diff --git a/.github/workflows/agents-release.yml b/.github/workflows/agents-release.yml
index 0fc101c9d8..a2700199d5 100644
--- a/.github/workflows/agents-release.yml
+++ b/.github/workflows/agents-release.yml
@@ -214,7 +214,7 @@ jobs:
         include:
           - jre-key: "21"
             java-version: "21"
-            modules: "java.base,java.sql,java.sql.rowset,java.naming,java.management,java.desktop,java.security.jgss,java.security.sasl,jdk.security.auth,jdk.security.jgss,jdk.charsets,jdk.unsupported,java.scripting,java.compiler"
+            modules: "java.base,java.sql,java.sql.rowset,java.naming,java.management,java.desktop,java.security.jgss,java.security.sasl,jdk.security.auth,jdk.security.jgss,jdk.charsets,jdk.unsupported,java.scripting,java.compiler,jdk.crypto.ec"
     steps:
       - uses: actions/setup-java@v4
         with:
@@ -236,6 +236,7 @@ jobs:
             ["macos-aarch64"]="mac/aarch64"
             ["macos-x64"]="mac/x64"
             ["linux-aarch64"]="linux/aarch64"
+            ["windows-aarch64"]="windows/aarch64"
             ["windows-x64"]="windows/x64"
           )
           for platform in "${!PLATFORMS[@]}"; do
@@ -453,7 +454,7 @@ jobs:
           {
             "jres": {
               "21": {
-                "version": "21.0.12+kerberos.1",
+                "version": "21.0.12+kerberos.ec.2",
                 "platforms": {
           ${JRE21_PLATFORMS}
                 }
diff --git a/agents/scripts/driver_release_packages_test.py b/agents/scripts/driver_release_packages_test.py
index 2a5a6ffd7e..498d408651 100644
--- a/agents/scripts/driver_release_packages_test.py
+++ b/agents/scripts/driver_release_packages_test.py
@@ -78,25 +78,35 @@ class DriverReleasePackagesTest(unittest.TestCase):
                     {"url": versioned_native.name, "size": versioned_native.stat().st_size},
                 )
 
-    def test_full_offline_bundle_includes_versioned_native_artifact(self) -> None:
+    def test_full_offline_bundle_includes_supported_windows_artifacts(self) -> None:
         with tempfile.TemporaryDirectory() as temp_dir:
             release_dir = Path(temp_dir)
             filename = "dbx-agent-kingbase-0.1.34-windows-x64.exe"
+            kafka_filename = "dbx-agent-kafka-0.1.0.jar"
             (release_dir / filename).write_bytes(b"MZtest-agent")
+            (release_dir / kafka_filename).write_bytes(b"test-kafka-agent")
             (release_dir / "dbx-jre-21-windows-x64.tar.gz").write_bytes(b"test-jre")
+            (release_dir / "dbx-jre-21-windows-aarch64.tar.gz").write_bytes(b"test-jre")
             (release_dir / "agent-registry.json").write_text('{"jres":{},"drivers":{}}', encoding="utf-8")
 
-            subprocess.run(
+            result = subprocess.run(
                 ["bash", str(Path(__file__).with_name("build_offline_zip.sh")), str(release_dir)],
                 check=True,
                 capture_output=True,
                 text=True,
             )
 
-            bundle = release_dir / "dbx-agents-offline-windows-x64.zip"
-            self.assertTrue(bundle.is_file())
-            with zipfile.ZipFile(bundle) as archive:
+            self.assertNotIn("SKIP windows-aarch64", result.stdout)
+            x64_bundle = release_dir / "dbx-agents-offline-windows-x64.zip"
+            arm64_bundle = release_dir / "dbx-agents-offline-windows-aarch64.zip"
+            self.assertTrue(x64_bundle.is_file())
+            self.assertTrue(arm64_bundle.is_file())
+            with zipfile.ZipFile(x64_bundle) as archive:
                 self.assertIn(f"drivers/{filename}", archive.namelist())
+                self.assertIn(f"drivers/{kafka_filename}", archive.namelist())
+            with zipfile.ZipFile(arm64_bundle) as archive:
+                self.assertIn("jre/dbx-jre-21-windows-aarch64.tar.gz", archive.namelist())
+                self.assertIn(f"drivers/{kafka_filename}", archive.namelist())
 
 
 if __name__ == "__main__":
diff --git a/agents/scripts/validate_agents.py b/agents/scripts/validate_agents.py
index 830a25a93b..3df80e844f 100644
--- a/agents/scripts/validate_agents.py
+++ b/agents/scripts/validate_agents.py
@@ -245,6 +245,14 @@ def validate_release_runtime_keys(root: Path) -> list[str]:
             r"jdk\.security\.jgss",
             "release workflow JRE must include jdk.security.jgss for Kafka GSSAPI SASL support",
         ),
+        (
+            r"jdk\.crypto\.ec",
+            "release workflow JRE must include jdk.crypto.ec for Kafka EC TLS support",
+        ),
+        (
+            r'\["windows-aarch64"\]\s*=\s*"windows/aarch64"',
+            "release workflow must build the managed JRE for windows-aarch64",
+        ),
         (
             r"legacy-placeholder\.jar",
             "native-only registry entries must publish a legacy jar placeholder for older DBX clients",
diff --git a/agents/scripts/validate_agents_test.py b/agents/scripts/validate_agents_test.py
index e3c3101946..9608d644f8 100644
--- a/agents/scripts/validate_agents_test.py
+++ b/agents/scripts/validate_agents_test.py
@@ -319,7 +319,10 @@ class ValidateAgentsTest(unittest.TestCase):
                         include:
                           - jre-key: "21"
                             java-version: "21"
-                            modules: "java.base,jdk.security.auth,jdk.security.jgss"
+                            modules: "java.base,jdk.security.auth,jdk.security.jgss,jdk.crypto.ec"
+                    declare -A PLATFORMS=(
+                      ["windows-aarch64"]="windows/aarch64"
+                    )
                     detect_jre_key() {
                       case "$name" in
                         *) echo "21" ;;
@@ -376,6 +379,8 @@ class ValidateAgentsTest(unittest.TestCase):
                     "registry must publish Java 21 under JRE key 21",
                     "release workflow JRE must include jdk.security.auth for Kafka Kerberos LoginModule support",
                     "release workflow JRE must include jdk.security.jgss for Kafka GSSAPI SASL support",
+                    "release workflow JRE must include jdk.crypto.ec for Kafka EC TLS support",
+                    "release workflow must build the managed JRE for windows-aarch64",
                     "native-only registry entries must publish a legacy jar placeholder for older DBX clients",
                     "release workflow must not build Java 21 under JRE key 17",
                     "agents must not use JRE key 17",
diff --git a/crates/dbx-core/src/agent_service.rs b/crates/dbx-core/src/agent_service.rs
index be07f8cefe..f77e1a3945 100644
--- a/crates/dbx-core/src/agent_service.rs
+++ b/crates/dbx-core/src/agent_service.rs
@@ -2067,6 +2067,19 @@ mod agent_registry_install_tests {
         AgentRegistry { jre: None, jres: std::collections::HashMap::new(), drivers }
     }
 
+    fn registry_with_jre_version(version: &str) -> AgentRegistry {
+        AgentRegistry {
+            jre: None,
+            jres: [(
+                DEFAULT_JRE_KEY.to_string(),
+                JreInfo { version: version.to_string(), platforms: std::collections::HashMap::new() },
+            )]
+            .into_iter()
+            .collect(),
+            drivers: std::collections::HashMap::new(),
+        }
+    }
+
     fn write_cached_driver_download(
         am: &AgentManager,
         db_type: &str,
@@ -2082,6 +2095,25 @@ mod agent_registry_install_tests {
         cache_path
     }
 
+    #[test]
+    fn managed_jre_content_revision_triggers_install() {
+        let manager = test_manager("jre-content-revision");
+        let java_path = manager.jre_java_path(DEFAULT_JRE_KEY);
+        std::fs::create_dir_all(java_path.parent().unwrap()).unwrap();
+        std::fs::write(&java_path, b"java").unwrap();
+
+        let mut state = crate::agent_manager::AgentState::default();
+        state.jre_versions.insert(DEFAULT_JRE_KEY.to_string(), "21.0.12+kerberos.1".to_string());
+        manager.save_state(&state).unwrap();
+
+        let registry = registry_with_jre_version("21.0.12+kerberos.ec.2");
+        assert!(jre_needs_install(&manager, &registry, DEFAULT_JRE_KEY));
+
+        state.jre_versions.insert(DEFAULT_JRE_KEY.to_string(), "21.0.12+kerberos.ec.2".to_string());
+        manager.save_state(&state).unwrap();
+        assert!(!jre_needs_install(&manager, &registry, DEFAULT_JRE_KEY));
+    }
+
     fn registry_with_jre(jre_key: &str, version: &str, url: &str, size: u64) -> AgentRegistry {
         AgentRegistry {
             jre: None,