diff --git a/.gitattributes b/.gitattributes
deleted file mode 100644
index ddd2219f..00000000
--- a/.gitattributes
+++ /dev/null
@@ -1 +0,0 @@
-test/e2e/fixtures/* binary linguist-vendored
diff --git a/package.json b/package.json
index 77e3b89f..15363a02 100644
--- a/package.json
+++ b/package.json
@@ -62,10 +62,12 @@
 		"slugg": "^1.2.0"
 	},
 	"devDependencies": {
+		"@pollyjs/adapter-node-http": "^6.0.5",
+		"@pollyjs/core": "^6.0.5",
+		"@pollyjs/persister-fs": "^6.0.5",
 		"eslint": "^8.15.0",
 		"is-coordinates": "^2.0.2",
 		"is-roughly-equal": "^0.1.0",
-		"replayer": "^2.2.3",
 		"tap": "^16.2.0",
 		"validate-fptf": "^3.0.0"
 	},
diff --git a/test/e2e/lib/util.js b/test/e2e/lib/util.js
index fb154efa..ca590b7c 100644
--- a/test/e2e/lib/util.js
+++ b/test/e2e/lib/util.js
@@ -38,17 +38,60 @@ const assertValidWhen = (actual, expected, name, delta = day + 6 * hour) => {
 // HTTP request mocking
 if (process.env.VCR_MODE && !process.env.VCR_OFF) {
 	const require = createRequire(import.meta.url)
-	const replayer = require('replayer')
 
-	replayer.configure({
-		headerWhitelist: [
-			// excludes User-Agent & Connection
-			'Content-Type', 'Accept-Encoding', 'Accept',
-		],
-		includeHeaderValues: true,
-		touchHits: false,
+	const {Polly} = require('@pollyjs/core')
+	const NodeHttpAdapter = require('@pollyjs/adapter-node-http')
+	const FSPersister = require('@pollyjs/persister-fs')
+	const tap = require('tap')
+
+	Polly.register(NodeHttpAdapter)
+	Polly.register(FSPersister)
+
+	let mode
+	if (process.env.VCR_MODE === 'record') mode = 'record'
+	else if (process.env.VCR_MODE === 'playback') mode = 'replay'
+	else throw new Error('invalid $VCR_MODE, must be "record" or "replay"')
+
+	const polly = new Polly('requests', {
+		logLevel: 'warn',
+		// If a request's recording is not found, pass-through to the server and record the response.
+		recordIfMissing: false,
+		// If false, Polly will throw when attempting to persist any failed requests. A request is considered to be a failed request when its response's status code is ≥ 400.
+		recordFailedRequests: true,
+		// Await any unresolved requests handled by the polly instance (via flush) when stop is called.
+		flushRequestsOnStop: true,
+		// The Polly mode. Can be one of the following:
+		// - replay: Replay responses from recordings.
+		// - record: Force Polly to record all requests. This will overwrite recordings that already exist.
+		// - passthrough: Passes all requests through directly to the server without recording or replaying.
+		mode,
+		adapters: ['node-http'],
+		persister: 'fs',
+		persisterOptions: {
+			fs: {
+				recordingsDir: new URL('../fixtures', import.meta.url).pathname,
+			},
+			// When disabled, requests that have not been captured by the running Polly instance will be removed from any previous recording. This ensures that a recording will only contain the requests that were made during the lifespan of the Polly instance. When enabled, new requests will be appended to the recording file.
+			keepUnusedRequests: true, // todo: change to false?
+		},
+		matchRequestsBy: {
+			headers: {
+				// todo: use an allow-list here?
+				exclude: [
+					// request
+					'user-agent', // randomised
+					'connection', // not relevant for tests
+					// response
+					'set-cookie', // often randomised
+					'date', // constantly changing
+				],
+			},
+		},
+	})
+
+	tap.teardown(async () => {
+		await polly.stop()
 	})
-	replayer.fixtureDir(new URL('../fixtures', import.meta.url).pathname)
 }
 
 export {