diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f1683abe..f79c42fe 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -7,7 +7,7 @@ jobs:
     # Don't run duplicate `push` jobs for the repo owner's PRs.
     if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name != github.repository
 
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-22.04
 
     steps:
       - uses: actions-rs/toolchain@v1
@@ -22,7 +22,7 @@ jobs:
     # Don't run duplicate `push` jobs for the repo owner's PRs.
     if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name != github.repository
 
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-22.04
 
     steps:
       - uses: actions-rs/toolchain@v1
@@ -33,13 +33,13 @@ jobs:
 
       - uses: actions/checkout@v2
 
-      - run: cargo clippy --all-features ---all-targets -- --deny warnings
+      - run: cargo clippy --all-features --all-targets -- --deny warnings
 
   audit:
     # Don't run duplicate `push` jobs for the repo owner's PRs.
     if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name != github.repository
 
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-22.04
 
     steps:
       - uses: actions-rs/toolchain@v1
@@ -67,7 +67,7 @@ jobs:
     # Don't run duplicate `push` jobs for the repo owner's PRs.
     if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name != github.repository
 
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-22.04
 
     steps:
       - uses: actions-rs/toolchain@v1
@@ -81,9 +81,9 @@ jobs:
             ~/.cargo/bin/cargo-deny
             ~/.cargo/.crates.toml
             ~/.cargo/.crates2.json
-          key: ${{ runner.os }}-v2-cargo-deny-locked-0.8.5
+          key: ${{ runner.os }}-v2-cargo-deny-locked-0.14.1
 
-      - run: cargo install cargo-deny --locked --vers "0.8.5"
+      - run: cargo install cargo-deny --locked --vers "0.14.1"
 
       - uses: actions/checkout@v2
 
@@ -94,7 +94,7 @@ jobs:
     # Don't run duplicate `push` jobs for the repo owner's PRs.
     if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name != github.repository
 
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-22.04
 
     strategy:
       matrix:
@@ -162,16 +162,16 @@ jobs:
 
         include:
           - target: arm-unknown-linux-gnueabihf
-            host_os: ubuntu-18.04
+            host_os: ubuntu-22.04
 
           - target: i686-pc-windows-msvc
             host_os: windows-latest
 
           - target: x86_64-unknown-linux-musl
-            host_os: ubuntu-18.04
+            host_os: ubuntu-22.04
 
           - target: x86_64-unknown-linux-gnu
-            host_os: ubuntu-18.04
+            host_os: ubuntu-22.04
 
     steps:
       - if: ${{ contains(matrix.host_os, 'ubuntu') }}
@@ -224,7 +224,7 @@ jobs:
         # TODO: targets
         include:
           - target: x86_64-unknown-linux-musl
-            host_os: ubuntu-18.04
+            host_os: ubuntu-22.04
 
     steps:
       - if: ${{ contains(matrix.host_os, 'ubuntu') }}
diff --git a/mk/cargo.sh b/mk/cargo.sh
index a7b8154b..7ddb5dd6 100755
--- a/mk/cargo.sh
+++ b/mk/cargo.sh
@@ -20,12 +20,18 @@ IFS=$'\n\t'
 rustflags_self_contained="-Clink-self-contained=yes -Clinker=rust-lld"
 qemu_aarch64="qemu-aarch64 -L /usr/aarch64-linux-gnu"
 qemu_arm="qemu-arm -L /usr/arm-linux-gnueabihf"
+qemu_mipsel="qemu-mipsel -L /usr/mipsel-linux-gnu"
 
 # Avoid putting the Android tools in `$PATH` because there are tools in this
 # directory like `clang` that would conflict with the same-named tools that may
 # be needed to compile the build script, or to compile for other targets.
-if [ -n "${ANDROID_SDK_ROOT-}" ]; then
-  android_tools=$ANDROID_SDK_ROOT/ndk-bundle/toolchains/llvm/prebuilt/linux-x86_64/bin
+if [ -n "${ANDROID_HOME-}" ]; then
+  # Keep the next line in sync with the corresponding line in install-build-tools.sh.
+  ndk_version=25.2.9519653
+  ANDROID_NDK_ROOT=${ANDROID_NDK_ROOT:-${ANDROID_HOME}/ndk/$ndk_version}
+fi
+if [ -n "${ANDROID_NDK_ROOT-}" ]; then
+  android_tools=${ANDROID_NDK_ROOT}/toolchains/llvm/prebuilt/linux-x86_64/bin
 fi
 
 for arg in $*; do
@@ -39,15 +45,12 @@ for arg in $*; do
 done
 
 # See comments in install-build-tools.sh.
-llvm_version=10
-if [ -n "${RING_COVERAGE-}" ]; then
-  llvm_version=11
-fi
+llvm_version=15
 
 case $target in
    aarch64-linux-android)
     export CC_aarch64_linux_android=$android_tools/aarch64-linux-android21-clang
-    export AR_aarch64_linux_android=$android_tools/aarch64-linux-android-ar
+    export AR_aarch64_linux_android=$android_tools/llvm-ar
     export CARGO_TARGET_AARCH64_LINUX_ANDROID_LINKER=$android_tools/aarch64-linux-android21-clang
     ;;
   aarch64-unknown-linux-gnu)
@@ -70,9 +73,9 @@ case $target in
     export CARGO_TARGET_ARM_UNKNOWN_LINUX_GNUEABIHF_RUNNER="$qemu_arm"
     ;;
   armv7-linux-androideabi)
-    export CC_armv7_linux_androideabi=$android_tools/armv7a-linux-androideabi18-clang
-    export AR_armv7_linux_androideabi=$android_tools/arm-linux-androideabi-ar
-    export CARGO_TARGET_ARMV7_LINUX_ANDROIDEABI_LINKER=$android_tools/armv7a-linux-androideabi18-clang
+    export CC_armv7_linux_androideabi=$android_tools/armv7a-linux-androideabi19-clang
+    export AR_armv7_linux_androideabi=$android_tools/llvm-ar
+    export CARGO_TARGET_ARMV7_LINUX_ANDROIDEABI_LINKER=$android_tools/armv7a-linux-androideabi19-clang
     ;;
   armv7-unknown-linux-musleabihf)
     export CC_armv7_unknown_linux_musleabihf=clang-$llvm_version
@@ -90,6 +93,12 @@ case $target in
     export AR_i686_unknown_linux_musl=llvm-ar-$llvm_version
     export CARGO_TARGET_I686_UNKNOWN_LINUX_MUSL_RUSTFLAGS="$rustflags_self_contained"
     ;;
+  mipsel-unknown-linux-gnu)
+    export CC_mipsel_unknown_linux_gnu=mipsel-linux-gnu-gcc
+    export AR_mipsel_unknown_linux_gnu=mipsel-linux-gnu-gcc-ar
+    export CARGO_TARGET_MIPSEL_UNKNOWN_LINUX_GNU_LINKER=mipsel-linux-gnu-gcc
+    export CARGO_TARGET_MIPSEL_UNKNOWN_LINUX_GNU_RUNNER="$qemu_mipsel"
+    ;;
   x86_64-unknown-linux-musl)
     export CC_x86_64_unknown_linux_musl=clang-$llvm_version
     export AR_x86_64_unknown_linux_musl=llvm-ar-$llvm_version
@@ -105,6 +114,7 @@ case $target in
     export CC_wasm32_unknown_unknown=clang-$llvm_version
     export AR_wasm32_unknown_unknown=llvm-ar-$llvm_version
     export CARGO_TARGET_WASM32_UNKNOWN_UNKNOWN_RUNNER=wasm-bindgen-test-runner
+    export WASM_BINDGEN_TEST_TIMEOUT=60
     ;;
   *)
     ;;
@@ -134,7 +144,7 @@ if [ -n "${RING_COVERAGE-}" ]; then
   declare -x "${runner_var}=mk/runner ${!runner_var-}"
 
   rustflags_var=CARGO_TARGET_${target_upper}_RUSTFLAGS
-  declare -x "${rustflags_var}=-Zinstrument-coverage ${!rustflags_var-}"
+  declare -x "${rustflags_var}=-Cinstrument-coverage ${!rustflags_var-}"
 fi
 
 cargo "$@"
diff --git a/mk/install-build-tools.sh b/mk/install-build-tools.sh
index e997bbb4..77b01cdc 100755
--- a/mk/install-build-tools.sh
+++ b/mk/install-build-tools.sh
@@ -27,12 +27,32 @@ function install_packages {
 use_clang=
 case $target in
 --target*android*)
-  mkdir -p "${ANDROID_SDK_ROOT}/licenses"
-  android_license_file="${ANDROID_SDK_ROOT}/licenses/android-sdk-license"
+  # https://blog.rust-lang.org/2023/01/09/android-ndk-update-r25.html says
+  # "Going forward the Android platform will target the most recent LTS NDK,
+  # allowing Rust developers to access platform features sooner. These updates
+  # should occur yearly and will be announced in release notes." Assume that
+  # means that we should always prefer to be using the latest 25.x.y version of
+  # the NDK until the Rust project announces that we should use a higher major
+  # version number.
+  #
+  # TODO: This should probably be implemented as a map of Rust toolchain version
+  # to NDK version; e.g. our MSRV might (only) support an older NDK than the
+  # latest stable Rust toolchain.
+  #
+  # Keep the following line in sync with the corresponding line in cargo.sh.
+  ndk_version=25.2.9519653
+
+  mkdir -p "${ANDROID_HOME}/licenses"
+  android_license_file="${ANDROID_HOME}/licenses/android-sdk-license"
   accept_android_license=24333f8a63b6825ea9c5514f83c2829b004d1fee
   grep --quiet --no-messages "$accept_android_license" "$android_license_file" \
     || echo $accept_android_license  >> "$android_license_file"
-  sudo "${ANDROID_SDK_ROOT}/tools/bin/sdkmanager" ndk-bundle
+  "${ANDROID_HOME}/cmdline-tools/latest/bin/sdkmanager" "ndk;$ndk_version"
+
+  # XXX: Older Rust toolchain versions link with `-lgcc` instead of `-lunwind`;
+  # see https://github.com/rust-lang/rust/pull/85806.
+  find -L ${ANDROID_NDK_ROOT:-${ANDROID_HOME}/ndk/$ndk_version} -name libunwind.a \
+          -execdir sh -c 'echo "INPUT(-lunwind)" > libgcc.a' \;
   ;;
 esac
 
@@ -65,31 +85,31 @@ case $target in
 --target=i686-unknown-linux-musl|--target=x86_64-unknown-linux-musl)
   use_clang=1
   ;;
+--target=mipsel-unknown-linux-gnu)
+  install_packages \
+    gcc-mipsel-linux-gnu \
+    libc6-dev-mipsel-cross \
+    qemu-user
+  ;;
 --target=wasm32-unknown-unknown)
-  # The version of wasm-bindgen-cli must match the wasm-bindgen version.
-  wasm_bindgen_version=$(cargo metadata --format-version 1 | jq -r '.packages | map(select( .name == "wasm-bindgen")) | map(.version) | .[0]')
-  cargo install wasm-bindgen-cli --vers "$wasm_bindgen_version" --bin wasm-bindgen-test-runner
-  case ${features-} in
-    *wasm32_c*)
-      use_clang=1
-      ;;
-    *)
-      ;;
-  esac
+  cargo install wasm-bindgen-cli --bin wasm-bindgen-test-runner
+  use_clang=1
   ;;
 --target=*)
   ;;
 esac
 
-if [ -n "$use_clang" ]; then
-  llvm_version=10
-  if [ -n "${RING_COVERAGE-}" ]; then
-    # https://github.com/rust-lang/rust/pull/79365 upgraded the coverage file
-    # format to one that only LLVM 11+ can use
-    llvm_version=11
-    sudo apt-key add mk/llvm-snapshot.gpg.key
-    sudo add-apt-repository "deb http://apt.llvm.org/bionic/ llvm-toolchain-bionic-$llvm_version main"
-    sudo apt-get update
+case "$OSTYPE" in
+linux*)
+  ubuntu_codename=$(lsb_release --codename --short)
+  llvm_version=15
+  sudo apt-key add mk/llvm-snapshot.gpg.key
+  sudo add-apt-repository "deb http://apt.llvm.org/$ubuntu_codename/ llvm-toolchain-$ubuntu_codename-$llvm_version main"
+  sudo apt-get update
+  # We need to use `llvm-nm` in `mk/check-symbol-prefixes.sh`.
+  install_packages llvm-$llvm_version
+  if [ -n "$use_clang" ]; then
+    install_packages clang-$llvm_version
   fi
-  install_packages clang-$llvm_version llvm-$llvm_version
-fi
+  ;;
+esac
diff --git a/src/lib.rs b/src/lib.rs
index ce9e71a5..65efa1d9 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -27,14 +27,20 @@
 #![doc(html_root_url = "https://briansmith.org/rustdoc/")]
 #![cfg_attr(not(feature = "std"), no_std)]
 #![allow(
+    clippy::clone_on_copy,
+    clippy::derive_partial_eq_without_eq,
     clippy::doc_markdown,
+    clippy::explicit_auto_deref,
     clippy::if_not_else,
     clippy::inline_always,
     clippy::items_after_statements,
     clippy::missing_errors_doc,
     clippy::module_name_repetitions,
+    clippy::needless_borrow,
+    clippy::redundant_closure,
     clippy::single_match,
-    clippy::single_match_else
+    clippy::single_match_else,
+    clippy::useless_asref
 )]
 #![deny(clippy::as_conversions)]
 
diff --git a/tests/dns_name_tests.rs b/tests/dns_name_tests.rs
index b3a3adc4..de30be21 100644
--- a/tests/dns_name_tests.rs
+++ b/tests/dns_name_tests.rs
@@ -232,6 +232,7 @@ static DNS_NAME_VALIDITY: &[(&[u8], bool)] = &[
 
 // (IP address, is valid DNS name). The comments here refer to the validity of
 // the string as an IP address, not as a DNS name validity.
+#[allow(clippy::octal_escapes)]
 static IP_ADDRESS_DNS_VALIDITY: &[(&[u8], bool)] = &[
     (b"", false),
     (b"1", false),