diff --git a/.github/workflows/ci-actions.yml b/.github/workflows/ci-actions.yml
index 51f837a2e..0173079a6 100644
--- a/.github/workflows/ci-actions.yml
+++ b/.github/workflows/ci-actions.yml
@@ -65,7 +65,7 @@ jobs:
 
     services:
       keycloak:
-        image: quay.io/keycloak/keycloak:8.0.1
+        image: quay.io/keycloak/keycloak:9.0.0
         env:
           KEYCLOAK_USER: admin
           KEYCLOAK_PASSWORD: admin
@@ -426,7 +426,7 @@ jobs:
               -server -Xms64m -Xmx512m -XX:MetaspaceSize=96M \
               -XX:MaxMetaspaceSize=256m -Djava.net.preferIPv4Stack=true -Djava.awt.headless=true \
               -Dkeycloak.profile.feature.upload_scripts=enabled" \
-            -d quay.io/keycloak/keycloak:8.0.1
+            -d quay.io/keycloak/keycloak:9.0.0
         if: matrix.keycloak
       - uses: actions/checkout@v2
       - name: Set up JDK 8
diff --git a/bom/runtime/pom.xml b/bom/runtime/pom.xml
index 2af33db69..cb87d4a95 100644
--- a/bom/runtime/pom.xml
+++ b/bom/runtime/pom.xml
@@ -179,7 +179,7 @@
         <jna.version>5.3.1</jna.version>
         <antlr.version>4.7.2</antlr.version>
         <quarkus-security.version>1.0.1.Final</quarkus-security.version>
-        <keycloak.version>8.0.1</keycloak.version>
+        <keycloak.version>9.0.0</keycloak.version>
         <logstash-gelf.version>1.14.0</logstash-gelf.version>
         <jsch.version>0.1.55</jsch.version>
         <jzlib.version>1.1.1</jzlib.version>
diff --git a/build-parent/pom.xml b/build-parent/pom.xml
index 305cde107..4d7fcfa79 100644
--- a/build-parent/pom.xml
+++ b/build-parent/pom.xml
@@ -78,8 +78,9 @@
         <wagon-provider-api.version>3.3.3</wagon-provider-api.version>
 
         <!-- The image to use for tests that run Keycloak -->
-        <!-- IMPORTANT: If this is changed you must also update native-build-steps.yaml to match the version -->
-        <keycloak.docker.image>quay.io/keycloak/keycloak:8.0.1</keycloak.docker.image>
+        <!-- IMPORTANT: If this is changed you must also update
+             native-build-steps.yaml, jvm-build-steps.yaml and .github/workflows/ci-actions.yml to match the version -->
+        <keycloak.docker.image>quay.io/keycloak/keycloak:9.0.0</keycloak.docker.image>
 
         <unboundid-ldap.version>4.0.13</unboundid-ldap.version>
 
diff --git a/ci-templates/jvm-build-steps.yaml b/ci-templates/jvm-build-steps.yaml
index 74fc8e466..85ec232bb 100644
--- a/ci-templates/jvm-build-steps.yaml
+++ b/ci-templates/jvm-build-steps.yaml
@@ -30,7 +30,7 @@ steps:
 - script: docker run --rm --publish 3308:3306 --name build-mariadb  -e MYSQL_USER=hibernate_orm_test -e MYSQL_PASSWORD=hibernate_orm_test -e MYSQL_DATABASE=hibernate_orm_test -e MYSQL_RANDOM_ROOT_PASSWORD=true -d mariadb:10.4
   displayName: 'start mariadb'
 
-- script: docker run --rm --publish 8180:8080 --name build-keycloak  -e KEYCLOAK_USER=admin -e KEYCLOAK_PASSWORD=admin -e JAVA_OPTS="-server -Xms64m -Xmx512m -XX:MetaspaceSize=96M -XX:MaxMetaspaceSize=256m -Djava.net.preferIPv4Stack=true -Djava.awt.headless=true -Dkeycloak.profile.feature.upload_scripts=enabled" -d quay.io/keycloak/keycloak:8.0.1
+- script: docker run --rm --publish 8180:8080 --name build-keycloak  -e KEYCLOAK_USER=admin -e KEYCLOAK_PASSWORD=admin -e JAVA_OPTS="-server -Xms64m -Xmx512m -XX:MetaspaceSize=96M -XX:MaxMetaspaceSize=256m -Djava.net.preferIPv4Stack=true -Djava.awt.headless=true -Dkeycloak.profile.feature.upload_scripts=enabled" -d quay.io/keycloak/keycloak:9.0.0
   displayName: 'start keycloak'
 
 - script: docker run --rm --publish 1433:1433 --name build-mssql -e ACCEPT_EULA=Y -e SA_PASSWORD=ActuallyRequired11Complexity -d microsoft/mssql-server-linux:2017-CU12
diff --git a/ci-templates/native-build-steps.yaml b/ci-templates/native-build-steps.yaml
index 46867d716..657f77d78 100644
--- a/ci-templates/native-build-steps.yaml
+++ b/ci-templates/native-build-steps.yaml
@@ -38,7 +38,7 @@ jobs:
       - script: docker run --rm --publish 8000:8000 --name build-dynamodb -d amazon/dynamodb-local:1.11.477
         displayName: 'start dynamodb'
     - ${{ if eq(parameters.keycloak, 'true') }}:
-        - script: docker run --rm --publish 8180:8080 --name build-keycloak  -e KEYCLOAK_USER=admin -e KEYCLOAK_PASSWORD=admin -e JAVA_OPTS="-server -Xms64m -Xmx512m -XX:MetaspaceSize=96M -XX:MaxMetaspaceSize=256m -Djava.net.preferIPv4Stack=true -Djava.awt.headless=true -Dkeycloak.profile.feature.upload_scripts=enabled" -d quay.io/keycloak/keycloak:8.0.1
+        - script: docker run --rm --publish 8180:8080 --name build-keycloak  -e KEYCLOAK_USER=admin -e KEYCLOAK_PASSWORD=admin -e JAVA_OPTS="-server -Xms64m -Xmx512m -XX:MetaspaceSize=96M -XX:MaxMetaspaceSize=256m -Djava.net.preferIPv4Stack=true -Djava.awt.headless=true -Dkeycloak.profile.feature.upload_scripts=enabled" -d quay.io/keycloak/keycloak:9.0.0
           displayName: 'start keycloak'
     - ${{ if eq(parameters.neo4j, 'true') }}:
         - script: docker run --rm --publish 7687:7687 --name build-neo4j -e NEO4J_AUTH=neo4j/secret -e NEO4J_dbms_memory_pagecache_size=10M -e NEO4J_dbms_memory_heap_initial__size=10M -d neo4j/neo4j-experimental:4.0.0-rc01