diff --git a/composer.json b/composer.json
index b5e2a9a..5eb2e74 100644
--- a/composer.json
+++ b/composer.json
@@ -29,7 +29,7 @@
     "require-dev": {
         "phpstan/phpstan": "^2.0",
         "phpstan/phpstan-strict-rules": "^2.0",
-        "phpunit/phpunit": "^7.0 || ^8.0 || ^9.0",
+        "phpunit/phpunit": "^11.0",
         "squizlabs/php_codesniffer": "^3.6"
     },
     "suggest": {
diff --git a/phpunit.xml b/phpunit.xml
index d816028..706250a 100644
--- a/phpunit.xml
+++ b/phpunit.xml
@@ -1,26 +1,24 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <phpunit xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-         xsi:noNamespaceSchemaLocation="https://schema.phpunit.de/9.5/phpunit.xsd"
+         xsi:noNamespaceSchemaLocation="https://schema.phpunit.de/11.5/phpunit.xsd"
          bootstrap="vendor/autoload.php"
-         cacheResultFile=".phpunit.cache/test-results"
+         cacheDirectory=".phpunit.cache"
          executionOrder="depends,defects"
-         forceCoversAnnotation="true"
-         beStrictAboutCoversAnnotation="false"
+         requireCoverageMetadata="true"
+         beStrictAboutCoverageMetadata="false"
          beStrictAboutOutputDuringTests="true"
-         beStrictAboutTodoAnnotatedTests="true"
+         displayDetailsOnAllIssues="true"
          failOnRisky="true"
-         failOnWarning="true"
-         verbose="true">
+         failOnWarning="true">
     <testsuites>
         <testsuite name="default">
             <directory>tests</directory>
         </testsuite>
     </testsuites>
 
-    <coverage cacheDirectory=".phpunit.cache/code-coverage"
-              processUncoveredFiles="true">
+    <source>
         <include>
             <directory suffix=".php">src</directory>
         </include>
-    </coverage>
+    </source>
 </phpunit>
diff --git a/tests/HOTPTest.php b/tests/HOTPTest.php
index 0cda16d..3ea4f34 100644
--- a/tests/HOTPTest.php
+++ b/tests/HOTPTest.php
@@ -4,10 +4,12 @@
 
 namespace Firehed\Security;
 
-/**
- * @covers Firehed\Security\OTP
- * @covers Firehed\Security\HOTP
- */
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\CoversFunction;
+use PHPUnit\Framework\Attributes\DataProvider;
+
+#[CoversClass(OTP::class)]
+#[CoversFunction('Firehed\Security\HOTP')]
 class HOTPTest extends \PHPUnit\Framework\TestCase
 {
     /**
@@ -17,7 +19,7 @@ class HOTPTest extends \PHPUnit\Framework\TestCase
      *
      * @return array{Secret, int, string}[]
      */
-    public function vectors(): array
+    public static function vectors(): array
     {
         $secret = new Secret('12345678901234567890');
         return [
@@ -34,9 +36,7 @@ public function vectors(): array
         ];
     }
 
-    /**
-     * @dataProvider vectors
-     */
+    #[DataProvider('vectors')]
     public function testHOTP(Secret $secret, int $counter, string $out): void
     {
         self::assertSame(
diff --git a/tests/SecretKeyTest.php b/tests/SecretKeyTest.php
index f6a219d..439ddbf 100644
--- a/tests/SecretKeyTest.php
+++ b/tests/SecretKeyTest.php
@@ -4,9 +4,9 @@
 
 namespace Firehed\Security;
 
-/**
- * @covers Firehed\Security\SecretKey
- */
+use PHPUnit\Framework\Attributes\CoversClass;
+
+#[CoversClass(SecretKey::class)]
 class SecretKeyTest extends \PHPUnit\Framework\TestCase
 {
     public function testGetKey(): void
diff --git a/tests/SecretTest.php b/tests/SecretTest.php
index f9d9cb9..d1eef87 100644
--- a/tests/SecretTest.php
+++ b/tests/SecretTest.php
@@ -4,9 +4,9 @@
 
 namespace Firehed\Security;
 
-/**
- * @covers Firehed\Security\Secret
- */
+use PHPUnit\Framework\Attributes\CoversClass;
+
+#[CoversClass(Secret::class)]
 class SecretTest extends \PHPUnit\Framework\TestCase
 {
     public function testConstruct(): void
diff --git a/tests/TOTPTest.php b/tests/TOTPTest.php
index a9421bc..173382e 100644
--- a/tests/TOTPTest.php
+++ b/tests/TOTPTest.php
@@ -4,10 +4,12 @@
 
 namespace Firehed\Security;
 
-/**
- * @covers Firehed\Security\OTP
- * @covers Firehed\Security\TOTP
- */
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\CoversFunction;
+use PHPUnit\Framework\Attributes\DataProvider;
+
+#[CoversClass(OTP::class)]
+#[CoversFunction('Firehed\Security\TOTP')]
 class TOTPTest extends \PHPUnit\Framework\TestCase
 {
     /**
@@ -15,7 +17,7 @@ class TOTPTest extends \PHPUnit\Framework\TestCase
      *
      * @return array{int, string, 'sha1'|'sha256'|'sha512', Secret}[]
      */
-    public function TOTPvectors(): array
+    public static function TOTPvectors(): array
     {
         // It's unclear that the token is of varying length based on the
         // algoritm being used, but that's definitely the case
@@ -46,9 +48,9 @@ public function TOTPvectors(): array
     }
 
     /**
-     * @dataProvider TOTPvectors
      * @param 'sha1'|'sha256'|'sha512' $algo
      */
+    #[DataProvider('TOTPvectors')]
     public function testTOTPVectors(
         int $ts,
         string $expectedOut,