diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 87b7317f13f..b45bacf4bf9 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -100,8 +100,9 @@ jobs:
         run: pipx run coverage xml --ignore-errors
       - name: Publish coverage
         if: hashFiles('coverage.xml') != ''  # Rudimentary `file.exists()`
-        uses: codecov/codecov-action@v3
+        uses: codecov/codecov-action@v4
         with:
+          token: ${{ secrets.CODECOV_TOKEN }}
           flags: >-  # Mark which lines are covered by which envs
             CI-GHA,
             ${{ github.job }},
@@ -190,8 +191,9 @@ jobs:
         shell: C:\cygwin\bin\env.exe CYGWIN_NOWINPATH=1 CHERE_INVOKING=1 C:\cygwin\bin\bash.exe -leo pipefail -o igncr {0}
       - name: Publish coverage
         if: hashFiles('coverage.xml') != ''  # Rudimentary `file.exists()`
-        uses: codecov/codecov-action@v3
+        uses: codecov/codecov-action@v4
         with:
+          token: ${{ secrets.CODECOV_TOKEN }}
           files: >-
             ${{ github.workspace }}\coverage.xml
           flags: >-  # Mark which lines are covered by which envs