diff --git a/.github/workflows/update-packages.yml b/.github/workflows/update-packages.yml
index 12680e6..5b6a6d1 100644
--- a/.github/workflows/update-packages.yml
+++ b/.github/workflows/update-packages.yml
@@ -33,7 +33,6 @@ name: Update Packages
 
 env:
   DOTNET_VERSION: "10.0.x"
-  JAVA_VERSION: "21"
   ELIXIR_VERSION: "1.18"
   OTP_VERSION: "27"
 
@@ -74,6 +73,13 @@ on:
         type: string
         required: false
         default: '24'
+      java-version:
+        description: >-
+          JDK version used for Gradle updates. Defaults to 21; callers whose
+          Gradle toolchain needs another JDK (for example 17) pass it here.
+        type: string
+        required: false
+        default: '21'
       post-update-command:
         description: >-
           Optional trusted Bash command in the caller repository root, after all
@@ -302,7 +308,7 @@ jobs:
         uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
         with:
           distribution: temurin
-          java-version: ${{ env.JAVA_VERSION }}
+          java-version: ${{ inputs.java-version }}
 
       - name: Setup Elixir
         if: steps.detect.outputs.update_mix == 'true'
diff --git a/README.md b/README.md
index 041ef58..d3ad791 100644
--- a/README.md
+++ b/README.md
@@ -92,6 +92,7 @@ dedupe.
 | `publication-mode` | `direct` | `direct` retains legacy publication; `pull-request` uses the validated-candidate rules below. Other values fail. |
 | `pull-request-label` | Empty (no label) | One existing, caller-chosen label, only in `pull-request` mode. Must match `[a-zA-Z0-9][a-zA-Z0-9_.:/-]*`. No comma lists, whitespace, or implicit release intent. |
 | `node-version` | `24` | Node.js version for NPM updates. Satisfies the Cratis JavaScript repositories' engine floors; a caller may override it, but the minimum is Node 22 (the peer sync script needs `fs.globSync` with array `exclude`, available from 22.14/23.7). |
+| `java-version` | `21` | JDK version for Gradle updates. A caller whose Gradle toolchain needs another JDK (for example `jvmToolchain(17)`) passes it here. |
 | `runs-on` | `ubuntu-latest` | Existing runner-label input; private callers should retain their approved self-hosted label. |
 | `npm-package-exclusions` | `typescript` | Existing comma-delimited exclusions, supplemented by the caller's `.github/update-packages-npm-exclusions`. |
 | `nuget-package-exclusions` | `StyleCop.Analyzers` (its 1.3.x betas fail the build of repositories on 1.2.0-beta.556; a caller that sets this input replaces the default and lists the package itself to keep it held) | Comma-delimited exact NuGet package IDs, matched case-insensitively after trimming whitespace. Applies to top-level project references, including centrally managed versions in `Directory.Packages.props`; transitive-only IDs warn as not directly referenced (updating a parent can still change transitive versions). Prerelease references retain the updater's prerelease eligibility; stable references do not gain prerelease-only candidates. Invalid/incomplete listings and divergent per-framework versions for eligible packages fail before updating. As with the default path, SDK exit 3 (no changes written) skips NuGet updates for that run. |