diff --git a/.github/workflows/maven-ci.yml b/.github/workflows/maven-ci.yml
index 62eb42191c..aed2703ab8 100644
--- a/.github/workflows/maven-ci.yml
+++ b/.github/workflows/maven-ci.yml
@@ -21,6 +21,9 @@ on:
       - 'log.extension/**'
       - 'examples/**'
       - 'configadmin/**'
+      # a change to the workflow itself must rebuild, otherwise a CI change
+      # cannot be verified by CI
+      - '.github/workflows/**'
   pull_request:
     branches: [ "master", "feature/**", "maintenance/**" ]
     paths:
@@ -41,6 +44,9 @@ on:
       - 'log.extension/**'
       - 'examples/**'
       - 'configadmin/**'
+      # a change to the workflow itself must rebuild, otherwise a CI change
+      # cannot be verified by CI
+      - '.github/workflows/**'
 
 # Cancel superseded runs when a branch is pushed again. github.head_ref is only set
 # for pull_request events, so pushes to master fall back to the unique run_id and are
@@ -57,7 +63,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        java: [17,21,23,25]
+        java: [17,21,23,25,26,27]
     steps:
     - uses: actions/checkout@v7
     - name: Set up JDK ${{ matrix.java }}
@@ -89,6 +95,8 @@ jobs:
             - 'log/**'
           framework:
             - 'framework/**'
+            # so that a workflow change is actually exercised by a build
+            - '.github/workflows/**'
             - 'framework.tck/**'
           gogo:
             - 'gogo/**'