diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index e61d0e97f..a74209b89 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,4 +1,4 @@
-# https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+# https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference
 version: 2
 updates:
 - package-ecosystem: github-actions
diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
index ced5f6d05..57cf3fc93 100644
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -1,11 +1,11 @@
-# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions
+# https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax
 name: Validate
 
-on:
+on:  # https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows
   push:
     branches-ignore:  # build all branches except:
     - 'dependabot/**'  # prevent workflow being triggered twice (once for commit to the branch and once for opening/syncing the PR)
-    tags-ignore: # don't build tags
+    tags-ignore:  # don't build tags
     - '**'
     paths-ignore:
     - '**/*.md'
@@ -18,27 +18,99 @@ on:
     - '.editorconfig'
     - '.git*'
     - '.github/*.yml'
-  workflow_dispatch:  # https://github.blog/changelog/2020-07-06-github-actions-manual-triggers-with-workflow_dispatch/
+  workflow_dispatch:
+    # https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#workflow_dispatch
+    inputs:
+      debug-with-ssh:
+        description: "When to open an SSH session for post-build debugging:"
+        default: never
+        type: choice
+        options: [ always, on_failure, on_failure_or_cancelled, never ]
+      debug-with-ssh-only-for-actor:
+        description: "Restrict SSH debug session access to the GitHub user who triggered the workflow"
+        default: true
+        type: boolean
+
+
+defaults:
+  run:
+    shell: bash
+
 
 jobs:
+
+  ###########################################################
   build:
-    runs-on: ${{ matrix.os }}
+  ###########################################################
 
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest]
+        os:  # https://github.com/actions/runner-images#available-images
+        - ubuntu-latest
+        - macos-15-intel # Intel
+        - macos-latest # ARM
+        - windows-latest
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 20
 
     steps:
+    - name: "Show: GitHub context"
+      env:
+        GITHUB_CONTEXT: ${{ toJSON(github) }}
+      run: echo $GITHUB_CONTEXT
+
+
+    - name: "Show: environment variables"
+      run: env | sort
+
+
     - name: Git Checkout
-      uses: actions/checkout@v4  # https://github.com/actions/checkout
+      uses: actions/checkout@v5  # https://github.com/actions/checkout
+
 
-    - name: Set up JDK 11 ☕
-      uses: actions/setup-java@v4
+    - name: "Install: JDK 11 ☕ for compilation/tests"
+      uses: actions/setup-java@v5  # https://github.com/actions/setup-java
       with:
+        distribution: temurin
         java-version: 11
-        distribution: 'temurin'
         cache: gradle
 
+
+    - name: "Install: JDK 17 ☕ for running gradle"
+      uses: actions/setup-java@v5  # https://github.com/actions/setup-java
+      with:
+        distribution: temurin
+        java-version: 17
+        cache: gradle
+
+
     - name: Build with Gradle 🏗️
       run: ./gradlew build
+
+
+    ##################################################
+    # Setup SSH debug session
+    ##################################################
+    - name: "SSH session for debugging: check"
+      id: DEBUG_SSH_SESSSION_CHECK
+      if: always()
+      run: |
+        set -eu
+
+        when="${{ inputs.debug-with-ssh }}"
+
+        if [[ $when == "always" ]] || case "${{ job.status }}" in
+          success)   [[ $when == "always" ]] ;;
+          cancelled) [[ $when == "on_failure_or_cancelled" ]] ;;
+          failure)   [[ $when == "on_failure"* ]] ;;
+        esac; then
+          echo "start_ssh_session=true" | tee -a "$GITHUB_OUTPUT"
+        fi
+
+
+    - name: "SSH session for debugging: start"
+      uses: mxschmitt/action-tmate@v3  # https://github.com/mxschmitt/action-tmate
+      if: always() && steps.DEBUG_SSH_SESSSION_CHECK.outputs.start_ssh_session
+      with:
+        limit-access-to-actor: ${{ inputs.debug-with-ssh-only-for-actor }}
diff --git a/gradle.properties b/gradle.properties
new file mode 100644
index 000000000..3ab723216
--- /dev/null
+++ b/gradle.properties
@@ -0,0 +1,9 @@
+org.gradle.daemon=false
+org.gradle.java.installations.auto-detect=true
+org.gradle.java.installations.auto-download=true
+
+# Optionally, you can hint custom JDK locations (semicolon-separated on Windows):
+# org.gradle.java.installations.paths=C:\\jdks\\jdk-11;C:\\jdks\\jdk-21
+
+# To run Gradle itself on a specific JDK (machine-specific), prefer setting JAVA_HOME
+# before invoking Gradle or use --java-home on the command line.
diff --git a/gradle/java-compiler-settings.gradle b/gradle/java-compiler-settings.gradle
index 42af5f1db..3d9363693 100644
--- a/gradle/java-compiler-settings.gradle
+++ b/gradle/java-compiler-settings.gradle
@@ -10,8 +10,14 @@
  * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
  ******************************************************************************/
 
+// Use central version from gradle/versions.gradle
+
 java {
-	sourceCompatibility = JavaVersion.VERSION_11
+	sourceCompatibility = JavaVersion.toVersion(versions.java)
+	// Use same Java version for compilation and task launches
+	toolchain {
+		languageVersion = JavaLanguageVersion.of(versions.java as Integer)
+	}
 }
 
 tasks.withType(Javadoc) {
@@ -21,6 +27,15 @@ tasks.withType(Javadoc) {
 
 tasks.withType(JavaCompile) {
 	options.encoding = 'UTF-8'
+	// Ensure cross-compilation targets specified Java version
+	options.release = versions.java as Integer
+}
+
+// Ensure tests run on the targeted JDK (not the Gradle JVM)
+tasks.withType(Test).configureEach {
+	javaLauncher = javaToolchains.launcherFor {
+		languageVersion = JavaLanguageVersion.of(versions.java as Integer)
+	}
 }
 
 task sourcesJar(type: Jar, dependsOn: classes) {
diff --git a/gradle/manifest-gen.gradle b/gradle/manifest-gen.gradle
index 91f98ab4d..6e2ff592e 100644
--- a/gradle/manifest-gen.gradle
+++ b/gradle/manifest-gen.gradle
@@ -21,7 +21,7 @@ def qualifiedVersion = baseVersion + '.v' + buildTime
 jar.bundle.bnd (
 	'Bundle-Version': qualifiedVersion,
 	'Bundle-Vendor': 'Eclipse LSP4J',
-	'Bundle-RequiredExecutionEnvironment': 'JavaSE-11',
+	'Bundle-RequiredExecutionEnvironment': "JavaSE-${versions.java}",
 	"-exportcontents": "org.eclipse.lsp4j.*",
 	"-savemanifest": "build/tmp/bnd/MANIFEST.MF",
 )
diff --git a/gradle/versions.gradle b/gradle/versions.gradle
index 54f362319..c45e663f0 100644
--- a/gradle/versions.gradle
+++ b/gradle/versions.gradle
@@ -12,7 +12,9 @@
 
 version = '1.0.0-SNAPSHOT'
 
-ext.versions = [
+ext.versions = [
+	'java': 11,
+
 	'xtend_lib': '2.32.0',
 	'guava': '[32.1.2,34)',
 	'gson': '[2.9.1,3.0)',
diff --git a/org.eclipse.lsp4j/build.gradle b/org.eclipse.lsp4j/build.gradle
index a1ef18ead..df008fb7c 100644
--- a/org.eclipse.lsp4j/build.gradle
+++ b/org.eclipse.lsp4j/build.gradle
@@ -1,23 +1,18 @@
 /******************************************************************************
  * Copyright (c) 2016 TypeFox and others.
- * 
+ *
  * This program and the accompanying materials are made available under the
  * terms of the Eclipse Public License v. 2.0 which is available at
  * http://www.eclipse.org/legal/epl-2.0,
  * or the Eclipse Distribution License v. 1.0 which is available at
  * http://www.eclipse.org/org/documents/edl-v10.php.
- * 
+ *
  * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
  ******************************************************************************/
 
 ext.title = 'LSP4J'
 description = 'Java bindings for the Language Server Protocol'
 
-java {
-	sourceCompatibility = JavaVersion.VERSION_11
-	targetCompatibility = JavaVersion.VERSION_11
-}
-
 dependencies {
 	compileOnly project(":org.eclipse.lsp4j.generator")
 	api project(":org.eclipse.lsp4j.jsonrpc")