diff --git a/.appveyor.yml b/.appveyor.yml
index 6891f1b32..90364823d 100644
--- a/.appveyor.yml
+++ b/.appveyor.yml
@@ -9,22 +9,8 @@ environment:
   CI_DEPS: codecov>=2.0.5
   CI_COMMANDS: codecov
   matrix:
-    - PYTHON: "C:\\Python35"
-      TOXENV: "py35"
-    # TODO: ENABLE WHEN AVAILABLE
-    # - PYTHON: "C:\\Python36"
-    #   TOXENV: "py36"
-
-  SNAPSHOT_HOST:
-    secure: NeTo57s2rJhCd/mjKHetXVxCFd3uhr8txnjnAXD1tUI=
-  SNAPSHOT_PORT:
-    secure: TiJPtg60/edYTH8RnoBErg==
-  SNAPSHOT_USER:
-    secure: 6yBwmO5gv4vAwoFYII8qjQ==
-  SNAPSHOT_PASS:
-    secure: LPjrtFrWxYhOVGXzfPRV1GjtZE/wHoKq9m/PI6hSalfysUK5p2DxTG9uHlb4Q9qV
-  RTOOL_KEY:
-    secure: 0a+UUNbA+JjquyAbda4fd0JmiwL06AdG6torRPdCvbPDbKHnaW/BHHp1nRPytOKM
+    - PYTHON: "C:\\Python36"
+      TOXENV: "py36"
 
 install:
   - "SET PATH=%PYTHON%;%PYTHON%\\Scripts;%PATH%"
@@ -36,17 +22,10 @@ test_script:
   - ps: |
       $Env:VERSION = $(python -m mitmproxy.version)
       $Env:SKIP_MITMPROXY = "python -c `"print('skip mitmproxy')`""
-      tox -e rtool -- wheel
-      tox -e rtool -- bdist
-
+      tox -e cibuild -- build
   - ps: |
-      if(
-        ($Env:TOXENV -match "py35") -and !$Env:APPVEYOR_PULL_REQUEST_NUMBER -and
-        (($Env:APPVEYOR_REPO_BRANCH -In ("master", "pyinstaller")) -or ($Env:APPVEYOR_REPO_TAG -match "true"))
-      ) {
-        echo "Decrypt license..."
-        tox -e rtool -- decrypt release\installbuilder\license.xml.enc release\installbuilder\license.xml
-        $ibVersion = "17.12.0"
+      if($Env:RTOOL_KEY) {
+        $ibVersion = "18.2.0"
         $ibSetup = "C:\projects\mitmproxy\release\installbuilder-installer.exe"
         $ibCli = "C:\Program Files (x86)\BitRock InstallBuilder Enterprise $ibVersion\bin\builder-cli.exe"
         if (!(Test-Path $ibSetup)) {
@@ -58,8 +37,8 @@ test_script:
         }
         echo "Install InstallBuilder..."
         Start-Process $ibSetup "--mode unattended --unattendedmodeui none" -PassThru -NoNewWindow -Wait
-        # Wait until executable exists - no idea why this is necessary.
-        while (!(Test-Path $ibCli)) { Start-Sleep 0.1 }
+        echo "Decrypt license..."
+        tox -e cibuild -- decrypt release\installbuilder\license.xml.enc release\installbuilder\license.xml
         echo "Run InstallBuilder..."
         &$ibCli `
           build `
@@ -73,15 +52,7 @@ test_script:
       }
 
 deploy_script:
-  # we build binaries on every run, but we only upload them for master snapshots or tags.
-  ps: |
-    if(
-      ($Env:TOXENV -match "py35") -and
-      (($Env:APPVEYOR_REPO_BRANCH -In ("master", "pyinstaller")) -or ($Env:APPVEYOR_REPO_TAG -match "true"))
-    ) {
-      tox -e rtool -- decrypt release\known_hosts.enc release\known_hosts
-      tox -e rtool -- upload-snapshot --bdist --wheel --installer
-    }
+  ps: tox -e cibuild -- upload
 
 cache:
   - C:\projects\mitmproxy\release\installbuilder-installer.exe -> .appveyor.yml
diff --git a/release/ci.py b/release/ci.py
index 666b921af..18209dfdd 100755
--- a/release/ci.py
+++ b/release/ci.py
@@ -10,6 +10,7 @@ import tarfile
 import zipfile
 from os.path import join, abspath, dirname, exists, basename
 
+import cryptography.fernet
 import click
 
 # https://virtualenv.pypa.io/en/latest/userguide.html#windows-notes
@@ -70,14 +71,17 @@ TOOLS = [
     for tool in tools
 ]
 
-if os.environ.get("TRAVIS_TAG", None):
-    VERSION = os.environ["TRAVIS_TAG"]
-elif os.environ.get("TRAVIS_BRANCH", None) in SNAPSHOT_BRANCHES:
-    VERSION = os.environ["TRAVIS_BRANCH"]
+TAG = os.environ.get("TRAVIS_TAG", os.environ.get("APPVEYOR_REPO_TAG_NAME", None))
+BRANCH = os.environ.get("TRAVIS_BRANCH", os.environ.get("APPVEYOR_REPO_BRANCH", None))
+if TAG:
+    VERSION = TAG
+elif BRANCH in SNAPSHOT_BRANCHES:
+    VERSION = BRANCH
 else:
-    print("Branch %s is not buildabranch - exiting." % os.environ.get("TRAVIS_BRANCH", None))
+    print("Branch %s is not build branch - exiting." % BRANCH)
     sys.exit(0)
 
+
 print("BUILD VERSION=%s" % VERSION)
 
 
@@ -206,15 +210,25 @@ def upload():
     """
         Upload snapshot to snapshot server
     """
-    subprocess.check_call(
-        [
-            "aws", "s3", "cp",
-            "--acl", "public-read",
-            DIST_DIR + "/",
-            "s3://snapshots.mitmproxy.org/%s/" % VERSION,
-            "--recursive",
-        ]
-    )
+    if "AWS_ACCESS_KEY_ID" in os.environ:
+        subprocess.check_call(
+            [
+                "aws", "s3", "cp",
+                "--acl", "public-read",
+                DIST_DIR + "/",
+                "s3://snapshots.mitmproxy.org/%s/" % VERSION,
+                "--recursive",
+            ]
+        )
+
+
+@cli.command("decrypt")
+@click.argument('infile', type=click.File('rb'))
+@click.argument('outfile', type=click.File('wb'))
+@click.argument('key', envvar='RTOOL_KEY')
+def decrypt(infile, outfile, key):
+    f = cryptography.fernet.Fernet(key.encode())
+    outfile.write(f.decrypt(infile.read()))
 
 
 if __name__ == "__main__":
diff --git a/release/rtool.py b/release/rtool.py
index a3f499143..2adc10962 100755
--- a/release/rtool.py
+++ b/release/rtool.py
@@ -11,6 +11,7 @@ import tarfile
 import zipfile
 from os.path import join, abspath, dirname
 
+import cryptography.fernet
 import click
 
 # https://virtualenv.pypa.io/en/latest/userguide.html#windows-notes
@@ -179,5 +180,14 @@ def homebrew_pr():
     ])
 
 
+@cli.command("encrypt")
+@click.argument('infile', type=click.File('rb'))
+@click.argument('outfile', type=click.File('wb'))
+@click.argument('key', envvar='RTOOL_KEY')
+def encrypt(infile, outfile, key):
+    f = cryptography.fernet.Fernet(key.encode())
+    outfile.write(f.encrypt(infile.read()))
+
+
 if __name__ == "__main__":
     cli()
diff --git a/tox.ini b/tox.ini
index 4b009851a..0033b8e8f 100644
--- a/tox.ini
+++ b/tox.ini
@@ -46,7 +46,7 @@ commands =
   pathoc --version
 
 [testenv:cibuild]
-passenv = TRAVIS_TAG TRAVIS_BRANCH AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY
+passenv = TRAVIS_TAG TRAVIS_BRANCH AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY APPVEYOR_REPO_TAG_NAME APPVEYOR_REPO_TAG APPVEYOR_REPO_BRANCH RTOOL_KEY
 deps =
   -rrequirements.txt
   pyinstaller==3.3.1