {
             this.archivePath = archivePath;
-            Map<String,String> env = new HashMap<>();
-            // ignores timestamps not stored in ZIP central directory, reducing I/O
-            // This key is handled by ZipFileSystem only.
-            env.put("zipinfo-time", "false");
-
             if (multiReleaseValue != null && archivePath.toString().endsWith(".jar")) {
-                env.put("multi-release", multiReleaseValue);
                 FileSystemProvider jarFSProvider = fsInfo.getJarFSProvider();
                 Assert.checkNonNull(jarFSProvider, "should have been caught before!");
+                Map<String, ?> env = fsInfo.readOnlyJarFSEnv(multiReleaseValue);
                 try {
                     this.fileSystem = jarFSProvider.newFileSystem(archivePath, env);
                 } catch (ZipException ze) {
@@ -577,8 +572,11 @@ public ArchiveContainer(Path archivePath) throws IOException, ProviderNotFoundEx
                 }
             } else {
                 // Less common case is possible if the file manager was not initialized in JavacTask,
-                // or if non "*.jar" files are on the classpath.
-                this.fileSystem = FileSystems.newFileSystem(archivePath, env, (ClassLoader)null);
+                // or if non "*.jar" files are on the classpath. If this is not a ZIP/JAR file then it
+                // will ignore ZIP specific parameters in env, and may not end up being read-only.
+                // However, Javac should never attempt to write back to archives either way.
+                Map<String, ?> env = fsInfo.readOnlyJarFSEnv(null);
+                this.fileSystem = FileSystems.newFileSystem(archivePath, env);
             }
             packages = new HashMap<>();
             for (Path root : fileSystem.getRootDirectories()) {
diff --git a/src/jdk.compiler/share/classes/com/sun/tools/javac/file/Locations.java b/src/jdk.compiler/share/classes/com/sun/tools/javac/file/Locations.java
index 5ff55d4be3a..42e239f6951 100644
--- a/src/jdk.compiler/share/classes/com/sun/tools/javac/file/Locations.java
+++ b/src/jdk.compiler/share/classes/com/sun/tools/javac/file/Locations.java
@@ -141,7 +141,7 @@ public class Locations {
 
     Map<Path, FileSystem> fileSystems = new LinkedHashMap<>();
     List<Closeable> closeables = new ArrayList<>();
-    private Map<String,String> fsEnv = Collections.emptyMap();
+    private String releaseVersion = null;
 
     Locations() {
         initHandlers();
@@ -233,7 +233,8 @@ private Iterable<Path> getPathEntries(String searchPath, Path emptyPathDefault)
     }
 
     public void setMultiReleaseValue(String multiReleaseValue) {
-        fsEnv = Collections.singletonMap("releaseVersion", multiReleaseValue);
+        // Null is implicitly allowed and unsets the value.
+        this.releaseVersion = multiReleaseValue;
     }
 
     private boolean contains(Collection<Path> searchPath, Path file) throws IOException {
@@ -480,7 +481,7 @@ Location getLocationForModule(String moduleName) throws IOException {
         }
 
         /**
-         * @see JavaFileManager#getLocationForModule(Location, JavaFileObject, String)
+         * @see JavaFileManager#getLocationForModule(Location, JavaFileObject)
          */
         Location getLocationForModule(Path file) throws IOException  {
             return null;
@@ -1387,7 +1388,7 @@ private Pair<String,Path> inferModuleName(Path p) {
                         log.error(Errors.NoZipfsForArchive(p));
                         return null;
                     }
-                    try (FileSystem fs = jarFSProvider.newFileSystem(p, fsEnv)) {
+                    try (FileSystem fs = jarFSProvider.newFileSystem(p, fsInfo.readOnlyJarFSEnv(releaseVersion))) {
                         Path moduleInfoClass = fs.getPath("module-info.class");
                         if (Files.exists(moduleInfoClass)) {
                             String moduleName = readModuleName(moduleInfoClass);
@@ -1463,7 +1464,7 @@ private Pair<String,Path> inferModuleName(Path p) {
                                 log.error(Errors.LocnCantReadFile(p));
                                 return null;
                             }
-                            fs = jarFSProvider.newFileSystem(p, Collections.emptyMap());
+                            fs = jarFSProvider.newFileSystem(p, fsInfo.readOnlyJarFSEnv(null));
                             try {
                                 Path moduleInfoClass = fs.getPath("classes/module-info.class");
                                 String moduleName = readModuleName(moduleInfoClass);
diff --git a/src/jdk.compiler/share/classes/com/sun/tools/javac/platform/JDKPlatformProvider.java b/src/jdk.compiler/share/classes/com/sun/tools/javac/platform/JDKPlatformProvider.java
index 4c24f9892a6..2360fce1f75 100644
--- a/src/jdk.compiler/share/classes/com/sun/tools/javac/platform/JDKPlatformProvider.java
+++ b/src/jdk.compiler/share/classes/com/sun/tools/javac/platform/JDKPlatformProvider.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2014, 2024, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2014, 2025, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -51,10 +51,8 @@
 import javax.annotation.processing.Processor;
 import javax.tools.ForwardingJavaFileObject;
 import javax.tools.JavaFileManager;
-import javax.tools.JavaFileManager.Location;
 import javax.tools.JavaFileObject;
 import javax.tools.JavaFileObject.Kind;
-import javax.tools.StandardJavaFileManager;
 import javax.tools.StandardLocation;
 
 import com.sun.source.util.Plugin;
@@ -64,6 +62,7 @@
 import com.sun.tools.javac.file.JavacFileManager;
 import com.sun.tools.javac.jvm.Target;
 import com.sun.tools.javac.main.Option;
+import com.sun.tools.javac.util.Assert;
 import com.sun.tools.javac.util.Context;
 import com.sun.tools.javac.util.Log;
 import com.sun.tools.javac.util.StringUtils;
@@ -96,6 +95,14 @@ public PlatformDescription getPlatformTrusted(String platformName) {
 
     private static final String[] symbolFileLocation = { "lib", "ct.sym" };
 
+    // These must match attributes defined in ZipFileSystem.java.
+    private static final Map<String, ?> CT_SYM_ZIP_ENV = Map.of(
+            // Symbol file should always be opened read-only.
+            "accessMode", "readOnly",
+            // Uses less accurate, but faster, timestamp information
+            // (nobody should care about timestamps in the CT symbol file).
+            "zipinfo-time", "false");
+
     private static final Set<String> SUPPORTED_JAVA_PLATFORM_VERSIONS;
     public static final Comparator<String> NUMERICAL_COMPARATOR = (s1, s2) -> {
         int i1;
@@ -117,7 +124,7 @@ public PlatformDescription getPlatformTrusted(String platformName) {
         SUPPORTED_JAVA_PLATFORM_VERSIONS = new TreeSet<>(NUMERICAL_COMPARATOR);
         Path ctSymFile = findCtSym();
         if (Files.exists(ctSymFile)) {
-            try (FileSystem fs = FileSystems.newFileSystem(ctSymFile, (ClassLoader)null);
+            try (FileSystem fs = FileSystems.newFileSystem(ctSymFile, CT_SYM_ZIP_ENV);
                  DirectoryStream<Path> dir =
                          Files.newDirectoryStream(fs.getRootDirectories().iterator().next())) {
                 for (Path section : dir) {
@@ -249,7 +256,12 @@ public String inferBinaryName(Location location, JavaFileObject file) {
                 try {
                     FileSystem fs = ctSym2FileSystem.get(file);
                     if (fs == null) {
-                        ctSym2FileSystem.put(file, fs = FileSystems.newFileSystem(file, (ClassLoader)null));
+                        fs = FileSystems.newFileSystem(file, CT_SYM_ZIP_ENV);
+                        // If for any reason this was not opened from a ZIP file,
+                        // then the resulting file system would not be read-only.
+                        // NOTE: This check is disabled until JDK 25 bootstrap!
+                        // Assert.check(fs.isReadOnly());
+                        ctSym2FileSystem.put(file, fs);
                     }
 
                     Path root = fs.getRootDirectories().iterator().next();
diff --git a/test/jdk/jdk/internal/jimage/ImageReaderTest.java b/test/jdk/jdk/internal/jimage/ImageReaderTest.java
new file mode 100644
index 00000000000..de52ed1503d
--- /dev/null
+++ b/test/jdk/jdk/internal/jimage/ImageReaderTest.java
@@ -0,0 +1,343 @@
+/*
+ * Copyright (c) 2025, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+import jdk.internal.jimage.ImageReader;
+import jdk.internal.jimage.ImageReader.Node;
+import jdk.test.lib.compiler.InMemoryJavaCompiler;
+import jdk.test.lib.util.JarBuilder;
+import jdk.tools.jlink.internal.LinkableRuntimeImage;
+import org.junit.jupiter.api.Assumptions;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.TestInstance;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.CsvSource;
+import org.junit.jupiter.params.provider.ValueSource;
+import tests.Helper;
+import tests.JImageGenerator;
+
+import java.io.IOException;
+import java.nio.file.Path;
+import java.util.Arrays;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import java.util.stream.Collectors;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertSame;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
+import static org.junit.jupiter.api.Assumptions.assumeTrue;
+import static org.junit.jupiter.api.TestInstance.Lifecycle.PER_CLASS;
+
+/*
+ * @test
+ * @summary Tests for ImageReader.
+ * @modules java.base/jdk.internal.jimage
+ *          jdk.jlink/jdk.tools.jlink.internal
+ *          jdk.jlink/jdk.tools.jimage
+ * @library /test/jdk/tools/lib
+ *          /test/lib
+ * @build tests.*
+ * @run junit/othervm ImageReaderTest
+ */
+
+/// Using PER_CLASS lifecycle means the (expensive) image file is only build once.
+/// There is no mutable test instance state to worry about.
+@TestInstance(PER_CLASS)
+public class ImageReaderTest {
+
+    private static final Map<String, List<String>> IMAGE_ENTRIES = Map.of(
+            "modfoo", Arrays.asList(
+                    "com.foo.Alpha",
+                    "com.foo.Beta",
+                    "com.foo.bar.Gamma"),
+            "modbar", Arrays.asList(
+                    "com.bar.One",
+                    "com.bar.Two"));
+    private final Path image = buildJImage(IMAGE_ENTRIES);
+
+    @ParameterizedTest
+    @ValueSource(strings = {
+            "/",
+            "/modules",
+            "/modules/modfoo",
+            "/modules/modbar",
+            "/modules/modfoo/com",
+            "/modules/modfoo/com/foo",
+            "/modules/modfoo/com/foo/bar"})
+    public void testModuleDirectories_expected(String name) throws IOException {
+        try (ImageReader reader = ImageReader.open(image)) {
+            assertDir(reader, name);
+        }
+    }
+
+    @ParameterizedTest
+    @ValueSource(strings = {
+            "",
+            "//",
+            "/modules/",
+            "/modules/unknown",
+            "/modules/modbar/",
+            "/modules/modfoo//com",
+            "/modules/modfoo/com/"})
+    public void testModuleNodes_absent(String name) throws IOException {
+        try (ImageReader reader = ImageReader.open(image)) {
+            assertAbsent(reader, name);
+        }
+    }
+
+    @Test
+    public void testModuleResources() throws IOException {
+        try (ImageReader reader = ImageReader.open(image)) {
+            assertNode(reader, "/modules/modfoo/com/foo/Alpha.class");
+            assertNode(reader, "/modules/modbar/com/bar/One.class");
+
+            ImageClassLoader loader = new ImageClassLoader(reader, IMAGE_ENTRIES.keySet());
+            assertEquals("Class: com.foo.Alpha", loader.loadAndGetToString("modfoo", "com.foo.Alpha"));
+            assertEquals("Class: com.foo.Beta", loader.loadAndGetToString("modfoo", "com.foo.Beta"));
+            assertEquals("Class: com.foo.bar.Gamma", loader.loadAndGetToString("modfoo", "com.foo.bar.Gamma"));
+            assertEquals("Class: com.bar.One", loader.loadAndGetToString("modbar", "com.bar.One"));
+        }
+    }
+
+    @ParameterizedTest
+    @CsvSource(delimiter = ':', value = {
+            "modfoo:com/foo/Alpha.class",
+            "modbar:com/bar/One.class",
+    })
+    public void testResource_present(String modName, String resPath) throws IOException {
+        try (ImageReader reader = ImageReader.open(image)) {
+            assertNotNull(reader.findResourceNode(modName, resPath));
+            assertTrue(reader.containsResource(modName, resPath));
+
+            String canonicalNodeName = "/modules/" + modName + "/" + resPath;
+            Node node = reader.findNode(canonicalNodeName);
+            assertTrue(node != null && node.isResource());
+        }
+    }
+
+    @ParameterizedTest
+    @CsvSource(delimiter = ':', value = {
+            // Absolute resource names are not allowed.
+            "modfoo:/com/bar/One.class",
+            // Resource in wrong module.
+            "modfoo:com/bar/One.class",
+            "modbar:com/foo/Alpha.class",
+            // Directories are not returned.
+            "modfoo:com/foo",
+            "modbar:com/bar",
+            // JImage entries exist for these, but they are not resources.
+            "modules:modfoo/com/foo/Alpha.class",
+            "packages:com.foo/modfoo",
+            // Empty module names/paths do not find resources.
+            "'':modfoo/com/foo/Alpha.class",
+            "modfoo:''"})
+    public void testResource_absent(String modName, String resPath) throws IOException {
+        try (ImageReader reader = ImageReader.open(image)) {
+            assertNull(reader.findResourceNode(modName, resPath));
+            assertFalse(reader.containsResource(modName, resPath));
+
+            // Non-existent resources names should either not be found,
+            // or (in the case of directory nodes) not be resources.
+            String canonicalNodeName = "/modules/" + modName + "/" + resPath;
+            Node node = reader.findNode(canonicalNodeName);
+            assertTrue(node == null || !node.isResource());
+        }
+    }
+
+    @ParameterizedTest
+    @CsvSource(delimiter = ':', value = {
+            // Don't permit module names to contain paths.
+            "modfoo/com/bar:One.class",
+            "modfoo/com:bar/One.class",
+            "modules/modfoo/com:foo/Alpha.class",
+    })
+    public void testResource_invalid(String modName, String resPath) throws IOException {
+        try (ImageReader reader = ImageReader.open(image)) {
+            assertThrows(IllegalArgumentException.class, () -> reader.containsResource(modName, resPath));
+            assertThrows(IllegalArgumentException.class, () -> reader.findResourceNode(modName, resPath));
+        }
+    }
+
+    @Test
+    public void testPackageDirectories() throws IOException {
+        try (ImageReader reader = ImageReader.open(image)) {
+            Node root = assertDir(reader, "/packages");
+            Set<String> pkgNames = root.getChildNames().collect(Collectors.toSet());
+            assertTrue(pkgNames.contains("/packages/com"));
+            assertTrue(pkgNames.contains("/packages/com.foo"));
+            assertTrue(pkgNames.contains("/packages/com.bar"));
+
+            // Even though no classes exist directly in the "com" package, it still
+            // creates a directory with links back to all the modules which contain it.
+            Set<String> comLinks = assertDir(reader, "/packages/com").getChildNames().collect(Collectors.toSet());
+            assertTrue(comLinks.contains("/packages/com/modfoo"));
+            assertTrue(comLinks.contains("/packages/com/modbar"));
+        }
+    }
+
+    @Test
+    public void testPackageLinks() throws IOException {
+        try (ImageReader reader = ImageReader.open(image)) {
+            Node moduleFoo = assertDir(reader, "/modules/modfoo");
+            Node moduleBar = assertDir(reader, "/modules/modbar");
+            assertSame(assertLink(reader, "/packages/com.foo/modfoo").resolveLink(), moduleFoo);
+            assertSame(assertLink(reader, "/packages/com.bar/modbar").resolveLink(), moduleBar);
+        }
+    }
+
+    private static ImageReader.Node assertNode(ImageReader reader, String name) throws IOException {
+        ImageReader.Node node = reader.findNode(name);
+        assertNotNull(node, "Could not find node: " + name);
+        return node;
+    }
+
+    private static ImageReader.Node assertDir(ImageReader reader, String name) throws IOException {
+        ImageReader.Node dir = assertNode(reader, name);
+        assertTrue(dir.isDirectory(), "Node was not a directory: " + name);
+        return dir;
+    }
+
+    private static ImageReader.Node assertLink(ImageReader reader, String name) throws IOException {
+        ImageReader.Node link = assertNode(reader, name);
+        assertTrue(link.isLink(), "Node was not a symbolic link: " + name);
+        return link;
+    }
+
+    private static void assertAbsent(ImageReader reader, String name) throws IOException {
+        assertNull(reader.findNode(name), "Should not be able to find node: " + name);
+    }
+
+    /// Builds a jimage file with the specified class entries. The classes in the built
+    /// image can be loaded and executed to return their names via `toString()` to confirm
+    /// the correct bytes were returned.
+    public static Path buildJImage(Map<String, List<String>> entries) {
+        Helper helper = getHelper();
+        Path outDir = helper.createNewImageDir("test");
+        JImageGenerator.JLinkTask jlink = JImageGenerator.getJLinkTask()
+                .modulePath(helper.defaultModulePath())
+                .output(outDir);
+
+        Path jarDir = helper.getJarDir();
+        entries.forEach((module, classes) -> {
+            JarBuilder jar = new JarBuilder(jarDir.resolve(module + ".jar").toString());
+            String moduleInfo = "module " + module + " {}";
+            jar.addEntry("module-info.class", InMemoryJavaCompiler.compile("module-info", moduleInfo));
+
+            classes.forEach(fqn -> {
+                int lastDot = fqn.lastIndexOf('.');
+                String pkg = fqn.substring(0, lastDot);
+                String cls = fqn.substring(lastDot + 1);
+
+                String path = fqn.replace('.', '/') + ".class";
+                String source = String.format(
+                        """
+                        package %s;
+                        public class %s {
+                            public String toString() {
+                                return "Class: %s";
+                            }
+                        }
+                        """, pkg, cls, fqn);
+                jar.addEntry(path, InMemoryJavaCompiler.compile(fqn, source));
+            });
+            try {
+                jar.build();
+            } catch (IOException e) {
+                throw new RuntimeException(e);
+            }
+            jlink.addMods(module);
+        });
+        return jlink.call().assertSuccess().resolve("lib", "modules");
+    }
+
+    ///  Returns the helper for building JAR and jimage files.
+    private static Helper getHelper() {
+        Helper helper;
+        try {
+            boolean isLinkableRuntime = LinkableRuntimeImage.isLinkableRuntime();
+            helper = Helper.newHelper(isLinkableRuntime);
+        } catch (IOException e) {
+            throw new RuntimeException(e);
+        }
+        Assumptions.assumeTrue(helper != null, "Cannot create test helper, skipping test!");
+        return helper;
+    }
+
+    /// Loads and performs actions on classes stored in a given `ImageReader`.
+    private static class ImageClassLoader extends ClassLoader {
+        private final ImageReader reader;
+        private final Set<String> testModules;
+
+        private ImageClassLoader(ImageReader reader, Set<String> testModules) {
+            this.reader = reader;
+            this.testModules = testModules;
+        }
+
+        @FunctionalInterface
+        public interface ClassAction<R, T extends Exception> {
+            R call(Class<?> cls) throws T;
+        }
+
+        String loadAndGetToString(String module, String fqn) {
+            return loadAndCall(module, fqn, c -> c.getDeclaredConstructor().newInstance().toString());
+        }
+
+        <R> R loadAndCall(String module, String fqn, ClassAction<R, ?> action) {
+            Class<?> cls = findClass(module, fqn);
+            assertNotNull(cls, "Could not load class: " + module + "/" + fqn);
+            try {
+                return action.call(cls);
+            } catch (Exception e) {
+                fail("Class loading failed", e);
+                return null;
+            }
+        }
+
+        @Override
+        protected Class<?> findClass(String module, String fqn) {
+            assumeTrue(testModules.contains(module), "Can only load classes in modules: " + testModules);
+            String name = "/modules/" + module + "/" + fqn.replace('.', '/') + ".class";
+            Class<?> cls = findLoadedClass(fqn);
+            if (cls == null) {
+                try {
+                    ImageReader.Node node = reader.findNode(name);
+                    if (node != null && node.isResource()) {
+                        byte[] classBytes = reader.getResource(node);
+                        cls = defineClass(fqn, classBytes, 0, classBytes.length);
+                        resolveClass(cls);
+                        return cls;
+                    }
+                } catch (IOException e) {
+                    throw new RuntimeException(e);
+                }
+            }
+            return null;
+        }
+    }
+}
diff --git a/test/jdk/jdk/internal/jimage/JImageReadTest.java b/test/jdk/jdk/internal/jimage/JImageReadTest.java
index ea700d03a4f..35fb2adb687 100644
--- a/test/jdk/jdk/internal/jimage/JImageReadTest.java
+++ b/test/jdk/jdk/internal/jimage/JImageReadTest.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2015, 2019, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2015, 2025, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -49,6 +49,9 @@
 import org.testng.Assert;
 import org.testng.TestNG;
 
+import static java.nio.ByteOrder.BIG_ENDIAN;
+import static java.nio.ByteOrder.LITTLE_ENDIAN;
+
 @Test
 public class JImageReadTest {
 
@@ -333,32 +336,21 @@ static void test4_nameTooLong() throws IOException {
      */
     @Test
     static void test5_imageReaderEndianness() throws IOException {
-        ImageReader nativeReader = ImageReader.open(imageFile);
-        Assert.assertEquals(nativeReader.getByteOrder(), ByteOrder.nativeOrder());
-
-        try {
-            ImageReader leReader = ImageReader.open(imageFile, ByteOrder.LITTLE_ENDIAN);
-            Assert.assertEquals(leReader.getByteOrder(), ByteOrder.LITTLE_ENDIAN);
-            leReader.close();
-        } catch (IOException io) {
-            // IOException expected if LITTLE_ENDIAN not the nativeOrder()
-            Assert.assertNotEquals(ByteOrder.nativeOrder(), ByteOrder.LITTLE_ENDIAN);
-        }
-
-        try {
-            ImageReader beReader = ImageReader.open(imageFile, ByteOrder.BIG_ENDIAN);
-            Assert.assertEquals(beReader.getByteOrder(), ByteOrder.BIG_ENDIAN);
-            beReader.close();
-        } catch (IOException io) {
-            // IOException expected if LITTLE_ENDIAN not the nativeOrder()
-            Assert.assertNotEquals(ByteOrder.nativeOrder(), ByteOrder.BIG_ENDIAN);
+        // Will be opened with native byte order.
+        try (ImageReader nativeReader = ImageReader.open(imageFile)) {
+            // Just ensure something works as expected.
+            Assert.assertNotNull(nativeReader.findNode("/"));
+        } catch (IOException expected) {
+            Assert.fail("Reader should be openable with native byte order.");
         }
 
-        nativeReader.close();
+        // Reader should not be openable with the wrong byte order.
+        ByteOrder otherOrder = ByteOrder.nativeOrder() == BIG_ENDIAN ? LITTLE_ENDIAN : BIG_ENDIAN;
+        Assert.assertThrows(IOException.class, () -> ImageReader.open(imageFile, otherOrder));
     }
-    // main method to run standalone from jtreg
 
-    @Test(enabled=false)
+    // main method to run standalone from jtreg
+    @Test(enabled = false)
     @Parameters({"x"})
     @SuppressWarnings("raw_types")
     public static void main(@Optional String[] args) {
diff --git a/test/jdk/tools/jimage/ImageReaderDuplicateChildNodesTest.java b/test/jdk/tools/jimage/ImageReaderDuplicateChildNodesTest.java
index bec32bee0f8..8656a4a3d00 100644
--- a/test/jdk/tools/jimage/ImageReaderDuplicateChildNodesTest.java
+++ b/test/jdk/tools/jimage/ImageReaderDuplicateChildNodesTest.java
@@ -68,17 +68,17 @@ public static void main(final String[] args) throws Exception {
                         + " in " + imagePath);
             }
             // now verify that the parent node which is a directory, doesn't have duplicate children
-            final List<ImageReader.Node> children = parent.getChildren();
-            if (children == null || children.isEmpty()) {
+            final List<String> childNames = parent.getChildNames().toList();
+            if (childNames.isEmpty()) {
                 throw new RuntimeException("ImageReader did not return any child resources under "
                         + integersParentResource + " in " + imagePath);
             }
             final Set<ImageReader.Node> uniqueChildren = new HashSet<>();
-            for (final ImageReader.Node child : children) {
-                final boolean unique = uniqueChildren.add(child);
+            for (final String childName : childNames) {
+                final boolean unique = uniqueChildren.add(reader.findNode(childName));
                 if (!unique) {
                     throw new RuntimeException("ImageReader returned duplicate child resource "
-                            + child + " under " + parent + " from image " + imagePath);
+                            + childName + " under " + parent + " from image " + imagePath);
                 }
             }
         }
diff --git a/test/langtools/tools/javac/api/file/SJFM_TestBase.java b/test/langtools/tools/javac/api/file/SJFM_TestBase.java
index fb3860edb75..52fd36afc5d 100644
--- a/test/langtools/tools/javac/api/file/SJFM_TestBase.java
+++ b/test/langtools/tools/javac/api/file/SJFM_TestBase.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2014, 2019, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2014, 2025, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -37,6 +37,7 @@
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.List;
+import java.util.Map;
 import java.util.stream.Collectors;
 import java.util.zip.ZipEntry;
 import java.util.zip.ZipOutputStream;
@@ -160,7 +161,7 @@ List<Path> getTestFilePaths() throws IOException {
     List<Path> getTestZipPaths() throws IOException {
         if (zipfs == null) {
             Path testZip = createSourceZip();
-            zipfs = FileSystems.newFileSystem(testZip);
+            zipfs = FileSystems.newFileSystem(testZip, Map.of("accessMode", "readOnly"));
             closeables.add(zipfs);
             zipPaths = Files.list(zipfs.getRootDirectories().iterator().next())
                 .filter(p -> p.getFileName().toString().endsWith(".java"))
diff --git a/test/langtools/tools/javac/platform/VerifyCTSymClassFiles.java b/test/langtools/tools/javac/platform/VerifyCTSymClassFiles.java
index 3c563904b16..aeafb1ee08b 100644
--- a/test/langtools/tools/javac/platform/VerifyCTSymClassFiles.java
+++ b/test/langtools/tools/javac/platform/VerifyCTSymClassFiles.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2024, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2024, 2025, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -23,10 +23,11 @@
 
 /**
  * @test
- * @bug 8331027
+ * @bug 8331027 8356645
  * @summary Verify classfile inside ct.sym
  * @library /tools/lib
  * @modules jdk.compiler/com.sun.tools.javac.api
+ *          jdk.compiler/com.sun.tools.javac.file
  *          jdk.compiler/com.sun.tools.javac.main
  *          jdk.compiler/com.sun.tools.javac.platform
  *          jdk.compiler/com.sun.tools.javac.util:+open
@@ -44,6 +45,7 @@
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.nio.file.Paths;
+import java.util.Map;
 
 public class VerifyCTSymClassFiles {
 
@@ -60,7 +62,13 @@ void checkClassFiles() throws IOException {
             //no ct.sym, nothing to check:
             return ;
         }
-        try (FileSystem fs = FileSystems.newFileSystem(ctSym)) {
+        // Expected to always be a ZIP filesystem.
+        Map<String, ?> env = Map.of("accessMode", "readOnly");
+        try (FileSystem fs = FileSystems.newFileSystem(ctSym, env)) {
+            // Check that the file system is read only (not true if not a zip file system).
+            if (!fs.isReadOnly()) {
+                throw new AssertionError("Expected read-only file system");
+            }
             Files.walk(fs.getRootDirectories().iterator().next())
                  .filter(p -> Files.isRegularFile(p))
                  .forEach(p -> checkClassFile(p));