diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6c7e5fbb..32123c9d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -103,6 +103,9 @@ jobs:
 
   coverage:
     runs-on: ${{ github.event.pull_request.head.repo.fork && 'ubuntu-latest' || 'cachekit-lean' }}
+    permissions:
+      contents: read
+      id-token: write # Required for Codecov OIDC
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
@@ -131,12 +134,16 @@ jobs:
       # aborts before exec; continue-on-error keeps the upload from reddening CI.
       # When this step is orange, read the log: "Could not verify signature" is
       # the guard working (never silence it); an upload error (token, network)
-      # only loses that upload.
+      # only loses that upload. Codecov requires a token on any same-repo branch
+      # (its error says "protected"). use_oidc mints one per run via the job's
+      # id-token: write, so no stored secret. Forks never attempt OIDC and upload
+      # tokenless; "Token required" on a same-repo run means OIDC did not mint.
       - name: Upload coverage
         uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         continue-on-error: true
         with:
           files: ./packages/cachekit/coverage/lcov.info
+          use_oidc: true
           fail_ci_if_error: true
 
   security: