diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index ed4aaba..9c420eb 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -43,5 +43,5 @@ jobs:
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with: {go-version: stable, cache: false}
       - run: .github/scripts/generate-sboms.sh "$RUNNER_TEMP/sbom"
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with: {name: cyclonedx-sbom, path: '${{ runner.temp }}/sbom/*.cdx.json', if-no-files-found: error}
diff --git a/.github/workflows/soak.yml b/.github/workflows/soak.yml
index 93a41a3..2dfbd14 100644
--- a/.github/workflows/soak.yml
+++ b/.github/workflows/soak.yml
@@ -53,7 +53,7 @@ jobs:
 
       - name: Upload benchmark smoke artifacts
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: benchmark-smoke
           path: .artifacts/*
@@ -103,7 +103,7 @@ jobs:
 
       - name: Upload evidence logs
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: integration-evidence-${{ matrix.backend }}
           path: .artifacts/*
@@ -155,7 +155,7 @@ jobs:
 
       - name: Upload soak logs
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: integration-soak-${{ matrix.backend }}
           path: .artifacts/*
@@ -245,7 +245,7 @@ jobs:
 
       - name: Upload GA soak logs
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: soak-ga-${{ matrix.backend }}
           path: .artifacts/*
@@ -296,7 +296,7 @@ jobs:
 
       - name: Upload chaos logs
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: integration-chaos-${{ matrix.backend }}
           path: .artifacts/*
@@ -346,7 +346,7 @@ jobs:
 
       - name: Upload flake probe logs
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: integration-flake-repeat-${{ matrix.backend }}
           path: .artifacts/*
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 117ec95..b4dd685 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -83,7 +83,7 @@ jobs:
         run: ./scripts/coverage-codecov.sh unit
 
       - name: Preserve multi-module unit coverage
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: coverage-unit
           path: |
@@ -223,7 +223,7 @@ jobs:
         run: ./scripts/coverage-codecov.sh integration
 
       - name: Preserve integration coverage
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: coverage-integration-${{ matrix.backend }}
           path: coverage/coverage-integration-${{ matrix.backend }}.out
@@ -232,6 +232,9 @@ jobs:
           retention-days: 1
 
   coverage:
+    permissions:
+      contents: read
+      id-token: write
     needs: [unit, integration-all]
     runs-on: ubuntu-latest
     steps:
@@ -244,7 +247,7 @@ jobs:
           go-version: "stable"
 
       - name: Download coverage artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           pattern: coverage-*
           path: coverage-artifacts
@@ -260,8 +263,9 @@ jobs:
           echo "files=$profiles" >> "$GITHUB_OUTPUT"
 
       - name: Upload complete coverage to Codecov
-        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
         with:
+          use_oidc: true
           files: ${{ steps.coverage-files.outputs.files }}
           disable_search: true
           fail_ci_if_error: true
@@ -269,8 +273,6 @@ jobs:
           override_build: ${{ github.run_id }}-${{ github.run_attempt }}
           override_commit: ${{ github.event.pull_request.head.sha || github.sha }}
           verbose: true
-        env:
-          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
 
       - name: Wait for the exact Codecov report
         env: