diff --git a/.github/workflows/java-ci.yml b/.github/workflows/java-ci.yml
index b3a4c22..95e677c 100644
--- a/.github/workflows/java-ci.yml
+++ b/.github/workflows/java-ci.yml
@@ -14,7 +14,13 @@ jobs:
 
      strategy:
        matrix:
-        java-version: [8, 11, 17, 21]
+        include:
+          - { java-version: 8, distribution: temurin }
+          - { java-version: 11, distribution: temurin }
+          - { java-version: 17, distribution: temurin }
+          - { java-version: 21, distribution: temurin }
+          # Adoptium has not published Temurin 27 yet, so the 27 legs use Zulu
+          - { java-version: 27, distribution: zulu }
 
      steps:
        - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -22,7 +28,7 @@ jobs:
        - name: Set up Java
          uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
          with:
-           distribution: 'temurin'
+           distribution: ${{ matrix.distribution }}
            java-version: ${{ matrix.java-version }}
 
        - name: Build and test SDK
@@ -41,7 +47,10 @@ jobs:
 
      strategy:
        matrix:
-        java-version: [17, 21]
+        include:
+          - { java-version: 17, distribution: temurin }
+          - { java-version: 21, distribution: temurin }
+          - { java-version: 27, distribution: zulu }
 
      steps:
        - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -49,7 +58,7 @@ jobs:
        - name: Set up Java
          uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
          with:
-           distribution: 'temurin'
+           distribution: ${{ matrix.distribution }}
            java-version: ${{ matrix.java-version }}
 
        - name: Inject dummy example config
diff --git a/duo-universal-sdk/pom.xml b/duo-universal-sdk/pom.xml
index fad2833..80e2b04 100644
--- a/duo-universal-sdk/pom.xml
+++ b/duo-universal-sdk/pom.xml
@@ -31,6 +31,16 @@
     </scm>
 
     <profiles>
+        <profile>
+            <!-- 4.11.0 is the last Mockito release that runs on Java 8 -->
+            <id>jdk8</id>
+            <activation>
+                <jdk>1.8</jdk>
+            </activation>
+            <properties>
+                <mockito.version>4.11.0</mockito.version>
+            </properties>
+        </profile>
         <profile>
             <id>release</id>
             <build>
@@ -109,6 +119,13 @@
             <groupId>com.squareup.retrofit2</groupId>
             <artifactId>converter-jackson</artifactId>
             <version>2.11.0</version>
+            <exclusions>
+                <!-- jackson-databind declares byte-buddy but never references it -->
+                <exclusion>
+                    <groupId>net.bytebuddy</groupId>
+                    <artifactId>byte-buddy</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
         <dependency>
             <groupId>com.auth0</groupId>
@@ -124,13 +141,22 @@
         <dependency>
             <groupId>org.mockito</groupId>
             <artifactId>mockito-core</artifactId>
-            <version>3.11.2</version>
+            <version>${mockito.version}</version>
             <scope>test</scope>
         </dependency>
+        <!-- Test only: Mockito mocks with byte-buddy and self-attaches with
+             byte-buddy-agent, so the two are pinned in lockstep. -->
         <dependency>
             <groupId>net.bytebuddy</groupId>
             <artifactId>byte-buddy</artifactId>
-            <version>1.15.4</version>
+            <version>1.17.7</version>
+            <scope>test</scope>
+        </dependency>
+        <dependency>
+            <groupId>net.bytebuddy</groupId>
+            <artifactId>byte-buddy-agent</artifactId>
+            <version>1.17.7</version>
+            <scope>test</scope>
         </dependency>
     </dependencies>
 
@@ -144,7 +170,7 @@
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-assembly-plugin</artifactId>
-                <version>2.5.4</version>
+                <version>3.8.0</version>
                 <configuration>
                     <descriptorRefs>
                         <descriptorRef>jar-with-dependencies</descriptorRef>
@@ -155,7 +181,7 @@
                         <id>make-assembly</id>
                         <phase>package</phase>
                         <goals>
-                            <goal>attached</goal>
+                            <goal>single</goal>
                         </goals>
                     </execution>
                 </executions>
@@ -184,19 +210,7 @@
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-surefire-plugin</artifactId>
-                <version>2.22.1</version>
-                <dependencies>
-                    <dependency>
-                        <groupId>org.junit.platform</groupId>
-                        <artifactId>junit-platform-surefire-provider</artifactId>
-                        <version>1.2.0-M1</version>
-                    </dependency>
-                    <dependency>
-                        <groupId>org.junit.jupiter</groupId>
-                        <artifactId>junit-jupiter-engine</artifactId>
-                        <version>5.2.0-M1</version>
-                    </dependency>
-                </dependencies>
+                <version>3.6.0</version>
             </plugin>
             <plugin>
                 <groupId>org.cyclonedx</groupId>
@@ -220,5 +234,8 @@
     <properties>
         <maven.compiler.source>1.8</maven.compiler.source>
         <maven.compiler.target>1.8</maven.compiler.target>
+        <!-- Mockito 5 is needed to mock on JDK 22 and newer. It is compiled for Java 11,
+             so the jdk8 profile drops back to the 4.x line when building on a Java 8 JDK. -->
+        <mockito.version>5.23.0</mockito.version>
     </properties>
 </project>
diff --git a/duo-universal-sdk/src/test/java/com/duosecurity/ClientTest.java b/duo-universal-sdk/src/test/java/com/duosecurity/ClientTest.java
index 5f167b6..3b3510a 100644
--- a/duo-universal-sdk/src/test/java/com/duosecurity/ClientTest.java
+++ b/duo-universal-sdk/src/test/java/com/duosecurity/ClientTest.java
@@ -19,8 +19,8 @@
 import java.net.URL;
 
 import static org.junit.jupiter.api.Assertions.*;
-import static org.mockito.Matchers.any;
-import static org.mockito.Matchers.anyString;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyString;
 import static org.mockito.Mockito.verify;
 
 class ClientTest {