diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 02d0c1d..ed28751 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -12,11 +12,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out code
-        uses: actions/checkout@v3
-      - name: Set up JAVA 8
-        uses: actions/setup-java@v2
+        uses: actions/checkout@v4
+      - name: Set up JAVA 21
+        uses: actions/setup-java@v4
         with:
-          java-version: 8
+          java-version: '21'
           distribution: 'temurin'
       - name: Build with Maven
         run: mvn -B package --file pom.xml
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f428189..9f542db 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -19,10 +19,10 @@ jobs:
       - name: Check out code
         uses: actions/checkout@v4
 
-      - name: Set up JAVA 8
+      - name: Set up JAVA 21
         uses: actions/setup-java@v4
         with:
-          java-version: 8
+          java-version: '21'
           distribution: "temurin"
 
       - name: Determine the version
@@ -41,10 +41,10 @@ jobs:
           exit 1
         if: github.event_name != 'workflow_dispatch' && steps.versioncheck.outputs.version != github.ref_name
 
-      - name: Set up JDK 8 for snapshots
+      - name: Set up JDK 21for snapshots
         uses: actions/setup-java@v4
         with:
-          java-version: "8"
+          java-version: "21"
           distribution: "temurin"
           cache: "maven"
           server-id: openconext-snapshots
@@ -52,10 +52,10 @@ jobs:
           server-password: MAVEN_PASSWORD
         if: ( endsWith(steps.versioncheck.outputs.version, '-SNAPSHOT'))
 
-      - name: Set up JDK 8 for releases
+      - name: Set up JDK 21 for releases
         uses: actions/setup-java@v4
         with:
-          java-version: "8"
+          java-version: "21"
           distribution: "temurin"
           cache: "maven"
           server-id: openconext-releases
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7107be4..8bdbb07 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,10 @@
 
 All notable changes to this project will be documented in this file.
 
+## [0.3.0]
+
+- Upgrade to JAVA 21
+
 ## [0.2.20]
 
 - Add prompt=consent when requesting offline_access
diff --git a/docker/Dockerfile b/docker/Dockerfile
index 5ecaa92..fd7900b 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -1,4 +1,4 @@
-FROM eclipse-temurin:8-jdk-alpine
+FROM eclipse-temurin:21-jdk-alpine
 RUN apk --update upgrade && apk add openssl openssl-dev ca-certificates libgcc && update-ca-certificates
 COPY target/*.jar app.jar
 ENTRYPOINT ["java","-jar","/app.jar"]
diff --git a/pom.xml b/pom.xml
index c6f336b..459cec8 100644
--- a/pom.xml
+++ b/pom.xml
@@ -10,11 +10,11 @@
     </parent>
     <groupId>org.surfnet</groupId>
     <artifactId>student-mobility-inteken-ontvanger-generiek</artifactId>
-    <version>0.2.22-SNAPSHOT</version>
+    <version>0.3.0-SNAPSHOT</version>
     <name>inteken-ontvanger-generiek</name>
     <description>inteken-ontvanger-generiek</description>
     <properties>
-        <java.version>1.8</java.version>
+        <java.version>21</java.version>
     </properties>
     <dependencies>
         <dependency>
@@ -126,10 +126,42 @@
                 <groupId>org.springframework.boot</groupId>
                 <artifactId>spring-boot-maven-plugin</artifactId>
             </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-compiler-plugin</artifactId>
+                <version>3.13.0</version>
+                <configuration>
+                    <release>21</release>
+                </configuration>
+            </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-enforcer-plugin</artifactId>
+                <version>3.5.0</version>
+                <executions>
+                    <execution>
+                        <id>enforce-versions</id>
+                        <goals>
+                            <goal>enforce</goal>
+                        </goals>
+                        <configuration>
+                            <rules>
+                                <requireMavenVersion>
+                                    <version>3.8.4</version>
+                                </requireMavenVersion>
+                                <requireJavaVersion>
+                                    <version>21</version>
+                                </requireJavaVersion>
+                            </rules>
+                        </configuration>
+                    </execution>
+                </executions>
+            </plugin>
+
             <plugin>
                 <groupId>pl.project13.maven</groupId>
                 <artifactId>git-commit-id-plugin</artifactId>
-                <version>4.0.2</version>
+                <version>4.9.10</version>
                 <configuration>
                     <useNativeGit>true</useNativeGit>
                 </configuration>
@@ -137,7 +169,7 @@
             <plugin>
                 <groupId>org.jacoco</groupId>
                 <artifactId>jacoco-maven-plugin</artifactId>
-                <version>0.8.5</version>
+                <version>0.8.12</version>
                 <executions>
                     <execution>
                         <goals>
@@ -153,26 +185,6 @@
                     </execution>
                 </executions>
             </plugin>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-enforcer-plugin</artifactId>
-                <version>3.3.0</version>
-                <executions>
-                    <execution>
-                        <id>enforce-versions</id>
-                        <goals>
-                            <goal>enforce</goal>
-                        </goals>
-                        <configuration>
-                            <rules>
-                                <requireJavaVersion>
-                                    <version>[1.8.0-0,1.8.0-500]</version>
-                                </requireJavaVersion>
-                            </rules>
-                        </configuration>
-                    </execution>
-                </executions>
-            </plugin>
         </plugins>
         <extensions>
             <extension>
diff --git a/src/main/java/generiek/api/EnrollmentEndpoint.java b/src/main/java/generiek/api/EnrollmentEndpoint.java
index 9a4a150..ed0ad1d 100644
--- a/src/main/java/generiek/api/EnrollmentEndpoint.java
+++ b/src/main/java/generiek/api/EnrollmentEndpoint.java
@@ -136,6 +136,11 @@ public EnrollmentEndpoint(@Value("${oidc.acr-context-class-ref}") String acr,
         this.restTemplate = new RestTemplate(requestFactory);
         this.restTemplate.getInterceptors().add((request, body, execution) -> {
             request.getHeaders().add("Accept-Language", LanguageFilter.language.get());
+            //Bugfix for too strict DefaultBearerTokenResolver which does not ignore CHARSET
+            List<String> contentType = request.getHeaders().get("Content-Type");
+            if (!CollectionUtils.isEmpty(contentType) && contentType.getFirst().startsWith("application/x-www-form-urlencoded")) {
+                request.getHeaders().set("Content-Type", "application/x-www-form-urlencoded");
+            }
             return execution.execute(request, body);
         });
         this.restTemplate.getInterceptors().add(new RestTemplateLoggingInterceptor());