diff --git a/.gitea/workflows/publish.yml b/.gitea/workflows/publish.yml
index 0aaa937..350e1ba 100644
--- a/.gitea/workflows/publish.yml
+++ b/.gitea/workflows/publish.yml
@@ -36,7 +36,7 @@ jobs:
       - uses: actions/setup-java@v4
         with:
           distribution: temurin
-          java-version: '27'
+          java-version: '25'
           cache: maven
           # writes ~/.m2/settings.xml with a <server id="gitea"> reading these env vars
           server-id: gitea
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index eca744e..59fd524 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -17,7 +17,7 @@ jobs:
       - uses: actions/setup-java@v4
         with:
           distribution: temurin
-          java-version: '27'
+          java-version: '25'
           cache: maven
 
       - name: Build and test
diff --git a/README.md b/README.md
index 8158ae7..38a0004 100644
--- a/README.md
+++ b/README.md
@@ -4,7 +4,7 @@ OpenPGP encryption for Spring Boot mail: discovers recipients' keys via Web Key
 PGP/MIME (RFC 3156), or hands mail to an encrypting relay. See [docs/PLAN.md](docs/PLAN.md) for the design
 and milestone status.
 
-Requires JDK 27; the Maven Wrapper (`./mvnw`) downloads Maven 3.9.11. Built on Spring Boot 4.1.1 and PGPainless 2.0.
+Requires JDK 25 or newer; the Maven Wrapper (`./mvnw`) downloads Maven 3.9.11. Built on Spring Boot 4.1.1 and PGPainless 2.0.
 
 ```
 ./mvnw verify
diff --git a/docs/PLAN.md b/docs/PLAN.md
index 955d355..bbc4e87 100644
--- a/docs/PLAN.md
+++ b/docs/PLAN.md
@@ -9,7 +9,7 @@ encrypt in-process ("built-in") or hand mail to an encrypting relay/gateway.
 | Topic | Decision |
 |---|---|
 | Build | Maven, multi-module |
-| Java | JDK 27 (`maven.compiler.release=27`) |
+| Java | JDK 25 LTS (`maven.compiler.release=25`) |
 | Spring Boot | 4.1.1 (imported as BOM, not as parent, so consumers are not forced onto our parent) |
 | Crypto | PGPainless 2.0.x (on Bouncy Castle 1.84, `OpenPGPCertificate` API) |
 | WKD hashing/URLs | `org.pgpainless:wkd-java` 0.1.3 (`WKDAddress`). Note: there is no `pgpainless-wkd` artifact on Maven Central; `wkd-java` provides the hashing/URL building. Fetching is ours (JDK `HttpClient`) so we control timeouts, size limits, redirects and fallback. |
@@ -173,7 +173,7 @@ Actuator is optional; when the `pgpkeys` endpoint is exposed
 Extension points: `KeyDiscoveryCustomizer` (wraps WKD discovery below the cache) and `SecureMailSenderCustomizer`.
 
 ## Milestones
-1. **Skeleton** — parent POM, modules, CI (GitHub Actions, `mvn verify` on Temurin 27). ✅
+1. **Skeleton** — parent POM, modules, CI (GitHub Actions, `mvn verify` on Temurin 25). ✅
 2. **WKD discovery + cache** — `WkdKeyDiscovery`, `HttpWkdFetcher`, `CachingKeyDiscovery`, static/composite discovery,
    properties + autoconfig for discovery beans. Tests: z-base-32 vector, advanced/direct fallback matrix,
    size limit, no redirects, cache TTLs. ✅
diff --git a/pom.xml b/pom.xml
index fe87406..db0f617 100644
--- a/pom.xml
+++ b/pom.xml
@@ -20,7 +20,7 @@
     </modules>
 
     <properties>
-        <maven.compiler.release>27</maven.compiler.release>
+        <maven.compiler.release>25</maven.compiler.release>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
 
         <spring-boot.version>4.1.1</spring-boot.version>
@@ -119,7 +119,7 @@
                         <configuration>
                             <rules>
                                 <requireJavaVersion>
-                                    <version>[27,)</version>
+                                    <version>[25,)</version>
                                 </requireJavaVersion>
                             </rules>
                         </configuration>