diff --git a/.circleci/config.yml b/.circleci/config.yml
index be05410..9fa3306 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -7,13 +7,13 @@ version: 2.1
 jobs:
   build:
     docker:
-      - image: cimg/python:3.9
+      - image: cimg/python:3.11
 
     steps:
       - checkout
 
       - restore_cache:
-          key: venv-4-{{ .Branch }}-{{ checksum "requirements.txt" }}
+          key: venv-5-{{ .Branch }}-{{ checksum "requirements.txt" }}
 
       - run:
           name: Base dependencies
@@ -65,7 +65,7 @@ jobs:
             fi
 
       - save_cache:
-          key: venv-4-{{ .Branch }}-{{ checksum "requirements.txt" }}
+          key: venv-5-{{ .Branch }}-{{ checksum "requirements.txt" }}
           paths:
             - /home/circleci/.pyenv
             # Ideally we'd cache these, but they need root, and the cimg/python
diff --git a/app.yaml b/app.yaml
index d01732c..cef4b21 100644
--- a/app.yaml
+++ b/app.yaml
@@ -2,7 +2,7 @@
 
 # application: bridgy-federated
 
-runtime: python39
+runtime: python311
 
 # default_expiration: 1h
 
diff --git a/requirements.txt b/requirements.txt
index a2f506c..151296c 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -6,6 +6,7 @@ git+https://github.com/snarfed/granary.git#egg=granary
 git+https://github.com/snarfed/dag-json.git#egg=dag_json
 git+https://github.com/snarfed/httpsig.git@HTTPSignatureAuth-sign-header#egg=httpsig
 git+https://github.com/snarfed/lexrpc.git#egg=lexrpc
+git+https://github.com/snarfed/mox3.git#egg=mox3
 git+https://github.com/snarfed/negotiator.git@py3#egg=negotiator
 git+https://github.com/snarfed/oauth-dropins.git#egg=oauth_dropins
 
@@ -64,7 +65,6 @@ lxml==4.9.3
 MarkupSafe==2.1.3
 mf2py==1.1.3
 mf2util==0.5.2
-mox3==1.1.0
 multiformats==0.2.1
 multiformats-config==0.2.0.post4
 oauthlib==3.2.2