diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 3b57573a..8b75981e 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -10,12 +10,23 @@ on:
     branches:
       - master
 
+env:
+  PYTEST_ADDOPTS: "--color=yes"
+
+# Set permissions at the job level.
+permissions: {}
+
 jobs:
   test:
     runs-on: ubuntu-20.04
     continue-on-error: ${{ matrix.allow_failure }}
+    timeout-minutes: 15
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v2
+        with:
+          persist-credentials: false
 
       - uses: actions/setup-python@v2
         with:
@@ -37,15 +48,17 @@ jobs:
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
-          pip install tox==3.20.0
+          pip install tox==3.24.4
 
       - name: Run tox
         run: tox -e ${{ matrix.name }}
 
       - name: Report coverage
         if: contains(matrix.name, 'coverage')
-        run: |
-          bash <(curl -s https://codecov.io/bash) -Z -X gcov -X xcode -X gcovout
+        uses: codecov/codecov-action@v2
+        with:
+          fail_ci_if_error: true
+          files: ./coverage.xml
 
     strategy:
       fail-fast: false
@@ -128,11 +141,15 @@ jobs:
   deploy:
     if: github.event_name == 'push' && startsWith(github.event.ref, 'refs/tags') && github.repository == 'pytest-dev/pytest-django'
     runs-on: ubuntu-20.04
+    timeout-minutes: 15
+    permissions:
+      contents: read
 
     steps:
       - uses: actions/checkout@v2
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - uses: actions/setup-python@v2
         with:
@@ -141,10 +158,10 @@ jobs:
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
-          pip install --upgrade wheel setuptools tox
+          pip install --upgrade build tox
 
       - name: Build package
-        run: python setup.py sdist bdist_wheel
+        run: python -m build
 
       - name: Publish package
         uses: pypa/gh-action-pypi-publish@v1.4.1
diff --git a/Makefile b/Makefile
index ff84d7df..ba5e3f50 100644
--- a/Makefile
+++ b/Makefile
@@ -4,11 +4,8 @@ VENV:=build/venv
 
 export DJANGO_SETTINGS_MODULE?=pytest_django_test.settings_sqlite_file
 
-testenv: $(VENV)/bin/pytest
-
 test: $(VENV)/bin/pytest
-	$(VENV)/bin/pip install -e .
-	$(VENV)/bin/py.test
+	$(VENV)/bin/pytest
 
 $(VENV)/bin/python $(VENV)/bin/pip:
 	virtualenv $(VENV)