diff --git a/.github/workflows/chacha20.yml b/.github/workflows/chacha20.yml
index a479375a..cdf2191d 100644
--- a/.github/workflows/chacha20.yml
+++ b/.github/workflows/chacha20.yml
@@ -39,16 +39,15 @@ jobs:
         with:
           toolchain: ${{ matrix.rust }}
           targets: ${{ matrix.target }}
-      - run: cargo build --target ${{ matrix.target }}
-      - run: cargo build --target ${{ matrix.target }} --features zeroize
+      - uses: RustCrypto/actions/cargo-hack-install@master
+      - run: cargo hack build --feature-powerset --target ${{ matrix.target }}
 
   minimal-versions:
-    if: false # TODO: temp disabled due to unpublished prerelease dependencies
     uses: RustCrypto/actions/.github/workflows/minimal-versions.yml@master
     with:
       working-directory: ${{ github.workflow }}
 
-  # Tests for runtime AVX2 detection
+  # Tests for runtime CPU feature detection
   autodetect:
     runs-on: ubuntu-latest
     strategy:
@@ -74,11 +73,10 @@ jobs:
         with:
           toolchain: ${{ matrix.rust }}
           targets: ${{ matrix.target }}
+      - uses: RustCrypto/actions/cargo-hack-install@master
       - run: ${{ matrix.deps }}
       - run: cargo check --target ${{ matrix.target }} --all-features
-      - run: cargo test --target ${{ matrix.target }}
-      - run: cargo test --target ${{ matrix.target }} --features zeroize
-      - run: cargo test --target ${{ matrix.target }} --all-features
+      - run: cargo hack test --feature-powerset --target ${{ matrix.target }}
 
   # Tests for the AVX2 backend
   avx2:
@@ -108,11 +106,10 @@ jobs:
         with:
           toolchain: ${{ matrix.rust }}
           targets: ${{ matrix.target }}
+      - uses: RustCrypto/actions/cargo-hack-install@master
       - run: ${{ matrix.deps }}
       - run: cargo check --target ${{ matrix.target }} --all-features
-      - run: cargo test --target ${{ matrix.target }}
-      - run: cargo test --target ${{ matrix.target }} --features zeroize
-      - run: cargo test --target ${{ matrix.target }} --all-features
+      - run: cargo hack test --feature-powerset --target ${{ matrix.target }}
 
   # Tests for the SSE2 backend
   sse2:
@@ -142,11 +139,10 @@ jobs:
         with:
           toolchain: ${{ matrix.rust }}
           targets: ${{ matrix.target }}
+      - uses: RustCrypto/actions/cargo-hack-install@master
       - run: ${{ matrix.deps }}
       - run: cargo check --target ${{ matrix.target }} --all-features
-      - run: cargo test --target ${{ matrix.target }}
-      - run: cargo test --target ${{ matrix.target }} --features zeroize
-      - run: cargo test --target ${{ matrix.target }} --all-features
+      - run: cargo hack test --feature-powerset --target ${{ matrix.target }}
 
   # Tests for the portable software backend
   soft:
@@ -176,11 +172,10 @@ jobs:
         with:
           toolchain: ${{ matrix.rust }}
           targets: ${{ matrix.target }}
+      - uses: RustCrypto/actions/cargo-hack-install@master
       - run: ${{ matrix.deps }}
       - run: cargo check --target ${{ matrix.target }} --all-features
-      - run: cargo test --target ${{ matrix.target }}
-      - run: cargo test --target ${{ matrix.target }} --features zeroize
-      - run: cargo test --target ${{ matrix.target }} --all-features
+      - run: cargo hack test --feature-powerset --target ${{ matrix.target }}
 
   # Cross-compiled tests
   cross:
diff --git a/chacha20/Cargo.toml b/chacha20/Cargo.toml
index 7fd58469..86c39d2d 100644
--- a/chacha20/Cargo.toml
+++ b/chacha20/Cargo.toml
@@ -22,7 +22,7 @@ rand_core-compatible RNGs based on those ciphers.
 cfg-if = "1"
 cipher = { version = "0.5.0-rc.1", optional = true, features = ["stream-wrapper"] }
 rand_core = { version = "0.9", optional = true, default-features = false }
-serde = { version = "1.0", features = ["derive"], optional = true }
+serde = { version = "1.0", optional = true, default-features = false, features = ["derive"] }
 
 # `zeroize` is an explicit dependency because this crate may be used without the `cipher` crate
 zeroize = { version = "1.8.1", optional = true, default-features = false }
diff --git a/chacha20/src/backends.rs b/chacha20/src/backends.rs
index ff16a657..936e0b67 100644
--- a/chacha20/src/backends.rs
+++ b/chacha20/src/backends.rs
@@ -1,3 +1,5 @@
+#![cfg(any(feature = "cipher", feature = "rng"))]
+
 use cfg_if::cfg_if;
 
 cfg_if! {
diff --git a/chacha20/src/lib.rs b/chacha20/src/lib.rs
index 52463bad..075d604b 100644
--- a/chacha20/src/lib.rs
+++ b/chacha20/src/lib.rs
@@ -144,6 +144,7 @@ pub use legacy::{ChaCha20Legacy, LegacyNonce};
 pub use xchacha::{XChaCha8, XChaCha12, XChaCha20, XNonce, hchacha};
 
 /// State initialization constant ("expand 32-byte k")
+#[cfg(any(feature = "cipher", feature = "rng"))]
 const CONSTANTS: [u32; 4] = [0x6170_7865, 0x3320_646e, 0x7962_2d32, 0x6b20_6574];
 
 /// Number of 32-bit words in the ChaCha state
@@ -230,6 +231,7 @@ impl<R: Rounds, V: Variant> ChaChaCore<R, V> {
     /// Constructs a ChaChaCore with the specified key, iv, and amount of rounds.
     /// You must ensure that the iv is of the correct size when using this method
     /// directly.
+    #[cfg(any(feature = "cipher", feature = "rng"))]
     fn new(key: &[u8; 32], iv: &[u8]) -> Self {
         let mut state = [0u32; STATE_WORDS];