diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index bd7127fd..9fb50f7c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -20,7 +20,6 @@ jobs:
       matrix:
         os: [ubuntu-20.04, windows-latest, macos-latest]
         python-version: ["3.7", "3.8", "3.9", "3.10", "3.11", "3.12"]
-        tox-version: ["latest", "<4"]
     steps:
       - uses: actions/checkout@v4
       - name: Set up Python ${{ matrix.python-version }}
@@ -37,8 +36,11 @@ jobs:
       - name: Install Nox-under-test
         run: |
           python -m pip install --disable-pip-version-check .
-      - name: Run tests on ${{ matrix.os }}
-        run: nox --non-interactive --error-on-missing-interpreter --session "tests(python='${{ matrix.python-version }}', tox_version='${{ matrix.tox-version }}')" -- --full-trace
+      - name: Run tests on ${{ matrix.os }} (tox <4)
+        run: nox --non-interactive --error-on-missing-interpreter --session "tests(python='${{ matrix.python-version }}', tox_version='<4')" -- --full-trace
+      - name: Run tests on ${{ matrix.os }} (tox latest)
+        run: nox --non-interactive --error-on-missing-interpreter --session "tests(python='${{ matrix.python-version }}', tox_version='latest')" -- --full-trace
+        if: matrix.python-version != '3.7'
       - name: Save coverage report
         uses: actions/upload-artifact@v3
         with:
diff --git a/noxfile.py b/noxfile.py
index fa10e1f5..336c45a2 100644
--- a/noxfile.py
+++ b/noxfile.py
@@ -31,6 +31,9 @@
     nox.options.sessions.append("conda_tests")
 
 
+# Because there is a dependency conflict between argcomplete and the latest tox
+# (both depend on a different version of importlibmetadata for Py 3.7) pip
+# installs tox 3 as the latest one for Py 3.7.
 @nox.session
 @nox.parametrize(
     "python, tox_version",
@@ -38,17 +41,11 @@
         (python, tox_version)
         for python in ("3.7", "3.8", "3.9", "3.10", "3.11", "3.12")
         for tox_version in ("latest", "<4")
+        if (python, tox_version) != ("3.7", "latest")
     ],
 )
 def tests(session: nox.Session, tox_version: str) -> None:
     """Run test suite with pytest."""
-    # Because there is a dependency conflict between
-    # argcomplete and the latest tox (both depend on
-    # a different version of importlibmetadata for Py 3.7)
-    # pip installs tox 3 as the latest one for Py 3.7.
-    if session.python == "3.7" and tox_version == "latest":
-        return
-
     session.create_tmp()  # Fixes permission errors on Windows
     session.install("-r", "requirements-test.txt")
     session.install("-e", ".[tox_to_nox]")
@@ -59,7 +56,6 @@ def tests(session: nox.Session, tox_version: str) -> None:
         "--cov=nox",
         "--cov-config",
         "pyproject.toml",
-        "--cov-report=",
         *session.posargs,
         env={
             "COVERAGE_FILE": f".coverage.{session.python}.tox.{tox_version.lstrip('<')}"
@@ -84,7 +80,7 @@ def cover(session: nox.Session) -> None:
     if ON_WINDOWS_CI:
         return
 
-    session.install("coverage[toml]")
+    session.install("coverage[toml]", "covdefaults")
     session.run("coverage", "combine")
     session.run("coverage", "report", "--fail-under=100", "--show-missing")
     session.run("coverage", "erase")
diff --git a/pyproject.toml b/pyproject.toml
index 8f60a5d9..436316fb 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -97,12 +97,12 @@ log_cli_level = "info"
 testpaths = [ "tests" ]
 
 [tool.coverage.run]
-branch = true
 relative_files = true
 omit = [ "nox/_typing.py" ]
+plugins = [ "covdefaults" ]
 
 [tool.coverage.report]
-exclude_lines = [ "pragma: no cover", "if TYPE_CHECKING:", "@overload" ]
+fail_under = 90  # 100 for combined coverage
 
 [tool.mypy]
 files = [ "nox/**/*.py", "noxfile.py" ]
diff --git a/requirements-test.txt b/requirements-test.txt
index c4c2ba52..67f87d27 100644
--- a/requirements-test.txt
+++ b/requirements-test.txt
@@ -1,3 +1,4 @@
+covdefaults
 flask
 myst-parser
 pytest>=6.0