diff --git a/.github/workflows/PR-Demo-Comment-with-react.yml b/.github/workflows/PR-Demo-Comment-with-react.yml
index 4e72e57bf..519ad8975 100644
--- a/.github/workflows/PR-Demo-Comment-with-react.yml
+++ b/.github/workflows/PR-Demo-Comment-with-react.yml
@@ -222,7 +222,7 @@ jobs:
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
         with:
-          gradle-version: 9.3.1
+          gradle-version: 9.5.1
 
       - name: Install Task
         uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
diff --git a/.github/workflows/ai-engine.yml b/.github/workflows/ai-engine.yml
index 9c701a5a6..46e0262a6 100644
--- a/.github/workflows/ai-engine.yml
+++ b/.github/workflows/ai-engine.yml
@@ -43,7 +43,7 @@ jobs:
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
         with:
-          gradle-version: 9.3.1
+          gradle-version: 9.5.1
 
       - name: Install Task
         uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
diff --git a/.github/workflows/backend-build.yml b/.github/workflows/backend-build.yml
index 8d3023a89..f90c42d2a 100644
--- a/.github/workflows/backend-build.yml
+++ b/.github/workflows/backend-build.yml
@@ -58,7 +58,7 @@ jobs:
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
         with:
-          gradle-version: 9.3.1
+          gradle-version: 9.5.1
           cache-disabled: true
 
       - name: Install Task
diff --git a/.github/workflows/check-licence.yml b/.github/workflows/check-licence.yml
index 400bdc94a..dd2475906 100644
--- a/.github/workflows/check-licence.yml
+++ b/.github/workflows/check-licence.yml
@@ -40,7 +40,7 @@ jobs:
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
         with:
-          gradle-version: 9.3.1
+          gradle-version: 9.5.1
           cache-disabled: true
 
       - name: Install Task
diff --git a/.github/workflows/check-openapi.yml b/.github/workflows/check-openapi.yml
index c6d4731cd..984502474 100644
--- a/.github/workflows/check-openapi.yml
+++ b/.github/workflows/check-openapi.yml
@@ -45,7 +45,7 @@ jobs:
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
         with:
-          gradle-version: 9.3.1
+          gradle-version: 9.5.1
           cache-disabled: true
 
       - name: Install Task
diff --git a/.github/workflows/db-migration-test.yml b/.github/workflows/db-migration-test.yml
index 2a386d1a5..114855c4b 100644
--- a/.github/workflows/db-migration-test.yml
+++ b/.github/workflows/db-migration-test.yml
@@ -48,7 +48,7 @@ jobs:
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
         with:
-          gradle-version: 9.3.1
+          gradle-version: 9.5.1
           cache-disabled: true
 
       # No `-PnoSpotless` here yet because the upstream cache layer matches the
diff --git a/.github/workflows/docker-compose-tests.yml b/.github/workflows/docker-compose-tests.yml
index 69031fed5..add65d6a8 100644
--- a/.github/workflows/docker-compose-tests.yml
+++ b/.github/workflows/docker-compose-tests.yml
@@ -61,7 +61,7 @@ jobs:
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
         with:
-          gradle-version: 9.3.1
+          gradle-version: 9.5.1
           cache-disabled: true
 
       - name: Set up Docker Buildx
diff --git a/.github/workflows/frontend-backend-licenses-update.yml b/.github/workflows/frontend-backend-licenses-update.yml
index 9c530944a..0eaab674e 100644
--- a/.github/workflows/frontend-backend-licenses-update.yml
+++ b/.github/workflows/frontend-backend-licenses-update.yml
@@ -349,7 +349,7 @@ jobs:
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
         with:
-          gradle-version: 9.3.1
+          gradle-version: 9.5.1
 
       - name: Install Task
         uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
diff --git a/.github/workflows/multiOSReleases.yml b/.github/workflows/multiOSReleases.yml
index 32c97022a..7d7600936 100644
--- a/.github/workflows/multiOSReleases.yml
+++ b/.github/workflows/multiOSReleases.yml
@@ -73,7 +73,7 @@ jobs:
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
         with:
-          gradle-version: 9.3.1
+          gradle-version: 9.5.1
 
       - name: Install Task
         uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
@@ -148,7 +148,7 @@ jobs:
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
         with:
-          gradle-version: 9.3.1
+          gradle-version: 9.5.1
 
       - name: Setup Node.js
         if: matrix.variant.build_frontend == true
@@ -252,7 +252,7 @@ jobs:
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
         with:
-          gradle-version: 9.3.1
+          gradle-version: 9.5.1
 
       - name: Install Task
         uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
diff --git a/.github/workflows/push-docker.yml b/.github/workflows/push-docker.yml
index c637b9158..6ee9f89f4 100644
--- a/.github/workflows/push-docker.yml
+++ b/.github/workflows/push-docker.yml
@@ -78,7 +78,7 @@ jobs:
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
         with:
-          gradle-version: 9.3.1
+          gradle-version: 9.5.1
 
       - name: Set up Docker Buildx
         id: buildx
diff --git a/.github/workflows/swagger.yml b/.github/workflows/swagger.yml
index 295498e57..31e66325c 100644
--- a/.github/workflows/swagger.yml
+++ b/.github/workflows/swagger.yml
@@ -48,7 +48,7 @@ jobs:
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
         with:
-          gradle-version: 9.3.1
+          gradle-version: 9.5.1
 
       - name: Generate Swagger documentation
         run: ./gradlew :stirling-pdf:generateOpenApiDocs
diff --git a/.github/workflows/tauri-build.yml b/.github/workflows/tauri-build.yml
index 82dc1b63f..f26f59efd 100644
--- a/.github/workflows/tauri-build.yml
+++ b/.github/workflows/tauri-build.yml
@@ -136,7 +136,7 @@ jobs:
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
         with:
-          gradle-version: 9.3.1
+          gradle-version: 9.5.1
 
       - name: Setup Task
         uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
diff --git a/.github/workflows/test-build-docker.yml b/.github/workflows/test-build-docker.yml
index 9d9c8f2bf..f020e5a0e 100644
--- a/.github/workflows/test-build-docker.yml
+++ b/.github/workflows/test-build-docker.yml
@@ -106,7 +106,7 @@ jobs:
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
         with:
-          gradle-version: 9.3.1
+          gradle-version: 9.5.1
           cache-disabled: true
 
       - name: Install Task
diff --git a/.github/workflows/testdriver.yml b/.github/workflows/testdriver.yml
index 350d6c077..7d5036964 100644
--- a/.github/workflows/testdriver.yml
+++ b/.github/workflows/testdriver.yml
@@ -51,7 +51,7 @@ jobs:
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
         with:
-          gradle-version: 9.3.1
+          gradle-version: 9.5.1
 
       - name: Build with Gradle
         run: ./gradlew build
diff --git a/.taskfiles/desktop.yml b/.taskfiles/desktop.yml
index 4cd4c017f..0b37df9f6 100644
--- a/.taskfiles/desktop.yml
+++ b/.taskfiles/desktop.yml
@@ -127,14 +127,15 @@ tasks:
     cmds:
       - rm -rf runtime/jre
       - mkdir -p runtime
-      - >-
-        jlink
-        --add-modules {{.JLINK_MODULES}}
-        --strip-debug
-        --compress=zip-6
-        --no-header-files
-        --no-man-pages
-        --output runtime/jre
+      - |
+        JLINK_COMPRESS="$(jlink --help 2>&1 | grep -q 'zip-\[0-9\]' && echo zip-6 || echo 2)"
+        jlink \
+          --add-modules {{.JLINK_MODULES}} \
+          --strip-debug \
+          --compress="$JLINK_COMPRESS" \
+          --no-header-files \
+          --no-man-pages \
+          --output runtime/jre
       # jlink emits its files mode 444 (read-only). Tauri's build-script
       # resource copier preserves source permissions when staging
       # `runtime/jre/**/*` into `target/<profile>/runtime/jre/...`, so the
diff --git a/docker/embedded/Dockerfile b/docker/embedded/Dockerfile
index 89913af09..1e65d0432 100644
--- a/docker/embedded/Dockerfile
+++ b/docker/embedded/Dockerfile
@@ -5,7 +5,7 @@ ARG BASE_VERSION=1.0.2
 ARG BASE_IMAGE=stirlingtools/stirling-pdf-base:${BASE_VERSION}
 
 # Stage 1: Build the Java application and frontend
-FROM gradle:9.3.1-jdk25@sha256:85aec999629f4774a383cb792da4b598bdf5a7e69c4b9570bb70c0f919179183 AS app-build
+FROM gradle:9.5.1-jdk25@sha256:8de3543f1772bb66be3b275893e5977b6d8bd2b0d25551faa5846a821d1f0600 AS app-build
 
 ARG TASK_VERSION=3.49.1
 RUN apt-get update \
diff --git a/docker/embedded/Dockerfile.fat b/docker/embedded/Dockerfile.fat
index f9754b472..3a33f9677 100644
--- a/docker/embedded/Dockerfile.fat
+++ b/docker/embedded/Dockerfile.fat
@@ -6,7 +6,7 @@ ARG BASE_VERSION=1.0.2
 ARG BASE_IMAGE=stirlingtools/stirling-pdf-base:${BASE_VERSION}
 
 # Stage 1: Build the Java application and frontend
-FROM gradle:9.3.1-jdk25 AS app-build
+FROM gradle:9.5.1-jdk25@sha256:8de3543f1772bb66be3b275893e5977b6d8bd2b0d25551faa5846a821d1f0600 AS app-build
 
 ARG TASK_VERSION=3.49.1
 RUN apt-get update \
diff --git a/docker/embedded/Dockerfile.ultra-lite b/docker/embedded/Dockerfile.ultra-lite
index d091d7b3f..dabddbc6f 100644
--- a/docker/embedded/Dockerfile.ultra-lite
+++ b/docker/embedded/Dockerfile.ultra-lite
@@ -2,7 +2,7 @@
 # Single JAR contains both frontend and backend with minimal dependencies
 
 # Stage 1: Build application with embedded frontend
-FROM gradle:9.3.1-jdk25 AS build
+FROM gradle:9.5.1-jdk25@sha256:8de3543f1772bb66be3b275893e5977b6d8bd2b0d25551faa5846a821d1f0600 AS build
 
 # Install Node.js and npm for frontend build
 ARG TASK_VERSION=3.49.1
diff --git a/frontend/editor/scripts/build-universal-mac-jre.sh b/frontend/editor/scripts/build-universal-mac-jre.sh
index baf66016b..f459bf7b6 100755
--- a/frontend/editor/scripts/build-universal-mac-jre.sh
+++ b/frontend/editor/scripts/build-universal-mac-jre.sh
@@ -48,11 +48,18 @@ X64_JRE="$WORK_DIR/jre-x86_64"
 run_jlink() {
   local java_home="$1"
   local out="$2"
+  local compress
+  if "$java_home/bin/jlink" --help 2>&1 | grep -q 'zip-\[0-9\]'; then
+    compress="zip-6"
+  else
+    compress="2"
+  fi
+
   "$java_home/bin/jlink" \
     --module-path "$java_home/jmods" \
     --add-modules "$JLINK_MODULES" \
     --strip-debug \
-    --compress=zip-6 \
+    --compress="$compress" \
     --no-header-files \
     --no-man-pages \
     --output "$out"
diff --git a/gradle/wrapper/gradle-wrapper.jar b/gradle/wrapper/gradle-wrapper.jar
index 61285a659..b1b8ef56b 100644
Binary files a/gradle/wrapper/gradle-wrapper.jar and b/gradle/wrapper/gradle-wrapper.jar differ
diff --git a/gradle/wrapper/gradle-wrapper.properties b/gradle/wrapper/gradle-wrapper.properties
index 37f78a6af..df6a6ad76 100644
--- a/gradle/wrapper/gradle-wrapper.properties
+++ b/gradle/wrapper/gradle-wrapper.properties
@@ -1,7 +1,9 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-9.3.1-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-9.5.1-bin.zip
 networkTimeout=10000
+retries=0
+retryBackOffMs=500
 validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME
 zipStorePath=wrapper/dists
diff --git a/gradlew b/gradlew
index adff685a0..b9bb139f7 100755
--- a/gradlew
+++ b/gradlew
@@ -57,7 +57,7 @@
 #       Darwin, MinGW, and NonStop.
 #
 #   (3) This script is generated from the Groovy template
-#       https://github.com/gradle/gradle/blob/HEAD/platforms/jvm/plugins-application/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt
+#       https://github.com/gradle/gradle/blob/3d91ce3b8caaf77ad09f381f43615b715b53f72c/platforms/jvm/plugins-application/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt
 #       within the Gradle project.
 #
 #       You can find Gradle at https://github.com/gradle/gradle/.
diff --git a/gradlew.bat b/gradlew.bat
index c4bdd3ab8..24c62d56f 100644
--- a/gradlew.bat
+++ b/gradlew.bat
@@ -23,8 +23,8 @@
 @rem
 @rem ##########################################################################
 
-@rem Set local scope for the variables with windows NT shell
-if "%OS%"=="Windows_NT" setlocal
+@rem Set local scope for the variables, and ensure extensions are enabled
+setlocal EnableExtensions
 
 set DIRNAME=%~dp0
 if "%DIRNAME%"=="" set DIRNAME=.
@@ -51,7 +51,7 @@ echo. 1>&2
 echo Please set the JAVA_HOME variable in your environment to match the 1>&2
 echo location of your Java installation. 1>&2
 
-goto fail
+"%COMSPEC%" /c exit 1
 
 :findJavaFromJavaHome
 set JAVA_HOME=%JAVA_HOME:"=%
@@ -65,7 +65,7 @@ echo. 1>&2
 echo Please set the JAVA_HOME variable in your environment to match the 1>&2
 echo location of your Java installation. 1>&2
 
-goto fail
+"%COMSPEC%" /c exit 1
 
 :execute
 @rem Setup the command line
@@ -73,21 +73,10 @@ goto fail
 
 
 @rem Execute Gradle
-"%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -jar "%APP_HOME%\gradle\wrapper\gradle-wrapper.jar" %*
+@rem endlocal doesn't take effect until after the line is parsed and variables are expanded
+@rem which allows us to clear the local environment before executing the java command
+endlocal & "%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -jar "%APP_HOME%\gradle\wrapper\gradle-wrapper.jar" %* & call :exitWithErrorLevel
 
-:end
-@rem End local scope for the variables with windows NT shell
-if %ERRORLEVEL% equ 0 goto mainEnd
-
-:fail
-rem Set variable GRADLE_EXIT_CONSOLE if you need the _script_ return code instead of
-rem the _cmd.exe /c_ return code!
-set EXIT_CODE=%ERRORLEVEL%
-if %EXIT_CODE% equ 0 set EXIT_CODE=1
-if not ""=="%GRADLE_EXIT_CONSOLE%" exit %EXIT_CODE%
-exit /b %EXIT_CODE%
-
-:mainEnd
-if "%OS%"=="Windows_NT" endlocal
-
-:omega
+:exitWithErrorLevel
+@rem Use "%COMSPEC%" /c exit to allow operators to work properly in scripts
+"%COMSPEC%" /c exit %ERRORLEVEL%
diff --git a/scripts/db-migration/run-migration-test.sh b/scripts/db-migration/run-migration-test.sh
index 953f58712..47aeea863 100644
--- a/scripts/db-migration/run-migration-test.sh
+++ b/scripts/db-migration/run-migration-test.sh
@@ -10,6 +10,8 @@
 # Inputs:
 #   STIRLING_JAR  - path to a pre-built Stirling-PDF .jar (defaults to the
 #                   :stirling-pdf:bootJar output)
+#   JAVA_BIN      - override the Java executable used to launch the JAR
+#                   (defaults to MIGRATION_TEST_JAVA, JAVA_HOME, then PATH)
 #   FIXTURE_DIR   - override the fixture directory (rarely needed)
 #
 # Exits non-zero on any fixture failure and writes a summary to stderr.
@@ -19,6 +21,7 @@ set -euo pipefail
 REPO_ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
 FIXTURE_DIR="${FIXTURE_DIR:-$REPO_ROOT/app/proprietary/src/test/resources/db-migration-fixtures}"
 STIRLING_JAR="${STIRLING_JAR:-}"
+JAVA_BIN="${JAVA_BIN:-${MIGRATION_TEST_JAVA:-}}"
 ADMIN_USERNAME="${ADMIN_USERNAME:-admin}"
 ADMIN_PASSWORD="${ADMIN_PASSWORD:-stirling}"
 STARTUP_TIMEOUT_SEC="${STARTUP_TIMEOUT_SEC:-300}"
@@ -26,6 +29,52 @@ STARTUP_TIMEOUT_SEC="${STARTUP_TIMEOUT_SEC:-300}"
 log()  { printf '[migration-test] %s\n' "$*" >&2; }
 fail() { printf '[migration-test][FAIL] %s\n' "$*" >&2; exit 1; }
 
+java_major_version() {
+    local java_bin="$1"
+    "$java_bin" -XshowSettings:properties -version 2>&1 \
+        | awk -F'= ' '/java.specification.version =/ { print $2; exit }'
+}
+
+find_java() {
+    local candidate
+    if [[ -n "$JAVA_BIN" ]]; then
+        if [[ -x "$JAVA_BIN" ]]; then
+            candidate="$JAVA_BIN"
+        elif command -v "$JAVA_BIN" >/dev/null 2>&1; then
+            candidate=$(command -v "$JAVA_BIN")
+        else
+            fail "JAVA_BIN/MIGRATION_TEST_JAVA='$JAVA_BIN' is not executable or on PATH"
+        fi
+    elif [[ -n "${JAVA_HOME:-}" && -x "${JAVA_HOME}/bin/java" ]]; then
+        candidate="${JAVA_HOME}/bin/java"
+    else
+        local java_home_var
+        for java_home_var in JAVA_HOME_25_X64 JAVA_HOME_25_ARM64 JAVA_HOME_25_AARCH64; do
+            local java_home="${!java_home_var:-}"
+            if [[ -n "$java_home" && -x "$java_home/bin/java" ]]; then
+                candidate="$java_home/bin/java"
+                break
+            fi
+        done
+        if [[ -z "${candidate:-}" ]]; then
+            candidate=$(command -v java || true)
+        fi
+    fi
+
+    [[ -n "${candidate:-}" ]] || fail "No java executable found; install JDK 25 or set JAVA_BIN"
+    realpath "$candidate"
+}
+
+assert_supported_java() {
+    local java_bin="$1"
+    local major
+    major=$(java_major_version "$java_bin")
+    [[ -n "$major" ]] || fail "Could not determine Java version from '$java_bin'"
+    if (( major < 25 )); then
+        fail "Migration test requires JDK 25+ to run the built JAR, but '$java_bin' is Java $major. Set JAVA_HOME or JAVA_BIN to a JDK 25 installation."
+    fi
+}
+
 find_jar() {
     local candidate
     if [[ -n "$STIRLING_JAR" ]]; then
@@ -63,7 +112,9 @@ test_fixture() {
     label=$(basename "$fixture_path" .mv.db)
     log "=== $label ==="
 
-    local jar; jar=$(find_jar)
+    local jar
+    jar=$(find_jar)
+    local java_bin="$MIGRATION_JAVA_BIN"
     local workdir; workdir=$(mktemp -d)
     local configsdir="$workdir/configs"
     mkdir -p "$configsdir"
@@ -74,6 +125,7 @@ test_fixture() {
     local log_file="$workdir/app.log"
 
     log "  jar=$jar"
+    log "  java=$java_bin ($("$java_bin" -version 2>&1 | head -n 1))"
     log "  workdir=$workdir"
     log "  port=$port"
 
@@ -86,7 +138,7 @@ test_fixture() {
     # to cwd, and we want to make sure we hit the fixture's configs/ and not
     # whatever happens to live at the runner's working directory.
     pushd "$workdir" >/dev/null
-    java -Xmx1g -jar "$jar" \
+    "$java_bin" -Xmx1g -jar "$jar" \
         "--server.port=$port" \
         "--spring.datasource.url=jdbc:h2:file:./configs/stirling-pdf-DB-2.3.232;DB_CLOSE_DELAY=-1;DB_CLOSE_ON_EXIT=TRUE;MODE=PostgreSQL" \
         "--spring.jpa.show-sql=false" \
@@ -169,6 +221,9 @@ test_fixture() {
 
 main() {
     [[ -d "$FIXTURE_DIR" ]] || fail "Fixture dir not found: $FIXTURE_DIR"
+    MIGRATION_JAVA_BIN=$(find_java)
+    assert_supported_java "$MIGRATION_JAVA_BIN"
+
     local fixtures
     mapfile -t fixtures < <(find "$FIXTURE_DIR" -maxdepth 1 -name '*.mv.db' | sort)
     [[ ${#fixtures[@]} -gt 0 ]] || fail "No fixtures under $FIXTURE_DIR"