diff --git a/.github/workflows/appimage.yml b/.github/workflows/appimage.yml
index 15c1ea3a9..5821a7fde 100644
--- a/.github/workflows/appimage.yml
+++ b/.github/workflows/appimage.yml
@@ -11,7 +11,7 @@ on:
 
 env:
   JAVA_DIST: 'zulu'
-  JAVA_VERSION: 21
+  JAVA_VERSION: '21.0.1+12'
 
 jobs:
   get-version:
diff --git a/.github/workflows/check-jdk-updates.yml b/.github/workflows/check-jdk-updates.yml
new file mode 100644
index 000000000..30954b9e4
--- /dev/null
+++ b/.github/workflows/check-jdk-updates.yml
@@ -0,0 +1,64 @@
+name: Checks JDK version for minor updates
+
+on:
+  schedule:
+    - cron: '0 0 1 * *' # run once a month at the first day of month
+
+env:
+  JDK_VERSION: '21.0.1+12'
+  JDK_VENDOR: zulu
+
+jobs:
+  jdk-current:
+    name: Check out current version
+    runs-on: ubuntu-latest
+    outputs:
+      jdk-date: ${{ steps.get-data.outputs.jdk-date}}
+    steps:
+      - uses: actions/setup-java@v3
+        with:
+          java-version: ${{ env.JDK_VERSION }}
+          distribution: ${{ env.JDK_VENDOR }}
+          check-latest: false
+      - name: Read JAVA_VERSION_DATE and store in env variable
+        id: get-data
+        run: |
+          date=$(cat ${JAVA_HOME}/release | grep "JAVA_VERSION_DATE=\"" | awk -F'=' '{print $2}' | tr -d '"')
+          echo "jdk-date=${date}" >> "$GITHUB_OUTPUT"
+  jdk-latest:
+    name: Checkout latest jdk version
+    runs-on: ubuntu-latest
+    outputs:
+      jdk-date: ${{ steps.get-data.outputs.jdk-date}}
+      jdk-version: ${{ steps.get-data.outputs.jdk-version}}
+    steps:
+      - uses: actions/setup-java@v3
+        with:
+          java-version: 21
+          distribution: ${{ env.JDK_VENDOR }}
+          check-latest: true
+      - name: Read JAVA_VERSION_DATE and store in env variable
+        id: get-data
+        run: |
+          date=$(cat ${JAVA_HOME}/release | grep "JAVA_VERSION_DATE=\"" | awk -F'=' '{print $2}' | tr -d '"')
+          echo "jdk-date=${date}" >> "$GITHUB_OUTPUT"
+          version=$(cat ${JAVA_HOME}/release | grep "JAVA_RUNTIME_VERSION=\"" | awk -F'=' '{print $2}' | tr -d '"')
+          echo "jdk-version=${version}" >> "$GITHUB_OUTPUT"
+  notify:
+    name: Notifies for jdk update
+    runs-on: ubuntu-latest
+    needs: [jdk-current, jdk-latest]
+    if: ${{ needs.jdk-latest.outputs.jdk-date }} > ${{ needs.jdk-current.outputs.jdk-date }}
+    steps:
+      - name: Slack Notification
+        uses: rtCamp/action-slack-notify@v2
+        env:
+          SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK_URL }}
+          SLACK_USERNAME: 'Cryptobot'
+          SLACK_ICON: false
+          SLACK_ICON_EMOJI: ':bot:'
+          SLACK_CHANNEL: 'cryptomator-desktop'
+          SLACK_TITLE: "JDK update available"
+          SLACK_MESSAGE: "Cryptomator-CI JDK can be upgraded to ${{ needs.jdk-latest.outputs.jdk-version }}. See https://github.com/cryptomator/cryptomator/wiki/How-to-update-the-build-JDK for instructions."
+          SLACK_FOOTER: false
+          MSG_MINIMAL: true
diff --git a/.github/workflows/debian.yml b/.github/workflows/debian.yml
index 054d6cadf..e8fd5da22 100644
--- a/.github/workflows/debian.yml
+++ b/.github/workflows/debian.yml
@@ -17,8 +17,9 @@ on:
 
 env:
   JAVA_DIST: 'zulu'
-  JAVA_VERSION: 21
-  COFFEELIBS_JDK_VERSION: 21
+  JAVA_VERSION: '21.0.1+12'
+  COFFEELIBS_JDK: 21
+  COFFEELIBS_JDK_VERSION: '21.0.1+12-0ppa1'
   OPENJFX_JMODS_AMD64: 'https://download2.gluonhq.com/openjfx/20.0.2/openjfx-20.0.2_linux-x64_bin-jmods.zip'
   OPENJFX_JMODS_AMD64_HASH: 'f522ac2ae4bdd61f0219b7b8d2058ff72a22f36a44378453bcfdcd82f8f5e08c'
   OPENJFX_JMODS_AARCH64: 'https://download2.gluonhq.com/openjfx/20.0.2/openjfx-20.0.2_linux-aarch64_bin-jmods.zip'
@@ -43,7 +44,7 @@ jobs:
         run: |
           sudo add-apt-repository ppa:coffeelibs/openjdk
           sudo apt-get update
-          sudo apt-get install debhelper devscripts dput coffeelibs-jdk-${{ env.COFFEELIBS_JDK_VERSION }} libgtk2.0-0
+          sudo apt-get install debhelper devscripts dput coffeelibs-jdk-${{ env.COFFEELIBS_JDK }}=${{ env.COFFEELIBS_JDK_VERSION }} libgtk2.0-0
       - name: Setup Java
         uses: actions/setup-java@v3
         with:
@@ -149,4 +150,4 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.CRYPTOBOT_RELEASE_TOKEN }}
         run: |
           artifacts=$(ls | grep cryptomator*.deb)
-          gh release upload ${{ github.ref_name }} $artifacts
\ No newline at end of file
+          gh release upload ${{ github.ref_name }} $artifacts
diff --git a/.github/workflows/mac-dmg.yml b/.github/workflows/mac-dmg.yml
index 8db4296d9..1372fe6ce 100644
--- a/.github/workflows/mac-dmg.yml
+++ b/.github/workflows/mac-dmg.yml
@@ -16,7 +16,7 @@ on:
 
 env:
   JAVA_DIST: 'zulu'
-  JAVA_VERSION: 21
+  JAVA_VERSION: '21.0.1+12'
 
 jobs:
   get-version:
diff --git a/.github/workflows/win-exe.yml b/.github/workflows/win-exe.yml
index 07ae7dea4..dece30a8b 100644
--- a/.github/workflows/win-exe.yml
+++ b/.github/workflows/win-exe.yml
@@ -15,7 +15,7 @@ on:
 
 env:
   JAVA_DIST: 'zulu'
-  JAVA_VERSION: 21
+  JAVA_VERSION: '21.0.1+12'
   OPENJFX_JMODS_AMD64: 'https://download2.gluonhq.com/openjfx/20.0.2/openjfx-20.0.2_windows-x64_bin-jmods.zip'
   OPENJFX_JMODS_AMD64_HASH: '18625bbc13c57dbf802486564247a8d8cab72ec558c240a401bf6440384ebd77'
   WINFSP_MSI: 'https://github.com/winfsp/winfsp/releases/download/v2.0/winfsp-2.0.23075.msi'
diff --git a/dist/linux/debian/control b/dist/linux/debian/control
index 148fdb213..0e7266c75 100644
--- a/dist/linux/debian/control
+++ b/dist/linux/debian/control
@@ -2,7 +2,7 @@ Source: cryptomator
 Maintainer: Cryptobot <releases@cryptomator.org>
 Section: utils
 Priority: optional
-Build-Depends: debhelper (>=10), coffeelibs-jdk-21, libgtk2.0-0, libgtk-3-0,  libxxf86vm1, libgl1
+Build-Depends: debhelper (>=10), coffeelibs-jdk-21 (= 21.0.1+12-0ppa1), libgtk2.0-0, libgtk-3-0,  libxxf86vm1, libgl1
 Standards-Version: 4.5.0
 Homepage: https://cryptomator.org
 Vcs-Git: https://github.com/cryptomator/cryptomator.git