diff --git a/.bazelrc b/.bazelrc
index 95f53c2..a384e91 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -1 +1,9 @@
-build --java_runtime_version=21 --javacopt='--release 8'
+build --java_language_version=8 --tool_java_language_version=25
+build --java_runtime_version=25 --tool_java_runtime_version=25
+
+build --experimental_one_version_enforcement=error
+# TODO(cpovirk): Remove after upgrading to a version of rules_java without an
+# error_prone_annotations dep (after cl/998596263).
+build --noone_version_enforcement_on_java_tests
+
+test --test_env=TZ=UTC
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d08b19b..6006258 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -31,15 +31,15 @@ jobs:
       - name: 'Cache Bazel dependencies'
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
         with:
-          path: ~/.cache/bazel/*/*/external
+          path: ~/.cache/bazel/*/cache
           key: bazel-${{ hashFiles('MODULE.bazel') }}
           restore-keys: |
             bazel-
-      - name: 'Set up JDK ${{ matrix.java }}'
+      - name: 'Set up JDK 27'
         uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6
         with:
-          java-version: ${{ matrix.java }}
+          java-version: 27
           distribution: 'temurin'
       - name: 'Test'
         shell: bash
-        run: bazelisk test --lockfile_mode=error --test_output=errors //...
+        run: bazelisk test --java_runtime_version=${{ matrix.java }} --lockfile_mode=error --test_output=errors //...