diff --git a/.circleci/config.yml b/.circleci/config.yml
index 01d9bff..e0442db 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -29,7 +29,7 @@ commands:
 jobs:
   Check Rust formatting:
     docker:
-      - image: circleci/rust:latest
+      - image: rust:1
         auth:
           username: $DOCKER_USER
           password: $DOCKER_PASS
@@ -41,7 +41,7 @@ jobs:
       - run: cargo fmt -- --check
   Rust tests - stable:
     docker:
-      - image: circleci/rust:latest
+      - image: rust:1
         auth:
           username: $DOCKER_USER
           password: $DOCKER_PASS
@@ -50,7 +50,7 @@ jobs:
       - rust-tests
   Rust tests - beta:
     docker:
-      - image: circleci/rust:latest
+      - image: rust:1
         auth:
           username: $DOCKER_USER
           password: $DOCKER_PASS
diff --git a/.github/workflows/build-test-deploy.yml b/.github/workflows/build-test-deploy.yml
new file mode 100644
index 0000000..8a7a188
--- /dev/null
+++ b/.github/workflows/build-test-deploy.yml
@@ -0,0 +1,39 @@
+name: build-test-deploy
+
+# Only invoke on merges to `main`
+on:
+  pull_request:
+  push:
+    branches:
+      - "*"
+    tags:
+      - "**"
+  workflow_dispatch: {}
+
+permissions:
+  contents: read
+
+env:
+  RUST_VERSION: "1"
+
+# Stop any prior work that may have been in progress
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - name: Set up rust
+        uses: dtolnay/rust-toolchain@stable
+      - name: Check format
+        run: |
+          cargo fmt --version
+          cargo fmt --all --check
+          cargo audit
+      - name: Run tests
+        run: cargo test --all-targets
+
+
diff --git a/Cargo.toml b/Cargo.toml
index f807536..1048ed0 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -14,14 +14,14 @@ keywords = ["http-ece", "web-push"]
 [dependencies]
 byteorder = "1.3"
 thiserror = "2.0"
-base64 = "0.22"
+base64 = "0.23"
 hex = "0.4"
-hkdf = { version = "0.12", optional = true }
+hkdf = { version = "0.13", optional = true }
 lazy_static = { version = "1.5", optional = true }
 once_cell = "1.21"
 openssl = { version = "0.10", optional = true }
 serde = { version = "1.0", features = ["derive"], optional = true }
-sha2 = { version = "0.10", optional = true }
+sha2 = { version = "0.11", optional = true }
 
 [features]
 default = ["backend-openssl", "serializable-keys"]
diff --git a/src/aes128gcm.rs b/src/aes128gcm.rs
index f966415..d861a25 100644
--- a/src/aes128gcm.rs
+++ b/src/aes128gcm.rs
@@ -202,7 +202,7 @@ impl<'a> Header<'a> {
 
         let salt = &input[0..ECE_SALT_LENGTH];
         let rs = BigEndian::read_u32(&input[ECE_SALT_LENGTH..]);
-        if rs < ECE_AES128GCM_MIN_RS || rs > ECE_AES128GCM_MAX_RS {
+        if !(ECE_AES128GCM_MIN_RS..ECE_AES128GCM_MAX_RS).contains(&rs) {
             return Err(Error::InvalidRecordSize);
         }
         let keyid = &input[ECE_AES128GCM_HEADER_LENGTH..ECE_AES128GCM_HEADER_LENGTH + keyid_len];
@@ -382,7 +382,7 @@ fn split_into_records(
     // Ensure we have enough padding to give at least one byte of it to each record.
     // This is the only reason why we might expand the padding beyond what was requested.
     let mut min_num_records = plaintext.len() / (rs - 1);
-    if plaintext.len() % (rs - 1) != 0 {
+    if !plaintext.len().is_multiple_of(rs - 1) {
         min_num_records += 1;
     }
     let pad_length = std::cmp::max(pad_length, min_num_records);
@@ -486,7 +486,7 @@ impl<'a> Iterator for PlaintextRecordIterator<'a> {
                 // The extra plaintext must be distributed as evenly as possible
                 // amongst all but the final record.
                 let mut extra_share = self.extra_plaintext / (records_remaining - 1);
-                if self.extra_plaintext % (records_remaining - 1) != 0 {
+                if !self.extra_plaintext.is_multiple_of(records_remaining - 1) {
                     extra_share += 1;
                 }
                 plaintext_share += extra_share;