diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index b4e8c49..db13dc8 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -16,7 +16,6 @@ env:
   GO_VERSION: "1.26.1"
   ANDROID_SDK_ROOT: /opt/android-sdk
   ANDROID_NDK_ROOT: /opt/android-sdk/ndk
-  JAVA_HOME: /usr/lib/jvm/java-21-openjdk-amd64
   DIST_DIR: dist
 
 jobs:
@@ -31,6 +30,12 @@ jobs:
         with:
           go-version: ${{ env.GO_VERSION }}
 
+      - name: Setup Java
+        uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: "25"
+
       - name: Install native build dependencies
         shell: bash
         run: |
@@ -78,6 +83,12 @@ jobs:
         with:
           go-version: ${{ env.GO_VERSION }}
 
+      - name: Setup Java
+        uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: "25"
+
       - name: Install native build dependencies
         shell: bash
         run: |
diff --git a/AGENTS.md b/AGENTS.md
index 4925d1d..17557af 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -177,7 +177,7 @@ These features are product requirements, not “nice to have” ideas.
   local `ANDROID_NDK_ROOT=/opt/android-ndk`,
   CI `ANDROID_NDK_ROOT=/opt/android-sdk/ndk`,
   local `JAVA_HOME=/usr/lib/jvm/java-25-openjdk`,
-  CI `JAVA_HOME=/usr/lib/jvm/java-21-openjdk-amd64`.
+  CI `JAVA_HOME` provided by `actions/setup-java` with Temurin 25.
 - Remember the known Android runtime regression:
   `gioui.org v0.9.0` produced a black screen on the `KeepassGoAPI35` emulator, while `gioui.org v0.8.0` rendered correctly. Treat Gio upgrades on Android as regression-sensitive and verify them on-device or in the emulator.
 - When validating an APK in the emulator, prefer the known KeePassGO setup:
diff --git a/APK.md b/APK.md
index bad3187..aa0642e 100644
--- a/APK.md
+++ b/APK.md
@@ -12,10 +12,11 @@ Build the release-signed APK with:
 make apk-release
 ```
 
-`make apk` uses a supported local JDK when `JAVA_HOME` points to Java 21
-or Java 25. If the host does not have one of those working JDKs, it falls back
-to the repo-managed Docker image in `packaging/docker/android-apk/`, which
-builds with Java 25.
+`make apk` uses a local Java 25 install when `JAVA_HOME` points to one.
+If the host does not have a working Java 25 install, it falls back to the
+repo-managed Docker image in `packaging/docker/android-apk/`, which also builds
+with Java 25. CI provisions Java 25 directly in the build job so release builds
+use that same local path instead of nested Docker.
 
 `make apk` remains a developer build path and may use Gio's default debug or
 ephemeral signing behavior if no explicit signing key is provided.
@@ -26,7 +27,7 @@ Environment:
 
 - `ANDROID_SDK_ROOT` defaults to `/opt/android-sdk`.
 - `ANDROID_NDK_ROOT` defaults to `/opt/android-ndk`.
-- `JAVA_HOME` defaults to `/usr/lib/jvm/java-25-openjdk`. Local builds support Java 25 and CI builds support Java 21.
+- `JAVA_HOME` defaults to `/usr/lib/jvm/java-25-openjdk`.
 - `APK_BUILD_IMAGE` overrides the Docker image name used by `make apk-container`.
 - `APP_ID` overrides the Android application id.
 - `APP_VERSION` overrides the version shown inside KeePassGO itself.
@@ -49,7 +50,7 @@ Installed machine prerequisites expected by this repo:
 - `android-sdk-build-tools`
 - `android-platform-35`
 - `android-sdk-platform-tools`
-- a working Java 21 or Java 25 JDK install for `make apk-local`, or Docker for `make apk`
+- a working Java 25 JDK install for `make apk-local`, or Docker for `make apk`
 
 The repo tracks `gogio` as a Go tool, and the local build runs through:
 
@@ -67,8 +68,8 @@ The Android build uses the branded icon asset at:
 
 Note:
 
-- KeePassGO's documented Android build uses Java 25 locally, while CI uses Java 21.
-- If neither supported host setup is available, `make apk` falls back to the Docker image
+- KeePassGO's documented Android build uses Java 25 locally and in CI.
+- If that host setup is unavailable, `make apk` falls back to the Docker image
   so the build still runs under Java 25 instead of encoding a newer host JDK as
   a requirement.
 - Android runtime testing on the `KeepassGoAPI35` emulator showed a black-screen
diff --git a/Makefile b/Makefile
index ba4ff32..2c29c83 100644
--- a/Makefile
+++ b/Makefile
@@ -46,10 +46,10 @@ endif
 
 .PHONY: apk apk-local apk-release apk-container apk-container-image archlinux-pkgbuild browser-bridge browser-extension-validate
 apk:
-	@if [ -x "$(JAVA_HOME)/bin/java" ] && "$(JAVA_HOME)/bin/java" -version 2>&1 | grep -Eq 'version "(21|25)([."]|$$)'; then \
+	@if [ -x "$(JAVA_HOME)/bin/java" ] && "$(JAVA_HOME)/bin/java" -version 2>&1 | grep -q 'version "25'; then \
 		$(MAKE) apk-local JAVA_HOME="$(JAVA_HOME)"; \
 	else \
-		echo "Using Dockerized Java 25 Android build because JAVA_HOME is not a supported local JDK (21 or 25)."; \
+		echo "Using Dockerized Java 25 Android build because JAVA_HOME is not a working Java 25 install."; \
 		$(MAKE) apk-container; \
 	fi
 
diff --git a/README.md b/README.md
index 0f2b00e..cb24e6d 100644
--- a/README.md
+++ b/README.md
@@ -93,11 +93,11 @@ Package:
 make apk
 ```
 
-`make apk` prefers a supported local JDK at `JAVA_HOME`. Java 25 is the
-local default, and Java 21 is also supported for CI builds. If neither is
-available, it falls back to the repo-managed Docker build image, which uses
-Java 25. You still need the Android SDK and NDK installed and configured for
-real device or release packaging.
+`make apk` prefers a local Java 25 install at `JAVA_HOME`. If that is not
+available, it falls back to the repo-managed Docker build image, which also
+uses Java 25. CI provisions Java 25 directly in the build job so release
+packaging follows that same local path. You still need the Android SDK and NDK
+installed and configured for real device or release packaging.
 
 Release package: