diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
index adafe1f5b..51f241d9d 100644
--- a/.github/workflows/cd.yml
+++ b/.github/workflows/cd.yml
@@ -8,7 +8,7 @@ env:
   CD: "true"
   ACTIONS_STEP_DEBUG: ${{ secrets.ACTIONS_STEP_DEBUG }}
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-  PYTHON_DEFAULT_VERSION: "3.11"
+  PYTHON_DEFAULT_VERSION: "3.12"
 
 jobs:
   deploy:
@@ -54,7 +54,7 @@ jobs:
     needs: deploy
     runs-on: ubuntu-latest
     container:
-      image: "python:3.11"  # can not use ${{ env.PYTHON_DEFAULT_VERSION }} here
+      image: "python:3.12"  # can not use ${{ env.PYTHON_DEFAULT_VERSION }} here
       env:
         DEBIAN_FRONTEND: noninteractive
     steps:
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 64d7b7883..cc21f907a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -7,7 +7,7 @@ on:
     branches: [master]
 
 env:
-  PYTHON_DEFAULT_VERSION: "3.11"
+  PYTHON_DEFAULT_VERSION: "3.12"
 
 jobs:
   lint:
@@ -104,7 +104,7 @@ jobs:
         run: nox -vs integration -- -m "not require_secrets"
       - name: Run integration tests (with secrets)
         # Limit CI workload by running integration tests with secrets only on edge Python versions.
-        if: ${{ env.B2_TEST_APPLICATION_KEY != '' && env.B2_TEST_APPLICATION_KEY_ID != '' && contains(fromJSON('["3.7", "pypy-3.10-nightly", "3.11"]'), matrix.python-version) }}
+        if: ${{ env.B2_TEST_APPLICATION_KEY != '' && env.B2_TEST_APPLICATION_KEY_ID != '' && contains(fromJSON('["3.7", "pypy-3.10-nightly", "3.12"]'), matrix.python-version) }}
         run: nox -vs integration -- -m "require_secrets" --cleanup
   test-docker:
     needs: cleanup_buckets
@@ -147,7 +147,7 @@ jobs:
       B2_TEST_APPLICATION_KEY_ID: ${{ secrets.B2_TEST_APPLICATION_KEY_ID }}
     runs-on: ubuntu-latest
     container:
-      image: "python:3.11"  # can not use ${{ env.PYTHON_DEFAULT_VERSION }} here
+      image: "python:3.12"  # can not use ${{ env.PYTHON_DEFAULT_VERSION }} here
       env:
         DEBIAN_FRONTEND: noninteractive
     steps:
diff --git a/changelog.d/+python3.12.infrastructure.md b/changelog.d/+python3.12.infrastructure.md
new file mode 100644
index 000000000..6b96af83a
--- /dev/null
+++ b/changelog.d/+python3.12.infrastructure.md
@@ -0,0 +1 @@
+Use cpython 3.12 (not 3.11) for integration tests with secrets
\ No newline at end of file
diff --git a/noxfile.py b/noxfile.py
index 2c0d5c974..8c52c75da 100644
--- a/noxfile.py
+++ b/noxfile.py
@@ -33,9 +33,9 @@
     '3.9',
     '3.10',
     '3.11',
+    '3.12',
 ] if NOX_PYTHONS is None else NOX_PYTHONS.split(',')
 PYTHON_DEFAULT_VERSION = PYTHON_VERSIONS[-1]
-PYTHON_VERSIONS += ['3.12']  # move this into PYTHON_VERSION above after official 3.12 release
 
 PY_PATHS = ['b2', 'test', 'noxfile.py', 'setup.py']