diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
new file mode 100644
index 0000000..2eae9da
--- /dev/null
+++ b/.github/workflows/build.yml
@@ -0,0 +1,55 @@
+# Build + unit tests. Replaces the abandoned Travis config, which fetched a Maven
+# distribution over the network with no integrity check (CWE-494).
+#
+# Rules for this file:
+#   * every third-party action is pinned by full commit SHA, never a mutable tag;
+#   * Maven comes from the runner image / setup-java, never an ad-hoc download;
+#   * `-C` makes Maven FAIL (not warn) on a checksum mismatch for any artifact.
+name: Build
+
+on:
+  pull_request:
+    branches: ["master", "main"]
+  push:
+    branches: ["master", "main"]
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        java: ['8', '11', '17']
+    name: build (JDK ${{ matrix.java }})
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
+        with:
+          distribution: temurin
+          java-version: ${{ matrix.java }}
+          cache: maven
+
+      # -C = strict checksum policy: a checksum mismatch on any resolved artifact
+      # fails the build instead of printing a warning.
+      #
+      # -DskipTests still COMPILES the tests (it only skips running them), so this
+      # job covers what CI can actually prove here: the enforcer rules, every pinned
+      # plugin version, and that main + test sources compile at source/target 1.7 on
+      # each JDK.
+      #
+      # The tests themselves are deliberately NOT run. They are credential-gated
+      # live-integration tests, not offline units: 12 of the 14 reach
+      # LocalBinary.getBinary(), which downloads the real BrowserStackLocal binary
+      # from an authenticated endpoint and returns HTTP 401 without
+      # BROWSERSTACK_ACCESS_KEY. A keyless runner therefore cannot pass them, and
+      # wiring a key in would both run real tunnels on every push and still fail for
+      # pull requests from forks (which get no secrets).
+      #
+      # To run the full suite locally:
+      #   BROWSERSTACK_ACCESS_KEY=... BROWSERSTACK_USERNAME=... mvn -B -C test
+      - name: Build (compile, tests skipped - see above)
+        run: mvn -B -C -Dgpg.skip -DskipTests clean verify
diff --git a/.travis.yml b/.travis.yml
deleted file mode 100644
index 7a7f809..0000000
--- a/.travis.yml
+++ /dev/null
@@ -1,23 +0,0 @@
-language: java
-
-addons:
-  apt:
-    packages:
-      - openjdk-6-jdk
-      
-jdk:
-  - openjdk6
-  - oraclejdk8
-  - openjdk7
-  - openjdk8
- 
-install:
-  - echo "Downloading Maven 3.0";
-  - wget https://archive.apache.org/dist/maven/binaries/apache-maven-3.0-bin.zip || travis_terminate 1
-  - unzip -qq apache-maven-3.0-bin.zip || travis_terminate 1
-  - export M2_HOME=$PWD/apache-maven-3.0
-  - export PATH=$M2_HOME/bin:$PATH
-  - mvn -version
-  - mvn clean package install -DskipTests -Dgpg.skip
-
-after_failure: cat /home/travis/build/browserstack/browserstack-local-java/target/surefire-reports/*
diff --git a/README.md b/README.md
index ea0369d..6f5b642 100644
--- a/README.md
+++ b/README.md
@@ -1,7 +1,5 @@
 # browserstack-local-java
 
-[![Build Status](https://travis-ci.org/browserstack/browserstack-local-java.svg?branch=master)](https://travis-ci.org/browserstack/browserstack-local-java)
-
 Java bindings for BrowserStack Local.
 
 ## Installation
diff --git a/pom.xml b/pom.xml
index 25a77c2..7f34677 100644
--- a/pom.xml
+++ b/pom.xml
@@ -16,6 +16,13 @@
         </license>
     </licenses>
 
+    <properties>
+        <!-- Without this the build uses the platform default encoding, so the same
+             source produces different bytes on different machines. -->
+        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
+        <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
+    </properties>
+
     <developers>
         <developer>
             <name>BrowserStack</name>
@@ -72,6 +79,7 @@
                     <plugin>
                         <groupId>org.apache.maven.plugins</groupId>
                         <artifactId>maven-gpg-plugin</artifactId>
+                        <version>3.2.8</version>
                         <executions>
                             <execution>
                                 <id>sign-artifacts</id>
@@ -96,6 +104,7 @@
                     <plugin>
                         <groupId>org.apache.maven.plugins</groupId>
                         <artifactId>maven-source-plugin</artifactId>
+                        <version>3.4.0</version>
                         <executions>
                             <execution>
                                 <id>attach-sources</id>
@@ -108,6 +117,7 @@
                     <plugin>
                         <groupId>org.apache.maven.plugins</groupId>
                         <artifactId>maven-javadoc-plugin</artifactId>
+                        <version>3.12.0</version>
                         <executions>
                             <execution>
                                 <id>attach-javadocs</id>
@@ -126,6 +136,46 @@
     </profiles>
 
     <build>
+        <!-- Maven binds these six to the lifecycle itself. Left unpinned they take
+             whatever the running Maven distribution's super-POM happens to default to
+             (Maven 3.8.6 gives jar 2.4 / resources 2.6 / install 2.4 / deploy 2.7 /
+             clean 2.5 / site 3.3, all circa 2013) — so the same source builds with a
+             different plugin set on a different machine. Pinning them makes the build
+             reproducible and retires the 2013 versions. -->
+        <pluginManagement>
+            <plugins>
+                <plugin>
+                    <groupId>org.apache.maven.plugins</groupId>
+                    <artifactId>maven-clean-plugin</artifactId>
+                    <version>3.5.0</version>
+                </plugin>
+                <plugin>
+                    <groupId>org.apache.maven.plugins</groupId>
+                    <artifactId>maven-resources-plugin</artifactId>
+                    <version>3.5.0</version>
+                </plugin>
+                <plugin>
+                    <groupId>org.apache.maven.plugins</groupId>
+                    <artifactId>maven-jar-plugin</artifactId>
+                    <version>3.5.1</version>
+                </plugin>
+                <plugin>
+                    <groupId>org.apache.maven.plugins</groupId>
+                    <artifactId>maven-install-plugin</artifactId>
+                    <version>3.1.4</version>
+                </plugin>
+                <plugin>
+                    <groupId>org.apache.maven.plugins</groupId>
+                    <artifactId>maven-deploy-plugin</artifactId>
+                    <version>3.1.4</version>
+                </plugin>
+                <plugin>
+                    <groupId>org.apache.maven.plugins</groupId>
+                    <artifactId>maven-site-plugin</artifactId>
+                    <version>3.22.0</version>
+                </plugin>
+            </plugins>
+        </pluginManagement>
         <plugins>
             <plugin>
                 <groupId>org.sonatype.central</groupId>
@@ -138,10 +188,51 @@
                     <autoPublish>false</autoPublish>
                 </configuration>
             </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-enforcer-plugin</artifactId>
+                <version>3.6.3</version>
+                <executions>
+                    <execution>
+                        <id>enforce-deterministic-dependencies</id>
+                        <phase>validate</phase>
+                        <goals>
+                            <goal>enforce</goal>
+                        </goals>
+                        <configuration>
+                            <rules>
+                                <!-- No version ranges / LATEST / RELEASE: every
+                                     coordinate resolves to the same artifact on
+                                     every build, on every machine. -->
+                                <banDynamicVersions>
+                                    <allowSnapshots>false</allowSnapshots>
+                                    <allowLatest>false</allowLatest>
+                                    <allowRelease>false</allowRelease>
+                                    <allowRanges>false</allowRanges>
+                                </banDynamicVersions>
+                                <requireReleaseDeps>
+                                    <message>No SNAPSHOT dependencies allowed.</message>
+                                </requireReleaseDeps>
+                                <!-- Every plugin must carry an explicit version, so a new
+                                     upstream release cannot silently enter the build (this
+                                     is what used to happen on the gpg/source/javadoc
+                                     signing path). -->
+                                <requirePluginVersions>
+                                    <banLatest>true</banLatest>
+                                    <banRelease>true</banRelease>
+                                    <banSnapshots>true</banSnapshots>
+                                    <phases>clean,deploy,site</phases>
+                                </requirePluginVersions>
+                            </rules>
+                            <fail>true</fail>
+                        </configuration>
+                    </execution>
+                </executions>
+            </plugin>
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-compiler-plugin</artifactId>
-                <version>2.3.2</version>
+                <version>3.14.1</version>
                 <configuration>
                     <source>1.7</source>
                     <target>1.7</target>
@@ -150,7 +241,7 @@
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-surefire-plugin</artifactId>
-                <version>2.4.2</version>
+                <version>3.5.6</version>
             </plugin>
         </plugins>
     </build>