diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index afe229a..c19fb66 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -17,20 +17,21 @@ jobs:
         python: ['3.8', '3.9', '3.10', '3.11', '3.12-dev']
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
       - name: Setup python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v5
         with:
           python-version: '${{ matrix.python }}'
       - name: Run tests
         run: ./ci.sh
         shell: bash
       - name: "Upload coverage data"
-        uses: "actions/upload-artifact@v3"
+        uses: "actions/upload-artifact@v4"
         with:
-          name: coverage-data
-          path: "empty/.coverage.*"
-          if-no-files-found: error
+          name: coverage-data-windows-${{ matrix.python }}
+          path: .coverage.*
+          include-hidden-files: true
+          if-no-files-found: ignore
 
   Ubuntu:
     name: 'Ubuntu (${{ matrix.python }})'
@@ -42,19 +43,20 @@ jobs:
         python: ['3.8', '3.9', '3.10', '3.11', '3.12-dev', 'pypy3.9', 'pypy-3.10']
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
       - name: Setup python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v5
         with:
           python-version: '${{ matrix.python }}'
       - name: Run tests
         run: ./ci.sh
       - name: "Upload coverage data"
-        uses: "actions/upload-artifact@v3"
+        uses: "actions/upload-artifact@v4"
         with:
-          name: coverage-data
-          path: "empty/.coverage.*"
-          if-no-files-found: error
+          name: coverage-data-ubuntu-${{ matrix.python }}
+          path: .coverage.*
+          include-hidden-files: true
+          if-no-files-found: ignore
 
   macOS:
     name: 'macOS (${{ matrix.python }})'
@@ -66,40 +68,55 @@ jobs:
         python: ['3.8', '3.9', '3.10', '3.11', '3.12-dev']
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
       - name: Setup python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v5
         with:
           python-version: '${{ matrix.python }}'
       - name: Run tests
         run: ./ci.sh
       - name: "Upload coverage data"
-        uses: "actions/upload-artifact@v3"
+        uses: "actions/upload-artifact@v4"
         with:
-          name: coverage-data
-          path: "empty/.coverage.*"
-          if-no-files-found: error
+          name: coverage-data-macos-${{ matrix.python }}
+          path: .coverage.*
+          include-hidden-files: true
+          if-no-files-found: ignore
 
   coverage:
+    name: Combine & check coverage
     if: always()
     runs-on: "ubuntu-latest"
     needs: ["Windows", "Ubuntu", "macOS"]
+
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - name: "Use latest Python so it understands all syntax"
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v5
         with:
           python-version: "3.x"
 
-      - name: "Install coverage"
-        run: "python -m pip install --upgrade coverage[toml]"
-
-      - name: "Download coverage data"
-        uses: actions/download-artifact@v3
+      - uses: actions/download-artifact@v4
         with:
-          name: coverage-data
+          pattern: coverage-data-*
+          merge-multiple: true
 
-      - name: "Combine & check coverage"
+      - name: Combine coverage & fail if it's <100%
         run: |
-          python -m coverage combine
-          python -m coverage report --ignore-errors --show-missing --fail-under=100
+          python -Im pip install --upgrade coverage[toml]
+
+          python -Im coverage combine
+          python -Im coverage html --skip-covered --skip-empty
+
+          # Report and write to summary.
+          python -Im coverage report --format=markdown >> $GITHUB_STEP_SUMMARY
+
+          # Report again and fail if under 100%.
+          python -Im coverage report --fail-under=100
+
+      - name: Upload HTML report if check failed
+        uses: actions/upload-artifact@v4
+        with:
+          name: html-report
+          path: htmlcov
+        if: ${{ failure() }}
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 947a7d3..dd4872f 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -13,9 +13,9 @@ jobs:
     runs-on: 'ubuntu-latest'
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
       - name: Setup python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v5
         with:
           python-version: '3.x'
       - name: Run lint
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 64fb4e7..97eaaa2 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -16,9 +16,9 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9  # v3.5.3
+        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
       - name: Setup python
-        uses: actions/setup-python@bd6b4b6205c4dbad673328db7b31b7fab9e241c0  # v4.6.1
+        uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5.2.0
         with:
           python-version: 3.x
       - name: Install dependencies
@@ -26,7 +26,7 @@ jobs:
       - name: Build dists
         run: python -m build
       - name: Upload dists
-        uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce  # v3.1.2
+        uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
         with:
           name: "dist"
           path: "dist/"
@@ -44,9 +44,9 @@ jobs:
 
     steps:
       - name: Download dists
-        uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a  # v3.0.2
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
         with:
           name: "dist"
           path: "dist/"
       - name: Publish package distributions to PyPI
-        uses: pypa/gh-action-pypi-publish@f5622bde02b04381239da3573277701ceca8f6a0  # v1.8.7
+        uses: pypa/gh-action-pypi-publish@f7600683efdcb7656dec5b29656edb7bc586e597 # v1.10.3
diff --git a/ci.sh b/ci.sh
index 1b5f230..17c2cc4 100755
--- a/ci.sh
+++ b/ci.sh
@@ -14,8 +14,7 @@ python -m pip install dist/*.zip
 
 python -m pip install -Ur test-requirements.txt
 if [ -n "${OLD_CRYPTOGRAPHY:-}" ]; then
-    python -m pip install cryptography=="${OLD_CRYPTOGRAPHY}"
+  python -m pip install cryptography=="${OLD_CRYPTOGRAPHY}"
 fi
-mkdir empty
-pushd empty
-coverage run --parallel-mode -m pytest -W error -ra -s ../tests
+
+coverage run --parallel-mode -m pytest -W error -ra -s tests
diff --git a/pyproject.toml b/pyproject.toml
index 74b54c0..5bc78c9 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -39,15 +39,15 @@ warn_unused_ignores = true
 
 [tool.coverage.run]
 branch = true
-omit = ["*/setup.py"]
+omit = ["*/trustme/__main__.py"]
 source = ["trustme"]
 
 [tool.coverage.paths]
-source = ["trustme", "*/trustme", "*\\trustme"]
+source = ["src/trustme", "*/trustme", "*\\trustme"]
 
 [tool.coverage.setup]
 precision = 1
 exclude_lines = [
-  "pragma: no cover",
+  "pragma: no cover.*",
   "if TYPE_CHECKING:"
 ]
diff --git a/src/trustme/_cli.py b/src/trustme/_cli.py
index 3e73673..714673b 100644
--- a/src/trustme/_cli.py
+++ b/src/trustme/_cli.py
@@ -12,7 +12,7 @@
 
 def main(argv: Optional[List[str]] = None) -> None:
     if argv is None:
-        argv = sys.argv[1:]
+        argv = sys.argv[1:]  # pragma: no cover (used in tests)
 
     parser = argparse.ArgumentParser(prog="trustme")
     parser.add_argument(