diff --git a/.github/SECURITY.md b/.github/SECURITY.md
new file mode 100644
index 0000000..7d4f8bc
--- /dev/null
+++ b/.github/SECURITY.md
@@ -0,0 +1,10 @@
+# PyYAML Security Policy
+
+## Reporting a Suspected Vulnerability
+
+The PyYAML project encourages responsible disclosure of suspected security
+vulnerabilities. However, we do not offer bug bounties, paid disclosure, or
+paid fixes for discovered vulnerabilities. To report a suspected security
+vulnerability, please e-mail details to <security@pyyaml.org> without creating
+public issues, pull requests, or discussion. Non-security correspondence to
+this address will be ignored.
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index c67847b..160d8e4 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -1,4 +1,8 @@
 ---
+# This is the CI workflow (not the artifact build/release workflow). The workflows
+# are split because GHA doesn't support a dynamic/conditional matrix. This workflow
+# has slow jobs and jobs that require private GHA runners (eg, M1 Mac) commented out.defaults:
+# Ensure changes are synced with manual_artifact_build.yaml.
 name: PyYAML CI
 
 on:
@@ -13,10 +17,10 @@ env:
 
 jobs:
   python_sdist:
-    name: PyYAML sdist
+    name: pyyaml sdist
     runs-on: ubuntu-latest
     steps:
-    - name: Checkout pyyaml
+    - name: Checkout PyYAML
       uses: actions/checkout@v2
 
     - name: Install a python
@@ -24,18 +28,14 @@ jobs:
       with:
         python-version: 3.x
 
-    - name: Install build deps
+    - name: Build sdist
+      env:
+        PYYAML_FORCE_CYTHON: 1
+        PYYAML_FORCE_LIBYAML: 0
       run: |
         python -V
         python -m pip install build
 
-    - name: Build sdist
-      run: |
-        # We DO want to force Cythoning, at least until 6.0.
-        export PYYAML_FORCE_CYTHON=1
-        # We don't actually want to build the lib.
-        export PYYAML_FORCE_LIBYAML=0
-
         python -m build .
 
         # Ensure exactly one artifact was produced.
@@ -68,26 +68,28 @@ jobs:
 
 
   linux_libyaml:
-    name: libyaml ${{matrix.arch}} ${{matrix.platform}}
+    name: libyaml ${{matrix.cfg.arch}} ${{matrix.cfg.platform}}
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        platform:
-        # manylinux1 is forward-compatible to 2010/2014.
-        #- manylinux2014
-        #- manylinux2010
-        - manylinux1
-        arch:
-        - x86_64
+        cfg:
+        - { platform: manylinux1, arch: x86_64 }
+        - { platform: manylinux2014, arch: x86_64 }
+#        - { platform: manylinux2014, arch: aarch64 }
+#        - { platform: manylinux2014, arch: s390x }
     env:
-      DOCKER_IMAGE: quay.io/pypa/${{matrix.platform}}_${{matrix.arch}}
+      DOCKER_IMAGE: quay.io/pypa/${{matrix.cfg.platform}}_${{matrix.cfg.arch}}
     steps:
     - name: Check cached libyaml state
       id: cached_libyaml
       uses: actions/cache@v2
       with:
         path: libyaml
-        key: libyaml_${{matrix.platform}}_${{matrix.arch}}_${{env.LIBYAML_REF}}
+        key: libyaml_${{matrix.cfg.platform}}_${{matrix.cfg.arch}}_${{env.LIBYAML_REF}}
+
+    - name: configure docker foreign arch support
+      uses: docker/setup-qemu-action@v1
+      if: matrix.cfg.arch != 'x86_64' && steps.cached_libyaml.outputs.cache-hit != 'true'
 
     - name: Checkout pyyaml
       uses: actions/checkout@v2
@@ -104,39 +106,41 @@ jobs:
         /io/packaging/build/libyaml.sh
       if: steps.cached_libyaml.outputs.cache-hit != 'true'
 
+    - name: ensure output is world readable (or cache fill fails with Permission Denied)
+      run: >
+        sudo chmod -R a+r ./libyaml/
+      if: steps.cached_libyaml.outputs.cache-hit != 'true'
+
+
   linux_pyyaml:
     needs: linux_libyaml
-    name: pyyaml ${{matrix.arch}} ${{matrix.platform}} ${{matrix.python_tag}}
+    name: pyyaml ${{matrix.arch}} ${{matrix.platform}} ${{matrix.spec}}
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        platform:
-        # So long as manylinux1 container builds work, they're
-        # forward-compatible to 2010/2014.
-        # - manylinux2014
-        # - manylinux2010
-        - manylinux1
-        arch:
-        - x86_64
-        python_tag:
-        # NB manylinux >=2014 containers don't have Python 2.7, so we have to
-        # use exclude to skip it.
-        - cp27-cp27mu
-        - cp36-cp36m
-        - cp37-cp37m
-        - cp38-cp38
-        - cp39-cp39
-#        exclude:
-#        - platform: manylinux2014
-#          arch: x86_64
-#          python_tag: cp27-cp27mu
-    env:
-      AW_PLAT: ${{matrix.platform}}_${{matrix.arch}}
-      DOCKER_IMAGE: quay.io/pypa/${{matrix.platform}}_${{matrix.arch}}
-      PYTHON_TAG: ${{matrix.python_tag}}
-      PYYAML_BUILD_WHEELS: 1
+        include:
+        - { platform: manylinux1, arch: x86_64, spec: cp36 }
+#        - { platform: manylinux1, arch: x86_64, spec: cp37 }
+#        - { platform: manylinux1, arch: x86_64, spec: cp38 }
+#        - { platform: manylinux1, arch: x86_64, spec: cp39 }
+#        - { platform: manylinux2014, arch: x86_64, spec: cp310 }
+        - { platform: manylinux2014, arch: x86_64, spec: cp311 }
+#        - { platform: manylinux2014, arch: aarch64, spec: cp36 }
+#        - { platform: manylinux2014, arch: aarch64, spec: cp37 }
+#        - { platform: manylinux2014, arch: aarch64, spec: cp38 }
+#        - { platform: manylinux2014, arch: aarch64, spec: cp39 }
+#        - { platform: manylinux2014, arch: aarch64, spec: cp310 }
+#        - { platform: manylinux2014, arch: aarch64, spec: cp311 }
+#        - { platform: manylinux2014, arch: s390x, spec: cp36 }
+#        - { platform: manylinux2014, arch: s390x, spec: cp37 }
+#        - { platform: manylinux2014, arch: s390x, spec: cp38 }
+#        - { platform: manylinux2014, arch: s390x, spec: cp39 }
+#        - { platform: manylinux2014, arch: s390x, spec: cp310 }
+#        - { platform: manylinux2014, arch: s390x, spec: cp311 }
+
     steps:
-    - uses: actions/checkout@v2
+    - name: Checkout PyYAML
+      uses: actions/checkout@v2
 
     - name: Fetch cached libyaml
       id: cached_libyaml
@@ -149,75 +153,255 @@ jobs:
       run: exit 1
       if: steps.cached_libyaml.outputs.cache-hit != 'true'
 
-    - name: Start container
-      run: >
-        docker run --rm --tty --detach
-        --name worker
-        --volume "$(pwd):/io"
-        "$DOCKER_IMAGE"
-        bash
+    - name: configure docker foreign arch support
+      uses: docker/setup-qemu-action@v1
+      if: matrix.arch != 'x86_64'
 
     - name: Build/Test/Package
-      run: >
-        docker exec
-        --env PYTHON_TAG
-        --env PYYAML_RUN_TESTS
-        --env PYYAML_BUILD_WHEELS
-        --env AW_PLAT
-        --workdir /io worker
-        /io/packaging/build/manylinux.sh
+      env:
+        CIBW_ARCHS: all
+        CIBW_BUILD: ${{matrix.spec}}-manylinux_${{matrix.arch}}
+        CIBW_BUILD_VERBOSITY: 1
+        # containerized Linux builds require explicit CIBW_ENVIRONMENT
+        CIBW_ENVIRONMENT: >
+          C_INCLUDE_PATH=libyaml/include
+          LIBRARY_PATH=libyaml/src/.libs
+          LD_LIBRARY_PATH=libyaml/src/.libs
+          PYYAML_FORCE_CYTHON=1
+          PYYAML_FORCE_LIBYAML=1
+        CIBW_TEST_COMMAND: cd {project}; python tests/lib/test_all.py
+      run: |
+        set -eux
+        python3 -V
+        python3 -m pip install -U --user cibuildwheel
+        python3 -m cibuildwheel --platform auto --output-dir dist .
 
-    - uses: actions/upload-artifact@v2
+    - name: Upload artifacts
+      uses: actions/upload-artifact@v2
       with:
         name: dist
         path: dist/*.whl
+        if-no-files-found: error
 
   macos_libyaml:
-    name: libyaml ${{matrix.arch}} ${{matrix.platform}}
-    runs-on: ${{matrix.platform}}
+    name: libyaml macos ${{matrix.arch}}
     strategy:
       matrix:
-        platform:
-        - macos-10.15
-        arch:
-        - x86_64
+        include:
+        - arch: x86_64
+#        - arch: arm64
+#          runs_on: [self-hosted, macOS, arm64]
+#          deployment_target: '11.0'
+#          run_wrapper: arch -arm64 bash --noprofile --norc -eo pipefail {0}
+#          sdkroot: macosx11.3
+    defaults:
+      run:
+        shell: ${{ matrix.run_wrapper || 'bash --noprofile --norc -eo pipefail {0}' }}
+    runs-on: ${{ matrix.runs_on || 'macos-11' }}
     steps:
     - name: Check cached libyaml state
       id: cached_libyaml
       uses: actions/cache@v2
       with:
         path: libyaml
-        key: libyaml_${{matrix.platform}}_${{matrix.arch}}_${{env.LIBYAML_REF}}
+        key: libyaml_macos_${{matrix.arch}}_${{env.LIBYAML_REF}}
 
-    - name: Checkout pyyaml
+    - name: Checkout PyYAML
       uses: actions/checkout@v2
       if: steps.cached_libyaml.outputs.cache-hit != 'true'
 
     - name: Build libyaml
       env:
-        MACOSX_DEPLOYMENT_TARGET: '10.9'
+        MACOSX_DEPLOYMENT_TARGET: ${{ matrix.deployment_target || '10.9' }}
+        SDKROOT: ${{ matrix.sdkroot || 'macosx' }}
       run: |
-        brew install automake coreutils
+        set -eux
+        brew install automake coreutils m4
         bash ./packaging/build/libyaml.sh
+        echo "finished artifact arch is $(lipo -archs libyaml/src/.libs/libyaml.a)"
       if: steps.cached_libyaml.outputs.cache-hit != 'true'
 
+
   macos_pyyaml:
     needs: macos_libyaml
-    name: pyyaml ${{matrix.arch}} ${{matrix.platform}} ${{matrix.python_tag}}
+    name: pyyaml ${{ matrix.spec }}
+    runs-on: ${{ matrix.runs_on || 'macos-11' }}
+    defaults:
+      run:
+        shell: ${{ matrix.run_wrapper || 'bash --noprofile --norc -eo pipefail {0}' }}
+    strategy:
+      matrix:
+        include:
+        - spec: cp36-macosx_x86_64
+          cibw_version: cibuildwheel==2.11.1
+#        - spec: cp37-macosx_x86_64
+#        - spec: cp38-macosx_x86_64
+#        - spec: cp39-macosx_x86_64
+#        - spec: cp310-macosx_x86_64
+        - spec: cp311-macosx_x86_64
+
+#        # build for arm64 under a hacked macOS 12 self-hosted x86_64-on-arm64 runner until arm64 is fully supported
+#        # FIXME: ? cp38-macosx_arm64 requires special handling and fails some test_zdist tests under cibw 2.1.2, skip it (so Apple's XCode python3 won't have a wheel)
+#        - spec: cp39-macosx_arm64
+#          deployment_target: '11.0'
+#          runs_on: [self-hosted, macOS, arm64]
+#          arch: arm64
+#          run_wrapper: arch -arm64 bash --noprofile --norc -eo pipefail {0}
+#          sdkroot: macosx11.3
+#
+#        - spec: cp310-macosx_arm64
+#          deployment_target: '11.0'
+#          runs_on: [self-hosted, macOS, arm64]
+#          arch: arm64
+#          run_wrapper: arch -arm64 bash --noprofile --norc -eo pipefail {0}
+#          sdkroot: macosx11.3
+#
+#        - spec: cp311-macosx_arm64
+#          deployment_target: '11.0'
+#          runs_on: [self-hosted, macOS, arm64]
+#          arch: arm64
+#          run_wrapper: arch -arm64 bash --noprofile --norc -eo pipefail {0}
+#          sdkroot: macosx11.3
+
+    steps:
+    - name: Checkout PyYAML
+      uses: actions/checkout@v2
+
+    - name: Get cached libyaml state
+      id: cached_libyaml
+      uses: actions/cache@v2
+      with:
+        path: libyaml
+        key: libyaml_macos_${{ matrix.arch || 'x86_64' }}_${{env.LIBYAML_REF}}
+
+    - name: Ensure libyaml fetched
+      run: exit 1
+      if: steps.cached_libyaml.outputs.cache-hit != 'true'
+
+    - name: Build/Test/Package
+      env:
+        C_INCLUDE_PATH: libyaml/include
+        CIBW_BUILD: ${{matrix.spec}}
+        CIBW_BUILD_VERBOSITY: 1
+        CIBW_TEST_COMMAND: cd {project}; python tests/lib/test_all.py
+        LIBRARY_PATH: libyaml/src/.libs
+        MACOSX_DEPLOYMENT_TARGET: ${{ matrix.deployment_target || '10.9' }}
+        SDKROOT: ${{ matrix.sdkroot || 'macosx' }}
+      run: |
+        python3 -V
+        python3 -m pip install -U --user ${{ matrix.cibw_version || 'cibuildwheel' }}
+        python3 -m cibuildwheel --platform auto --output-dir dist .
+
+    - name: Upload artifacts
+      uses: actions/upload-artifact@v2
+      with:
+        name: dist
+        path: dist/*.whl
+        if-no-files-found: error
+
+  windows_libyaml:
+    name: libyaml ${{matrix.platform}} ${{matrix.arch}}
     runs-on: ${{matrix.platform}}
     strategy:
       matrix:
-        platform:
-        - macos-10.15
-        arch:
-        - x86_64
-        python_tag:
-        - cp27*
-        - cp36*
-        - cp37*
-        - cp38*
-        - cp39*
+        include:
+        - platform: windows-2019
+          arch: x64
+        - platform: windows-2019
+          arch: win32
     steps:
+    - name: Get cached libyaml state
+      id: cached_libyaml
+      uses: actions/cache@v2
+      with:
+        path: libyaml
+        key: libyaml_${{matrix.platform}}_${{matrix.arch}}_${{env.LIBYAML_REF}}
+
+    - name: Build libyaml
+      shell: bash
+      if: steps.cached_libyaml.outputs.cache-hit != 'true'
+      run: |
+        # git spews all over stderr unless we tell it not to
+        export GIT_REDIRECT_STDERR="2>&1"
+
+        if [[ ! -d ./libyaml ]]; then
+          git clone -b ${{ env.LIBYAML_REF }} ${{ env.LIBYAML_REPO }} 2>&1
+        fi
+
+        pushd libyaml
+        git clean -fdx
+        popd
+
+        mkdir libyaml/build
+
+        pushd libyaml/build
+        cmake.exe -G "Visual Studio 16 2019" -A ${{ matrix.arch }} -DYAML_STATIC_LIB_NAME=yaml ..
+        cmake.exe --build . --config Release
+        popd
+
+
+  windows_pyyaml:
+    needs: windows_libyaml
+    name: pyyaml ${{ matrix.platform }} ${{matrix.python_arch}} ${{matrix.spec}}
+    runs-on: ${{matrix.platform}}
+    strategy:
+      matrix:
+        include:
+        - platform: windows-2019
+          build_arch: x64
+          python_arch: x64
+          spec: 3.6
+#        - platform: windows-2019
+#          build_arch: x64
+#          python_arch: x64
+#          spec: 3.7
+#        - platform: windows-2019
+#          build_arch: x64
+#          python_arch: x64
+#          spec: 3.8
+#        - platform: windows-2019
+#          build_arch: x64
+#          python_arch: x64
+#          spec: 3.9
+#        - platform: windows-2019
+#          build_arch: x64
+#          python_arch: x64
+#          spec: '3.10'
+        - platform: windows-2019
+          build_arch: x64
+          python_arch: x64
+          spec: '3.11'
+        - platform: windows-2019
+          build_arch: win32
+          python_arch: x86
+          spec: 3.6
+#        - platform: windows-2019
+#          build_arch: win32
+#          python_arch: x86
+#          spec: 3.7
+#        - platform: windows-2019
+#          build_arch: win32
+#          python_arch: x86
+#          spec: 3.8
+#        - platform: windows-2019
+#          build_arch: win32
+#          python_arch: x86
+#          spec: 3.9
+#        - platform: windows-2019
+#          build_arch: win32
+#          python_arch: x86
+#          spec: '3.10'
+        - platform: windows-2019
+          build_arch: win32
+          python_arch: x86
+          spec: '3.11'
+    steps:
+    # autocrlf screws up tests under Windows
+    - name: Set git to use LF
+      run: |
+        git config --global core.autocrlf false
+        git config --global core.eol lf
+
     - name: Checkout pyyaml
       uses: actions/checkout@v2
 
@@ -226,25 +410,43 @@ jobs:
       uses: actions/cache@v2
       with:
         path: libyaml
-        key: libyaml_${{matrix.platform}}_${{matrix.arch}}_${{env.LIBYAML_REF}}
+        key: libyaml_${{matrix.platform}}_${{matrix.build_arch}}_${{env.LIBYAML_REF}}
 
     - name: Ensure libyaml fetched
       run: exit 1
       if: steps.cached_libyaml.outputs.cache-hit != 'true'
 
-    - name: Install a python
+    - name: Install python ${{ matrix.spec }}
       uses: actions/setup-python@v2
       with:
-        python-version: 3.x
+        architecture: ${{ matrix.python_arch }}
+        python-version: ${{ matrix.spec }}
 
     - name: Build/Test/Package
       env:
-        CIBW_BUILD: ${{matrix.python_tag}}
-        CIBW_BUILD_VERBOSITY: 1
-      run: bash ./packaging/build/macos.sh
+        PYYAML_FORCE_CYTHON: 1
+        PYYAML_FORCE_LIBYAML: 1
+      shell: bash
+      run: |
+        set -eux
+        python -V
+        python -m pip install "Cython<3.0" wheel
 
-    - uses: actions/upload-artifact@v2
+        python setup.py \
+        --with-libyaml build_ext \
+        -I libyaml/include \
+        -L libyaml/build/Release \
+        -D YAML_DECLARE_STATIC \
+        build bdist_wheel
+
+        # run tests on built wheel
+        python -m pip install dist/*.whl
+        python tests/lib/test_all.py
+
+    - name: Upload artifacts
+      uses: actions/upload-artifact@v2
       with:
         name: dist
         path: dist/*.whl
+        if-no-files-found: error
 ...
diff --git a/.github/workflows/manual_artifact_build.yaml b/.github/workflows/manual_artifact_build.yaml
new file mode 100644
index 0000000..97d9add
--- /dev/null
+++ b/.github/workflows/manual_artifact_build.yaml
@@ -0,0 +1,452 @@
+---
+# This is the actual artifact build/release workflow. This workflow exists temporarily
+# because GHA doesn't support a dynamic/conditional matrix. Ensure changes are synced with ci.yaml.
+name: Manual Artifact Build
+
+on:
+#  push:
+#  pull_request:
+#    types: [opened, synchronize, edited, reopened]
+  workflow_dispatch:
+
+env:
+  LIBYAML_REPO: https://github.com/yaml/libyaml
+  LIBYAML_REF: 0.2.5
+
+jobs:
+  python_sdist:
+    name: pyyaml sdist
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout PyYAML
+      uses: actions/checkout@v2
+
+    - name: Install a python
+      uses: actions/setup-python@v2
+      with:
+        python-version: 3.x
+
+    - name: Build sdist
+      env:
+        PYYAML_FORCE_CYTHON: 1
+        PYYAML_FORCE_LIBYAML: 0
+      run: |
+        python -V
+        python -m pip install build
+
+        python -m build .
+
+        # Ensure exactly one artifact was produced.
+        [[ $(shopt -s nullglob; ls dist/*.tar.gz | wc -w) == 1 ]] || {
+          echo "Unexpected content in dist dir: '$(ls dist/*.tar.gz)'."
+          exit 1
+        }
+
+    - name: Test sdist
+      run: |
+        # Install some libyaml headers.
+        # TODO Should we smoke test the sdist against the libyaml we built?
+        sudo apt update
+        sudo apt install libyaml-dev -y
+
+        # Ensure Cython is not present so we use only what's in the sdist.
+        python -m pip uninstall Cython -y || true
+
+        # Pass no extra args.
+        # We should auto-install with libyaml since it's present.
+        python -m pip install dist/*.tar.gz -v
+
+        python packaging/build/smoketest.py
+
+    - name: Upload sdist artifact
+      uses: actions/upload-artifact@v2
+      with:
+        name: dist
+        path: dist/*.tar.gz
+
+
+  linux_libyaml:
+    name: libyaml ${{matrix.cfg.arch}} ${{matrix.cfg.platform}}
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        cfg:
+        - { platform: manylinux1, arch: x86_64 }
+        - { platform: manylinux2014, arch: x86_64 }
+        - { platform: manylinux2014, arch: aarch64 }
+        - { platform: manylinux2014, arch: s390x }
+    env:
+      DOCKER_IMAGE: quay.io/pypa/${{matrix.cfg.platform}}_${{matrix.cfg.arch}}
+    steps:
+    - name: Check cached libyaml state
+      id: cached_libyaml
+      uses: actions/cache@v2
+      with:
+        path: libyaml
+        key: libyaml_${{matrix.cfg.platform}}_${{matrix.cfg.arch}}_${{env.LIBYAML_REF}}
+
+    - name: configure docker foreign arch support
+      uses: docker/setup-qemu-action@v1
+      if: matrix.cfg.arch != 'x86_64' && steps.cached_libyaml.outputs.cache-hit != 'true'
+
+    - name: Checkout pyyaml
+      uses: actions/checkout@v2
+      if: steps.cached_libyaml.outputs.cache-hit != 'true'
+
+    - name: Build libyaml
+      run: >
+        docker run --rm
+        --volume "$(pwd):/io"
+        --env LIBYAML_REF
+        --env LIBYAML_REPO
+        --workdir /io
+        "$DOCKER_IMAGE"
+        /io/packaging/build/libyaml.sh
+      if: steps.cached_libyaml.outputs.cache-hit != 'true'
+
+    - name: ensure output is world readable (or cache fill fails with Permission Denied)
+      run: >
+        sudo chmod -R a+r ./libyaml/
+      if: steps.cached_libyaml.outputs.cache-hit != 'true'
+
+
+  linux_pyyaml:
+    needs: linux_libyaml
+    name: pyyaml ${{matrix.arch}} ${{matrix.platform}} ${{matrix.spec}}
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        include:
+        - { platform: manylinux1, arch: x86_64, spec: cp36 }
+        - { platform: manylinux1, arch: x86_64, spec: cp37 }
+        - { platform: manylinux1, arch: x86_64, spec: cp38 }
+        - { platform: manylinux1, arch: x86_64, spec: cp39 }
+        - { platform: manylinux2014, arch: x86_64, spec: cp310 }
+        - { platform: manylinux2014, arch: x86_64, spec: cp311 }
+        - { platform: manylinux2014, arch: aarch64, spec: cp36 }
+        - { platform: manylinux2014, arch: aarch64, spec: cp37 }
+        - { platform: manylinux2014, arch: aarch64, spec: cp38 }
+        - { platform: manylinux2014, arch: aarch64, spec: cp39 }
+        - { platform: manylinux2014, arch: aarch64, spec: cp310 }
+        - { platform: manylinux2014, arch: aarch64, spec: cp311 }
+        - { platform: manylinux2014, arch: s390x, spec: cp36 }
+        - { platform: manylinux2014, arch: s390x, spec: cp37 }
+        - { platform: manylinux2014, arch: s390x, spec: cp38 }
+        - { platform: manylinux2014, arch: s390x, spec: cp39 }
+        - { platform: manylinux2014, arch: s390x, spec: cp310 }
+        - { platform: manylinux2014, arch: s390x, spec: cp311 }
+
+    steps:
+    - name: Checkout PyYAML
+      uses: actions/checkout@v2
+
+    - name: Fetch cached libyaml
+      id: cached_libyaml
+      uses: actions/cache@v2
+      with:
+        path: libyaml
+        key: libyaml_${{matrix.platform}}_${{matrix.arch}}_${{env.LIBYAML_REF}}
+
+    - name: Ensure libyaml fetched
+      run: exit 1
+      if: steps.cached_libyaml.outputs.cache-hit != 'true'
+
+    - name: configure docker foreign arch support
+      uses: docker/setup-qemu-action@v1
+      if: matrix.arch != 'x86_64'
+
+    - name: Build/Test/Package
+      env:
+        CIBW_ARCHS: all
+        CIBW_BUILD: ${{matrix.spec}}-manylinux_${{matrix.arch}}
+        CIBW_BUILD_VERBOSITY: 1
+        # containerized Linux builds require explicit CIBW_ENVIRONMENT
+        CIBW_ENVIRONMENT: >
+          C_INCLUDE_PATH=libyaml/include
+          LIBRARY_PATH=libyaml/src/.libs
+          LD_LIBRARY_PATH=libyaml/src/.libs
+          PYYAML_FORCE_CYTHON=1
+          PYYAML_FORCE_LIBYAML=1
+        CIBW_TEST_COMMAND: cd {project}; python tests/lib/test_all.py
+      run: |
+        set -eux
+        python3 -V
+        python3 -m pip install -U --user cibuildwheel
+        python3 -m cibuildwheel --platform auto --output-dir dist .
+
+    - name: Upload artifacts
+      uses: actions/upload-artifact@v2
+      with:
+        name: dist
+        path: dist/*.whl
+        if-no-files-found: error
+
+  macos_libyaml:
+    name: libyaml macos ${{matrix.arch}}
+    strategy:
+      matrix:
+        include:
+        - arch: x86_64
+        - arch: arm64
+          runs_on: [self-hosted, macOS, arm64]
+          deployment_target: '11.0'
+          run_wrapper: arch -arm64 bash --noprofile --norc -eo pipefail {0}
+          sdkroot: macosx11.3
+    defaults:
+      run:
+        shell: ${{ matrix.run_wrapper || 'bash --noprofile --norc -eo pipefail {0}' }}
+    runs-on: ${{ matrix.runs_on || 'macos-11' }}
+    steps:
+    - name: Check cached libyaml state
+      id: cached_libyaml
+      uses: actions/cache@v2
+      with:
+        path: libyaml
+        key: libyaml_macos_${{matrix.arch}}_${{env.LIBYAML_REF}}
+
+    - name: Checkout PyYAML
+      uses: actions/checkout@v2
+      if: steps.cached_libyaml.outputs.cache-hit != 'true'
+
+    - name: Build libyaml
+      env:
+        MACOSX_DEPLOYMENT_TARGET: ${{ matrix.deployment_target || '10.9' }}
+        SDKROOT: ${{ matrix.sdkroot || 'macosx' }}
+      run: |
+        set -eux
+        brew install automake coreutils m4
+        bash ./packaging/build/libyaml.sh
+        echo "finished artifact arch is $(lipo -archs libyaml/src/.libs/libyaml.a)"
+      if: steps.cached_libyaml.outputs.cache-hit != 'true'
+
+
+  macos_pyyaml:
+    needs: macos_libyaml
+    name: pyyaml ${{ matrix.spec }}
+    runs-on: ${{ matrix.runs_on || 'macos-11' }}
+    defaults:
+      run:
+        shell: ${{ matrix.run_wrapper || 'bash --noprofile --norc -eo pipefail {0}' }}
+    strategy:
+      matrix:
+        include:
+        - spec: cp36-macosx_x86_64
+          cibw_version: cibuildwheel==2.11.1
+        - spec: cp37-macosx_x86_64
+          cibw_version: cibuildwheel==2.11.1
+        - spec: cp38-macosx_x86_64
+          cibw_version: cibuildwheel==2.11.1
+        - spec: cp39-macosx_x86_64
+        - spec: cp310-macosx_x86_64
+        - spec: cp311-macosx_x86_64
+
+        # build for arm64 under a hacked macOS 12 self-hosted x86_64-on-arm64 runner until arm64 is fully supported
+        # FIXME: ? cp38-macosx_arm64 requires special handling and fails some test_zdist tests under cibw 2.1.2, skip it (so Apple's XCode python3 won't have a wheel)
+        - spec: cp39-macosx_arm64
+          deployment_target: '11.0'
+          runs_on: [self-hosted, macOS, arm64]
+          arch: arm64
+          run_wrapper: arch -arm64 bash --noprofile --norc -eo pipefail {0}
+          sdkroot: macosx11.3
+
+        - spec: cp310-macosx_arm64
+          deployment_target: '11.0'
+          runs_on: [self-hosted, macOS, arm64]
+          arch: arm64
+          run_wrapper: arch -arm64 bash --noprofile --norc -eo pipefail {0}
+          sdkroot: macosx11.3
+
+        - spec: cp311-macosx_arm64
+          deployment_target: '11.0'
+          runs_on: [self-hosted, macOS, arm64]
+          arch: arm64
+          run_wrapper: arch -arm64 bash --noprofile --norc -eo pipefail {0}
+          sdkroot: macosx11.3
+
+    steps:
+    - name: Checkout PyYAML
+      uses: actions/checkout@v2
+
+    - name: Get cached libyaml state
+      id: cached_libyaml
+      uses: actions/cache@v2
+      with:
+        path: libyaml
+        key: libyaml_macos_${{ matrix.arch || 'x86_64' }}_${{env.LIBYAML_REF}}
+
+    - name: Ensure libyaml fetched
+      run: exit 1
+      if: steps.cached_libyaml.outputs.cache-hit != 'true'
+
+    - name: Build/Test/Package
+      env:
+        C_INCLUDE_PATH: libyaml/include
+        CIBW_BUILD: ${{matrix.spec}}
+        CIBW_BUILD_VERBOSITY: 1
+        CIBW_TEST_COMMAND: cd {project}; python tests/lib/test_all.py
+        LIBRARY_PATH: libyaml/src/.libs
+        MACOSX_DEPLOYMENT_TARGET: ${{ matrix.deployment_target || '10.9' }}
+        SDKROOT: ${{ matrix.sdkroot || 'macosx' }}
+      run: |
+        python3 -V
+        python3 -m pip install -U --user ${{ matrix.cibw_version || 'cibuildwheel' }}
+        python3 -m cibuildwheel --platform auto --output-dir dist .
+
+    - name: Upload artifacts
+      uses: actions/upload-artifact@v2
+      with:
+        name: dist
+        path: dist/*.whl
+        if-no-files-found: error
+
+  windows_libyaml:
+    name: libyaml ${{matrix.platform}} ${{matrix.arch}}
+    runs-on: ${{matrix.platform}}
+    strategy:
+      matrix:
+        include:
+        - platform: windows-2019
+          arch: x64
+        - platform: windows-2019
+          arch: win32
+    steps:
+    - name: Get cached libyaml state
+      id: cached_libyaml
+      uses: actions/cache@v2
+      with:
+        path: libyaml
+        key: libyaml_${{matrix.platform}}_${{matrix.arch}}_${{env.LIBYAML_REF}}
+
+    - name: Build libyaml
+      shell: bash
+      if: steps.cached_libyaml.outputs.cache-hit != 'true'
+      run: |
+        # git spews all over stderr unless we tell it not to
+        export GIT_REDIRECT_STDERR="2>&1"
+
+        if [[ ! -d ./libyaml ]]; then
+          git clone -b ${{ env.LIBYAML_REF }} ${{ env.LIBYAML_REPO }} 2>&1
+        fi
+
+        pushd libyaml
+        git clean -fdx
+        popd
+
+        mkdir libyaml/build
+
+        pushd libyaml/build
+        cmake.exe -G "Visual Studio 16 2019" -A ${{ matrix.arch }} -DYAML_STATIC_LIB_NAME=yaml ..
+        cmake.exe --build . --config Release
+        popd
+
+
+  windows_pyyaml:
+    needs: windows_libyaml
+    name: pyyaml ${{ matrix.platform }} ${{matrix.python_arch}} ${{matrix.spec}}
+    runs-on: ${{matrix.platform}}
+    strategy:
+      matrix:
+        include:
+        - platform: windows-2019
+          build_arch: x64
+          python_arch: x64
+          spec: 3.6
+        - platform: windows-2019
+          build_arch: x64
+          python_arch: x64
+          spec: 3.7
+        - platform: windows-2019
+          build_arch: x64
+          python_arch: x64
+          spec: 3.8
+        - platform: windows-2019
+          build_arch: x64
+          python_arch: x64
+          spec: 3.9
+        - platform: windows-2019
+          build_arch: x64
+          python_arch: x64
+          spec: '3.10'
+        - platform: windows-2019
+          build_arch: x64
+          python_arch: x64
+          spec: '3.11'
+        - platform: windows-2019
+          build_arch: win32
+          python_arch: x86
+          spec: 3.6
+        - platform: windows-2019
+          build_arch: win32
+          python_arch: x86
+          spec: 3.7
+        - platform: windows-2019
+          build_arch: win32
+          python_arch: x86
+          spec: 3.8
+        - platform: windows-2019
+          build_arch: win32
+          python_arch: x86
+          spec: 3.9
+        - platform: windows-2019
+          build_arch: win32
+          python_arch: x86
+          spec: '3.10'
+        - platform: windows-2019
+          build_arch: win32
+          python_arch: x86
+          spec: '3.11'
+    steps:
+    # autocrlf screws up tests under Windows
+    - name: Set git to use LF
+      run: |
+        git config --global core.autocrlf false
+        git config --global core.eol lf
+
+    - name: Checkout pyyaml
+      uses: actions/checkout@v2
+
+    - name: Get cached libyaml state
+      id: cached_libyaml
+      uses: actions/cache@v2
+      with:
+        path: libyaml
+        key: libyaml_${{matrix.platform}}_${{matrix.build_arch}}_${{env.LIBYAML_REF}}
+
+    - name: Ensure libyaml fetched
+      run: exit 1
+      if: steps.cached_libyaml.outputs.cache-hit != 'true'
+
+    - name: Install python ${{ matrix.spec }}
+      uses: actions/setup-python@v2
+      with:
+        architecture: ${{ matrix.python_arch }}
+        python-version: ${{ matrix.spec }}
+
+    - name: Build/Test/Package
+      env:
+        PYYAML_FORCE_CYTHON: 1
+        PYYAML_FORCE_LIBYAML: 1
+      shell: bash
+      run: |
+        set -eux
+        python -V
+        python -m pip install "Cython<3.0" wheel
+
+        python setup.py \
+        --with-libyaml build_ext \
+        -I libyaml/include \
+        -L libyaml/build/Release \
+        -D YAML_DECLARE_STATIC \
+        build bdist_wheel
+
+        # run tests on built wheel
+        python -m pip install dist/*.whl
+        python tests/lib/test_all.py
+
+    - name: Upload artifacts
+      uses: actions/upload-artifact@v2
+      with:
+        name: dist
+        path: dist/*.whl
+        if-no-files-found: error
+...
diff --git a/CHANGES b/CHANGES
index c37d9be..27e11bf 100644
--- a/CHANGES
+++ b/CHANGES
@@ -4,6 +4,10 @@ For a complete changelog, see:
 * https://github.com/yaml/pyyaml/commits/
 * https://bitbucket.org/xi/pyyaml/commits/
 
+6.0.1 (2023-07-18)
+
+* https://github.com/yaml/pyyaml/pull/702 -- pin Cython build dep to < 3.0
+
 6.0 (2021-10-13)
 
 * https://github.com/yaml/pyyaml/pull/327 -- Change README format to Markdown
diff --git a/README.OpenSource b/README.OpenSource
index 93e0b50..f82308a 100644
--- a/README.OpenSource
+++ b/README.OpenSource
@@ -3,7 +3,7 @@
     "Name": "PyYAML",
     "License": "MIT License",
     "License File": "LICENSE",
-    "Version Number": "6.0",
+    "Version Number": "6.0.1",
     "Owner": "xuyong59@huawei.com",
     "Upstream URL": "https://pypi.org/project/PyYAML",
     "Description": "A YAML parser and emitter for Python"
diff --git a/announcement.msg b/announcement.msg
index abc1bbe..be46a5a 100644
--- a/announcement.msg
+++ b/announcement.msg
@@ -1,37 +1,22 @@
 From: Ingy döt Net <ingy@ingy.net>
 To: python-list@python.org, python-announce@python.org, yaml-core@lists.sourceforge.net
-Subject: [ANN] PyYAML-6.0 Released
+Subject: [ANN] PyYAML-6.0.1 Released
 
-=====================
-Announcing PyYAML-6.0
-=====================
+=======================
+Announcing PyYAML-6.0.1
+=======================
 
 A new release of PyYAML is now available:
-https://github.com/yaml/pyyaml/releases/tag/6.0
+https://github.com/yaml/pyyaml/releases/tag/6.0.1
 
-The previously-deprecated default loader selection in `yaml.load()` has
-been removed; `Loader` is now a required argument.
-
-Support for Python 2.7 and 3.5 has been dropped, and support for Python 3.10
-added. It now includes libyaml 0.2.5 extension wheels for MacOS M1
-(Apple Silicon/arm64), Linux s390x and Linux aarch64.
-
-Numerous other bugfixes and code cleanups are included in this release.
+No code changes; update PEP518 build metadata to require Cython < 3.0 until
+packaging code is rewritten for Cython 3.0 compatibility.
 
 
 Changes
 =======
 
-* https://github.com/yaml/pyyaml/pull/327 -- Change README format to Markdown
-* https://github.com/yaml/pyyaml/pull/483 -- Add a test for YAML 1.1 types
-* https://github.com/yaml/pyyaml/pull/497 -- fix float resolver to ignore `.` and `._`
-* https://github.com/yaml/pyyaml/pull/550 -- drop Python 2.7
-* https://github.com/yaml/pyyaml/pull/553 -- Fix spelling of “hexadecimal”
-* https://github.com/yaml/pyyaml/pull/556 -- fix representation of Enum subclasses
-* https://github.com/yaml/pyyaml/pull/557 -- fix libyaml extension compiler warnings
-* https://github.com/yaml/pyyaml/pull/560 -- fix ResourceWarning on leaked file descriptors
-* https://github.com/yaml/pyyaml/pull/561 -- always require `Loader` arg to `yaml.load()`
-* https://github.com/yaml/pyyaml/pull/564 -- remove remaining direct distutils usage
+* https://github.com/yaml/pyyaml/pull/702 -- pin Cython build dep to < 3.0
 
 
 Resources
diff --git a/lib/yaml/__init__.py b/lib/yaml/__init__.py
index 465041d..8249361 100644
--- a/lib/yaml/__init__.py
+++ b/lib/yaml/__init__.py
@@ -8,7 +8,7 @@ from .nodes import *
 from .loader import *
 from .dumper import *
 
-__version__ = '6.0'
+__version__ = '6.0.1'
 try:
     from .cyaml import *
     __with_libyaml__ = True
diff --git a/pyproject.toml b/pyproject.toml
index 2bf5ec8..4bc04c0 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,3 +1,3 @@
 [build-system]
-requires = ["setuptools", "wheel", "Cython"]
+requires = ["setuptools", "wheel", "Cython<3.0"]
 build-backend = "setuptools.build_meta"
diff --git a/setup.py b/setup.py
index 548b19f..65b0ea0 100644
--- a/setup.py
+++ b/setup.py
@@ -1,6 +1,6 @@
 
 NAME = 'PyYAML'
-VERSION = '6.0'
+VERSION = '6.0.1'
 DESCRIPTION = "YAML parser and emitter for Python"
 LONG_DESCRIPTION = """\
 YAML is a data serialization format designed for human readability
@@ -33,6 +33,7 @@ CLASSIFIERS = [
     "Programming Language :: Python :: 3.8",
     "Programming Language :: Python :: 3.9",
     "Programming Language :: Python :: 3.10",
+    "Programming Language :: Python :: 3.11",
     "Programming Language :: Python :: Implementation :: CPython",
     "Programming Language :: Python :: Implementation :: PyPy",
     "Topic :: Software Development :: Libraries :: Python Modules",
diff --git a/tox.ini b/tox.ini
index d736a6c..4335fa9 100644
--- a/tox.ini
+++ b/tox.ini
@@ -1,5 +1,5 @@
 [tox]
-envlist = pypy3,py36,py37,py38,py39,py310
+envlist = pypy3,py36,py37,py38,py39,py310,py311
 
 [testenv]
 deps =