diff --git a/.circleci/config.yml b/.circleci/config.yml
index 5afd09010..340745d9b 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -148,10 +148,17 @@ jobs:
       ports:
       - 9092:9092
       - 9093:9093
-      environment:
+      # recently, the base image for some newer versions of kafka switched from
+      # alpine to debian, which causes the "apk add ..." line to fail. The env
+      # map should be used for any versions that fail due to being part of this
+      # migration.
+      environment: &environmentDebian
         <<: *environment
         KAFKA_AUTHORIZER_CLASS_NAME: 'kafka.security.auth.SimpleAclAuthorizer'
         KAFKA_ALLOW_EVERYONE_IF_NO_ACL_FOUND: 'true'
+        CUSTOM_INIT_SCRIPT: |-
+          echo -e 'KafkaServer {\norg.apache.kafka.common.security.scram.ScramLoginModule required\n username="adminscram"\n password="admin-secret";\n org.apache.kafka.common.security.plain.PlainLoginModule required\n username="adminplain"\n password="admin-secret"\n user_adminplain="admin-secret";\n  };' > /opt/kafka/config/kafka_server_jaas.conf;
+          /opt/kafka/bin/kafka-configs.sh --zookeeper localhost:2181 --alter --add-config 'SCRAM-SHA-256=[password=admin-secret-256],SCRAM-SHA-512=[password=admin-secret-512]' --entity-type users --entity-name adminscram
     steps: *steps
 
   kafka-222:
@@ -168,9 +175,7 @@ jobs:
       - 9092:9092
       - 9093:9093
       environment:
-        <<: *environment
-        KAFKA_AUTHORIZER_CLASS_NAME: 'kafka.security.auth.SimpleAclAuthorizer'
-        KAFKA_ALLOW_EVERYONE_IF_NO_ACL_FOUND: 'true'
+        <<: *environmentDebian
     steps: *steps
 
   kafka-231:
@@ -187,9 +192,7 @@ jobs:
       - 9092:9092
       - 9093:9093
       environment:
-        <<: *environment
-        KAFKA_AUTHORIZER_CLASS_NAME: 'kafka.security.auth.SimpleAclAuthorizer'
-        KAFKA_ALLOW_EVERYONE_IF_NO_ACL_FOUND: 'true'
+        <<: *environmentDebian
     steps: *steps
 
   kafka-241:
@@ -217,9 +220,7 @@ jobs:
       - 9092:9092
       - 9093:9093
       environment:
-        <<: *environment
-        KAFKA_AUTHORIZER_CLASS_NAME: 'kafka.security.authorizer.AclAuthorizer'
-        KAFKA_ALLOW_EVERYONE_IF_NO_ACL_FOUND: 'true'
+        <<: *environmentDebian
     steps: *steps
 
   kafka-260: