diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..4aafe85
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,74 @@
+name: CI
+on:
+  pull_request:
+  push:
+    branches: [main]
+  # release.yml runs this on the tagged commit before publishing
+  workflow_call:
+permissions:
+  contents: read
+jobs:
+  # Format, lint and test the library with each crypto provider
+  check:
+    strategy:
+      fail-fast: false
+      matrix:
+        provider: [crypto-ring, crypto-aws-lc]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt, clippy
+      - name: Format
+        run: cargo fmt --all -- --check
+      - name: Clippy
+        run: cargo clippy -p sfio-rustls-config --all-targets --features ${{ matrix.provider }} -- -D warnings
+      - name: Test
+        run: cargo test -p sfio-rustls-config --features ${{ matrix.provider }}
+  # The verifier tests in the tests crate, with each crypto provider
+  integration:
+    strategy:
+      fail-fast: false
+      matrix:
+        provider: [crypto-ring, crypto-aws-lc]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy
+      - name: Clippy
+        run: cargo clippy -p tests --all-targets --no-default-features --features ${{ matrix.provider }} -- -D warnings
+      - name: Test
+        run: cargo test -p tests --no-default-features --features ${{ matrix.provider }}
+  # Build with the rust-version declared in lib/Cargo.toml
+  msrv:
+    strategy:
+      fail-fast: false
+      matrix:
+        provider: [crypto-ring, crypto-aws-lc]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+      - name: Install Rust 1.85
+        uses: dtolnay/rust-toolchain@1.85
+      - name: Check
+        run: cargo check -p sfio-rustls-config --features ${{ matrix.provider }}
+  # Fail on any advisory against the dependencies
+  audit:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@stable
+      - name: Install cargo-audit
+        run: cargo install cargo-audit --locked
+      - name: Audit
+        run: cargo generate-lockfile && cargo audit
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..f91ecf7
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,38 @@
+name: Release
+# Pushing a tag equal to the crate version (e.g. 0.4.1) publishes it to crates.io using trusted
+# publishing: crates.io trusts this workflow, so no API token is stored in the repository
+on:
+  push:
+    tags: ["*"]
+permissions:
+  contents: read
+jobs:
+  # every CI check must pass on the tagged commit
+  ci:
+    uses: ./.github/workflows/ci.yml
+  publish:
+    needs: ci
+    runs-on: ubuntu-latest
+    environment: crates-io
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@stable
+      - name: Check the tag matches the crate version
+        run: |
+          version=$(cargo metadata --no-deps --format-version 1 | jq -r '.packages[] | select(.name == "sfio-rustls-config") | .version')
+          if [ "$version" != "$GITHUB_REF_NAME" ]; then
+            echo "tag $GITHUB_REF_NAME doesn't match the crate version $version"
+            exit 1
+          fi
+      - name: Authenticate with crates.io
+        id: auth
+        uses: rust-lang/crates-io-auth-action@v1
+      - name: Publish
+        run: cargo publish -p sfio-rustls-config --features crypto-ring
+        env:
+          CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}
diff --git a/CHANGELOG.md b/CHANGELOG.md
index c94358d..34049a1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,9 @@
+# 0.4.1
+* :bug: Remove a debug `println!` that wrote the client certificate verification result to stdout on every handshake of a server using authority-based client verification.
+* :wrench: Set `rust-version` to 1.85, the minimum the current dependencies require.
+* :wrench: Build the docs.rs documentation with the `crypto-ring` provider, since the crate requires one.
+* :wrench: Run CI on every change, and publish releases from CI with crates.io trusted publishing.
+
 # 0.4.0
 * :wrench: Make `ring` or `aws-lc-rs` configurable via features
 
diff --git a/clippy.toml b/clippy.toml
new file mode 100644
index 0000000..4b6c79f
--- /dev/null
+++ b/clippy.toml
@@ -0,0 +1,4 @@
+allow-unwrap-in-tests = true
+allow-expect-in-tests = true
+allow-panic-in-tests = true
+allow-indexing-slicing-in-tests = true
diff --git a/lib/Cargo.toml b/lib/Cargo.toml
index fe64e9f..7533d4e 100644
--- a/lib/Cargo.toml
+++ b/lib/Cargo.toml
@@ -1,13 +1,13 @@
 [package]
 name = "sfio-rustls-config"
-version = "0.4.0"
+version = "0.4.1"
 license = "MIT OR Apache-2.0"
 edition = "2021"
 description = "Configuration routines for Rustls used in libraries from Step Function I/O"
 repository = "https://github.com/stepfunc/rustls-config"
 readme = "README.md"
 authors = ["Step Function I/O LLC <info@stepfunc.io>"]
-rust-version = "1.74"
+rust-version = "1.85"
 
 [dependencies]
 pem = { version = "^3.0" }
@@ -17,6 +17,10 @@ rustls = { version = "0.23", default-features = false, features = ["std", "loggi
 rustls-pki-types =  { version = "1.11.0" }
 rustls-webpki = { version = "0.103.1", default-features = false, features = ["std"] }
 
+[package.metadata.docs.rs]
+# the crate requires exactly one crypto provider
+features = ["crypto-ring"]
+
 [features]
 default = []
 crypto-ring = ["rustls/ring", "rustls-webpki/ring"]
@@ -34,7 +38,18 @@ unused_crate_dependencies = "deny"
 missing_copy_implementations = "deny"
 
 [lints.clippy]
-all = "deny"
+all = { level = "deny", priority = -1 }
+# no output except through the caller, and no panics in library code; clippy.toml allows
+# unwrap, expect, panic and indexing in tests
+print_stdout = "deny"
+print_stderr = "deny"
+dbg_macro = "deny"
+unwrap_used = "deny"
+expect_used = "deny"
+panic = "deny"
+indexing_slicing = "deny"
+arithmetic_side_effects = "deny"
+as_conversions = "deny"
 
 [lints.rustdoc]
 broken_intra_doc_links = "deny"
\ No newline at end of file
diff --git a/lib/README.md b/lib/README.md
index c092e86..d5dd48c 100644
--- a/lib/README.md
+++ b/lib/README.md
@@ -1,4 +1,15 @@
 # Description
 
 Configuration routines for [rustls](https://github.com/rustls/rustls) used by Step Function's commercial [DNP3](https://github.com/stepfunc/dnp3)
-and [Modbus](https://github.com/stepfunc/rodbus) libraries.
\ No newline at end of file
+and [Modbus](https://github.com/stepfunc/rodbus) libraries.
+
+# Usage
+
+Enable exactly one crypto provider, `crypto-ring` or `crypto-aws-lc`:
+
+```toml
+[dependencies]
+sfio-rustls-config = { version = "0.4", features = ["crypto-ring"] }
+```
+
+Requires Rust 1.85 or later.
\ No newline at end of file
diff --git a/lib/src/server.rs b/lib/src/server.rs
index 5b9be07..a59749c 100644
--- a/lib/src/server.rs
+++ b/lib/src/server.rs
@@ -121,7 +121,7 @@ impl ClientCertVerifier for ClientNameVerifier {
             .base_verifier
             .verify_client_cert(end_entity, intermediates, now)?;
 
-        let res = match &self.verification {
+        match &self.verification {
             ClientNameVerification::None => {
                 // we're done
                 Ok(verified)
@@ -130,11 +130,7 @@ impl ClientCertVerifier for ClientNameVerifier {
             ClientNameVerification::SanOrCommonName(x) => {
                 self.verify_client_name(end_entity, x, true)
             }
-        };
-
-        println!("client result: {res:?}");
-
-        res
+        }
     }
 
     fn verify_tls12_signature(
diff --git a/tests/Cargo.toml b/tests/Cargo.toml
index b0c0033..548e4fa 100644
--- a/tests/Cargo.toml
+++ b/tests/Cargo.toml
@@ -5,10 +5,16 @@ edition = "2021"
 publish = false
 
 [dependencies]
-sfio-rustls-config = { path = "../lib", default-features = false, features = ["crypto-aws-lc"] }
-tokio-rustls = { version = "0.26", default-features = false, features = ["aws-lc-rs"] }
+sfio-rustls-config = { path = "../lib", default-features = false }
+tokio-rustls = { version = "0.26", default-features = false }
 tokio = { version = "1.44", features = ["test-util", "net", "rt", "macros"] }
 
+# exactly one provider, as for the library
+[features]
+default = ["crypto-aws-lc"]
+crypto-aws-lc = ["sfio-rustls-config/crypto-aws-lc", "tokio-rustls/aws-lc-rs"]
+crypto-ring = ["sfio-rustls-config/crypto-ring", "tokio-rustls/ring"]
+
 [[test]]
 name = "test_verifiers"
 path = "src/test_verifiers.rs"