diff --git a/.travis.yml b/.travis.yml
index 917c4fc..8fc00d5 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -4,7 +4,7 @@
   include:
   - python: 3.5
     env: TOXENV=lint
-  - python: 3.5
+  - python: 3.6
     env: TOXENV=docs
   - python: 2.7
     env: TOXENV=py27
@@ -12,12 +12,14 @@
     env: TOXENV=py34
   - python: 3.5
     env: TOXENV=py35
+  - python: 3.6
+    env: TOXENV=py36
   - python: pypy
     env: TOXENV=pypy
-  - python: 3.5
+  - python: 3.6
     env: TOXENV=cover
-  - python: 3.5
-    env: TOXENV=py35-system SYSTEM_TEST=1 SKIP_APP_ENGINE_SYSTEM_TEST=1
+  - python: 3.6
+    env: TOXENV=py36-system SYSTEM_TEST=1 SKIP_APP_ENGINE_SYSTEM_TEST=1
   - python: 2.7
     env: TOXENV=py27-system SYSTEM_TEST=1 SKIP_APP_ENGINE_SYSTEM_TEST=1
 cache:
diff --git a/scripts/travis.sh b/scripts/travis.sh
index 84a227a..7359a0c 100755
--- a/scripts/travis.sh
+++ b/scripts/travis.sh
@@ -25,6 +25,9 @@
     if [[ $TRAVIS_SECURE_ENV_VARS == "true" ]]; then
         echo 'Extracting secrets.'
         scripts/decrypt-secrets.sh "$SECRETS_PASSWORD"
+        # Prevent build failures from leaking our password.
+        # looking at you, Tox.
+        export SECRETS_PASSWORD=""
     else
         # This is an external PR, so just mark system tests as green.
         echo 'In system test but secrets are not available, skipping.'
diff --git a/tox.ini b/tox.ini
index a2f7362..528806c 100644
--- a/tox.ini
+++ b/tox.ini
@@ -1,5 +1,5 @@
 [tox]
-envlist = lint,py27,py34,py35,pypy,cover
+envlist = lint,py27,py34,py35,py36,pypy,cover
 
 [testenv]
 deps =
@@ -18,15 +18,15 @@
   py.test --cov=google.auth --cov=google.oauth2 --cov=tests {posargs:tests}
 
 [testenv:cover]
-basepython = python3.5
+basepython = python3.6
 commands =
   py.test --cov=google.auth --cov=google.oauth2 --cov=tests --cov-report= tests
   coverage report --show-missing --fail-under=100
 deps =
   {[testenv]deps}
 
-[testenv:py35-system]
-basepython = python3.5
+[testenv:py36-system]
+basepython = python3.6
 changedir = {toxinidir}/system_tests
 commands =
   nox {posargs}
@@ -52,7 +52,7 @@
   CLOUD_SDK_ROOT
 
 [testenv:docgen]
-basepython = python3.5
+basepython = python3.6
 deps =
   {[testenv]deps}
   sphinx
@@ -63,7 +63,7 @@
   sphinx-apidoc --output-dir docs/reference --separate --module-first google
 
 [testenv:docs]
-basepython = python3.5
+basepython = python3.6
 deps =
   sphinx
   -r{toxinidir}/docs/requirements-docs.txt