diff --git a/.github/workflows/maven.yml b/.github/workflows/maven.yml
index acf3b6452..3a878a6bf 100644
--- a/.github/workflows/maven.yml
+++ b/.github/workflows/maven.yml
@@ -16,10 +16,10 @@ jobs:
     steps:
     - uses: actions/checkout@v5
 
-    - name: Set up JDK 11
+    - name: Set up JDK 21
       uses: actions/setup-java@v5
       with:
-        java-version: '11'
+        java-version: '21'
         distribution: 'zulu'
         cache: maven
 
diff --git a/Dockerfile b/Dockerfile
index b921534cc..23da3f3b4 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -32,7 +32,7 @@
 # Install library dependencies before actually building source.
 # This caches libraries into an image layer that can be reused when only source code has changed.
 
-FROM azul/zulu-openjdk-debian:11 as build_environment
+FROM azul/zulu-openjdk-debian:21 as build_environment
 LABEL maintainer="Forrest Collman <forrestc@alleninstitute.org>, Eric Trautman <trautmane@janelia.hhmi.org>"
 
 RUN apt-get update && apt-get install -y maven
@@ -85,7 +85,7 @@ RUN mkdir -p /root/render-lib && \
 # Once web service application is built, set up jetty server and deploy application to it.
 
 # NOTE: jetty version should be kept in sync with values in render/render-ws/pom.xml and render/render-ws/src/main/scripts/install.sh
-FROM jetty:10.0.13-jre11 as render-ws
+FROM jetty:10.0.26-jre21 as render-ws
 
 # add packages not included in base image:
 #   curl and coreutils are always needed for gnu readlink, tzdata is needed to set timezone
diff --git a/docs/src/site/markdown/how-to/how-to-local-spark-intellij.md b/docs/src/site/markdown/how-to/how-to-local-spark-intellij.md
index 1fb918a1c..3fd2594de 100644
--- a/docs/src/site/markdown/how-to/how-to-local-spark-intellij.md
+++ b/docs/src/site/markdown/how-to/how-to-local-spark-intellij.md
@@ -1,7 +1,7 @@
 # How To: Run Spark Locally in IntelliJ
 
 It can be useful to run and test render spark clients within an IDE  
-[using a local master URL](https://spark.apache.org/docs/3.4.1/submitting-applications.html#master-urls).  Unfortunately 
+[using a local master URL](https://spark.apache.org/docs/4.0.4/submitting-applications.html#master-urls).  Unfortunately 
 because we need to exclude spark libraries from the render-ws-spark-client fat jar, you'll need to add a 
 few extra settings to your IntelliJ run configuration to get spark clients to run within the IDE.
 
@@ -10,7 +10,7 @@ few extra settings to your IntelliJ run configuration to get spark clients to ru
 The hadoop client runtime library is required to run spark locally.  If you don't already have it in a local directory, 
 an easy way to install it is to: 
 - Comment out the library's exclusion block in the 
-[render-ws-spark-client pom.xml](../../../../../render-ws-spark-client/pom.xml#L213-L216):
+[render-ws-spark-client pom.xml](../../../../../render-ws-spark-client/pom.xml#L267-L270):
 ```
 <!--
   <exclusion>
@@ -21,10 +21,10 @@ an easy way to install it is to:
 ```
 - Run `mvn compile` to pull the library into your local .m2/repository.  The compilation will fail because of 
   the enforcer no-duplicate-classes rule, but the jar will get pulled.
-- Once `${HOME}/.m2/repository/org/apache/hadoop/hadoop-client-runtime/3.3.4/hadoop-client-runtime-3.3.4.jar` exists,
+- Once `${HOME}/.m2/repository/org/apache/hadoop/hadoop-client-runtime/3.4.1/hadoop-client-runtime-3.4.1.jar` exists,
 restore the pom.xml file to its original state by uncommenting the exclusion.
 
-The local hadoop-client-runtime-3.3.4.jar path can then be referenced in all IntelliJ run configurations 
+The local hadoop-client-runtime-3.4.1.jar path can then be referenced in all IntelliJ run configurations 
 that use spark.  This means you'll only need to do this install process once unless you change spark versions 
 or clean out your local `${HOME}/.m2/repository`.  
 
@@ -44,10 +44,13 @@ Select the run drop-down menu and click Edit Configurations...
 
 Then make the following changes to the run configuration (and save the changes):
 - A: Add `SPARK_LOCAL_IP=127.0.0.1` to the environment variables so that runs will work when you are connected via VPN. 
+     Also make sure the configuration's JDK is 21: spark 4 supports java 17 and 21 only, and on java 24+ every
+     spark client dies in `new JavaSparkContext(...)` with `UnsupportedOperationException: getSubject is not supported`
+     (hadoop's `UserGroupInformation` uses the security manager API that JEP 486 removed). 
 - B: Select the `Modify options` drop-down menu.
 - C: Select `Modify classpath`. 
 - D: Select `Add dependencies with "provided" scope to classpath` and close the drop-down menu.
-- E: Click the `+` button below `Modify classpath:` and use the dialog to add the hadoop-client-runtime-3.3.4.jar 
+- E: Click the `+` button below `Modify classpath:` and use the dialog to add the hadoop-client-runtime-3.4.1.jar 
      path from your local .m2/repository.  This can be a little tricky on Macs because the .m2 directory is usually 
      hidden from Finder windows.  On Macs you can use `⌘⇧.` to reveal dot files or use `⌘⇧G` to open a 
      Go dialog and paste in a path. 
diff --git a/pom.xml b/pom.xml
index c2cabe000..b11899651 100644
--- a/pom.xml
+++ b/pom.xml
@@ -146,12 +146,13 @@
              that matcher is a separate effort, so keep the 2.x line reactor-wide (render-app also pins 2.1.3). -->
         <Descriptor_based_registration.version>2.1.3</Descriptor_based_registration.version>
 
-        <!-- pom-scijava 45 bumps Stitching_ to 3.1.10, which is compiled for JDK 21 and trips the
-             EnforceBytecodeVersion enforcer rule (render targets JDK 11). Keep 3.1.9 (pom-scijava 39's version,
-             JDK 8 bytecode); render only uses stable mpicbg.stitching.* / stitching.* APIs. -->
-        <Stitching.version>3.1.9</Stitching.version>
-
-        <jackson-version>2.14.3</jackson-version> <!-- NOTE: 2.15.3 causes NullPointerException in maven enforcer plugin -->
+        <!--
+          Keep this in sync with the jackson version bundled with the spark version in
+          render-ws-spark-client/pom.xml: spark refuses to start when its jackson-module-scala does not
+          match the jackson-databind on the classpath.  Overriding pom-scijava's jackson.version keeps
+          jackson-databind, jackson-core, jackson-annotations and jackson-jaxrs-json-provider aligned with each other.
+        -->
+        <jackson.version>2.18.6</jackson.version>
 
         <swagger-version>1.6.2</swagger-version>
 
@@ -163,9 +164,9 @@
         <license.licenseName>gpl_v2</license.licenseName>
         <license.copyrightOwners>Howard Hughes Medical Institute</license.copyrightOwners>
 
-        <!-- Override JDK 8 settings in pom-scijava-base now that Jetty 10 has forced us to JDK 11  -->
-        <scijava.jvm.version>11</scijava.jvm.version>
-        <scijava.jvm.build.version>[11,]</scijava.jvm.build.version>
+        <!-- render targets JDK 21; try to not lag behind scijava too much -->
+        <scijava.jvm.version>21</scijava.jvm.version>
+        <scijava.jvm.build.version>[21,]</scijava.jvm.build.version>
 
         <!-- only print test summaries for failures and avoid warnings for skipped tests -->
         <surefire.printSummary>false</surefire.printSummary>
@@ -179,7 +180,7 @@
                 <plugin>
                     <artifactId>maven-compiler-plugin</artifactId>
                     <configuration>
-                        <release>11</release>
+                        <release>21</release>
                     </configuration>
                 </plugin>
                 <plugin>
diff --git a/render-app/pom.xml b/render-app/pom.xml
index f1a5aca3b..52119274b 100644
--- a/render-app/pom.xml
+++ b/render-app/pom.xml
@@ -164,11 +164,11 @@
             <artifactId>n5-hdf5</artifactId>
         </dependency>
 
-        <!-- Use older version of jackson to keep consistent with render-ws jackson-jaxrs-json-provider version. -->
+        <!-- Version comes from the jackson.version property in the root pom, which keeps jackson-databind
+             in sync with jackson-core, jackson-annotations and the jaxrs provider. -->
         <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
             <artifactId>jackson-databind</artifactId>
-            <version>${jackson-version}</version>
         </dependency>
 
         <!-- Dependencies not defined in SciJava -->
diff --git a/render-ws-java-client/pom.xml b/render-ws-java-client/pom.xml
index 0599c6b3a..ce9ef8d82 100644
--- a/render-ws-java-client/pom.xml
+++ b/render-ws-java-client/pom.xml
@@ -230,11 +230,11 @@
             <version>${n5-version}</version>
         </dependency>
 
-        <!-- Use older version of jackson to keep consistent with render-ws jackson-jaxrs-json-provider version. -->
+        <!-- Version comes from the jackson.version property in the root pom, which keeps jackson-databind
+             in sync with jackson-core, jackson-annotations and the jaxrs provider. -->
         <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
             <artifactId>jackson-databind</artifactId>
-            <version>${jackson-version}</version>
         </dependency>
 
         <!-- Dependencies not defined in SciJava -->
diff --git a/render-ws-spark-client/pom.xml b/render-ws-spark-client/pom.xml
index fef7b6bf7..1d5945f74 100644
--- a/render-ws-spark-client/pom.xml
+++ b/render-ws-spark-client/pom.xml
@@ -183,38 +183,22 @@
         <dependency>
             <groupId>org.janelia.saalfeldlab</groupId>
             <artifactId>n5-spark</artifactId>
-            <version>3.7.3</version>
+            <!-- 4.1.0 is built against n5 4.x. -->
+            <version>4.1.0</version>
             <exclusions>
-                <!-- filter out dependencies that cause duplicate class failures -->
+                <!-- n5-spark uses kryo 5.x, whose classes duplicate the kryo-shaded 4.x that spark provides -->
                 <exclusion>
                     <groupId>com.esotericsoftware</groupId>
                     <artifactId>kryo</artifactId>
                 </exclusion>
-                <exclusion>
-                    <groupId>javax.validation</groupId>
-                    <artifactId>validation-api</artifactId>
-                </exclusion>
-                <!-- filter out unneeded google-http-client jar which causes overlap issue in shaded jar -->
-                <exclusion>
-                    <groupId>com.google.http-client</groupId>
-                    <artifactId>google-http-client-xml</artifactId>
-                </exclusion>
-                <!--
-                     filter out mbknor-jackson-jsonschema_2.12 jar which causes missing scala.Tuple2 errors
-                     because it uses older 2.12.8 scala-library (all other scala dependencies are 2.13.*)
-                -->
-                <exclusion>
-                    <groupId>com.kjetland</groupId>
-                    <artifactId>mbknor-jackson-jsonschema_2.12</artifactId>
-                </exclusion>
             </exclusions>
         </dependency>
 
-        <!-- Use older version of jackson to keep consistent with render-ws jackson-jaxrs-json-provider version. -->
+        <!-- Version comes from the jackson.version property in the root pom, which keeps jackson-databind
+             in sync with jackson-core, jackson-annotations and the jaxrs provider. -->
         <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
             <artifactId>jackson-databind</artifactId>
-            <version>${jackson-version}</version>
         </dependency>
 
         <!-- Dependencies not defined in SciJava -->
@@ -222,7 +206,12 @@
         <dependency>
             <groupId>org.apache.spark</groupId>
             <artifactId>spark-core_2.13</artifactId>
-            <version>3.4.1</version> <!-- released on June 23, 2023, see https://spark.apache.org/releases/spark-release-3-4-1.html -->
+            <!--
+              Spark 4 is required because render targets JDK 21: Spark 3.x supports Java 8/11/17 only
+              (see https://spark.apache.org/docs/3.5.7/). This is a 'provided' dependency, so it should
+              be kept in sync with the Spark version installed on the cluster this is deployed to.
+            -->
+            <version>4.0.4</version> <!-- published on July 12, 2026, see https://spark.apache.org/releases/spark-release-4-0-4.html -->
             <scope>provided</scope>
             <exclusions>
 
@@ -249,9 +238,9 @@
 
                   Comment out the hadoop-client-runtime exclusion below and run mvn compile to pull it into your local .m2/repository.
                   The compile will fail because of the enforcer no-duplicate-classes rule but the jar will get pulled.
-                  Once $HOME/.m2/repository/org/apache/hadoop/hadoop-client-runtime/3.3.4/hadoop-client-runtime-3.3.4.jar exists,
+                  Once $HOME/.m2/repository/org/apache/hadoop/hadoop-client-runtime/3.4.1/hadoop-client-runtime-3.4.1.jar exists,
                   uncomment the exclusion and run mvn clean package.
-                  Finally, add the hadoop-client-runtime-3.3.4.jar to IntelliJ run configurations to run local Spark jobs from IDE.
+                  Finally, add the hadoop-client-runtime-3.4.1.jar to IntelliJ run configurations to run local Spark jobs from IDE.
 
                   Note that the hadoop version will change with Spark version changes.
                   Hopefully, whoever updates Spark will also update this comment with the new corresponding hadoop version and .m2 path.
diff --git a/render-ws/pom.xml b/render-ws/pom.xml
index 6785ea5db..fbb5ceafe 100644
--- a/render-ws/pom.xml
+++ b/render-ws/pom.xml
@@ -102,11 +102,11 @@
             <version>${n5-version}</version>
         </dependency>
 
-        <!-- Use older version of jackson to keep consistent with render-ws jackson-jaxrs-json-provider version. -->
+        <!-- Version comes from the jackson.version property in the root pom, which keeps jackson-databind
+             in sync with jackson-core, jackson-annotations and the jaxrs provider. -->
         <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
             <artifactId>jackson-databind</artifactId>
-            <version>${jackson-version}</version>
         </dependency>
 
         <!-- Dependencies not defined in SciJava -->
@@ -161,16 +161,23 @@
             <artifactId>resteasy-servlet-initializer</artifactId>
         </dependency>
 
+        <!-- pom-scijava does not manage this artifact, so use its jackson version to stay in sync with databind. -->
         <dependency>
             <groupId>com.fasterxml.jackson.jaxrs</groupId>
             <artifactId>jackson-jaxrs-json-provider</artifactId>
-            <version>${jackson-version}</version>
+            <version>${jackson.version}</version>
             <exclusions>
                 <!-- covered by javax.activation in swagger, spark, and mock-server -->
                 <exclusion>
                     <groupId>jakarta.activation</groupId>
                     <artifactId>jakarta.activation-api</artifactId>
                 </exclusion>
+                <!-- jackson-module-jaxb-annotations pulls in the legacy javax.xml.bind:jaxb-api, whose classes
+                     duplicate the jakarta.xml.bind:jakarta.xml.bind-api ones that arrive via render-app -->
+                <exclusion>
+                    <groupId>javax.xml.bind</groupId>
+                    <artifactId>jaxb-api</artifactId>
+                </exclusion>
             </exclusions>
         </dependency>
 
@@ -247,7 +254,7 @@
 
     <properties>
         <resteasy.version>4.7.9.Final</resteasy.version>
-        <jetty.version>10.0.13</jetty.version> <!-- NOTE: jetty version should be kept in sync with values in render/Dockerfile and render/render-ws/src/main/scripts/install.sh -->
+        <jetty.version>10.0.26</jetty.version> <!-- NOTE: jetty version should be kept in sync with values in render/Dockerfile and render/render-ws/src/main/scripts/install.sh -->
         <mongodb.driver.version>4.4.1</mongodb.driver.version>
         <license.licenseName>gpl_v2</license.licenseName>
         <license.copyrightOwners>Howard Hughes Medical Institute</license.copyrightOwners>
diff --git a/render-ws/src/main/scripts/install.sh b/render-ws/src/main/scripts/install.sh
index fb25d24b4..653d3fa03 100755
--- a/render-ws/src/main/scripts/install.sh
+++ b/render-ws/src/main/scripts/install.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-JETTY_VERSION="10.0.13" # NOTE: jetty version should be kept in sync with values in render/render-ws/pom.xml and render/Dockerfile
+JETTY_VERSION="10.0.26" # NOTE: jetty version should be kept in sync with values in render/render-ws/pom.xml and render/Dockerfile
 JETTY_DIST="jetty-home-${JETTY_VERSION}"
 # URLs for Jetty 10, SLF4J 1.7, Logback 1.1, and Swagger 2.1
 MAVEN_CENTRAL_URL="https://repo1.maven.org"
@@ -91,7 +91,7 @@ JETTY_WRAPPER_SCRIPT="${JETTY_BASE}/jetty_wrapper.sh"
 sed "
   s~/opt/local/jetty_home~${JETTY_HOME}~
   s~/opt/local/jetty_base~${JETTY_BASE}~
-  s~/misc/sc/jdks/zulu11~${JAVA_HOME}~
+  s~/misc/sc/jdks/zulu21~${JAVA_HOME}~
 " "${SCRIPTS_DIR}"/jetty/jetty_wrapper.sh > "${JETTY_WRAPPER_SCRIPT}"
 
 chmod 755 "${JETTY_WRAPPER_SCRIPT}"
diff --git a/render-ws/src/main/scripts/jdk-vars.sh b/render-ws/src/main/scripts/jdk-vars.sh
index ca88833a7..68f4c3fa7 100755
--- a/render-ws/src/main/scripts/jdk-vars.sh
+++ b/render-ws/src/main/scripts/jdk-vars.sh
@@ -1,8 +1,8 @@
 #!/bin/bash
 
-export JDK_VERSION="zulu11.78.15-ca-jdk11.0.26-linux_x64"
+export JDK_VERSION="zulu21.52.15-ca-jdk21.0.12-linux_x64"
 
 # URL for JDK
 # You can find latest Linux x64 download links at:
-# https://www.azul.com/downloads/?version=java-11-lts&os=linux&architecture=x86-64-bit&package=jdk&show-old-builds=true#zulu
+# https://www.azul.com/downloads/?version=java-21-lts&os=linux&architecture=x86-64-bit&package=jdk&show-old-builds=true#zulu
 export JDK_URL="https://cdn.azul.com/zulu/bin/${JDK_VERSION}.tar.gz"
\ No newline at end of file
diff --git a/render-ws/src/main/scripts/jetty/jetty_wrapper.sh b/render-ws/src/main/scripts/jetty/jetty_wrapper.sh
index 81a1b0d07..1a42783be 100755
--- a/render-ws/src/main/scripts/jetty/jetty_wrapper.sh
+++ b/render-ws/src/main/scripts/jetty/jetty_wrapper.sh
@@ -21,7 +21,7 @@ export JETTY_STATE="${JETTY_RUN}/jetty.state"
 # JETTY_USER
 # JETTY_SHELL
  
-export JAVA_HOME="/misc/sc/jdks/zulu11"
+export JAVA_HOME="/misc/sc/jdks/zulu21"
 export PATH="${JAVA_HOME}/bin:${PATH}"
 export JAVA="${JAVA_HOME}/bin/java"
 export JAVA_OPTIONS="-Xms${JETTY_MIN_AND_MAX_MEMORY} -Xmx${JETTY_MIN_AND_MAX_MEMORY} -server -Djava.awt.headless=true"
diff --git a/trakem2-scripts/pom.xml b/trakem2-scripts/pom.xml
index 1f171b9f3..c15e4809d 100644
--- a/trakem2-scripts/pom.xml
+++ b/trakem2-scripts/pom.xml
@@ -238,11 +238,11 @@
             <version>${n5-version}</version>
         </dependency>
 
-        <!-- Use older version of jackson to keep consistent with render-ws jackson-jaxrs-json-provider version. -->
+        <!-- Version comes from the jackson.version property in the root pom, which keeps jackson-databind
+             in sync with jackson-core, jackson-annotations and the jaxrs provider. -->
         <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
             <artifactId>jackson-databind</artifactId>
-            <version>${jackson-version}</version>
         </dependency>
 
         <!-- Dependencies not defined in SciJava -->