diff --git a/.github/actions/gradle-setup/action.yml b/.github/actions/gradle-setup/action.yml
index a42959190..29aafda95 100644
--- a/.github/actions/gradle-setup/action.yml
+++ b/.github/actions/gradle-setup/action.yml
@@ -7,6 +7,9 @@ inputs:
   jdk_distribution:
     description: 'JDK distribution (temurin or jetbrains)'
     default: 'temurin'
+  install_jetbrains_jdk:
+    description: 'Also install JetBrains JDK 21 for Compose Desktop toolchain resolution'
+    default: 'false'
   gradle_encryption_key:
     description: 'Encryption key for Gradle remote cache'
     required: false
@@ -27,6 +30,14 @@ runs:
         distribution: ${{ inputs.jdk_distribution }}
         token: ${{ github.token }}
 
+    - name: Set up JetBrains JDK 21 (for Compose Desktop)
+      if: inputs.install_jetbrains_jdk == 'true'
+      uses: actions/setup-java@v5
+      with:
+        java-version: '21'
+        distribution: 'jetbrains'
+        token: ${{ github.token }}
+
     - name: Setup Gradle
       uses: gradle/actions/setup-gradle@v6
       with:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d1fa993b3..40c0e032f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -286,6 +286,7 @@ jobs:
         with:
           gradle_encryption_key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
           cache_read_only: 'false'
+          install_jetbrains_jdk: 'true'
 
       - name: Install dependencies for AppImage
         if: runner.os == 'Linux'
@@ -369,6 +370,7 @@ jobs:
         with:
           gradle_encryption_key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
           cache_read_only: 'true'
+          install_jetbrains_jdk: 'true'
 
       # Uses an isolated Gradle user home so every artifact actually traverses the
       # network — the flatpak-sources plugin captures URLs via BuildOperationListener and
diff --git a/.github/workflows/reusable-check.yml b/.github/workflows/reusable-check.yml
index 906cc4da1..54588252e 100644
--- a/.github/workflows/reusable-check.yml
+++ b/.github/workflows/reusable-check.yml
@@ -534,6 +534,7 @@ jobs:
         with:
           gradle_encryption_key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
           cache_read_only: ${{ needs.setup.outputs.cache_read_only }}
+          install_jetbrains_jdk: 'true'
 
       - name: Build Desktop
         run: ./gradlew :desktopApp:createDistributable -Pci=true
@@ -574,6 +575,7 @@ jobs:
         with:
           gradle_encryption_key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
           cache_read_only: true
+          install_jetbrains_jdk: 'true'
 
       # Isolated Gradle user home — see explanation in release.yml.
       # packageUberJarForCurrentOS is what the in-flatpak build invokes; it resolves the FULL
diff --git a/.github/workflows/verify-flatpak.yml b/.github/workflows/verify-flatpak.yml
index 0fc90c065..c70848952 100644
--- a/.github/workflows/verify-flatpak.yml
+++ b/.github/workflows/verify-flatpak.yml
@@ -31,6 +31,11 @@ jobs:
           distribution: temurin
           java-version: 21
 
+      - uses: actions/setup-java@v5
+        with:
+          distribution: jetbrains
+          java-version: 21
+
       - uses: gradle/actions/setup-gradle@v6
 
       - name: Generate flatpak-sources.json