9.x has to go to BC-TLS 2.1 as the 1.0 version isn't certified for use with Java 21. But, that's something I had punted to post-9.0 because I'd like to get FIPS acceptance tests in place before making that sort of change.