diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5c62b6298..bc984d182 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -37,6 +37,49 @@ jobs:
           annotate_only: true
           job_summary: true
 
+  # The tests of `build` on the newer JDKs, in parallel with everything else: nothing waits for these
+  # jobs and nothing they build is kept. The code is still compiled for Java 21 by JDK 21, as in the
+  # release; -PjavaRuntime moves only the test JVMs, and with them the javac whose internals the
+  # formatter parses with. The IntelliJ plugin's tests stay on the runtime of the IDE they start.
+  # JDK 21 itself is `build`, the check the main branch requires.
+  jdk:
+    name: build (JDK ${{ matrix.jdk }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        jdk: [25, 26, 27]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Install JDK ${{ matrix.jdk }} for the tests
+        id: test-jdk
+        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+        with:
+          distribution: temurin
+          java-version: ${{ matrix.jdk }}
+
+      # Installed last, so that it is the JAVA_HOME Gradle runs and compiles on.
+      - name: Install JDK 21
+        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+        with:
+          distribution: temurin
+          java-version: '21'
+
+      # Gradle does not look into the runner's tool cache, so it is told where the test JDK is.
+      - name: Build
+        run: >-
+          ./gradlew test -PjavaRuntime=${{ matrix.jdk }}
+          -Porg.gradle.java.installations.paths=${{ steps.test-jdk.outputs.path }}
+
+      - name: Publish Test Report
+        uses: mikepenz/action-junit-report@a9170d5795813c01ab4901ffb045b52bab4ab09d # v6.5.0
+        if: ${{ !cancelled() }}
+        with:
+          report_paths: '**/build/test-results/test/*.xml'
+          annotate_only: true
+          job_summary: true
+
   # One explicit job per target, so every binary we ship is traceable to a named run.
   native:
     name: native (${{ matrix.platform }})
diff --git a/README.md b/README.md
index 1be167feb..ad4eef38c 100644
--- a/README.md
+++ b/README.md
@@ -119,6 +119,10 @@ mise trust && mise install
 ./gradlew test      # what the CI build job runs
 ```
 
+`-PjavaRuntime=25` runs the same tests on JDK 25, as CI's `jdk` jobs do for 25, 26 and 27. The code
+is compiled for Java 21 either way. Gradle has to find that JDK: installed with mise, or named with
+`-Porg.gradle.java.installations.paths=/path/to/jdk`.
+
 Nothing inside the build downloads a JDK. `gradle.properties` turns toolchain auto-download off and
 reads the installations from `JDK21_HOME` and `GRAALVM_HOME`, so a missing JDK is an error you can
 read rather than a silent download.
diff --git a/build.gradle b/build.gradle
index a73a45132..2093235e1 100644
--- a/build.gradle
+++ b/build.gradle
@@ -129,5 +129,7 @@ subprojects {
 
 javaVersions {
     libraryTarget = 21
-    runtime = 21
+    // The JDK the tests run on, and with it the javac whose internals the formatter parses with. The code is
+    // compiled for 21 whatever this says. CI's `jdk` jobs pass -PjavaRuntime=25 and so on.
+    runtime = providers.gradleProperty('javaRuntime').getOrElse('21')
 }