diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml
index 990d885d5..3ecb424a3 100644
--- a/.github/workflows/push.yml
+++ b/.github/workflows/push.yml
@@ -30,7 +30,8 @@ jobs:
       - name: Setup build environment
         uses: ./.github/actions/setup-build-environment
         with:
-          java-version: 11
+          # google-java-format 1.27.0 (pinned in pom.xml) requires JRE 17+ to run.
+          java-version: 17
 
       - name: Check formatting
         run: mvn --errors spotless:check
diff --git a/Makefile b/Makefile
index 811dd0577..32c24823c 100644
--- a/Makefile
+++ b/Makefile
@@ -1,5 +1,16 @@
 fmt:
-	mvn spotless:apply
+	@mvn spotless:apply || ( \
+	  echo ""; \
+	  echo "==> default JDK could not run google-java-format (likely < JDK 17). Retrying with JDK 17..."; \
+	  echo ""; \
+	  $(MAKE) fmt-jdk17 \
+	)
+
+# Same as `fmt` but runs under JDK 17 explicitly. Use this when your default
+# JDK is older than 17 (e.g. JDK 11), since google-java-format 1.27.0 — pinned
+# in pom.xml for JDK 25 generator support — requires JRE 17+ to load.
+fmt-jdk17:
+	JAVA_HOME=/usr/lib/jvm/java-17-openjdk-amd64 mvn spotless:apply
 
 test:
 	mvn test
diff --git a/pom.xml b/pom.xml
index c24d36c3f..e41bc4ba5 100644
--- a/pom.xml
+++ b/pom.xml
@@ -84,11 +84,11 @@
           <java>
             <!--            <cleanthat/> This can be added after we drop java 8 support -->
             <googleJavaFormat>
-              <!-- 1.22.0 is the last GJF release that supports JRE 11 (1.23+ requires JRE 17).
-                   Needed to support newer JDKs (e.g. the code-generator's JDK 25) where the
-                   spotless-bundled default (1.15.0) fails with NoSuchMethodError against
-                   javac internals (Log$DeferredDiagnosticHandler.getDiagnostics). -->
-              <version>1.22.0</version>
+              <!-- 1.27.0 is the first GJF release with the fix for the JDK 23+
+                   Log$DeferredDiagnosticHandler signature change (required for the
+                   code-generator's JDK 25 environment). Requires JRE 17+ to run, which
+                   is why the fmt CI job (.github/workflows/push.yml) pins JDK 17. -->
+              <version>1.27.0</version>
             </googleJavaFormat>
             <importOrder/>
             <removeUnusedImports/>