diff --git a/common/src/main/java/org/keycloak/common/util/Encode.java b/common/src/main/java/org/keycloak/common/util/Encode.java
index 73b8702553..488508bfb1 100755
--- a/common/src/main/java/org/keycloak/common/util/Encode.java
+++ b/common/src/main/java/org/keycloak/common/util/Encode.java
@@ -86,7 +86,11 @@ public class Encode
             case '@':
                continue;
          }
-         pathEncoding[i] = URLEncoder.encode(String.valueOf((char) i));
+         try {
+            pathEncoding[i] = URLEncoder.encode(String.valueOf((char) i), UTF_8);
+         } catch (UnsupportedEncodingException e) {
+            throw new RuntimeException(e);
+         }
       }
       pathEncoding[' '] = "%20";
       System.arraycopy(pathEncoding, 0, matrixParameterEncoding, 0, pathEncoding.length);
@@ -119,7 +123,11 @@ public class Encode
                queryNameValueEncoding[i] = "+";
                continue;
          }
-         queryNameValueEncoding[i] = URLEncoder.encode(String.valueOf((char) i));
+         try {
+            queryNameValueEncoding[i] = URLEncoder.encode(String.valueOf((char) i), UTF_8);
+         } catch (UnsupportedEncodingException e) {
+            throw new RuntimeException(e);
+         }
       }
 
       /*
@@ -157,7 +165,11 @@ public class Encode
                queryStringEncoding[i] = "%20";
                continue;
          }
-         queryStringEncoding[i] = URLEncoder.encode(String.valueOf((char) i));
+         try {
+            queryStringEncoding[i] = URLEncoder.encode(String.valueOf((char) i), UTF_8);
+         } catch (UnsupportedEncodingException e) {
+            throw new RuntimeException(e);
+         }
       }
 
      /*
diff --git a/common/src/main/java/org/keycloak/common/util/reflections/Reflections.java b/common/src/main/java/org/keycloak/common/util/reflections/Reflections.java
index 000793f1f9..1ff98e9be2 100644
--- a/common/src/main/java/org/keycloak/common/util/reflections/Reflections.java
+++ b/common/src/main/java/org/keycloak/common/util/reflections/Reflections.java
@@ -31,7 +31,6 @@ import java.lang.reflect.ParameterizedType;
 import java.lang.reflect.Type;
 import java.lang.reflect.TypeVariable;
 import java.lang.reflect.WildcardType;
-import java.security.AccessController;
 import java.util.Arrays;
 import java.util.HashMap;
 import java.util.HashSet;
@@ -398,7 +397,7 @@ public class Reflections {
 
     /**
      * Set the accessibility flag on the {@link AccessibleObject} as described in {@link
-     * AccessibleObject#setAccessible(boolean)} within the context of a {link PrivilegedAction}.
+     * AccessibleObject#setAccessible(boolean)}.
      *
      * @param <A> member the accessible object type
      * @param member the accessible object
@@ -406,13 +405,13 @@ public class Reflections {
      * @return the accessible object after the accessible flag has been altered
      */
     public static <A extends AccessibleObject> A setAccessible(A member) {
-        AccessController.doPrivileged(new SetAccessiblePrivilegedAction(member));
+        member.setAccessible(true);
         return member;
     }
 
     /**
      * Set the accessibility flag on the {@link AccessibleObject} to false as described in {@link
-     * AccessibleObject#setAccessible(boolean)} within the context of a {link PrivilegedAction}.
+     * AccessibleObject#setAccessible(boolean)}.
      *
      * @param <A> member the accessible object type
      * @param member the accessible object
@@ -420,7 +419,7 @@ public class Reflections {
      * @return the accessible object after the accessible flag has been altered
      */
     public static <A extends AccessibleObject> A unsetAccessible(A member) {
-        AccessController.doPrivileged(new UnSetAccessiblePrivilegedAction(member));
+        member.setAccessible(false);
         return member;
     }
 
@@ -987,7 +986,9 @@ public class Reflections {
      * @throws ClassNotFoundException
      * @throws IllegalAccessException
      * @throws InstantiationException
+     * @deprecated for removal in Keycloak 27
      */
+    @Deprecated(forRemoval = true)
     public static <T> T newInstance(final Class<T> fromClass) throws ClassNotFoundException, IllegalAccessException, InstantiationException {
         return newInstance(fromClass, fromClass.getName());
     }
@@ -1005,7 +1006,9 @@ public class Reflections {
      * @throws ClassNotFoundException
      * @throws IllegalAccessException
      * @throws InstantiationException
+     * @deprecated for removal in Keycloak 27
      */
+    @Deprecated(forRemoval = true)
     public static <T> T newInstance(final Class<?> type, final String fullQualifiedName) throws ClassNotFoundException, IllegalAccessException, InstantiationException {
         return (T) classForName(fullQualifiedName, type.getClassLoader()).newInstance();
     }
diff --git a/common/src/main/java/org/keycloak/common/util/reflections/SetAccessiblePrivilegedAction.java b/common/src/main/java/org/keycloak/common/util/reflections/SetAccessiblePrivilegedAction.java
index f4c8d34fa0..62ded30753 100644
--- a/common/src/main/java/org/keycloak/common/util/reflections/SetAccessiblePrivilegedAction.java
+++ b/common/src/main/java/org/keycloak/common/util/reflections/SetAccessiblePrivilegedAction.java
@@ -22,7 +22,9 @@ import java.security.PrivilegedAction;
 
 /**
  * A {@link java.security.PrivilegedAction} that calls {@link java.lang.reflect.AccessibleObject#setAccessible(boolean)}
+ * @deprecated for removal in Keycloak 27
  */
+@Deprecated(forRemoval = true)
 public class SetAccessiblePrivilegedAction implements PrivilegedAction<Void> {
 
     private final AccessibleObject member;
diff --git a/common/src/main/java/org/keycloak/common/util/reflections/UnSetAccessiblePrivilegedAction.java b/common/src/main/java/org/keycloak/common/util/reflections/UnSetAccessiblePrivilegedAction.java
index cfdb1302e4..01e7096247 100644
--- a/common/src/main/java/org/keycloak/common/util/reflections/UnSetAccessiblePrivilegedAction.java
+++ b/common/src/main/java/org/keycloak/common/util/reflections/UnSetAccessiblePrivilegedAction.java
@@ -22,7 +22,9 @@ import java.security.PrivilegedAction;
 
 /**
  * A {@link PrivilegedAction} that calls {@link AccessibleObject#setAccessible(boolean)}
+ * @deprecated for removal in Keycloak 27
  */
+@Deprecated(forRemoval = true)
 public class UnSetAccessiblePrivilegedAction implements PrivilegedAction<Void> {
 
     private final AccessibleObject member;
diff --git a/docs/documentation/upgrading/topics/changes/changes-26_0_0.adoc b/docs/documentation/upgrading/topics/changes/changes-26_0_0.adoc
index 69603ac12d..ebe3d28e32 100644
--- a/docs/documentation/upgrading/topics/changes/changes-26_0_0.adoc
+++ b/docs/documentation/upgrading/topics/changes/changes-26_0_0.adoc
@@ -24,3 +24,16 @@ The default implementation performs a single network call per an event, and it w
 = Operator's default CPU and memory limits/requests
 
 In order to follow the best practices, the default CPU and memory limits/requests for the Operator were introduced. It affects both non-OLM and OLM installs. To override the default values for the OLM install, edit the `resources` section in the operator's https://github.com/operator-framework/operator-lifecycle-manager/blob/master/doc/design/subscription-config.md#resources[subscription].
+
+= Deprecations in `keycloak-common` module
+
+The following items have been deprecated for removal in upcoming {project_name} versions with no replacement:
+
+- `org.keycloak.common.util.reflections.Reflections.newInstance(java.lang.Class<T>)`
+- `org.keycloak.common.util.reflections.Reflections.newInstance(java.lang.Class<?>, java.lang.String)`
+- `org.keycloak.common.util.reflections.SetAccessiblePrivilegedAction`
+- `org.keycloak.common.util.reflections.UnSetAccessiblePrivilegedAction`
+
+= Consistent usage of UTF-8 charset for URL encoding
+
+`org.keycloak.common.util.Encode` now always uses the `UTF-8` charset for URL encoding instead relying implicitly on the `file.encoding` system property.
diff --git a/model/jpa/src/main/java/org/keycloak/connections/jpa/updater/liquibase/LiquibaseJpaUpdaterProvider.java b/model/jpa/src/main/java/org/keycloak/connections/jpa/updater/liquibase/LiquibaseJpaUpdaterProvider.java
index 27a7a570ec..ec3e4ae24d 100755
--- a/model/jpa/src/main/java/org/keycloak/connections/jpa/updater/liquibase/LiquibaseJpaUpdaterProvider.java
+++ b/model/jpa/src/main/java/org/keycloak/connections/jpa/updater/liquibase/LiquibaseJpaUpdaterProvider.java
@@ -42,10 +42,10 @@ import liquibase.structure.core.Column;
 import liquibase.structure.core.Table;
 import liquibase.util.StreamUtil;
 import org.jboss.logging.Logger;
-import org.keycloak.common.util.reflections.Reflections;
 import org.keycloak.connections.jpa.entityprovider.JpaEntityProvider;
 import org.keycloak.connections.jpa.updater.JpaUpdaterProvider;
 import org.keycloak.connections.jpa.updater.liquibase.conn.CustomChangeLogHistoryService;
+import org.keycloak.connections.jpa.updater.liquibase.conn.KeycloakLiquibase;
 import org.keycloak.connections.jpa.updater.liquibase.conn.LiquibaseConnectionProvider;
 import org.keycloak.connections.jpa.util.JpaUtils;
 import org.keycloak.models.KeycloakSession;
@@ -101,7 +101,7 @@ public class LiquibaseJpaUpdaterProvider implements JpaUpdaterProvider {
         Writer exportWriter = null;
         try {
             // Run update with keycloak master changelog first
-            Liquibase liquibase = getLiquibaseForKeycloakUpdate(connection, defaultSchema);
+            KeycloakLiquibase liquibase = getLiquibaseForKeycloakUpdate(connection, defaultSchema);
             if (file != null) {
                 exportWriter = new FileWriter(file);
             }
@@ -133,7 +133,7 @@ public class LiquibaseJpaUpdaterProvider implements JpaUpdaterProvider {
         }
     }
 
-    protected void updateChangeSet(Liquibase liquibase, Writer exportWriter) throws LiquibaseException, SQLException {
+    protected void updateChangeSet(KeycloakLiquibase liquibase, Writer exportWriter) throws LiquibaseException, SQLException {
         String changelog = liquibase.getChangeLogFile();
         Database database = liquibase.getDatabase();
         Table changelogTable = SnapshotGeneratorFactory.getInstance().getDatabaseChangeLogTable(new SnapshotControl(database, false, Table.class, Column.class), database);
@@ -235,7 +235,7 @@ public class LiquibaseJpaUpdaterProvider implements JpaUpdaterProvider {
 
         try {
             // Validate with keycloak master changelog first
-            Liquibase liquibase = getLiquibaseForKeycloakUpdate(connection, defaultSchema);
+            KeycloakLiquibase liquibase = getLiquibaseForKeycloakUpdate(connection, defaultSchema);
 
             Status status = validateChangeSet(liquibase, liquibase.getChangeLogFile());
             if (status != Status.VALID) {
@@ -262,7 +262,7 @@ public class LiquibaseJpaUpdaterProvider implements JpaUpdaterProvider {
         return Status.VALID;
     }
 
-    protected Status validateChangeSet(Liquibase liquibase, String changelog) throws LiquibaseException {
+    protected Status validateChangeSet(KeycloakLiquibase liquibase, String changelog) throws LiquibaseException {
         final Status result;
         List<ChangeSet> changeSets = getLiquibaseUnrunChangeSets(liquibase);
 
@@ -285,10 +285,8 @@ public class LiquibaseJpaUpdaterProvider implements JpaUpdaterProvider {
         return result;
     }
 
-    private void resetLiquibaseServices(Liquibase liquibase) {
-        Method resetServices = Reflections.findDeclaredMethod(Liquibase.class, "resetServices");
-        Reflections.invokeMethod(true, resetServices, liquibase);
-
+    private void resetLiquibaseServices(KeycloakLiquibase liquibase) {
+        liquibase.resetServices();
         ChangeLogHistoryServiceFactory.getInstance().register(new CustomChangeLogHistoryService());
     }
 
@@ -296,12 +294,12 @@ public class LiquibaseJpaUpdaterProvider implements JpaUpdaterProvider {
         return liquibase.listUnrunChangeSets(null, new LabelExpression(), false);
     }
 
-    private Liquibase getLiquibaseForKeycloakUpdate(Connection connection, String defaultSchema) throws LiquibaseException {
+    private KeycloakLiquibase getLiquibaseForKeycloakUpdate(Connection connection, String defaultSchema) throws LiquibaseException {
         LiquibaseConnectionProvider liquibaseProvider = session.getProvider(LiquibaseConnectionProvider.class);
         return liquibaseProvider.getLiquibase(connection, defaultSchema);
     }
 
-    private Liquibase getLiquibaseForCustomProviderUpdate(Connection connection, String defaultSchema, String changelogLocation, ClassLoader classloader, String changelogTableName) throws LiquibaseException {
+    private KeycloakLiquibase getLiquibaseForCustomProviderUpdate(Connection connection, String defaultSchema, String changelogLocation, ClassLoader classloader, String changelogTableName) throws LiquibaseException {
         LiquibaseConnectionProvider liquibaseProvider = session.getProvider(LiquibaseConnectionProvider.class);
         return liquibaseProvider.getLiquibaseForCustomUpdate(connection, defaultSchema, changelogLocation, classloader, changelogTableName);
     }
diff --git a/model/jpa/src/main/java/org/keycloak/connections/jpa/updater/liquibase/conn/DefaultLiquibaseConnectionProvider.java b/model/jpa/src/main/java/org/keycloak/connections/jpa/updater/liquibase/conn/DefaultLiquibaseConnectionProvider.java
index 27ce972b27..69bfdaa7fd 100644
--- a/model/jpa/src/main/java/org/keycloak/connections/jpa/updater/liquibase/conn/DefaultLiquibaseConnectionProvider.java
+++ b/model/jpa/src/main/java/org/keycloak/connections/jpa/updater/liquibase/conn/DefaultLiquibaseConnectionProvider.java
@@ -17,7 +17,6 @@
 
 package org.keycloak.connections.jpa.updater.liquibase.conn;
 
-import liquibase.Liquibase;
 import liquibase.Scope;
 import liquibase.ScopeManager;
 import liquibase.ThreadLocalScopeManager;
@@ -114,7 +113,7 @@ public class DefaultLiquibaseConnectionProvider implements LiquibaseConnectionPr
     }
 
     @Override
-    public Liquibase getLiquibase(Connection connection, String defaultSchema) throws LiquibaseException {
+    public KeycloakLiquibase getLiquibase(Connection connection, String defaultSchema) throws LiquibaseException {
         Database database = DatabaseFactory.getInstance().findCorrectDatabaseImplementation(new JdbcConnection(connection));
         if (defaultSchema != null) {
             database.setDefaultSchemaName(defaultSchema);
@@ -126,11 +125,11 @@ public class DefaultLiquibaseConnectionProvider implements LiquibaseConnectionPr
         logger.debugf("Using changelog file %s and changelogTableName %s", changelog, database.getDatabaseChangeLogTableName());
 
         ((AbstractJdbcDatabase) database).set(INDEX_CREATION_THRESHOLD_PARAM, indexCreationThreshold);
-        return new Liquibase(changelog, resourceAccessor, database);
+        return new KeycloakLiquibase(changelog, resourceAccessor, database);
     }
 
     @Override
-    public Liquibase getLiquibaseForCustomUpdate(Connection connection, String defaultSchema, String changelogLocation, ClassLoader classloader, String changelogTableName) throws LiquibaseException {
+    public KeycloakLiquibase getLiquibaseForCustomUpdate(Connection connection, String defaultSchema, String changelogLocation, ClassLoader classloader, String changelogTableName) throws LiquibaseException {
         Database database = DatabaseFactory.getInstance().findCorrectDatabaseImplementation(new JdbcConnection(connection));
         if (defaultSchema != null) {
             database.setDefaultSchemaName(defaultSchema);
@@ -141,7 +140,7 @@ public class DefaultLiquibaseConnectionProvider implements LiquibaseConnectionPr
 
         logger.debugf("Using changelog file %s and changelogTableName %s", changelogLocation, database.getDatabaseChangeLogTableName());
 
-        return new Liquibase(changelogLocation, resourceAccessor, database);
+        return new KeycloakLiquibase(changelogLocation, resourceAccessor, database);
     }
 
 }
diff --git a/model/jpa/src/main/java/org/keycloak/connections/jpa/updater/liquibase/conn/KeycloakLiquibase.java b/model/jpa/src/main/java/org/keycloak/connections/jpa/updater/liquibase/conn/KeycloakLiquibase.java
new file mode 100644
index 0000000000..9c11de5d18
--- /dev/null
+++ b/model/jpa/src/main/java/org/keycloak/connections/jpa/updater/liquibase/conn/KeycloakLiquibase.java
@@ -0,0 +1,38 @@
+/*
+ * Copyright 2023 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.connections.jpa.updater.liquibase.conn;
+
+import liquibase.Liquibase;
+import liquibase.database.Database;
+import liquibase.resource.ResourceAccessor;
+
+/**
+ * Custom subclass to expose protected liquibase API.
+ */
+public class KeycloakLiquibase extends Liquibase {
+
+    public KeycloakLiquibase(String changeLogFile, ResourceAccessor resourceAccessor, Database database) {
+        super(changeLogFile, resourceAccessor, database);
+    }
+
+    @Override
+    public void resetServices() {
+        // expose protected method for use without reflection
+        super.resetServices();
+    }
+}
diff --git a/model/jpa/src/main/java/org/keycloak/connections/jpa/updater/liquibase/conn/LiquibaseConnectionProvider.java b/model/jpa/src/main/java/org/keycloak/connections/jpa/updater/liquibase/conn/LiquibaseConnectionProvider.java
index 4bfdf3614e..adc2bf00e2 100644
--- a/model/jpa/src/main/java/org/keycloak/connections/jpa/updater/liquibase/conn/LiquibaseConnectionProvider.java
+++ b/model/jpa/src/main/java/org/keycloak/connections/jpa/updater/liquibase/conn/LiquibaseConnectionProvider.java
@@ -17,7 +17,6 @@
 
 package org.keycloak.connections.jpa.updater.liquibase.conn;
 
-import liquibase.Liquibase;
 import liquibase.exception.LiquibaseException;
 import org.keycloak.provider.Provider;
 
@@ -28,8 +27,8 @@ import java.sql.Connection;
  */
 public interface LiquibaseConnectionProvider extends Provider {
 
-    Liquibase getLiquibase(Connection connection, String defaultSchema) throws LiquibaseException;
+    KeycloakLiquibase getLiquibase(Connection connection, String defaultSchema) throws LiquibaseException;
 
-    Liquibase getLiquibaseForCustomUpdate(Connection connection, String defaultSchema, String changelogLocation, ClassLoader classloader, String changelogTableName) throws LiquibaseException;
+    KeycloakLiquibase getLiquibaseForCustomUpdate(Connection connection, String defaultSchema, String changelogLocation, ClassLoader classloader, String changelogTableName) throws LiquibaseException;
 
 }
diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/storage/legacy/liquibase/QuarkusJpaUpdaterProvider.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/storage/legacy/liquibase/QuarkusJpaUpdaterProvider.java
index 762a07455e..cf2de9e501 100755
--- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/storage/legacy/liquibase/QuarkusJpaUpdaterProvider.java
+++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/storage/legacy/liquibase/QuarkusJpaUpdaterProvider.java
@@ -21,7 +21,6 @@ import java.io.File;
 import java.io.FileWriter;
 import java.io.IOException;
 import java.io.Writer;
-import java.lang.reflect.Method;
 import java.sql.Connection;
 import java.util.ArrayList;
 import java.util.HashMap;
@@ -31,12 +30,12 @@ import java.util.Set;
 
 import liquibase.Scope;
 import org.jboss.logging.Logger;
-import org.keycloak.common.util.reflections.Reflections;
 import org.keycloak.connections.jpa.entityprovider.JpaEntityProvider;
 import org.keycloak.connections.jpa.updater.JpaUpdaterProvider;
 import org.keycloak.connections.jpa.updater.liquibase.LiquibaseConstants;
 import org.keycloak.connections.jpa.updater.liquibase.ThreadLocalSessionContext;
 import org.keycloak.connections.jpa.updater.liquibase.conn.CustomChangeLogHistoryService;
+import org.keycloak.connections.jpa.updater.liquibase.conn.KeycloakLiquibase;
 import org.keycloak.connections.jpa.updater.liquibase.conn.LiquibaseConnectionProvider;
 import org.keycloak.connections.jpa.util.JpaUtils;
 import org.keycloak.models.KeycloakSession;
@@ -100,7 +99,7 @@ public class QuarkusJpaUpdaterProvider implements JpaUpdaterProvider {
         try {
             if (needVerifyMasterChangelog()) {
                 // Run update with keycloak master changelog first
-                Liquibase liquibase = getLiquibaseForKeycloakUpdate(connection, defaultSchema);
+                KeycloakLiquibase liquibase = getLiquibaseForKeycloakUpdate(connection, defaultSchema);
                 if (file != null) {
                     exportWriter = new FileWriter(file);
                 }
@@ -114,7 +113,7 @@ public class QuarkusJpaUpdaterProvider implements JpaUpdaterProvider {
                 if (customChangelog != null) {
                     String factoryId = jpaProvider.getFactoryId();
                     String changelogTableName = JpaUtils.getCustomChangelogTableName(factoryId);
-                    Liquibase liquibase = getLiquibaseForCustomProviderUpdate(connection, defaultSchema, customChangelog, jpaProvider.getClass().getClassLoader(), changelogTableName);
+                    KeycloakLiquibase liquibase = getLiquibaseForCustomProviderUpdate(connection, defaultSchema, customChangelog, jpaProvider.getClass().getClassLoader(), changelogTableName);
                     updateChangeSet(liquibase, exportWriter);
                 }
             }
@@ -136,7 +135,7 @@ public class QuarkusJpaUpdaterProvider implements JpaUpdaterProvider {
         return session.getAttributeOrDefault(VERIFY_AND_RUN_MASTER_CHANGELOG, Boolean.TRUE);
     }
 
-    protected void updateChangeSet(Liquibase liquibase, Writer exportWriter) throws LiquibaseException  {
+    protected void updateChangeSet(KeycloakLiquibase liquibase, Writer exportWriter) throws LiquibaseException  {
         String changelog = liquibase.getChangeLogFile();
         Database database = liquibase.getDatabase();
         Table changelogTable = SnapshotGeneratorFactory.getInstance().getDatabaseChangeLogTable(new SnapshotControl(database, false, Table.class, Column.class), database);
@@ -232,7 +231,7 @@ public class QuarkusJpaUpdaterProvider implements JpaUpdaterProvider {
         try {
             if (needVerifyMasterChangelog()) {
                 // Validate with keycloak master changelog first
-                Liquibase liquibase = getLiquibaseForKeycloakUpdate(connection, defaultSchema);
+                KeycloakLiquibase liquibase = getLiquibaseForKeycloakUpdate(connection, defaultSchema);
 
                 Status status = validateChangeSet(liquibase, liquibase.getChangeLogFile());
                 if (status != Status.VALID) {
@@ -247,7 +246,7 @@ public class QuarkusJpaUpdaterProvider implements JpaUpdaterProvider {
                 if (customChangelog != null) {
                     String factoryId = jpaProvider.getFactoryId();
                     String changelogTableName = JpaUtils.getCustomChangelogTableName(factoryId);
-                    Liquibase liquibase = getLiquibaseForCustomProviderUpdate(connection, defaultSchema, customChangelog, jpaProvider.getClass().getClassLoader(), changelogTableName);
+                    KeycloakLiquibase liquibase = getLiquibaseForCustomProviderUpdate(connection, defaultSchema, customChangelog, jpaProvider.getClass().getClassLoader(), changelogTableName);
                     if (validateChangeSet(liquibase, liquibase.getChangeLogFile()) != Status.VALID) {
                         return Status.OUTDATED;
                     }
@@ -260,7 +259,7 @@ public class QuarkusJpaUpdaterProvider implements JpaUpdaterProvider {
         return Status.VALID;
     }
 
-    protected Status validateChangeSet(Liquibase liquibase, String changelog) throws LiquibaseException {
+    protected Status validateChangeSet(KeycloakLiquibase liquibase, String changelog) throws LiquibaseException {
         final Status result;
         List<ChangeSet> changeSets = getLiquibaseUnrunChangeSets(liquibase);
 
@@ -283,10 +282,8 @@ public class QuarkusJpaUpdaterProvider implements JpaUpdaterProvider {
         return result;
     }
 
-    private void resetLiquibaseServices(Liquibase liquibase) {
-        Method resetServices = Reflections.findDeclaredMethod(Liquibase.class, "resetServices");
-        Reflections.invokeMethod(true, resetServices, liquibase);
-
+    private void resetLiquibaseServices(KeycloakLiquibase liquibase) {
+        liquibase.resetServices();
         ChangeLogHistoryServiceFactory.getInstance().register(new CustomChangeLogHistoryService());
     }
 
@@ -301,12 +298,12 @@ public class QuarkusJpaUpdaterProvider implements JpaUpdaterProvider {
         });
     }
 
-    private Liquibase getLiquibaseForKeycloakUpdate(Connection connection, String defaultSchema) throws LiquibaseException {
+    private KeycloakLiquibase getLiquibaseForKeycloakUpdate(Connection connection, String defaultSchema) throws LiquibaseException {
         LiquibaseConnectionProvider liquibaseProvider = session.getProvider(LiquibaseConnectionProvider.class);
         return liquibaseProvider.getLiquibase(connection, defaultSchema);
     }
 
-    private Liquibase getLiquibaseForCustomProviderUpdate(Connection connection, String defaultSchema, String changelogLocation, ClassLoader classloader, String changelogTableName) throws LiquibaseException {
+    private KeycloakLiquibase getLiquibaseForCustomProviderUpdate(Connection connection, String defaultSchema, String changelogLocation, ClassLoader classloader, String changelogTableName) throws LiquibaseException {
         LiquibaseConnectionProvider liquibaseProvider = session.getProvider(LiquibaseConnectionProvider.class);
         return liquibaseProvider.getLiquibaseForCustomUpdate(connection, defaultSchema, changelogLocation, classloader, changelogTableName);
     }
diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/storage/legacy/liquibase/QuarkusLiquibaseConnectionProvider.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/storage/legacy/liquibase/QuarkusLiquibaseConnectionProvider.java
index d0166eaaed..a508905a28 100644
--- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/storage/legacy/liquibase/QuarkusLiquibaseConnectionProvider.java
+++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/storage/legacy/liquibase/QuarkusLiquibaseConnectionProvider.java
@@ -28,12 +28,12 @@ import liquibase.Scope;
 import liquibase.ui.LoggerUIService;
 import org.jboss.logging.Logger;
 import org.keycloak.Config;
+import org.keycloak.connections.jpa.updater.liquibase.conn.KeycloakLiquibase;
 import org.keycloak.connections.jpa.updater.liquibase.conn.LiquibaseConnectionProvider;
 import org.keycloak.connections.jpa.updater.liquibase.conn.LiquibaseConnectionProviderFactory;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.KeycloakSessionFactory;
 
-import liquibase.Liquibase;
 import liquibase.database.Database;
 import liquibase.database.DatabaseFactory;
 import liquibase.database.jvm.JdbcConnection;
@@ -117,7 +117,7 @@ public class QuarkusLiquibaseConnectionProvider implements LiquibaseConnectionPr
     }
 
     @Override
-    public Liquibase getLiquibase(Connection connection, String defaultSchema) throws LiquibaseException {
+    public KeycloakLiquibase getLiquibase(Connection connection, String defaultSchema) throws LiquibaseException {
         Database database = DatabaseFactory.getInstance().findCorrectDatabaseImplementation(new JdbcConnection(connection));
         if (defaultSchema != null) {
             database.setDefaultSchemaName(defaultSchema);
@@ -127,11 +127,11 @@ public class QuarkusLiquibaseConnectionProvider implements LiquibaseConnectionPr
 
         logger.debugf("Using changelog file %s and changelogTableName %s", changelog, database.getDatabaseChangeLogTableName());
 
-        return new Liquibase(changelog, resourceAccessor, database);
+        return new KeycloakLiquibase(changelog, resourceAccessor, database);
     }
 
     @Override
-    public Liquibase getLiquibaseForCustomUpdate(Connection connection, String defaultSchema, String changelogLocation, ClassLoader classloader, String changelogTableName) throws LiquibaseException {
+    public KeycloakLiquibase getLiquibaseForCustomUpdate(Connection connection, String defaultSchema, String changelogLocation, ClassLoader classloader, String changelogTableName) throws LiquibaseException {
         Database database = DatabaseFactory.getInstance().findCorrectDatabaseImplementation(new JdbcConnection(connection));
         if (defaultSchema != null) {
             database.setDefaultSchemaName(defaultSchema);
@@ -142,7 +142,7 @@ public class QuarkusLiquibaseConnectionProvider implements LiquibaseConnectionPr
 
         logger.debugf("Using changelog file %s and changelogTableName %s", changelogLocation, database.getDatabaseChangeLogTableName());
 
-        return new Liquibase(changelogLocation, resourceAccessor, database);
+        return new KeycloakLiquibase(changelogLocation, resourceAccessor, database);
     }
 
     @Override