diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9f8d0d1a95..99e566b32d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -159,7 +159,7 @@ jobs:
   # archive.apache.org mirror does not consume the docker-build job budget.
   plugins-download-archives:
     runs-on: ubuntu-24.04
-    timeout-minutes: 120
+    timeout-minutes: 90
     steps:
       - uses: actions/checkout@v6
 
diff --git a/dev-support/ranger-docker/.env b/dev-support/ranger-docker/.env
index be842585a5..8ca362eabe 100644
--- a/dev-support/ranger-docker/.env
+++ b/dev-support/ranger-docker/.env
@@ -75,11 +75,12 @@ ORACLE_VERSION=23.6
 SQLSERVER_VERSION=2022-latest
 
 # Ozone Configuration
-OZONE_VERSION=1.4.0
+# Align runtime with Ranger plugin compile target (pom.xml ozone.version=2.1.0)
+OZONE_VERSION=2.1.0
 OZONE_PLUGIN_VERSION=3.0.0-SNAPSHOT
 OZONE_RUNNER_IMAGE=apache/ozone-runner
-# JDK 17 runner for Ranger 3.0 / Ozone 1.4; 20241108-jdk17-1 has arm64+amd64 (20241022-jdk17-1 is amd64-only).
-OZONE_RUNNER_VERSION=20241108-jdk17-1
+# Ozone 2.0+ requires jdk21 runner (jdk11/jdk17 tags are for Ozone 1.x). Multi-arch arm64+amd64.
+OZONE_RUNNER_VERSION=20260106-1-jdk21
 
 # Trino Configuration
 TRINO_VERSION=latest
diff --git a/dev-support/ranger-docker/Dockerfile.ranger-ozone b/dev-support/ranger-docker/Dockerfile.ranger-ozone
index 68aa796b63..0e435e1f5d 100644
--- a/dev-support/ranger-docker/Dockerfile.ranger-ozone
+++ b/dev-support/ranger-docker/Dockerfile.ranger-ozone
@@ -15,8 +15,8 @@
 # limitations under the License.
 
 ARG OZONE_RUNNER_IMAGE=apache/ozone-runner
-# Keep in sync with .env; 20241108-jdk17-1 is multi-arch (arm64+amd64), 20241022-jdk17-1 is amd64-only.
-ARG OZONE_RUNNER_VERSION=20241108-jdk17-1
+# Keep in sync with .env; Ozone 2.0+ needs jdk21 runner (20260106-1-jdk21 is multi-arch arm64+amd64).
+ARG OZONE_RUNNER_VERSION=20260106-1-jdk21
 FROM ${OZONE_RUNNER_IMAGE}:${OZONE_RUNNER_VERSION}
 
 ARG OZONE_HOME
diff --git a/dev-support/ranger-docker/docker-compose.ranger-ozone.yml b/dev-support/ranger-docker/docker-compose.ranger-ozone.yml
index 2d6c001695..3de2916748 100644
--- a/dev-support/ranger-docker/docker-compose.ranger-ozone.yml
+++ b/dev-support/ranger-docker/docker-compose.ranger-ozone.yml
@@ -9,7 +9,7 @@ services:
       - ranger
     ports:
       - 9864
-    command: ["/opt/hadoop/bin/ozone","datanode"]
+    command: bash -c "sudo mkdir -p /data/hdds /data/metadata && sudo chown -R hadoop:hadoop /data && exec /opt/hadoop/bin/ozone datanode"
     env_file:
       - ./scripts/ozone/docker-config
   om:
@@ -42,14 +42,14 @@ services:
       ranger-solr:
         condition: service_started
     environment:
-      ENSURE_OM_INITIALIZED: /data/metadata/om/current/VERSION
       OZONE_OPTS: -XX:-UseContainerSupport -Dcom.sun.net.ssl.checkRevocation=false
       OZONE_HOME: /opt/hadoop
       OZONE_PLUGIN_VERSION: ${OZONE_PLUGIN_VERSION}
       OZONE_VERSION: ${OZONE_VERSION}
     env_file:
       - ./scripts/ozone/docker-config
-    command: bash -c "/opt/hadoop/ranger-ozone-plugin/ranger-ozone-setup.sh && /opt/hadoop/bin/ozone om"
+    # Ozone 2.1 entrypoint init uses obsolete -createObjectStore fallback; use --init explicitly.
+    command: bash -c "/opt/hadoop/ranger-ozone-plugin/ranger-ozone-setup.sh && (test -f /data/metadata/om/current/VERSION || /opt/hadoop/bin/ozone om --init) && exec /opt/hadoop/bin/ozone om"
   scm:
     image: ${OZONE_RUNNER_IMAGE}:${OZONE_RUNNER_VERSION}
     container_name: ozone-scm
@@ -64,9 +64,8 @@ services:
     env_file:
       - ./scripts/ozone/docker-config
     environment:
-      ENSURE_SCM_INITIALIZED: /data/metadata/scm/current/VERSION
       OZONE-SITE.XML_hdds.scm.safemode.min.datanode: "${OZONE_SAFEMODE_MIN_DATANODES:-1}"
-    command: ["/opt/hadoop/bin/ozone","scm"]
+    command: bash -c "(test -f /data/metadata/scm/current/VERSION || /opt/hadoop/bin/ozone scm --init) && exec /opt/hadoop/bin/ozone scm"
 
 networks:
   ranger:
diff --git a/distro/src/main/assembly/plugin-ozone.xml b/distro/src/main/assembly/plugin-ozone.xml
index aba01db6e0..8aaead673f 100644
--- a/distro/src/main/assembly/plugin-ozone.xml
+++ b/distro/src/main/assembly/plugin-ozone.xml
@@ -108,6 +108,7 @@
                     <include>joda-time:joda-time</include>
                     <include>com.carrotsearch:hppc</include>
                     <include>io.airlift:aircompressor:jar:${aircompressor.version}</include>
+                    <include>javax.annotation:javax.annotation-api:jar:${javax.annotation-api.version}</include>
                     <include>javax.inject:javax.inject</include>
                     <include>javax.ws.rs:javax.ws.rs-api</include>
                     <include>org.apache.hadoop.thirdparty:hadoop-shaded-guava:jar:${hadoop-shaded-guava.version}</include>
diff --git a/plugin-ozone/pom.xml b/plugin-ozone/pom.xml
index dba7e4e5c3..d2fcc6e092 100644
--- a/plugin-ozone/pom.xml
+++ b/plugin-ozone/pom.xml
@@ -148,6 +148,12 @@ limitations under the License.
                 </exclusion>
             </exclusions>
         </dependency>
+        <dependency>
+            <groupId>javax.annotation</groupId>
+            <artifactId>javax.annotation-api</artifactId>
+            <version>${javax.annotation-api.version}</version>
+            <scope>runtime</scope>
+        </dependency>
         <dependency>
             <groupId>javax.inject</groupId>
             <artifactId>javax.inject</artifactId>