diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c342d4d..437ac20 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -6,6 +6,9 @@ on:
       - "dependabot/**"
   pull_request:
 
+env:
+  FORCE_COLOR: "1"
+
 jobs:
   test:
     strategy:
@@ -16,9 +19,11 @@ jobs:
           - macos-latest
           - windows-latest
           - ubuntu-latest
+        nox-session: ['']
         include:
           - python-version: pypy3.10
             os: ubuntu-latest
+            nox-session: test-pypy3.10
     name: ${{ fromJson('{"macos-latest":"macOS","windows-latest":"Windows","ubuntu-latest":"Ubuntu"}')[matrix.os] }} (${{ matrix.python-version }})
     timeout-minutes: 20
     runs-on: ${{ matrix.os }}
@@ -31,8 +36,13 @@ jobs:
           python-version: '${{ matrix.python-version }}'
           allow-prereleases: true
       - name: Run tests
-        run: ./ci.sh
+        run: |
+          python -m pip install --upgrade nox
+          nox -s ${NOX_SESSION:-test-$PYTHON_VERSION}
         shell: bash
+        env:
+          PYTHON_VERSION: ${{ matrix.python-version }}
+          NOX_SESSION: ${{ matrix.nox-session }}
       - name: "Upload coverage data"
         uses: "actions/upload-artifact@v4"
         with:
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index dd4872f..d66ee3d 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -6,6 +6,9 @@ on:
       - "dependabot/**"
   pull_request:
 
+env:
+  FORCE_COLOR: "1"
+
 jobs:
   Lint:
     name: 'Lint'
@@ -19,4 +22,6 @@ jobs:
         with:
           python-version: '3.x'
       - name: Run lint
-        run: ./lint.sh
+        run: |
+          python -m pip install --upgrade nox
+          nox -s lint
diff --git a/ci.sh b/ci.sh
deleted file mode 100755
index f167c8d..0000000
--- a/ci.sh
+++ /dev/null
@@ -1,20 +0,0 @@
-#!/bin/bash
-
-set -exu -o pipefail
-
-python -c "import sys, struct, ssl; print('#' * 70); print('python:', sys.version); print('version_info:', sys.version_info); print('bits:', struct.calcsize('P') * 8); print('openssl:', ssl.OPENSSL_VERSION, ssl.OPENSSL_VERSION_INFO); print('#' * 70)"
-
-python -m pip install -U pip build
-python -m pip --version
-
-python -m build --sdist
-python -m pip install dist/*.tar.gz
-
-# Actual tests
-
-python -m pip install -Ur test-requirements.txt
-if [ -n "${OLD_CRYPTOGRAPHY:-}" ]; then
-  python -m pip install cryptography=="${OLD_CRYPTOGRAPHY}"
-fi
-
-coverage run --parallel-mode -m pytest -W error -ra -s tests
diff --git a/lint-requirements.in b/lint-requirements.in
index 9a38e30..0a153f1 100644
--- a/lint-requirements.in
+++ b/lint-requirements.in
@@ -5,3 +5,4 @@ pytest>=6.2
 idna>=3.2
 black
 isort
+nox
diff --git a/lint-requirements.txt b/lint-requirements.txt
index 440738c..a62533d 100644
--- a/lint-requirements.txt
+++ b/lint-requirements.txt
@@ -1,20 +1,24 @@
-#
-# This file is autogenerated by pip-compile with Python 3.12
-# by the following command:
-#
-#    pip-compile lint-requirements.in
-#
-black==24.8.0
+# This file was autogenerated by uv via the following command:
+#    uv pip compile lint-requirements.in
+argcomplete==3.5.1
+    # via nox
+black==24.10.0
     # via -r lint-requirements.in
 cffi==1.17.1
     # via cryptography
 click==8.1.7
     # via black
-cryptography==42.0.4
+colorlog==6.8.2
+    # via nox
+cryptography==43.0.1
     # via
     #   -r lint-requirements.in
     #   types-pyopenssl
-idna==3.6
+distlib==0.3.8
+    # via virtualenv
+filelock==3.16.1
+    # via virtualenv
+idna==3.10
     # via -r lint-requirements.in
 iniconfig==2.0.0
     # via pytest
@@ -26,14 +30,19 @@ mypy-extensions==1.0.0
     # via
     #   black
     #   mypy
+nox==2024.4.15
+    # via -r lint-requirements.in
 packaging==24.1
     # via
     #   black
+    #   nox
     #   pytest
 pathspec==0.12.1
     # via black
 platformdirs==4.3.6
-    # via black
+    # via
+    #   black
+    #   virtualenv
 pluggy==1.5.0
     # via pytest
 pycparser==2.22
@@ -48,3 +57,5 @@ types-setuptools==75.1.0.20240917
     # via types-cffi
 typing-extensions==4.12.2
     # via mypy
+virtualenv==20.26.6
+    # via nox
diff --git a/lint.sh b/lint.sh
deleted file mode 100755
index 90162c8..0000000
--- a/lint.sh
+++ /dev/null
@@ -1,17 +0,0 @@
-#!/bin/bash
-
-set -exu -o pipefail
-
-python -c "import sys, struct, ssl; print('#' * 70); print('python:', sys.version); print('version_info:', sys.version_info); print('bits:', struct.calcsize('P') * 8); print('openssl:', ssl.OPENSSL_VERSION, ssl.OPENSSL_VERSION_INFO); print('#' * 70)"
-
-python -m pip install -U pip
-python -m pip --version
-
-# Dependencies
-
-python -m pip install -Ur lint-requirements.txt
-
-# Linting
-black --check src/trustme tests
-isort --profile black src/trustme tests
-mypy src/trustme tests
diff --git a/noxfile.py b/noxfile.py
new file mode 100644
index 0000000..6ad0230
--- /dev/null
+++ b/noxfile.py
@@ -0,0 +1,32 @@
+import os
+
+import nox
+
+
+@nox.session()
+def lint(session: nox.Session) -> None:
+    session.install("-r", "lint-requirements.txt")
+    LINT_PATHS = ("src/trustme", "tests", "noxfile.py")
+    session.run("black", *LINT_PATHS)
+    session.run("isort", "--profile", "black", *LINT_PATHS)
+    session.run("mypy", *LINT_PATHS)
+
+
+@nox.session(python=["3.9", "3.10", "3.11", "3.12", "3.13", "pypy3.10"])
+def test(session: nox.Session) -> None:
+    session.install(".", "-r", "test-requirements.txt")
+    session.run(
+        "coverage",
+        "run",
+        "--parallel-mode",
+        "-m",
+        "pytest",
+        "-W",
+        "error",
+        "-ra",
+        "-s",
+        *(session.posargs or ("tests/",)),
+    )
+    if os.environ.get("CI") != "true":
+        session.run("coverage", "combine")
+        session.run("coverage", "report", "-m")