diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
new file mode 100644
index 0000000..ca71212
--- /dev/null
+++ b/.github/workflows/test.yml
@@ -0,0 +1,63 @@
+name: Test
+
+on:
+  push:
+    branches:
+      - main
+      - ci
+  pull_request:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+env:
+  # https://github.com/actions/setup-go/issues/491
+  GOTOOLCHAIN: local
+
+jobs:
+  test:
+    strategy:
+      # Default is true, cancels jobs for other platforms in the matrix if one fails
+      fail-fast: true
+      matrix:
+        os:
+          - ubuntu-latest
+        go:
+          - '1.25.2'
+
+    runs-on: ${{ matrix.os }}
+    permissions:
+      contents: read
+      pull-requests: read
+      actions: write # to allow uploading artifacts and cache
+    steps:
+    - name: Harden the runner (Audit all outbound calls)
+      uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+      with:
+        egress-policy: audit
+
+    - name: Checkout code
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+
+    - name: Install Go
+      uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
+      with:
+        go-version: ${{ matrix.go }}
+        check-latest: true
+
+    - name: Get dependencies
+      run: |
+        go get -v
+
+    - name: Download MaxMindDB binary
+      run: |
+        wget https://git.io/GeoLite2-Country.mmdb
+
+    # Commented bits below were useful to allow the job to continue
+    # even if the tests fail, so we can publish the report separately
+    # For info about set-output, see https://stackoverflow.com/questions/57850553/github-actions-check-steps-status
+    - name: Run tests
+      run: |
+        go test -v -failfast ./...
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
deleted file mode 100644
index ca56ecb..0000000
--- a/.github/workflows/tests.yml
+++ /dev/null
@@ -1,69 +0,0 @@
-name: "Tests"
-
-permissions:
-  contents: read
-  pull-requests: write
-  
-on:
-  push:
-    branches: ["main"]
-  pull_request:
-    branches: ["main"]
-
-jobs:
-  tests:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Set up Go
-        uses: actions/setup-go@v5
-        with:
-          go-version: "1.24.2"
-
-      - name: Get Dependencies
-        run: go get -v ./...
-        
-      - name: Get Caddy Dependencies
-        run: |
-          go get github.com/caddyserver/caddy/v2/modules/caddyhttp/templates@v2.9.1
-          go get github.com/caddyserver/caddy/v2/modules/caddyhttp/proxyprotocol@v2.9.1
-          go get github.com/caddyserver/caddy/v2/modules/caddyhttp/tracing@v2.9.1
-          go get github.com/caddyserver/caddy/v2/modules/caddypki/acmeserver@v2.9.1
-          go get github.com/smallstep/certificates/acme@v0.26.1
-          
-      - name: Build Caddy
-        run: |
-          go build -v -o caddy github.com/caddyserver/caddy/v2/cmd/caddy
-          
-      - name: Tidy modules
-        run: go mod tidy
-
-      - name: Build
-        run: go build -v ./...
-   
-      - name: Test
-        id: test
-        run: |
-          test_output=$(go test -v -count=1 ./... 2>&1)
-          echo "test_output<<EOF" >> $GITHUB_STEP_SUMMARY
-          echo "$test_output" >> $GITHUB_STEP_SUMMARY
-          echo "EOF" >> $GITHUB_STEP_SUMMARY
-      
-          passed_count=$(echo "$test_output" | grep "PASS:" | wc -l)
-          failed_count=$(echo "$test_output" | grep "FAIL:" | wc -l)
-      
-          echo "passed=$passed_count" >> $GITHUB_ENV
-          echo "failed=$failed_count" >> $GITHUB_ENV
-          
-      - name: Test Summary
-        if: always()
-        run: |
-          echo "Test Results:"
-          echo "Passed Tests: ${{ steps.test.outputs.passed }}"
-          echo "Failed Tests: ${{ steps.test.outputs.failed }}"
-      
-      - name: Fail if tests failed
-        if: steps.test.outputs.failed != '0'
-        run: exit 1