diff --git a/.coveragerc b/.coveragerc
index a920d99..7235976 100644
--- a/.coveragerc
+++ b/.coveragerc
@@ -1,13 +1,28 @@
+# .coveragerc to control coverage.py
 [run]
+branch = True
 source = src
 omit = tests/*
 
+[paths]
+source =
+    src/
+    */site-packages/
+
 [report]
+# Regexes for lines to exclude from consideration
 exclude_lines =
+    # Have to re-enable the standard pragma
     pragma: no cover
+
+    # Don't complain about missing debug-only code:
     def __repr__
-    if self.debug:
+    if self\.debug
+
+    # Don't complain if tests don't hit defensive assertion code:
     raise AssertionError
     raise NotImplementedError
+
+    # Don't complain if non-runnable code isn't run:
     if 0:
     if __name__ == .__main__.:
diff --git a/.github/workflows/run-tests.yml b/.github/workflows/run-tests.yml
index eda83ea..ca79fe4 100644
--- a/.github/workflows/run-tests.yml
+++ b/.github/workflows/run-tests.yml
@@ -44,11 +44,12 @@ jobs:
           python-version: ${{ matrix.python }}
 
       - name: Install tox
-        run: python -m pip install tox
+        run: python -m pip install tox coverage
 
       - name: Run tests
-        run: |
-          tox -e default -- --cov --cov-branch --cov-report=xml
+        run: >-
+          tox
+          -- -rFEx --durations 10 --color yes --cov --cov-branch --cov-report=xml  # pytest args
 
       - name: Check for codecov token availability
         id: codecov-check
@@ -63,7 +64,7 @@ jobs:
       - name: Upload coverage reports to Codecov with GitHub Action
         uses: codecov/codecov-action@v7
         if: ${{ steps.codecov-check.outputs.codecov == 'true' }}
-        env:
-          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}
           slug: ${{ github.repository }}
           flags: ${{ matrix.platform }} - py${{ matrix.python }}
diff --git a/pyproject.toml b/pyproject.toml
index 94ac09c..dd69155 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -106,3 +106,7 @@ addopts = "--cov --cov-report term-missing"
 testpaths = [
     "tests",
 ]
+
+[tool.bandit]
+exclude_dirs = ["tests"]
+skips = ["B110"]