diff --git a/.ci/docker.env b/.ci/docker.env
index ef4fb2d58..6f2a304a2 100644
--- a/.ci/docker.env
+++ b/.ci/docker.env
@@ -24,3 +24,4 @@ WITH_TCTI
 GEN_FUZZ
 TEST_TCTI_CONFIG
 ENABLE_COVERAGE
+CODECOV_TOKEN
diff --git a/.ci/docker.run b/.ci/docker.run
index c45c8ad52..5defc1293 100755
--- a/.ci/docker.run
+++ b/.ci/docker.run
@@ -151,6 +151,11 @@ if [ -n "$BASE_REF" ]; then
 fi
 
 if [ "$ENABLE_COVERAGE" == "true" ]; then
-    bash <(curl -s https://codecov.io/bash)
+
+    lcov --capture --directory . --output-file ./coverage.info
+    curl -Os https://uploader.codecov.io/latest/linux/codecov
+    chmod +x codecov
+    ./codecov -f ./coverage.info -t ${CODECOV_TOKEN}
 fi
+
 exit 0
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 76e4a645a..6f1484b3a 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -127,11 +127,15 @@ jobs:
       - name: Launch Action
         uses:
           tpm2-software/ci/runCI@main
+        uses: codecov/codecov-action@v4
         with:
+          token: ${{ secrets.CODECOV_TOKEN }}
           CC: gcc
           DOCKER_IMAGE: ubuntu-20.04
           ENABLE_COVERAGE: true
           PROJECT_NAME: ${{ github.event.repository.name }}
+        env:
+          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
       - name: failure
         if: ${{ failure() }}
         run: cat $(find ../ -name test-suite.log) || true