diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
index 55bf93119ea..f93aa8e7107 100644
--- a/.github/workflows/checks.yml
+++ b/.github/workflows/checks.yml
@@ -109,3 +109,5 @@ jobs:
           check-latest: true
       - name: Run test action
         uses: ./.github/workflows/test-action
+        with:
+          codecov_token: ${{ secrets.CODECOV_TOKEN }}
diff --git a/.github/workflows/prerelease-check.yml b/.github/workflows/prerelease-check.yml
index 3b587daa3d4..0c3d7b6d260 100644
--- a/.github/workflows/prerelease-check.yml
+++ b/.github/workflows/prerelease-check.yml
@@ -102,6 +102,8 @@ jobs:
           check-latest: true
       - name: Run test action
         uses: ./.github/workflows/test-action
+        with:
+          codecov_token: ${{ secrets.CODECOV_TOKEN }}
   release-helper:
     permissions:
       contents: read # to fetch code (actions/checkout)
diff --git a/.github/workflows/test-action/action.yml b/.github/workflows/test-action/action.yml
index c25b24609da..b8165c7daca 100644
--- a/.github/workflows/test-action/action.yml
+++ b/.github/workflows/test-action/action.yml
@@ -15,6 +15,11 @@
 name: test
 description: "Runs go tests"
 
+inputs:
+  codecov_token:
+    description: "Token for uploading coverage reports to Codecov"
+    required: true
+
 runs:
   using: composite
   steps:
@@ -24,4 +29,7 @@ runs:
         TEST_ACCEPTANCE: true
       run: ./scripts/run_tests.sh
     - name: Upload coverage to Codecov
-      uses: codecov/codecov-action@ab904c41d6ece82784817410c45d8b8c02684457 # v3.1.6
+      uses: codecov/codecov-action@84508663e988701840491b86de86b666e8a86bed # v4.3.0
+      with:
+        token: ${{ inputs.CODECOV_TOKEN }}
+        fail_ci_if_error: true