diff --git a/extensions/kafka-client/runtime/src/main/java/io/quarkus/kafka/client/runtime/graal/SubjectSubstitution.java b/extensions/kafka-client/runtime/src/main/java/io/quarkus/kafka/client/runtime/graal/SubjectSubstitution.java
index bd32e339dbc5c..0bf94be94eef1 100644
--- a/extensions/kafka-client/runtime/src/main/java/io/quarkus/kafka/client/runtime/graal/SubjectSubstitution.java
+++ b/extensions/kafka-client/runtime/src/main/java/io/quarkus/kafka/client/runtime/graal/SubjectSubstitution.java
@@ -3,17 +3,20 @@
 import java.security.AccessControlContext;
 import java.security.AccessController;
 import java.util.concurrent.TimeUnit;
+import java.util.function.BooleanSupplier;
 
 import javax.security.auth.AuthPermission;
 import javax.security.auth.Subject;
 import javax.security.auth.SubjectDomainCombiner;
 
+import org.graalvm.home.Version;
+
 import com.github.benmanes.caffeine.cache.Cache;
 import com.github.benmanes.caffeine.cache.Caffeine;
 import com.oracle.svm.core.annotate.Substitute;
 import com.oracle.svm.core.annotate.TargetClass;
 
-@TargetClass(className = "javax.security.auth.Subject")
+@TargetClass(className = "javax.security.auth.Subject", onlyWith = Target_javax_security_auth_Subject.Graal22_0OrEarlier.class)
 final class Target_javax_security_auth_Subject {
 
     @Substitute
@@ -96,4 +99,16 @@ final static class SubjectHolder {
                 .expireAfterAccess(1, TimeUnit.SECONDS)
                 .build();
     }
+
+    /**
+     * 22.1.0 => false
+     * 22.0.0.2 => true
+     * 21.3.0 => true
+     */
+    public static final class Graal22_0OrEarlier implements BooleanSupplier {
+        @Override
+        public boolean getAsBoolean() {
+            return Version.getCurrent().compareTo(22, 1) < 0;
+        }
+    }
 }