diff --git a/build.gradle b/build.gradle
index b18d50ce9..1bdf4dea7 100644
--- a/build.gradle
+++ b/build.gradle
@@ -422,11 +422,15 @@ subprojects {
   }
 }
 
-// Force SDK download to be sequential, otherwise parallel tasks will try to
-// write to the same location to upgrade gcloud and fail.
+// Force SDK download and deployment to be sequential, otherwise parallel tasks
+// will fail. For SDK download, they will try to write to the same location to
+// upgrade gcloud. For deployment, they will try to deploy different services to
+// the same project at the same time.
 for (int i = 1; i < services.size(); i++) {
   project("${services[i]}").downloadCloudSdk
           .dependsOn(project("${services[i - 1]}").downloadCloudSdk)
+  project("${services[i]}").appengineDeployAll
+          .dependsOn(project("${services[i - 1]}").appengineDeployAll)
 }
 
 // If "-P verboseTestOutput=true" is passed in, configure all subprojects to dump all of their
diff --git a/core/Dockerfile b/core/Dockerfile
index 8557311f6..94d04ba53 100644
--- a/core/Dockerfile
+++ b/core/Dockerfile
@@ -1,3 +1,3 @@
-FROM gcr.io/distroless/java17-debian11:debug
+FROM eclipse-temurin:21
 ADD build/libs/nomulus.jar /nomulus.jar
-ENTRYPOINT ["/usr/bin/java", "-jar", "/nomulus.jar"]
+ENTRYPOINT ["java", "-jar", "/nomulus.jar"]
diff --git a/core/build.gradle b/core/build.gradle
index 8f39adfab..7ed680973 100644
--- a/core/build.gradle
+++ b/core/build.gradle
@@ -762,7 +762,7 @@ if (environment == 'alpha') {
             gs://${gcpProject}-deploy/live/beam/${metaDataBaseName} \
             --image-gcr-path ${imageName}:live \
             --sdk-language JAVA \
-            --flex-template-base-image JAVA17 \
+            --flex-template-base-image gcr.io/dataflow-templates-base/java21-template-launcher-base:latest \
             --metadata-file ${projectDir}/src/main/resources/${metaData} \
             --jar ${uberJarName} \
             --env FLEX_TEMPLATE_JAVA_MAIN_CLASS=${mainClass} \
diff --git a/core/src/main/java/google/registry/env/alpha/backend/WEB-INF/appengine-web.xml b/core/src/main/java/google/registry/env/alpha/backend/WEB-INF/appengine-web.xml
index 260b79ab5..136328e73 100644
--- a/core/src/main/java/google/registry/env/alpha/backend/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/alpha/backend/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>backend</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
   </basic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
               value="alpha"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html" expiration="1m"/>
   </static-files>
diff --git a/core/src/main/java/google/registry/env/alpha/bsa/WEB-INF/appengine-web.xml b/core/src/main/java/google/registry/env/alpha/bsa/WEB-INF/appengine-web.xml
index 816b688fb..a1ac65425 100644
--- a/core/src/main/java/google/registry/env/alpha/bsa/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/alpha/bsa/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>bsa</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,16 @@
   </basic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
               value="alpha"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
 
   <!-- Enable external traffic to go through VPC, required for static ip -->
   <vpc-access-connector>
diff --git a/core/src/main/java/google/registry/env/alpha/default/WEB-INF/appengine-web.xml b/core/src/main/java/google/registry/env/alpha/default/WEB-INF/appengine-web.xml
index f486516f8..3271ac5d8 100644
--- a/core/src/main/java/google/registry/env/alpha/default/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/alpha/default/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>default</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
   </basic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
               value="alpha"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html" expiration="1m"/>
     <include path="/assets/js/**" expiration="1m"/>
diff --git a/core/src/main/java/google/registry/env/alpha/pubapi/WEB-INF/appengine-web.xml b/core/src/main/java/google/registry/env/alpha/pubapi/WEB-INF/appengine-web.xml
index 02c92c317..ed777bebf 100644
--- a/core/src/main/java/google/registry/env/alpha/pubapi/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/alpha/pubapi/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>pubapi</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
   </basic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
               value="alpha"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html" expiration="1m"/>
     <include path="/assets/js/**" expiration="1m"/>
diff --git a/core/src/main/java/google/registry/env/alpha/tools/WEB-INF/appengine-web.xml b/core/src/main/java/google/registry/env/alpha/tools/WEB-INF/appengine-web.xml
index 339ef1b58..139998b27 100644
--- a/core/src/main/java/google/registry/env/alpha/tools/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/alpha/tools/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>tools</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
   </basic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
               value="alpha"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html" expiration="1m"/>
     <include path="/assets/js/**" expiration="1m"/>
diff --git a/core/src/main/java/google/registry/env/crash/backend/WEB-INF/appengine-web.xml b/core/src/main/java/google/registry/env/crash/backend/WEB-INF/appengine-web.xml
index 66a7c22fa..a57ac284e 100644
--- a/core/src/main/java/google/registry/env/crash/backend/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/crash/backend/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>backend</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
   </basic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
               value="crash"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html" expiration="1m"/>
   </static-files>
diff --git a/core/src/main/java/google/registry/env/crash/bsa/WEB-INF/appengine-web.xml b/core/src/main/java/google/registry/env/crash/bsa/WEB-INF/appengine-web.xml
index 866b0392f..007cd564a 100644
--- a/core/src/main/java/google/registry/env/crash/bsa/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/crash/bsa/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>bsa</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
   </basic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
               value="crash"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <!-- Enable external traffic to go through VPC, required for static ip -->
   <vpc-access-connector>
     <name>projects/domain-registry-crash/locations/us-central1/connectors/appengine-connector</name>
diff --git a/core/src/main/java/google/registry/env/crash/default/WEB-INF/appengine-web.xml b/core/src/main/java/google/registry/env/crash/default/WEB-INF/appengine-web.xml
index 599553a84..2c7b32e1e 100644
--- a/core/src/main/java/google/registry/env/crash/default/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/crash/default/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>default</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
   </basic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
               value="crash"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html" expiration="1m"/>
     <include path="/assets/js/**" expiration="1m"/>
diff --git a/core/src/main/java/google/registry/env/crash/pubapi/WEB-INF/appengine-web.xml b/core/src/main/java/google/registry/env/crash/pubapi/WEB-INF/appengine-web.xml
index 3beafc6e3..7f54c564f 100644
--- a/core/src/main/java/google/registry/env/crash/pubapi/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/crash/pubapi/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>pubapi</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
   </basic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
               value="crash"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html" expiration="1m"/>
     <include path="/assets/js/**" expiration="1m"/>
diff --git a/core/src/main/java/google/registry/env/crash/tools/WEB-INF/appengine-web.xml b/core/src/main/java/google/registry/env/crash/tools/WEB-INF/appengine-web.xml
index 6020f0c7b..f711aecd7 100644
--- a/core/src/main/java/google/registry/env/crash/tools/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/crash/tools/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>tools</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
   </basic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
               value="crash"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html" expiration="1m"/>
     <include path="/assets/js/**" expiration="1m"/>
diff --git a/core/src/main/java/google/registry/env/local/backend/WEB-INF/appengine-web.xml b/core/src/main/java/google/registry/env/local/backend/WEB-INF/appengine-web.xml
index 3ca4328c2..77b6e6d80 100644
--- a/core/src/main/java/google/registry/env/local/backend/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/local/backend/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>backend</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -12,6 +12,7 @@
   </basic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
@@ -20,6 +21,10 @@
               value="/tmp/domain-registry-appengine-generated/local/"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html">
       <http-header name="Cache-Control" value="max-age=0,must-revalidate" />
diff --git a/core/src/main/java/google/registry/env/local/bsa/WEB-INF/appengine-web.xml b/core/src/main/java/google/registry/env/local/bsa/WEB-INF/appengine-web.xml
index 9945fe536..a6dadaece 100644
--- a/core/src/main/java/google/registry/env/local/bsa/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/local/bsa/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>bsa</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -12,6 +12,7 @@
   </basic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
@@ -20,6 +21,10 @@
               value="/tmp/domain-registry-appengine-generated/local/"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html">
       <http-header name="Cache-Control" value="max-age=0,must-revalidate" />
diff --git a/core/src/main/java/google/registry/env/local/default/WEB-INF/appengine-web.xml b/core/src/main/java/google/registry/env/local/default/WEB-INF/appengine-web.xml
index 6f483b1ff..6f71d5ab1 100644
--- a/core/src/main/java/google/registry/env/local/default/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/local/default/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>default</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -12,6 +12,7 @@
   </basic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
@@ -20,6 +21,10 @@
               value="/tmp/domain-registry-appengine-generated/local/"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html">
       <http-header name="Cache-Control" value="max-age=0,must-revalidate" />
diff --git a/core/src/main/java/google/registry/env/local/pubapi/WEB-INF/appengine-web.xml b/core/src/main/java/google/registry/env/local/pubapi/WEB-INF/appengine-web.xml
index c3a4a43a0..2147b90ba 100644
--- a/core/src/main/java/google/registry/env/local/pubapi/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/local/pubapi/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>pubapi</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -12,6 +12,7 @@
   </basic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
@@ -20,6 +21,10 @@
               value="/tmp/domain-registry-appengine-generated/local/"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html">
       <http-header name="Cache-Control" value="max-age=0,must-revalidate" />
diff --git a/core/src/main/java/google/registry/env/local/tools/WEB-INF/appengine-web.xml b/core/src/main/java/google/registry/env/local/tools/WEB-INF/appengine-web.xml
index 0f5bd2898..9924414b0 100644
--- a/core/src/main/java/google/registry/env/local/tools/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/local/tools/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>tools</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -12,6 +12,7 @@
   </basic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
@@ -20,6 +21,10 @@
               value="/tmp/domain-registry-appengine-generated/local/"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html">
       <http-header name="Cache-Control" value="max-age=0,must-revalidate" />
diff --git a/core/src/main/java/google/registry/env/production/backend/WEB-INF/appengine-web.xml b/core/src/main/java/google/registry/env/production/backend/WEB-INF/appengine-web.xml
index e59cb166e..a46bfc86a 100644
--- a/core/src/main/java/google/registry/env/production/backend/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/production/backend/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>backend</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
   </basic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
               value="production"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html" expiration="1d"/>
   </static-files>
diff --git a/core/src/main/java/google/registry/env/production/bsa/WEB-INF/appengine-web.xml b/core/src/main/java/google/registry/env/production/bsa/WEB-INF/appengine-web.xml
index c9b57fd1c..e10a9c3ed 100644
--- a/core/src/main/java/google/registry/env/production/bsa/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/production/bsa/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>bsa</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
   </basic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
               value="production"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <!-- Enable external traffic to go through VPC, required for static ip -->
   <vpc-access-connector>
     <name>projects/domain-registry/locations/us-central1/connectors/appengine-connector</name>
diff --git a/core/src/main/java/google/registry/env/production/default/WEB-INF/appengine-web.xml b/core/src/main/java/google/registry/env/production/default/WEB-INF/appengine-web.xml
index 44b867b5e..ec0b8396f 100644
--- a/core/src/main/java/google/registry/env/production/default/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/production/default/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>default</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -11,12 +11,17 @@
   </manual-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
               value="production"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html" expiration="1d"/>
     <include path="/assets/js/**" expiration="1d"/>
diff --git a/core/src/main/java/google/registry/env/production/pubapi/WEB-INF/appengine-web.xml b/core/src/main/java/google/registry/env/production/pubapi/WEB-INF/appengine-web.xml
index 22922a18f..146e662c7 100644
--- a/core/src/main/java/google/registry/env/production/pubapi/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/production/pubapi/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>pubapi</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -11,12 +11,17 @@
   </manual-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
               value="production"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html" expiration="1d"/>
     <include path="/assets/js/**" expiration="1d"/>
diff --git a/core/src/main/java/google/registry/env/production/tools/WEB-INF/appengine-web.xml b/core/src/main/java/google/registry/env/production/tools/WEB-INF/appengine-web.xml
index bdacaa04c..6b2d4ddf9 100644
--- a/core/src/main/java/google/registry/env/production/tools/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/production/tools/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>tools</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
   </basic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
               value="production"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html" expiration="1d"/>
     <include path="/assets/js/**" expiration="1d"/>
diff --git a/core/src/main/java/google/registry/env/qa/backend/WEB-INF/appengine-web.xml b/core/src/main/java/google/registry/env/qa/backend/WEB-INF/appengine-web.xml
index 0f78e0339..901cec37d 100644
--- a/core/src/main/java/google/registry/env/qa/backend/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/qa/backend/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>backend</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
   </basic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
               value="qa"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html" expiration="1h"/>
   </static-files>
diff --git a/core/src/main/java/google/registry/env/qa/bsa/WEB-INF/appengine-web.xml b/core/src/main/java/google/registry/env/qa/bsa/WEB-INF/appengine-web.xml
index 6dc8eeea3..67b94ddf6 100644
--- a/core/src/main/java/google/registry/env/qa/bsa/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/qa/bsa/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>bsa</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
   </basic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
               value="qa"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html" expiration="1h"/>
   </static-files>
diff --git a/core/src/main/java/google/registry/env/qa/default/WEB-INF/appengine-web.xml b/core/src/main/java/google/registry/env/qa/default/WEB-INF/appengine-web.xml
index 7a5109044..07204022e 100644
--- a/core/src/main/java/google/registry/env/qa/default/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/qa/default/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>default</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -15,12 +15,17 @@
   </automatic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
               value="qa"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html" expiration="1h"/>
     <include path="/assets/js/**" expiration="1h"/>
diff --git a/core/src/main/java/google/registry/env/qa/pubapi/WEB-INF/appengine-web.xml b/core/src/main/java/google/registry/env/qa/pubapi/WEB-INF/appengine-web.xml
index ae056986a..4a9f306da 100644
--- a/core/src/main/java/google/registry/env/qa/pubapi/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/qa/pubapi/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>pubapi</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
   </basic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
               value="qa"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html" expiration="1h"/>
     <include path="/assets/js/**" expiration="1h"/>
diff --git a/core/src/main/java/google/registry/env/qa/tools/WEB-INF/appengine-web.xml b/core/src/main/java/google/registry/env/qa/tools/WEB-INF/appengine-web.xml
index f5956e6b1..a0a1a98d7 100644
--- a/core/src/main/java/google/registry/env/qa/tools/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/qa/tools/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>tools</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
   </basic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
               value="qa"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html" expiration="1h"/>
     <include path="/assets/js/**" expiration="1h"/>
diff --git a/core/src/main/java/google/registry/env/sandbox/backend/WEB-INF/appengine-web.xml b/core/src/main/java/google/registry/env/sandbox/backend/WEB-INF/appengine-web.xml
index a16e16c85..6a6c96d94 100644
--- a/core/src/main/java/google/registry/env/sandbox/backend/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/sandbox/backend/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>backend</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
   </basic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
               value="sandbox"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html" expiration="1d"/>
   </static-files>
diff --git a/core/src/main/java/google/registry/env/sandbox/bsa/WEB-INF/appengine-web.xml b/core/src/main/java/google/registry/env/sandbox/bsa/WEB-INF/appengine-web.xml
index 02ab68932..6d31c2552 100644
--- a/core/src/main/java/google/registry/env/sandbox/bsa/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/sandbox/bsa/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>bsa</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
   </basic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
               value="sandbox"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html" expiration="1d"/>
   </static-files>
diff --git a/core/src/main/java/google/registry/env/sandbox/default/WEB-INF/appengine-web.xml b/core/src/main/java/google/registry/env/sandbox/default/WEB-INF/appengine-web.xml
index e03fd12af..217303ea9 100644
--- a/core/src/main/java/google/registry/env/sandbox/default/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/sandbox/default/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>default</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -11,12 +11,17 @@
   </manual-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
               value="sandbox"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html" expiration="1d"/>
     <include path="/assets/js/**" expiration="1d"/>
diff --git a/core/src/main/java/google/registry/env/sandbox/pubapi/WEB-INF/appengine-web.xml b/core/src/main/java/google/registry/env/sandbox/pubapi/WEB-INF/appengine-web.xml
index 126835223..3b764cb52 100644
--- a/core/src/main/java/google/registry/env/sandbox/pubapi/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/sandbox/pubapi/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>pubapi</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -11,12 +11,17 @@
   </manual-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
               value="sandbox"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html" expiration="1d"/>
     <include path="/assets/js/**" expiration="1d"/>
diff --git a/core/src/main/java/google/registry/env/sandbox/tools/WEB-INF/appengine-web.xml b/core/src/main/java/google/registry/env/sandbox/tools/WEB-INF/appengine-web.xml
index 8262a7ac8..47d903dad 100644
--- a/core/src/main/java/google/registry/env/sandbox/tools/WEB-INF/appengine-web.xml
+++ b/core/src/main/java/google/registry/env/sandbox/tools/WEB-INF/appengine-web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java21</runtime>
   <service>tools</service>
   <app-engine-apis>true</app-engine-apis>
   <sessions-enabled>true</sessions-enabled>
@@ -12,12 +12,17 @@
   </basic-scaling>
 
   <system-properties>
+    <property name="appengine.use.EE8" value="true"/>
     <property name="java.util.logging.config.file"
               value="WEB-INF/logging.properties"/>
     <property name="google.registry.environment"
               value="sandbox"/>
   </system-properties>
 
+  <env-variables>
+    <env-var name="GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE" value="true"/>
+  </env-variables>
+
   <static-files>
     <include path="/*.html" expiration="1d"/>
     <include path="/assets/js/**" expiration="1d"/>
diff --git a/jetty/Dockerfile b/jetty/Dockerfile
index 406fec7da..366dfe1cc 100644
--- a/jetty/Dockerfile
+++ b/jetty/Dockerfile
@@ -1,4 +1,4 @@
-FROM jetty:12-jdk17
+FROM jetty:12-jdk21
 ADD --chown=jetty:jetty build/jetty-base /jetty-base
 ENV JETTY_BASE=/jetty-base
 WORKDIR "$JETTY_BASE"
diff --git a/proxy/Dockerfile b/proxy/Dockerfile
index 545c84e1e..62b53bc79 100644
--- a/proxy/Dockerfile
+++ b/proxy/Dockerfile
@@ -1,4 +1,4 @@
-FROM gcr.io/distroless/java
+FROM eclipse-temurin:21
 ADD build/libs/proxy_server.jar .
 ENTRYPOINT ["java", "-jar", "proxy_server.jar"]
 EXPOSE 30000 30001 30002 30010 30012
diff --git a/release/stage_beam_pipeline.sh b/release/stage_beam_pipeline.sh
index 8247e6dce..0e27d36eb 100755
--- a/release/stage_beam_pipeline.sh
+++ b/release/stage_beam_pipeline.sh
@@ -71,7 +71,7 @@ while (( "$#" > 0 )); do
     "gs://${dev_project}-deploy/${release_tag}/beam/${metadata_basename}" \
     --image-gcr-path "${image_name}:${release_tag}" \
     --sdk-language "JAVA" \
-    --flex-template-base-image JAVA17 \
+    --flex-template-base-image gcr.io/dataflow-templates-base/java21-template-launcher-base:latest \
     --metadata-file "./core/src/main/resources/${metadata_pathname}" \
     --jar "./core/build/libs/${uberjar_name}.jar" \
     --env FLEX_TEMPLATE_JAVA_MAIN_CLASS="${main_class}" \