diff --git a/updatecli/scripts/check-jdk.sh b/updatecli/scripts/check-jdk.sh
new file mode 100644
index 000000000..003f49178
--- /dev/null
+++ b/updatecli/scripts/check-jdk.sh
@@ -0,0 +1,73 @@
+#!/bin/bash
+# This script checks that the provided JDK version has all the required binaries available for downloads
+# as sometimes, the tag for adoptium is published immeidatly while binaries are published later.
+##
+# The source of truth is the ERB template stored at the location dist/profile/templates/jenkinscontroller/casc/tools.yaml.erb
+# It lists all the installations used as "Jenkins Tools" by the Jenkins controllers of the infrastructure
+##
+set -eu -o pipefail
+
+command -v curl >/dev/null 2>&1 || { echo "ERROR: curl command not found. Exiting."; exit 1; }
+
+function get_jdk_download_url() {
+  jdk_version="${1}"
+  platform="${2}"
+  case "${jdk_version}" in
+    8*)
+      ## JDK8 does not have the carret ('-') in their archive names
+      echo "https://github.com/adoptium/temurin8-binaries/releases/download/jdk${jdk_version}/OpenJDK8U-jdk_${platform}_hotspot_${jdk_version//-}";
+      return 0;;
+    11*)
+      ## JDK11 URLs have an underscore ('_') instead of a plus ('+') in their archive names
+      echo "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-${jdk_version}/OpenJDK11U-jdk_${platform}_hotspot_${jdk_version//+/_}";
+      return 0;;
+    17*)
+      ## JDK17 URLs have an underscore ('_') instead of a plus ('+') in their archive names
+      echo "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-${jdk_version}/OpenJDK17U-jdk_${platform}_hotspot_${jdk_version//+/_}";
+      return 0;;
+    19*)
+      ## JDK19 URLs have an underscore ('_') instead of a plus ('+') in their archive names
+      echo "https://github.com/adoptium/temurin19-binaries/releases/download/jdk-${jdk_version}/OpenJDK19U-jdk_${platform}_hotspot_${jdk_version//+/_}";
+      return 0;;
+    21*)
+      # JDK version (21+35-ea-beta)
+      ##    https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21%2B35-ea-beta/OpenJDK21U-jdk_aarch64_linux_hotspot_ea_21-0-35.tar.gz
+      urlEncodedJDKVersion="${jdk_version//+/%2B}"
+      echo "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-${urlEncodedJDKVersion}-ea-beta/OpenJDK21U-jdk_${platform}_hotspot_ea_21-0-$(echo ${jdk_version} | cut -d '+' -f 2 | cut -d '-' -f 1)"
+      return 0;;
+    *)
+      echo "ERROR: unsupported JDK version (${jdk_version}).";
+      exit 1;;
+  esac
+}
+
+case "${1}" in
+  8u*)
+    # No s390x support for JDK8: $platforms is kept as default
+    platforms=("x64_linux" "x64_windows" "aarch64_linux");;
+  11.*)
+    platforms=("x64_linux" "x64_windows" "aarch64_linux" "s390x_linux");;
+  17.*+*)
+    platforms=("x64_linux" "x64_windows" "aarch64_linux" "s390x_linux");;
+  19.*+*)
+    platforms=("x64_linux" "x64_windows" "aarch64_linux" "s390x_linux");;
+  21*+*)
+    platforms=("x64_linux" "x64_windows" "aarch64_linux" "s390x_linux");;
+  *)
+    echo "ERROR: unsupported JDK version (${1}).";
+    exit 1;;
+esac
+
+for platform in "${platforms[@]}"
+do
+  url_to_check="$(get_jdk_download_url "${1}" "${platform}")"
+  if [[ "${platform}" == *windows* ]]
+  then
+    url_to_check+=".zip"
+  else
+    url_to_check+=".tar.gz"
+  fi
+  >&2 curl --connect-timeout 5 --location --head --fail --silent "${url_to_check}" || { echo "ERROR: the following URL is NOT available: ${url_to_check}."; exit 1; }
+done
+
+echo "OK: all JDK URL for version=${1} are available."
diff --git a/updatecli/updatecli.d/jdk21.yaml b/updatecli/updatecli.d/jdk21.yaml
new file mode 100644
index 000000000..43928b7a9
--- /dev/null
+++ b/updatecli/updatecli.d/jdk21.yaml
@@ -0,0 +1,60 @@
+---
+name: Bump JDK21 version for all Linux images
+
+scms:
+  default:
+    kind: github
+    spec:
+      user: "{{ .github.user }}"
+      email: "{{ .github.email }}"
+      owner: "{{ .github.owner }}"
+      repository: "{{ .github.repository }}"
+      token: "{{ requiredEnv .github.token }}"
+      username: "{{ .github.username }}"
+      branch: "{{ .github.branch }}"
+  temurin21-binaries:
+    kind: "github"
+    spec:
+      user: "{{ .github.user }}"
+      email: "{{ .github.email }}"
+      owner: "adoptium"
+      repository: "temurin21-binaries"
+      token: '{{ requiredEnv .github.token }}'
+      branch: "main"
+
+sources:
+  getLatestJDK21EAVersion:
+    name: Get the latest Adoptium JDK21 version
+    kind: gittag
+    scmid: temurin21-binaries
+    spec:
+      versionfilter:
+        kind: regex
+        pattern: ".*-ea-.*"
+    transformers:
+      - trimprefix: "jdk-"
+      - trimsuffix: "-ea-beta"
+
+conditions:
+  checkIfReleaseIsAvailable:
+    kind: shell
+    spec:
+      command: bash ./updatecli/scripts/check-jdk.sh # source input value passed as argument
+
+targets:
+  setJDK21Version:
+    name: "Bump JDK21 version for Linux images in the docker-bake.hcl file"
+    kind: hcl
+    spec:
+      file: docker-bake.hcl
+      path: variable.JAVA21_VERSION.default
+    scmid: default
+
+actions:
+  default:
+    kind: github/pullrequest
+    scmid: default
+    title: Bump JDK21 version to {{ source "getLatestJDK21EAVersion" }}
+    spec:
+      labels:
+        - dependencies