diff --git a/.github/workflows/main.yaml b/.github/workflows/main.yaml
index a20db63..eba55e4 100644
--- a/.github/workflows/main.yaml
+++ b/.github/workflows/main.yaml
@@ -14,6 +14,7 @@ concurrency:
   cancel-in-progress: false   # let each merge finish publishing, in order
 
 jobs:
+
   build:
     name: Build & test
     runs-on: ubuntu-latest
@@ -21,9 +22,11 @@ jobs:
       - uses: actions/checkout@v7
       - uses: actions/setup-java@v6
         with:
-          java-version: '11'
+          java-version: ${{ vars.WORKING_JAVA_VERSION }}
           distribution: 'temurin'
       - uses: gradle/actions/setup-gradle@v6   # also validates the wrapper jar
+        with:
+          cache-provider: basic
       - name: Build, lint and test
         run: ./gradlew build   # `check` includes spotlessCheck
       - name: Upload test reports
@@ -38,7 +41,7 @@ jobs:
           name: jar
           path: build/libs/*.jar
 
-  image:
+  containerize:
     name: Publish image to GHCR
     runs-on: ubuntu-latest
     needs: build
@@ -68,6 +71,8 @@ jobs:
         uses: docker/build-push-action@v7
         with:
           context: .
+          build-args: |
+            DOCKER_BASE_JAVA_VERSION_TAG=${{ vars.DOCKER_BASE_JAVA_VERSION_TAG }}
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
diff --git a/.github/workflows/pull-request.yaml b/.github/workflows/pull-request.yaml
index 92028ac..f11efa7 100644
--- a/.github/workflows/pull-request.yaml
+++ b/.github/workflows/pull-request.yaml
@@ -20,9 +20,11 @@ jobs:
       - uses: actions/checkout@v7
       - uses: actions/setup-java@v6
         with:
-          java-version: '11'
+          java-version: ${{ vars.WORKING_JAVA_VERSION }}
           distribution: 'temurin'
       - uses: gradle/actions/setup-gradle@v6   # also validates the wrapper jar
+        with:
+          cache-provider: basic
       - name: Check formatting
         run: ./gradlew spotlessCheck
 
@@ -32,7 +34,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        java: ['11', '17']
+        java: ${{ fromJSON(vars.SUPPORTED_JAVA_VERSIONS) }}
     steps:
       - uses: actions/checkout@v7
       - uses: actions/setup-java@v6
@@ -50,14 +52,14 @@ jobs:
           name: test-reports-jdk${{ matrix.java }}
           path: build/reports/tests/
       - name: Upload jar
-        if: matrix.java == '11'
+        if: matrix.java == '17'
         uses: actions/upload-artifact@v7
         with:
           name: jar
           path: build/libs/*.jar
           retention-days: 3
 
-  image:
+  containerize:
     name: Container build (no push)
     runs-on: ubuntu-latest
     needs: test
@@ -72,6 +74,8 @@ jobs:
         uses: docker/build-push-action@v7
         with:
           context: .
+          build-args: |
+            DOCKER_BASE_JAVA_VERSION_TAG=${{ vars.DOCKER_BASE_JAVA_VERSION_TAG }}
           push: false
           tags: ghcr.io/${{ github.repository }}:pr-${{ github.event.pull_request.number }}
           cache-from: type=gha
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index a91f5a3..e7d96db 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -13,7 +13,7 @@ jobs:
       - uses: actions/checkout@v7
       - uses: actions/setup-java@v6
         with:
-          java-version: '11'
+          java-version: ${{ vars.WORKING_JAVA_VERSION }}
           distribution: 'temurin'
       - uses: gradle/actions/setup-gradle@v6   # also validates the wrapper jar
         with:
@@ -58,6 +58,8 @@ jobs:
         uses: docker/build-push-action@v7
         with:
           context: .
+          build-args: |
+            DOCKER_BASE_JAVA_VERSION_TAG=${{ vars.DOCKER_BASE_JAVA_VERSION_TAG }}
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
diff --git a/Dockerfile b/Dockerfile
index 233a7e1..e4203c3 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,5 @@
-FROM eclipse-temurin:11
+ARG DOCKER_BASE_JAVA_VERSION_TAG=17
+FROM eclipse-temurin:${DOCKER_BASE_JAVA_VERSION_TAG}
 WORKDIR /extproc
 COPY build/libs/extproc-*.jar ./extproc.jar
 EXPOSE 50051