diff --git a/gradle-baseline-java/src/test/groovy/com/palantir/baseline/BaselineExactDependenciesTest.groovy b/gradle-baseline-java/src/test/groovy/com/palantir/baseline/BaselineExactDependenciesTest.groovy
index 6db476486..73c61ebd2 100644
--- a/gradle-baseline-java/src/test/groovy/com/palantir/baseline/BaselineExactDependenciesTest.groovy
+++ b/gradle-baseline-java/src/test/groovy/com/palantir/baseline/BaselineExactDependenciesTest.groovy
@@ -29,7 +29,7 @@ class BaselineExactDependenciesTest extends AbstractPluginTest {
             id 'java'
             id 'com.palantir.baseline-exact-dependencies'
             id 'com.palantir.baseline' apply false
-            id 'com.palantir.consistent-versions' version '2.0.0' apply false
+            id 'com.palantir.consistent-versions' version '2.31.0' apply false
         }
     '''.stripIndent(true)
 
@@ -331,16 +331,14 @@ class BaselineExactDependenciesTest extends AbstractPluginTest {
             pluginManager.withPlugin('java') {
                 java {
                     toolchain {
-                        languageVersion.set(JavaLanguageVersion.of(16))
+                        languageVersion.set(JavaLanguageVersion.of(17))
                     }
                 }
             }
         '''.stripIndent(true)
 
         then:
-        with('tasks', '--stacktrace')
-                .withGradleVersion('8.4')
-                .build()
+        with('tasks', '--stacktrace').build()
     }
 
     /**
diff --git a/gradle-baseline-java/src/test/groovy/com/palantir/baseline/BaselineJavaVersionIntegrationTest.groovy b/gradle-baseline-java/src/test/groovy/com/palantir/baseline/BaselineJavaVersionIntegrationTest.groovy
index 251595719..4edb23082 100644
--- a/gradle-baseline-java/src/test/groovy/com/palantir/baseline/BaselineJavaVersionIntegrationTest.groovy
+++ b/gradle-baseline-java/src/test/groovy/com/palantir/baseline/BaselineJavaVersionIntegrationTest.groovy
@@ -35,7 +35,7 @@ import java.util.regex.Pattern
  */
 @Unroll
 class BaselineJavaVersionIntegrationTest extends IntegrationSpec {
-    private static final List<String> GRADLE_TEST_VERSIONS = ['8.8', GradleVersion.current().getVersion()]
+    private static final List<String> GRADLE_TEST_VERSIONS = ['7.6.4', '8.8', GradleVersion.current().getVersion()]
 
     private static final int JAVA_8_BYTECODE = 52
     private static final int JAVA_11_BYTECODE = 55
@@ -50,8 +50,8 @@ class BaselineJavaVersionIntegrationTest extends IntegrationSpec {
         buildscript {
             repositories { mavenCentral() }
             dependencies {
-                classpath 'com.palantir.sls-packaging:gradle-sls-packaging:7.56.0'
-                classpath 'com.palantir.gradle.jdkslatest:gradle-jdks-latest:0.13.0'
+                classpath 'com.palantir.sls-packaging:gradle-sls-packaging:7.65.0'
+                classpath 'com.palantir.gradle.jdkslatest:gradle-jdks-latest:0.16.0'
             }
         }
         plugins {
diff --git a/gradle-baseline-java/src/test/groovy/com/palantir/baseline/BaselineNullAwayIntegrationTest.groovy b/gradle-baseline-java/src/test/groovy/com/palantir/baseline/BaselineNullAwayIntegrationTest.groovy
index 87d63b8f8..97b6eeb1c 100644
--- a/gradle-baseline-java/src/test/groovy/com/palantir/baseline/BaselineNullAwayIntegrationTest.groovy
+++ b/gradle-baseline-java/src/test/groovy/com/palantir/baseline/BaselineNullAwayIntegrationTest.groovy
@@ -91,7 +91,7 @@ class BaselineNullAwayIntegrationTest extends IntegrationSpec {
         when:
         buildFile << '''
         plugins {
-            id 'org.unbroken-dome.test-sets' version '4.0.0'
+            id 'org.unbroken-dome.test-sets' version '4.1.0'
         }
         '''.stripIndent(true)
         buildFile << standardBuildFile
diff --git a/gradle-baseline-java/src/test/groovy/com/palantir/baseline/BaselineTestingIntegrationTest.groovy b/gradle-baseline-java/src/test/groovy/com/palantir/baseline/BaselineTestingIntegrationTest.groovy
index c14a24184..833529c44 100644
--- a/gradle-baseline-java/src/test/groovy/com/palantir/baseline/BaselineTestingIntegrationTest.groovy
+++ b/gradle-baseline-java/src/test/groovy/com/palantir/baseline/BaselineTestingIntegrationTest.groovy
@@ -102,7 +102,7 @@ class BaselineTestingIntegrationTest extends IntegrationSpec {
         when:
         buildFile << '''
         plugins {
-            id 'org.unbroken-dome.test-sets' version '4.0.0'
+            id 'org.unbroken-dome.test-sets' version '4.1.0'
         }
         '''.stripIndent(true)
         buildFile << standardBuildFile
@@ -151,7 +151,7 @@ class BaselineTestingIntegrationTest extends IntegrationSpec {
         when:
         buildFile << '''
         plugins {
-            id 'org.unbroken-dome.test-sets' version '4.0.0'
+            id 'org.unbroken-dome.test-sets' version '4.1.0'
         }
         '''.stripIndent(true)
         buildFile << standardBuildFile
diff --git a/gradle-baseline-java/src/test/groovy/com/palantir/baseline/GradleTestVersions.java b/gradle-baseline-java/src/test/groovy/com/palantir/baseline/GradleTestVersions.java
index 588e838ed..f2a57c6f5 100644
--- a/gradle-baseline-java/src/test/groovy/com/palantir/baseline/GradleTestVersions.java
+++ b/gradle-baseline-java/src/test/groovy/com/palantir/baseline/GradleTestVersions.java
@@ -19,7 +19,7 @@
 import com.google.common.collect.ImmutableList;
 
 public final class GradleTestVersions {
-    public static final ImmutableList<String> VERSIONS = ImmutableList.of("7.6.4", "8.4");
+    public static final ImmutableList<String> VERSIONS = ImmutableList.of("7.6.4", "8.8");
 
     private GradleTestVersions() {}
 }
diff --git a/gradle-baseline-java/src/test/groovy/com/palantir/baseline/plugins/BaselineImmutablesTest.groovy b/gradle-baseline-java/src/test/groovy/com/palantir/baseline/plugins/BaselineImmutablesTest.groovy
index 6ca1fd4cb..af61f3091 100644
--- a/gradle-baseline-java/src/test/groovy/com/palantir/baseline/plugins/BaselineImmutablesTest.groovy
+++ b/gradle-baseline-java/src/test/groovy/com/palantir/baseline/plugins/BaselineImmutablesTest.groovy
@@ -28,7 +28,7 @@ class BaselineImmutablesTest extends IntegrationSpec {
         // language=Gradle
         buildFile << '''
             plugins {
-                id 'org.unbroken-dome.test-sets' version '4.0.0'
+                id 'org.unbroken-dome.test-sets' version '4.1.0'
             }
             
             apply plugin: 'com.palantir.baseline-immutables'
diff --git a/gradle-baseline-java/src/test/resources/com/palantir/baseline/build.gradle b/gradle-baseline-java/src/test/resources/com/palantir/baseline/build.gradle
index 74a8ddf32..70ea1c2ec 100644
--- a/gradle-baseline-java/src/test/resources/com/palantir/baseline/build.gradle
+++ b/gradle-baseline-java/src/test/resources/com/palantir/baseline/build.gradle
@@ -16,8 +16,8 @@ dependencies {
 
 tasks.withType(Checkstyle) {
     reports {
-        xml.enabled = false
-        html.enabled = true
+        xml.required = false
+        html.required = true
     }
 }
 
diff --git a/gradle-baseline-java/src/test/resources/com/palantir/baseline/subproject.gradle b/gradle-baseline-java/src/test/resources/com/palantir/baseline/subproject.gradle
index 30ca7a5ff..9c85dd52a 100644
--- a/gradle-baseline-java/src/test/resources/com/palantir/baseline/subproject.gradle
+++ b/gradle-baseline-java/src/test/resources/com/palantir/baseline/subproject.gradle
@@ -31,8 +31,8 @@ dependencies {
 
 tasks.withType(Checkstyle) {
     reports {
-        xml.enabled = false
-        html.enabled = true
+        xml.required = false
+        html.required = true
     }
 }
 
diff --git a/gradle/wrapper/gradle-wrapper.jar b/gradle/wrapper/gradle-wrapper.jar
index afba10928..e6441136f 100644
Binary files a/gradle/wrapper/gradle-wrapper.jar and b/gradle/wrapper/gradle-wrapper.jar differ
diff --git a/gradle/wrapper/gradle-wrapper.properties b/gradle/wrapper/gradle-wrapper.properties
index c7d437bbb..a4413138c 100644
--- a/gradle/wrapper/gradle-wrapper.properties
+++ b/gradle/wrapper/gradle-wrapper.properties
@@ -1,6 +1,7 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-7.6.4-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.8-bin.zip
 networkTimeout=10000
+validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME
 zipStorePath=wrapper/dists
diff --git a/gradlew b/gradlew
index 7a2a66719..980b50e43 100755
--- a/gradlew
+++ b/gradlew
@@ -55,7 +55,7 @@
 #       Darwin, MinGW, and NonStop.
 #
 #   (3) This script is generated from the Groovy template
-#       https://github.com/gradle/gradle/blob/HEAD/subprojects/plugins/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt
+#       https://github.com/gradle/gradle/blob/HEAD/platforms/jvm/plugins-application/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt
 #       within the Gradle project.
 #
 #       You can find Gradle at https://github.com/gradle/gradle/.
@@ -94,10 +94,8 @@ done
 # This is normally unused
 # shellcheck disable=SC2034
 APP_BASE_NAME=${0##*/}
-APP_HOME=$( cd "${APP_HOME:-./}" && pwd -P ) || exit
-
-# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
-DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
+# Discard cd standard output in case $CDPATH is set (https://github.com/gradle/gradle/issues/25036)
+APP_HOME=$( cd "${APP_HOME:-./}" > /dev/null && pwd -P ) || exit
 
 # Use the maximum available, or set MAX_FD != -1 to use that value.
 MAX_FD=maximum
@@ -144,10 +142,13 @@ location of your Java installation."
     fi
 else
     JAVACMD=java
-    which java >/dev/null 2>&1 || die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
+    if ! command -v java >/dev/null 2>&1
+    then
+        die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
 
 Please set the JAVA_HOME variable in your environment to match the
 location of your Java installation."
+    fi
 fi
 
 # Increase the maximum file descriptors if we can.
@@ -155,7 +156,7 @@ if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
     case $MAX_FD in #(
       max*)
         # In POSIX sh, ulimit -H is undefined. That's why the result is checked to see if it worked.
-        # shellcheck disable=SC3045 
+        # shellcheck disable=SC2039,SC3045
         MAX_FD=$( ulimit -H -n ) ||
             warn "Could not query maximum file descriptor limit"
     esac
@@ -163,7 +164,7 @@ if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
       '' | soft) :;; #(
       *)
         # In POSIX sh, ulimit -n is undefined. That's why the result is checked to see if it worked.
-        # shellcheck disable=SC3045 
+        # shellcheck disable=SC2039,SC3045
         ulimit -n "$MAX_FD" ||
             warn "Could not set maximum file descriptor limit to $MAX_FD"
     esac
@@ -208,11 +209,15 @@ if "$cygwin" || "$msys" ; then
     done
 fi
 
-# Collect all arguments for the java command;
-#   * $DEFAULT_JVM_OPTS, $JAVA_OPTS, and $GRADLE_OPTS can contain fragments of
-#     shell script including quotes and variable substitutions, so put them in
-#     double quotes to make sure that they get re-expanded; and
-#   * put everything else in single quotes, so that it's not re-expanded.
+
+# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
+DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
+
+# Collect all arguments for the java command:
+#   * DEFAULT_JVM_OPTS, JAVA_OPTS, JAVA_OPTS, and optsEnvironmentVar are not allowed to contain shell fragments,
+#     and any embedded shellness will be escaped.
+#   * For example: A user cannot expect ${Hostname} to be expanded, as it is an environment variable and will be
+#     treated as '${Hostname}' itself on the command line.
 
 set -- \
         "-Dorg.gradle.appname=$APP_BASE_NAME" \
@@ -252,4 +257,4 @@ eval "set -- $(
         tr '\n' ' '
     )" '"$@"'
 
-exec "$JAVACMD" "$@"
\ No newline at end of file
+exec "$JAVACMD" "$@"
diff --git a/gradlew.bat b/gradlew.bat
index 6689b85be..7101f8e46 100644
--- a/gradlew.bat
+++ b/gradlew.bat
@@ -43,11 +43,11 @@ set JAVA_EXE=java.exe
 %JAVA_EXE% -version >NUL 2>&1
 if %ERRORLEVEL% equ 0 goto execute
 
-echo.
-echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
-echo.
-echo Please set the JAVA_HOME variable in your environment to match the
-echo location of your Java installation.
+echo. 1>&2
+echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH. 1>&2
+echo. 1>&2
+echo Please set the JAVA_HOME variable in your environment to match the 1>&2
+echo location of your Java installation. 1>&2
 
 goto fail
 
@@ -57,11 +57,11 @@ set JAVA_EXE=%JAVA_HOME%/bin/java.exe
 
 if exist "%JAVA_EXE%" goto execute
 
-echo.
-echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME%
-echo.
-echo Please set the JAVA_HOME variable in your environment to match the
-echo location of your Java installation.
+echo. 1>&2
+echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME% 1>&2
+echo. 1>&2
+echo Please set the JAVA_HOME variable in your environment to match the 1>&2
+echo location of your Java installation. 1>&2
 
 goto fail
 
diff --git a/versions.lock b/versions.lock
index 7ff50c8d1..f6d2fc2d7 100644
--- a/versions.lock
+++ b/versions.lock
@@ -61,8 +61,8 @@ org.apache.maven.shared:maven-dependency-analyzer:1.15.1 (1 constraints: 3a05393
 org.apache.maven.shared:maven-shared-utils:3.3.4 (1 constraints: e60b61f3)
 org.checkerframework:checker-qual:3.48.1 (5 constraints: 7148206c)
 org.checkerframework:dataflow-nullaway:3.48.1 (2 constraints: 7511b6f2)
-org.codehaus.groovy:groovy:3.0.13 (3 constraints: 3a295322)
-org.codehaus.groovy:groovy-xml:3.0.13 (1 constraints: 791161da)
+org.codehaus.groovy:groovy:3.0.21 (3 constraints: 39290322)
+org.codehaus.groovy:groovy-xml:3.0.21 (1 constraints: 791161da)
 org.codehaus.plexus:plexus-cipher:2.0 (1 constraints: 641174c7)
 org.codehaus.plexus:plexus-classworlds:2.6.0 (3 constraints: 572b5104)
 org.codehaus.plexus:plexus-component-annotations:2.1.0 (2 constraints: 241d860a)
diff --git a/versions.props b/versions.props
index 4ee0e0a8f..5bac380f5 100644
--- a/versions.props
+++ b/versions.props
@@ -43,14 +43,14 @@ org.junit.vintage:* = 5.11.4
 org.junit.platform:* = 1.11.4
 org.mockito:* = 5.15.2
 
+org.codehaus.groovy:* = 3.0.21
+
 # dependency-upgrader:OFF
 # Don't upgrade, we will remove this in a future release.
 # Users should depend on this plugin directly such that it will get updated by excavator.
 com.palantir.javaformat:gradle-palantir-java-format = 1.1.0
 # Newer spotless versions have issues resolving dependencies at configuration time
 com.diffplug.spotless:spotless-plugin-gradle = 6.6.0
-# Groovy versions must be compatible with gradle
-org.codehaus.groovy:* = 3.0.13
 # checkerframework dependencies should be limited to errorpropne and nullaway
 # requirements, upgrading prior to those often causes compilation failures.
 org.checkerframework:* = 3.48.1