diff --git a/.github/workflows/coverage-baseline.yml b/.github/workflows/coverage-baseline.yml
index 8235919..79ff1f3 100644
--- a/.github/workflows/coverage-baseline.yml
+++ b/.github/workflows/coverage-baseline.yml
@@ -1,7 +1,7 @@
 name: Coverage baseline
 
-# Refreshes the Codecov baseline for `main` so PR comparisons have a recent
-# base commit to diff against. Runs weekly (Monday 06:00 America/New_York,
+# Runs the canonical coverage row against `main` so coverage drift after a
+# merge stays visible. Runs weekly (Monday 06:00 America/New_York,
 # 11:00 UTC) and on demand; scheduled runs always use the default branch.
 # It stands in for a `push: branches: [main]` trigger on tests.yml, which
 # would re-run the full matrix after every merge. Steps mirror the canonical
@@ -69,22 +69,3 @@ jobs:
           name: coverage-xml-${{ github.sha }}
           path: coverage.xml
           retention-days: 7
-
-      - name: Upload coverage to Codecov
-        id: codecov
-        # Same detection as tests.yml: fail_ci_if_error surfaces an HTTP >= 400
-        # as a step failure, continue-on-error keeps the job green.
-        continue-on-error: true
-        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
-        with:
-          files: ./coverage.xml
-          disable_search: true
-          token: ${{ secrets.CODECOV_TOKEN }}
-          fail_ci_if_error: true
-
-      - name: Report a rejected Codecov upload
-        if: steps.codecov.outcome == 'failure'
-        run: |
-          msg="Codecov rejected the upload (repository not activated or token mismatch) — coverage is still enforced by pest --min and shown in the job summary. See the 'Upload coverage to Codecov' step log for the server response."
-          echo "::warning title=Codecov upload failed::$msg"
-          printf '\n> [!WARNING]\n> %s\n' "$msg" >> "$GITHUB_STEP_SUMMARY"
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index ef11f9a..2014b03 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -1,7 +1,7 @@
 name: Tests
 
-# Tests gate pull requests only. The Codecov baseline for `main` is refreshed
-# by coverage-baseline.yml on a schedule, not by a push trigger.
+# Tests gate pull requests only. Coverage on `main` is refreshed by
+# coverage-baseline.yml on a schedule, not by a push trigger.
 on:
   pull_request:
     branches: [ main, develop ]
@@ -70,9 +70,9 @@ jobs:
         run: vendor/bin/pest --group=security
 
       # PHP 8.4 / prefer-stable is the canonical coverage row: it writes the
-      # job summary, keeps coverage.xml, and uploads to Codecov. The floor is
-      # enforced on every row by --min above (composer.json test:coverage
-      # carries the same number, which is where the summary reads it from).
+      # job summary and keeps coverage.xml. The floor is enforced on every row
+      # by --min above (composer.json test:coverage carries the same number,
+      # which is where the summary reads it from).
       - name: Coverage summary
         # always(): show the numbers even when the run fails the floor.
         if: >-
@@ -90,29 +90,6 @@ jobs:
           path: coverage.xml
           retention-days: 7
 
-      - name: Upload coverage to Codecov
-        id: codecov
-        if: matrix.php == '8.4' && matrix.dependency-version == 'prefer-stable'
-        # Advisory: the gate is --min, and the job summary shows the numbers.
-        # fail_ci_if_error makes the CLI exit non-zero when Codecov answers
-        # HTTP >= 400 (with it off, the action always exits 0 and a rejection
-        # is silent); continue-on-error keeps that from failing the job, and
-        # the next step turns it into a visible warning.
-        continue-on-error: true
-        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
-        with:
-          files: ./coverage.xml
-          disable_search: true
-          token: ${{ secrets.CODECOV_TOKEN }}
-          fail_ci_if_error: true
-
-      - name: Report a rejected Codecov upload
-        if: steps.codecov.outcome == 'failure'
-        run: |
-          msg="Codecov rejected the upload (repository not activated or token mismatch) — coverage is still enforced by pest --min and shown in the job summary. See the 'Upload coverage to Codecov' step log for the server response."
-          echo "::warning title=Codecov upload failed::$msg"
-          printf '\n> [!WARNING]\n> %s\n' "$msg" >> "$GITHUB_STEP_SUMMARY"
-
   code-quality:
     runs-on: ubuntu-latest
     timeout-minutes: 15