diff --git a/ci-constraints-requirements.txt b/ci-constraints-requirements.txt
index 4a0b58c320de..3bae95b92635 100644
--- a/ci-constraints-requirements.txt
+++ b/ci-constraints-requirements.txt
@@ -17,13 +17,13 @@ bleach==6.0.0
     # via readme-renderer
 build==0.10.0
     # via
-    #   check-manifest
+    #   check-sdist
     #   cryptography (pyproject.toml)
 certifi==2022.12.7
     # via requests
 charset-normalizer==3.1.0
     # via requests
-check-manifest==0.49
+check-sdist==0.1.2
     # via cryptography (pyproject.toml)
 click==8.1.3
     # via black
@@ -84,7 +84,9 @@ packaging==23.1
     #   pytest
     #   sphinx
 pathspec==0.11.1
-    # via black
+    # via
+    #   black
+    #   check-sdist
 pkginfo==1.9.6
     # via twine
 platformdirs==3.5.0
@@ -193,4 +195,3 @@ zipp==3.15.0
 # The following packages are considered to be unsafe in a requirements file:
 # cffi
 # pycparser
-# setuptools
diff --git a/noxfile.py b/noxfile.py
index 8f1b94a500fb..8c9cc218b56b 100644
--- a/noxfile.py
+++ b/noxfile.py
@@ -125,7 +125,7 @@ def flake(session: nox.Session) -> None:
 
     session.run("ruff", ".")
     session.run("black", "--check", ".")
-    session.run("check-manifest")
+    session.run("check-sdist")
     session.run(
         "mypy",
         "src/cryptography/",
diff --git a/pyproject.toml b/pyproject.toml
index 9c01f84e3b5a..6f786bdb7e9a 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -78,7 +78,7 @@ test-randomorder = ["pytest-randomly"]
 docs = ["sphinx >=5.3.0", "sphinx-rtd-theme >=1.1.1"]
 docstest =  ["pyenchant >=1.6.11", "twine >=1.12.0", "sphinxcontrib-spelling >=4.0.1"]
 sdist = ["build"]
-pep8test = ["black", "ruff", "mypy", "check-manifest"]
+pep8test = ["black", "ruff", "mypy", "check-sdist"]
 
 [tool.black]
 line-length = 79
@@ -143,3 +143,12 @@ line-length = 79
 
 [tool.ruff.isort]
 known-first-party = ["cryptography", "cryptography_vectors", "tests"]
+
+[tool.check-sdist]
+git-only = [
+    "vectors/*",
+    "release.py",
+    "ci-constraints-requirements.txt",
+    ".gitattributes",
+    ".gitignore",
+]
\ No newline at end of file
diff --git a/src/_cffi_src/build_openssl.py b/src/_cffi_src/build_openssl.py
index e199329db606..019789441431 100644
--- a/src/_cffi_src/build_openssl.py
+++ b/src/_cffi_src/build_openssl.py
@@ -54,7 +54,7 @@
 )
 
 if __name__ == "__main__":
-    out_dir = os.getenv("OUT_DIR")
+    out_dir = os.environ["OUT_DIR"]
     module_name, source, source_extension, kwds = ffi._assigned_source
     c_file = os.path.join(out_dir, module_name + source_extension)
     if platform.python_implementation() == "PyPy":
diff --git a/src/_cffi_src/utils.py b/src/_cffi_src/utils.py
index 9eb782686eae..b5fba37091d9 100644
--- a/src/_cffi_src/utils.py
+++ b/src/_cffi_src/utils.py
@@ -7,6 +7,7 @@
 import os
 import platform
 import sys
+import typing
 
 from cffi import FFI
 
@@ -18,9 +19,9 @@
 
 
 def build_ffi_for_binding(
-    module_name,
-    module_prefix,
-    modules,
+    module_name: str,
+    module_prefix: str,
+    modules: typing.List[str],
 ):
     """
     Modules listed in ``modules`` should have the following attributes:
@@ -54,9 +55,9 @@ def build_ffi_for_binding(
 
 
 def build_ffi(
-    module_name,
-    cdef_source,
-    verify_source,
+    module_name: str,
+    cdef_source: str,
+    verify_source: str,
 ):
     ffi = FFI()
     # Always add the CRYPTOGRAPHY_PACKAGE_VERSION to the shared object