diff --git a/.env.ci b/.env.ci
new file mode 100644
index 000000000..3cbb60ab0
--- /dev/null
+++ b/.env.ci
@@ -0,0 +1,5 @@
+# overrides for .env.example for CI
+SECRET_KEY=beepbeep
+USE_DUMMY_CACHE=true
+EMAIL_HOST_USER=
+EMAIL_HOST_PASSWORD=
diff --git a/.github/workflows/django-tests.yml b/.github/workflows/django-tests.yml
index 78b6e142e..c5d5c1b29 100644
--- a/.github/workflows/django-tests.yml
+++ b/.github/workflows/django-tests.yml
@@ -7,64 +7,17 @@ on:
 
 jobs:
   build:
+    runs-on: ubuntu-latest
+    env:
+      COMPOSE_FILE: "docker-compose.yml:docker-compose.ci.yml"
+      COMPOSE_ENV_FILES: ".env.example:.env.ci"
 
-    runs-on: ubuntu-20.04
-    services:
-      postgres:
-        image: postgres:13
-        env:
-          POSTGRES_USER: postgres
-          POSTGRES_PASSWORD: hunter2
-        options: >-
-          --health-cmd pg_isready
-          --health-interval 10s
-          --health-timeout 5s
-          --health-retries 5
-        ports:
-          - 5432:5432
     steps:
-    - uses: actions/checkout@v3
-    - name: Set up Python
-      uses: actions/setup-python@v4
-      with:
-        python-version: 3.9
-    - name: Install Dependencies
-      run: |
-        python -m pip install --upgrade pip
-        pip install -r requirements.txt
-    - name: Check migrations up-to-date
-      run: |
-        python ./manage.py makemigrations --check
-      env:
-        SECRET_KEY: beepbeep
-        DOMAIN: your.domain.here
-        EMAIL_HOST: ""
-        EMAIL_HOST_USER: ""
-        EMAIL_HOST_PASSWORD: ""
-    - name: Run Tests
-      env:
-        SECRET_KEY: beepbeep
-        DEBUG: false
-        USE_HTTPS: true
-        DOMAIN: your.domain.here
-        BOOKWYRM_DATABASE_BACKEND: postgres
-        MEDIA_ROOT: images/
-        POSTGRES_PASSWORD: hunter2
-        POSTGRES_USER: postgres
-        POSTGRES_DB: github_actions
-        POSTGRES_HOST: 127.0.0.1
-        CELERY_BROKER: ""
-        REDIS_BROKER_PORT: 6379
-        REDIS_BROKER_PASSWORD: beep
-        USE_DUMMY_CACHE: true
-        FLOWER_PORT: 8888
-        EMAIL_HOST: "smtp.mailgun.org"
-        EMAIL_PORT: 587
-        EMAIL_HOST_USER: ""
-        EMAIL_HOST_PASSWORD: ""
-        EMAIL_USE_TLS: true
-        ENABLE_PREVIEW_IMAGES: false
-        ENABLE_THUMBNAIL_GENERATION: true
-        HTTP_X_FORWARDED_PROTO: false
-      run: |
-        pytest -n 3
+    - name: Checkout code
+      uses: actions/checkout@v3
+    - name: Build Docker images
+      run: docker-compose build
+    - name: Check if migrations are up-to-date
+      run: docker-compose run web python manage.py makemigrations --check
+    - name: Run pytest
+      run: docker-compose run web pytest -n 3
diff --git a/bw-dev b/bw-dev
index e888cc6fb..a84c73f34 100755
--- a/bw-dev
+++ b/bw-dev
@@ -28,6 +28,7 @@ if docker compose &> /dev/null ; then
 else
 	DOCKER_COMPOSE="docker-compose"
 fi
+DOCKER_COMPOSE_CI="$DOCKER_COMPOSE --env-file .env.example --env-file .env.ci -f docker-compose.yml -f docker-compose.ci.yml"
 
 function clean {
     $DOCKER_COMPOSE stop
@@ -38,6 +39,10 @@ function runweb {
     $DOCKER_COMPOSE run --rm web "$@"
 }
 
+function runwebci {
+    $DOCKER_COMPOSE_CI run --rm web "$@"
+}
+
 function execdb {
     $DOCKER_COMPOSE exec db $@
 }
@@ -126,11 +131,11 @@ case "$CMD" in
         ;;
     pytest)
         prod_error
-        runweb pytest --no-cov-on-fail "$@"
+        runwebci pytest --no-cov-on-fail "$@"
         ;;
     pytest_coverage_report)
         prod_error
-        runweb pytest -n 3 --cov-report term-missing "$@"
+        runwebci pytest -n 3 --cov-report term-missing "$@"
         ;;
     compile_themes)
         runweb python manage.py compile_themes
diff --git a/docker-compose.ci.yml b/docker-compose.ci.yml
new file mode 100644
index 000000000..052252782
--- /dev/null
+++ b/docker-compose.ci.yml
@@ -0,0 +1,38 @@
+version: '3'
+
+# Pass the variables defined in .env.example and .env.ci to the containers
+# instead of .env (which is ignored).
+
+services:
+  db:
+    env_file:
+      - .env.example
+      - .env.ci
+  web:
+    env_file:
+      - .env.example
+      - .env.ci
+  redis_activity:
+    env_file:
+      - .env.example
+      - .env.ci
+  redis_broker:
+    env_file:
+      - .env.example
+      - .env.ci
+  celery_worker:
+    env_file:
+      - .env.example
+      - .env.ci
+  celery_beat:
+    env_file:
+      - .env.example
+      - .env.ci
+  flower:
+    env_file:
+      - .env.example
+      - .env.ci
+  dev-tools:
+    env_file:
+      - .env.example
+      - .env.ci
diff --git a/docker-compose.override.yml b/docker-compose.override.yml
new file mode 100644
index 000000000..665fd73b1
--- /dev/null
+++ b/docker-compose.override.yml
@@ -0,0 +1,27 @@
+version: '3'
+
+services:
+  db:
+    env_file:
+      - .env
+  web:
+    env_file:
+      - .env
+  redis_activity:
+    env_file:
+      - .env
+  redis_broker:
+    env_file:
+      - .env
+  celery_worker:
+    env_file:
+      - .env
+  celery_beat:
+    env_file:
+      - .env
+  flower:
+    env_file:
+      - .env
+  dev-tools:
+    env_file:
+      - .env
diff --git a/docker-compose.yml b/docker-compose.yml
index 4d4037681..9b4d8e9e9 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,5 +1,8 @@
 version: '3'
 
+# This file is merged with docker-compose.ci.yml for CI, and with
+# docker-compose.override.yml for all other purposes.
+
 services:
   nginx:
     image: nginx:1.25.2
@@ -16,14 +19,12 @@ services:
       - media_volume:/app/images
   db:
     image: postgres:13
-    env_file: .env
     volumes:
       - pgdata:/var/lib/postgresql/data
     networks:
       - main
   web:
     build: .
-    env_file: .env
     command: python manage.py runserver 0.0.0.0:8000
     volumes:
       - .:/app
@@ -43,7 +44,6 @@ services:
     volumes:
       - ./redis.conf:/etc/redis/redis.conf
       - redis_activity_data:/data
-    env_file: .env
     networks:
       - main
     restart: on-failure
@@ -53,12 +53,10 @@ services:
     volumes:
       - ./redis.conf:/etc/redis/redis.conf
       - redis_broker_data:/data
-    env_file: .env
     networks:
       - main
     restart: on-failure
   celery_worker:
-    env_file: .env
     build: .
     networks:
       - main
@@ -73,7 +71,6 @@ services:
       - redis_broker
     restart: on-failure
   celery_beat:
-    env_file: .env
     build: .
     networks:
       - main
@@ -88,7 +85,6 @@ services:
   flower:
     build: .
     command: celery -A celerywyrm flower --basic_auth=${FLOWER_USER}:${FLOWER_PASSWORD} --url_prefix=flower
-    env_file: .env
     volumes:
       - .:/app
     networks:
@@ -99,7 +95,6 @@ services:
     restart: on-failure
   dev-tools:
     build: dev-tools
-    env_file: .env
     volumes:
       - /app/dev-tools/
       - .:/app
diff --git a/pytest.ini b/pytest.ini
index b50efd602..fa9dbc59f 100644
--- a/pytest.ini
+++ b/pytest.ini
@@ -4,25 +4,3 @@ python_files = tests.py test_*.py *_tests.py
 addopts = --cov=bookwyrm --cov-config=.coveragerc
 markers =
     integration: marks tests as requiring external resources (deselect with '-m "not integration"')
-
-env =
-    LANGUAGE_CODE = en-US
-    SECRET_KEY = beepbeep
-    DEBUG = false
-    USE_HTTPS = true
-    DOMAIN = your.domain.here
-    BOOKWYRM_DATABASE_BACKEND = postgres
-    MEDIA_ROOT = images/
-    CELERY_BROKER = ""
-    REDIS_BROKER_PORT = 6379
-    REDIS_BROKER_PASSWORD = beep
-    REDIS_ACTIVITY_PORT = 6379
-    REDIS_ACTIVITY_PASSWORD = beep
-    USE_DUMMY_CACHE = true
-    FLOWER_PORT = 8888
-    EMAIL_HOST = "smtp.mailgun.org"
-    EMAIL_PORT = 587
-    EMAIL_HOST_USER = ""
-    EMAIL_HOST_PASSWORD = ""
-    EMAIL_USE_TLS = true
-    ENABLE_PREVIEW_IMAGES = false