diff --git a/.gitignore b/.gitignore
index 6505e716c..064e7fffe 100644
--- a/.gitignore
+++ b/.gitignore
@@ -51,3 +51,10 @@ tests/letstest/venv3/
 .certbot_test_workspace
 **/assets/pebble*
 **/assets/challtestsrv*
+
+# snap files
+.snapcraft
+parts
+prime
+stage
+*.snap
diff --git a/.travis.yml b/.travis.yml
index 72cd3a408..3b22429c1 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -11,17 +11,23 @@ before_script:
   # Use Travis retry feature for farm tests since they are flaky
   - 'if [[ "$TOXENV" == "travis-test-farm"* ]]; then export TRAVIS_RETRY=travis_retry; fi'
   - export TOX_TESTENV_PASSENV=TRAVIS
+  - 'if [[ "$SNAP" == true ]]; then snap/local/build_and_install.sh; fi'
 
 # Only build pushes to the master branch, PRs, and branches beginning with
-# `test-`, `travis-test-`, or of the form `digit(s).digit(s).x`. This reduces
-# the number of simultaneous Travis runs, which speeds turnaround time on
-# review since there is a cap of on the number of simultaneous runs.
+# `test-`, `travis-test-`, or of the form `digit(s).digit(s).x` or
+# `vdigit(s).digit(s).digit(s)`. As documented at
+# https://docs.travis-ci.com/user/customizing-the-build/#safelisting-or-blocklisting-branches,
+# this includes tags so pushing tags of the form `vdigit(s).digit(s).digit(s)`
+# will also trigger tests. This reduces the number of simultaneous Travis runs,
+# which speeds turnaround time on review since there is a cap of on the number
+# of simultaneous runs.
 branches:
   # When changing these branches, please ensure the documentation under
   # "Running tests in CI" is still correct.
   only:
     - master
-    - /^\d+\.\d+\.x$/
+    - /^\d+\.\d+\.x$/  # this matches our point release branches
+    - /^v\d+\.\d+\.\d+$/  # this matches our release tags
     - /^(travis-)?test-.*$/
 
 # Jobs for the main test suite are always executed (including on PRs) except for pushes on master.
@@ -36,10 +42,16 @@ extended-test-suite: &extended-test-suite
 matrix:
   include:
     # Main test suite
-    - python: "2.7"
+    - stage: "Test"
+      python: "2.7"
       env: ACME_SERVER=pebble TOXENV=integration
       <<: *not-on-master
 
+    # As documented at
+    # https://docs.travis-ci.com/user/build-stages/#how-to-define-build-stages,
+    # the previous stage will be automatically applied to all subsequent jobs
+    # until a new stage is defined.
+
     # This job is always executed, including on master
     - python: "3.8"
       env: TOXENV=py38-cover FYI="py38 tests + code coverage"
@@ -220,6 +232,51 @@ matrix:
           packages:  # don't install nginx and apache
             - libaugeas0
       <<: *extended-test-suite
+    - stage: "Snap"
+      sudo: required
+      env: SNAP=true TOXENV=integration-external,apacheconftest-external-with-pebble
+      addons:
+        apt:
+          packages:
+          - nginx-light
+        snaps:
+          - name: snapcraft
+            channel: stable
+            confinement: classic
+          - name: lxd
+            channel: stable
+      git:
+        # By default, Travis clones the repo to a depth of 50 commits which can
+        # break the ability to use `git describe` to set the version of the
+        # snap. This setting removes the --depth flag from git commands solving
+        # this problem. See
+        # https://docs.travis-ci.com/user/customizing-the-build#git-clone-depth
+        # for more info.
+        depth: false
+      deploy:
+        # This section relies on credentials stored in a SNAP_TOKEN environment
+        # variable in Travis. See
+        # https://docs.travis-ci.com/user/deployment/snaps/ for more info.
+        # This credential has a maximum lifetime of 1 year and the current
+        # credential will expire on 4/22/2021. The value of SNAP_TOKEN will
+        # need to be updated to use a new credential before then to prevent
+        # automated deploys from breaking. Remembering to do this is also
+        # tracked by https://github.com/certbot/certbot/issues/7931.
+        'on':
+          # Deploy on release tags or nightly runs from any branch. We only try
+          # to deploy from the certbot/certbot repo to prevent errors if forks
+          # of this repo try to run tests.
+          all_branches: true
+          condition: -n $TRAVIS_TAG || $TRAVIS_EVENT_TYPE = cron
+          repo: certbot/certbot
+        provider: snap
+        snap: certbot_*.snap
+        channel: edge
+        # skip_cleanup is needed to prevent Travis from deleting the snaps we
+        # just built and tested. See
+        # https://docs.travis-ci.com/user/deployment#uploading-files-and-skip_cleanup.
+        skip_cleanup: true
+      <<: *extended-test-suite
 
 # container-based infrastructure
 sudo: false
diff --git a/snap/.gitignore b/snap/.gitignore
deleted file mode 100644
index 2a339aeaa..000000000
--- a/snap/.gitignore
+++ /dev/null
@@ -1,8 +0,0 @@
-.snapcraft
-parts
-prime
-stage
-*.snap
-certbot
-venv
-.idea
diff --git a/snap/.travis.yml b/snap/.travis.yml
deleted file mode 100644
index 125893985..000000000
--- a/snap/.travis.yml
+++ /dev/null
@@ -1,34 +0,0 @@
-language: python
-before_install:
-  - sudo -E apt-get -yq --no-install-suggests --no-install-recommends install nginx-light python3-venv
-  - sudo -E /etc/init.d/nginx stop
-install:
-  - sudo /snap/bin/lxd.migrate -yes
-  - sudo /snap/bin/lxd waitready
-  - sudo /snap/bin/lxd init --auto
-  - git clone https://github.com/certbot/certbot.git certbot --branch master
-  - certbot/tools/strip_hashes.py certbot/letsencrypt-auto-source/pieces/dependency-requirements.txt > certbot/constraints.txt
-before_script:
-  - sudo snapcraft --use-lxd
-script:
-  - sudo snap install --dangerous --classic *.snap
-  - sudo bash test.sh
-deploy:
-  'on':
-    branch: master
-  provider: snap
-  snap: certbot_*.snap
-  channel: edge
-  skip_cleanup: true
-notifications:
-  email:
-    recipients: [robie.basak@canonical.com]
-    on_failure: change
-addons:
-  snaps:
-    - name: snapcraft
-      # TODO: move back to stable channel once snapcraft 3.10 has been pushed to it.
-      channel: candidate
-      classic: true
-    - name: lxd
-      channel: stable
diff --git a/snap/local/build_and_install.sh b/snap/local/build_and_install.sh
new file mode 100755
index 000000000..4c9754d3e
--- /dev/null
+++ b/snap/local/build_and_install.sh
@@ -0,0 +1,14 @@
+#!/bin/bash
+set -ex
+
+if [[ -z "$TRAVIS" ]]; then
+    echo "This script makes global changes to the system it is run on so should only be run in CI."
+    exit 1
+fi
+
+sudo /snap/bin/lxd.migrate -yes
+sudo /snap/bin/lxd waitready
+sudo /snap/bin/lxd init --auto
+tools/strip_hashes.py letsencrypt-auto-source/pieces/dependency-requirements.txt > constraints.txt
+sudo snapcraft --use-lxd
+sudo snap install --dangerous --classic *.snap
diff --git a/snap/snap/snapcraft.yaml b/snap/snapcraft.yaml
similarity index 97%
rename from snap/snap/snapcraft.yaml
rename to snap/snapcraft.yaml
index 53643865a..2e4f68c00 100644
--- a/snap/snap/snapcraft.yaml
+++ b/snap/snapcraft.yaml
@@ -45,13 +45,13 @@ parts:
     build-packages: [libaugeas-dev]
   acme:
     plugin: python
-    source: certbot
+    source: .
     source-subdir: acme
     constraints: [$SNAPCRAFT_PART_SRC/constraints.txt]
     python-version: python3
   certbot:
     plugin: python
-    source: certbot
+    source: .
     source-subdir: certbot
     constraints: [$SNAPCRAFT_PART_SRC/constraints.txt]
     python-version: python3
@@ -64,7 +64,7 @@ parts:
       - -usr/lib/python3.6/sitecustomize.py
   certbot-apache:
     plugin: python
-    source: certbot
+    source: .
     source-subdir: certbot-apache
     constraints: [$SNAPCRAFT_PART_SRC/constraints.txt]
     python-version: python3
@@ -75,7 +75,7 @@ parts:
       - -lib/python3.6/site-packages/augeas.py
   certbot-nginx:
     plugin: python
-    source: certbot
+    source: .
     source-subdir: certbot-nginx
     constraints: [$SNAPCRAFT_PART_SRC/constraints.txt]
     python-version: python3
diff --git a/snap/test.sh b/snap/test.sh
deleted file mode 100644
index e6aca7efd..000000000
--- a/snap/test.sh
+++ /dev/null
@@ -1,11 +0,0 @@
-#!/bin/bash
-set -ex
-
-python3 -m venv venv
-venv/bin/python -m pip install -e certbot/certbot-ci
-venv/bin/python -m pytest certbot/certbot-ci/certbot_integration_tests -n 4
-
-# DO NOT RUN `apache-conf-test` LOCALLY, IT WILL BREAK YOUR APACHE CONFIGURATION!
-if [ -n "$TRAVIS" ]; then
-    venv/bin/python certbot/certbot-apache/tests/apache-conf-files/apache-conf-test-pebble.py --debian-modules
-fi
diff --git a/tox.ini b/tox.ini
index 7f5b7bd5a..46e73e32f 100644
--- a/tox.ini
+++ b/tox.ini
@@ -138,15 +138,22 @@ commands =
 
 [testenv:apacheconftest]
 commands =
-    {[base]pip_install} acme certbot certbot-apache certbot-compatibility-test
+    {[base]pip_install} acme certbot certbot-apache
     {toxinidir}/certbot-apache/tests/apache-conf-files/apache-conf-test --debian-modules
 passenv =
     SERVER
 
+[testenv:apacheconftest-external-with-pebble]
+# Run apacheconftest with pebble and Certbot outside of tox's virtual
+# environment.
+commands =
+    {[base]pip_install} certbot-ci
+    {toxinidir}/certbot-apache/tests/apache-conf-files/apache-conf-test-pebble.py --debian-modules
+
 [testenv:apacheconftest-with-pebble]
 commands =
-    {[base]pip_install} acme certbot certbot-apache certbot-ci certbot-compatibility-test
-    {toxinidir}/certbot-apache/tests/apache-conf-files/apache-conf-test-pebble.py --debian-modules
+    {[base]pip_install} acme certbot certbot-apache
+    {[testenv:apacheconftest-external-with-pebble]commands}
 
 [testenv:nginxroundtrip]
 commands =
@@ -250,6 +257,14 @@ commands =
         --cov-config=certbot-ci/certbot_integration_tests/.coveragerc
     coverage report --include 'certbot/*' --show-missing --fail-under=62
 
+[testenv:integration-external]
+# Run integration tests with Certbot outside of tox's virtual environment.
+commands =
+    {[base]pip_install} certbot-ci
+    pytest certbot-ci/certbot_integration_tests \
+        --acme-server={env:ACME_SERVER:pebble}
+passenv = DOCKER_*
+
 [testenv:integration-certbot-oldest]
 commands =
     {[base]pip_install} certbot