diff --git a/.github/workflows/pull-request-check.yml b/.github/workflows/pull-request-check.yml
index fc741019e..7f7c9e069 100644
--- a/.github/workflows/pull-request-check.yml
+++ b/.github/workflows/pull-request-check.yml
@@ -62,6 +62,19 @@ jobs:
           mvn -B verify -Pnative -Dmaven.wagon.httpconnectionManager.ttlSeconds=60
         shell: bash
 
+      - name: Switch to Temurin JDK
+        uses: actions/setup-java@v3
+        with:
+          distribution: 'temurin'
+          java-version: '17'
+          overwrite-settings: false
+
+      - name: Test executable jar on Temurin
+        if: matrix.os == 'ubuntu-20.04'
+        run: |
+          cd tools/samm-cli
+          mvn -B -Denforcer.skip -Dskip.maven.surefire failsafe:integration-test -Dmaven.wagon.httpconnectionManager.ttlSeconds=60
+
       - name: Upload executable jar
         # We only need one OS job to upload the jar
         if: matrix.os == 'ubuntu-20.04'
diff --git a/.github/workflows/release-workflow.yml b/.github/workflows/release-workflow.yml
index cbb0896a8..9e973fe1c 100644
--- a/.github/workflows/release-workflow.yml
+++ b/.github/workflows/release-workflow.yml
@@ -113,6 +113,18 @@ jobs:
         env:
           PGP_KEY_PASSWORD: ${{ secrets.PGP_KEY_PASSWORD }}
 
+      - name: Switch to Temurin JDK
+        uses: actions/setup-java@v3
+        with:
+          distribution: 'temurin'
+          java-version: '17'
+          overwrite-settings: false
+
+      - name: Test executable jar on Temurin
+        run: |
+          cd tools/samm-cli
+          mvn -B -Denforcer.skip -Dskip.maven.surefire failsafe:integration-test -Dmaven.wagon.httpconnectionManager.ttlSeconds=60
+
       - name: Upload staging directory and Linux binary
         uses: actions/upload-artifact@v3
         with:
diff --git a/core/esmf-aspect-model-aas-generator/pom.xml b/core/esmf-aspect-model-aas-generator/pom.xml
index b0634b4b9..dc308f1b2 100644
--- a/core/esmf-aspect-model-aas-generator/pom.xml
+++ b/core/esmf-aspect-model-aas-generator/pom.xml
@@ -57,10 +57,5 @@
          <artifactId>assertj-core</artifactId>
          <scope>test</scope>
       </dependency>
-      <dependency>
-         <groupId>junit</groupId>
-         <artifactId>junit</artifactId>
-         <scope>test</scope>
-      </dependency>
    </dependencies>
 </project>
diff --git a/core/esmf-aspect-model-validator/pom.xml b/core/esmf-aspect-model-validator/pom.xml
index b41801e89..e94a6bbab 100644
--- a/core/esmf-aspect-model-validator/pom.xml
+++ b/core/esmf-aspect-model-validator/pom.xml
@@ -51,7 +51,6 @@
       <dependency>
          <groupId>org.graalvm.js</groupId>
          <artifactId>js</artifactId>
-         <scope>runtime</scope>
       </dependency>
       <dependency>
          <groupId>org.projectlombok</groupId>
diff --git a/pom.xml b/pom.xml
index 1e9fc65f0..730d868e5 100644
--- a/pom.xml
+++ b/pom.xml
@@ -182,7 +182,6 @@
             <groupId>org.eclipse.esmf</groupId>
             <artifactId>esmf-aspect-model-aas-generator</artifactId>
             <version>${project.version}</version>
-            <scope>compile</scope>
          </dependency>
 
          <!-- Third party dependencies -->
@@ -195,35 +194,48 @@
             <scope>import</scope>
          </dependency>
 
-         <dependency>
-            <groupId>org.hibernate.validator</groupId>
-            <artifactId>hibernate-validator</artifactId>
-            <version>${hibernate-validator-version}</version>
-         </dependency>
          <dependency>
             <groupId>org.apache.poi</groupId>
             <artifactId>poi</artifactId>
             <version>${poi-version}</version>
          </dependency>
-         <dependency>
-            <groupId>org.graphper</groupId>
-            <artifactId>graph-support</artifactId>
-            <version>${graph-support-version}</version>
-         </dependency>
-         <dependency>
-            <groupId>org.graalvm.truffle</groupId>
-            <artifactId>truffle-api</artifactId>
-            <version>${graalvm-version}</version>
-         </dependency>
          <dependency>
             <groupId>org.graalvm.js</groupId>
             <artifactId>js</artifactId>
             <version>${graalvm-version}</version>
          </dependency>
-
       </dependencies>
    </dependencyManagement>
 
+   <dependencies>
+      <!-- Overrides due to CVEs -->
+      <dependency>
+         <groupId>org.apache.maven.shared</groupId>
+         <artifactId>maven-shared-utils</artifactId>
+         <version>[3.3.3,)</version>
+      </dependency>
+      <dependency>
+         <groupId>org.yaml</groupId>
+         <artifactId>snakeyaml</artifactId>
+         <version>[2.0,)</version>
+      </dependency>
+      <dependency>
+         <groupId>org.apache.commons</groupId>
+         <artifactId>commons-compress</artifactId>
+         <version>[1.21,)</version>
+      </dependency>
+      <dependency>
+         <groupId>commons-io</groupId>
+         <artifactId>commons-io</artifactId>
+         <version>[2.7,)</version>
+      </dependency>
+      <dependency>
+         <groupId>org.codehaus.plexus</groupId>
+         <artifactId>plexus-archiver</artifactId>
+         <version>[4.8.0,)</version>
+      </dependency>
+   </dependencies>
+
    <build>
       <plugins>
          <plugin>
diff --git a/tools/esmf-aspect-model-maven-plugin/pom.xml b/tools/esmf-aspect-model-maven-plugin/pom.xml
index d75188adf..3f6d0e7d9 100644
--- a/tools/esmf-aspect-model-maven-plugin/pom.xml
+++ b/tools/esmf-aspect-model-maven-plugin/pom.xml
@@ -60,14 +60,20 @@
       <dependency>
          <groupId>org.apache.maven.plugin-testing</groupId>
          <artifactId>maven-plugin-testing-harness</artifactId>
-         <scope>test</scope>
          <version>${maven-plugin-testing-harness-version}</version>
+         <scope>test</scope>
       </dependency>
       <dependency>
          <groupId>org.assertj</groupId>
          <artifactId>assertj-core</artifactId>
          <scope>test</scope>
       </dependency>
+      <!-- Maven plugin testing has a transitive dependency on Junit 4, but does not declare it explictly -->
+      <dependency>
+         <groupId>junit</groupId>
+         <artifactId>junit</artifactId>
+         <scope>test</scope>
+      </dependency>
    </dependencies>
 
    <build>
diff --git a/tools/samm-cli/pom.xml b/tools/samm-cli/pom.xml
index 8ece14c9a..91bc920d7 100644
--- a/tools/samm-cli/pom.xml
+++ b/tools/samm-cli/pom.xml
@@ -32,6 +32,9 @@
       <main-class>org.eclipse.esmf.SammCli</main-class>
       <binary-name>samm</binary-name>
       <graalvm-config-path>${project.build.directory}/classes/META-INF/native-image/${project.groupId}/${project.artifactId}</graalvm-config-path>
+      <!-- The separate jar that is built without GraalVM-internal dependencies which trip up the GraalVM compiler,
+           which is exclusive used to pass on to native-image -->
+      <native-image-jar>${project.artifactId}-${project.version}-for-native</native-image-jar>
       <skip.maven.surefire>false</skip.maven.surefire>
       <skip.maven.surefire.report.plugin>false</skip.maven.surefire.report.plugin>
       <skip.maven.shade>false</skip.maven.shade>
@@ -67,33 +70,20 @@
          <groupId>org.graalvm.nativeimage</groupId>
          <artifactId>svm</artifactId>
          <scope>provided</scope>
-         <exclusions>
-            <!-- Exclude transitive dependency for truffle-api because it has runtime scope. We need to add it with provided scope. -->
-            <exclusion>
-               <groupId>org.graalvm-truffle</groupId>
-               <artifactId>truffle-api</artifactId>
-            </exclusion>
-         </exclusions>
       </dependency>
       <dependency>
-         <groupId>org.graalvm.truffle</groupId>
-         <artifactId>truffle-api</artifactId>
-         <scope>provided</scope>
+         <groupId>org.graalvm.sdk</groupId>
+         <artifactId>graal-sdk</artifactId>
+         <version>${graalvm-version}</version>
       </dependency>
       <dependency>
          <groupId>org.graalvm.js</groupId>
          <artifactId>js</artifactId>
-         <scope>runtime</scope>
-         <exclusions>
-            <exclusion>
-               <groupId>org.graalvm.truffle</groupId>
-               <artifactId>truffle-api</artifactId>
-            </exclusion>
-            <exclusion>
-               <groupId>org.graalvm.sdk</groupId>
-               <artifactId>graal-sdk</artifactId>
-            </exclusion>
-         </exclusions>
+      </dependency>
+      <dependency>
+         <groupId>org.graalvm.js</groupId>
+         <artifactId>js-scriptengine</artifactId>
+         <version>${graalvm-version}</version>
       </dependency>
 
       <!-- Test dependencies -->
@@ -226,7 +216,7 @@
                   <configuration>
                      <!-- The main class of your build-time scanning code -->
                      <mainClass>org.eclipse.esmf.buildtime.Aas4jClassSetup</mainClass>
-                     <!-- Pass the build target file as a commandline param -->
+                     <!-- Pass the properties file as a commandline param -->
                      <commandlineArgs>${project.build.outputDirectory}/adminshell.properties</commandlineArgs>
                      <cleanupDaemonThreads>false</cleanupDaemonThreads>
                   </configuration>
@@ -255,12 +245,13 @@
             <artifactId>maven-shade-plugin</artifactId>
             <executions>
                <execution>
-                  <id>default-shade</id>
+                  <id>shade-for-native-image</id>
                   <phase>package</phase>
                   <goals>
                      <goal>shade</goal>
                   </goals>
                   <configuration>
+                     <finalName>${native-image-jar}</finalName>
                      <createDependencyReducedPom>false</createDependencyReducedPom>
                      <skip>${skip.maven.shade}</skip>
                      <transformers>
@@ -352,6 +343,100 @@
                      </filters>
                   </configuration>
                </execution>
+               <execution>
+                  <id>default-shade</id>
+                  <phase>package</phase>
+                  <goals>
+                     <goal>shade</goal>
+                  </goals>
+                  <configuration>
+                     <createDependencyReducedPom>false</createDependencyReducedPom>
+                     <skip>${skip.maven.shade}</skip>
+                     <transformers>
+                        <transformer implementation="org.apache.maven.plugins.shade.resource.ManifestResourceTransformer">
+                           <manifestEntries>
+                              <Main-Class>${main-class}</Main-Class>
+                           </manifestEntries>
+                        </transformer>
+                        <transformer implementation="org.apache.maven.plugins.shade.resource.ServicesResourceTransformer"/>
+                     </transformers>
+                     <artifactSet>
+                        <excludes>
+                           <!-- Exclude meta model dependency, because meta model resources are already contained in the
+                                meta model resolver package -->
+                           <exclude>org.eclipse.esmf:esmf-semantic-aspect-meta-model</exclude>
+                           <!-- Duplicate annotations that are already contained in javax.annotation-api -->
+                           <exclude>javax.annotation:jsr250-api</exclude>
+                        </excludes>
+                     </artifactSet>
+                     <filters>
+                        <!-- Required to prevent overlapping resources -->
+                        <filter>
+                           <artifact>*:*</artifact>
+                           <excludes>
+                              <exclude>module-info.class</exclude>
+                              <exclude>META-INF/*</exclude>
+                              <exclude>META-INF/sisu/javax.inject.Named</exclude>
+                              <exclude>META-INF/plexus/components.xml</exclude>
+                              <exclude>META-INF.versions*/**</exclude>
+                              <exclude>META-INF/versions*/**</exclude>
+                              <exclude>META-INF/maven/**</exclude>
+                              <exclude>plugin.xml</exclude>
+                              <exclude>about.html</exclude>
+                           </excludes>
+                        </filter>
+                        <!-- Required to override the excludes above -->
+                        <filter>
+                           <artifact>${project.groupId}:${project.artifactId}</artifact>
+                           <excludeDefaults>false</excludeDefaults>
+                           <includes>
+                              <include>**</include>
+                              <include>META-INF/**</include>
+                              <include>git.properties</include>
+                           </includes>
+                           <excludes>
+                              <!-- Explicitly exclude build-time-only code from jar -->
+                              <exclude>org/eclipse/esmf/buildtime/**</exclude>
+                           </excludes>
+                        </filter>
+                        <!-- Clashes with the files from xml-apis-ext -->
+                        <filter>
+                           <artifact>xml-apis:xml-apis</artifact>
+                           <excludes>
+                              <exclude>license/**</exclude>
+                           </excludes>
+                        </filter>
+                        <!-- Clashes with the same file from batik-rasterizer -->
+                        <filter>
+                           <artifact>org.apache.xmlgraphics:batik-svgrasterizer</artifact>
+                           <excludes>
+                              <exclude>org/apache/batik/apps/rasterizer/resources/rasterizer.policy</exclude>
+                           </excludes>
+                        </filter>
+                        <!-- These configs add lots of spurious GraalVM configuration -->
+                        <filter>
+                           <artifact>org.jboss.forge.roaster:roaster-jdt</artifact>
+                           <excludes>
+                              <exclude>META-INF/native-image/**</exclude>
+                           </excludes>
+                        </filter>
+                        <!-- Required to have Model Instantiators available -->
+                        <filter>
+                           <artifact>org.eclipse.esmf:esmf-aspect-meta-model-java</artifact>
+                           <includes>
+                              <include>**</include>
+                           </includes>
+                        </filter>
+                        <!-- Prevent overlapping classes from javax modules -->
+                        <filter>
+                           <artifact>jakarta.activation:jakarta.activation-api</artifact>
+                           <excludes>
+                              <exclude>**</exclude>
+                           </excludes>
+                        </filter>
+                     </filters>
+                  </configuration>
+               </execution>
             </executions>
          </plugin>
 
@@ -455,18 +540,18 @@
             </configuration>
          </plugin>
 
-         <!-- for testing of the command executor, we need a test JAR file -->
          <plugin>
             <groupId>org.apache.maven.plugins</groupId>
             <artifactId>maven-jar-plugin</artifactId>
             <executions>
+               <!-- For testing of the command executor, we need a test JAR file -->
                <execution>
                   <id>build-test-jar</id>
                   <goals>
                      <goal>test-jar</goal>
                   </goals>
                   <!-- Make sure the plugin is built before maven surefire runs -->
-                  <phase>pre-test</phase>
+                  <phase>process-test-classes</phase>
                   <configuration>
                      <archive>
                         <manifest>
@@ -557,7 +642,7 @@
                      </buildArgs>
                      <quickBuild>true</quickBuild>
                      <classpath>
-                        <param>${project.build.directory}/${project.artifactId}-${project.version}.jar</param>
+                        <param>${project.build.directory}/${native-image-jar}.jar</param>
                      </classpath>
                   </configuration>
                </plugin>