diff --git a/.circleci/config.yml b/.circleci/config.yml
deleted file mode 100644
index 008cd02..0000000
--- a/.circleci/config.yml
+++ /dev/null
@@ -1,87 +0,0 @@
-version: 2.1
-
-workflows:
-  test:
-    jobs:
-      - test:
-          matrix:
-            parameters:
-              python_image:
-                - "python:3.6-slim"
-                - "python:3.7-slim"
-                - "python:3.8-slim"
-                - "python:3.9-slim"
-                - "python:3.10-slim"
-                - "python:3.11-slim"
-                - "pypy:3-slim-buster"
-              django_version:
-                - "3.2.x" # 3.0 supports python 3.6 to 3.9
-                - "4.0.x" # 4.0 supports python 3.8 to 3.10
-                - "4.1.x" # 4.1 supports python 3.8 to 3.11
-                - "main" # 4.1 supports 3.8 to 3.11
-            exclude:
-              - python_image: "python:3.6-slim"
-                django_version: "main"
-              - python_image: "python:3.6-slim"
-                django_version: "4.0.x"
-              - python_image: "python:3.6-slim"
-                django_version: "4.1.x"
-              - python_image: "python:3.7-slim"
-                django_version: "main"
-              - python_image: "python:3.7-slim"
-                django_version: "4.0.x"
-              - python_image: "python:3.7-slim"
-                django_version: "4.1.x"
-              - python_image: "python:3.10-slim"
-                django_version: "3.2.x"
-              - python_image: "python:3.11-slim"
-                django_version: "3.2.x"
-              - python_image: "python:3.11-slim"
-                django_version: "4.0.x"
-
-jobs:
-  test:
-    parameters:
-      python_image:
-        type: string
-      django_version:
-        type: string
-    docker:
-      - image: << parameters.python_image >>
-        # auth:
-        #   username: $DOCKER_USER
-        #   password: $DOCKER_PASS
-        environment:
-          DJANGO_VERSION: << parameters.django_version >>
-          PYTHON_IMAGE: << parameters.python_image >>
-    steps:
-      - checkout
-      - run:
-          name: install
-          command: pip install tox coveralls
-      - when:
-          condition:
-            not:
-              or:
-                - equal: ["pypy:3-slim-buster", << parameters.python_image >>]
-          steps:
-            - run:
-                name: test cpython
-                command: |
-                  PYTHON_VERSION="$(python --version 2>&1 | cut -d ' ' -f 2 | cut -d '.' -f 1,2)"
-                  echo "$PYTHON_VERSION-$DJANGO_VERSION"
-                  tox -e "$PYTHON_VERSION-$DJANGO_VERSION"
-      - when:
-          condition:
-            or:
-              - equal: ["pypy:3-slim-buster", << parameters.python_image >>]
-          steps:
-            - run:
-                name: test pypy
-                command: |
-                  PYTHON_VERSION="pypy$(pypy --version 2>&1 | head -n 1 | cut -d ' ' -f 2 | cut -d '.' -f 1)"
-                  echo "$PYTHON_VERSION-$DJANGO_VERSION"
-                  tox -e "$PYTHON_VERSION-$DJANGO_VERSION"
-      - run:
-          name: report coverage
-          command: coveralls
diff --git a/.github/workflows/run-tests.yaml b/.github/workflows/run-tests.yaml
new file mode 100644
index 0000000..32a810c
--- /dev/null
+++ b/.github/workflows/run-tests.yaml
@@ -0,0 +1,57 @@
+name: "CI" # Note that this name appears in the README's badge
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+  pull_request:
+  release:
+    types: [published]
+jobs:
+  run-tests:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version:
+            - '3.8'
+            - '3.9'
+            - '3.10'
+            - '3.11'
+            - '3.12'
+            - 'pypy-3.8'
+            - 'pypy-3.9'
+            - 'pypy-3.10'
+
+    steps:
+    - uses: actions/checkout@v3
+    - name: Set up Python ${{ matrix.python-version }}
+      uses: actions/setup-python@v4
+      with:
+        python-version: ${{ matrix.python-version }}
+    - name: Install dependencies
+      run: |
+        python -m pip install --upgrade pip
+        python -m pip install tox tox-gh-actions
+    - name: Test with tox
+      run: tox
+
+  release:
+    name: Release django-csp
+    if: github.event_name == 'release' && github.event.action == 'published'
+    needs:
+      - run-tests
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/setup-python@v4
+        with:
+          python-version: 3.12
+      - name: Install dependencies for package building only
+        run: pip install build
+      - name: Build package for upload to PyPI
+        run: python -m build .
+      - name: Upload the distribution to PyPI
+        uses: pypa/gh-action-pypi-publish@v1.4.2
+        with:
+          user: __token__
+          password: ${{ secrets.PYPI_API_TOKEN }}
\ No newline at end of file
diff --git a/README.rst b/README.rst
index 5c7b02a..d4e13d9 100644
--- a/README.rst
+++ b/README.rst
@@ -1,8 +1,8 @@
 .. image:: https://badge.fury.io/py/django-csp.svg
    :target: https://pypi.python.org/pypi/django_csp
 
-.. image:: https://circleci.com/gh/mozilla/django-csp/tree/main.svg?style=shield
-   :target: https://circleci.com/gh/mozilla/django-csp/?branch=main
+.. image:: https://github.com/mozilla/django-csp/actions/workflows/run-tests.yaml/badge.svg
+   :target: https://github.com/mozilla/django-csp/actions/workflows/run-tests.yaml
 
 .. image:: https://coveralls.io/repos/github/mozilla/django-csp/badge.svg?branch=main
    :target: https://coveralls.io/github/mozilla/django-csp?branch=main
diff --git a/tox.ini b/tox.ini
index 656e6f7..e9ec469 100644
--- a/tox.ini
+++ b/tox.ini
@@ -1,18 +1,30 @@
 [tox]
 envlist =
-    {3.10,3.11,3.12,pypy3}-main
-    {3.10,3.11,3.12pypy3}-5.0.x
-    {3.8,3.9,3.10,3.11,3.12,pypy3}-4.2.x
-    {3.8,3.9,3.10,pypy3}-3.2.x
+    {3.10,3.11,3.12,pypy310}-main
+    {3.10,3.11,3.12,pypy310}-5.0.x
+    {3.8,3.9,3.10,3.11,3.12,pypy38,pypy39,pypy310}-4.2.x
+    {3.8,3.9,3.10,pypy38,pypy39,pypy310}-3.2.x
+
+
+# Don't run coverage when testing with pypy:
+# see https://github.com/nedbat/coveragepy/issues/1382
+[testenv:pypy310-main,pypy310-5.0.x,{pypy38,pypy39,pypy310}-4.2.x,{pypy38,pypy39,pypy310}-3.2.x]
+commands =
+    pip install --upgrade pip
+    pip install -e .[tests]
+    pytest {toxinidir}/csp
+
 
 [testenv]
 setenv =
     PYTHONPATH={toxinidir}
     PYTHONDONTWRITEBYTECODE=1
+
 commands =
     pip install --upgrade pip
     pip install -e .[tests]
     pytest --cov={toxinidir}/csp  {toxinidir}/csp
+
 basepython =
     3.8: python3.8
     3.9: python3.9
@@ -20,9 +32,25 @@ basepython =
     3.11: python3.11
     3.12: python3.12
     pypy3: pypy3
-deps=
+
+deps =
     pytest
     3.2.x: Django>=3.2,<3.3
     4.2.x: Django>=4.2,<4.3
     5.0.x: Django>=5.0.1,<5.1
     main: https://github.com/django/django/archive/main.tar.gz
+
+
+[gh-actions]
+# Running tox in GHA without redefining it all in a GHA matrix:
+# https://github.com/ymyzk/tox-gh-actions
+python =
+    3.7: py37
+    3.8: py38
+    3.9: py39
+    3.10: py310
+    3.11: py311
+    3.12: py312
+    pypy-3.8: pypy38
+    pypy-3.9: pypy39
+    pypy-3.10: pypy310