diff --git a/.github/workflows/test-nextjs.yml b/.github/workflows/test-nextjs.yml
index 6bf1f7e..bb9449d 100644
--- a/.github/workflows/test-nextjs.yml
+++ b/.github/workflows/test-nextjs.yml
@@ -56,7 +56,7 @@ jobs:
       - name: Upload coverage to Codecov
         # Tokenless upload works for public repos via OIDC; CODECOV_TOKEN
         # is used when present (private-repo path / rate-limit relief).
-        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: ./coverage/lcov.info
diff --git a/.github/workflows/test-wordpress.yml b/.github/workflows/test-wordpress.yml
index 9580bb2..f274737 100644
--- a/.github/workflows/test-wordpress.yml
+++ b/.github/workflows/test-wordpress.yml
@@ -90,7 +90,7 @@ jobs:
           esac
 
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: wordpress/${{ matrix.tree }}/coverage.xml
diff --git a/.github/workflows/test-worker.yml b/.github/workflows/test-worker.yml
index 6c9ca7a..2dd47ca 100644
--- a/.github/workflows/test-worker.yml
+++ b/.github/workflows/test-worker.yml
@@ -88,7 +88,7 @@ jobs:
         # the submodule get uploaded alongside the merged cobertura.xml
         # and pollute the worker flag's numbers.
         if: always()
-        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: coverage/merged/kcov-merged/cobertura.xml