diff --git a/java/testdata/java21_debian12.yaml b/java/testdata/java21_debian12.yaml
index 593247a70..de4ad6698 100644
--- a/java/testdata/java21_debian12.yaml
+++ b/java/testdata/java21_debian12.yaml
@@ -3,11 +3,11 @@ commandTests:
   - name: java
     command: "/usr/lib/jvm/temurin21_jre_amd64/bin/java"
     args: ["-version"]
-    expectedError: ['openjdk version "21.0.2"']
+    expectedError: ['openjdk version "21.0.4"']
   - name: java-symlink
     command: "/usr/bin/java"
     args: ["-version"]
-    expectedError: ['openjdk version "21.0.2"']
+    expectedError: ['openjdk version "21.0.4"']
 fileExistenceTests:
   - name: certs
     path: "/etc/ssl/certs/java/cacerts"
@@ -36,4 +36,4 @@ fileExistenceTests:
 metadataTest:
   envVars:
     - key: 'JAVA_VERSION'
-      value: '21.0.2'
+      value: '21.0.4'
diff --git a/java/testdata/java21_debug_debian12.yaml b/java/testdata/java21_debug_debian12.yaml
index 5b45f3934..ca8e8d56a 100644
--- a/java/testdata/java21_debug_debian12.yaml
+++ b/java/testdata/java21_debug_debian12.yaml
@@ -3,15 +3,15 @@ commandTests:
   - name: java
     command: "/usr/lib/jvm/temurin21_jdk_amd64/bin/java"
     args: ["-version"]
-    expectedError: ['openjdk version "21.0.2"']
+    expectedError: ['openjdk version "21.0.4"']
   - name: java-symlink
     command: "/usr/bin/java"
     args: ["-version"]
-    expectedError: ['openjdk version "21.0.2"']
+    expectedError: ['openjdk version "21.0.4"']
   - name: javac
     command: "/usr/lib/jvm/temurin21_jdk_amd64/bin/javac"
     args: ["-version"]
-    expectedOutput: ['javac 21.0.2']
+    expectedOutput: ['javac 21.0.4']
 fileExistenceTests:
   - name: certs
     path: "/etc/ssl/certs/java/cacerts"
@@ -29,4 +29,4 @@ fileExistenceTests:
 metadataTest:
   envVars:
    - key: 'JAVA_VERSION'
-     value: '21.0.2'
+     value: '21.0.4'
diff --git a/java_archives.bzl b/java_archives.bzl
index ef456ddd9..4ecce6b30 100644
--- a/java_archives.bzl
+++ b/java_archives.bzl
@@ -1,76 +1,69 @@
 "repositories for java"
 
-# TODO: this should be auto generated by a script
-
 load("//private/remote:temurin_archive.bzl", "temurin_archive")
 
 JAVA_RELEASE_VERSIONS = {
-    "temurin21_jre_amd64": "21.0.2",
-    "temurin21_jdk_amd64": "21.0.2",
-    "temurin21_jre_arm64": "21.0.2",
-    "temurin21_jdk_arm64": "21.0.2",
-    "temurin21_jre_ppc64le": "21.0.2",
-    "temurin21_jdk_ppc64le": "21.0.2",
+    "temurin21_jre_amd64": "21.0.4",
+    "temurin21_jdk_amd64": "21.0.4",
+    "temurin21_jre_arm64": "21.0.4",
+    "temurin21_jdk_arm64": "21.0.4",
+    "temurin21_jre_ppc64le": "21.0.4",
+    "temurin21_jdk_ppc64le": "21.0.4",
 }
 
 def repositories():
     "java archives"
     temurin_archive(
         name = "temurin21_jre_amd64",
-        sha256 = "51141204fe01a9f9dd74eab621d5eca7511eac67315c9975dbde5f2625bdca55",
-        strip_prefix = "jdk-21.0.2+13-jre",
-        urls = ["https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.2%2B13/OpenJDK21U-jre_x64_linux_hotspot_21.0.2_13.tar.gz"],
-        version = "21.0.2+13",
+        sha256 = "d3affbb011ca6c722948f6345d15eba09bded33f9947d4d67e09723e2518c12a",
+        strip_prefix = "jdk-21.0.4+7-jre",
+        urls = ["https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.4%2B7/OpenJDK21U-jre_x64_linux_hotspot_21.0.4_7.tar.gz"],
+        version = "21.0.4+7",
         architecture = "amd64",
         control = "//java:control",
     )
-
     temurin_archive(
         name = "temurin21_jdk_amd64",
-        sha256 = "454bebb2c9fe48d981341461ffb6bf1017c7b7c6e15c6b0c29b959194ba3aaa5",
-        strip_prefix = "jdk-21.0.2+13",
-        urls = ["https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.2%2B13/OpenJDK21U-jdk_x64_linux_hotspot_21.0.2_13.tar.gz"],
-        version = "21.0.2+13",
+        sha256 = "51fb4d03a4429c39d397d3a03a779077159317616550e4e71624c9843083e7b9",
+        strip_prefix = "jdk-21.0.4+7",
+        urls = ["https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.4%2B7/OpenJDK21U-jdk_x64_linux_hotspot_21.0.4_7.tar.gz"],
+        version = "21.0.4+7",
         architecture = "amd64",
         control = "//java:control",
     )
-
     temurin_archive(
         name = "temurin21_jre_arm64",
-        sha256 = "64c78854184c92a4da5cda571c8e357043bfaf03a03434eef58550cc3410d8a4",
-        strip_prefix = "jdk-21.0.2+13-jre",
-        urls = ["https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.2%2B13/OpenJDK21U-jre_aarch64_linux_hotspot_21.0.2_13.tar.gz"],
-        version = "21.0.2+13",
+        sha256 = "58845ce4275f3ec74fba075597c8216bb201773da036c4703be8b7b7b457355d",
+        strip_prefix = "jdk-21.0.4+7-jre",
+        urls = ["https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.4%2B7/OpenJDK21U-jre_aarch64_linux_hotspot_21.0.4_7.tar.gz"],
+        version = "21.0.4+7",
         architecture = "arm64",
         control = "//java:control",
     )
-
     temurin_archive(
         name = "temurin21_jdk_arm64",
-        sha256 = "3ce6a2b357e2ef45fd6b53d6587aa05bfec7771e7fb982f2c964f6b771b7526a",
-        strip_prefix = "jdk-21.0.2+13",
-        urls = ["https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.2%2B13/OpenJDK21U-jdk_aarch64_linux_hotspot_21.0.2_13.tar.gz"],
-        version = "21.0.2+13",
+        sha256 = "d768eecddd7a515711659e02caef8516b7b7177fa34880a56398fd9822593a79",
+        strip_prefix = "jdk-21.0.4+7",
+        urls = ["https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.4%2B7/OpenJDK21U-jdk_aarch64_linux_hotspot_21.0.4_7.tar.gz"],
+        version = "21.0.4+7",
         architecture = "arm64",
         control = "//java:control",
     )
-
     temurin_archive(
         name = "temurin21_jre_ppc64le",
-        sha256 = "caaf48e50787b80b810dc08ee91bd4ffe0d0696bd14906a92f05bf8c14aabb22",
-        strip_prefix = "jdk-21.0.2+13-jre",
-        urls = ["https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.2%2B13/OpenJDK21U-jre_ppc64le_linux_hotspot_21.0.2_13.tar.gz"],
-        version = "21.0.2+13",
+        sha256 = "46cf93653e2b553fb1c91760cfe2ff20999ba358d648d2df69e5948784768440",
+        strip_prefix = "jdk-21.0.4+7-jre",
+        urls = ["https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.4%2B7/OpenJDK21U-jre_ppc64le_linux_hotspot_21.0.4_7.tar.gz"],
+        version = "21.0.4+7",
         architecture = "ppc64le",
         control = "//java:control",
     )
-
     temurin_archive(
         name = "temurin21_jdk_ppc64le",
-        sha256 = "d08de863499d8851811c893e8915828f2cd8eb67ed9e29432a6b4e222d80a12f",
-        strip_prefix = "jdk-21.0.2+13",
-        urls = ["https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.2%2B13/OpenJDK21U-jdk_ppc64le_linux_hotspot_21.0.2_13.tar.gz"],
-        version = "21.0.2+13",
+        sha256 = "c208cd0fb90560644a90f928667d2f53bfe408c957a5e36206585ad874427761",
+        strip_prefix = "jdk-21.0.4+7",
+        urls = ["https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.4%2B7/OpenJDK21U-jdk_ppc64le_linux_hotspot_21.0.4_7.tar.gz"],
+        version = "21.0.4+7",
         architecture = "ppc64le",
         control = "//java:control",
     )
diff --git a/knife b/knife
index 733f37ce4..fb221c24a 100755
--- a/knife
+++ b/knife
@@ -128,6 +128,14 @@ function cmd_lint () {
     buildifier -mode=fix $(find . -name 'BUILD*' -o -name 'WORKSPACE*' -o -name '*.bzl' -type f)
 }
 
+function cmd_update_java_archives () {
+    source scripts/update_java_archives.sh
+    old_version=$(get_version)
+    generate_java_archives > java_archives.bzl
+    new_version=$(get_version)
+    update_test_versions_java21 $old_version $new_version
+}
+
 function cmd_test () {
     echo "🧪 Testing"
     echo ""
@@ -160,6 +168,9 @@ github-update-snapshots)
 test)
     cmd_test
     ;;
+update-java-archives)
+    cmd_update_java_archives
+    ;;
 ~~nocmd) # no command provided
     echo "provide a command: lock, update-snapshots, github-update-snapshots, test"
     exit 1
diff --git a/scripts/update_java_archives.sh b/scripts/update_java_archives.sh
new file mode 100644
index 000000000..6ec98480d
--- /dev/null
+++ b/scripts/update_java_archives.sh
@@ -0,0 +1,99 @@
+set -o pipefail -o errexit -o nounset
+
+# Copyright 2024 Google Inc. All rights reserved.
+
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+
+#     http://www.apache.org/licenses/LICENSE-2.0
+
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# a collection of functions to use when updating java archives from the knife utility
+
+function get_version() {
+  grep "temurin21_jre_amd64\":" ./java_archives.bzl | cut -d":" -f2 | sed 's/[ ,"]//g'
+}
+
+function underscore_encode() {
+  echo "${1/\+/_}"
+}
+
+function generate_java_archives() {
+  local releases latest_release release_name version plain_version archs archs_deb variants
+
+  releases=$(curl -sSL https://api.github.com/repos/adoptium/temurin21-binaries/releases)
+  latest_release=$(echo "$releases" | jq -r 'map(select(.name | test("jdk-([0-9.]+)(\\+([0-9]+))?"))) | sort_by(.published_at) | last')
+  release_name=$(echo "$latest_release" | jq -r '.name')
+  version=${release_name#jdk-}
+  plain_version=$([[ $version =~ ^[0-9]+\.[0-9]+\.[0-9]+ ]] && echo "${BASH_REMATCH[0]}")
+  archs=("x64" "aarch64" "ppc64le")
+  archs_deb=("amd64" "arm64" "ppc64le")
+  variants=("jre" "jdk")
+
+cat << EOM
+"repositories for java"
+
+load("//private/remote:temurin_archive.bzl", "temurin_archive")
+
+JAVA_RELEASE_VERSIONS = {
+    "temurin21_jre_amd64": "${plain_version}",
+    "temurin21_jdk_amd64": "${plain_version}",
+    "temurin21_jre_arm64": "${plain_version}",
+    "temurin21_jdk_arm64": "${plain_version}",
+    "temurin21_jre_ppc64le": "${plain_version}",
+    "temurin21_jdk_ppc64le": "${plain_version}",
+}
+
+def repositories():
+    "java archives"
+EOM
+
+  for arch_index in "${!archs[@]}"; do
+    for variant in "${variants[@]}"; do
+      local arch arch_deb name archive_url sha256_name sha256_url sha256 strip_prefix_suffix
+
+      arch=${archs[arch_index]}
+      arch_deb=${archs_deb[arch_index]}
+      name="OpenJDK21U-${variant}_${arch}_linux_hotspot_$(underscore_encode "${version}").tar.gz"
+      archive_url=$(echo "$latest_release" | jq -r --arg NAME "$name" '.assets.[] | select(.name==$NAME) | .browser_download_url')
+      [ "$archive_url" ] || { echo "no url found for ${name}"; exit 1; }
+      sha256_name="${name}.sha256.txt"
+      sha256_url=$(echo "$latest_release" | jq -r --arg NAME "$sha256_name" '.assets.[] | select(.name==$NAME) | .browser_download_url')
+      [ "$sha256_url" ] || { echo "no url found for ${sha256_name}"; exit 1; }
+      sha256=$(curl -sSL "$sha256_url" | cut -d' '  -f1)
+      [ "$sha256" ] || { echo "no sha256 downloaded for ${name}"; exit 1; }
+
+      strip_prefix_suffix="-jre"
+      if [[ ${variant} == "jdk" ]]; then
+        strip_prefix_suffix=""
+      fi
+
+cat << EOM
+    temurin_archive(
+        name = "temurin21_${variant}_${arch_deb}",
+        sha256 = "${sha256}",
+        strip_prefix = "${release_name}${strip_prefix_suffix}",
+        urls = ["${archive_url}"],
+        version = "${version}",
+        architecture = "${arch_deb}",
+        control = "//java:control",
+    )
+EOM
+
+    done
+  done
+}
+
+function update_test_versions_java21() {
+  [ "$1" ] || { echo "no old version set in param 1"; exit 1; }
+  [ "$2" ] || { echo "no new version set in param 2"; exit 1; }
+  old_version=$1
+  new_version=$2
+  sed -i -e "s/$old_version/$new_version/g" java/testdata/java21_*
+}