diff --git a/.circleci/config.yml b/.circleci/config.yml
new file mode 100644
index 0000000..c6287da
--- /dev/null
+++ b/.circleci/config.yml
@@ -0,0 +1,109 @@
+version: 2.1
+
+_references:
+  ruby_versions: &ruby_versions
+    ruby-version:
+      - "3.3.0"
+      - "3.2.2"
+      - "3.1.4"
+      - "3.0.6"
+  rails_version_prefixess: &rails_version_prefixes
+    rails-version-prefix:
+      - "7.1"
+      - "7.0"
+      - "6.1"
+
+orbs:
+  ruby: circleci/ruby@2.1.0
+
+jobs:
+  test:
+    parameters:
+      ruby-version:
+        type: string
+      rails-version-prefix:
+        type: string
+
+    executor:
+      name: ruby/default
+      tag: <<parameters.ruby-version>>
+    environment:
+      RAILS_VERSION_PREFIX: <<parameters.rails-version-prefix>>
+    steps:
+      - checkout
+      - ruby/install-deps:
+          # Have to set this since there's no lockfile
+          bundler-version: ">2"
+          # Do not use deployment mode, because we don't have a lockfile
+          path: "bundle"
+          # Always install the latest versions available
+          with-cache: false
+      - ruby/rspec-test
+  test-ruby-head:
+    parameters:
+      rails-version-prefix:
+        type: string
+    docker:
+      - image: cimg/base:stable
+    environment:
+      RAILS_VERSION: <<parameters.rails-version-prefix>>
+    steps:
+      - checkout
+      - ruby/install:
+          # RVM wants Ruby 2 for some reason to install Ruby head.
+          # But then it will use 2.7.8 by default in the future;
+          # we must use `rvm use ruby-head` before every command that matters
+          version: "2.7.8"
+      - ruby/install:
+          version: ruby-head
+      - restore_cache:
+          keys:
+            - v1-{{ arch }}-ruby-head-bundler
+      - run:
+          name: Install Ruby dependencies
+          command: |
+            rvm use ruby-head
+            ruby --version
+            gem install bundler
+            bundle config set path bundle
+            bundle update
+      - save_cache:
+          key: v1-{{ arch }}-ruby-head-bundler
+          paths:
+            - ./bundle
+      - run:
+          name: RSpec tests
+          command: |
+            rvm use ruby-head
+            ruby --version
+            mkdir -p /tmp/test-results/rspec
+            bundle exec rspec --profile 10 --format RspecJunitFormatter --out /tmp/test-results/rspec/results.xml --format progress
+      - store_test_results:
+          path: /tmp/test-results/rspec
+
+workflows:
+  test:
+    jobs:
+      - test:
+          name: "test-ruby-<<matrix.ruby-version>>-rails-<<matrix.rails-version-prefix>>"
+          matrix:
+            parameters:
+              <<: *ruby_versions
+              <<: *rails_version_prefixes
+  test-head:
+    jobs:
+      - test:
+          name: "test-ruby-<<matrix.ruby-version>>-rails-main"
+          matrix:
+            parameters:
+              <<: *ruby_versions
+              rails-version-prefix:
+                - main
+            exclude:
+              - ruby-version: 3.0.6
+                rails-version-prefix: main
+      - test-ruby-head:
+          name: "test-ruby-head-rails-<<matrix.rails-version-prefix>>"
+          matrix:
+            parameters:
+              <<: *rails_version_prefixes
diff --git a/.github/workflows/pr-security.yaml b/.github/workflows/pr-security.yaml
deleted file mode 100644
index 708a53b..0000000
--- a/.github/workflows/pr-security.yaml
+++ /dev/null
@@ -1,32 +0,0 @@
----
-# onemedical/<repo>/.github/workflows/pr-security.yaml
-#
-# This is the workflow for distribution to repositories across the organization.
-# It will call the reusable PR security workflow, and run scans against each PR.
-name: PR Security
-
-
-# yamllint disable-line rule:truthy
-on:
-  pull_request:
-    branches: [main, master]
-
-
-permissions:
-  # Required for workflows in private repositories.
-  contents: read
-
-  # Required for SARIF results upload to GHAS.
-  security-events: write
-  actions: read
-
-
-jobs:
-  # Run the reusable workflow.
-  run-workflow:
-    name: Run Workflow
-    # yamllint disable-line rule:line-length
-    uses: onemedical/github-reusable-workflows/.github/workflows/reusable-pr-security.yaml@main
-    # The detect-secrets tool is used in some repositories, and generates false
-    # positives like the one below. Add comment to ignore.
-    secrets: inherit  # pragma: allowlist secret
diff --git a/Gemfile b/Gemfile
index 669f0e7..31e2630 100644
--- a/Gemfile
+++ b/Gemfile
@@ -1,5 +1,15 @@
-ruby '3.2.2'
-
 source 'https://rubygems.org'
 
 gemspec
+
+# Lock Rails down in the matrix build, but not by default
+rails_version_prefix = ENV.fetch("RAILS_VERSION_PREFIX", nil)
+if rails_version_prefix == "main"
+  gem "activesupport", github: "rails/rails", branch: "main"
+  gem "activerecord", github: "rails/rails", branch: "main"
+  gem "railties", github: "rails/rails", branch: "main"
+elsif rails_version_prefix
+  gem "activesupport", "~> #{rails_version_prefix}.0"
+  gem "activerecord", "~> #{rails_version_prefix}.0"
+  gem "railties", "~> #{rails_version_prefix}.0"
+end
diff --git a/acts_as_scrubbable.gemspec b/acts_as_scrubbable.gemspec
index 172fb29..a089153 100644
--- a/acts_as_scrubbable.gemspec
+++ b/acts_as_scrubbable.gemspec
@@ -27,6 +27,7 @@ Gem::Specification.new do |s|
   s.add_development_dependency 'pry-byebug'   , '~> 3.2'
   s.add_development_dependency 'terminal-notifier-guard' , '~> 1.6'
   s.add_development_dependency 'activerecord-nulldb-adapter', '~> 1.0'
+  s.add_development_dependency 'rspec_junit_formatter'
 
   s.files         = `git ls-files`.split("\n")
   s.test_files    = `git ls-files -- spec/*`.split("\n")