diff --git a/java/bazel/BUILD.bazel b/java/bazel/BUILD.bazel
index f3c47cf7..dcf657ab 100644
--- a/java/bazel/BUILD.bazel
+++ b/java/bazel/BUILD.bazel
@@ -27,7 +27,7 @@ genrule(
 echo > $@
 while read -r config; do
     TMP_FILE=$$(mktemp -q /tmp/remotejdk.XXXXXX)
-    IFS=\\| read -r name version urls strip_prefix target_compatible_with primary_url <<< "$$config"
+    IFS=\\| read -r name version urls strip_prefix target_compatible_with primary_url patch_cmds <<< "$$config"
     echo "fetching: $$primary_url to $$TMP_FILE" > /dev/stderr
     curl --retry 5 --write-out '%{{onerror}}%{{url}}\n' --show-error --silent --fail -o $$TMP_FILE -L "$$primary_url" > /dev/stderr
     sha256=`sha256sum $$TMP_FILE | cut -d' ' -f1`
@@ -38,6 +38,9 @@ while read -r config; do
     echo "  strip_prefix = \\"$$strip_prefix\\","
     echo "  urls = $$urls,"
     echo "  version = \\"$$version\\","
+    if [[ "$$patch_cmds" != "[]" ]]; then
+      echo "  patch_cmds = $$patch_cmds,"
+    fi
     echo "),"
     rm -f "$$TMP_FILE"
 done <<< '{configs}' >> $@
@@ -49,6 +52,7 @@ done <<< '{configs}' >> $@
             config.strip_prefix,
             json.encode(config.target_compatible_with),
             config.urls[0],
+            json.encode(config.patch_cmds),
         ])
         for config in FLAT_CONFIGS
     ])),
diff --git a/java/bazel/repositories_util.bzl b/java/bazel/repositories_util.bzl
index 40101d37..813f5f13 100644
--- a/java/bazel/repositories_util.bzl
+++ b/java/bazel/repositories_util.bzl
@@ -18,7 +18,7 @@ visibility(["//test"])
 _RELEASE_CONFIGS = {
     "8": {
         "zulu": {
-            "release": "8.90.0.19-ca-jdk8.0.472",
+            "release": "8.96.0.19-ca-jdk8.0.502",
             "platforms": {
                 "linux": ["aarch64", "x86_64"],
                 "macos": ["aarch64", "x86_64"],
@@ -34,7 +34,7 @@ _RELEASE_CONFIGS = {
     },
     "11": {
         "zulu": {
-            "release": "11.84.17-ca-jdk11.0.29",
+            "release": "11.90.19-ca-jdk11.0.32",
             "platforms": {
                 "linux": ["aarch64", "x86_64"],
                 "macos": ["aarch64", "x86_64"],
@@ -56,7 +56,7 @@ _RELEASE_CONFIGS = {
     },
     "17": {
         "zulu": {
-            "release": "17.62.17-ca-jdk17.0.17",
+            "release": "17.68.17-ca-jdk17.0.20",
             "platforms": {
                 "linux": ["aarch64", "x86_64"],
                 "macos": ["aarch64", "x86_64"],
@@ -72,7 +72,7 @@ _RELEASE_CONFIGS = {
     },
     "21": {
         "zulu": {
-            "release": "21.46.19-ca-jdk21.0.9",
+            "release": "21.52.15-ca-jdk21.0.12",
             "platforms": {
                 "linux": ["aarch64", "x86_64"],
                 "macos": ["aarch64", "x86_64"],
@@ -88,7 +88,7 @@ _RELEASE_CONFIGS = {
     },
     "25": {
         "zulu": {
-            "release": "25.32.17-ca-jdk25.0.2",
+            "release": "25.36.15-ca-jdk25.0.4",
             "platforms": {
                 "linux": ["aarch64", "x86_64"],
                 "macos": ["aarch64", "x86_64"],
@@ -135,7 +135,16 @@ def _zulu_remote_jdk_repo(os, cpu, release):
         "https://" + primary_url,
         "https://mirror.bazel.build/" + primary_url,
     ]
-    return urls, archive_name
+    patch_cmds = []
+    if os == "macos":
+        # Recent Zulu macOS archives are application bundles: the JDK lives
+        # under Contents/Home and the top-level bin/lib/... symlinks that
+        # earlier releases shipped are gone. strip_prefix stays at the
+        # archive root (uniform with the other platforms); recreate the
+        # top-level symlinks so the shared JDK BUILD template still finds
+        # bin/, lib/, etc.
+        patch_cmds = ["ln -s Contents/Home/* ."]
+    return urls, archive_name, patch_cmds
 
 def _adoptium_linux_remote_jdk_repo(version, cpu, release):
     os = "linux"
@@ -173,8 +182,9 @@ def _flatten_configs():
             for os, cpus in distrib_cfg["platforms"].items():
                 for cpu in cpus:
                     name = _name_for_remote_jdk(version, os, cpu)
+                    patch_cmds = []
                     if distrib == "zulu":
-                        urls, strip_prefix = _zulu_remote_jdk_repo(os, cpu, release)
+                        urls, strip_prefix, patch_cmds = _zulu_remote_jdk_repo(os, cpu, release)
                     elif distrib == "adoptium":
                         if os != "linux":
                             fail("adoptium jdk configured but not linux")
@@ -193,6 +203,7 @@ def _flatten_configs():
                         urls = urls,
                         strip_prefix = _STRIP_PREFIX_OVERRIDES.get(name, strip_prefix),
                         target_compatible_with = ["@platforms//os:" + os, "@platforms//cpu:" + cpu],
+                        patch_cmds = patch_cmds,
                     ))
     return result
 
diff --git a/java/repositories.bzl b/java/repositories.bzl
index df95f86d..569bd679 100644
--- a/java/repositories.bzl
+++ b/java/repositories.bzl
@@ -86,41 +86,43 @@ _REMOTE_JDK_CONFIGS_LIST = [
     struct(
         name = "remote_jdk8_linux_aarch64",
         target_compatible_with = ["@platforms//os:linux", "@platforms//cpu:aarch64"],
-        sha256 = "c372fb26480c052537125013cb0ba7336c404e5190ea8f6e2de247b676432a67",
-        strip_prefix = "zulu8.90.0.19-ca-jdk8.0.472-linux_aarch64",
-        urls = ["https://cdn.azul.com/zulu/bin/zulu8.90.0.19-ca-jdk8.0.472-linux_aarch64.tar.gz", "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu8.90.0.19-ca-jdk8.0.472-linux_aarch64.tar.gz"],
+        sha256 = "b23296caf10d0c3db054d4a58b9dd168976991472f2203335d7c4820f98c4a4e",
+        strip_prefix = "zulu8.96.0.19-ca-jdk8.0.502-linux_aarch64",
+        urls = ["https://cdn.azul.com/zulu/bin/zulu8.96.0.19-ca-jdk8.0.502-linux_aarch64.tar.gz", "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu8.96.0.19-ca-jdk8.0.502-linux_aarch64.tar.gz"],
         version = "8",
     ),
     struct(
         name = "remote_jdk8_linux",
         target_compatible_with = ["@platforms//os:linux", "@platforms//cpu:x86_64"],
-        sha256 = "6f9e3fa773829ac2553411fb0cdeb394980627c47c9ab8f8892d4b917b70e2dd",
-        strip_prefix = "zulu8.90.0.19-ca-jdk8.0.472-linux_x64",
-        urls = ["https://cdn.azul.com/zulu/bin/zulu8.90.0.19-ca-jdk8.0.472-linux_x64.tar.gz", "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu8.90.0.19-ca-jdk8.0.472-linux_x64.tar.gz"],
+        sha256 = "5923daaf12fd0b87e60e437aaae7b2e5b257846cdb8ac15065258fb59a1da70a",
+        strip_prefix = "zulu8.96.0.19-ca-jdk8.0.502-linux_x64",
+        urls = ["https://cdn.azul.com/zulu/bin/zulu8.96.0.19-ca-jdk8.0.502-linux_x64.tar.gz", "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu8.96.0.19-ca-jdk8.0.502-linux_x64.tar.gz"],
         version = "8",
     ),
     struct(
         name = "remote_jdk8_macos_aarch64",
         target_compatible_with = ["@platforms//os:macos", "@platforms//cpu:aarch64"],
-        sha256 = "823d547ab9508e3a2b8abd3c5de66a39a50a254dc5835747cf3c2617fbe55600",
-        strip_prefix = "zulu8.90.0.19-ca-jdk8.0.472-macosx_aarch64",
-        urls = ["https://cdn.azul.com/zulu/bin/zulu8.90.0.19-ca-jdk8.0.472-macosx_aarch64.tar.gz", "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu8.90.0.19-ca-jdk8.0.472-macosx_aarch64.tar.gz"],
+        sha256 = "9f9e5038c638e415e507e8b5118a774822f553a56e76bdf4b042c3fbe7b69083",
+        strip_prefix = "zulu8.96.0.19-ca-jdk8.0.502-macosx_aarch64",
+        urls = ["https://cdn.azul.com/zulu/bin/zulu8.96.0.19-ca-jdk8.0.502-macosx_aarch64.tar.gz", "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu8.96.0.19-ca-jdk8.0.502-macosx_aarch64.tar.gz"],
         version = "8",
+        patch_cmds = ["ln -s Contents/Home/* ."],
     ),
     struct(
         name = "remote_jdk8_macos",
         target_compatible_with = ["@platforms//os:macos", "@platforms//cpu:x86_64"],
-        sha256 = "96fb7bc3a2babd7f807484b1b8f1dfb8cf2c61ea27b2d0630e2237088b0a5100",
-        strip_prefix = "zulu8.90.0.19-ca-jdk8.0.472-macosx_x64",
-        urls = ["https://cdn.azul.com/zulu/bin/zulu8.90.0.19-ca-jdk8.0.472-macosx_x64.tar.gz", "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu8.90.0.19-ca-jdk8.0.472-macosx_x64.tar.gz"],
+        sha256 = "b29088ddb00f81db1e01d6d5bfddd44a58e46ef44b50c372cff3eb1bf5b23173",
+        strip_prefix = "zulu8.96.0.19-ca-jdk8.0.502-macosx_x64",
+        urls = ["https://cdn.azul.com/zulu/bin/zulu8.96.0.19-ca-jdk8.0.502-macosx_x64.tar.gz", "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu8.96.0.19-ca-jdk8.0.502-macosx_x64.tar.gz"],
         version = "8",
+        patch_cmds = ["ln -s Contents/Home/* ."],
     ),
     struct(
         name = "remote_jdk8_windows",
         target_compatible_with = ["@platforms//os:windows", "@platforms//cpu:x86_64"],
-        sha256 = "ff90484103d3fdb9808f737af027586c8dbfa1aa8a310ce99b0b5e0517567aee",
-        strip_prefix = "zulu8.90.0.19-ca-jdk8.0.472-win_x64",
-        urls = ["https://cdn.azul.com/zulu/bin/zulu8.90.0.19-ca-jdk8.0.472-win_x64.zip", "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu8.90.0.19-ca-jdk8.0.472-win_x64.zip"],
+        sha256 = "0d64e817ba56962d447339040f9e7bd1119f98b813d0a968e3485aab0c530a47",
+        strip_prefix = "zulu8.96.0.19-ca-jdk8.0.502-win_x64",
+        urls = ["https://cdn.azul.com/zulu/bin/zulu8.96.0.19-ca-jdk8.0.502-win_x64.zip", "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu8.96.0.19-ca-jdk8.0.502-win_x64.zip"],
         version = "8",
     ),
     struct(
@@ -134,41 +136,43 @@ _REMOTE_JDK_CONFIGS_LIST = [
     struct(
         name = "remotejdk11_linux_aarch64",
         target_compatible_with = ["@platforms//os:linux", "@platforms//cpu:aarch64"],
-        sha256 = "5a225a0fe0a92bc6c04c8c5aeb03c697c6fd114465829f23e494a2ad44fa1cc0",
-        strip_prefix = "zulu11.84.17-ca-jdk11.0.29-linux_aarch64",
-        urls = ["https://cdn.azul.com/zulu/bin/zulu11.84.17-ca-jdk11.0.29-linux_aarch64.tar.gz", "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu11.84.17-ca-jdk11.0.29-linux_aarch64.tar.gz"],
+        sha256 = "31fb32a1c9d842f96e8e79c683996e217d087b3aeac0cc6bfc39f028eb860146",
+        strip_prefix = "zulu11.90.19-ca-jdk11.0.32-linux_aarch64",
+        urls = ["https://cdn.azul.com/zulu/bin/zulu11.90.19-ca-jdk11.0.32-linux_aarch64.tar.gz", "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu11.90.19-ca-jdk11.0.32-linux_aarch64.tar.gz"],
         version = "11",
     ),
     struct(
         name = "remotejdk11_linux",
         target_compatible_with = ["@platforms//os:linux", "@platforms//cpu:x86_64"],
-        sha256 = "681b2e4bf7fedf4d20666fc2a954b83ff5675ccfb916c867267d29c85c2ee310",
-        strip_prefix = "zulu11.84.17-ca-jdk11.0.29-linux_x64",
-        urls = ["https://cdn.azul.com/zulu/bin/zulu11.84.17-ca-jdk11.0.29-linux_x64.tar.gz", "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu11.84.17-ca-jdk11.0.29-linux_x64.tar.gz"],
+        sha256 = "d4832d97886444346ed75fd1059c68c5e38795098e3273e4a0929fe2eb2abf76",
+        strip_prefix = "zulu11.90.19-ca-jdk11.0.32-linux_x64",
+        urls = ["https://cdn.azul.com/zulu/bin/zulu11.90.19-ca-jdk11.0.32-linux_x64.tar.gz", "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu11.90.19-ca-jdk11.0.32-linux_x64.tar.gz"],
         version = "11",
     ),
     struct(
         name = "remotejdk11_macos_aarch64",
         target_compatible_with = ["@platforms//os:macos", "@platforms//cpu:aarch64"],
-        sha256 = "09ed1734c2d88fadcb75fdbec1ba5467d32e7fa2b10894541aa8e3d3ce78dc2d",
-        strip_prefix = "zulu11.84.17-ca-jdk11.0.29-macosx_aarch64",
-        urls = ["https://cdn.azul.com/zulu/bin/zulu11.84.17-ca-jdk11.0.29-macosx_aarch64.tar.gz", "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu11.84.17-ca-jdk11.0.29-macosx_aarch64.tar.gz"],
+        sha256 = "a552338385fa27026ced01a3c56a3b3a2de048ed4b79907d876e99be80547551",
+        strip_prefix = "zulu11.90.19-ca-jdk11.0.32-macosx_aarch64",
+        urls = ["https://cdn.azul.com/zulu/bin/zulu11.90.19-ca-jdk11.0.32-macosx_aarch64.tar.gz", "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu11.90.19-ca-jdk11.0.32-macosx_aarch64.tar.gz"],
         version = "11",
+        patch_cmds = ["ln -s Contents/Home/* ."],
     ),
     struct(
         name = "remotejdk11_macos",
         target_compatible_with = ["@platforms//os:macos", "@platforms//cpu:x86_64"],
-        sha256 = "b7f5a37c47ed94af1c8ecf631b1dc6dec990958f3afd4222a7dd27d6ca1084bd",
-        strip_prefix = "zulu11.84.17-ca-jdk11.0.29-macosx_x64",
-        urls = ["https://cdn.azul.com/zulu/bin/zulu11.84.17-ca-jdk11.0.29-macosx_x64.tar.gz", "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu11.84.17-ca-jdk11.0.29-macosx_x64.tar.gz"],
+        sha256 = "5ba1b39cc08999645944bcfd54da48dd6c9a0891785d56cff95e92324fa841f6",
+        strip_prefix = "zulu11.90.19-ca-jdk11.0.32-macosx_x64",
+        urls = ["https://cdn.azul.com/zulu/bin/zulu11.90.19-ca-jdk11.0.32-macosx_x64.tar.gz", "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu11.90.19-ca-jdk11.0.32-macosx_x64.tar.gz"],
         version = "11",
+        patch_cmds = ["ln -s Contents/Home/* ."],
     ),
     struct(
         name = "remotejdk11_win",
         target_compatible_with = ["@platforms//os:windows", "@platforms//cpu:x86_64"],
-        sha256 = "f4002a8090662ff66bf9f3248604be0f9d226e964085bd59bbea4b8535df3de1",
-        strip_prefix = "zulu11.84.17-ca-jdk11.0.29-win_x64",
-        urls = ["https://cdn.azul.com/zulu/bin/zulu11.84.17-ca-jdk11.0.29-win_x64.zip", "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu11.84.17-ca-jdk11.0.29-win_x64.zip"],
+        sha256 = "700a42d5764b5f41ab43adbfe3e03deac329cc10886f2312a5908fd5a3c78d46",
+        strip_prefix = "zulu11.90.19-ca-jdk11.0.32-win_x64",
+        urls = ["https://cdn.azul.com/zulu/bin/zulu11.90.19-ca-jdk11.0.32-win_x64.zip", "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu11.90.19-ca-jdk11.0.32-win_x64.zip"],
         version = "11",
     ),
     struct(
@@ -198,49 +202,51 @@ _REMOTE_JDK_CONFIGS_LIST = [
     struct(
         name = "remotejdk17_linux_aarch64",
         target_compatible_with = ["@platforms//os:linux", "@platforms//cpu:aarch64"],
-        sha256 = "527b76fbd60e8f9644f6b70800d15160cdbd3344bc6fbf30d42e905f540a770c",
-        strip_prefix = "zulu17.62.17-ca-jdk17.0.17-linux_aarch64",
-        urls = ["https://cdn.azul.com/zulu/bin/zulu17.62.17-ca-jdk17.0.17-linux_aarch64.tar.gz", "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu17.62.17-ca-jdk17.0.17-linux_aarch64.tar.gz"],
+        sha256 = "46f1dc7678760d37d38699c5a5a34dea8ed451dcdf6d27890a7b61f025e7ff60",
+        strip_prefix = "zulu17.68.17-ca-jdk17.0.20-linux_aarch64",
+        urls = ["https://cdn.azul.com/zulu/bin/zulu17.68.17-ca-jdk17.0.20-linux_aarch64.tar.gz", "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu17.68.17-ca-jdk17.0.20-linux_aarch64.tar.gz"],
         version = "17",
     ),
     struct(
         name = "remotejdk17_linux",
         target_compatible_with = ["@platforms//os:linux", "@platforms//cpu:x86_64"],
-        sha256 = "1dcbbed73e95dc35f5c60402a84936f6830ff43c2a0dc0037a5657dbc25472c1",
-        strip_prefix = "zulu17.62.17-ca-jdk17.0.17-linux_x64",
-        urls = ["https://cdn.azul.com/zulu/bin/zulu17.62.17-ca-jdk17.0.17-linux_x64.tar.gz", "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu17.62.17-ca-jdk17.0.17-linux_x64.tar.gz"],
+        sha256 = "32c5efedf69f4a95635ea2923f6a6ee90ce6ca83df0bd43ba55dd662d5af429a",
+        strip_prefix = "zulu17.68.17-ca-jdk17.0.20-linux_x64",
+        urls = ["https://cdn.azul.com/zulu/bin/zulu17.68.17-ca-jdk17.0.20-linux_x64.tar.gz", "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu17.68.17-ca-jdk17.0.20-linux_x64.tar.gz"],
         version = "17",
     ),
     struct(
         name = "remotejdk17_macos_aarch64",
         target_compatible_with = ["@platforms//os:macos", "@platforms//cpu:aarch64"],
-        sha256 = "5558f7efe6297ecb20f422f31471555cd43e9499beb304b8f3ddc68796d2874b",
-        strip_prefix = "zulu17.62.17-ca-jdk17.0.17-macosx_aarch64",
-        urls = ["https://cdn.azul.com/zulu/bin/zulu17.62.17-ca-jdk17.0.17-macosx_aarch64.tar.gz", "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu17.62.17-ca-jdk17.0.17-macosx_aarch64.tar.gz"],
+        sha256 = "0da52534760b74ba8a42660384b2f4e44311a47ae52faa45fcbd829b2797b244",
+        strip_prefix = "zulu17.68.17-ca-jdk17.0.20-macosx_aarch64",
+        urls = ["https://cdn.azul.com/zulu/bin/zulu17.68.17-ca-jdk17.0.20-macosx_aarch64.tar.gz", "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu17.68.17-ca-jdk17.0.20-macosx_aarch64.tar.gz"],
         version = "17",
+        patch_cmds = ["ln -s Contents/Home/* ."],
     ),
     struct(
         name = "remotejdk17_macos",
         target_compatible_with = ["@platforms//os:macos", "@platforms//cpu:x86_64"],
-        sha256 = "e6b2fb0cd3f929225a179c2fb2813abd1834f839a3b4c8cdcb36067aa16b6f83",
-        strip_prefix = "zulu17.62.17-ca-jdk17.0.17-macosx_x64",
-        urls = ["https://cdn.azul.com/zulu/bin/zulu17.62.17-ca-jdk17.0.17-macosx_x64.tar.gz", "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu17.62.17-ca-jdk17.0.17-macosx_x64.tar.gz"],
+        sha256 = "b5bace4a346a7af0fe4f50904c46770e66d4b465800b038693c35e5d5b9bd52a",
+        strip_prefix = "zulu17.68.17-ca-jdk17.0.20-macosx_x64",
+        urls = ["https://cdn.azul.com/zulu/bin/zulu17.68.17-ca-jdk17.0.20-macosx_x64.tar.gz", "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu17.68.17-ca-jdk17.0.20-macosx_x64.tar.gz"],
         version = "17",
+        patch_cmds = ["ln -s Contents/Home/* ."],
     ),
     struct(
         name = "remotejdk17_win_arm64",
         target_compatible_with = ["@platforms//os:windows", "@platforms//cpu:arm64"],
-        sha256 = "c1bba9148907348da93b0de2c9abd56bd180efcb6b1f35068ab9785015fcd74b",
-        strip_prefix = "zulu17.62.17-ca-jdk17.0.17-win_aarch64",
-        urls = ["https://cdn.azul.com/zulu/bin/zulu17.62.17-ca-jdk17.0.17-win_aarch64.zip", "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu17.62.17-ca-jdk17.0.17-win_aarch64.zip"],
+        sha256 = "e125b3b64c9b5a0a2f2737e4a94ba275b541d8cc85d61c95ff875a3463ce0d8e",
+        strip_prefix = "zulu17.68.17-ca-jdk17.0.20-win_aarch64",
+        urls = ["https://cdn.azul.com/zulu/bin/zulu17.68.17-ca-jdk17.0.20-win_aarch64.zip", "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu17.68.17-ca-jdk17.0.20-win_aarch64.zip"],
         version = "17",
     ),
     struct(
         name = "remotejdk17_win",
         target_compatible_with = ["@platforms//os:windows", "@platforms//cpu:x86_64"],
-        sha256 = "bd8a942bb543f109a28d3eadf3ec2f29a3ee28ab53506e31d2858292f63c6949",
-        strip_prefix = "zulu17.62.17-ca-jdk17.0.17-win_x64",
-        urls = ["https://cdn.azul.com/zulu/bin/zulu17.62.17-ca-jdk17.0.17-win_x64.zip", "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu17.62.17-ca-jdk17.0.17-win_x64.zip"],
+        sha256 = "d207d8cec299f4d216bef1c7c081ba9504e79ba1cbc740de312d4a91b2d46436",
+        strip_prefix = "zulu17.68.17-ca-jdk17.0.20-win_x64",
+        urls = ["https://cdn.azul.com/zulu/bin/zulu17.68.17-ca-jdk17.0.20-win_x64.zip", "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu17.68.17-ca-jdk17.0.20-win_x64.zip"],
         version = "17",
     ),
     struct(
@@ -262,49 +268,51 @@ _REMOTE_JDK_CONFIGS_LIST = [
     struct(
         name = "remotejdk21_linux_aarch64",
         target_compatible_with = ["@platforms//os:linux", "@platforms//cpu:aarch64"],
-        sha256 = "a826a93c18d4388ec8d5d4057f5bb1b5c60f00ffc875ed299dea17aa947555ee",
-        strip_prefix = "zulu21.46.19-ca-jdk21.0.9-linux_aarch64",
-        urls = ["https://cdn.azul.com/zulu/bin/zulu21.46.19-ca-jdk21.0.9-linux_aarch64.tar.gz", "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu21.46.19-ca-jdk21.0.9-linux_aarch64.tar.gz"],
+        sha256 = "dc7ed9ab7dfd33f2ddb1cd8311d3b00738497961a420533d81088051eac3f195",
+        strip_prefix = "zulu21.52.15-ca-jdk21.0.12-linux_aarch64",
+        urls = ["https://cdn.azul.com/zulu/bin/zulu21.52.15-ca-jdk21.0.12-linux_aarch64.tar.gz", "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu21.52.15-ca-jdk21.0.12-linux_aarch64.tar.gz"],
         version = "21",
     ),
     struct(
         name = "remotejdk21_linux",
         target_compatible_with = ["@platforms//os:linux", "@platforms//cpu:x86_64"],
-        sha256 = "67e810b31427ac0ff1c249473595066a00bdf0f9265df186c32905d5f75c93b8",
-        strip_prefix = "zulu21.46.19-ca-jdk21.0.9-linux_x64",
-        urls = ["https://cdn.azul.com/zulu/bin/zulu21.46.19-ca-jdk21.0.9-linux_x64.tar.gz", "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu21.46.19-ca-jdk21.0.9-linux_x64.tar.gz"],
+        sha256 = "b1a9df12e798770d1b2db43b402a80f1e6080cff6d5d1d1fbe5c768fb4225f6a",
+        strip_prefix = "zulu21.52.15-ca-jdk21.0.12-linux_x64",
+        urls = ["https://cdn.azul.com/zulu/bin/zulu21.52.15-ca-jdk21.0.12-linux_x64.tar.gz", "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu21.52.15-ca-jdk21.0.12-linux_x64.tar.gz"],
         version = "21",
     ),
     struct(
         name = "remotejdk21_macos_aarch64",
         target_compatible_with = ["@platforms//os:macos", "@platforms//cpu:aarch64"],
-        sha256 = "b56112ad12d3dfe62802840655ecf198fe4ca48729824c939d65a69e803536c7",
-        strip_prefix = "zulu21.46.19-ca-jdk21.0.9-macosx_aarch64",
-        urls = ["https://cdn.azul.com/zulu/bin/zulu21.46.19-ca-jdk21.0.9-macosx_aarch64.tar.gz", "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu21.46.19-ca-jdk21.0.9-macosx_aarch64.tar.gz"],
+        sha256 = "84d38c4bf04f73d585bd319b949758d00abde50149a9522c2d9deef46b9a3ec6",
+        strip_prefix = "zulu21.52.15-ca-jdk21.0.12-macosx_aarch64",
+        urls = ["https://cdn.azul.com/zulu/bin/zulu21.52.15-ca-jdk21.0.12-macosx_aarch64.tar.gz", "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu21.52.15-ca-jdk21.0.12-macosx_aarch64.tar.gz"],
         version = "21",
+        patch_cmds = ["ln -s Contents/Home/* ."],
     ),
     struct(
         name = "remotejdk21_macos",
         target_compatible_with = ["@platforms//os:macos", "@platforms//cpu:x86_64"],
-        sha256 = "3d870d823e3e101189b00ad975188c0321e31056ac8ca8b487bcf4454f3b5cfe",
-        strip_prefix = "zulu21.46.19-ca-jdk21.0.9-macosx_x64",
-        urls = ["https://cdn.azul.com/zulu/bin/zulu21.46.19-ca-jdk21.0.9-macosx_x64.tar.gz", "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu21.46.19-ca-jdk21.0.9-macosx_x64.tar.gz"],
+        sha256 = "14e05cb1299c27cd26d3c5c6815723f63018df548dc7278c810767607902b4f4",
+        strip_prefix = "zulu21.52.15-ca-jdk21.0.12-macosx_x64",
+        urls = ["https://cdn.azul.com/zulu/bin/zulu21.52.15-ca-jdk21.0.12-macosx_x64.tar.gz", "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu21.52.15-ca-jdk21.0.12-macosx_x64.tar.gz"],
         version = "21",
+        patch_cmds = ["ln -s Contents/Home/* ."],
     ),
     struct(
         name = "remotejdk21_win_arm64",
         target_compatible_with = ["@platforms//os:windows", "@platforms//cpu:arm64"],
-        sha256 = "1210b169db7b40d7305a94d41ab3eb87aaee51108b43f8f7f36f0c2865107790",
-        strip_prefix = "zulu21.46.19-ca-jdk21.0.9-win_aarch64",
-        urls = ["https://cdn.azul.com/zulu/bin/zulu21.46.19-ca-jdk21.0.9-win_aarch64.zip", "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu21.46.19-ca-jdk21.0.9-win_aarch64.zip"],
+        sha256 = "d75658d371e025bb6378231551b4d53d1f5312cb0fccf7aa3b039d91ce1f0b7e",
+        strip_prefix = "zulu21.52.15-ca-jdk21.0.12-win_aarch64",
+        urls = ["https://cdn.azul.com/zulu/bin/zulu21.52.15-ca-jdk21.0.12-win_aarch64.zip", "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu21.52.15-ca-jdk21.0.12-win_aarch64.zip"],
         version = "21",
     ),
     struct(
         name = "remotejdk21_win",
         target_compatible_with = ["@platforms//os:windows", "@platforms//cpu:x86_64"],
-        sha256 = "0c9812c0fe527b59f48c70cb527035c8a7abe620b31f776b4ddc21bddc1cd067",
-        strip_prefix = "zulu21.46.19-ca-jdk21.0.9-win_x64",
-        urls = ["https://cdn.azul.com/zulu/bin/zulu21.46.19-ca-jdk21.0.9-win_x64.zip", "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu21.46.19-ca-jdk21.0.9-win_x64.zip"],
+        sha256 = "3c06e6693fd6fa725b985e66798a6a8293c75f52b793490754ad3c54d3d8b5a6",
+        strip_prefix = "zulu21.52.15-ca-jdk21.0.12-win_x64",
+        urls = ["https://cdn.azul.com/zulu/bin/zulu21.52.15-ca-jdk21.0.12-win_x64.zip", "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu21.52.15-ca-jdk21.0.12-win_x64.zip"],
         version = "21",
     ),
     struct(
@@ -334,49 +342,51 @@ _REMOTE_JDK_CONFIGS_LIST = [
     struct(
         name = "remotejdk25_linux_aarch64",
         target_compatible_with = ["@platforms//os:linux", "@platforms//cpu:aarch64"],
-        sha256 = "f7295abb1decb2f6e0ea9f760a70917f2d47356db4366d615c7ab9b01c3c6866",
-        strip_prefix = "zulu25.32.17-ca-jdk25.0.2-linux_aarch64",
-        urls = ["https://cdn.azul.com/zulu/bin/zulu25.32.17-ca-jdk25.0.2-linux_aarch64.tar.gz", "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu25.32.17-ca-jdk25.0.2-linux_aarch64.tar.gz"],
+        sha256 = "ae04e25b16116ddd0f72cb387742d5122bb29c4b94f0fed08ff2bccc395f9daa",
+        strip_prefix = "zulu25.36.15-ca-jdk25.0.4-linux_aarch64",
+        urls = ["https://cdn.azul.com/zulu/bin/zulu25.36.15-ca-jdk25.0.4-linux_aarch64.tar.gz", "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu25.36.15-ca-jdk25.0.4-linux_aarch64.tar.gz"],
         version = "25",
     ),
     struct(
         name = "remotejdk25_linux",
         target_compatible_with = ["@platforms//os:linux", "@platforms//cpu:x86_64"],
-        sha256 = "f1752d0051b6ca233625ddb2c18c9170edbe55c5ee6515bfefd8ea0197ee1c20",
-        strip_prefix = "zulu25.32.17-ca-jdk25.0.2-linux_x64",
-        urls = ["https://cdn.azul.com/zulu/bin/zulu25.32.17-ca-jdk25.0.2-linux_x64.tar.gz", "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu25.32.17-ca-jdk25.0.2-linux_x64.tar.gz"],
+        sha256 = "e476f5c98952cb365ca77a814dbe3c74341e71ae76d1a87d1c0a69c7d2b1b2d0",
+        strip_prefix = "zulu25.36.15-ca-jdk25.0.4-linux_x64",
+        urls = ["https://cdn.azul.com/zulu/bin/zulu25.36.15-ca-jdk25.0.4-linux_x64.tar.gz", "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu25.36.15-ca-jdk25.0.4-linux_x64.tar.gz"],
         version = "25",
     ),
     struct(
         name = "remotejdk25_macos_aarch64",
         target_compatible_with = ["@platforms//os:macos", "@platforms//cpu:aarch64"],
-        sha256 = "537ac74fa1ca2c4dd8f6063ddede0138ae4a896f128bfe10b428a7dcc4aa929f",
-        strip_prefix = "zulu25.32.17-ca-jdk25.0.2-macosx_aarch64",
-        urls = ["https://cdn.azul.com/zulu/bin/zulu25.32.17-ca-jdk25.0.2-macosx_aarch64.tar.gz", "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu25.32.17-ca-jdk25.0.2-macosx_aarch64.tar.gz"],
+        sha256 = "c422f22713510992c764a7d577ae4f5add223529ab356993f38f8df2d4b247bd",
+        strip_prefix = "zulu25.36.15-ca-jdk25.0.4-macosx_aarch64",
+        urls = ["https://cdn.azul.com/zulu/bin/zulu25.36.15-ca-jdk25.0.4-macosx_aarch64.tar.gz", "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu25.36.15-ca-jdk25.0.4-macosx_aarch64.tar.gz"],
         version = "25",
+        patch_cmds = ["ln -s Contents/Home/* ."],
     ),
     struct(
         name = "remotejdk25_macos",
         target_compatible_with = ["@platforms//os:macos", "@platforms//cpu:x86_64"],
-        sha256 = "fe22346c192920c5b84b23f4aa24e3debb0bb94fc428016f7c2b2c7790c82780",
-        strip_prefix = "zulu25.32.17-ca-jdk25.0.2-macosx_x64",
-        urls = ["https://cdn.azul.com/zulu/bin/zulu25.32.17-ca-jdk25.0.2-macosx_x64.tar.gz", "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu25.32.17-ca-jdk25.0.2-macosx_x64.tar.gz"],
+        sha256 = "63273c6b9e2d9b250a0009ffdaa6d9f27af6ba98772516c391276106fb9f2820",
+        strip_prefix = "zulu25.36.15-ca-jdk25.0.4-macosx_x64",
+        urls = ["https://cdn.azul.com/zulu/bin/zulu25.36.15-ca-jdk25.0.4-macosx_x64.tar.gz", "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu25.36.15-ca-jdk25.0.4-macosx_x64.tar.gz"],
         version = "25",
+        patch_cmds = ["ln -s Contents/Home/* ."],
     ),
     struct(
         name = "remotejdk25_win_arm64",
         target_compatible_with = ["@platforms//os:windows", "@platforms//cpu:arm64"],
-        sha256 = "5f44792a12af2100b4db9b5120c27c42af8080ad63bc9eaadc9ca25e5c7dd590",
-        strip_prefix = "zulu25.32.17-ca-jdk25.0.2-win_aarch64",
-        urls = ["https://cdn.azul.com/zulu/bin/zulu25.32.17-ca-jdk25.0.2-win_aarch64.zip", "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu25.32.17-ca-jdk25.0.2-win_aarch64.zip"],
+        sha256 = "2e8468229aea447152343fff87dbebe5c339e1fbab143a8f227f6b2f388c0a8c",
+        strip_prefix = "zulu25.36.15-ca-jdk25.0.4-win_aarch64",
+        urls = ["https://cdn.azul.com/zulu/bin/zulu25.36.15-ca-jdk25.0.4-win_aarch64.zip", "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu25.36.15-ca-jdk25.0.4-win_aarch64.zip"],
         version = "25",
     ),
     struct(
         name = "remotejdk25_win",
         target_compatible_with = ["@platforms//os:windows", "@platforms//cpu:x86_64"],
-        sha256 = "90bcbbcbe2fb7aec43ce8fd2efa024fcc48f00bbdcd7a76b58f912d6b97e6d56",
-        strip_prefix = "zulu25.32.17-ca-jdk25.0.2-win_x64",
-        urls = ["https://cdn.azul.com/zulu/bin/zulu25.32.17-ca-jdk25.0.2-win_x64.zip", "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu25.32.17-ca-jdk25.0.2-win_x64.zip"],
+        sha256 = "a91265f0f0fb40155befe8f1cae7d1a0ae2ab4b7760f52733160d206637b50d1",
+        strip_prefix = "zulu25.36.15-ca-jdk25.0.4-win_x64",
+        urls = ["https://cdn.azul.com/zulu/bin/zulu25.36.15-ca-jdk25.0.4-win_x64.zip", "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu25.36.15-ca-jdk25.0.4-win_x64.zip"],
         version = "25",
     ),
     struct(
@@ -425,6 +435,7 @@ def _remote_jdk_repos_for_version(version):
             strip_prefix = item.strip_prefix,
             urls = item.urls,
             version = item.version,
+            patch_cmds = getattr(item, "patch_cmds", []),
         )
 
 def remote_jdk8_repos(name = ""):
diff --git a/test/check_remote_jdk_configs.sh b/test/check_remote_jdk_configs.sh
index cea093c0..e7f27201 100755
--- a/test/check_remote_jdk_configs.sh
+++ b/test/check_remote_jdk_configs.sh
@@ -36,15 +36,14 @@ for config in "$@"; do
       fail "ERROR: wrong hash for ${name}! wanted: ${hash}, got: ${actual_hash}"
     fi
     if [[ -z "${url##*.tar.gz}" ]]; then
-      bin_dir=$(tar ztf ${TMP_FILE} | egrep '/bin(|/)$' | sort | head -n1)
+      root_dir=$(tar ztf ${TMP_FILE} --exclude='*/*')
     elif [[ -z "${url##*.zip}" ]]; then
-      bin_dir=$(unzip -Z1 ${TMP_FILE} | egrep '/bin(|/)/$' | sort | head -n1)
+      root_dir=$(unzip -Z1 ${TMP_FILE} | head -n1)
     else
       fail "ERROR: unexpected archive type for ${name}"
     fi
-    root_dir="${bin_dir%/bin*}"
-    if [ "${root_dir}" != "${strip_prefix}" ]; then
-      fail "ERROR: bad strip_prefix for ${name}, wanted: ${strip_prefix}, got: ${root_dir}"
+    if [ "${root_dir}" != "${strip_prefix}/" ]; then
+      fail "ERROR: bad strip_prefix for ${name}, wanted: ${strip_prefix}/, got: ${root_dir}"
     fi
     if [[ -n "${mirror_url}" ]]; then
       debug_log "checking mirror: ${mirror_url}"