diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
new file mode 100644
index 00000000000..ddf38c5e885
--- /dev/null
+++ b/.github/workflows/deploy.yml
@@ -0,0 +1,33 @@
+name: Publish package to GitHub Packages
+on:
+  push:
+  release:
+    types: [created]
+permissions:
+  contents: read
+jobs:
+  publish:
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - name: Install Harden-Runner
+        uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
+        with:
+          disable-sudo: true
+          egress-policy: audit
+      - name: Check out code and set up JDK and Maven
+        uses: s4u/setup-maven-action@9a27433d289dd99d73851f653607c39d3444e8ba # v1.17.0
+        with:
+          java-version: |
+            25-ea
+            17.0.13
+          java-distribution: temurin
+          maven-version: 3.9.9
+      - name: Publish package
+        run: mvn -B deploy -DaltDeploymentRepository=github::https://maven.pkg.github.com/PicnicSupermarket/error-prone
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Remove installed project artifacts
+        run: mvn dependency:purge-local-repository -DmanualInclude='${project.groupId}' -DresolutionFuzziness=groupId
diff --git a/check_api/pom.xml b/check_api/pom.xml
index 061e83e0e6b..1c29be239e5 100644
--- a/check_api/pom.xml
+++ b/check_api/pom.xml
@@ -177,7 +177,7 @@
             <id>default-compile</id>
             <configuration>
               <jdkToolchain>
-                <version>17</version>
+                <version>17.0.13</version>
               </jdkToolchain>
             </configuration>
           </execution>
diff --git a/pom.xml b/pom.xml
index ab4c991ff5d..e1f32458d7e 100644
--- a/pom.xml
+++ b/pom.xml
@@ -302,8 +302,8 @@
         <configuration>
           <toolchains>
             <jdk>
-              <version>17</version>
-              <version>25</version>
+              <version>17.0.13</version>
+              <version>25-ea</version>
             </jdk>
           </toolchains>
         </configuration>