diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 886651d..425c2b5 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -6,35 +6,17 @@ permissions:
   contents: read
 
 env:
-  # Environment variables to support color support (jaraco/skeleton#66):
-  # Request colored output from CLI tools supporting it. Different tools
-  # interpret the value differently. For some, just being set is sufficient.
-  # For others, it must be a non-zero integer. For yet others, being set
-  # to a non-empty value is sufficient. For tox, it must be one of
-  # <blank>, 0, 1, false, no, off, on, true, yes. The only enabling value
-  # in common is "1".
+  # Environment variable to support color support (jaraco/skeleton#66)
   FORCE_COLOR: 1
-  # MyPy's color enforcement (must be a non-zero number)
-  MYPY_FORCE_COLOR: -42
-  # Recognized by the `py` package, dependency of `pytest` (must be "1")
-  PY_COLORS: 1
-  # Make tox-wrapped tools see color requests
-  TOX_TESTENV_PASSENV: >-
-    FORCE_COLOR
-    MYPY_FORCE_COLOR
-    NO_COLOR
-    PY_COLORS
-    PYTEST_THEME
-    PYTEST_THEME_MODE
 
   # Suppress noisy pip warnings
   PIP_DISABLE_PIP_VERSION_CHECK: 'true'
   PIP_NO_PYTHON_VERSION_WARNING: 'true'
   PIP_NO_WARN_SCRIPT_LOCATION: 'true'
 
-  # Disable the spinner, noise in GHA; TODO(webknjaz): Fix this upstream
-  # Must be "1".
-  TOX_PARALLEL_NO_SPINNER: 1
+  # Ensure tests can sense settings about the environment
+  TOX_OVERRIDE: >-
+    testenv.pass_env+=GITHUB_*,FORCE_COLOR
 
 
 jobs:
@@ -80,6 +62,24 @@ jobs:
       - name: Run
         run: tox
 
+  diffcov:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+      - name: Setup Python
+        uses: actions/setup-python@v4
+        with:
+          python-version: 3.x
+      - name: Install tox
+        run: |
+          python -m pip install tox
+      - name: Evaluate coverage
+        run: tox
+        env:
+          TOXENV: diffcov
+
   docs:
     runs-on: ubuntu-latest
     env:
diff --git a/setup.cfg b/setup.cfg
index c646ee5..71e0945 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -50,6 +50,8 @@ testing =
 docs =
 	# upstream
 	sphinx >= 3.5
+	# workaround for sphinx/sphinx-doc#11662
+	sphinx < 7.2.5
 	jaraco.packaging >= 9.3
 	rst.linker >= 1.9
 	furo
diff --git a/tox.ini b/tox.ini
index 12f8ce0..704c1c3 100644
--- a/tox.ini
+++ b/tox.ini
@@ -1,4 +1,5 @@
 [testenv]
+description = perform primary checks (tests, style, types, coverage)
 deps =
 	# workaround for numpy/numpy#23808
 	numpy @ git+https://github.com/rgommers/numpy@default-to-meson ; python_version >= "3.12"
@@ -10,7 +11,17 @@ usedevelop = True
 extras =
 	testing
 
+[testenv:diffcov]
+description = run tests and check that diff from main is covered
+deps =
+	diff-cover
+commands =
+	pytest {posargs} --cov-report xml
+	diff-cover coverage.xml --compare-branch=origin/main --html-report diffcov.html
+	diff-cover coverage.xml --compare-branch=origin/main --fail-under=100
+
 [testenv:docs]
+description = build the documentation
 extras =
 	docs
 	testing
@@ -20,6 +31,7 @@ commands =
 	python -m sphinxlint
 
 [testenv:finalize]
+description = assemble changelog and tag a release
 skip_install = True
 deps =
 	towncrier
@@ -30,6 +42,7 @@ commands =
 
 
 [testenv:release]
+description = publish the package to PyPI and GitHub
 skip_install = True
 deps =
 	build