diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ea0f87ed..0a63b045 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -25,22 +25,22 @@ jobs:
     strategy:
       fail-fast: false # We want to see all results
       matrix:
-        agp: ['8.1.0', '8.2.0-alpha13']
+        agp: ['8.1.2', '8.2.0-beta06', '8.3.0-alpha07']
         job: ['instrumentation', 'plugin']
     env:
       DEP_OVERRIDE_agp: ${{ matrix.agp }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
 
       - name: Gradle Wrapper Validation
         uses: gradle/wrapper-validation-action@v1
 
-      - name: Install JDK ${{ matrix.java }}
+      - name: Install JDK
         uses: actions/setup-java@v3
         with:
           distribution: 'zulu'
-          java-version: '19'
+          java-version: '20'
 
       - name: Spot check
         run: ./gradlew spotlessCheck
@@ -114,7 +114,7 @@ jobs:
         if: failure()
         uses: actions/upload-artifact@v3
         with:
-          name: error-report
+          name: error-report-${{ matrix.job }}-${{ matrix.agp }}
           path: build-reports.zip
 
   publish-snapshots:
@@ -124,13 +124,13 @@ jobs:
     needs: 'build'
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
 
       - name: Install JDK
         uses: actions/setup-java@v3
         with:
           distribution: 'zulu'
-          java-version: '19'
+          java-version: '20'
 
       # Just here to restore cache
       - name: Gradle prep
diff --git a/build.gradle.kts b/build.gradle.kts
index ca4f2d08..d89f3985 100644
--- a/build.gradle.kts
+++ b/build.gradle.kts
@@ -27,7 +27,7 @@ plugins {
 
 subprojects {
   pluginManager.withPlugin("java") {
-    configure<JavaPluginExtension> { toolchain { languageVersion.set(JavaLanguageVersion.of(19)) } }
+    configure<JavaPluginExtension> { toolchain { languageVersion.set(JavaLanguageVersion.of(20)) } }
 
     tasks.withType<JavaCompile>().configureEach { options.release.set(11) }
   }
@@ -42,6 +42,15 @@ subprojects {
   }
 }
 
+configurations
+  .matching { it.name.startsWith("spotless") }
+  .configureEach {
+    resolutionStrategy {
+      // Guava's new gradle metadata is a dumpster fire https://github.com/google/guava/issues/6612
+      force("com.google.guava:guava:32.0.1-jre")
+    }
+  }
+
 spotless {
   format("misc") {
     target("**/*.md", ".gitignore")
diff --git a/gradle.properties b/gradle.properties
index 0b85d0aa..389c9d78 100644
--- a/gradle.properties
+++ b/gradle.properties
@@ -16,6 +16,9 @@
 
 android.useAndroidX=true
 
+# This isn't reliable on actions
+org.gradle.java.installations.auto-download=false
+
 # For GJF
 org.gradle.jvmargs=--add-exports jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED \
   --add-exports jdk.compiler/com.sun.tools.javac.file=ALL-UNNAMED \
diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml
index 937fc097..6ddcbb8e 100644
--- a/gradle/libs.versions.toml
+++ b/gradle/libs.versions.toml
@@ -1,21 +1,21 @@
 [versions]
-agp = "8.1.0"
-androidx-test = "1.5.2"
-kotlin = "1.8.22"
-gjf = "1.17.0"
-ktfmt = "0.44"
+agp = "8.1.2"
+androidx-test = "1.6.0-alpha04"
+kotlin = "1.9.10"
+gjf = "1.18.1"
+ktfmt = "0.46"
 
 [plugins]
 agp-library = { id = "com.android.library", version.ref = "agp" }
 binaryCompatibilityValidator = { id = "org.jetbrains.kotlinx.binary-compatibility-validator", version = "0.13.2" }
 kotlin-jvm = { id = "org.jetbrains.kotlin.jvm", version.ref = "kotlin" }
 mavenPublish = { id = "com.vanniktech.maven.publish", version = "0.25.3" }
-spotless = { id = "com.diffplug.spotless", version = "6.20.0" }
+spotless = { id = "com.diffplug.spotless", version = "6.22.0" }
 
 [libraries]
-androidx-annotation = "androidx.annotation:annotation:1.6.0"
-androidx-test-orchestrator = "androidx.test:orchestrator:1.4.2"
-androidx-test-rules = { module = "androidx.test:rules", version = "1.5.0" }
+androidx-annotation = "androidx.annotation:annotation:1.7.0"
+androidx-test-orchestrator = "androidx.test:orchestrator:1.5.0-alpha01"
+androidx-test-rules = { module = "androidx.test:rules", version = "1.6.0-alpha01" }
 androidx-test-runner = { module = "androidx.test:runner", version.ref = "androidx-test" }
 androidx-test-truth = "androidx.test.ext:junit:1.1.5"
 agp = { module = "com.android.tools.build:gradle", version.ref = "agp" }
@@ -25,7 +25,7 @@ junit = "junit:junit:4.13.2"
 kgp = { module = "org.jetbrains.kotlin:kotlin-gradle-plugin", version.ref = "kotlin" }
 kgp-api = { module = "org.jetbrains.kotlin:kotlin-gradle-plugin-api", version.ref = "kotlin" }
 kotlinpoet = "com.squareup:kotlinpoet:1.14.2"
-okio = "com.squareup.okio:okio:3.4.0"
+okio = "com.squareup.okio:okio:3.6.0"
 truth = "com.google.truth:truth:1.1.5"
 zipflinger = { module = "com.android:zipflinger", version.ref = "agp" }
 
diff --git a/gradle/wrapper/gradle-wrapper.jar b/gradle/wrapper/gradle-wrapper.jar
index 033e24c4..7f93135c 100644
Binary files a/gradle/wrapper/gradle-wrapper.jar and b/gradle/wrapper/gradle-wrapper.jar differ
diff --git a/gradle/wrapper/gradle-wrapper.properties b/gradle/wrapper/gradle-wrapper.properties
index 9f4197d5..3fa8f862 100644
--- a/gradle/wrapper/gradle-wrapper.properties
+++ b/gradle/wrapper/gradle-wrapper.properties
@@ -1,6 +1,6 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-8.2.1-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.4-bin.zip
 networkTimeout=10000
 validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME
diff --git a/gradlew b/gradlew
index fcb6fca1..1aa94a42 100755
--- a/gradlew
+++ b/gradlew
@@ -83,7 +83,8 @@ done
 # This is normally unused
 # shellcheck disable=SC2034
 APP_BASE_NAME=${0##*/}
-APP_HOME=$( cd "${APP_HOME:-./}" && pwd -P ) || exit
+# Discard cd standard output in case $CDPATH is set (https://github.com/gradle/gradle/issues/25036)
+APP_HOME=$( cd "${APP_HOME:-./}" > /dev/null && pwd -P ) || exit
 
 # Use the maximum available, or set MAX_FD != -1 to use that value.
 MAX_FD=maximum
@@ -144,7 +145,7 @@ if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
     case $MAX_FD in #(
       max*)
         # In POSIX sh, ulimit -H is undefined. That's why the result is checked to see if it worked.
-        # shellcheck disable=SC3045
+        # shellcheck disable=SC2039,SC3045
         MAX_FD=$( ulimit -H -n ) ||
             warn "Could not query maximum file descriptor limit"
     esac
@@ -152,7 +153,7 @@ if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
       '' | soft) :;; #(
       *)
         # In POSIX sh, ulimit -n is undefined. That's why the result is checked to see if it worked.
-        # shellcheck disable=SC3045
+        # shellcheck disable=SC2039,SC3045
         ulimit -n "$MAX_FD" ||
             warn "Could not set maximum file descriptor limit to $MAX_FD"
     esac
@@ -201,11 +202,11 @@ fi
 # Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
 DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
 
-# Collect all arguments for the java command;
-#   * $DEFAULT_JVM_OPTS, $JAVA_OPTS, and $GRADLE_OPTS can contain fragments of
-#     shell script including quotes and variable substitutions, so put them in
-#     double quotes to make sure that they get re-expanded; and
-#   * put everything else in single quotes, so that it's not re-expanded.
+# Collect all arguments for the java command:
+#   * DEFAULT_JVM_OPTS, JAVA_OPTS, JAVA_OPTS, and optsEnvironmentVar are not allowed to contain shell fragments,
+#     and any embedded shellness will be escaped.
+#   * For example: A user cannot expect ${Hostname} to be expanded, as it is an environment variable and will be
+#     treated as '${Hostname}' itself on the command line.
 
 set -- \
         "-Dorg.gradle.appname=$APP_BASE_NAME" \
diff --git a/keeper-gradle-plugin/build.gradle.kts b/keeper-gradle-plugin/build.gradle.kts
index 933617db..337b23aa 100644
--- a/keeper-gradle-plugin/build.gradle.kts
+++ b/keeper-gradle-plugin/build.gradle.kts
@@ -65,7 +65,7 @@ sourceSets {
   getByName("test").resources.srcDirs(project.layout.buildDirectory.dir("pluginUnderTestMetadata"))
 }
 
-java { toolchain { languageVersion.set(JavaLanguageVersion.of(19)) } }
+java { toolchain { languageVersion.set(JavaLanguageVersion.of(20)) } }
 
 tasks.withType<JavaCompile>().configureEach { options.release.set(17) }
 
diff --git a/keeper-gradle-plugin/gradle/wrapper/gradle-wrapper.jar b/keeper-gradle-plugin/gradle/wrapper/gradle-wrapper.jar
index 033e24c4..7f93135c 100644
Binary files a/keeper-gradle-plugin/gradle/wrapper/gradle-wrapper.jar and b/keeper-gradle-plugin/gradle/wrapper/gradle-wrapper.jar differ
diff --git a/keeper-gradle-plugin/gradle/wrapper/gradle-wrapper.properties b/keeper-gradle-plugin/gradle/wrapper/gradle-wrapper.properties
index 9f4197d5..3fa8f862 100644
--- a/keeper-gradle-plugin/gradle/wrapper/gradle-wrapper.properties
+++ b/keeper-gradle-plugin/gradle/wrapper/gradle-wrapper.properties
@@ -1,6 +1,6 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-8.2.1-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.4-bin.zip
 networkTimeout=10000
 validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME
diff --git a/keeper-gradle-plugin/gradlew b/keeper-gradle-plugin/gradlew
index fcb6fca1..1aa94a42 100755
--- a/keeper-gradle-plugin/gradlew
+++ b/keeper-gradle-plugin/gradlew
@@ -83,7 +83,8 @@ done
 # This is normally unused
 # shellcheck disable=SC2034
 APP_BASE_NAME=${0##*/}
-APP_HOME=$( cd "${APP_HOME:-./}" && pwd -P ) || exit
+# Discard cd standard output in case $CDPATH is set (https://github.com/gradle/gradle/issues/25036)
+APP_HOME=$( cd "${APP_HOME:-./}" > /dev/null && pwd -P ) || exit
 
 # Use the maximum available, or set MAX_FD != -1 to use that value.
 MAX_FD=maximum
@@ -144,7 +145,7 @@ if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
     case $MAX_FD in #(
       max*)
         # In POSIX sh, ulimit -H is undefined. That's why the result is checked to see if it worked.
-        # shellcheck disable=SC3045
+        # shellcheck disable=SC2039,SC3045
         MAX_FD=$( ulimit -H -n ) ||
             warn "Could not query maximum file descriptor limit"
     esac
@@ -152,7 +153,7 @@ if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
       '' | soft) :;; #(
       *)
         # In POSIX sh, ulimit -n is undefined. That's why the result is checked to see if it worked.
-        # shellcheck disable=SC3045
+        # shellcheck disable=SC2039,SC3045
         ulimit -n "$MAX_FD" ||
             warn "Could not set maximum file descriptor limit to $MAX_FD"
     esac
@@ -201,11 +202,11 @@ fi
 # Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
 DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
 
-# Collect all arguments for the java command;
-#   * $DEFAULT_JVM_OPTS, $JAVA_OPTS, and $GRADLE_OPTS can contain fragments of
-#     shell script including quotes and variable substitutions, so put them in
-#     double quotes to make sure that they get re-expanded; and
-#   * put everything else in single quotes, so that it's not re-expanded.
+# Collect all arguments for the java command:
+#   * DEFAULT_JVM_OPTS, JAVA_OPTS, JAVA_OPTS, and optsEnvironmentVar are not allowed to contain shell fragments,
+#     and any embedded shellness will be escaped.
+#   * For example: A user cannot expect ${Hostname} to be expanded, as it is an environment variable and will be
+#     treated as '${Hostname}' itself on the command line.
 
 set -- \
         "-Dorg.gradle.appname=$APP_BASE_NAME" \
diff --git a/keeper-gradle-plugin/src/main/java/com/slack/keeper/KeeperPlugin.kt b/keeper-gradle-plugin/src/main/java/com/slack/keeper/KeeperPlugin.kt
index e224e494..6ed75bbd 100644
--- a/keeper-gradle-plugin/src/main/java/com/slack/keeper/KeeperPlugin.kt
+++ b/keeper-gradle-plugin/src/main/java/com/slack/keeper/KeeperPlugin.kt
@@ -92,9 +92,9 @@ public class KeeperPlugin : Plugin<Project> {
 
   internal companion object {
     const val INTERMEDIATES_DIR = "intermediates/keeper"
-    const val TRACE_REFERENCES_DEFAULT_VERSION = "3.2.78"
+    const val TRACE_REFERENCES_DEFAULT_VERSION = "8.1.56"
     const val CONFIGURATION_NAME = "keeperR8"
-    private val MIN_GRADLE_VERSION = GradleVersion.version("7.5")
+    private val MIN_GRADLE_VERSION = GradleVersion.version("8.0")
 
     fun interpolateR8TaskName(variantName: String): String {
       return "minify${variantName.capitalize(Locale.US)}WithR8"
diff --git a/keeper-gradle-plugin/src/test/kotlin/com/slack/keeper/KeeperFunctionalTest.kt b/keeper-gradle-plugin/src/test/kotlin/com/slack/keeper/KeeperFunctionalTest.kt
index b4ab944e..a2592e50 100644
--- a/keeper-gradle-plugin/src/test/kotlin/com/slack/keeper/KeeperFunctionalTest.kt
+++ b/keeper-gradle-plugin/src/test/kotlin/com/slack/keeper/KeeperFunctionalTest.kt
@@ -394,23 +394,23 @@ private fun buildGradleFile(
   }
 
   plugins {
-    id 'com.android.application' version '8.0.0-beta03'
-    id 'org.jetbrains.kotlin.android' version '1.8.10'
+    id 'com.android.application' version '8.1.2'
+    id 'org.jetbrains.kotlin.android' version '1.9.10'
     id 'com.slack.keeper'
   }
 
-  java { toolchain { languageVersion.set(JavaLanguageVersion.of(19)) } }
+  java { toolchain { languageVersion.set(JavaLanguageVersion.of(20)) } }
 
   tasks.withType(KotlinCompile).configureEach { compilerOptions { jvmTarget.set(JvmTarget.JVM_11) } }
 
   android {
-    compileSdkVersion 33
+    compileSdkVersion 34
     namespace "com.slack.keeper.sample"
 
     defaultConfig {
       applicationId "com.slack.keeper.sample"
       minSdk 21
-      targetSdk 33
+      targetSdk 34
     }
 
     compileOptions {
diff --git a/sample-libraries/a/build.gradle b/sample-libraries/a/build.gradle
index 8ba96a86..04c65f6f 100644
--- a/sample-libraries/a/build.gradle
+++ b/sample-libraries/a/build.gradle
@@ -20,7 +20,7 @@ plugins {
 }
 
 android {
-  compileSdk 33
+  compileSdk 34
   namespace = "com.slack.keeper.sample.a"
 
   defaultConfig {
diff --git a/sample-libraries/b/build.gradle b/sample-libraries/b/build.gradle
index f587a998..06be9094 100644
--- a/sample-libraries/b/build.gradle
+++ b/sample-libraries/b/build.gradle
@@ -20,7 +20,7 @@ plugins {
 }
 
 android {
-  compileSdk 33
+  compileSdk 34
   namespace = "com.slack.keeper.sample.b"
 
   defaultConfig {
diff --git a/sample-libraries/test-only-android/build.gradle b/sample-libraries/test-only-android/build.gradle
index 5cb43f1d..d2310c5e 100644
--- a/sample-libraries/test-only-android/build.gradle
+++ b/sample-libraries/test-only-android/build.gradle
@@ -20,7 +20,7 @@ plugins {
 }
 
 android {
-  compileSdk 33
+  compileSdk 34
   namespace = "com.slack.keeper.sample.testonlyandroid"
 
   defaultConfig {