diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 350e441..bd19bf9 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -7,7 +7,7 @@ name: deploy
 # See https://docs.github.com/en/free-pro-team@latest/actions/reference/workflow-syntax-for-github-actions#filter-pattern-cheat-sheet
 on:
   push:
-    tags: '[0-9]+.[0-9]+.[0-9]+**'  # Ex. 8.272.10 or 17.0.8_p7
+    tags: '[0-9]+.[0-9]+.[0-9]+**'  # Ex. 8.272.10 or 21.0.1_p12
 
 jobs:
   deploy:
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 04705c0..9a52b07 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -25,6 +25,6 @@ jobs:
       # We can't cache Docker without using buildx because GH actions restricts /var/lib/docker
       # That's ok because DOCKER_PARENT_IMAGE is always ghcr.io and local anyway.
       - name: Test LTS JDK
-        run: build-bin/configure_test && build-bin/test 17.0.8_p7
+        run: build-bin/configure_test && build-bin/test 21.0.1_p12
       - name: Test latest JDK
         run: build-bin/configure_test && build-bin/test
diff --git a/.travis.yml b/.travis.yml
index 52b771e..2a082a4 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -2,7 +2,7 @@
 arch:  # only test archs not already tested with GH actions
   - arm64
   - s390x
-os: linux   # required for arch different than amd64
+os: linux   # required for arch different from amd64
 dist: focal # newest available distribution
 language: bash
 services: docker
@@ -19,7 +19,7 @@ before_install: |  # Prevent test build of a documentation-only change.
 install: ./build-bin/configure_test
 script:
   # Test LTS JDK
-  - ./build-bin/test 17.0.8_p7
+  - ./build-bin/test 21.0.1_p12
   # Test latest JDK
   - ./build-bin/test
 
diff --git a/Dockerfile b/Dockerfile
index 9ca6b67..7db21fd 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -6,15 +6,15 @@
 # docker_parent_image is the base layer of full and jre image
 #
 # Use latest version here: https://github.com/orgs/openzipkin/packages/container/package/alpine
-ARG docker_parent_image=ghcr.io/openzipkin/alpine:3.18.2
+ARG docker_parent_image=ghcr.io/openzipkin/alpine:3.18.5
 
 # java_version is hard-coded here to allow the following to work:
 #  * `docker build https://github.com/openzipkin/docker-java.git`
 #
 # When updating, also update the README
-#  * Use current version from https://pkgs.alpinelinux.org/packages?name=openjdk17, stripping
+#  * Use current version from https://pkgs.alpinelinux.org/packages?name=openjdk21, stripping
 #    the `-rX` at the end.
-ARG java_version=17.0.8_p7
+ARG java_version=21.0.1_p12
 
 # We copy files from the context into a scratch container first to avoid a problem where docker and
 # docker-compose don't share layer hashes https://github.com/docker/compose/issues/883 normally.
@@ -29,11 +29,11 @@ FROM $docker_parent_image as base
 #  * `docker build https://github.com/openzipkin/docker-java.git`
 #
 # When updating, also update the README
-#  * Use current version from https://pkgs.alpinelinux.org/packages?name=openjdk15
+#  * Use current version from https://pkgs.alpinelinux.org/packages?name=openjdk21
 # This is defined in many places because Docker has no "env" script functionality unless you use
 # docker-compose: When updating, update everywhere.
 ARG java_version
-ARG java_home=/usr/lib/jvm/java-17-openjdk
+ARG java_home=/usr/lib/jvm/java-21-openjdk
 LABEL java-version=$java_version
 LABEL java-home=$java_home
 
@@ -50,7 +50,7 @@ ENTRYPOINT ["java", "-jar"]
 FROM base as jdk
 LABEL org.opencontainers.image.description="OpenJDK on Alpine Linux"
 ARG java_version
-ARG maven_version=3.8.8
+ARG maven_version=3.9.6
 LABEL maven-version=$maven_version
 
 COPY --from=code /code/install.sh .
@@ -61,11 +61,8 @@ FROM jdk as install
 
 WORKDIR /install
 
-# Opt out of --strip-debug when openjdk15+arm64 per https://github.com/openzipkin/docker-java/issues/34
-# This is because we cannot set the following in jlink -Djdk.lang.Process.launchMechanism=vfork
-RUN if [ -d "/usr/lib/jvm/java-17-openjdk" ] && uname -m | grep -E 'aarch64|s390x'; then strip=""; else strip="--strip-debug"; fi && \
-# Included modules cherry-picked from https://docs.oracle.com/en/java/javase/15/docs/api/
-jlink --vm=server --no-header-files --no-man-pages --compress=0 ${strip} --add-modules \
+# Included modules cherry-picked from https://docs.oracle.com/en/java/javase/21/docs/api/
+RUN jlink --vm=server --no-header-files --no-man-pages --compress=0 --strip-debug --add-modules \
 java.base,java.logging,\
 # java.desktop includes java.beans which is used by Spring
 java.desktop,\
diff --git a/README.md b/README.md
index 1666299..072cf64 100644
--- a/README.md
+++ b/README.md
@@ -5,7 +5,7 @@
 
 GitHub Container Registry: [ghcr.io/openzipkin/java](https://github.com/orgs/openzipkin/packages/container/package/java) includes:
  * `master` tag: latest commit
- * `MAJOR.MINOR.PATCH` tag: release corresponding to a [Current OpenJDK Version](https://pkgs.alpinelinux.org/packages?name=openjdk15)
+ * `MAJOR.MINOR.PATCH` tag: release corresponding to a [Current OpenJDK Version](https://pkgs.alpinelinux.org/packages?name=openjdk21)
 
 Tags ending in `-jre` include only a JRE where unqualified tags include the full JDK, Maven, and a
 few build utilities.
@@ -15,27 +15,27 @@ This is an internal base layer primarily used in [zipkin](https://github.com/ope
 
 To try the image, run the `java -version` command:
 ```bash
-docker run --rm ghcr.io/openzipkin/java:17.0.8_p7 -version
-openjdk version "17.0.5" 2022-10-18
-OpenJDK Runtime Environment (build 17.0.5+8-alpine-r2)
-OpenJDK 64-Bit Server VM (build 17.0.5+8-alpine-r2, mixed mode, sharing)
+docker run --rm ghcr.io/openzipkin/java:21.0.1_p12 -version
+openjdk version "21.0.1" 2023-10-17
+OpenJDK Runtime Environment (build 21.0.1+12-alpine-r0)
+OpenJDK 64-Bit Server VM (build 21.0.1+12-alpine-r0, mixed mode, sharing)
 ```
 
 ## Release process
 Build the `Dockerfile` using the current version without the revision classifier from here:
- * https://pkgs.alpinelinux.org/packages?name=openjdk15
+ * https://pkgs.alpinelinux.org/packages?name=openjdk21
 ```bash
-# Note 17.0.8_p7 not 17.0.8_p7-r0!
-./build-bin/build 17.0.8_p7
+# Note 21.0.1_p12 not 21.0.1_p12-r0!
+./build-bin/build 21.0.1_p12
 ```
 
 Next, verify the built image matches that version:
 ```bash
 docker run --rm openzipkin/java:test -version
-openjdk version "17.0.5" 2022-10-18
-OpenJDK Runtime Environment (build 17.0.5+8-alpine-r2)
-OpenJDK 64-Bit Server VM (build 17.0.5+8-alpine-r2, mixed mode, sharing)
+openjdk version "21.0.1" 2023-10-17
+OpenJDK Runtime Environment (build 21.0.1+12-alpine-r0)
+OpenJDK 64-Bit Server VM (build 21.0.1+12-alpine-r0, mixed mode, sharing)
 ```
 
-To release the image, push a tag matching the arg to `build-bin/build` (ex `17.0.8_p7`).
+To release the image, push a tag matching the arg to `build-bin/build` (ex `21.0.1_p12`).
 This triggers a [GitHub Actions](https://github.com/openzipkin/docker-java/actions) job to push the image.
diff --git a/build-bin/README.md b/build-bin/README.md
index 2090c25..a3618bd 100644
--- a/build-bin/README.md
+++ b/build-bin/README.md
@@ -141,7 +141,7 @@ explicitly defined and `on.tags` is a [glob pattern](https://docs.github.com/en/
 ```yaml
 on:
   push:
-    tags: '[0-9]+.[0-9]+.[0-9]+**'  # Ex. 8.272.10 or 17.0.8_p7
+    tags: '[0-9]+.[0-9]+.[0-9]+**'  # Ex. 8.272.10 or 21.0.1_p12
     branches: master
 
 jobs:
@@ -203,7 +203,7 @@ jobs:
         - if [ "${SHOULD_DEPLOY}" != "true" ]; then travis_terminate 0; fi
         - travis_wait ./build-bin/deploy master
     - stage: deploy
-      # Ex. 8.272.10 or 17.0.8_p7
+      # Ex. 8.272.10 or 21.0.1_p12
       if: tag =~ /^[0-9]+\.[0-9]+\.[0-9]+/ AND type = push AND env(GH_TOKEN) IS present
       install: ./build-bin/configure_deploy
       script: ./build-bin/deploy ${TRAVIS_TAG}
diff --git a/build-bin/docker/docker_args b/build-bin/docker/docker_args
index 0a6f58b..f51a516 100755
--- a/build-bin/docker/docker_args
+++ b/build-bin/docker/docker_args
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright 2019-2020 The OpenZipkin Authors
+# Copyright 2019-2023 The OpenZipkin Authors
 #
 # Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except
 # in compliance with the License. You may obtain a copy of the License at
@@ -46,7 +46,7 @@ if [ -n "${DOCKER_TARGET}" ]; then
 fi
 
 # When non-empty, becomes the base layer including tag appropriate for the image being built.
-# Ex. ghcr.io/openzipkin/java:17.0.8_p7-jre
+# Ex. ghcr.io/openzipkin/java:21.0.1_p12-jre
 #
 # This is not required to be a base (FROM scratch) image like ghcr.io/openzipkin/alpine:3.12.3
 # See https://docs.docker.com/glossary/#parent-image
@@ -60,7 +60,7 @@ if [ -n "${ALPINE_VERSION}" ]; then
   docker_args="${docker_args} --build-arg alpine_version=${ALPINE_VERSION}"
 fi
 
-# When non-empty, becomes the build-arg java_version. Ex. "17.0.8_p7"
+# When non-empty, becomes the build-arg java_version. Ex. "21.0.1_p12"
 # Used to align base layers from https://github.com/orgs/openzipkin/packages/container/package/java
 if [ -n "${JAVA_VERSION}" ]; then
   docker_args="${docker_args} --build-arg java_version=${JAVA_VERSION}"
diff --git a/install.sh b/install.sh
index 8e72d08..e40f61f 100755
--- a/install.sh
+++ b/install.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright 2019-2020 The OpenZipkin Authors
+# Copyright 2019-2023 The OpenZipkin Authors
 #
 # Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except
 # in compliance with the License. You may obtain a copy of the License at
@@ -13,8 +13,8 @@
 # the License.
 
 # Install OS packages that support most software we build
-# * openjdk15-jdk: smaller than openjdk15, which includes docs and demos
-# * openjdk15-jmods: needed for module support
+# * openjdk21-jdk: smaller than openjdk21, which includes docs and demos
+# * openjdk21-jmods: needed for module support
 # * binutils: needed for some node modules and jlink --strip-debug
 # * tar: BusyBox built-in tar doesn't support --strip=1
 # * wget: BusyBox built-in wget doesn't support --tries=3
@@ -27,8 +27,8 @@ function maybe_log_crash() {
   (cat $(ls hs_err_pid*.log) 2>&- || true) && exit 1;
 }
 
-java_version=${1?java_version is required. ex 17.0.8_p7}
-maven_version=${2?maven_version is required. ex 3.6.3}
+java_version=${1?java_version is required. ex --strip-debug}
+maven_version=${2?maven_version is required. ex 3.9.6}
 java_major_version=$(echo ${java_version}| cut -f1 -d .)
 package=openjdk${java_major_version}
 
@@ -53,5 +53,5 @@ apache_backup_mirror=https://downloads.apache.org/
 (wget ${apache_mirror}${maven_dist_path} || wget ${apache_backup_mirror}${maven_dist_path}) | tar xz --strip=1 -C maven
 ln -s ${PWD}/maven/bin/mvn /usr/bin/mvn
 
-mvn -q --batch-mode org.apache.maven.plugins:maven-help-plugin:3.2.0:evaluate -Dexpression=maven.version -q -DforceStdout || maybe_log_crash
-mvn -q --batch-mode org.apache.maven.plugins:maven-dependency-plugin:3.1.2:get -Dmdep.skip
+mvn -q --batch-mode org.apache.maven.plugins:maven-help-plugin:3.4.0:evaluate -Dexpression=maven.version -q -DforceStdout || maybe_log_crash
+mvn -q --batch-mode org.apache.maven.plugins:maven-dependency-plugin:3.6.1:get -Dmdep.skip