diff --git a/.gitignore b/.gitignore
index 93802b22b..0bc7dc0b9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -37,6 +37,7 @@ zope.interface-*.egg
 /tahoe-deps/
 /tahoe-deps.tar.gz
 /.coverage
+/.coverage.*
 /.coverage.el
 /coverage-html/
 /miscaptures.txt
diff --git a/Makefile b/Makefile
index 6dd87409e..c1b8e7579 100644
--- a/Makefile
+++ b/Makefile
@@ -1,37 +1,53 @@
-
+# Tahoe LFS Development and maintenance tasks
+#
 # NOTE: this Makefile requires GNU make
 
-default:
-	@echo "no default target"
+### Defensive settings for make:
+#     https://tech.davis-hansson.com/p/make/
+SHELL := bash
+.ONESHELL:
+.SHELLFLAGS := -xeu -o pipefail -c
+.SILENT:
+.DELETE_ON_ERROR:
+MAKEFLAGS += --warn-undefined-variables
+MAKEFLAGS += --no-builtin-rules
 
+# Local target variables
 PYTHON=python
 export PYTHON
 PYFLAKES=flake8
 export PYFLAKES
-
 SOURCES=src/allmydata static misc setup.py
 APPNAME=tahoe-lafs
 
+
+# Top-level, phony targets
+
+.PHONY: default
+default:
+	@echo "no default target"
+
+.PHONY: test
+## Run all tests and code reports
+test: .tox
+	tox -p auto
+
 # This is necessary only if you want to automatically produce a new
 # _version.py file from the current git history (without doing a build).
 .PHONY: make-version
 make-version:
 	$(PYTHON) ./setup.py update_version
 
-.built:
-	$(MAKE) build
-
-src/allmydata/_version.py:
-	$(MAKE) make-version
-
 # Build OS X pkg packages.
-.PHONY: build-osx-pkg test-osx-pkg upload-osx-pkg
+.PHONY: build-osx-pkg
 build-osx-pkg:
 	misc/build_helpers/build-osx-pkg.sh $(APPNAME)
 
+.PHONY: test-osx-pkg
 test-osx-pkg:
 	$(PYTHON) misc/build_helpers/test-osx-pkg.py
 
+.PHONY: upload-osx-pkg
 upload-osx-pkg:
 	# [Failure instance: Traceback: <class 'OpenSSL.SSL.Error'>: [('SSL routines', 'ssl3_read_bytes', 'tlsv1 alert unknown ca'), ('SSL routines', 'ssl3_write_bytes', 'ssl handshake failure')]
 	#
@@ -42,29 +58,12 @@ upload-osx-pkg:
 	#   echo not uploading tahoe-lafs-osx-pkg because this is not trunk but is branch \"${BB_BRANCH}\" ; \
 	# fi
 
-# code coverage-based testing is disabled temporarily, as we switch to tox.
-# This will eventually be added to a tox environment. The following comments
-# and variable settings are retained as notes for that future effort.
-
-## # code coverage: install the "coverage" package from PyPI, do "make
-## # test-coverage" to do a unit test run with coverage-gathering enabled, then
-## # use "make coverage-output" to generate an HTML report. Also see "make
-## # .coverage.el" and misc/coding_tools/coverage.el for Emacs integration.
-##
-## # This might need to be python-coverage on Debian-based distros.
-## COVERAGE=coverage
-##
-## COVERAGEARGS=--branch --source=src/allmydata
-##
-## # --include appeared in coverage-3.4
-## COVERAGE_OMIT=--include '$(CURDIR)/src/allmydata/*' --omit '$(CURDIR)/src/allmydata/test/*'
-
-
 .PHONY: code-checks
 #code-checks: build version-and-path check-interfaces check-miscaptures -find-trailing-spaces -check-umids pyflakes
 code-checks: check-interfaces check-debugging check-miscaptures -find-trailing-spaces -check-umids pyflakes
 
 .PHONY: check-interfaces
+check-interfaces:
 	$(PYTHON) misc/coding_tools/check-interfaces.py 2>&1 |tee violations.txt
 	@echo
 
@@ -188,6 +187,7 @@ distclean: clean
 	rm -rf src/*.egg-info
 	rm -f src/allmydata/_version.py
 	rm -f src/allmydata/_appname.py
+	rm -rf ./.tox/
 
 
 .PHONY: find-trailing-spaces
@@ -220,3 +220,12 @@ tarballs: # delegated to tox, so setup.py can update setuptools if needed
 .PHONY: upload-tarballs
 upload-tarballs:
 	@if [ "X${BB_BRANCH}" = "Xmaster" ] || [ "X${BB_BRANCH}" = "X" ]; then for f in dist/*; do flappclient --furlfile ~/.tahoe-tarball-upload.furl upload-file $$f; done ; else echo not uploading tarballs because this is not trunk but is branch \"${BB_BRANCH}\" ; fi
+
+
+# Real targets
+
+src/allmydata/_version.py:
+	$(MAKE) make-version
+
+.tox: tox.ini setup.py
+	tox --notest -p all
diff --git a/newsfragments/3421.minor b/newsfragments/3421.minor
new file mode 100644
index 000000000..d6f70f6d9
--- /dev/null
+++ b/newsfragments/3421.minor
@@ -0,0 +1 @@
+Various, minor development `./Makefile` cleanup and improvement.
diff --git a/tox.ini b/tox.ini
index 6bc24273c..c9ec2bb1d 100644
--- a/tox.ini
+++ b/tox.ini
@@ -80,6 +80,7 @@ commands =
 
 
 [testenv:codechecks]
+basepython = python2.7
 # On macOS, git inside of towncrier needs $HOME.
 passenv = HOME
 whitelist_externals =