diff --git a/HACKING.adoc b/HACKING.adoc
index 877546e479..da6937cfc5 100644
--- a/HACKING.adoc
+++ b/HACKING.adoc
@@ -101,11 +101,11 @@ Create a new dedicated target repository in your Docker Hub account, and use it
 
 [source,bash]
 --
-export DOCKERHUB_ORGANISATION=batmat
-export DOCKERHUB_REPO=test-jenkins
+export DOCKERHUB_ORGANISATION=markewaite
+export DOCKERHUB_REPO=experiments
 # The log below will help confirm this override was taken in account:
-./publish.sh
+.ci/publish.sh
 Docker repository in Use:
-* JENKINS_REPO: batmat/test-jenkins
+* JENKINS_REPO: markewaite/experiments
 ...
 --
diff --git a/Jenkinsfile b/Jenkinsfile
index d8290e6e3b..1a6f72922c 100644
--- a/Jenkinsfile
+++ b/Jenkinsfile
@@ -11,8 +11,8 @@ H 6,21 * * 3''')])
 
 properties(listOfProperties)
 
-// Default environment variable set to allow images publication
-def envVars = ['PUBLISH=true']
+// Only publish images from trusted.ci.jenkins.io
+def envVars = ['PUBLISH=' + env.JENKINS_URL.startsWith('https://trusted.ci.jenkins.io')]
 
 // Set to true in a replay to simulate a LTS build on ci.jenkins.io
 // It will set the environment variables needed for a LTS
@@ -21,10 +21,9 @@ def SIMULATE_LTS_BUILD = false
 
 if (SIMULATE_LTS_BUILD) {
     envVars = [
-        'PUBLISH=false',
-        'TAG_NAME=2.462.3',
-        'JENKINS_VERSION=2.462.3',
-        'JENKINS_SHA=3e53b52a816405e3b10ad07f1c48cd0cb5cb3f893207ef7f9de28415806b93c1'
+        'TAG_NAME=2.516.1',
+        'JENKINS_VERSION=2.516.1',
+        'JENKINS_SHA=c308a27e81f4ce3aa6787e96caf771534f7f206fefbb83969d77b15fc7f2700a'
     ]
 }
 
diff --git a/alpine/hotspot/Dockerfile b/alpine/hotspot/Dockerfile
index 9acab8110e..43b162f120 100644
--- a/alpine/hotspot/Dockerfile
+++ b/alpine/hotspot/Dockerfile
@@ -90,13 +90,13 @@ RUN mkdir -p ${REF}/init.groovy.d
 
 # jenkins version being bundled in this docker image
 ARG JENKINS_VERSION
-ENV JENKINS_VERSION=${JENKINS_VERSION:-2.504}
+ENV JENKINS_VERSION=${JENKINS_VERSION:-2.516.1}
 
 # jenkins.war checksum, download will be validated using it
-ARG JENKINS_SHA=efc91d6be8d79dd078e7f930fc4a5f135602d0822a5efe9091808fdd74607d32
+ARG JENKINS_SHA=c308a27e81f4ce3aa6787e96caf771534f7f206fefbb83969d77b15fc7f2700a
 
 # Can be used to customize where jenkins.war get downloaded from
-ARG JENKINS_URL=https://repo.jenkins-ci.org/public/org/jenkins-ci/main/jenkins-war/${JENKINS_VERSION}/jenkins-war-${JENKINS_VERSION}.war
+ARG JENKINS_URL
 
 # could use ADD but this one does not check Last-Modified header neither does it allow to control checksum
 # see https://github.com/docker/docker/issues/8331
diff --git a/build-windows.yaml b/build-windows.yaml
index 82a9440ce2..58e3885879 100644
--- a/build-windows.yaml
+++ b/build-windows.yaml
@@ -9,6 +9,7 @@ services:
         JAVA_HOME: "C:/openjdk-17"
         JAVA_VERSION: 17.0.16_8
         JENKINS_SHA: ${JENKINS_SHA}
+        JENKINS_URL: ${JENKINS_URL}
         JENKINS_VERSION: ${JENKINS_VERSION}
         TOOLS_WINDOWS_VERSION: ${TOOLS_WINDOWS_VERSION}
         WINDOWS_VERSION: ${WINDOWS_VERSION}
@@ -24,6 +25,7 @@ services:
         JAVA_HOME: "C:/openjdk-21"
         JAVA_VERSION: 21.0.8_9
         JENKINS_SHA: ${JENKINS_SHA}
+        JENKINS_URL: ${JENKINS_URL}
         JENKINS_VERSION: ${JENKINS_VERSION}
         TOOLS_WINDOWS_VERSION: ${TOOLS_WINDOWS_VERSION}
         WINDOWS_VERSION: ${WINDOWS_VERSION}
diff --git a/debian/bookworm-slim/hotspot/Dockerfile b/debian/bookworm-slim/hotspot/Dockerfile
index 2bd990aa6d..adc9f3b75f 100644
--- a/debian/bookworm-slim/hotspot/Dockerfile
+++ b/debian/bookworm-slim/hotspot/Dockerfile
@@ -101,13 +101,13 @@ RUN mkdir -p ${REF}/init.groovy.d
 
 # jenkins version being bundled in this docker image
 ARG JENKINS_VERSION
-ENV JENKINS_VERSION=${JENKINS_VERSION:-2.504}
+ENV JENKINS_VERSION=${JENKINS_VERSION:-2.516.1}
 
 # jenkins.war checksum, download will be validated using it
-ARG JENKINS_SHA=efc91d6be8d79dd078e7f930fc4a5f135602d0822a5efe9091808fdd74607d32
+ARG JENKINS_SHA=c308a27e81f4ce3aa6787e96caf771534f7f206fefbb83969d77b15fc7f2700a
 
 # Can be used to customize where jenkins.war get downloaded from
-ARG JENKINS_URL=https://repo.jenkins-ci.org/public/org/jenkins-ci/main/jenkins-war/${JENKINS_VERSION}/jenkins-war-${JENKINS_VERSION}.war
+ARG JENKINS_URL
 
 # could use ADD but this one does not check Last-Modified header neither does it allow to control checksum
 # see https://github.com/docker/docker/issues/8331
diff --git a/debian/bookworm/hotspot/Dockerfile b/debian/bookworm/hotspot/Dockerfile
index 73456e2530..690cac6400 100644
--- a/debian/bookworm/hotspot/Dockerfile
+++ b/debian/bookworm/hotspot/Dockerfile
@@ -101,13 +101,13 @@ RUN mkdir -p ${REF}/init.groovy.d
 
 # jenkins version being bundled in this docker image
 ARG JENKINS_VERSION
-ENV JENKINS_VERSION=${JENKINS_VERSION:-2.504}
+ENV JENKINS_VERSION=${JENKINS_VERSION:-2.516.1}
 
 # jenkins.war checksum, download will be validated using it
-ARG JENKINS_SHA=efc91d6be8d79dd078e7f930fc4a5f135602d0822a5efe9091808fdd74607d32
+ARG JENKINS_SHA=c308a27e81f4ce3aa6787e96caf771534f7f206fefbb83969d77b15fc7f2700a
 
 # Can be used to customize where jenkins.war get downloaded from
-ARG JENKINS_URL=https://repo.jenkins-ci.org/public/org/jenkins-ci/main/jenkins-war/${JENKINS_VERSION}/jenkins-war-${JENKINS_VERSION}.war
+ARG JENKINS_URL
 
 # could use ADD but this one does not check Last-Modified header neither does it allow to control checksum
 # see https://github.com/docker/docker/issues/8331
diff --git a/docker-bake.hcl b/docker-bake.hcl
index fe1ff41fea..83582c3ce2 100644
--- a/docker-bake.hcl
+++ b/docker-bake.hcl
@@ -43,11 +43,11 @@ group "linux-ppc64le" {
 # ---- variables ----
 
 variable "JENKINS_VERSION" {
-  default = "2.504"
+  default = "2.516.1"
 }
 
 variable "JENKINS_SHA" {
-  default = "efc91d6be8d79dd078e7f930fc4a5f135602d0822a5efe9091808fdd74607d32"
+  default = "c308a27e81f4ce3aa6787e96caf771534f7f206fefbb83969d77b15fc7f2700a"
 }
 
 variable "REGISTRY" {
@@ -94,6 +94,12 @@ variable "BOOKWORM_TAG" {
   default = "20250721"
 }
 
+variable "JENKINS_URL" { }
+
+variable "PUBLISH" {
+  default = "false"
+}
+
 # ----  user-defined functions ----
 
 # return a tag prefixed by the Jenkins version
@@ -120,6 +126,22 @@ function "tag_lts" {
   result = equal(LATEST_LTS, "true") ? tag(prepend_jenkins_version, tag) : ""
 }
 
+# return release line based on Jenkins version
+function "release_line" {
+  # If there is more than one sequence of digits with a trailing literal '.', this is LTS
+  # 2.523 has only one sequence of digits with a trailing literal '.'
+  # 2.516.1 has two sequences of digits with a trailing literal '.'
+  # https://developer.hashicorp.com/terraform/language/functions/regexall describes the technique
+  params = []
+  result = length(regexall("[0-9]+[.]", JENKINS_VERSION)) < 2 ? "war" : "war-stable"
+}
+
+# return Jenkins URL based on Jenkins version and release line
+function "jenkins_url" {
+  params = []
+  result = equal("true",PUBLISH) ? "https://repo.jenkins-ci.org/releases/org/jenkins-ci/main/jenkins-war/${JENKINS_VERSION}/jenkins-war-${JENKINS_VERSION}.war" : "https://get.jenkins.io/${release_line()}/${JENKINS_VERSION}/jenkins.war"
+}
+
 # ---- targets ----
 
 target "alpine_jdk17" {
@@ -132,6 +154,7 @@ target "alpine_jdk17" {
     PLUGIN_CLI_VERSION = PLUGIN_CLI_VERSION
     ALPINE_TAG         = ALPINE_FULL_TAG
     JAVA_VERSION       = JAVA17_VERSION
+    JENKINS_URL        = jenkins_url()
   }
   tags = [
     tag(true, "alpine-jdk17"),
@@ -152,6 +175,7 @@ target "alpine_jdk21" {
     PLUGIN_CLI_VERSION = PLUGIN_CLI_VERSION
     ALPINE_TAG         = ALPINE_FULL_TAG
     JAVA_VERSION       = JAVA21_VERSION
+    JENKINS_URL        = jenkins_url()
   }
   tags = [
     tag(true, "alpine"),
@@ -176,6 +200,7 @@ target "debian_jdk17" {
     PLUGIN_CLI_VERSION = PLUGIN_CLI_VERSION
     BOOKWORM_TAG       = BOOKWORM_TAG
     JAVA_VERSION       = JAVA17_VERSION
+    JENKINS_URL        = jenkins_url()
   }
   tags = [
     tag(true, "jdk17"),
@@ -197,6 +222,7 @@ target "debian_jdk21" {
     PLUGIN_CLI_VERSION = PLUGIN_CLI_VERSION
     BOOKWORM_TAG       = BOOKWORM_TAG
     JAVA_VERSION       = JAVA21_VERSION
+    JENKINS_URL        = jenkins_url()
   }
   tags = [
     tag(true, ""),
@@ -222,6 +248,7 @@ target "debian_slim_jdk17" {
     PLUGIN_CLI_VERSION = PLUGIN_CLI_VERSION
     BOOKWORM_TAG       = BOOKWORM_TAG
     JAVA_VERSION       = JAVA17_VERSION
+    JENKINS_URL        = jenkins_url()
   }
   tags = [
     tag(true, "slim-jdk17"),
@@ -241,6 +268,7 @@ target "debian_slim_jdk21" {
     PLUGIN_CLI_VERSION = PLUGIN_CLI_VERSION
     BOOKWORM_TAG       = BOOKWORM_TAG
     JAVA_VERSION       = JAVA21_VERSION
+    JENKINS_URL        = jenkins_url()
   }
   tags = [
     tag(true, "slim"),
@@ -263,6 +291,7 @@ target "rhel_ubi9_jdk17" {
     COMMIT_SHA         = COMMIT_SHA
     PLUGIN_CLI_VERSION = PLUGIN_CLI_VERSION
     JAVA_VERSION       = JAVA17_VERSION
+    JENKINS_URL        = jenkins_url()
   }
   tags = [
     tag(true, "rhel-ubi9-jdk17"),
@@ -282,6 +311,7 @@ target "rhel_ubi9_jdk21" {
     COMMIT_SHA         = COMMIT_SHA
     PLUGIN_CLI_VERSION = PLUGIN_CLI_VERSION
     JAVA_VERSION       = JAVA21_VERSION
+    JENKINS_URL        = jenkins_url()
   }
   tags = [
     tag(true, "rhel-ubi9-jdk21"),
diff --git a/jenkins.war b/jenkins.war
new file mode 100644
index 0000000000..c7eb50f8d4
Binary files /dev/null and b/jenkins.war differ
diff --git a/make.ps1 b/make.ps1
index 4fe83dcfd0..09004abc9b 100644
--- a/make.ps1
+++ b/make.ps1
@@ -2,7 +2,7 @@
 Param(
     [Parameter(Position=1)]
     [String] $Target = 'build',
-    [String] $JenkinsVersion = '2.504',
+    [String] $JenkinsVersion = '2.516.1',
     [switch] $DryRun = $false
 )
 
@@ -57,8 +57,24 @@ $env:JENKINS_SHA = $webClient.DownloadString($jenkinsShaURL).ToUpper()
 
 $env:COMMIT_SHA=$(git rev-parse HEAD)
 
+# Set JENKINS_URL build argument and JENKINS_URL environment variable
+$JenkinsURL = ''
+if($env:PUBLISH -eq $true -or $DryRun -eq $true) {
+    $JenkinsURL = 'https://repo.jenkins-ci.org/releases/org/jenkins-ci/main/jenkins-war/' + $JenkinsVersion + '/jenkins-war-' + $JenkinsVersion + '.war'
+} else {
+    # Not publishing - use mirrors
+    $ReleaseLine = 'war'
+    if([regex]::Matches($JenkinsVersion, "[0-9]+[.]").count -gt 1) {
+        # Building the LTS version
+        $ReleaseLine = 'war-stable'
+    }
+    $JenkinsURL = 'https://get.jenkins.io/' + $ReleaseLine + '/' + $JenkinsVersion + '/jenkins.war'
+}
+$JenkinsURLArg = '--build-arg JENKINS_URL=' + $JenkinsURL
+$env:JENKINS_URL = "$JenkinsURL"
+
 $baseDockerCmd = 'docker-compose --file=build-windows.yaml'
-$baseDockerBuildCmd = '{0} build --parallel --pull' -f $baseDockerCmd
+$baseDockerBuildCmd = '{0} build --parallel --pull {1}' -f $baseDockerCmd, $JenkinsURLArg
 
 Write-Host "= PREPARE: List of $Organisation/$Repository images and tags to be processed:"
 Invoke-Expression "$baseDockerCmd config"
diff --git a/rhel/ubi9/hotspot/Dockerfile b/rhel/ubi9/hotspot/Dockerfile
index c66222c637..6704ac0db4 100644
--- a/rhel/ubi9/hotspot/Dockerfile
+++ b/rhel/ubi9/hotspot/Dockerfile
@@ -92,13 +92,13 @@ RUN curl -fsSL "https://github.com/krallin/tini/releases/download/${TINI_VERSION
 
 # jenkins version being bundled in this docker image
 ARG JENKINS_VERSION
-ENV JENKINS_VERSION=${JENKINS_VERSION:-2.504}
+ENV JENKINS_VERSION=${JENKINS_VERSION:-2.516.1}
 
 # jenkins.war checksum, download will be validated using it
-ARG JENKINS_SHA=efc91d6be8d79dd078e7f930fc4a5f135602d0822a5efe9091808fdd74607d32
+ARG JENKINS_SHA=c308a27e81f4ce3aa6787e96caf771534f7f206fefbb83969d77b15fc7f2700a
 
 # Can be used to customize where jenkins.war get downloaded from
-ARG JENKINS_URL=https://repo.jenkins-ci.org/public/org/jenkins-ci/main/jenkins-war/${JENKINS_VERSION}/jenkins-war-${JENKINS_VERSION}.war
+ARG JENKINS_URL
 
 # could use ADD but this one does not check Last-Modified header neither does it allow to control checksum
 # see https://github.com/docker/docker/issues/8331
diff --git a/tests/test_helpers.psm1 b/tests/test_helpers.psm1
index be418d20f2..167a491cbe 100644
--- a/tests/test_helpers.psm1
+++ b/tests/test_helpers.psm1
@@ -105,7 +105,7 @@ function Run-Program($cmd, $params, $verbose=$false) {
 }
 
 function Build-Docker($tag) {
-    $exitCode, $stdout, $stderr = Run-Program 'docker-compose' '--file=build-windows.yaml build --parallel'
+    $exitCode, $stdout, $stderr = Run-Program 'docker-compose' '--file=build-windows.yaml build --parallel --build-arg JENKINS_URL=' + $env:JENKINS_URL
     if($exitCode -ne 0) {
         return $exitCode, $stdout, $stderr
     }
diff --git a/windows/windowsservercore/hotspot/Dockerfile b/windows/windowsservercore/hotspot/Dockerfile
index 8e4bc338aa..947066d108 100644
--- a/windows/windowsservercore/hotspot/Dockerfile
+++ b/windows/windowsservercore/hotspot/Dockerfile
@@ -94,13 +94,13 @@ RUN New-Item -ItemType Directory -Force -Path C:/ProgramData/Jenkins/Reference/i
 
 # jenkins version being bundled in this docker image
 ARG JENKINS_VERSION
-ENV JENKINS_VERSION=${JENKINS_VERSION:-2.504}
+ENV JENKINS_VERSION=${JENKINS_VERSION:-2.516.1}
 
 # jenkins.war checksum, download will be validated using it
-ARG JENKINS_SHA=efc91d6be8d79dd078e7f930fc4a5f135602d0822a5efe9091808fdd74607d32
+ARG JENKINS_SHA=c308a27e81f4ce3aa6787e96caf771534f7f206fefbb83969d77b15fc7f2700a
 
 # Can be used to customize where jenkins.war get downloaded from
-ARG JENKINS_URL=https://repo.jenkins-ci.org/public/org/jenkins-ci/main/jenkins-war/${JENKINS_VERSION}/jenkins-war-${JENKINS_VERSION}.war
+ARG JENKINS_URL
 
 # could use ADD but this one does not check Last-Modified header neither does it allow to control checksum
 # see https://github.com/docker/docker/issues/8331