diff --git a/.ci/publish.sh b/.ci/publish.sh
index 37b20a82ee..df5fbb5030 100755
--- a/.ci/publish.sh
+++ b/.ci/publish.sh
@@ -68,9 +68,15 @@ else
     LATEST_WEEKLY="false"
 fi
 
+# Build all images including Java 11 if the version match latest LTS version
+# TODO: remove when Java 11 is removed from LTS line
+# See https://github.com/jenkinsci/docker/issues/1890
+TARGET="linux"
+
 if [[ "${JENKINS_VERSION}" == "${latest_lts_version}" ]]
 then
     LATEST_LTS="true"
+    TARGET="linux-lts-with-jdk11"
 else
     LATEST_LTS="false"
 fi
@@ -84,7 +90,7 @@ fi
 
 JENKINS_SHA="$(curl --disable --fail --silent --show-error --location "https://repo.jenkins-ci.org/releases/org/jenkins-ci/main/jenkins-war/${JENKINS_VERSION}/jenkins-war-${JENKINS_VERSION}.war.sha256")"
 COMMIT_SHA=$(git rev-parse HEAD)
-export COMMIT_SHA JENKINS_VERSION JENKINS_SHA LATEST_WEEKLY LATEST_LTS
+export COMMIT_SHA JENKINS_VERSION JENKINS_SHA LATEST_WEEKLY LATEST_LTS TARGET
 
 cat <<EOF
 Using the following settings:
@@ -94,6 +100,7 @@ Using the following settings:
 * COMMIT_SHA: ${COMMIT_SHA}
 * LATEST_WEEKLY: ${LATEST_WEEKLY}
 * LATEST_LTS: ${LATEST_LTS}
+* TARGET: ${TARGET}
 EOF
 
-docker buildx bake --file docker-bake.hcl "${build_opts[@]}" linux
+docker buildx bake --file docker-bake.hcl "${build_opts[@]}" "${TARGET}"
diff --git a/Jenkinsfile b/Jenkinsfile
index 34a656f8fc..bd733268f9 100644
--- a/Jenkinsfile
+++ b/Jenkinsfile
@@ -11,62 +11,97 @@ H 6,21 * * 3''')])
 
 properties(listOfProperties)
 
+// Default environment variable set to allow images publication
+def envVars = ["PUBLISH=true"]
+
+// Set to true in a replay to simulate a LTS build on ci.jenkins.io
+// It will set the environment variables needed for a LTS
+// and disable images publication out of caution
+def SIMULATE_LTS_BUILD = false
+
+if (SIMULATE_LTS_BUILD) {
+    envVars = [
+        "PUBLISH=false",
+        "TAG_NAME=2.452.2",
+        "JENKINS_VERSION=2.452.2",
+        "JENKINS_SHA=360efc8438db9a4ba20772981d4257cfe6837bf0c3fb8c8e9b2253d8ce6ba339"
+    ]
+}
+
 stage('Build') {
     def builds = [:]
-    def windowsImageTypes = [
-        'windowsservercore-ltsc2019',
-    ]
-    for (anImageType in windowsImageTypes) {
-        def imageType = anImageType
-        builds[imageType] = {
-            nodeWithTimeout('windows-2019') {
-                stage('Checkout') {
-                    checkout scm
-                }
 
-                withEnv(["IMAGE_TYPE=${imageType}"]) {
-                    if (!infra.isTrusted()) {
-                        /* Outside of the trusted.ci environment, we're building and testing
-                        * the Dockerfile in this repository, but not publishing to docker hub
-                        */
-                        stage("Build ${imageType}") {
-                            infra.withDockerCredentials {
-                                powershell './make.ps1'
-                            }
+    withEnv (envVars) {
+        // Determine if the tag name (ie Jenkins version) correspond to a LTS (3 groups of digits)
+        // to use the appropriate bake target and set of images to build (including or not Java 11)
+        def isLTS
+        if (env.TAG_NAME && env.TAG_NAME =~ /^\d+\.\d+\.\d+$/) {
+            isLTS = true
+            target = 'linux-lts-with-jdk11'
+        } else {
+            isLTS = false
+            target = 'linux'
+        }
+        echo "= bake target: $target"
+        echo "= isLTS: $isLTS"
+
+        withEnv (["TARGET=${target}"]) {
+            def windowsImageTypes = [
+                'windowsservercore-ltsc2019',
+            ]
+            for (anImageType in windowsImageTypes) {
+                def imageType = anImageType
+                builds[imageType] = {
+                    nodeWithTimeout('windows-2019') {
+                        stage('Checkout') {
+                            checkout scm
                         }
 
-                        stage("Test ${imageType}") {
-                            infra.withDockerCredentials {
-                                def windowsTestStatus = powershell(script: './make.ps1 test', returnStatus: true)
-                                junit(allowEmptyResults: true, keepLongStdio: true, testResults: 'target/**/junit-results.xml')
-                                if (windowsTestStatus > 0) {
-                                    // If something bad happened let's clean up the docker images
-                                    error('Windows test stage failed.')
+                        withEnv(["IMAGE_TYPE=${imageType}"]) {
+                            if (!infra.isTrusted()) {
+                                /* Outside of the trusted.ci environment, we're building and testing
+                                * the Dockerfile in this repository, but not publishing to docker hub
+                                */
+                                stage("Build ${imageType}") {
+                                    infra.withDockerCredentials {
+                                        powershell './make.ps1'
+                                    }
                                 }
-                            }
-                        }
 
-                        // disable until we get the parallel changes merged in
-                        // def branchName = "${env.BRANCH_NAME}"
-                        // if (branchName ==~ 'master'){
-                        //    stage('Publish Experimental') {
-                        //        infra.withDockerCredentials {
-                        //            withEnv(['DOCKERHUB_ORGANISATION=jenkins4eval','DOCKERHUB_REPO=jenkins']) {
-                        //                powershell './make.ps1 publish'
-                        //            }
-                        //        }
-                        //    }
-                        // }
-                    } else {
-                        // Only publish when a tag triggered the build
-                        if (env.TAG_NAME) {
-                            // Split to ensure any suffix is not taken in account (but allow suffix tags to trigger rebuilds)
-                            jenkins_version = env.TAG_NAME.split('-')[0]
-                            withEnv(["JENKINS_VERSION=${jenkins_version}"]) {
-                                stage('Publish') {
+                                stage("Test ${imageType}") {
                                     infra.withDockerCredentials {
-                                        withEnv(['DOCKERHUB_ORGANISATION=jenkins','DOCKERHUB_REPO=jenkins']) {
-                                            powershell './make.ps1 publish'
+                                        def windowsTestStatus = powershell(script: './make.ps1 test', returnStatus: true)
+                                        junit(allowEmptyResults: true, keepLongStdio: true, testResults: 'target/**/junit-results.xml')
+                                        if (windowsTestStatus > 0) {
+                                            // If something bad happened let's clean up the docker images
+                                            error('Windows test stage failed.')
+                                        }
+                                    }
+                                }
+
+                                // disable until we get the parallel changes merged in
+                                // def branchName = "${env.BRANCH_NAME}"
+                                // if (branchName ==~ 'master'){
+                                //    stage('Publish Experimental') {
+                                //        infra.withDockerCredentials {
+                                //            withEnv(['DOCKERHUB_ORGANISATION=jenkins4eval','DOCKERHUB_REPO=jenkins']) {
+                                //                powershell './make.ps1 publish'
+                                //            }
+                                //        }
+                                //    }
+                                // }
+                            } else {
+                                // Only publish when a tag triggered the build & the publication is enabled (ie not simulating a LTS)
+                                if (env.TAG_NAME && (env.PUBLISH == "true")) {
+                                    // Split to ensure any suffix is not taken in account (but allow suffix tags to trigger rebuilds)
+                                    jenkins_version = env.TAG_NAME.split('-')[0]
+                                    withEnv(["JENKINS_VERSION=${jenkins_version}"]) {
+                                        stage('Publish') {
+                                            infra.withDockerCredentials {
+                                                withEnv(['DOCKERHUB_ORGANISATION=jenkins','DOCKERHUB_REPO=jenkins']) {
+                                                    powershell './make.ps1 publish'
+                                                }
+                                            }
                                         }
                                     }
                                 }
@@ -75,114 +110,136 @@ stage('Build') {
                     }
                 }
             }
-        }
-    }
 
-    if (!infra.isTrusted()) {
-        def images = [
-                'almalinux_jdk11',
-                'alpine_jdk11',
-                'alpine_jdk17',
-                'alpine_jdk21',
-                'debian_jdk11',
-                'debian_jdk17',
-                'debian_jdk21',
-                'debian_slim_jdk11',
-                'debian_slim_jdk17',
-                'debian_slim_jdk21',
-                'rhel_ubi8_jdk11',
-                'rhel_ubi9_jdk17',
-                'rhel_ubi9_jdk21',
-        ]
-        for (i in images) {
-            def imageToBuild = i
-
-            builds[imageToBuild] = {
-                nodeWithTimeout('docker') {
-                    deleteDir()
-
-                    stage('Checkout') {
-                        checkout scm
-                    }
+            if (!infra.isTrusted()) {
+                def images
+
+                def imagesWithoutJava11 = [
+                    'alpine_jdk17',
+                    'alpine_jdk21',
+                    'debian_jdk17',
+                    'debian_jdk21',
+                    'debian_slim_jdk17',
+                    'debian_slim_jdk21',
+                    'rhel_ubi9_jdk17',
+                    'rhel_ubi9_jdk21',
+                ]
+                def imagesWithJava11 = [
+                    'almalinux_jdk11',
+                    'alpine_jdk11',
+                    'alpine_jdk17',
+                    'alpine_jdk21',
+                    'debian_jdk11',
+                    'debian_jdk17',
+                    'debian_jdk21',
+                    'debian_slim_jdk11',
+                    'debian_slim_jdk17',
+                    'debian_slim_jdk21',
+                    'rhel_ubi8_jdk11',
+                    'rhel_ubi9_jdk17',
+                    'rhel_ubi9_jdk21',
+                ]
+                // Build all images including Java 11 if the version match a LTS versioning pattern
+                // TODO: remove when Java 11 is removed from LTS line
+                // See https://github.com/jenkinsci/docker/issues/1890
+                if (isLTS) {
+                    images = imagesWithJava11
+                } else {
+                    images = imagesWithoutJava11
+                }
+                for (i in images) {
+                    def imageToBuild = i
 
-                    stage('Static analysis') {
-                        sh 'make hadolint shellcheck'
-                    }
+                    builds[imageToBuild] = {
+                        nodeWithTimeout('docker') {
+                            deleteDir()
 
-                    /* Outside of the trusted.ci environment, we're building and testing
-                    * the Dockerfile in this repository, but not publishing to docker hub
-                    */
-                    stage("Build linux-${imageToBuild}") {
-                        infra.withDockerCredentials {
-                            sh "make build-${imageToBuild}"
-                        }
-                    }
+                            stage('Checkout') {
+                                checkout scm
+                            }
 
-                    stage("Test linux-${imageToBuild}") {
-                        sh "make prepare-test"
-                        try {
-                            infra.withDockerCredentials {
-                                sh "make test-${imageToBuild}"
+                            stage('Static analysis') {
+                                sh 'make hadolint shellcheck'
                             }
-                        } catch (err) {
-                            error("${err.toString()}")
-                        } finally {
-                            junit(allowEmptyResults: true, keepLongStdio: true, testResults: 'target/*.xml')
-                        }
-                    }
-                }
-            }
-        }
-        builds['multiarch-build'] = {
-            nodeWithTimeout('docker') {
-                stage('Checkout') {
-                    deleteDir()
-                    checkout scm
-                }
 
-                // sanity check that proves all images build on declared platforms
-                stage('Multi arch build') {
-                    infra.withDockerCredentials {
-                        sh '''
-                            docker buildx create --use
-                            docker run --rm --privileged multiarch/qemu-user-static --reset -p yes
-                            docker buildx bake --file docker-bake.hcl linux
-                        '''
+                            /* Outside of the trusted.ci environment, we're building and testing
+                            * the Dockerfile in this repository, but not publishing to docker hub
+                            */
+                            stage("Build linux-${imageToBuild}") {
+                                infra.withDockerCredentials {
+                                    sh "make build-${imageToBuild}"
+                                }
+                            }
+
+                            stage("Test linux-${imageToBuild}") {
+                                sh "make prepare-test"
+                                try {
+                                    infra.withDockerCredentials {
+                                        sh "make test-${imageToBuild}"
+                                    }
+                                } catch (err) {
+                                    error("${err.toString()}")
+                                } finally {
+                                    junit(allowEmptyResults: true, keepLongStdio: true, testResults: 'target/*.xml')
+                                }
+                            }
+                        }
                     }
                 }
-            }
-        }
-    } else {
-        // Only publish when a tag triggered the build
-        if (env.TAG_NAME) {
-            // Split to ensure any suffix is not taken in account (but allow suffix tags to trigger rebuilds)
-            jenkins_version = env.TAG_NAME.split('-')[0]
-            builds['linux'] = {
-                withEnv(["JENKINS_VERSION=${jenkins_version}"]) {
+                builds['multiarch-build'] = {
                     nodeWithTimeout('docker') {
                         stage('Checkout') {
+                            deleteDir()
                             checkout scm
                         }
 
-                        stage('Publish') {
+                        // sanity check that proves all images build on declared platforms
+                        stage('Multi arch build') {
                             infra.withDockerCredentials {
                                 sh '''
                                     docker buildx create --use
                                     docker run --rm --privileged multiarch/qemu-user-static --reset -p yes
-                                    make publish
-                                    '''
+                                    docker buildx bake --file docker-bake.hcl "${TARGET}"
+                                '''
+                            }
+                        }
+                    }
+                }
+            } else {
+                // Only publish when a tag triggered the build
+                if (env.TAG_NAME) {
+                    // Split to ensure any suffix is not taken in account (but allow suffix tags to trigger rebuilds)
+                    jenkins_version = env.TAG_NAME.split('-')[0]
+                    builds['linux'] = {
+                        withEnv(["JENKINS_VERSION=${jenkins_version}"]) {
+                            nodeWithTimeout('docker') {
+                                stage('Checkout') {
+                                    checkout scm
+                                }
+
+                                stage('Publish') {
+                                    // Publication is enabled by default, disabled when simulating a LTS
+                                    if (env.PUBLISH == "true") {
+                                        infra.withDockerCredentials {
+                                            sh '''
+                                                docker buildx create --use
+                                                docker run --rm --privileged multiarch/qemu-user-static --reset -p yes
+                                                make publish
+                                                '''
+                                        }
+                                    }
+                                }
                             }
                         }
                     }
                 }
             }
+
+            parallel builds
         }
     }
-
-    parallel builds
 }
 
-
 void nodeWithTimeout(String label, def body) {
     node(label) {
         timeout(time: 60, unit: 'MINUTES') {
diff --git a/Makefile b/Makefile
index 8da9843a2f..d169569058 100644
--- a/Makefile
+++ b/Makefile
@@ -21,6 +21,11 @@ DISABLE_PARALLEL_TESTS ?= false
 # default is "all test suites in the "tests/" directory
 TEST_SUITES ?= $(CURDIR)/tests
 
+# Set to linux-lts-with-jdk11 to build all images including Java 11 if the version match a LTS versioning pattern
+# TODO: remove when Java 11 is removed from LTS line
+# See https://github.com/jenkinsci/docker/issues/1890
+TARGET ?= linux
+
 ##### Macros
 ## Check the presence of a CLI in the current PATH
 check_cli = type "$(1)" >/dev/null 2>&1 || { echo "Error: command '$(1)' required but not found. Exiting." ; exit 1 ; }
@@ -53,7 +58,7 @@ build-%: check-reqs
 	@set -x; $(bake_base_cli) --set '*.platform=linux/$(ARCH)' '$*'
 
 show:
-	@$(bake_base_cli) linux --print
+	@$(bake_base_cli) $(TARGET) --print
 
 list: check-reqs
 	@set -x; make --silent show | jq -r '.target | path(.. | select(.platforms[] | contains("linux/$(ARCH)"))?) | add'
diff --git a/build-windows-lts-with-jdk11.yaml b/build-windows-lts-with-jdk11.yaml
new file mode 100644
index 0000000000..1d0485768c
--- /dev/null
+++ b/build-windows-lts-with-jdk11.yaml
@@ -0,0 +1,50 @@
+services:
+  jdk11:
+    image: ${DOCKERHUB_ORGANISATION}/${DOCKERHUB_REPO}${SEPARATOR_LTS_PREFIX}jdk11-hotspot-${WINDOWS_FLAVOR}-${WINDOWS_VERSION}
+    build:
+      context: ./
+      dockerfile: ./windows/${WINDOWS_FLAVOR}/hotspot/Dockerfile
+      args:
+        COMMIT_SHA: ${COMMIT_SHA}
+        JAVA_HOME: "C:/openjdk-11"
+        JAVA_VERSION: 11.0.23_9
+        JENKINS_SHA: ${JENKINS_SHA}
+        JENKINS_VERSION: ${JENKINS_VERSION}
+        TOOLS_WINDOWS_VERSION: ${TOOLS_WINDOWS_VERSION}
+        WINDOWS_VERSION: ${WINDOWS_VERSION}
+      tags:
+        - ${DOCKERHUB_ORGANISATION}/${DOCKERHUB_REPO}:${JENKINS_VERSION}-jdk11-hotspot-${WINDOWS_FLAVOR}-${WINDOWS_VERSION}
+  jdk17:
+    image: ${DOCKERHUB_ORGANISATION}/${DOCKERHUB_REPO}${SEPARATOR_LTS_PREFIX}jdk17-hotspot-${WINDOWS_FLAVOR}-${WINDOWS_VERSION}
+    build:
+      context: ./
+      dockerfile: ./windows/${WINDOWS_FLAVOR}/hotspot/Dockerfile
+      args:
+        COMMIT_SHA: ${COMMIT_SHA}
+        JAVA_HOME: "C:/openjdk-17"
+        JAVA_VERSION: 17.0.11_9
+        JENKINS_SHA: ${JENKINS_SHA}
+        JENKINS_VERSION: ${JENKINS_VERSION}
+        TOOLS_WINDOWS_VERSION: ${TOOLS_WINDOWS_VERSION}
+        WINDOWS_VERSION: ${WINDOWS_VERSION}
+      tags:
+        - ${DOCKERHUB_ORGANISATION}/${DOCKERHUB_REPO}:${JENKINS_VERSION}-jdk17-hotspot-${WINDOWS_FLAVOR}-${WINDOWS_VERSION}
+        - ${DOCKERHUB_ORGANISATION}/${DOCKERHUB_REPO}:${JENKINS_VERSION}-${WINDOWS_FLAVOR}-${WINDOWS_VERSION}
+        - ${DOCKERHUB_ORGANISATION}/${DOCKERHUB_REPO}${SEPARATOR_LTS_PREFIX}${WINDOWS_FLAVOR}-${WINDOWS_VERSION}
+  jdk21:
+    image: ${DOCKERHUB_ORGANISATION}/${DOCKERHUB_REPO}${SEPARATOR_LTS_PREFIX}jdk21-hotspot-${WINDOWS_FLAVOR}-${WINDOWS_VERSION}
+    build:
+      context: ./
+      dockerfile: ./windows/${WINDOWS_FLAVOR}/hotspot/Dockerfile
+      args:
+        COMMIT_SHA: ${COMMIT_SHA}
+        JAVA_HOME: "C:/openjdk-21"
+        JAVA_VERSION: 21.0.3_9
+        JENKINS_SHA: ${JENKINS_SHA}
+        JENKINS_VERSION: ${JENKINS_VERSION}
+        TOOLS_WINDOWS_VERSION: ${TOOLS_WINDOWS_VERSION}
+        WINDOWS_VERSION: ${WINDOWS_VERSION}
+      tags:
+        - ${DOCKERHUB_ORGANISATION}/${DOCKERHUB_REPO}:${JENKINS_VERSION}-jdk21-hotspot-${WINDOWS_FLAVOR}-${WINDOWS_VERSION}
+        - ${DOCKERHUB_ORGANISATION}/${DOCKERHUB_REPO}:${JENKINS_VERSION}-${WINDOWS_FLAVOR}-${WINDOWS_VERSION}
+        - ${DOCKERHUB_ORGANISATION}/${DOCKERHUB_REPO}${SEPARATOR_LTS_PREFIX}${WINDOWS_FLAVOR}-${WINDOWS_VERSION}
diff --git a/build-windows.yaml b/build-windows.yaml
index 1d0485768c..50600f5d13 100644
--- a/build-windows.yaml
+++ b/build-windows.yaml
@@ -1,19 +1,4 @@
 services:
-  jdk11:
-    image: ${DOCKERHUB_ORGANISATION}/${DOCKERHUB_REPO}${SEPARATOR_LTS_PREFIX}jdk11-hotspot-${WINDOWS_FLAVOR}-${WINDOWS_VERSION}
-    build:
-      context: ./
-      dockerfile: ./windows/${WINDOWS_FLAVOR}/hotspot/Dockerfile
-      args:
-        COMMIT_SHA: ${COMMIT_SHA}
-        JAVA_HOME: "C:/openjdk-11"
-        JAVA_VERSION: 11.0.23_9
-        JENKINS_SHA: ${JENKINS_SHA}
-        JENKINS_VERSION: ${JENKINS_VERSION}
-        TOOLS_WINDOWS_VERSION: ${TOOLS_WINDOWS_VERSION}
-        WINDOWS_VERSION: ${WINDOWS_VERSION}
-      tags:
-        - ${DOCKERHUB_ORGANISATION}/${DOCKERHUB_REPO}:${JENKINS_VERSION}-jdk11-hotspot-${WINDOWS_FLAVOR}-${WINDOWS_VERSION}
   jdk17:
     image: ${DOCKERHUB_ORGANISATION}/${DOCKERHUB_REPO}${SEPARATOR_LTS_PREFIX}jdk17-hotspot-${WINDOWS_FLAVOR}-${WINDOWS_VERSION}
     build:
diff --git a/docker-bake.hcl b/docker-bake.hcl
index 7c0ce41820..dde9f33052 100644
--- a/docker-bake.hcl
+++ b/docker-bake.hcl
@@ -1,6 +1,21 @@
 # ---- groups ----
 
 group "linux" {
+  targets = [
+    "alpine_jdk17",
+    "alpine_jdk21",
+    "debian_jdk17",
+    "debian_jdk21",
+    "debian_slim_jdk17",
+    "debian_slim_jdk21",
+    "rhel_ubi9_jdk17",
+    "rhel_ubi9_jdk21",
+  ]
+}
+
+# TODO: remove when Java 11 is removed from LTS line
+# See https://github.com/jenkinsci/docker/issues/1890
+group "linux-lts-with-jdk11" {
   targets = [
     "almalinux_jdk11",
     "alpine_jdk11",
diff --git a/make.ps1 b/make.ps1
index 4c23f29c86..a8dcb87480 100644
--- a/make.ps1
+++ b/make.ps1
@@ -57,7 +57,14 @@ $env:JENKINS_SHA = $webClient.DownloadString($jenkinsShaURL).ToUpper()
 
 $env:COMMIT_SHA=$(git rev-parse HEAD)
 
-$baseDockerCmd = 'docker-compose --file=build-windows.yaml'
+# Build all images including Java 11 if the version match a LTS versioning pattern
+# TODO: remove when Java 11 is removed from LTS line
+# See https://github.com/jenkinsci/docker/issues/1890
+$dockerComposeFile = 'build-windows.yaml'
+if ($JenkinsVersion -match '^\d+\.\d+\.\d+$') {
+    $dockerComposeFile = 'build-windows-lts-with-jdk11.yaml'
+}
+$baseDockerCmd = 'docker-compose --file={0}' -f $dockerComposeFile
 $baseDockerBuildCmd = '{0} build --parallel --pull' -f $baseDockerCmd
 
 Write-Host "= PREPARE: List of $Organisation/$Repository images and tags to be processed:"