diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 7df672e..706fa51 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -96,19 +96,13 @@ jobs:
       fail-fast: false
       matrix:
         python-version:
-          - "3.7"
           - "3.8"
           - "3.9"
           - "3.10"
           - "3.11"
           - "3.12"
+          - "3.13"
         os: [ubuntu-latest, macos-latest, windows-latest]
-        exclude:
-          - os: macos-latest
-            python-version: "3.7"
-        include:
-          - python-version: "3.7"
-            os: macos-12
 
     steps:
       - name: checkout
@@ -117,6 +111,7 @@ jobs:
         uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
+          allow-prereleases: true
       ###
       # Caching.
       # This actually *restores* a cache and schedules a cleanup action
@@ -153,16 +148,23 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-pip-
 
+      - name: Install Build Dependencies (3.13)
+        if: matrix.python-version == '3.13'
+        run: |
+          pip install -U pip
+          pip install -U "setuptools<69" wheel twine
+          pip install --pre cffi
       - name: Install Build Dependencies
+        if: matrix.python-version != '3.13'
         run: |
           pip install -U pip
           pip install -U "setuptools<69" wheel twine
+          pip install cffi
 
-      - name: Build AccessControl (macOS x86_64, Python 3.8+)
+      - name: Build AccessControl (macOS x86_64)
         if: >
           startsWith(runner.os, 'Mac')
-          && !(startsWith(matrix.python-version, 'pypy')
-               || matrix.python-version == '3.7')
+          && !startsWith(matrix.python-version, 'pypy')
         env:
           MACOSX_DEPLOYMENT_TARGET: 10.9
           _PYTHON_HOST_PLATFORM: macosx-10.9-x86_64
@@ -172,11 +174,10 @@ jobs:
           # output (pip install uses a random temporary directory, making this difficult).
           python setup.py build_ext -i
           python setup.py bdist_wheel
-      - name: Build AccessControl (macOS arm64, Python 3.8+)
+      - name: Build AccessControl (macOS arm64)
         if: >
           startsWith(runner.os, 'Mac')
-          && !(startsWith(matrix.python-version, 'pypy')
-               || matrix.python-version == '3.7')
+          && !startsWith(matrix.python-version, 'pypy')
         env:
           MACOSX_DEPLOYMENT_TARGET: 11.0
           _PYTHON_HOST_PLATFORM: macosx-11.0-arm64
@@ -190,14 +191,21 @@ jobs:
         if: >
           !startsWith(runner.os, 'Mac')
           || startsWith(matrix.python-version, 'pypy')
-          || matrix.python-version == '3.7'
         run: |
           # Next, build the wheel *in place*. This helps ccache, and also lets us cache the configure
           # output (pip install uses a random temporary directory, making this difficult).
           python setup.py build_ext -i
           python setup.py bdist_wheel
 
+      - name: Install AccessControl and dependencies (3.13)
+        if: matrix.python-version == '3.13'
+        run: |
+          # Install to collect dependencies into the (pip) cache.
+          # Use "--pre" here because dependencies with support for this future
+          # Python release may only be available as pre-releases
+          pip install --pre .[test]
       - name: Install AccessControl and dependencies
+        if: matrix.python-version != '3.13'
         run: |
           # Install to collect dependencies into the (pip) cache.
           pip install .[test]
@@ -211,19 +219,18 @@ jobs:
           startsWith(runner.os, 'Mac')
         uses: actions/upload-artifact@v4
         with:
-          name: AccessControl-${{ runner.os }}-${{ matrix.python-version }}.whl
+          # The x86_64 wheel is uploaded with a different name just so it can be
+          # manually downloaded when desired. The wheel itself *cannot* be tested
+          # on the GHA runner, which uses arm64 architecture.
+          name: AccessControl-${{ runner.os }}-${{ matrix.python-version }}-x86_64.whl
           path: dist/*x86_64.whl
       - name: Upload AccessControl wheel (macOS arm64)
         if: >
           startsWith(runner.os, 'Mac')
-          && !(startsWith(matrix.python-version, 'pypy')
-               || matrix.python-version == '3.7')
+          && !startsWith(matrix.python-version, 'pypy')
         uses: actions/upload-artifact@v4
         with:
-          # The arm64 wheel is uploaded with a different name just so it can be
-          # manually downloaded when desired. The wheel itself *cannot* be tested
-          # on the GHA runner, which uses x86_64 architecture.
-          name: AccessControl-${{ runner.os }}-${{ matrix.python-version }}-arm64.whl
+          name: AccessControl-${{ runner.os }}-${{ matrix.python-version }}.whl
           path: dist/*arm64.whl
       - name: Upload AccessControl wheel (all other platforms)
         if: >
@@ -241,6 +248,7 @@ jobs:
           && startsWith(github.ref, 'refs/tags')
           && !startsWith(runner.os, 'Linux')
           && !startsWith(matrix.python-version, 'pypy')
+          && !startsWith(matrix.python-version, '3.13')
         env:
           TWINE_PASSWORD: ${{ secrets.TWINE_PASSWORD }}
         run: |
@@ -253,19 +261,13 @@ jobs:
       fail-fast: false
       matrix:
         python-version:
-          - "3.7"
           - "3.8"
           - "3.9"
           - "3.10"
           - "3.11"
           - "3.12"
+          - "3.13"
         os: [ubuntu-latest, macos-latest, windows-latest]
-        exclude:
-          - os: macos-latest
-            python-version: "3.7"
-        include:
-          - python-version: "3.7"
-            os: macos-12
 
     steps:
       - name: checkout
@@ -274,6 +276,7 @@ jobs:
         uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
+          allow-prereleases: true
       ###
       # Caching.
       # This actually *restores* a cache and schedules a cleanup action
@@ -315,7 +318,23 @@ jobs:
         with:
           name: AccessControl-${{ runner.os }}-${{ matrix.python-version }}.whl
           path: dist/
+      - name: Install AccessControl 3.13 ${{ matrix.python-version }}
+        if: matrix.python-version == '3.13'
+        run: |
+          pip install -U wheel "setuptools<69"
+          pip install --pre cffi
+          # coverage might have a wheel on PyPI for a future python version which is
+          # not ABI compatible with the current one, so build it from sdist:
+          pip install -U --no-binary :all: coverage
+          # Unzip into src/ so that testrunner can find the .so files
+          # when we ask it to load tests from that directory. This
+          # might also save some build time?
+          unzip -n dist/AccessControl-*whl -d src
+          # Use "--pre" here because dependencies with support for this future
+          # Python release may only be available as pre-releases
+          pip install --pre -U -e .[test]
       - name: Install AccessControl
+        if: matrix.python-version != '3.13'
         run: |
           pip install -U wheel "setuptools<69"
           pip install -U coverage
@@ -370,6 +389,7 @@ jobs:
         uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
+          allow-prereleases: true
       ###
       # Caching.
       # This actually *restores* a cache and schedules a cleanup action
@@ -417,12 +437,9 @@ jobs:
           pip install -U wheel
           pip install -U `ls dist/AccessControl-*`[test]
       - name: Lint
-        # We only need to do this on one version, and it should be Python 3, because
-        # pylint has stopped updating for Python 2.
-        # TODO: Pick a linter and configuration and make this step right.
         run: |
-          pip install -U pylint
-          # python -m pylint --limit-inference-results=1 --rcfile=.pylintrc AccessControl -f parseable -r n
+          pip install -U tox
+          tox -e lint
 
   manylinux:
     runs-on: ubuntu-latest
@@ -440,6 +457,7 @@ jobs:
         uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
+          allow-prereleases: true
       ###
       # Caching.
       # This actually *restores* a cache and schedules a cleanup action
diff --git a/.manylinux-install.sh b/.manylinux-install.sh
index bc779a3..288d7a0 100755
--- a/.manylinux-install.sh
+++ b/.manylinux-install.sh
@@ -28,7 +28,7 @@ yum -y install libffi-devel
 
 tox_env_map() {
     case $1 in
-        *"cp37"*) echo 'py37';;
+        *"cp313"*) echo 'py313';;
         *"cp38"*) echo 'py38';;
         *"cp39"*) echo 'py39';;
         *"cp310"*) echo 'py310';;
@@ -41,14 +41,19 @@ tox_env_map() {
 # Compile wheels
 for PYBIN in /opt/python/*/bin; do
     if \
+       [[ "${PYBIN}" == *"cp313/"* ]] || \
        [[ "${PYBIN}" == *"cp311/"* ]] || \
        [[ "${PYBIN}" == *"cp312/"* ]] || \
-       [[ "${PYBIN}" == *"cp37/"* ]] || \
        [[ "${PYBIN}" == *"cp38/"* ]] || \
        [[ "${PYBIN}" == *"cp39/"* ]] || \
        [[ "${PYBIN}" == *"cp310/"* ]] ; then
-        "${PYBIN}/pip" install -e /io/
-        "${PYBIN}/pip" wheel /io/ -w wheelhouse/
+        if [[ "${PYBIN}" == *"cp313/"* ]] ; then
+            "${PYBIN}/pip" install --pre -e /io/
+            "${PYBIN}/pip" wheel /io/ --pre -w wheelhouse/
+        else
+            "${PYBIN}/pip" install -e /io/
+            "${PYBIN}/pip" wheel /io/ -w wheelhouse/
+        fi
         if [ `uname -m` == 'aarch64' ]; then
           cd /io/
           ${PYBIN}/pip install tox
diff --git a/.meta.toml b/.meta.toml
index 48ee12f..2114bed 100644
--- a/.meta.toml
+++ b/.meta.toml
@@ -2,13 +2,13 @@
 # https://github.com/zopefoundation/meta/tree/master/config/c-code
 [meta]
 template = "c-code"
-commit-id = "4dc0484e"
+commit-id = "9f78efd3"
 
 [python]
 with-appveyor = false
 with-windows = true
 with-pypy = false
-with-future-python = false
+with-future-python = true
 with-sphinx-doctests = false
 with-macos = false
 with-docs = false
@@ -37,3 +37,6 @@ additional-rules = [
     "recursive-include src *.h",
     "recursive-include src *.zcml",
     ]
+
+[c-code]
+require-cffi = true
diff --git a/CHANGES.rst b/CHANGES.rst
index 8907d9e..0f1280d 100644
--- a/CHANGES.rst
+++ b/CHANGES.rst
@@ -3,9 +3,13 @@ Changelog
 
 For changes before version 3.0, see ``HISTORY.rst``.
 
-6.4 (unreleased)
+7.0 (unreleased)
 ----------------
 
+- Add preliminary support for Python 3.13 as of 3.13b1.
+
+- Remove support for Python 3.7.
+
 - Build Windows wheels on GHA.
 
 - Make dict views (`.keys()`, `.items()` and `.values()`) behave like their
diff --git a/setup.py b/setup.py
index 2944bde..70c60d3 100644
--- a/setup.py
+++ b/setup.py
@@ -32,7 +32,7 @@
                  join('include', 'Acquisition', 'Acquisition.h')]),
 ]
 
-version = '6.4.dev0'
+version = '7.0.dev0'
 
 
 setup(name='AccessControl',
@@ -60,12 +60,12 @@
           'Operating System :: OS Independent',
           'Programming Language :: Python',
           'Programming Language :: Python :: 3',
-          'Programming Language :: Python :: 3.7',
           'Programming Language :: Python :: 3.8',
           'Programming Language :: Python :: 3.9',
           'Programming Language :: Python :: 3.10',
           'Programming Language :: Python :: 3.11',
           'Programming Language :: Python :: 3.12',
+          'Programming Language :: Python :: 3.13',
           'Programming Language :: Python :: Implementation :: CPython',
       ],
       ext_modules=ext_modules,
@@ -89,7 +89,7 @@
           'zope.testing',
           'funcsigs;python_version<"3.3"',
       ],
-      python_requires='>=3.7',
+      python_requires='>=3.8',
       include_package_data=True,
       zip_safe=False,
       extras_require={
diff --git a/tox.ini b/tox.ini
index 581d03c..617db14 100644
--- a/tox.ini
+++ b/tox.ini
@@ -4,18 +4,19 @@
 minversion = 4.0
 envlist =
     lint
-    py37,py37-pure
     py38,py38-pure
     py39,py39-pure
     py310,py310-pure
     py311,py311-pure
     py312,py312-pure
+    py313,py313-pure
     coverage
 
 [testenv]
 usedevelop = true
+pip_pre = py313: true
 deps =
-  setuptools < 69
+    setuptools < 69
 setenv =
     pure: PURE_PYTHON=1
     !pure-!pypy3: PURE_PYTHON=0