diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
new file mode 100644
index 0000000..a9ee71b
--- /dev/null
+++ b/.github/workflows/build.yml
@@ -0,0 +1,29 @@
+name: Build
+
+on:
+  push:
+    branches:
+      - master
+      - 'feature/**'
+      - 'hotfix/**'
+  pull_request:
+    branches:
+      - master
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Set up JDK 11 (Temurin)
+        uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: '11'
+          cache: maven
+
+      - name: Build and test
+        run: mvn -B clean install
diff --git a/.gitignore b/.gitignore
index 4640ee0..14dd99d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -8,3 +8,13 @@ velocity.log
 .DS_Store
 .run/
 velocity.log.*
+
+# HSQLDB scratch files generated by DatabaseSessionHandlerTest
+mem.lobs
+mem.log
+mem.properties
+mem.script
+
+# Local-only working notes (not for the shared repo)
+CLAUDE.md
+TODO.md
diff --git a/demo/pom.xml b/demo/pom.xml
index 292c8cf..6b591d4 100644
--- a/demo/pom.xml
+++ b/demo/pom.xml
@@ -53,7 +53,7 @@
         <dependency>
             <groupId>dk.digst</groupId>
             <artifactId>oiosaml3.java</artifactId>
-            <version>3.2.2-SNAPSHOT</version>
+            <version>${project.version}</version>
         </dependency>
 
         <!-- Write all logging to Log4j2 -->
diff --git a/oiosaml/pom.xml b/oiosaml/pom.xml
index 94a5bd5..9f58a0c 100644
--- a/oiosaml/pom.xml
+++ b/oiosaml/pom.xml
@@ -69,10 +69,12 @@
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-compiler-plugin</artifactId>
-                <version>3.3</version>
+                <version>3.8.1</version>
                 <configuration>
-                    <source>1.8</source>
-                    <target>1.8</target>
+                    <!-- Build runs on JDK 11+, but the published artifact must stay
+                         runnable on Java 8 consumers. release=8 compiles against the
+                         Java 8 API so no newer API can leak into the bytecode. -->
+                    <release>8</release>
                 </configuration>
             </plugin>
 
diff --git a/oiosaml/src/test/java/dk/gov/oio/saml/service/CRLCheckerTest.java b/oiosaml/src/test/java/dk/gov/oio/saml/service/CRLCheckerTest.java
index 3bdf065..d3ca909 100644
--- a/oiosaml/src/test/java/dk/gov/oio/saml/service/CRLCheckerTest.java
+++ b/oiosaml/src/test/java/dk/gov/oio/saml/service/CRLCheckerTest.java
@@ -18,8 +18,7 @@
 public class CRLCheckerTest extends BaseServiceTest {
 
     @DisplayName("Test revocation check on valid certificate using OCSP")
-    @Test
-    public void testOcspCheckOnValidCertificate() throws Exception {
+    @Test    public void testOcspCheckOnValidCertificate() throws Exception {
         OIOSAML3Service.getConfig().setCRLCheckEnabled(false);
         OIOSAML3Service.getConfig().setOcspCheckEnabled(true);
 
@@ -36,8 +35,7 @@ public void testOcspCheckOnValidCertificate() throws Exception {
     }
     
     @DisplayName("Test revocation check on valid certificate using CRL")
-    @Test
-    public void testCrlCheckOnValidCertificate() throws Exception {
+    @Test    public void testCrlCheckOnValidCertificate() throws Exception {
         OIOSAML3Service.getConfig().setCRLCheckEnabled(true);
         OIOSAML3Service.getConfig().setOcspCheckEnabled(false);
         
@@ -54,8 +52,7 @@ public void testCrlCheckOnValidCertificate() throws Exception {
     }
 
     @DisplayName("Test revocation check on revoked certificate using OCSP")
-    @Test
-    public void testOcspCheckOnRevokedCertificate() throws Exception {
+    @Test    public void testOcspCheckOnRevokedCertificate() throws Exception {
         OIOSAML3Service.getConfig().setCRLCheckEnabled(false);
         OIOSAML3Service.getConfig().setOcspCheckEnabled(true);
 
@@ -73,8 +70,7 @@ public void testOcspCheckOnRevokedCertificate() throws Exception {
     }
     
     @DisplayName("Test revocation check on revoked certificate using CRL")
-    @Test
-    public void testCrlCheckOnRevokedCertificate() throws Exception {
+    @Test    public void testCrlCheckOnRevokedCertificate() throws Exception {
         OIOSAML3Service.getConfig().setCRLCheckEnabled(true);
         OIOSAML3Service.getConfig().setOcspCheckEnabled(false);
 
diff --git a/oiosaml/src/test/java/dk/gov/oio/saml/util/TestConstants.java b/oiosaml/src/test/java/dk/gov/oio/saml/util/TestConstants.java
index 1f4e751..87c2226 100644
--- a/oiosaml/src/test/java/dk/gov/oio/saml/util/TestConstants.java
+++ b/oiosaml/src/test/java/dk/gov/oio/saml/util/TestConstants.java
@@ -150,37 +150,5 @@ public class TestConstants {
     
     public static final String VALID_CERTIFICATE = "MIIGkzCCBMegAwIBAgIUdxCsIBOOtB5tqNtriG1TMHD9dqYwQQYJKoZIhvcNAQEKMDSgDzANBglghkgBZQMEAgEFAKEcMBoGCSqGSIb3DQEBCDANBglghkgBZQMEAgEFAKIDAgEgMGsxLTArBgNVBAMMJERlbiBEYW5za2UgU3RhdCBPQ0VTIHVkc3RlZGVuZGUtQ0EgMTETMBEGA1UECwwKVGVzdCAtIGN0aTEYMBYGA1UECgwPRGVuIERhbnNrZSBTdGF0MQswCQYDVQQGEwJESzAeFw0yMzA4MTgxMDI2NThaFw0yNjA4MTcxMDI2NTdaMIGpMSUwIwYDVQQDDBxqYXZhLnJlZmVyZW5jZWltcGxlbWVudGVyaW5nMTcwNQYDVQQFEy5VSTpESy1POkc6MmRjZjc5MTktYjI4Mi00NGQxLWI5ODAtM2I3MzcwMGE3ZGQ0MSEwHwYDVQQKDBhEaWdpdGFsaXNlcmluZ3NzdHlyZWxzZW4xFzAVBgNVBGEMDk5UUkRLLTM0MDUxMTc4MQswCQYDVQQGEwJESzCCAaIwDQYJKoZIhvcNAQEBBQADggGPADCCAYoCggGBAKNAf9uAhuz3bEjPPFrBa39HCF6S64pSzGRr5yYm3lCBElYJvHzDr9lMKgbv8rKglIVgjWh+PzUjiwIlGjrqAbYa2Hg08Vw2H60GQSFP8rGsshgR+E5Ca2nb9kUcQXAQJl9ScG9squCPRNkdp8vSblRwv/3N0ksjxdZk1wdZ86bOqTsFEjpzhFdBXXSMl4tbhE7WOruKc0QqjUkzXJyp4qwyB2XA75+jsvtRHN/luOzCkUxLhEkFrbg+B6IWqjUuO132xC8d5+T8Y39K6rs4BYOIgQRJOg0OlA5844CC/WBLtAYgMiu1ucZ4mbVWOmm2F86WVRBdmwlN0CFORXihHiYNZfHpA0rPOSncDDMrrGZ7vuvvXxMfIiHlAniSw4eHaEqtaXqwDyNZbfcXgYkszQd7ZV7YMfAjkDo82Qn+Qz+Oc9qq0Syhd9pdUJ/Q26CjFDiaNSg+hDUUJTxowQAktX3AuwBcDeuMoc2yOGmg2xOf/3bIwJSNm8/b+y0wKfY2FwIDAQABo4IBhjCCAYIwDAYDVR0TAQH/BAIwADAfBgNVHSMEGDAWgBR/KJ/ZcZlC4nXn1zV2Lk0IJW12XjB7BggrBgEFBQcBAQRvMG0wQwYIKwYBBQUHMAKGN2h0dHA6Ly9jYTEuY3RpLWdvdi5kay9vY2VzL2lzc3VpbmcvMS9jYWNlcnQvaXNzdWluZy5jZXIwJgYIKwYBBQUHMAGGGmh0dHA6Ly9jYTEuY3RpLWdvdi5kay9vY3NwMCEGA1UdIAQaMBgwCAYGBACPegEBMAwGCiqBUIEpAQEBAwcwOwYIKwYBBQUHAQMELzAtMCsGCCsGAQUFBwsCMB8GBwQAi+xJAQIwFIYSaHR0cHM6Ly91aWQuZ292LmRrMEUGA1UdHwQ+MDwwOqA4oDaGNGh0dHA6Ly9jYTEuY3RpLWdvdi5kay9vY2VzL2lzc3VpbmcvMS9jcmwvaXNzdWluZy5jcmwwHQYDVR0OBBYEFNKFKxc70Coluez0ieqiVuK+a01oMA4GA1UdDwEB/wQEAwIFoDBBBgkqhkiG9w0BAQowNKAPMA0GCWCGSAFlAwQCAQUAoRwwGgYJKoZIhvcNAQEIMA0GCWCGSAFlAwQCAQUAogMCASADggGBAIkUbY8meqO9xQQ2gyMS4rfmqW3bV52YGs07DqG0zuVew7W7RMAJWqDLUj5ltMWK7wULcCBS1tjtxOrvMBCoAE42oQfF/EzLRYKr7VgsMyOgUiTk2t6LvyF5A1OGHOUP3lxQKX3viDURXUeoI4QZ3mxbHUg4sQXdXg2hOEhQOarOhWLdV3MzUkA9ZkwjmycXkbLBVdTbr/fODUU0jeDDlaixKXsGI66qg8Ou86nDkyW7wCxQ9QVwJ5YGogy9ZSc6sLt8XSv3+wFlXD/81EzWfqe5BdWX8cukLtSzdzg3SzJifB4IJ6GIQ58+NVLPEMezwZCLODzVkvdJfyWRxJrDijSVCza515qNW52yfYPYkTb+vdvKcFmwO1gCeK0vT21udVkp1grhNzwb8Cj/tq3OZ+IamZXkjL1go9GzSQQ31IbXHEI/oaPLEeX6j9E8X69wVtSti8SWPw0WgoeOglJM5A6fmlJIGhCBPk2klhH3IIU3+tjuz7iyFHZg7gbPhNHdow==";
 
-    public static final String REVOKED_CERTIFICATE = "MIIGKDCCBRCgAwIBAgIEW607HjANBgkqhkiG9w0BAQsFADBIMQswCQYDVQQGEwJE" + 
-            "SzESMBAGA1UECgwJVFJVU1QyNDA4MSUwIwYDVQQDDBxUUlVTVDI0MDggU3lzdGVt" + 
-            "dGVzdCBYWElJIENBMB4XDTE5MTIxNjE0MzQxN1oXDTIyMTIxNjE0MzM0N1owgZIx" + 
-            "CzAJBgNVBAYTAkRLMScwJQYDVQQKDB5ORVRTIERBTklEIEEvUyAvLyBDVlI6MzA4" + 
-            "MDg0NjAxWjAgBgNVBAUTGUNWUjozMDgwODQ2MC1GSUQ6NDUzMjc0NzMwNgYDVQQD" + 
-            "DC9UVSBHRU5FUkVMIEZPQ0VTIHNww6ZycmV0IChmdW5rdGlvbnNjZXJ0aWZpa2F0" + 
-            "KTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJqKd1cVjcteIQ0jfcn2" + 
-            "lmjZS3lNzqYAjCKs7MhPAB4P8FSpxzn4hW6azYK0Vsy8NGBTijuQYHI2zSCgpIBO" + 
-            "C7DnuF1+JdpoqzPdSt967/3efmQe60JXKeyHViMJqCgB+vBmbvhAVl9v2qDWhj5H" + 
-            "m2CSC7SvLCffuFITinO2ZTgTNjvEYqqRm6k/G8E7F4rpuRB25DdCkt8NlOUoT7aN" + 
-            "+0lH/2UH9vyDaGCXreesLyAEbBOW+w5NxZFS88bvFGlIqg5CujInwbUjATRl2Wm8" + 
-            "FnZ9WkbJ7VdceXHcNkz/QiLIYHZt0aGEz6cXvBc8zSSmV4D1shHLz376Uhm01873" + 
-            "1X0CAwEAAaOCAs0wggLJMA4GA1UdDwEB/wQEAwIDuDCBlwYIKwYBBQUHAQEEgYow" + 
-            "gYcwPAYIKwYBBQUHMAGGMGh0dHA6Ly9vY3NwLnN5c3RlbXRlc3QyMi50cnVzdDI0" + 
-            "MDguY29tL3Jlc3BvbmRlcjBHBggrBgEFBQcwAoY7aHR0cDovL2YuYWlhLnN5c3Rl" + 
-            "bXRlc3QyMi50cnVzdDI0MDguY29tL3N5c3RlbXRlc3QyMi1jYS5jZXIwggEgBgNV" + 
-            "HSAEggEXMIIBEzCCAQ8GDSsGAQQBgfRRAgQGBAMwgf0wLwYIKwYBBQUHAgEWI2h0" + 
-            "dHA6Ly93d3cudHJ1c3QyNDA4LmNvbS9yZXBvc2l0b3J5MIHJBggrBgEFBQcCAjCB" + 
-            "vDAMFgVEYW5JRDADAgEBGoGrRGFuSUQgdGVzdCBjZXJ0aWZpa2F0ZXIgZnJhIGRl" + 
-            "bm5lIENBIHVkc3RlZGVzIHVuZGVyIE9JRCAxLjMuNi4xLjQuMS4zMTMxMy4yLjQu" + 
-            "Ni40LjMuIERhbklEIHRlc3QgY2VydGlmaWNhdGVzIGZyb20gdGhpcyBDQSBhcmUg" + 
-            "aXNzdWVkIHVuZGVyIE9JRCAxLjMuNi4xLjQuMS4zMTMxMy4yLjQuNi40LjMuMIGt" + 
-            "BgNVHR8EgaUwgaIwPaA7oDmGN2h0dHA6Ly9jcmwuc3lzdGVtdGVzdDIyLnRydXN0" + 
-            "MjQwOC5jb20vc3lzdGVtdGVzdDIyMS5jcmwwYaBfoF2kWzBZMQswCQYDVQQGEwJE" + 
-            "SzESMBAGA1UECgwJVFJVU1QyNDA4MSUwIwYDVQQDDBxUUlVTVDI0MDggU3lzdGVt" + 
-            "dGVzdCBYWElJIENBMQ8wDQYDVQQDDAZDUkwyMTQwHwYDVR0jBBgwFoAUq6gBRBmw" + 
-            "s0OZ2vp8zNIAGAPnPL8wHQYDVR0OBBYEFJddclhedsyHjXSrF7JG81IPRuz9MAkG" + 
-            "A1UdEwQCMAAwDQYJKoZIhvcNAQELBQADggEBAJSf6/PJ4fGW4LYtgA/758n51KN0" + 
-            "ccY+80Qk0Fc01/chDHSXCbyVkQm7/02dggnV/VWrnKy1IY5dSu5rJ45Aijg4zADZ" + 
-            "/1eeeaSRvRiYz2+jIIPuGkMbHUdDJM6RuCertu/Pq2IQFIB0t/4EahVxTJcWmWY0" + 
-            "j3TQWARCJfoE2baAD/xKasUNAItq9w8T6AhxFb1g2A4fUVhdKDIqA+SLNzc0VO9V" + 
-            "xhvTIY8nNgEWuW8XKeUXPk/z4WNojNlO2NiHBJzyhEvptvIUvgshbLYD4vJZwry3" + 
-            "9dk+tZf4c/vNlk57P2hcK4sPtqrxlKxrvZFeOA0Jn9PVbn0KWw/lOxx3w24="; 
+    public static final String REVOKED_CERTIFICATE = "MIIGizCCBL+gAwIBAgIUNtX5gOHMima7NNCirR0xYtZD5dQwQQYJKoZIhvcNAQEKMDSgDzANBglghkgBZQMEAgEFAKEcMBoGCSqGSIb3DQEBCDANBglghkgBZQMEAgEFAKIDAgEgMGsxLTArBgNVBAMMJERlbiBEYW5za2UgU3RhdCBPQ0VTIHVkc3RlZGVuZGUtQ0EgMTETMBEGA1UECwwKVGVzdCAtIGN0aTEYMBYGA1UECgwPRGVuIERhbnNrZSBTdGF0MQswCQYDVQQGEwJESzAeFw0yMzA3MDQwODQyMjZaFw0yNjA3MDMwODQyMjVaMIGDMRAwDgYDVQQDDAdSZXZva2VkMTcwNQYDVQQFEy5VSTpESy1POkc6Mjc1ODFhMzktYjYxNC00YzYxLWJlY2UtOWIyYjA5Zjg1NzJhMRAwDgYDVQQKDAdpZDIgQS9TMRcwFQYDVQRhDA5OVFJESy00NDE2MDMxNTELMAkGA1UEBhMCREswggGiMA0GCSqGSIb3DQEBAQUAA4IBjwAwggGKAoIBgQDGFxjnzy3gKPLBt2Lj4ALK2uHAMFB8CZc4DaJDdn6YWNOdL4bvi2Ip0Nf87A9IZT3KzLsyju5pqQOaJ1MlwTB11Hlwne4DHUOo8EZhMAS2/oWtTf+scmbDXR0Edv05ecteReabO7tRyQcbxacirX20rT8jTVLtvWfzCHobvbCK9wWTXiaYYZXZykrHbCrRikuHz7DtyefznKRC36wC3sBzptA4ncdDnhiwOoDizZ46toMYahDLj2P1VDIh+2XyWKPV5rxTlZkY3b+H235tdRtjkX+kTfUDFBVt8PrU7/Pq1D1NHIQsvoHmSsUHwK0QqDGeCbj6qQMs5p5PhBksKdh7Xkfsoh6oTwvXRdbLmjcuc7rIoUB2QidfgltZ2bqSpGX+xvg4uQCKCgqn6TlXUCpDrLKKplE0MnYIyNuWrS/Grj11GJnmfTAsAVkXgM8dSXsBhf0JmMBMXLRTUuz1axxeNy3e29fXDEuoXPoTZ8a9EFTzgA/1l9n67qolWlZV5C8CAwEAAaOCAaQwggGgMAwGA1UdEwEB/wQCMAAwHwYDVR0jBBgwFoAUfyif2XGZQuJ159c1di5NCCVtdl4wewYIKwYBBQUHAQEEbzBtMEMGCCsGAQUFBzAChjdodHRwOi8vY2ExLmN0aS1nb3YuZGsvb2Nlcy9pc3N1aW5nLzEvY2FjZXJ0L2lzc3VpbmcuY2VyMCYGCCsGAQUFBzABhhpodHRwOi8vY2ExLmN0aS1nb3YuZGsvb2NzcDAcBgNVHREEFTATgRF0aG9tYXNAbnltYW5kLm5ldDAhBgNVHSAEGjAYMAgGBgQAj3oBATAMBgoqgVCBKQEBAQMHMDsGCCsGAQUFBwEDBC8wLTArBggrBgEFBQcLAjAfBgcEAIvsSQECMBSGEmh0dHBzOi8vdWlkLmdvdi5kazBFBgNVHR8EPjA8MDqgOKA2hjRodHRwOi8vY2ExLmN0aS1nb3YuZGsvb2Nlcy9pc3N1aW5nLzEvY3JsL2lzc3VpbmcuY3JsMB0GA1UdDgQWBBS6ZyVKq8su7B6OPmH0lkvc6nYpqzAOBgNVHQ8BAf8EBAMCBeAwQQYJKoZIhvcNAQEKMDSgDzANBglghkgBZQMEAgEFAKEcMBoGCSqGSIb3DQEBCDANBglghkgBZQMEAgEFAKIDAgEgA4IBgQCNt3wTWs0HKYutrfPxw06SmQdeS/bZDBtiallEYaE9HclkWPFIGii8V0gHYyvV6i90f+Sz9FWjAohhQCaMWVkImKG+8EU4mgAjkSRJa4/GpsB9KKQZs26dNayKTdbL/x9MajgaPBPp+kYuVPOjX6oXgLG8huaJ8GqsjQocGd9JPX4k/ir6S+E4Q4Q3PG89HCX9R+28XjT4R/SUwxIvjnf0eKapS/LZdOgk/e5pxTUDWOZhlmJLlXsDAcwXlQ+0vhX4Euk08RKqAi+jK2n2qKIiAg2UFfgdtg7Fu4hWkbLMH/KFf2U21vdmVZAgiOAPmipkuFOwiJV8Q6k5kIVf+OoxBlkUCK6Z9j3Cxuaa1bOif13Iyv003Gns2GCAULA4i+yloYkWHE1jPi1KaLhpcMbf7eRE9MEmS/JVBNVXpDi1M3Y6s6gltO4xbctJPPpnvopyHEhRQx0zQTxk7FcY5izmI+ld62eCLKtPEvV0oVGXVoUGkUqnz5IZmXpBTXVt+YA="; 
 }
diff --git a/pom.xml b/pom.xml
index 4c586f7..3093c83 100644
--- a/pom.xml
+++ b/pom.xml
@@ -16,10 +16,12 @@
                         <plugin>
                                 <groupId>org.apache.maven.plugins</groupId>
                                 <artifactId>maven-compiler-plugin</artifactId>
-                                <version>3.3</version>
+                                <version>3.8.1</version>
                                 <configuration>
-                                        <source>1.8</source>
-                                        <target>1.8</target>
+                                        <!-- Build runs on JDK 11+, but the published artifact must stay
+                                             runnable on Java 8 consumers. release=8 compiles against the
+                                             Java 8 API so no newer API can leak into the bytecode. -->
+                                        <release>8</release>
                                 </configuration>
                         </plugin>