diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index a011b8ab23..7296f5962e 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -17,7 +17,7 @@ on:
 
 env:
   # Please ensure that this is in sync with graalVersion in build.sbt
-  graalVersion: 21.1.0
+  graalVersion: 21.3.0
   # Please ensure that this is in sync with javaVersion in build.sbt
   javaVersion: 11
   # Please ensure that this is in sync with project/build.properties
diff --git a/.github/workflows/legal-review.yml b/.github/workflows/legal-review.yml
index d1eb8492c4..4a2c2a8f78 100644
--- a/.github/workflows/legal-review.yml
+++ b/.github/workflows/legal-review.yml
@@ -8,7 +8,7 @@ on:
 
 env:
   # Please ensure that this is in sync with graalVersion in build.sbt
-  graalVersion: 21.1.0
+  graalVersion: 21.3.0
   # Please ensure that this is in sync with javaVersion in build.sbt
   javaVersion: 11
   # Please ensure that this is in sync with project/build.properties
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index 78022d0e98..4feefa6c63 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -10,7 +10,7 @@ on:
 
 env:
   # Please ensure that this is in sync with graalVersion in build.sbt
-  graalVersion: 21.1.0
+  graalVersion: 21.3.0
   # Please ensure that this is in sync with javaVersion in build.sbt
   javaVersion: 11
   # Please ensure that this is in sync with project/build.properties
diff --git a/.github/workflows/release-publish-edition.yml b/.github/workflows/release-publish-edition.yml
index d9252f3f1a..c232e7e338 100644
--- a/.github/workflows/release-publish-edition.yml
+++ b/.github/workflows/release-publish-edition.yml
@@ -6,7 +6,7 @@ on:
 
 env:
   # Please ensure that this is in sync with graalVersion in build.sbt
-  graalVersion: 21.1.0
+  graalVersion: 21.3.0
   # Please ensure that this is in sync with javaVersion in build.sbt
   javaVersion: 11
   # Please ensure that this is in sync with project/build.properties
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c5940089eb..3a550f920e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -7,7 +7,7 @@ on:
 
 env:
   # Please ensure that this is in sync with graalVersion in build.sbt
-  graalVersion: 21.1.0
+  graalVersion: 21.3.0
   # Please ensure that this is in sync with javaVersion in build.sbt
   javaVersion: 11
   # Please ensure that this is in sync with project/build.properties
diff --git a/.github/workflows/scala.yml b/.github/workflows/scala.yml
index 592fe0f362..a9806ee1ed 100644
--- a/.github/workflows/scala.yml
+++ b/.github/workflows/scala.yml
@@ -8,7 +8,7 @@ on:
 
 env:
   # Please ensure that this is in sync with graalVersion in build.sbt
-  graalVersion: 21.1.0
+  graalVersion: 21.3.0
   # Please ensure that this is in sync with javaVersion in build.sbt
   javaVersion: 11
   # Please ensure that this is in sync with project/build.properties
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9b7e86f94c..93e2ef0fc4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -54,8 +54,10 @@
 #### Enso Compiler
 
 - [Added overloaded `from` conversions.][3227]
+- [Upgraded to Graal VM 21.3.0][3258]
 
 [3227]: https://github.com/enso-org/enso/pull/3227
+[3258]: https://github.com/enso-org/enso/pull/3258
 
 # Enso 2.0.0-alpha.18 (2021-10-12)
 
diff --git a/RELEASES.md b/RELEASES.md
index 276bcbfab2..d076eb0379 100644
--- a/RELEASES.md
+++ b/RELEASES.md
@@ -9,6 +9,9 @@
   transitive dependencies of the library.
 - Updated the Scala compiler and dependencies
   ([#3214](https://github.com/enso-org/enso/pull/3214)).
+- Updated to
+  [GraalVM 21.3.0](https://github.com/graalvm/graalvm-ce-builds/releases/tag/vm-21.3.0)
+  ([#3258](https://github.com/enso-org/enso/pull/3258)).
 
 ## Interpreter/Runtime
 
diff --git a/build.sbt b/build.sbt
index 4b7d0fa6b6..d1455c7029 100644
--- a/build.sbt
+++ b/build.sbt
@@ -16,7 +16,7 @@ import java.io.File
 // ============================================================================
 
 val scalacVersion         = "2.13.7"
-val graalVersion          = "21.1.0"
+val graalVersion          = "21.3.0"
 val javaVersion           = "11"
 val defaultDevEnsoVersion = "0.0.0-dev"
 val ensoVersion = sys.env.getOrElse(
diff --git a/docs/infrastructure/native-image.md b/docs/infrastructure/native-image.md
index 94faa2ec5b..e747042aec 100644
--- a/docs/infrastructure/native-image.md
+++ b/docs/infrastructure/native-image.md
@@ -46,17 +46,17 @@ bundle containing all requirements for a static build with `musl`. It only
 requires a `tar` command to be available to extract the bundle.
 
 Currently, to use `musl`, the `--libc=musl` option has to be added to the build
-and `gcc-musl` must be available in the system PATH for the native-image. In the
-future it is possible that a different option will be used or that the bundle
-will not be required anymore if it became prepackaged. This task may thus need
-an update when moving to a newer version of Graal. More information may be found
-in
+and `x86_64-linux-musl-gcc` must be available in the system PATH for the
+native-image. In the future it is possible that a different option will be used
+or that the bundle will not be required anymore if it became prepackaged. This
+task may thus need an update when moving to a newer version of Graal. More
+information may be found in
 [the Native Image documentation](https://github.com/oracle/graal/blob/master/substratevm/STATIC-IMAGES.md).
 
 To make the bundle work correctly with GraalVM 20.2, a shell script called
-`gcc-musl` which loads the bundle's configuration is created by the task and the
-paths starting with `/build/bundle` in `musl-gcc.specs` are replaced with
-absolute paths to the bundle location.
+`x86_64-linux-musl-gcc` which loads the bundle's configuration is created by the
+task and the paths starting with `/build/bundle` in `musl-gcc.specs` are
+replaced with absolute paths to the bundle location.
 
 ## Static Builds
 
diff --git a/engine/runtime/src/main/java/org/enso/interpreter/node/ClosureRootNode.java b/engine/runtime/src/main/java/org/enso/interpreter/node/ClosureRootNode.java
index 465dce4031..0646aab105 100644
--- a/engine/runtime/src/main/java/org/enso/interpreter/node/ClosureRootNode.java
+++ b/engine/runtime/src/main/java/org/enso/interpreter/node/ClosureRootNode.java
@@ -65,7 +65,7 @@ public class ClosureRootNode extends EnsoRootNode {
   @Override
   public Object execute(VirtualFrame frame) {
     if (CompilerDirectives.inCompilationRoot() || CompilerDirectives.inInterpreter()) {
-      lookupContextReference(Language.class).get().getThreadManager().poll();
+      com.oracle.truffle.api.TruffleSafepoint.poll(this);
     }
     Object state = Function.ArgumentsHelper.getState(frame.getArguments());
     frame.setObject(this.getStateFrameSlot(), state);
diff --git a/engine/runtime/src/main/java/org/enso/interpreter/node/callable/dispatch/LoopingCallOptimiserNode.java b/engine/runtime/src/main/java/org/enso/interpreter/node/callable/dispatch/LoopingCallOptimiserNode.java
index c8d5d11013..8fc1607c25 100644
--- a/engine/runtime/src/main/java/org/enso/interpreter/node/callable/dispatch/LoopingCallOptimiserNode.java
+++ b/engine/runtime/src/main/java/org/enso/interpreter/node/callable/dispatch/LoopingCallOptimiserNode.java
@@ -14,7 +14,6 @@ import com.oracle.truffle.api.nodes.LoopNode;
 import com.oracle.truffle.api.nodes.Node;
 import com.oracle.truffle.api.nodes.NodeInfo;
 import com.oracle.truffle.api.nodes.RepeatingNode;
-import org.enso.interpreter.Language;
 import org.enso.interpreter.node.callable.ExecuteCallNode;
 import org.enso.interpreter.node.callable.ExecuteCallNodeGen;
 import org.enso.interpreter.runtime.callable.CallerInfo;
@@ -210,7 +209,7 @@ public abstract class LoopingCallOptimiserNode extends CallOptimiserNode {
      */
     @Override
     public boolean executeRepeating(VirtualFrame frame) {
-      lookupContextReference(Language.class).get().getThreadManager().poll();
+      com.oracle.truffle.api.TruffleSafepoint.poll(this);
       try {
         Function function = getNextFunction(frame);
         Object state = getNextState(frame);
diff --git a/engine/runtime/src/main/java/org/enso/interpreter/node/expression/builtin/io/GetUserHomeNode.java b/engine/runtime/src/main/java/org/enso/interpreter/node/expression/builtin/io/GetUserHomeNode.java
index 9b30083415..5535c2f78b 100644
--- a/engine/runtime/src/main/java/org/enso/interpreter/node/expression/builtin/io/GetUserHomeNode.java
+++ b/engine/runtime/src/main/java/org/enso/interpreter/node/expression/builtin/io/GetUserHomeNode.java
@@ -1,8 +1,6 @@
 package org.enso.interpreter.node.expression.builtin.io;
 
-import com.oracle.truffle.api.CompilerDirectives;
 import com.oracle.truffle.api.nodes.Node;
-import org.apache.commons.lang3.SystemUtils;
 import org.enso.interpreter.dsl.BuiltinMethod;
 import org.enso.interpreter.runtime.data.text.Text;
 
diff --git a/engine/runtime/src/main/java/org/enso/interpreter/node/expression/builtin/number/bigInteger/EqualsNode.java b/engine/runtime/src/main/java/org/enso/interpreter/node/expression/builtin/number/bigInteger/EqualsNode.java
index b1562ba936..a593aa14fa 100644
--- a/engine/runtime/src/main/java/org/enso/interpreter/node/expression/builtin/number/bigInteger/EqualsNode.java
+++ b/engine/runtime/src/main/java/org/enso/interpreter/node/expression/builtin/number/bigInteger/EqualsNode.java
@@ -1,6 +1,5 @@
 package org.enso.interpreter.node.expression.builtin.number.bigInteger;
 
-import cats.derived.IterState.Cont;
 import com.oracle.truffle.api.TruffleLanguage.ContextReference;
 import com.oracle.truffle.api.dsl.Cached;
 import com.oracle.truffle.api.dsl.CachedContext;
diff --git a/engine/runtime/src/main/java/org/enso/interpreter/node/expression/builtin/number/utils/BigIntegerOps.java b/engine/runtime/src/main/java/org/enso/interpreter/node/expression/builtin/number/utils/BigIntegerOps.java
index f803b16f20..b3b0a79d77 100644
--- a/engine/runtime/src/main/java/org/enso/interpreter/node/expression/builtin/number/utils/BigIntegerOps.java
+++ b/engine/runtime/src/main/java/org/enso/interpreter/node/expression/builtin/number/utils/BigIntegerOps.java
@@ -1,6 +1,5 @@
 package org.enso.interpreter.node.expression.builtin.number.utils;
 
-import com.fasterxml.jackson.databind.node.BigIntegerNode;
 import com.oracle.truffle.api.CompilerDirectives;
 
 import java.math.BigDecimal;
diff --git a/engine/runtime/src/main/java/org/enso/interpreter/runtime/Context.java b/engine/runtime/src/main/java/org/enso/interpreter/runtime/Context.java
index e0a2996b19..9a21aafe4a 100644
--- a/engine/runtime/src/main/java/org/enso/interpreter/runtime/Context.java
+++ b/engine/runtime/src/main/java/org/enso/interpreter/runtime/Context.java
@@ -82,7 +82,7 @@ public class Context {
     this.err = new PrintStream(environment.err());
     this.in = environment.in();
     this.inReader = new BufferedReader(new InputStreamReader(environment.in()));
-    this.threadManager = new ThreadManager();
+    this.threadManager = new ThreadManager(environment);
     this.resourceManager = new ResourceManager(this);
     this.isInlineCachingDisabled =
         environment.getOptions().get(RuntimeOptions.DISABLE_INLINE_CACHES_KEY);
diff --git a/engine/runtime/src/main/java/org/enso/interpreter/runtime/ThreadManager.java b/engine/runtime/src/main/java/org/enso/interpreter/runtime/ThreadManager.java
index 1ba9034fb8..ba0607a1db 100644
--- a/engine/runtime/src/main/java/org/enso/interpreter/runtime/ThreadManager.java
+++ b/engine/runtime/src/main/java/org/enso/interpreter/runtime/ThreadManager.java
@@ -1,33 +1,25 @@
 package org.enso.interpreter.runtime;
 
-import com.oracle.truffle.api.Assumption;
-import com.oracle.truffle.api.CompilerDirectives;
-import com.oracle.truffle.api.Truffle;
-import com.oracle.truffle.api.nodes.InvalidAssumptionException;
+import com.oracle.truffle.api.ThreadLocalAction;
+import com.oracle.truffle.api.TruffleLanguage.Env;
 import org.enso.interpreter.runtime.control.ThreadInterruptedException;
 
 import java.util.concurrent.ConcurrentHashMap;
-import java.util.concurrent.Phaser;
 import java.util.concurrent.locks.ReentrantLock;
 
 /** Manages threads running guest code, exposing a safepoint-like functionality. */
 public class ThreadManager {
-  private final Phaser safepointPhaser =
-      new Phaser() {
-        @Override
-        protected boolean onAdvance(int phase, int registeredParties) {
-          // Ensure the phaser never terminates, even if the number of parties drops to zero at some
-          // point.
-          return false;
-        }
-      };
   private final ReentrantLock lock = new ReentrantLock();
+  private final Env env;
 
-  private volatile boolean safepoint = false;
   private final ConcurrentHashMap<Thread, Boolean> interruptFlags = new ConcurrentHashMap<>();
   private static final Object ENTERED = new Object();
   private static final Object NO_OP = new Object();
 
+  public ThreadManager(Env env) {
+    this.env = env;
+  }
+
   /**
    * Registers the current thread as running guest code.
    *
@@ -42,7 +34,6 @@ public class ThreadManager {
    */
   public Object enter() {
     if (interruptFlags.get(Thread.currentThread()) == null) {
-      safepointPhaser.register();
       interruptFlags.put(Thread.currentThread(), false);
       return ENTERED;
     }
@@ -58,23 +49,10 @@ public class ThreadManager {
    */
   public void leave(Object token) {
     if (token != NO_OP) {
-      safepointPhaser.arriveAndDeregister();
       interruptFlags.remove(Thread.currentThread());
     }
   }
 
-  /** Called from the interpreter to periodically perform a safepoint check. */
-  public void poll() {
-    if (safepoint) {
-      CompilerDirectives.transferToInterpreter();
-      safepointPhaser.arriveAndAwaitAdvance();
-      if (interruptFlags.get(Thread.currentThread())) {
-        interruptFlags.put(Thread.currentThread(), false);
-        throw new ThreadInterruptedException();
-      }
-    }
-  }
-
   /**
    * Forces all threads managed by this system to halt at the next safepoint (i.e. a {@link #poll()}
    * call) and throw a {@link ThreadInterruptedException}.
@@ -91,9 +69,15 @@ public class ThreadManager {
       interruptFlags.replaceAll((t, b) -> true);
       Object p = enter();
       try {
-        safepoint = true;
-        safepointPhaser.arriveAndAwaitAdvance();
-        safepoint = false;
+        env.submitThreadLocal(null, new ThreadLocalAction(true, false) {
+          @Override
+          protected void perform(ThreadLocalAction.Access access) {
+            Boolean interrupt = interruptFlags.get(access.getThread());
+            if (Boolean.TRUE.equals(interrupt)) {
+                throw new ThreadInterruptedException();
+            }
+          }
+        });
       } finally {
         leave(p);
       }
diff --git a/engine/runtime/src/main/java/org/enso/interpreter/runtime/type/Types.java b/engine/runtime/src/main/java/org/enso/interpreter/runtime/type/Types.java
index 808b54772e..1cdbe2999d 100644
--- a/engine/runtime/src/main/java/org/enso/interpreter/runtime/type/Types.java
+++ b/engine/runtime/src/main/java/org/enso/interpreter/runtime/type/Types.java
@@ -20,7 +20,6 @@ import org.enso.interpreter.runtime.error.PanicSentinel;
 import org.enso.interpreter.runtime.number.EnsoBigInteger;
 import org.enso.interpreter.runtime.scope.ModuleScope;
 import org.enso.polyglot.data.TypeGraph;
-import org.yaml.snakeyaml.scanner.Constant;
 
 /**
  * This class defines the interpreter-level type system for Enso.
diff --git a/project/NativeImage.scala b/project/NativeImage.scala
index 2b457c5f66..f0a8207de6 100644
--- a/project/NativeImage.scala
+++ b/project/NativeImage.scala
@@ -201,7 +201,7 @@ object NativeImage {
     * Checks for existence of its directory and if it does not exist, downloads
     * and extracts the bundle. After extracting it does the required
     * initialization (renaming paths to be absolute and creating a shell script
-    * called `musl-gcc`).
+    * called `x86_64-linux-musl-gcc`).
     *
     * `musl` is needed for static builds on Linux.
     *
@@ -217,7 +217,7 @@ object NativeImage {
     val muslRoot       = buildCache / "musl-1.2.0"
     val bundleLocation = muslRoot / "bundle"
     val binaryLocation = bundleLocation / "bin"
-    val gccLocation    = binaryLocation / "musl-gcc"
+    val gccLocation    = binaryLocation / "x86_64-linux-musl-gcc"
     def isMuslInstalled =
       gccLocation.exists() && gccLocation.isOwnerExecutable
     if (!isMuslInstalled) {
@@ -297,7 +297,7 @@ object NativeImage {
       s"""#!/bin/sh
          |exec "$${REALGCC:-gcc}" "$$@" -specs "$bundlePath/lib/musl-gcc.specs"
          |""".stripMargin
-    val wrapper = bundleLocation / "bin" / "musl-gcc"
+    val wrapper = bundleLocation / "bin" / "x86_64-linux-musl-gcc"
     IO.write(wrapper, content)
     wrapper.setExecutable(true)
   }
@@ -320,14 +320,14 @@ object NativeImage {
  * errors may arise.
  *
  * Currently, to use `musl`, the `--libc=musl` option has to be added to the
- * build and `gcc-musl` must be available in the system PATH for the
+ * build and `x86_64-linux-musl-gcc` must be available in the system PATH for the
  * native-image. In the future it is possible that a different option will be
  * used or that the bundle will not be required anymore if it became
  * prepackaged. This task may thus need an update when moving to a newer version
  * of Graal.
  *
  * Currently to make the bundle work correctly with GraalVM 20.2, a shell script
- * called `gcc-musl` which loads the bundle's configuration is created by the
+ * called `x86_64-linux-musl-gcc` which loads the bundle's configuration is created by the
  * task and the paths starting with `/build/bundle` in `musl-gcc.specs` are
  * replaced with absolute paths to the bundle location.
  */
diff --git a/test/Tests/src/Network/Http_Spec.enso b/test/Tests/src/Network/Http_Spec.enso
index 49bae44585..3fe9109123 100644
--- a/test/Tests/src/Network/Http_Spec.enso
+++ b/test/Tests/src/Network/Http_Spec.enso
@@ -47,7 +47,7 @@ spec =
                 {
                   "headers": {
                     "Content-Length": "0",
-                    "User-Agent": "Java-http-client/11.0.11"
+                    "User-Agent": "Java-http-client/11.0.13"
                   },
                   "origin": "127.0.0.1",
                   "url": "",
@@ -61,7 +61,7 @@ spec =
                 {
                   "headers": {
                     "Content-Length": "0",
-                    "User-Agent": "Java-http-client/11.0.11"
+                    "User-Agent": "Java-http-client/11.0.13"
                   },
                   "origin": "127.0.0.1",
                   "url": "",
@@ -76,7 +76,7 @@ spec =
                 {
                   "headers": {
                     "Content-Length": "0",
-                    "User-Agent": "Java-http-client/11.0.11"
+                    "User-Agent": "Java-http-client/11.0.13"
                   },
                   "origin": "127.0.0.1",
                   "url": "",
@@ -97,7 +97,7 @@ spec =
                 {
                   "headers": {
                     "Content-Length": "0",
-                    "User-Agent": "Java-http-client/11.0.11"
+                    "User-Agent": "Java-http-client/11.0.13"
                   },
                   "origin": "127.0.0.1",
                   "url": "",
@@ -116,7 +116,7 @@ spec =
                 {
                   "headers": {
                     "Content-Length": "0",
-                    "User-Agent": "Java-http-client/11.0.11"
+                    "User-Agent": "Java-http-client/11.0.13"
                   },
                   "origin": "127.0.0.1",
                   "url": "",
@@ -136,7 +136,7 @@ spec =
                   "headers": {
                     "Content-Length": "12",
                     "Content-Type": "text/plain",
-                    "User-Agent": "Java-http-client/11.0.11"
+                    "User-Agent": "Java-http-client/11.0.13"
                   },
                   "origin": "127.0.0.1",
                   "url": "",
@@ -156,7 +156,7 @@ spec =
                   "headers": {
                     "Content-Length": "7",
                     "Content-Type": "application/x-www-form-urlencoded",
-                    "User-Agent": "Java-http-client/11.0.11"
+                    "User-Agent": "Java-http-client/11.0.13"
                   },
                   "origin": "127.0.0.1",
                   "url": "",
@@ -176,7 +176,7 @@ spec =
                   "headers": {
                     "Content-Length": "7",
                     "Content-Type": "application/x-www-form-urlencoded",
-                    "User-Agent": "Java-http-client/11.0.11"
+                    "User-Agent": "Java-http-client/11.0.13"
                   },
                   "origin": "127.0.0.1",
                   "url": "",
@@ -206,7 +206,7 @@ spec =
                   "headers": {
                     "Content-Length": "13",
                     "Content-Type": "application/json",
-                    "User-Agent": "Java-http-client/11.0.11"
+                    "User-Agent": "Java-http-client/11.0.13"
                   },
                   "origin": "127.0.0.1",
                   "url": "",
@@ -229,7 +229,7 @@ spec =
                   "headers": {
                     "Content-Length": "13",
                     "Content-Type": "application/json",
-                    "User-Agent": "Java-http-client/11.0.11"
+                    "User-Agent": "Java-http-client/11.0.13"
                   },
                   "origin": "127.0.0.1",
                   "url": "",
@@ -252,7 +252,7 @@ spec =
                   "headers": {
                     "Content-Length": "12",
                     "Content-Type": "application/octet-stream",
-                    "User-Agent": "Java-http-client/11.0.11"
+                    "User-Agent": "Java-http-client/11.0.13"
                   },
                   "origin": "127.0.0.1",
                   "url": "",
@@ -272,7 +272,7 @@ spec =
                 {
                   "headers": {
                     "Content-Length": "0",
-                    "User-Agent": "Java-http-client/11.0.11"
+                    "User-Agent": "Java-http-client/11.0.13"
                   },
                   "origin": "127.0.0.1",
                   "url": "",
@@ -288,7 +288,7 @@ spec =
                   "headers": {
                     "Content-Length": "13",
                     "Content-Type": "application/json",
-                    "User-Agent": "Java-http-client/11.0.11"
+                    "User-Agent": "Java-http-client/11.0.13"
                   },
                   "origin": "127.0.0.1",
                   "url": "",
@@ -313,7 +313,7 @@ spec =
                   "headers": {
                     "Content-Length": "16",
                     "Content-Type": "application/json",
-                    "User-Agent": "Java-http-client/11.0.11"
+                    "User-Agent": "Java-http-client/11.0.13"
                   },
                   "origin": "127.0.0.1",
                   "url": "",
diff --git a/tools/ci/docker/Dockerfile b/tools/ci/docker/Dockerfile
index b56371234b..bf34a7324f 100644
--- a/tools/ci/docker/Dockerfile
+++ b/tools/ci/docker/Dockerfile
@@ -1,4 +1,4 @@
-FROM ghcr.io/graalvm/graalvm-ce:java11-21.1.0
+FROM ghcr.io/graalvm/graalvm-ce:java11-21.3.0
 
 USER root