diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index e1439fd..f415292 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -13,11 +13,11 @@ jobs:
 
     steps:
     - uses: actions/checkout@v4
-    - name: Set up JDK 11
+    - name: Set up JDK 21
       uses: actions/setup-java@v4
       with:
         distribution: 'temurin' # See 'Supported distributions' for available options
-        java-version: '11'
+        java-version: '21'
     - name: Build with Maven
       run: mvn -B package --file pom.xml
     - name: Codecov
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 23725d1..e225268 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -19,10 +19,10 @@ jobs:
       - name: Check out code
         uses: actions/checkout@v4
 
-      - name: Set up JAVA 11
+      - name: Set up JAVA 21
         uses: actions/setup-java@v4
         with:
-          java-version: 11
+          java-version: 21
           distribution: "temurin"
 
       - name: Determine the version
@@ -41,10 +41,10 @@ jobs:
           exit 1
         if: github.event_name != 'workflow_dispatch' && steps.versioncheck.outputs.version != github.ref_name
 
-      - name: Set up JDK 11 for snapshots
+      - name: Set up JDK 21 for snapshots
         uses: actions/setup-java@v4
         with:
-          java-version: "11"
+          java-version: "21"
           distribution: "temurin"
           cache: "maven"
           server-id: openconext-snapshots
@@ -52,10 +52,10 @@ jobs:
           server-password: MAVEN_PASSWORD
         if: ( endsWith(steps.versioncheck.outputs.version, '-SNAPSHOT'))
 
-      - name: Set up JDK 11 for releases
+      - name: Set up JDK 21 for releases
         uses: actions/setup-java@v4
         with:
-          java-version: "11"
+          java-version: "21"
           distribution: "temurin"
           cache: "maven"
           server-id: openconext-releases
diff --git a/docker/Dockerfile b/docker/Dockerfile
index 3954ed2..fd7900b 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -1,4 +1,4 @@
-FROM eclipse-temurin:11-jdk-alpine
+FROM eclipse-temurin:21-jdk-alpine
 RUN apk --update upgrade && apk add openssl openssl-dev ca-certificates libgcc && update-ca-certificates
 COPY target/*.jar app.jar
 ENTRYPOINT ["java","-jar","/app.jar"]
diff --git a/pom.xml b/pom.xml
index a55fe14..aade36f 100644
--- a/pom.xml
+++ b/pom.xml
@@ -4,19 +4,19 @@
     <parent>
         <groupId>org.springframework.boot</groupId>
         <artifactId>spring-boot-starter-parent</artifactId>
-        <version>2.4.0</version>
+        <version>2.7.18</version>
         <relativePath/>
         <!-- lookup parent from repository -->
     </parent>
     <groupId>org.surfnet</groupId>
     <artifactId>student-mobility-home-institution-mock</artifactId>
-    <version>0.2.14-SNAPSHOT</version>
+    <version>0.3.0-SNAPSHOT</version>
     <name>home-institution-mock</name>
     <description>home-institution-mock</description>
     <properties>
-        <java.version>11</java.version>
-        <maven.compiler.target>11</maven.compiler.target>
-        <maven.compiler.source>11</maven.compiler.source>
+        <java.version>21</java.version>
+        <maven.compiler.target>21</maven.compiler.target>
+        <maven.compiler.source>21</maven.compiler.source>
     </properties>
     <dependencies>
         <dependency>
@@ -26,7 +26,7 @@
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-oauth2-resource-server</artifactId>
-            <version>2.4.0</version>
+            <version>2.7.18</version>
         </dependency>
         <dependency>
             <groupId>org.springframework.boot</groupId>
@@ -64,7 +64,7 @@
         <dependency>
             <groupId>com.github.spullara.mustache.java</groupId>
             <artifactId>compiler</artifactId>
-            <version>0.9.6</version>
+            <version>0.9.14</version>
         </dependency>
         <dependency>
             <groupId>org.projectlombok</groupId>
@@ -75,19 +75,19 @@
         <dependency>
             <groupId>io.rest-assured</groupId>
             <artifactId>rest-assured</artifactId>
-            <version>4.2.0</version>
+            <version>5.5.0</version>
             <scope>test</scope>
         </dependency>
         <dependency>
             <groupId>io.rest-assured</groupId>
             <artifactId>json-path</artifactId>
-            <version>4.2.0</version>
+            <version>5.5.0</version>
             <scope>test</scope>
         </dependency>
         <dependency>
             <groupId>io.rest-assured</groupId>
             <artifactId>xml-path</artifactId>
-            <version>4.2.0</version>
+            <version>5.5.0</version>
             <scope>test</scope>
         </dependency>
         <!-- https://mvnrepository.com/artifact/com.github.tomakehurst/wiremock -->
@@ -122,10 +122,41 @@
                 <groupId>org.springframework.boot</groupId>
                 <artifactId>spring-boot-maven-plugin</artifactId>
             </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-compiler-plugin</artifactId>
+                <version>3.13.0</version>
+                <configuration>
+                    <release>21</release>
+                </configuration>
+            </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-enforcer-plugin</artifactId>
+                <version>3.5.0</version>
+                <executions>
+                    <execution>
+                        <id>enforce-versions</id>
+                        <goals>
+                            <goal>enforce</goal>
+                        </goals>
+                        <configuration>
+                            <rules>
+                                <requireMavenVersion>
+                                    <version>3.8.4</version>
+                                </requireMavenVersion>
+                                <requireJavaVersion>
+                                    <version>21</version>
+                                </requireJavaVersion>
+                            </rules>
+                        </configuration>
+                    </execution>
+                </executions>
+            </plugin>
             <plugin>
                 <groupId>pl.project13.maven</groupId>
                 <artifactId>git-commit-id-plugin</artifactId>
-                <version>4.0.2</version>
+                <version>4.9.10</version>
                 <configuration>
                     <useNativeGit>true</useNativeGit>
                 </configuration>
@@ -133,7 +164,7 @@
             <plugin>
                 <groupId>org.jacoco</groupId>
                 <artifactId>jacoco-maven-plugin</artifactId>
-                <version>0.8.5</version>
+                <version>0.8.12</version>
                 <configuration>
                     <excludes>
                         <exclude>**/*MockMailBox.*</exclude>
@@ -159,7 +190,7 @@
             <extension>
                 <groupId>org.apache.maven.wagon</groupId>
                 <artifactId>wagon-webdav-jackrabbit</artifactId>
-                <version>3.3.4</version>
+                <version>3.5.3</version>
             </extension>
         </extensions>
     </build>
diff --git a/src/main/java/home/SecurityConfiguration.java b/src/main/java/home/SecurityConfiguration.java
index fa33476..b9925fa 100644
--- a/src/main/java/home/SecurityConfiguration.java
+++ b/src/main/java/home/SecurityConfiguration.java
@@ -27,7 +27,8 @@ public static class OAuth2SecurityConfigurationAdapter extends WebSecurityConfig
         protected void configure(HttpSecurity http) throws Exception {
             DefaultBearerTokenResolver tokenResolver = new DefaultBearerTokenResolver();
             tokenResolver.setAllowFormEncodedBodyParameter(true);
-            http.requestMatchers().antMatchers("/persons/**", "/associations/**", "/oauth2/offerings/**")
+            http.requestMatchers()
+                    .antMatchers("/persons/**", "/associations/**", "/oauth2/offerings/**")
                     .and()
                     .authorizeRequests(authz -> authz
                             .antMatchers(HttpMethod.GET)
@@ -35,6 +36,7 @@ protected void configure(HttpSecurity http) throws Exception {
                             .anyRequest().authenticated())
                     .sessionManagement(sessionManagement ->
                             sessionManagement.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
+                    .csrf().disable()
                     .oauth2ResourceServer().bearerTokenResolver(tokenResolver).opaqueToken();
         }
 
diff --git a/src/main/resources/application.yml b/src/main/resources/application.yml
index 8f489ac..ff5193e 100644
--- a/src/main/resources/application.yml
+++ b/src/main/resources/application.yml
@@ -3,6 +3,7 @@ logging:
     root: warn
     home: debug
     org.springframework: info
+    org.springframework.security: trace
 
 delay:
   enabled: true
diff --git a/src/test/java/home/api/PersonEndpointTest.java b/src/test/java/home/api/PersonEndpointTest.java
index ee8619d..603bc93 100644
--- a/src/test/java/home/api/PersonEndpointTest.java
+++ b/src/test/java/home/api/PersonEndpointTest.java
@@ -1,7 +1,10 @@
 package home.api;
 
 import home.AbstractIntegrationTest;
+import io.restassured.config.EncoderConfig;
+import io.restassured.config.RestAssuredConfig;
 import org.junit.jupiter.api.Test;
+import org.springframework.http.MediaType;
 
 import java.io.IOException;
 
@@ -31,8 +34,13 @@ void persons() throws Exception {
     void personsPost() throws Exception {
         String accessToken = opaqueAccessToken(true);
         given()
+                .config(RestAssuredConfig.config()
+                        .encoderConfig(EncoderConfig.encoderConfig()
+                                ///Bugfix for the DefaultBearerTokenResolver being strict in content type checking
+                                .appendDefaultContentCharsetToContentTypeIfUndefined(false)))
                 .when()
                 .formParam("access_token", accessToken)
+                .contentType(MediaType.APPLICATION_FORM_URLENCODED_VALUE)
                 .post("/persons/me")
                 .then()
                 .statusCode(SC_OK)
diff --git a/src/test/resources/logback-test.xml b/src/test/resources/logback-test.xml
index b27eb62..dbe5d64 100644
--- a/src/test/resources/logback-test.xml
+++ b/src/test/resources/logback-test.xml
@@ -9,5 +9,6 @@
         <appender-ref ref="STDOUT"/>
     </root>
     <logger name="org.springframework" level="WARN"/>
+    <logger name="org.springframework.security" level="TRACE"/>
     <logger name="home" level="DEBUG"/>
 </configuration>
\ No newline at end of file