diff --git a/java-11/Dockerfile b/java-11/Dockerfile
index ea67a4a..4441a2a 100644
--- a/java-11/Dockerfile
+++ b/java-11/Dockerfile
@@ -1,33 +1,9 @@
-# Zulu build name, e.g. zulu11.54.107-ca-jdk11.0.13 (see java.version)
 ARG JAVA_VERSION
 ARG BASE_IMAGE
-# The azul/zulu-openjdk-debian image has no tag with the eMudhra blocked.certs fix yet, so fetch the
-# Zulu CA build straight from Azul's CDN. The SHA-256 pins the download. jlink copies blocked.certs
-# from the JDK it runs, so it must be the fixed one.
-# TEMP: go back to azul/zulu-openjdk-debian once it publishes a tag with the fix.
-FROM debian:trixie-slim AS jre
-ARG JAVA_VERSION
-ARG TARGETARCH
-# Update these together with java.version.
-ARG ZULU_SHA256_AMD64=64658a2be5140c2ffd571c0e09ac3b505a2be0d4654e09957b584b54b4dac8b5
-ARG ZULU_SHA256_ARM64=abed984a694d4da40662ec0bdfd2ecbe798bab1b8ce784d4f02d00479d53e802
+FROM azul/zulu-openjdk-debian:${JAVA_VERSION} AS jre
 
 # Needed for --strip-debug
-RUN apt-get -y update && apt-get -y upgrade libssl3 && apt-get -y install binutils curl ca-certificates
-
-RUN case "${TARGETARCH}" in \
-      amd64) ZULU_ARCH=x64; ZULU_SHA256="${ZULU_SHA256_AMD64}" ;; \
-      arm64) ZULU_ARCH=aarch64; ZULU_SHA256="${ZULU_SHA256_ARM64}" ;; \
-      *) echo "unsupported arch ${TARGETARCH}" >&2; exit 1 ;; \
-    esac \
-    && curl -fsSL -o /tmp/zulu.tar.gz "https://cdn.azul.com/zulu/bin/${JAVA_VERSION}-linux_${ZULU_ARCH}.tar.gz" \
-    && echo "${ZULU_SHA256}  /tmp/zulu.tar.gz" | sha256sum -c - \
-    && mkdir -p /usr/lib/jvm \
-    && tar -xzf /tmp/zulu.tar.gz -C /usr/lib/jvm \
-    && ln -s "/usr/lib/jvm/${JAVA_VERSION}-linux_${ZULU_ARCH}" /usr/lib/jvm/zulu \
-    && rm /tmp/zulu.tar.gz
-ENV JAVA_HOME=/usr/lib/jvm/zulu
-ENV PATH=${JAVA_HOME}/bin:${PATH}
+RUN apt-get -y update && apt-get -y upgrade libssl3 && apt-get -y install binutils ca-certificates
 
 # Included modules cherrypicked from https://docs.oracle.com/en/java/javase/11/docs/api/
 #
diff --git a/java-11/java.version b/java-11/java.version
index 1edb69a..1083209 100644
--- a/java-11/java.version
+++ b/java-11/java.version
@@ -1 +1 @@
-zulu11.92.109-ca-jdk11.0.33
\ No newline at end of file
+11.0.33-11.92
diff --git a/java-21/Dockerfile b/java-21/Dockerfile
index a25269d..0748987 100644
--- a/java-21/Dockerfile
+++ b/java-21/Dockerfile
@@ -1,33 +1,9 @@
-# Zulu build name, e.g. zulu21.54.107-ca-jdk21.0.13 (see java.version)
 ARG JAVA_VERSION
 ARG BASE_IMAGE
-# The azul/zulu-openjdk-debian image has no tag with the eMudhra blocked.certs fix yet, so fetch the
-# Zulu CA build straight from Azul's CDN. The SHA-256 pins the download. jlink copies blocked.certs
-# from the JDK it runs, so it must be the fixed one.
-# TEMP: go back to azul/zulu-openjdk-debian once it publishes a tag with the fix.
-FROM debian:trixie-slim AS jre
-ARG JAVA_VERSION
-ARG TARGETARCH
-# Update these together with java.version.
-ARG ZULU_SHA256_AMD64=dd8cf0628cfb8c369b7d4fe96783e2b516482b37d2b3e140b208c91deabf1169
-ARG ZULU_SHA256_ARM64=783460592bc66c9290b14c32a537b29da812bd62ad53bf6cb565355bca7ea563
+FROM azul/zulu-openjdk-debian:${JAVA_VERSION} AS jre
 
 # Needed for --strip-debug
-RUN apt-get -y update && apt-get -y upgrade libssl3 && apt-get -y install binutils curl ca-certificates
-
-RUN case "${TARGETARCH}" in \
-      amd64) ZULU_ARCH=x64; ZULU_SHA256="${ZULU_SHA256_AMD64}" ;; \
-      arm64) ZULU_ARCH=aarch64; ZULU_SHA256="${ZULU_SHA256_ARM64}" ;; \
-      *) echo "unsupported arch ${TARGETARCH}" >&2; exit 1 ;; \
-    esac \
-    && curl -fsSL -o /tmp/zulu.tar.gz "https://cdn.azul.com/zulu/bin/${JAVA_VERSION}-linux_${ZULU_ARCH}.tar.gz" \
-    && echo "${ZULU_SHA256}  /tmp/zulu.tar.gz" | sha256sum -c - \
-    && mkdir -p /usr/lib/jvm \
-    && tar -xzf /tmp/zulu.tar.gz -C /usr/lib/jvm \
-    && ln -s "/usr/lib/jvm/${JAVA_VERSION}-linux_${ZULU_ARCH}" /usr/lib/jvm/zulu \
-    && rm /tmp/zulu.tar.gz
-ENV JAVA_HOME=/usr/lib/jvm/zulu
-ENV PATH=${JAVA_HOME}/bin:${PATH}
+RUN apt-get -y update && apt-get -y upgrade libssl3 && apt-get -y install binutils ca-certificates
 
 # Included modules cherrypicked from https://docs.oracle.com/en/java/javase/21/docs/api/
 #
diff --git a/java-21/java.version b/java-21/java.version
index a259b7b..03d948c 100644
--- a/java-21/java.version
+++ b/java-21/java.version
@@ -1 +1 @@
-zulu21.54.107-ca-jdk21.0.13
\ No newline at end of file
+21.0.13.0.3-21.54