diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml
index 5b6cc47..6517fa9 100644
--- a/.github/workflows/push.yml
+++ b/.github/workflows/push.yml
@@ -13,10 +13,18 @@ jobs:
       contents: read
     steps:
       - uses: actions/checkout@v7.0.1
+      # setup-java's liberica distribution can't select 21.0.13.0.3+5 (it maps to the same
+      # semver as 21.0.13.0.2+5), so download the exact eMudhra-fixed build and install it.
+      # SHA-256 computed from the tarball after checking it against BellSoft's published SHA-1.
+      - name: Download Liberica JDK 21.0.13.0.3+5
+        run: |
+          curl --proto '=https' --tlsv1.2 -fsSL -o "$RUNNER_TEMP/liberica.tar.gz" "https://github.com/bell-sw/Liberica/releases/download/21.0.13.0.3+5/bellsoft-jdk21.0.13.0.3+5-linux-amd64.tar.gz"
+          echo "f6bac5c836223d91525360bfbb2e422b39f8fcebedafbc1adda27945934926da  $RUNNER_TEMP/liberica.tar.gz" | sha256sum -c -
       - uses: actions/setup-java@v6.1.0
         with:
-          java-version: 21.0.1+12
-          distribution: liberica
+          distribution: jdkfile
+          jdkFile: ${{ runner.temp }}/liberica.tar.gz
+          java-version: 21.0.13
       - name: Cache Maven dependencies
         uses: actions/cache@v6.1.0
         with:
diff --git a/Dockerfile b/Dockerfile
index ac694ec..066c7c9 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,9 +1,9 @@
-FROM bellsoft/liberica-openjre-alpine:21.0.12.1 AS builder
+FROM bellsoft/liberica-openjre-alpine:21.0.13.0.3-5 AS builder
 WORKDIR /builder
 COPY target/*-SNAPSHOT.jar application.jar
 RUN java -Djarmode=tools  -jar application.jar extract --layers --destination extracted
 
-FROM bellsoft/liberica-openjre-alpine:21.0.12.1
+FROM bellsoft/liberica-openjre-alpine:21.0.13.0.3-5
 RUN apk update && apk upgrade && apk add --no-cache tini
 WORKDIR /deployments
 RUN addgroup appuser && adduser --disabled-password appuser --ingroup appuser