diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c1b509d..ac06663 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -8,9 +8,24 @@ on:
 
 jobs:
   build:
+    strategy:
+      matrix:
+        go:
+          - "1.11.x" # Debian 10 "Buster"
+          - "1.13.x" # Ubuntu 20.04 LTS "focal"
+          - "1.15.x" # Debian 11 "Bullseye"
+          - "1.16.x" # Golang upstream stable
+          - "1.17.x" # Golang upstream stable
+      # Don't cancel everything when one Go version fails
+      fail-fast: false
     runs-on: ubuntu-latest
     steps:
 
+    - name: Install Go ${{ matrix.go }}
+      uses: actions/setup-go@v2
+      with:
+        go-version: ${{ matrix.go }}
+
     # Looks like Github Actions leaks fds to child processes
     # https://github.com/actions/runner/issues/1188
     - run: ls -l /proc/self/fd
@@ -26,7 +41,7 @@ jobs:
     - run: ./build-without-openssl.bash
     - uses: actions/upload-artifact@v2
       with:
-        name: gocryptfs static binary
+        name: gocryptfs static binary (Go ${{ matrix.go }})
         path: gocryptfs
 
     # Actual test steps are in the Makefile
diff --git a/Makefile b/Makefile
index c9c9975..e8fc4d7 100644
--- a/Makefile
+++ b/Makefile
@@ -51,6 +51,7 @@ ci:
 	go clean -modcache
 	# GOPROXY=off makes sure we fail instead of making network requests
 	# (we should not need any!)
-	GOPROXY=off ./build.bash
+	# "-mod=vendor" is required for Go 1.11
+	GOPROXY=off ./build.bash -mod=vendor
 	# Delete "vendor" dir
 	rm -R vendor