diff --git a/composer.json b/composer.json
index fbe51eb..5eb45d5 100644
--- a/composer.json
+++ b/composer.json
@@ -26,7 +26,7 @@
         "phpstan/phpstan": "^1.2",
         "phpstan/phpstan-phpunit": "^1.0",
         "phpstan/phpstan-strict-rules": "^1.0",
-        "phpunit/phpunit": "^9.0",
+        "phpunit/phpunit": "^10.5 || ^11.0",
         "squizlabs/php_codesniffer": "^3.4"
     },
     "config": {
diff --git a/phpunit.xml.dist b/phpunit.xml.dist
index cdeb067..3900dd3 100644
--- a/phpunit.xml.dist
+++ b/phpunit.xml.dist
@@ -1,24 +1,17 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<phpunit xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-         xsi:noNamespaceSchemaLocation="https://schema.phpunit.de/7.0/phpunit.xsd"
-         bootstrap="vendor/autoload.php"
-         forceCoversAnnotation="true"
-         backupGlobals="true"
-         beStrictAboutCoversAnnotation="false"
-         beStrictAboutOutputDuringTests="true"
-         beStrictAboutTodoAnnotatedTests="true"
-         verbose="true">
-    <testsuite name="default">
-        <directory suffix="Test.php">tests</directory>
-    </testsuite>
-
-    <filter>
-        <whitelist processUncoveredFilesFromWhitelist="true">
-            <directory suffix=".php">src</directory>
-        </whitelist>
-    </filter>
-
-    <logging>
-        <log type="coverage-clover" target="build/logs/clover.xml" />
-    </logging>
+<phpunit xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="https://schema.phpunit.de/11.2/phpunit.xsd" bootstrap="vendor/autoload.php" backupGlobals="true" beStrictAboutOutputDuringTests="true" cacheDirectory=".phpunit.cache" requireCoverageMetadata="true" beStrictAboutCoverageMetadata="false">
+  <coverage>
+    <report>
+      <clover outputFile="build/logs/clover.xml"/>
+    </report>
+  </coverage>
+  <testsuite name="default">
+    <directory suffix="Test.php">tests</directory>
+  </testsuite>
+  <logging/>
+  <source>
+    <include>
+      <directory suffix=".php">src</directory>
+    </include>
+  </source>
 </phpunit>
diff --git a/tests/CodecTest.php b/tests/CodecTest.php
index 85fb78f..7d16150 100644
--- a/tests/CodecTest.php
+++ b/tests/CodecTest.php
@@ -6,10 +6,11 @@
 
 use Firehed\Security\Secret;
 use PHPUnit\Framework\TestCase;
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\Small;
 
-/**
- * @covers Codec
- */
+#[CoversClass(Codec::class)]
+#[Small]
 class CodecTest extends TestCase
 {
     private Codec $codec;
diff --git a/tests/JWTTest.php b/tests/JWTTest.php
index 53bf352..e718bdd 100644
--- a/tests/JWTTest.php
+++ b/tests/JWTTest.php
@@ -6,17 +6,21 @@
 use Error;
 use Firehed\Security\Secret;
 use RuntimeException;
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\DataProvider;
+use PHPUnit\Framework\Attributes\DoesNotPerformAssertions;
+use PHPUnit\Framework\Attributes\Small;
+use PHPUnit\Framework\TestCase;
 
-/**
- * @covers Firehed\JWT\JWT
- */
-class JWTTest extends \PHPUnit\Framework\TestCase
+#[CoversClass(JWT::class)]
+#[Small]
+class JWTTest extends TestCase
 {
 
     /**
-     * @dataProvider vectors
      * @param array<string, mixed> $exp_claims
      */
+    #[DataProvider('vectors')]
     public function testDecode(string $vector, array $exp_claims, KeyContainer $keys): void
     {
         $JWT = JWT::fromEncoded($vector, $keys);
@@ -70,9 +74,9 @@ public function testDecodeThrowsWithNonDictClaims(): void
     }
 
     /**
-     * @dataProvider vectors
      * @param array<string, mixed> $claims
      */
+    #[DataProvider('vectors')]
     public function testEncode(string $vector, array $claims, KeyContainer $keys): void
     {
         $tok = new JWT($claims);
@@ -203,9 +207,7 @@ public function testModifiedAlgorithmTriggersInvalidSignature(): void
         $jwt->getClaims();
     }
 
-    /**
-     * @doesNotPerformAssertions
-     */
+    #[DoesNotPerformAssertions]
     public function testConstruct(): void
     {
         $jwt = new JWT(['foo' => 'bar']);
@@ -224,7 +226,7 @@ public function testSetKeysReturnsthis(): void
     /**
      * @return array{string, array<string, mixed>, KeyContainer, bool}[]
      */
-    public function vectors(): array
+    public static function vectors(): array
     {
         // [
         //  encoded JWT,
diff --git a/tests/KeyContainerTest.php b/tests/KeyContainerTest.php
index 18d88f5..d0517df 100644
--- a/tests/KeyContainerTest.php
+++ b/tests/KeyContainerTest.php
@@ -5,10 +5,13 @@
 
 use Firehed\Security\Secret;
 
-/**
- * @covers Firehed\JWT\KeyContainer
- */
-class KeyContainerTest extends \PHPUnit\Framework\TestCase
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\Small;
+use PHPUnit\Framework\TestCase;
+
+#[CoversClass(KeyContainer::class)]
+#[Small]
+class KeyContainerTest extends TestCase
 {
     public function testSetDefaultKeyReturnsThis(): void
     {
diff --git a/tests/SessionHandlerTest.php b/tests/SessionHandlerTest.php
index 4bbd782..2baf2f0 100644
--- a/tests/SessionHandlerTest.php
+++ b/tests/SessionHandlerTest.php
@@ -5,28 +5,25 @@
 use Firehed\Security\Secret;
 use InvalidArgumentException;
 use OverflowException;
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\Small;
+use PHPUnit\Framework\TestCase;
 use SessionHandlerInterface;
 
-/**
- * @covers Firehed\JWT\SessionHandler
- */
-class SessionHandlerTest extends \PHPUnit\Framework\TestCase
+#[CoversClass(SessionHandler::class)]
+#[Small]
+class SessionHandlerTest extends TestCase
 {
 
     /**
      * Stores the data that would have gone to `setcookie`
-     * @var string
      */
-    private $cookieData = '';
+    private string $cookieData = '';
 
-    /** @var KeyContainer */
-    private $container;
+    private KeyContainer $container;
 
-    /** @var SessionHandlerInterface */
-    private $handler;
+    private SessionHandler $handler;
 
-    /**
-     */
     public function setUp(): void
     {
         $this->container = (new KeyContainer())