diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 9d3a3ca..ff84eda 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -97,21 +97,16 @@ jobs:
       matrix:
         python-version:
           - "pypy-3.10"
-          - "3.7"
           - "3.8"
           - "3.9"
           - "3.10"
           - "3.11"
           - "3.12"
+          - "3.13"
         os: [ubuntu-latest, macos-latest, windows-latest]
         exclude:
-          - os: macos-latest
-            python-version: "3.7"
           - os: macos-latest
             python-version: "pypy-3.10"
-        include:
-          - python-version: "3.7"
-            os: macos-12
 
     steps:
       - name: checkout
@@ -120,6 +115,7 @@ jobs:
         uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
+          allow-prereleases: true
       ###
       # Caching.
       # This actually *restores* a cache and schedules a cleanup action
@@ -156,17 +152,24 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-pip-
 
+      - name: Install Build Dependencies (3.13)
+        if: matrix.python-version == '3.13'
+        run: |
+          pip install -U pip
+          pip install -U "setuptools<69" wheel twine
+          pip install --pre cffi
       - name: Install Build Dependencies
+        if: matrix.python-version != '3.13'
         run: |
           pip install -U pip
           pip install -U "setuptools<69" wheel twine
+          pip install cffi
           pip install -U zope.proxy
 
-      - name: Build zope.security (macOS x86_64, Python 3.8+)
+      - name: Build zope.security (macOS x86_64)
         if: >
           startsWith(runner.os, 'Mac')
-          && !(startsWith(matrix.python-version, 'pypy')
-               || matrix.python-version == '3.7')
+          && !startsWith(matrix.python-version, 'pypy')
         env:
           MACOSX_DEPLOYMENT_TARGET: 10.9
           _PYTHON_HOST_PLATFORM: macosx-10.9-x86_64
@@ -176,11 +179,10 @@ jobs:
           # output (pip install uses a random temporary directory, making this difficult).
           python setup.py build_ext -i
           python setup.py bdist_wheel
-      - name: Build zope.security (macOS arm64, Python 3.8+)
+      - name: Build zope.security (macOS arm64)
         if: >
           startsWith(runner.os, 'Mac')
-          && !(startsWith(matrix.python-version, 'pypy')
-               || matrix.python-version == '3.7')
+          && !startsWith(matrix.python-version, 'pypy')
         env:
           MACOSX_DEPLOYMENT_TARGET: 11.0
           _PYTHON_HOST_PLATFORM: macosx-11.0-arm64
@@ -194,14 +196,21 @@ jobs:
         if: >
           !startsWith(runner.os, 'Mac')
           || startsWith(matrix.python-version, 'pypy')
-          || matrix.python-version == '3.7'
         run: |
           # Next, build the wheel *in place*. This helps ccache, and also lets us cache the configure
           # output (pip install uses a random temporary directory, making this difficult).
           python setup.py build_ext -i
           python setup.py bdist_wheel
 
+      - name: Install zope.security and dependencies (3.13)
+        if: matrix.python-version == '3.13'
+        run: |
+          # Install to collect dependencies into the (pip) cache.
+          # Use "--pre" here because dependencies with support for this future
+          # Python release may only be available as pre-releases
+          pip install --pre .[test]
       - name: Install zope.security and dependencies
+        if: matrix.python-version != '3.13'
         run: |
           # Install to collect dependencies into the (pip) cache.
           pip install .[test]
@@ -215,19 +224,18 @@ jobs:
           startsWith(runner.os, 'Mac')
         uses: actions/upload-artifact@v4
         with:
-          name: zope.security-${{ runner.os }}-${{ matrix.python-version }}.whl
+          # The x86_64 wheel is uploaded with a different name just so it can be
+          # manually downloaded when desired. The wheel itself *cannot* be tested
+          # on the GHA runner, which uses arm64 architecture.
+          name: zope.security-${{ runner.os }}-${{ matrix.python-version }}-x86_64.whl
           path: dist/*x86_64.whl
       - name: Upload zope.security wheel (macOS arm64)
         if: >
           startsWith(runner.os, 'Mac')
-          && !(startsWith(matrix.python-version, 'pypy')
-               || matrix.python-version == '3.7')
+          && !startsWith(matrix.python-version, 'pypy')
         uses: actions/upload-artifact@v4
         with:
-          # The arm64 wheel is uploaded with a different name just so it can be
-          # manually downloaded when desired. The wheel itself *cannot* be tested
-          # on the GHA runner, which uses x86_64 architecture.
-          name: zope.security-${{ runner.os }}-${{ matrix.python-version }}-arm64.whl
+          name: zope.security-${{ runner.os }}-${{ matrix.python-version }}.whl
           path: dist/*arm64.whl
       - name: Upload zope.security wheel (all other platforms)
         if: >
@@ -245,6 +253,7 @@ jobs:
           && startsWith(github.ref, 'refs/tags')
           && !startsWith(runner.os, 'Linux')
           && !startsWith(matrix.python-version, 'pypy')
+          && !startsWith(matrix.python-version, '3.13')
         env:
           TWINE_PASSWORD: ${{ secrets.TWINE_PASSWORD }}
         run: |
@@ -258,21 +267,16 @@ jobs:
       matrix:
         python-version:
           - "pypy-3.10"
-          - "3.7"
           - "3.8"
           - "3.9"
           - "3.10"
           - "3.11"
           - "3.12"
+          - "3.13"
         os: [ubuntu-latest, macos-latest, windows-latest]
         exclude:
-          - os: macos-latest
-            python-version: "3.7"
           - os: macos-latest
             python-version: "pypy-3.10"
-        include:
-          - python-version: "3.7"
-            os: macos-12
 
     steps:
       - name: checkout
@@ -281,6 +285,7 @@ jobs:
         uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
+          allow-prereleases: true
       ###
       # Caching.
       # This actually *restores* a cache and schedules a cleanup action
@@ -322,7 +327,23 @@ jobs:
         with:
           name: zope.security-${{ runner.os }}-${{ matrix.python-version }}.whl
           path: dist/
+      - name: Install zope.security ${{ matrix.python-version }}
+        if: matrix.python-version == '3.13'
+        run: |
+          pip install -U wheel "setuptools<69"
+          pip install --pre cffi
+          # coverage might have a wheel on PyPI for a future python version which is
+          # not ABI compatible with the current one, so build it from sdist:
+          pip install -U --no-binary :all: coverage
+          # Unzip into src/ so that testrunner can find the .so files
+          # when we ask it to load tests from that directory. This
+          # might also save some build time?
+          unzip -n dist/zope.security-*whl -d src
+          # Use "--pre" here because dependencies with support for this future
+          # Python release may only be available as pre-releases
+          pip install --pre -U -e .[test]
       - name: Install zope.security
+        if: matrix.python-version != '3.13'
         run: |
           pip install -U wheel "setuptools<69"
           pip install -U coverage
@@ -377,6 +398,7 @@ jobs:
         uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
+          allow-prereleases: true
       ###
       # Caching.
       # This actually *restores* a cache and schedules a cleanup action
@@ -445,6 +467,7 @@ jobs:
         uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
+          allow-prereleases: true
       ###
       # Caching.
       # This actually *restores* a cache and schedules a cleanup action
@@ -512,6 +535,7 @@ jobs:
         uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
+          allow-prereleases: true
       ###
       # Caching.
       # This actually *restores* a cache and schedules a cleanup action
diff --git a/.manylinux-install.sh b/.manylinux-install.sh
index d818c24..46cd34d 100755
--- a/.manylinux-install.sh
+++ b/.manylinux-install.sh
@@ -28,7 +28,7 @@ yum -y install libffi-devel
 
 tox_env_map() {
     case $1 in
-        *"cp37"*) echo 'py37';;
+        *"cp313"*) echo 'py313';;
         *"cp38"*) echo 'py38';;
         *"cp39"*) echo 'py39';;
         *"cp310"*) echo 'py310';;
@@ -41,14 +41,19 @@ tox_env_map() {
 # Compile wheels
 for PYBIN in /opt/python/*/bin; do
     if \
+       [[ "${PYBIN}" == *"cp313/"* ]] || \
        [[ "${PYBIN}" == *"cp311/"* ]] || \
        [[ "${PYBIN}" == *"cp312/"* ]] || \
-       [[ "${PYBIN}" == *"cp37/"* ]] || \
        [[ "${PYBIN}" == *"cp38/"* ]] || \
        [[ "${PYBIN}" == *"cp39/"* ]] || \
        [[ "${PYBIN}" == *"cp310/"* ]] ; then
-        "${PYBIN}/pip" install -e /io/
-        "${PYBIN}/pip" wheel /io/ -w wheelhouse/
+        if [[ "${PYBIN}" == *"cp313/"* ]] ; then
+            "${PYBIN}/pip" install --pre -e /io/
+            "${PYBIN}/pip" wheel /io/ --pre -w wheelhouse/
+        else
+            "${PYBIN}/pip" install -e /io/
+            "${PYBIN}/pip" wheel /io/ -w wheelhouse/
+        fi
         if [ `uname -m` == 'aarch64' ]; then
           cd /io/
           ${PYBIN}/pip install tox
diff --git a/.meta.toml b/.meta.toml
index 36b881c..425d95e 100644
--- a/.meta.toml
+++ b/.meta.toml
@@ -2,13 +2,13 @@
 # https://github.com/zopefoundation/meta/tree/master/config/c-code
 [meta]
 template = "c-code"
-commit-id = "1c0f31f5"
+commit-id = "13719585"
 
 [python]
 with-appveyor = true
 with-windows = true
 with-pypy = true
-with-future-python = false
+with-future-python = true
 with-docs = true
 with-sphinx-doctests = true
 with-macos = false
@@ -16,15 +16,12 @@ with-macos = false
 [tox]
 use-flake8 = true
 additional-envlist = [
-    "py37-watch, py311-watch",
+    "py38-watch, py311-watch",
     ]
 testenv-setenv = [
     "ZOPE_INTERFACE_STRICT_IRO=1",
     "watch: ZOPE_WATCH_CHECKERS=1",
     ]
-testenv-deps = [
-    "py37: urllib3 < 2",
-    ]
 
 [coverage]
 fail-under = 99.5
@@ -57,9 +54,12 @@ additional-config = [
 
 [github-actions]
 additional-config = [
-    "- [\"3.7\",   \"py37-watch\"]",
+    "- [\"3.8\",   \"py38-watch\"]",
     "- [\"3.11\",  \"py311-watch\"]",
     ]
 additional-build-dependencies = [
     "zope.proxy",
     ]
+
+[c-code]
+require-cffi = true
diff --git a/CHANGES.rst b/CHANGES.rst
index ccb30ab..860fe5c 100644
--- a/CHANGES.rst
+++ b/CHANGES.rst
@@ -2,9 +2,13 @@
  Changes
 =========
 
-6.3 (unreleased)
+7.0 (unreleased)
 ----------------
 
+- Add preliminary support for Python 3.13 as of 3.13b1.
+
+- Drop support for Python 3.7.
+
 - Build windows wheels on GHA.
 
 
diff --git a/setup.py b/setup.py
index 7bfbe17..77819d6 100644
--- a/setup.py
+++ b/setup.py
@@ -104,7 +104,7 @@ def read(*rnames):
 
 
 setup(name='zope.security',
-      version='6.3.dev0',
+      version='7.0.dev0',
       author='Zope Foundation and Contributors',
       author_email='zope-dev@zope.org',
       description='Zope Security Framework',
@@ -121,12 +121,12 @@ def read(*rnames):
           'License :: OSI Approved :: Zope Public License',
           'Programming Language :: Python',
           'Programming Language :: Python :: 3',
-          'Programming Language :: Python :: 3.7',
           'Programming Language :: Python :: 3.8',
           'Programming Language :: Python :: 3.9',
           'Programming Language :: Python :: 3.10',
           'Programming Language :: Python :: 3.11',
           'Programming Language :: Python :: 3.12',
+          'Programming Language :: Python :: 3.13',
           'Programming Language :: Python :: Implementation :: CPython',
           'Programming Language :: Python :: Implementation :: PyPy',
           'Natural Language :: English',
@@ -149,7 +149,7 @@ def read(*rnames):
           'build_ext': optional_build_ext,
       },
       ext_modules=ext_modules,
-      python_requires='>=3.7',
+      python_requires='>=3.8',
       install_requires=[
           'setuptools',
           'zope.component',
diff --git a/tox.ini b/tox.ini
index efbe3c6..06e615d 100644
--- a/tox.ini
+++ b/tox.ini
@@ -4,22 +4,23 @@
 minversion = 4.0
 envlist =
     lint
-    py37,py37-pure
     py38,py38-pure
     py39,py39-pure
     py310,py310-pure
     py311,py311-pure
     py312,py312-pure
+    py313,py313-pure
     pypy3
     docs
     coverage
-    py37-watch, py311-watch
+    py38-watch, py311-watch
 
 [testenv]
 usedevelop = true
+pip_pre = py313: true
 deps =
     setuptools < 69
-    py37: urllib3 < 2
+    Sphinx
 setenv =
     pure: PURE_PYTHON=1
     !pure-!pypy3: PURE_PYTHON=0
@@ -40,7 +41,6 @@ allowlist_externals =
     mkdir
 deps =
     coverage
-    py37: urllib3 < 2
 setenv =
     PURE_PYTHON=1
 commands =