diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b6aae98..d19e64d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -210,6 +210,16 @@ jobs:
         run: |
           cargo test -vv --target=${{ matrix.target }} ${{ matrix.cargo_options }} ${{ matrix.features }} ${{ matrix.mode }}
 
+      # rcgen-based tests require Rust 1.67.
+      - if: ${{ !contains(matrix.host_os, 'windows') && !contains(matrix.rust_channel, '1.61.0') }}
+        run: |
+          mk/cargo.sh test -p rcgen-tests -vv --target=${{ matrix.target }} ${{ matrix.cargo_options }} ${{ matrix.features }} ${{ matrix.mode }}
+
+      # rcgen-based tests require Rust 1.67.
+      - if: ${{ contains(matrix.host_os, 'windows') && !contains(matrix.rust_channel, '1.61.0') }}
+        run: |
+          cargo test -vv -p rcgen-tests --target=${{ matrix.target }} ${{ matrix.cargo_options }} ${{ matrix.features }} ${{ matrix.mode }}
+
   coverage:
     runs-on: ${{ matrix.host_os }}
 
@@ -256,7 +266,7 @@ jobs:
 
       - if: ${{ !contains(matrix.host_os, 'windows') }}
         run: |
-          RING_COVERAGE=1 mk/cargo.sh +${{ matrix.rust_channel }} test -vv --target=${{ matrix.target }} ${{ matrix.cargo_options }} ${{ matrix.features }} ${{ matrix.mode }}
+          RING_COVERAGE=1 mk/cargo.sh +${{ matrix.rust_channel }} test --workspace -vv --target=${{ matrix.target }} ${{ matrix.cargo_options }} ${{ matrix.features }} ${{ matrix.mode }}
 
       - uses: briansmith/codecov-codecov-action@v1
         with:
diff --git a/Cargo.toml b/Cargo.toml
index 462997d..327d158 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -61,7 +61,6 @@ untrusted = "0.9"
 
 [dev-dependencies]
 base64 = "0.9.1"
-rcgen = { version = "0.11.3", default-features = false }
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"
 
@@ -80,3 +79,9 @@ rpath = false
 lto = true
 debug-assertions = false
 codegen-units = 1
+
+[workspace]
+members = [
+    # Intentionally not a default member.
+    "rcgen-tests",
+]
diff --git a/rcgen-tests/Cargo.toml b/rcgen-tests/Cargo.toml
new file mode 100644
index 0000000..204fc43
--- /dev/null
+++ b/rcgen-tests/Cargo.toml
@@ -0,0 +1,9 @@
+[package]
+edition = "2018"
+name = "rcgen-tests"
+publish = false
+version = "0.10.0"
+
+[dev-dependencies]
+rcgen = { version = "0.11.3", default-features = false }
+webpki = { path = "../", default-features = false }
diff --git a/tests/dos.rs b/rcgen-tests/tests/dos.rs
similarity index 91%
rename from tests/dos.rs
rename to rcgen-tests/tests/dos.rs
index 5aa8c44..e3cf9e0 100644
--- a/tests/dos.rs
+++ b/rcgen-tests/tests/dos.rs
@@ -12,18 +12,6 @@
 // ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 // OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 
-// XXX: rcgen can only build on archs that *ring* 0.16 supports.
-#![cfg(all(
-    not(all(target_arch = "aarch64", target_os = "windows")),
-    any(
-        target_arch = "aarch64",
-        target_arch = "arm",
-        target_arch = "wasm32",
-        target_arch = "x86",
-        target_arch = "x86_64"
-    )
-))]
-#![cfg(feature = "alloc")]
 #![no_std]
 
 extern crate alloc;