diff --git a/.python-version-default b/.python-version-default
index e4fba21..24ee5b1 100644
--- a/.python-version-default
+++ b/.python-version-default
@@ -1 +1 @@
-3.12
+3.13
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1d51079..0c07cba 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -15,6 +15,12 @@ You can find out backwards-compatibility policy [here](https://github.com/pyca/s
 
 ## [Unreleased](https://github.com/pyca/service-identity/compare/24.1.0...HEAD)
 
+### Added
+
+- Python 3.13 is now officially supported.
+  [#74](https://github.com/pyca/service-identity/pull/74)
+
+
 ### Changed
 
 - pyOpenSSL's identity extraction has been reimplemented using *cryptography*'s primitives instead of deprecated pyOpenSSL APIs.
diff --git a/pyproject.toml b/pyproject.toml
index b7823b3..dabd973 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -18,6 +18,7 @@ classifiers = [
     "Programming Language :: Python :: 3.10",
     "Programming Language :: Python :: 3.11",
     "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
     "Programming Language :: Python :: Implementation :: CPython",
     "Programming Language :: Python :: Implementation :: PyPy",
     "Topic :: Security :: Cryptography",
diff --git a/tox.ini b/tox.ini
index f3015ba..429c151 100644
--- a/tox.ini
+++ b/tox.ini
@@ -4,7 +4,7 @@ env_list =
     lint,
     mypy-{api,pkg},
     docs,
-    py3{8,9,10,11,12}{,-pyopenssl}{,-oldest}{,-idna},
+    py3{8,9,10,11,12,13}{,-pyopenssl}{,-oldest}{,-idna},
     coverage-report