diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9ff09149ca..8876778ba2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -56,9 +56,9 @@ jobs:
           sudo apt-get -y install graphicsmagick-imagemagick-compat
           sudo apt-get -y install exiftool
       - name: Setup Java
-        uses: actions/setup-java@v3
+        uses: actions/setup-java@v4
         with:
-          java-version: '8'
+          java-version: '11'
           distribution: 'corretto'
           cache: 'sbt'
       - name: SBT
diff --git a/.java-version b/.java-version
index 6259340971..b4de394767 100644
--- a/.java-version
+++ b/.java-version
@@ -1 +1 @@
-1.8
+11
diff --git a/.tool-versions b/.tool-versions
new file mode 100644
index 0000000000..b60a0e5cfc
--- /dev/null
+++ b/.tool-versions
@@ -0,0 +1 @@
+java corretto-11.0.24.8.1
diff --git a/build.sbt b/build.sbt
index 93050a2f7b..4edb2f8fc4 100644
--- a/build.sbt
+++ b/build.sbt
@@ -15,11 +15,11 @@ import com.typesafe.sbt.packager.debian.JDebPackaging
 ThisBuild / packageOptions += FixedTimestamp(Package.keepTimestamps)
 
 val commonSettings = Seq(
-  scalaVersion := "2.12.15",
+  scalaVersion := "2.12.20",
   description := "grid",
   organization := "com.gu",
   version := "0.1",
-  scalacOptions ++= Seq("-feature", "-deprecation", "-language:higherKinds", "-Xfatal-warnings"),
+  scalacOptions ++= Seq("-feature", "-deprecation", "-language:higherKinds", "-Xfatal-warnings", "-release:11"),
 
   // The Java SDK uses CBOR protocol
   // We use localstack in TEST. Kinesis in localstack uses kinesislite which requires CBOR to be disabled
@@ -220,7 +220,7 @@ def playProject(projectName: String, port: Int, path: Option[String] = None): Pr
     .dependsOn(restLib)
     .settings(commonSettings ++ buildInfo ++ Seq(
       playDefaultPort := port,
-      debianPackageDependencies := Seq("openjdk-8-jre-headless"),
+      debianPackageDependencies := Seq("java11-runtime-headless"),
       Linux / maintainer := "Guardian Developers <dig.dev.software@theguardian.com>",
       Linux / packageSummary := description.value,
       packageDescription := description.value,
@@ -244,9 +244,8 @@ def playProject(projectName: String, port: Int, path: Option[String] = None): Pr
         "-Dpidfile.path=/dev/null",
         s"-Dconfig.file=/usr/share/$projectName/conf/application.conf",
         s"-Dlogger.file=/usr/share/$projectName/conf/logback.xml",
-        "-J-XX:+PrintGCDetails",
-        "-J-XX:+PrintGCDateStamps",
-        s"-J-Xloggc:/var/log/$projectName/gc.log",
+        "-J-Xlog:gc*",
+        s"-J-Xlog:gc:/var/log/$projectName/gc.log",
         "-J-XX:+UseGCLogFileRotation",
         "-J-XX:NumberOfGCLogFiles=5",
         "-J-XX:GCLogFileSize=2M"
diff --git a/project/build.properties b/project/build.properties
index c8fcab543a..ee4c672cd0 100644
--- a/project/build.properties
+++ b/project/build.properties
@@ -1 +1 @@
-sbt.version=1.6.2
+sbt.version=1.10.1
diff --git a/project/plugins.sbt b/project/plugins.sbt
index 387b3f1422..6e28fff341 100644
--- a/project/plugins.sbt
+++ b/project/plugins.sbt
@@ -14,6 +14,18 @@ addSbtPlugin("com.typesafe.sbt" % "sbt-digest" % "1.1.4")
 
 addSbtPlugin("com.typesafe.sbt" % "sbt-gzip" % "1.0.2")
 
-// needed by Snyk to accurately report vulnerabilities
-// https://docs.snyk.io/scan-application-code/snyk-open-source/snyk-open-source-supported-languages-and-package-managers/snyk-for-scala
-addSbtPlugin("net.virtual-void" % "sbt-dependency-graph" % "0.10.0-RC1")
+/*
+   Without setting VersionScheme.Always here on `scala-xml`, sbt 1.8.0 will raise fatal 'version conflict' errors when
+   used with sbt plugins like `sbt-native-packager`, which currently use sort-of-incompatible versions of the `scala-xml`
+   library. sbt 1.8.0 has upgraded to Scala 2.12.17, which has itself upgraded to `scala-xml` 2.1.0
+   (see https://github.com/sbt/sbt/releases/tag/v1.8.0), but `sbt-native-packager` is currently using `scala-xml` 1.1.1,
+    and the `scala-xml` library declares that it uses specifically 'early-semver' version compatibility (see
+    https://www.scala-lang.org/blog/2021/02/16/preventing-version-conflicts-with-versionscheme.html#versionscheme-librarydependencyschemes-and-sbt-150 ),
+    meaning that for version x.y.z, `x` & `y` *must match exactly* for versions to be considered compatible by sbt.
+    By setting VersionScheme.Always here on `scala-xml`, we're overriding its declared version-compatability scheme,
+    choosing to tolerate the risk of binary incompatibility. We consider this to be safe because when set under
+    `projects/` (ie *not* in `build.sbt` itself) it only affects the compilation of build.sbt, not of the application
+    build itself. Once the build has succeeded, there is no further risk (ie of a runtime exception due to clashing
+    versions of `scala-xml`).
+ */
+libraryDependencySchemes += "org.scala-lang.modules" %% "scala-xml" % VersionScheme.Always
diff --git a/riff-raff.yaml b/riff-raff.yaml
index b80a12db4b..56adb0526c 100644
--- a/riff-raff.yaml
+++ b/riff-raff.yaml
@@ -89,7 +89,7 @@ deployments:
         AmiId:
           BuiltBy: amigo
           AmigoStage: PROD
-          Recipe: editorial-tools-focal-java8-ARM-WITH-cdk-base
+          Recipe: editorial-tools-focal-java11-ARM-WITH-cdk-base
         ImagingAmiId:
           BuiltBy: amigo
           AmigoStage: PROD