diff --git a/ci/cfengine-build-host-setup.cf b/ci/cfengine-build-host-setup.cf
index fd4da9f81..84fe8b5c0 100644
--- a/ci/cfengine-build-host-setup.cf
+++ b/ci/cfengine-build-host-setup.cf
@@ -189,6 +189,9 @@ bundle agent cfengine_build_host_setup
 
 
   vars:
+    "java_version_raw" string => execresult("java -version 2>&1 | grep version", "useshell"),
+      unless => "missing_java";
+    "java_version" string => nth(splitstring("${java_version_raw}", '"', 20), 1);
     "suse_users_and_groups" slist => { "daemon", "bin", "sys" };
     "sshd_hardening_directives" slist => {
       "PermitRootLogin",
@@ -214,6 +217,9 @@ bundle agent cfengine_build_host_setup
       "have_tmp_mount" expression => returnszero("mount | grep '/tmp'", "useshell");
       "have_coredumpctl" expression => returnszero("command -v coredumpctl", "useshell");
       "missing_java" expression => not(fileexists("/usr/bin/java"));
+@if minimum_version(3.23)
+      "insufficient_java_version" expression => version_compare( "${java_version}", "<", "21.0.0" );
+@endif
       "missing_groovy" expression => not(fileexists("/usr/bin/groovy"));
     (redhat|centos).!(redhat_6|centos_6|redhat_7|centos_7)::
       "yum_conf_ok" expression => returnszero("grep best=False /etc/yum.conf >/dev/null", "useshell");
@@ -253,7 +259,7 @@ bundle agent cfengine_build_host_setup
         contain => in_shell;
     containers_host.missing_groovy::
       "sh $(this.promise_dirname)/linux-install-groovy.sh" contain => in_shell;
-    missing_java::
+    missing_java|insufficient_java_version::
       "sh $(this.promise_dirname)/linux-install-jdk21.sh" contain => in_shell;
     (redhat_7|centos_7|redhat_8|centos_8|redhat_9|redhat_10).(!have_development_tools).(yum_dnf_conf_ok)::
       "yum groups install -y 'Development Tools'" contain => in_shell;