diff --git a/.github/workflows/coverage-ci.yml b/.github/workflows/coverage-ci.yml
new file mode 100644
index 0000000..98b57a6
--- /dev/null
+++ b/.github/workflows/coverage-ci.yml
@@ -0,0 +1,23 @@
+name: Coverage CI
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  coverage:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: oracle
+          java-version: "25"
+          cache: maven
+
+      - name: Install test-data tools
+        run: sudo apt-get update && sudo apt-get install -y wget zstd
+
+      - name: Check coverage
+        run: mvn -pl estore clean test jacoco:report jacoco:check
diff --git a/.github/workflows/formatting-ci.yml b/.github/workflows/formatting-ci.yml
index b7c4b5e..b3cb5dd 100644
--- a/.github/workflows/formatting-ci.yml
+++ b/.github/workflows/formatting-ci.yml
@@ -12,7 +12,7 @@ jobs:
 
       - uses: actions/setup-java@v4
         with:
-          distribution: temurin
+          distribution: oracle
           java-version: "25"
           cache: maven
 
diff --git a/.github/workflows/test-ci.yml b/.github/workflows/test-ci.yml
index 9e3e583..b8be1a8 100644
--- a/.github/workflows/test-ci.yml
+++ b/.github/workflows/test-ci.yml
@@ -12,12 +12,20 @@ jobs:
 
       - uses: actions/setup-java@v4
         with:
-          distribution: temurin
-          java-version: "8"
+          distribution: oracle
+          java-version: "25"
           cache: maven
 
       - name: Install test-data tools
         run: sudo apt-get update && sudo apt-get install -y wget zstd
 
       - name: Build and test estore
-        run: mvn -pl estore clean test -Dmaven.compiler.release=8
+        run: mvn -pl estore clean test jacoco:report
+
+      - name: Upload JaCoCo report
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: jacoco-report
+          path: estore/target/site/jacoco/
+          if-no-files-found: ignore
diff --git a/Dockerfile b/Dockerfile
index 66ee760..1c9fdcc 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,11 +1,24 @@
 FROM ubuntu:24.04
 
 ENV DEBIAN_FRONTEND=noninteractive
+ENV JAVA_HOME=/usr/java/jdk-25
+ENV PATH="${JAVA_HOME}/bin:${PATH}"
 
-# Java 8 first. Installing maven in the same apt command pulls OpenJDK 11.
+# Oracle JDK 25 first so apt maven does not become the default java.
 RUN apt-get update \
     && apt-get install -y --no-install-recommends \
-        openjdk-8-jdk wget zstd netcat-openbsd \
+        ca-certificates wget zstd netcat-openbsd \
+    && ARCH="$(dpkg --print-architecture)" \
+    && case "$ARCH" in \
+         amd64) JDK_ARCH=x64 ;; \
+         arm64) JDK_ARCH=aarch64 ;; \
+         *) echo "unsupported arch: $ARCH" && exit 1 ;; \
+       esac \
+    && wget -q "https://download.oracle.com/java/25/latest/jdk-25_linux-${JDK_ARCH}_bin.tar.gz" -O /tmp/jdk.tgz \
+    && echo "$(wget -qO- "https://download.oracle.com/java/25/latest/jdk-25_linux-${JDK_ARCH}_bin.tar.gz.sha256") */tmp/jdk.tgz" | sha256sum -c \
+    && mkdir -p "$JAVA_HOME" \
+    && tar --extract --file /tmp/jdk.tgz --directory "$JAVA_HOME" --strip-components 1 \
+    && rm /tmp/jdk.tgz \
     && apt-get install -y --no-install-recommends maven \
     && rm -rf /var/lib/apt/lists/*
 
diff --git a/README.md b/README.md
index c8dce0a..85c7373 100644
--- a/README.md
+++ b/README.md
@@ -1,4 +1,9 @@
 # In-memory Object Graph Stores
+
+[![Test CI](https://github.com/EngineeringSoftware/eStore/actions/workflows/test-ci.yml/badge.svg)](https://github.com/EngineeringSoftware/eStore/actions/workflows/test-ci.yml)
+[![Formatting CI](https://github.com/EngineeringSoftware/eStore/actions/workflows/formatting-ci.yml/badge.svg)](https://github.com/EngineeringSoftware/eStore/actions/workflows/formatting-ci.yml)
+[![Coverage CI](https://github.com/EngineeringSoftware/eStore/actions/workflows/coverage-ci.yml/badge.svg)](https://github.com/EngineeringSoftware/eStore/actions/workflows/coverage-ci.yml)
+
 <img src="images/estore_logo.png" width="400" />
 
 Implementation of an in-memory object graph store, dubbed ϵStore. Our
diff --git a/estore-maven-plugin/pom.xml b/estore-maven-plugin/pom.xml
index 2d9849f..4e29ce5 100644
--- a/estore-maven-plugin/pom.xml
+++ b/estore-maven-plugin/pom.xml
@@ -25,7 +25,8 @@
 
   <properties>
     <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
-    <maven.compiler.release>8</maven.compiler.release>
+    <maven.compiler.source>8</maven.compiler.source>
+    <maven.compiler.target>8</maven.compiler.target>
     <maven.version>3.9.14</maven.version>
   </properties>
 
diff --git a/estore/pom.xml b/estore/pom.xml
index f47ffa3..532a1d2 100644
--- a/estore/pom.xml
+++ b/estore/pom.xml
@@ -14,7 +14,8 @@
   <name>estore</name>
   <properties>
     <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
-    <maven.compiler.release>8</maven.compiler.release>
+    <maven.compiler.source>8</maven.compiler.source>
+    <maven.compiler.target>8</maven.compiler.target>
     <test.jvm.add.opens></test.jvm.add.opens>
   </properties>
 
@@ -118,7 +119,24 @@
       <plugin>
         <groupId>org.jacoco</groupId>
         <artifactId>jacoco-maven-plugin</artifactId>
-        <version>0.8.13</version>
+        <version>0.8.14</version>
+        <configuration>
+          <excludes>
+            <exclude>org/estore/antlr4/**</exclude>
+          </excludes>
+          <rules>
+            <rule>
+              <element>BUNDLE</element>
+              <limits>
+                <limit>
+                  <counter>LINE</counter>
+                  <value>COVEREDRATIO</value>
+                  <minimum>0.70</minimum>
+                </limit>
+              </limits>
+            </rule>
+          </rules>
+        </configuration>
         <executions>
           <execution>
             <goals>
@@ -132,6 +150,13 @@
               <goal>report</goal>
             </goals>
           </execution>
+          <execution>
+            <id>check</id>
+            <phase>verify</phase>
+            <goals>
+              <goal>check</goal>
+            </goals>
+          </execution>
         </executions>
       </plugin>
       <!-- clean lifecycle, see https://maven.apache.org/ref/current/maven-core/lifecycles.html#clean_Lifecycle -->
diff --git a/pom.xml b/pom.xml
index f5210d5..b35d1a2 100644
--- a/pom.xml
+++ b/pom.xml
@@ -9,7 +9,8 @@
   <name>estore-internal</name>
   <url>http://maven.apache.org</url>
   <properties>
-    <maven.compiler.release>8</maven.compiler.release>
+    <maven.compiler.source>8</maven.compiler.source>
+    <maven.compiler.target>8</maven.compiler.target>
     <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
   </properties>
 
diff --git a/s b/s
index 7a6b6a7..bbab7c0 100755
--- a/s
+++ b/s
@@ -19,8 +19,10 @@ function check_deps() {
         ! hash "mvn" && \
                 { echo "missing maven (https://maven.apache.org/download.cgi)"; return 1; }
 
-        java -version 2>&1 | grep -qE 'version "1\.8|version "8' || \
-                { echo "no java 8 available (apt-get install openjdk-8-jdk; macOS: brew install openjdk@8)"; return 1; }
+        if ! hash "java" 2>/dev/null || ! hash "javac" 2>/dev/null; then
+                echo "no JDK available (CI uses Oracle JDK 25; bytecode target is Java 8)"
+                return 1
+        fi
 
         ! hash "wget" && \
                 { echo "missing wget (apt-get install wget)"; return 1; }
@@ -51,10 +53,9 @@ function install_deps() {
                         { echo "Failed to install Maven"; return 1; }
         fi
 
-        if ! hash "java" 2>/dev/null || ! java -version 2>&1 | grep -qE 'version "1\.8|version "8'; then
-                echo "Installing Java 8..."
-                apt-get update && apt-get install -y openjdk-8-jdk || \
-                        { echo "Failed to install Java 8"; return 1; }
+        if ! hash "java" 2>/dev/null || ! hash "javac" 2>/dev/null; then
+                echo "No JDK found. Install Oracle JDK 25 from https://www.oracle.com/java/technologies/downloads/"
+                return 1
         fi
 
         if ! hash "wget" 2>/dev/null; then