diff --git a/.github/workflows/maven_central_release.yml b/.github/workflows/maven_central_release.yml
index 1b5d0d10..56508328 100644
--- a/.github/workflows/maven_central_release.yml
+++ b/.github/workflows/maven_central_release.yml
@@ -72,11 +72,11 @@ jobs:
           ref: ${{ inputs.source_ref }}
           fetch-depth: 0
 
-      - name: Set up Java 11
+      - name: Set up Java 8
         uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           distribution: temurin
-          java-version: "11"
+          java-version: "8"
           cache: maven
 
       - name: Resolve versions and guard against re-release
@@ -168,11 +168,15 @@ jobs:
           ref: ${{ needs.resolve.outputs.source_sha }}
           submodules: true
 
-      - name: Set up Java 11
+      - name: Set up Java 8
         uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
-          distribution: temurin
-          java-version: "11"
+          # Temurin publishes no macOS/aarch64 8u, which fails the darwin-aarch64
+          # (macos-14) leg; Zulu ships both macOS aarch64 and x64 8u. The macOS
+          # jni_md.h is ABI-identical across vendors, so building the native lib
+          # against Zulu's JDK 8 headers matches the artifact's Java 8 floor.
+          distribution: zulu
+          java-version: "8"
 
       - name: Install toolchains
         run: |
@@ -222,9 +226,16 @@ jobs:
     timeout-minutes: 60
     container:
       image: quay.io/pypa/manylinux2014_x86_64
+      # GitHub's runner now forces JS actions (actions/checkout) onto Node 24, but
+      # Node 24 needs glibc >= 2.28 while this container is glibc 2.17 -- the stock
+      # /__e/node24 binary aborts with `GLIBC_2.27'/`GLIBC_2.28' not found`. There is
+      # no glibc-2.17 build of Node 24, so shadow BOTH /__e/node20 AND /__e/node24
+      # with the glibc-2.17 Node 20 binary installed below; checkout's JS runs fine
+      # on it regardless of the runtime the runner advertises.
       volumes:
         - /node20217:/node20217
         - /node20217:/__e/node20
+        - /node20217:/__e/node24
     steps:
       - name: Install tools
         run: |
@@ -238,11 +249,14 @@ jobs:
           rpmbuild --rebuild ./nasm-2.16.03-0.fc39.src.rpm
           rpm -i ~/rpmbuild/RPMS/x86_64/nasm-2.16.03-0.el7.x86_64.rpm
 
-      - name: Install Node.js 20 glibc2.17
+      - name: Install Node.js 20 glibc2.17 (shadows /__e/node20 and /__e/node24)
         run: |
           curl -LO https://unofficial-builds.nodejs.org/download/release/v20.9.0/node-v20.9.0-linux-x64-glibc-217.tar.xz
           tar -xf node-v20.9.0-linux-x64-glibc-217.tar.xz --strip-components 1 -C /node20217
+          # The same /node20217 source is bind-mounted over both runtime paths, so the
+          # glibc-2.17 binary is what runs whether the runner picks node20 or node24.
           ldd /__e/node20/bin/node
+          ldd /__e/node24/bin/node
 
       - name: Check out release source
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
@@ -256,13 +270,15 @@ jobs:
           tar -zxf cmake-3.29.2-linux-x86_64.tar.gz
           echo "PATH=$(pwd)/cmake-3.29.2-linux-x86_64/bin/:$PATH" >> "$GITHUB_ENV"
 
-      - name: Install GraalVM JDK 25
+      - name: Install Temurin JDK 8
         run: |
-          # TODO(pin): replace /25/latest/ with an exact GraalVM build URL and verify a sha256.
-          wget -nv -O graalvm.tar.gz https://download.oracle.com/graalvm/25/latest/graalvm-jdk-25_linux-x64_bin.tar.gz
-          mkdir graalvm
-          tar xfz graalvm.tar.gz -C graalvm --strip-components=1
-          echo "JAVA_HOME=$(pwd)/graalvm" >> "$GITHUB_ENV"
+          # Build the native lib against the Java 8 JNI headers -- JDK 8 is the artifact's
+          # floor. The Adoptium "latest GA" redirect tracks the newest 8u release.
+          # TODO(pin): pin to an exact Temurin 8u build URL and verify a sha256.
+          wget -nv -O jdk8.tar.gz https://api.adoptium.net/v3/binary/latest/8/ga/linux/x64/jdk/hotspot/normal/eclipse
+          mkdir jdk8
+          tar xfz jdk8.tar.gz -C jdk8 --strip-components=1
+          echo "JAVA_HOME=$(pwd)/jdk8" >> "$GITHUB_ENV"
 
       - name: Build native library
         run: |
@@ -320,13 +336,15 @@ jobs:
           yum update -y
           yum install wget nasm zstd -y
 
-      - name: Install GraalVM JDK 25
+      - name: Install Temurin JDK 8
         run: |
-          # TODO(pin): replace /25/latest/ with an exact GraalVM build URL and verify a sha256.
-          wget -v --timeout=180 -O graalvm.tar.gz https://download.oracle.com/graalvm/25/latest/graalvm-jdk-25_linux-aarch64_bin.tar.gz
-          mkdir graalvm
-          tar xfz graalvm.tar.gz -C graalvm --strip-components=1
-          echo "JAVA_HOME=$(pwd)/graalvm" >> "$GITHUB_ENV"
+          # Build the native lib against the Java 8 JNI headers -- JDK 8 is the artifact's
+          # floor. The Adoptium "latest GA" redirect tracks the newest 8u release.
+          # TODO(pin): pin to an exact Temurin 8u build URL and verify a sha256.
+          wget -v --timeout=180 -O jdk8.tar.gz https://api.adoptium.net/v3/binary/latest/8/ga/linux/aarch64/jdk/hotspot/normal/eclipse
+          mkdir jdk8
+          tar xfz jdk8.tar.gz -C jdk8 --strip-components=1
+          echo "JAVA_HOME=$(pwd)/jdk8" >> "$GITHUB_ENV"
 
       - name: Build native library
         run: |
@@ -382,19 +400,21 @@ jobs:
           sudo apt-get update -y
           sudo apt-get install -y nasm gcc-mingw-w64 g++-mingw-w64
 
-      - name: Install GraalVM JDK 25
+      - name: Install Temurin JDK 8
         run: |
-          # TODO(pin): replace /25/latest/ with an exact GraalVM build URL and verify a sha256.
-          wget -nv -O graalvm.tar.gz https://download.oracle.com/graalvm/25/latest/graalvm-jdk-25_linux-x64_bin.tar.gz
-          mkdir graalvm
-          tar xfz graalvm.tar.gz -C graalvm --strip-components=1
-          echo "JAVA_HOME=$(pwd)/graalvm" >> "$GITHUB_ENV"
+          # Host JDK only supplies the shared JNI header (jni.h); the Windows-specific
+          # jni_md.h is fetched below. JDK 8 is the artifact's floor.
+          # TODO(pin): pin to an exact Temurin 8u build URL and verify a sha256.
+          wget -nv -O jdk8.tar.gz https://api.adoptium.net/v3/binary/latest/8/ga/linux/x64/jdk/hotspot/normal/eclipse
+          mkdir jdk8
+          tar xfz jdk8.tar.gz -C jdk8 --strip-components=1
+          echo "JAVA_HOME=$(pwd)/jdk8" >> "$GITHUB_ENV"
 
-      - name: Download Windows jni_md.h from JDK 25
+      - name: Download Windows jni_md.h from JDK 8
         run: |
           cd core
-          # TODO(pin): pin to a jdk25u tag/commit instead of the moving `master` branch.
-          curl -fsSL https://raw.githubusercontent.com/openjdk/jdk25u/master/src/java.base/windows/native/include/jni_md.h > "$JAVA_HOME/include/jni_md.h"
+          # TODO(pin): pin to a jdk8u tag/commit instead of the moving `master` branch.
+          curl -fsSL https://raw.githubusercontent.com/openjdk/jdk8u/master/jdk/src/windows/javavm/export/jni_md.h > "$JAVA_HOME/include/jni_md.h"
 
       - name: Build native library
         run: |
@@ -443,11 +463,11 @@ jobs:
         with:
           ref: ${{ needs.resolve.outputs.source_sha }}
 
-      - name: Set up Java 11
+      - name: Set up Java 8
         uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           distribution: temurin
-          java-version: "11"
+          java-version: "8"
           cache: maven
 
       - name: Download native artifacts
@@ -537,11 +557,11 @@ jobs:
             exit 1
           fi
 
-      - name: Set up Java 11
+      - name: Set up Java 8
         uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           distribution: temurin
-          java-version: "11"
+          java-version: "8"
           cache: maven
 
       - name: Download native artifacts
@@ -741,11 +761,11 @@ jobs:
           ref: ${{ inputs.source_ref }}
           fetch-depth: 0
 
-      - name: Set up Java 11
+      - name: Set up Java 8
         uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           distribution: temurin
-          java-version: "11"
+          java-version: "8"
           cache: maven
 
       - name: Open next-development-version bump PR