diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c6033c2b..2fe47d07 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -8,18 +8,63 @@ on:
 
 env:
   FORCE_COLOR: "1"
+  OS_LIST: '["ubuntu-20.04", "windows-latest", "macos-latest"]'
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
 jobs:
+
+  nox_data:
+    name: Query nox
+    runs-on: ubuntu-latest
+    outputs:
+      tests_matrix: ${{ steps.generate.outputs.tests_matrix }}
+      lint_python_version: ${{ steps.generate.outputs.lint_python_version }}
+      # our noxfile does not have an opinion about the python version for these:
+      docs_python_version: "3.9"
+      cover_python_version: "3.11"
+    steps:
+      - uses: actions/checkout@v4
+      - name: Set up Python 3.11
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+      - name: Install Nox-under-test
+        run: |
+          python -m pip install --disable-pip-version-check .
+      - name: Save nox sessions to json
+        run: |
+          nox -l --json >> nox_sessions.json
+      - name: Generate output variables
+        id: generate
+        run: |
+          jq 'map(select(.name == "tests")) | map({"python-version": .python, "tox-version": .call_spec.tox_version})' nox_sessions.json >> tests.json
+          : # Unfortunately, Adding OSes to `strategy:matrix:os` and the python/tox versions to `strategy:matrix:include` does not
+          : # combine as advertised so we have to make the combinations ourselves.
+          : # https://github.com/orgs/community/discussions/67591#discussioncomment-7402927
+          echo $OS_LIST | jq 'map({"os": .})' >> oses.json
+          : # -s places the contents of each json file (each of which contains a list) into the first two elements of a list.
+          : # 'combinations' loops creates a pair of objects for each combination in the two lists.
+          : # 'add' fuses each of the pairs of objects into a single object.
+          : # -c -j creates single line output.
+          OUTPUT=$(jq -c -j -s '[ combinations | add ]' tests.json oses.json)
+          echo "tests_matrix=$OUTPUT" >> "$GITHUB_OUTPUT"
+          echo $OUTPUT
+
+          OUTPUT=$(jq -c -j 'map(select(.name == "lint")) | map(.python) | .[0]' nox_sessions.json)
+          echo "lint_python_version=$OUTPUT" >> "$GITHUB_OUTPUT"
+          echo $OUTPUT
+
   build:
+    needs: nox_data
+    name: build (${{ matrix.os }}, py-${{ matrix.python-version }}, tox ${{ matrix.tox-version }})
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
-        os: [ubuntu-20.04, windows-latest, macos-latest]
-        python-version: ["3.7", "3.8", "3.9", "3.10", "3.11", "3.12"]
+        include: ${{ fromJSON(needs.nox_data.outputs.tests_matrix) }}
+
     steps:
       - uses: actions/checkout@v4
       - name: Set up Python ${{ matrix.python-version }}
@@ -36,11 +81,9 @@ jobs:
       - name: Install Nox-under-test
         run: |
           python -m pip install --disable-pip-version-check .
-      - name: Run tests on ${{ matrix.os }} (tox <4)
-        run: nox --non-interactive --error-on-missing-interpreter --session "tests(python='${{ matrix.python-version }}', tox_version='<4')" -- --full-trace
-      - name: Run tox-to-nox tests on ${{ matrix.os }} (tox latest)
-        run: nox --non-interactive --error-on-missing-interpreter --session "tests(python='${{ matrix.python-version }}', tox_version='latest')" -- tests/test_tox_to_nox.py --full-trace
-        if: matrix.python-version != '3.7'
+      - name: Run tests on ${{ matrix.os }} (tox ${{ matrix.tox-version }})
+        run: |
+          nox --non-interactive --error-on-missing-interpreter --session "tests(python='${{ matrix.python-version }}', tox_version='${{ matrix.tox-version }}')" -- --full-trace
       - name: Save coverage report
         uses: actions/upload-artifact@v4
         with:
@@ -48,14 +91,14 @@ jobs:
           path: .coverage.*
 
   coverage:
-    needs: build
+    needs: [build, nox_data]
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - name: Set up Python 3.11
+      - name: Set up Python ${{ needs.nox_data.outputs.cover_python_version }}
         uses: actions/setup-python@v5
         with:
-          python-version: "3.11"
+          python-version: ${{ fromJSON(needs.nox_data.outputs.cover_python_version) }}
       - name: Install Nox-under-test
         run: |
           python -m pip install --disable-pip-version-check .
@@ -70,26 +113,28 @@ jobs:
         run: nox --non-interactive --session "cover"
 
   lint:
+    needs: nox_data
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - name: Set up Python 3.9
+      - name: Set up Python ${{ needs.nox_data.outputs.lint_python_version }}
         uses: actions/setup-python@v5
         with:
-          python-version: 3.9
+          python-version: ${{ fromJSON(needs.nox_data.outputs.lint_python_version) }}
       - name: Install Nox-under-test
         run: |
           python -m pip install --disable-pip-version-check .
       - name: Lint
         run: nox --non-interactive --error-on-missing-interpreter --session "lint"
   docs:
+    needs: nox_data
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - name: Set up Python 3.9
+      - name: Set up Python ${{ needs.nox_data.outputs.docs_python_version }}
         uses: actions/setup-python@v5
         with:
-          python-version: 3.9
+          python-version: ${{ fromJSON(needs.nox_data.outputs.docs_python_version) }}
       - name: Install Nox-under-test
         run: |
           python -m pip install --disable-pip-version-check .
diff --git a/noxfile.py b/noxfile.py
index a7a665c7..e6cec17a 100644
--- a/noxfile.py
+++ b/noxfile.py
@@ -56,15 +56,20 @@ def tests(session: nox.Session, tox_version: str) -> None:
     session.create_tmp()  # Fixes permission errors on Windows
     session.install("-r", "requirements-test.txt")
     session.install("-e.[tox_to_nox]")
+    args = session.posargs
     if tox_version != "latest":
         session.install(f"tox{tox_version}")
+    elif not args:
+        # this ensures consistent behavior locally and in CI
+        args = ["tests/test_tox_to_nox.py"]
+
     session.run(
         "pytest",
         "--cov",
         "--cov-config",
         "pyproject.toml",
         "--cov-report=",
-        *session.posargs,
+        *args,
         env={
             "COVERAGE_FILE": coverage_file,
         },