diff --git a/.bazelci/presubmit.yml b/.bazelci/presubmit.yml
index 68c6f3a314ffa5..a20096f6eb46c7 100644
--- a/.bazelci/presubmit.yml
+++ b/.bazelci/presubmit.yml
@@ -224,12 +224,10 @@ tasks:
       - "-//src/test/py/bazel:bazel_module_test"
       - "-//src/test/shell/integration:target_compatible_with_test"
       - "-//src/test/shell/integration:bazel_json_worker_test"
-      - "-//src/test/shell/bazel:bazel_coverage_java_jdk17_toolchain_head_test"
-      - "-//src/test/shell/bazel:bazel_java_test_jdk11_toolchain_head"
+      - "-//src/test/shell/bazel:bazel_coverage_java_jdk21_toolchain_head_test"
       # - "-//src/test/shell/bazel/android:aar_integration_test"
       - "-//src/test/shell/bazel:bazel_coverage_java_test"
-      - "-//src/test/shell/bazel:bazel_coverage_java_jdk11_toolchain_head_test"
-      - "-//src/test/shell/bazel:bazel_java_test_jdk17_toolchain_head"
+      - "-//src/test/shell/bazel:bazel_java_test_jdk21_toolchain_head"
       - "-//src/test/shell/bazel:starlark_git_repository_test"
       - "-//src/test/shell/integration:build_event_stream_test"
       - "-//third_party/ijar/test:zip_test"
@@ -239,7 +237,7 @@ tasks:
       - "-//src/test/shell/integration:bazel_sandboxed_worker_test"
       - "-//src/test/shell/integration:client_test"
       - "-//src/test/shell/bazel/remote:remote_execution_test"
-      - "-//src/test/shell/bazel:bazel_coverage_java_jdk17_toolchain_released_test"
+      - "-//src/test/shell/bazel:bazel_coverage_java_jdk21_toolchain_released_test"
       - "-//src/test/py/bazel:bazel_vendor_test"
       - "-//src/test/shell/integration:sandboxing_test"
       - "-//src/test/shell/bazel:bazel_java_test"
@@ -248,7 +246,6 @@ tasks:
       # - "-//src/test/shell/bazel/android:desugarer_integration_test_with_head_android_tools"
       - "-//src/test/py/bazel:bazel_external_repository_test"
       # - "-//src/test/shell/bazel/android:resource_processing_integration_test"
-      - "-//src/test/shell/bazel:bazel_coverage_java_jdk11_toolchain_released_test"
       # - "-//src/test/shell/bazel/android:aar_integration_test_with_head_android_tools"
       - "-//src/tools/singlejar:zip64_test"
       - "-//src/test/py/bazel:launcher_test"
diff --git a/.bazelrc b/.bazelrc
index 5ec1ee1bea97a4..a50a163827b9f7 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -50,9 +50,11 @@ build:macos --host_cxxopt=-std=c++17
 build:windows --cxxopt=/std:c++17
 build:windows --host_cxxopt=/std:c++17
 
-# Enable Java 11 language features (https://github.com/bazelbuild/bazel/issues/14592)
-build --java_language_version=11
-build --tool_java_language_version=11
+# Enable Java 21 language features
+build --java_runtime_version=21
+build --java_language_version=21
+build --tool_java_language_version=21
+build --tool_java_runtime_version=21
 
 # Fail if a glob doesn't match anything (https://github.com/bazelbuild/bazel/issues/8195)
 common --incompatible_disallow_empty_glob
diff --git a/scripts/bootstrap/buildenv.sh b/scripts/bootstrap/buildenv.sh
index 03f52c32d440b2..ca3ce104f7b5a6 100755
--- a/scripts/bootstrap/buildenv.sh
+++ b/scripts/bootstrap/buildenv.sh
@@ -77,7 +77,7 @@ function fail() {
 DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
 WORKSPACE_DIR="$(dirname "$(dirname "${DIR}")")"
 
-JAVA_VERSION=${JAVA_VERSION:-11}
+JAVA_VERSION=${JAVA_VERSION:-21}
 BAZELRC=${BAZELRC:-"/dev/null"}
 PLATFORM="$(uname -s | tr 'A-Z' 'a-z')"
 
diff --git a/src/BUILD b/src/BUILD
index 35fdc1bff1a4f3..df4201de193748 100644
--- a/src/BUILD
+++ b/src/BUILD
@@ -2,6 +2,7 @@
 
 load("@bazel_skylib//:bzl_library.bzl", "bzl_library")
 load("@rules_python//python:defs.bzl", "py_binary", "py_library")
+load("//src:build_defs.bzl", "transition_java_language_8_archive")
 load("//src:release_archive.bzl", "release_archive")
 load(":embedded_tools.bzl", "srcsfile")
 load(":rule_size_test.bzl", "rule_size_test")
@@ -488,6 +489,12 @@ release_archive(
     ],
 )
 
+transition_java_language_8_archive(
+    name = "java_tools_java8.zip",
+    archive_zip = ":java_tools.zip",
+    visibility = ["//src/test/shell/bazel:__pkg__"],
+)
+
 release_archive(
     name = "turbine_direct_graal_zip",
     srcs = ["//src/java_tools/buildjar/java/com/google/devtools/build/java/turbine:turbine_direct_graal"],
@@ -509,6 +516,12 @@ release_archive(
     ],
 )
 
+transition_java_language_8_archive(
+    name = "java_tools_prebuilt_java8.zip",
+    archive_zip = ":java_tools_prebuilt.zip",
+    visibility = ["//src/test/shell/bazel:__pkg__"],
+)
+
 # Following targets used by the java_tools_binaries Buildkite pipeline to upload
 # the java_tools_*.zip to either tmp/sources or tmp/build directories in GCS.
 sh_binary(
diff --git a/src/build_defs.bzl b/src/build_defs.bzl
index b1d3206f14cdf0..92aaa868be7f67 100644
--- a/src/build_defs.bzl
+++ b/src/build_defs.bzl
@@ -12,7 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-"""Utility for restricting java_library to Java 11 APIs."""
+"""Utility for restricting Java APIs."""
 
 load("@rules_java//java:defs.bzl", "java_library")
 
@@ -23,3 +23,46 @@ def java_11_library(**attrs):
         javacopts = javacopts + ["-source 11", "-target 11"],
         **attrs
     )
+
+_java_language_version_8_transition = transition(
+    implementation = lambda settings, attr: {
+        "//command_line_option:java_language_version": "8",
+    },
+    inputs = [],
+    outputs = ["//command_line_option:java_language_version"],
+)
+
+def _transition_java_language_8_impl(ctx):
+    archive_zip = ctx.files.archive_zip[0]
+
+    outfile = ctx.actions.declare_file(ctx.label.name)
+
+    ctx.actions.run_shell(
+        inputs = [archive_zip],
+        outputs = [outfile],
+        command = "cp %s %s" % (archive_zip.path, outfile.path),
+    )
+    return [
+        DefaultInfo(
+            files = depset([outfile]),
+        ),
+    ]
+
+_transitioned_java_8 = rule(
+    implementation = _transition_java_language_8_impl,
+    attrs = {
+        "archive_zip": attr.label(
+            allow_files = True,
+            cfg = _java_language_version_8_transition,
+            mandatory = True,
+        ),
+    },
+)
+
+# Used to transition the zip file generated by release_archive to compile at Java language 8.
+def transition_java_language_8_archive(name, archive_zip, visibility):
+    _transitioned_java_8(
+        name = name,
+        archive_zip = archive_zip,
+        visibility = visibility,
+    )
diff --git a/src/test/shell/bazel/BUILD b/src/test/shell/bazel/BUILD
index 68326cca3ba070..148b24928378cf 100644
--- a/src/test/shell/bazel/BUILD
+++ b/src/test/shell/bazel/BUILD
@@ -230,14 +230,18 @@ sh_test(
     srcs = ["bazel_java17_test.sh"],
     args = [
         # java_tools zip to test
-        "$(rlocationpath //src:java_tools_zip)",
-        "$(rlocationpath //src:java_tools_prebuilt_zip)",
+        "$(rlocationpath //src:java_tools_java8.zip)",
+        "$(rlocationpath //src:java_tools_prebuilt_java8.zip)",
     ],
     data = [
         ":gen_rules_java_repo_name",
         ":test-deps",
-        "//src:java_tools_prebuilt_zip",
-        "//src:java_tools_zip",
+        # Use java_tools compiled at Java language 8 instead (aligned with the
+        # default compilation level of java_tools). For the purpose
+        # of this test, we need java_tools to be running with runtime >11 to
+        # test the failure modes of incompatible system classpaths.
+        "//src:java_tools_prebuilt_java8.zip",
+        "//src:java_tools_java8.zip",
         "@bazel_tools//tools/bash/runfiles",
     ],
     tags = ["local"],
@@ -271,9 +275,9 @@ sh_test(
     exec_compatible_with = ["//:highcpu_machine"],
 )
 
-JAVA_VERSIONS = ("11", "17")
+JAVA_VERSIONS = ("21",)
 
-JAVA_VERSIONS_COVERAGE = ("11", "17")
+JAVA_VERSIONS_COVERAGE = ("21",)
 
 [
     sh_test(
diff --git a/src/test/shell/bazel/bazel_java17_test.sh b/src/test/shell/bazel/bazel_java17_test.sh
index a121c96c0fa9ec..a1cb3e3928ae20 100755
--- a/src/test/shell/bazel/bazel_java17_test.sh
+++ b/src/test/shell/bazel/bazel_java17_test.sh
@@ -60,6 +60,12 @@ JAVA_TOOLS_PREBUILT_ZIP="$1"; shift
 
 override_java_tools "${RULES_JAVA_REPO_NAME}" "${JAVA_TOOLS_ZIP}" "${JAVA_TOOLS_PREBUILT_ZIP}"
 
+# Override test globals that are defaulted to 21 in testenv.sh.tmpl for all
+# other tests. For the purpose of this test, we want to run java_tools at
+# runtime 11 to test for failures in incompatible system classpaths.
+add_to_bazelrc "build --java_runtime_version=11"
+add_to_bazelrc "build --tool_java_runtime_version=11"
+
 # Java source files version shall match --java_language_version_flag version.
 function test_java17_text_block() {
   mkdir -p java/main
diff --git a/src/test/shell/bazel/bazel_with_jdk_test.sh b/src/test/shell/bazel/bazel_with_jdk_test.sh
index 8ad81b77cb9620..9220e991af99f8 100755
--- a/src/test/shell/bazel/bazel_with_jdk_test.sh
+++ b/src/test/shell/bazel/bazel_with_jdk_test.sh
@@ -148,7 +148,9 @@ function test_bazel_reports_missing_local_jdk() {
   export JAVA_HOME="$PWD"
   export PATH="$PWD/bin:$PATH"
 
-  bazel build java/main:JavaExample &>"${TEST_log}" \
+  bazel build \
+      --java_runtime_version=local_jdk \
+       java/main:JavaExample &>"${TEST_log}" \
       && fail "build with missing local JDK should have failed" || true
   expect_log "Auto-Configuration Error: Cannot find Java binary"
 }
@@ -275,6 +277,7 @@ EOF
   export PATH="$PWD/jdk/bin:$PATH"
 
   bazel cquery \
+      --java_runtime_version=local_jdk \
       --toolchain_resolution_debug=tools/jdk:runtime_toolchain_type \
       //java/main:JavaExample &>"${TEST_log}" \
       || fail "Failed to resolve Java toolchain when version cannot be detected"
diff --git a/src/test/shell/testenv.sh.tmpl b/src/test/shell/testenv.sh.tmpl
index b177dc46a24164..c9fe3be52083f8 100755
--- a/src/test/shell/testenv.sh.tmpl
+++ b/src/test/shell/testenv.sh.tmpl
@@ -288,6 +288,11 @@ common --enable_bzlmod
 # Verify compatibility before the flip (https://github.com/bazelbuild/bazel/issues/12821)
 common --nolegacy_external_runfiles
 
+# Support JDK 21, data dependencies that get compiled and used tools need to be
+# run with 21 runtime.
+build --java_runtime_version=21
+build --tool_java_runtime_version=21
+
 ${EXTRA_BAZELRC:-}
 EOF
 
diff --git a/tools/jdk/BUILD.tools b/tools/jdk/BUILD.tools
index 6c869b23375e76..cfc1bc0efeb73f 100644
--- a/tools/jdk/BUILD.tools
+++ b/tools/jdk/BUILD.tools
@@ -175,10 +175,10 @@ TARGET_NAMES = [
     for version in (8, 9, 10, 11)
 ] + [
     "toolchain_jdk_%d" % version
-    for version in (14, 15, 16, 17, 20)
+    for version in (14, 15, 16, 17, 21)
 ] + [
      "toolchain_jdk_%d_definition" % version
-     for version in (14, 15, 16, 17, 20)
+     for version in (14, 15, 16, 17, 21)
 ]
 
 [