diff --git a/.github/.OwlBot.lock.yaml b/.github/.OwlBot.lock.yaml
index 426cf83e..f60d7749 100644
--- a/.github/.OwlBot.lock.yaml
+++ b/.github/.OwlBot.lock.yaml
@@ -13,4 +13,5 @@
 # limitations under the License.
 docker:
   image: gcr.io/cloud-devrel-public-resources/owlbot-java:latest
-  digest: sha256:b0b1c1c89570e229b1026372a2b8989ba31495007055b8d30178b7648503eefa
+  digest: sha256:fc52b202aa298a50a12c64efd04fea3884d867947effe2fa85382a246c09e813
+# created: 2022-04-06T16:30:03.627422514Z
diff --git a/.github/auto-label.yaml b/.github/auto-label.yaml
new file mode 100644
index 00000000..4caef688
--- /dev/null
+++ b/.github/auto-label.yaml
@@ -0,0 +1,15 @@
+# Copyright 2021 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+requestsize:
+  enabled: true
diff --git a/.github/sync-repo-settings.yaml b/.github/sync-repo-settings.yaml
index c2d7ab05..c3a74079 100644
--- a/.github/sync-repo-settings.yaml
+++ b/.github/sync-repo-settings.yaml
@@ -46,6 +46,19 @@ branchProtectionRules:
     - "dependencies (11, java-spanner)"
     - "dependencies (11, java-storage)"
     - "dependencies (11, java-pubsub)"
+    - "build (8, java-trace, test)"
+    - "build (8, java-trace, lint)"
+    - "build (8, java-trace, clirr)"
+    - "build (8, java-bigquery, test)"
+    - "build (8, java-bigquery, lint)"
+    - "build (8, java-bigquery, clirr)"
+    - "build (11, java-trace, test)"
+    - "build (11, java-trace, lint)"
+    - "build (11, java-trace, clirr)"
+    - "build (11, java-bigquery, test)"
+    - "build (11, java-bigquery, lint)"
+    - "build (11, java-bigquery, clirr)"
+    - "graalvm (11, java-orgpolicy)"
     - "cla/google"
 - pattern: java7
   # Can admins overwrite branch protection.
diff --git a/.github/workflows/downstream.yaml b/.github/workflows/downstream-dependencies.yaml
similarity index 70%
rename from .github/workflows/downstream.yaml
rename to .github/workflows/downstream-dependencies.yaml
index 8992a599..58c60f9d 100644
--- a/.github/workflows/downstream.yaml
+++ b/.github/workflows/downstream-dependencies.yaml
@@ -18,14 +18,12 @@ jobs:
         - java-storage
         - java-pubsub
     steps:
-    - uses: actions/checkout@v2
-    - uses: stCarolas/setup-maven@v4
-      with:
-        maven-version: 3.8.1
-    - uses: actions/setup-java@v1
+    - uses: actions/checkout@v3
+    - uses: actions/setup-java@v3
       with:
+        distribution: zulu
         java-version: ${{matrix.java}}
     - run: java -version
     - run: sudo apt-get update -y
     - run: sudo apt-get install libxml2-utils
-    - run: .kokoro/client-library-check.sh ${{matrix.repo}}
+    - run: .kokoro/client-library-check.sh ${{matrix.repo}} dependencies
diff --git a/.github/workflows/downstream-maven-plugins.yaml b/.github/workflows/downstream-maven-plugins.yaml
new file mode 100644
index 00000000..e1544540
--- /dev/null
+++ b/.github/workflows/downstream-maven-plugins.yaml
@@ -0,0 +1,67 @@
+on:
+  push:
+    branches:
+    - main
+  pull_request:
+
+# Keeping this file separate as the dependencies check would use more
+# repositories than needed this downstream check for GraalVM native image and
+# other Maven plugins.
+name: downstream
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        java: [8, 11]
+        repo:
+        # GAPIC library
+        - java-trace
+        # Handwritten library
+        - java-bigquery
+        job-type:
+        - test  # maven-surefire-plugin
+        - lint  # fmt-maven-plugin and google-java-format
+        - clirr # clirr-maven-plugin
+    steps:
+    - uses: actions/checkout@v3
+    - uses: actions/setup-java@v3
+      with:
+        distribution: zulu
+        java-version: ${{matrix.java}}
+    - run: java -version
+    - run: sudo apt-get update -y
+    - run: sudo apt-get install libxml2-utils
+    - run: .kokoro/client-library-check.sh ${{matrix.repo}} ${{matrix.job-type}}
+
+  # GraalVM job ensures the compatibility of GraaVM version above and the
+  # native-maven-plugin version.
+  graalvm:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        java: [11]
+        repo:
+        # GAPIC library that doesn't use a real GCP project in integration tests
+        - java-orgpolicy
+    steps:
+    - uses: actions/checkout@v2
+    - uses: stCarolas/setup-maven@v4
+      with:
+        maven-version: 3.8.1
+    - uses: ayltai/setup-graalvm@v1
+      with:
+        java-version: ${{matrix.java}}
+        # When a new version of native-maven-plugin fails to run in a downstream
+        # library, it's likely to be an incompatibility with the GraalVM version.
+        # In that case, you need to upgrade the Docker container used in the
+        # tests in the downstream repositories (not just this value below).
+        # Example: https://github.com/googleapis/testing-infra-docker/pull/195
+        graalvm-version: 22.0.0.2
+        native-image: true
+    - run: java -version
+    - run: sudo apt-get update -y
+    - run: sudo apt-get install libxml2-utils
+    - run: .kokoro/client-library-check.sh ${{matrix.repo}} graalvm
diff --git a/.kokoro/client-library-check.sh b/.kokoro/client-library-check.sh
index 03cee53b..3cddeb10 100755
--- a/.kokoro/client-library-check.sh
+++ b/.kokoro/client-library-check.sh
@@ -21,12 +21,15 @@ set -eo pipefail
 # Display commands being run.
 set -x
 
-if [[ $# -lt 1 ]];
+if [[ $# -ne 2 ]];
 then
-  echo "Usage: $0 <repo-name>"
+  echo "Usage: $0 <repo-name> <job-type>"
+  echo "where repo-name is java-XXX and check-type is dependencies, lint, or clirr"
   exit 1
 fi
 REPO=$1
+# build.sh uses this environment variable
+export JOB_TYPE=$2
 
 ## Get the directory of the build script
 scriptDir=$(realpath $(dirname "${BASH_SOURCE[0]}"))
@@ -61,5 +64,17 @@ set ${VERSION}
 save pom.xml
 EOF
 
-# run dependencies script
-.kokoro/dependencies.sh
+case ${JOB_TYPE} in
+dependencies)
+    .kokoro/dependencies.sh
+    RETURN_CODE=$?
+    ;;
+*)
+    # This reads the JOB_TYPE environmental variable
+    .kokoro/build.sh
+    RETURN_CODE=$?
+    ;;
+esac
+
+echo "exiting with ${RETURN_CODE}"
+exit ${RETURN_CODE}
diff --git a/CHANGELOG.md b/CHANGELOG.md
index d889322c..cc875d87 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,18 @@
 # Changelog
 
+### [1.3.3](https://github.com/googleapis/java-shared-config/compare/v1.3.2...v1.3.3) (2022-04-19)
+
+
+### Bug Fixes
+
+* **java:** remove protobuf feature from native profile ([#461](https://github.com/googleapis/java-shared-config/issues/461)) ([ffd07cb](https://github.com/googleapis/java-shared-config/commit/ffd07cb18ee7d45d4daee1d9ea6f6d321fdca874))
+
+
+### Dependencies
+
+* update dependency com.google.cloud:native-image-support to v0.12.11 ([#459](https://github.com/googleapis/java-shared-config/issues/459)) ([d20008d](https://github.com/googleapis/java-shared-config/commit/d20008df15209708fdf9d06828b567778190f4d0))
+* update dependency com.google.cloud:native-image-support to v0.13.1 ([#465](https://github.com/googleapis/java-shared-config/issues/465)) ([b202064](https://github.com/googleapis/java-shared-config/commit/b2020648816feb4740ad70acedfed470d7da5bcf))
+
 ### [1.3.2](https://github.com/googleapis/java-shared-config/compare/v1.3.1...v1.3.2) (2022-03-28)
 
 
diff --git a/pom.xml b/pom.xml
index 628bea79..cd599903 100644
--- a/pom.xml
+++ b/pom.xml
@@ -6,7 +6,7 @@
   <groupId>com.google.cloud</groupId>
   <artifactId>google-cloud-shared-config</artifactId>
   <packaging>pom</packaging>
-  <version>1.3.2</version><!-- {x-version-update:google-cloud-shared-config:current} -->
+  <version>1.3.3</version><!-- {x-version-update:google-cloud-shared-config:current} -->
   <name>Google Cloud</name>
   <url>https://github.com/googleapis/java-shared-config</url>
   <description>
@@ -64,6 +64,7 @@
     <report.jxr.inherited>false</report.jxr.inherited>
     <skipITs>true</skipITs>
     <auto-value-annotation.version>1.9</auto-value-annotation.version>
+    <surefire.version>3.0.0-M6</surefire.version>
     <docRoot>/java/docs/reference/</docRoot>
   </properties>
 
@@ -85,7 +86,7 @@
         <plugin>
           <groupId>org.apache.maven.plugins</groupId>
           <artifactId>maven-surefire-plugin</artifactId>
-          <version>3.0.0-M5</version>
+          <version>${surefire.version}</version>
           <configuration>
             <!-- Excludes integration tests and smoke tests when unit tests are run -->
             <excludes>
@@ -98,7 +99,7 @@
             <dependency>
               <groupId>org.apache.maven.surefire</groupId>
               <artifactId>surefire-junit47</artifactId>
-              <version>3.0.0-M5</version>
+              <version>${surefire.version}</version>
             </dependency>
           </dependencies>
         </plugin>
@@ -129,7 +130,8 @@
         <plugin>
           <groupId>org.apache.maven.plugins</groupId>
           <artifactId>maven-failsafe-plugin</artifactId>
-          <version>3.0.0-M4</version>
+          <!-- this plugin is released along with maven-surefire-plugin -->
+          <version>${surefire.version}</version>
           <configuration>
             <forkedProcessTimeoutInSeconds>3600</forkedProcessTimeoutInSeconds>
             <reportNameSuffix>sponge_log</reportNameSuffix>
@@ -142,7 +144,7 @@
             <dependency>
               <groupId>org.apache.maven.surefire</groupId>
               <artifactId>surefire-junit47</artifactId>
-              <version>3.0.0-M4</version>
+              <version>${surefire.version}</version>
             </dependency>
           </dependencies>
         </plugin>
@@ -190,7 +192,7 @@
         <plugin>
           <groupId>org.jacoco</groupId>
           <artifactId>jacoco-maven-plugin</artifactId>
-          <version>0.8.7</version>
+          <version>0.8.8</version>
         </plugin>
         <plugin>
           <groupId>org.apache.maven.plugins</groupId>
@@ -506,7 +508,7 @@
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-jxr-plugin</artifactId>
-        <version>3.1.1</version>
+        <version>3.2.0</version>
         <configuration>
           <linkJavadoc>true</linkJavadoc>
         </configuration>
@@ -776,7 +778,7 @@
         <dependency>
           <groupId>com.google.cloud</groupId>
           <artifactId>native-image-support</artifactId>
-          <version>0.12.10</version>
+          <version>0.13.1</version>
           <scope>test</scope>
         </dependency>
 
@@ -831,7 +833,6 @@
               <buildArgs>
                 <buildArg>--no-fallback</buildArg>
                 <buildArg>--no-server</buildArg>
-                <buildArg>--features=com.google.cloud.nativeimage.features.ProtobufMessageFeature</buildArg>
               </buildArgs>
             </configuration>
           </plugin>
diff --git a/versions.txt b/versions.txt
index 5079fd28..1aca0482 100644
--- a/versions.txt
+++ b/versions.txt
@@ -1,4 +1,4 @@
 # Format:
 # module:released-version:current-version
 
-google-cloud-shared-config:1.3.2:1.3.2
+google-cloud-shared-config:1.3.3:1.3.3