diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index cd3a3bbff1..e5bd5699c8 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -12,14 +12,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
-      - name: Install Python 3.8
-        uses: actions/setup-python@v4
-        with:
-          python-version: '3.8'
       - name: Install Python 3.11
         uses: actions/setup-python@v4
         with:
           python-version: '3.11'
+      - name: Install Python 3.12
+        uses: actions/setup-python@v4
+        with:
+          python-version: '3.12'
       - name: Cache the .tox directory to speed things up
         uses: actions/cache@v3
         with:
diff --git a/.platform/hooks/prebuild/01_install.sh b/.platform/hooks/prebuild/01_install.sh
index e6f7ad5b8b..e96b4cb530 100755
--- a/.platform/hooks/prebuild/01_install.sh
+++ b/.platform/hooks/prebuild/01_install.sh
@@ -4,9 +4,9 @@
 set -eux
 
 # Install libffi-devel for misaka, and htop for when I want to look at what's going on
-yum install -y libffi-devel htop
+dnf install -y libffi-devel htop
 # Install PostgreSQL client tools and libraries
-amazon-linux-extras install -y postgresql11
+dnf install -y postgresql15
 
 # Automatically set the PG* environment variables so that `psql` connects to the liberapay database by default
 install -m 644 -o root -g root -t /etc/profile.d .platform/files/pgenv.sh
@@ -18,7 +18,7 @@ install -m 644 -o root -g root -t /etc/systemd/system .platform/files/webapp@.so
 systemctl daemon-reload
 
 # Install cloudflared, directly from GitHub
-target_cfd_version="2021.11.0"
+target_cfd_version="2023.10.0"
 function get_installed_cfd_version() {
     if [ -x /usr/local/bin/cloudflared ]; then
         /usr/local/bin/cloudflared version | \
@@ -34,7 +34,7 @@ if [ "$installed_cfd_version" != "$target_cfd_version" ]; then
     fi
     wget "https://github.com/cloudflare/cloudflared/releases/download/$target_cfd_version/cloudflared-linux-amd64"
     hash=$(sha256sum cloudflared-linux-amd64 | cut -d' ' -f1)
-    expected_hash=cce5bc7df0187e93291135d32d159b1acd86d9ca25c3e448b8bbeab2ce976b8e
+    expected_hash=33e6876bd55c2db13a931cf812feb9cb17c071ab45d3b50c588642b022693cdc
     if [ $hash != $expected_hash ]; then
         echo "cloudflared binary downloaded from GitHub doesn't match expected hash: $hash != $expected_hash"
         exit 1
diff --git a/Makefile b/Makefile
index a44d8ad0bb..3b08c57183 100644
--- a/Makefile
+++ b/Makefile
@@ -1,4 +1,4 @@
-python := "$(shell { command -v python3.8 || command -v python3 || command -v python || echo false; } 2>/dev/null)"
+python := "$(shell { command -v python3.11 || command -v python3 || command -v python || echo false; } 2>/dev/null)"
 
 # Set the relative path to installed binaries under the project virtualenv.
 # NOTE: Creating a virtualenv on Windows places binaries in the 'Scripts' directory.
@@ -20,7 +20,7 @@ $(env): Makefile requirements*.txt
 		exit 1; \
 	fi;
 	@$(python) cli/check-python-version.py
-	$(python) -m venv $(env)
+	$(python) -m venv --upgrade-deps $(env)
 	$(pip) install wheel
 	$(pip) install --require-hashes -r requirements_base.txt
 	$(pip) install -r requirements_tests.txt
@@ -67,7 +67,7 @@ test-schema: $(env)
 	$(with_tests_env) ./recreate-schema.sh test
 
 pyflakes: $(env)
-	$(env_bin)/python -m flake8 app.py liberapay tests
+	$(env_py) -m flake8 app.py liberapay tests
 
 test: test-schema pytest
 tests: test
@@ -99,7 +99,7 @@ _i18n_extract: $(env)
 		grep -E '^(liberapay/.+\.py|.+\.(spt|html))$$' | \
 		python -c "import sys; print(*sorted(sys.stdin, key=lambda l: l.rsplit('/', 1)))" \
 	)
-	@$(env_bin)/python cli/po-tools.py reflag i18n/core.pot
+	@$(env_py) cli/po-tools.py reflag i18n/core.pot
 	@for f in i18n/*/*.po; do \
 		$(env_bin)/pybabel update -i i18n/core.pot -l $$(basename -s '.po' "$$f") -o "$$f" --ignore-obsolete --no-fuzzy-matching --no-wrap; \
 	done
@@ -120,7 +120,7 @@ _i18n_clean: $(env)
 	done
 
 _i18n_convert: $(env)
-	@$(env_bin)/python cli/convert-chinese.py
+	@$(env_py) cli/convert-chinese.py
 
 i18n_update: _i18n_rebase _i18n_pull _i18n_extract _i18n_convert _i18n_clean
 	@if git commit --dry-run i18n &>/dev/null; then \
@@ -161,7 +161,7 @@ _i18n_merge:
 	git reset -q master -- i18n
 	@for f in i18n/*/*.po; do \
 		if test $$(sed -E -e '/\\n"$$/{d;d}' $$f | grep -c -E '^"' 2>/dev/null) -gt 10; then \
-			$(env_bin)/python cli/po-tools.py reformat $$f; \
+			$(env_py) cli/po-tools.py reformat $$f; \
 		fi \
 	done
 	@$(MAKE) --no-print-directory _i18n_clean
diff --git a/README.md b/README.md
index b16044a22a..8336121d62 100644
--- a/README.md
+++ b/README.md
@@ -73,7 +73,7 @@ The python code inside simplates is only for request-specific logic, common back
 
 Make sure you have the following dependencies installed first:
 
-- python ≥ 3.8
+- python ≥ 3.11
   - including the C headers of python and libffi, which are packaged separately in many Linux distributions
 - postgresql 13 (see [the official download & install docs](https://www.postgresql.org/download/))
 - make
diff --git a/cli/check-python-version.py b/cli/check-python-version.py
index 1e178a37b6..abba54df3c 100644
--- a/cli/check-python-version.py
+++ b/cli/check-python-version.py
@@ -1,7 +1,7 @@
 import sys
 
-if sys.version_info < (3, 8, 0):
-    print("Liberapay requires Python >= 3.8, but %s is version %s.%s" %
+if sys.version_info < (3, 11, 0):
+    print("Liberapay requires Python >= 3.11, but %s is version %s.%s" %
           (sys.executable, sys.version_info[0], sys.version_info[1]))
     sys.exit(1)
 if sys.version_info >= (3, 13, 0):
diff --git a/requirements_base.txt b/requirements_base.txt
index c11cbc94a8..05becd1e99 100644
--- a/requirements_base.txt
+++ b/requirements_base.txt
@@ -403,12 +403,7 @@ cryptography==41.0.6 \
         --hash=sha256:13ae38502be632115abf8a24cbe5f4da52e3b5231990aff31123c805306ccb9c \
         --hash=sha256:db4e40728b728508912cbb3d44f19ce188f218e9eba635821bb4b68564f8fd67
 
-OpenCC==1.1.3; python_version < '3.10' \
-    --hash=sha256:2d1043e4d19ac89656b83e027f1834451ee0639d27239b579ba0b7cbb24af805 \
-    --hash=sha256:3aadc356b3b67dead0614fd47530351130eddf0d45b9889a5b58dd888c945640 \
-    --hash=sha256:48309ed913fde331f43beea36ca74252f1e279ee98d149f8509151a2252adbca \
-    --hash=sha256:c0a85bb12f362903241a53c767838fe09d494c4caffe12797157bdd8133b7e6e
-OpenCC==1.1.7; python_version >= '3.10' \
+OpenCC==1.1.7 \
     --hash=sha256:06092f06e4b8a1f2563df03214c9f6fa457c9ff6d114f76bf9fb374cc2a4591f \
     --hash=sha256:253e7d636ad0aad2e70e616d2185181e0104687f53ec38974f7b67221c475382 \
     --hash=sha256:3ed6f128383375b9dc5c3db02ffa9d6ac1a14242656414bab85a18ef65daf645 \
diff --git a/tox.ini b/tox.ini
index dbd2543b70..e923fb32c9 100644
--- a/tox.ini
+++ b/tox.ini
@@ -1,5 +1,5 @@
 [tox]
-envlist = py38,py311
+envlist = py311,py312
 skipsdist = True
 
 [testenv]