diff --git a/.github/workflows/codecov.yml b/.github/workflows/codecov.yml
index c313f13efc77d..ec63ae9bdb394 100644
--- a/.github/workflows/codecov.yml
+++ b/.github/workflows/codecov.yml
@@ -11,6 +11,8 @@ jobs:
     name: collect
     if: github.repository == 'aws/aws-cdk'
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write    
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -19,10 +21,10 @@ jobs:
         uses: actions/setup-node@v4
 
       - name: Install dependencies
-        run: cd packages/aws-cdk && yarn install
+        run: yarn install
 
       - name: Build CLI
-        run: cd packages/aws-cdk && npx lerna run build --scope=aws-cdk
+        run: npx lerna run build --scope=aws-cdk
 
       - name: Run tests
         run: cd packages/aws-cdk && yarn test
@@ -33,4 +35,4 @@ jobs:
           directory: packages/aws-cdk/coverage
           fail_ci_if_error: true
           flags: suite.unit
-          token: ${{ secrets.CODECOV_TOKEN }}
+          use_oidc: true
diff --git a/.mergify.yml b/.mergify.yml
index 98299ebd0e518..b9ffeae147913 100644
--- a/.mergify.yml
+++ b/.mergify.yml
@@ -15,10 +15,6 @@ queue_rules:
       - "#changes-requested-reviews-by=0"
       - status-success~=AWS CodeBuild us-east-1
       - status-success=validate-pr
-      - status-success=codecov/patch
-      - status-success=codecov/patch/packages/aws-cdk
-      - status-success=codecov/project
-      - status-success=codecov/project/packages/aws-cdk      
     commit_message_template: |-
       {{ title }} (#{{ number }})
       {{ body }}
@@ -37,10 +33,6 @@ queue_rules:
       - "#changes-requested-reviews-by=0"
       - status-success~=AWS CodeBuild us-east-1
       - status-success=validate-pr
-      - status-success=codecov/patch
-      - status-success=codecov/patch/packages/aws-cdk
-      - status-success=codecov/project
-      - status-success=codecov/project/packages/aws-cdk      
     commit_message_template: |-
       {{ title }} (#{{ number }})
       {{ body }}
@@ -72,10 +64,6 @@ pull_request_rules:
       - "#changes-requested-reviews-by=0"
       - status-success~=AWS CodeBuild us-east-1
       - status-success=validate-pr
-      - status-success=codecov/patch
-      - status-success=codecov/patch/packages/aws-cdk
-      - status-success=codecov/project
-      - status-success=codecov/project/packages/aws-cdk      
   - name: automatic merge (2+ approvers)
     actions:
       comment:
@@ -96,10 +84,6 @@ pull_request_rules:
       - "#changes-requested-reviews-by=0"
       - status-success~=AWS CodeBuild us-east-1
       - status-success=validate-pr
-      - status-success=codecov/patch
-      - status-success=codecov/patch/packages/aws-cdk
-      - status-success=codecov/project
-      - status-success=codecov/project/packages/aws-cdk      
   - name: automatic merge (no-squash)
     actions:
       comment:
@@ -120,10 +104,6 @@ pull_request_rules:
       - "#changes-requested-reviews-by=0"
       - status-success~=AWS CodeBuild us-east-1
       - status-success=validate-pr
-      - status-success=codecov/patch
-      - status-success=codecov/patch/packages/aws-cdk
-      - status-success=codecov/project
-      - status-success=codecov/project/packages/aws-cdk      
   - name: remove stale reviews
     actions:
       dismiss_reviews:
@@ -163,7 +143,3 @@ pull_request_rules:
       - "#changes-requested-reviews-by=0"
       - status-success~=AWS CodeBuild us-east-1
       - status-success=validate-pr
-      - status-success=codecov/patch
-      - status-success=codecov/patch/packages/aws-cdk
-      - status-success=codecov/project
-      - status-success=codecov/project/packages/aws-cdk      
diff --git a/packages/aws-cdk/jest.config.js b/packages/aws-cdk/jest.config.js
index 6519819936478..a6aa99d846bfa 100644
--- a/packages/aws-cdk/jest.config.js
+++ b/packages/aws-cdk/jest.config.js
@@ -12,7 +12,8 @@ module.exports = {
             lines: 81
         },
     },
-    "coveragePathIgnorePatterns": [
+    coveragePathIgnorePatterns: [
+        ...baseConfig.coveragePathIgnorePatterns,
         // Mostly wrappers around the SDK, which get mocked in unit tests
         "<rootDir>/lib/api/aws-auth/sdk.ts",
     ],
diff --git a/packages/aws-cdk/lib/api/logs/logs-monitor.ts b/packages/aws-cdk/lib/api/logs/logs-monitor.ts
index c2757514a1463..5594d3f4cb8ff 100644
--- a/packages/aws-cdk/lib/api/logs/logs-monitor.ts
+++ b/packages/aws-cdk/lib/api/logs/logs-monitor.ts
@@ -124,10 +124,10 @@ export class CloudWatchLogEventMonitor {
   }
 
   private async tick(): Promise<void> {
+    // excluding from codecoverage because this
+    // doesn't always run (depends on timing)
+    /* istanbul ignore next */
     if (!this.active) {
-      // excluding from codecoverage because this
-      // doesn't always run (depends on timing)
-      /* istanbul ignore next */
       return;
     }
     try {