diff --git a/.github/workflows/rust.yaml b/.github/workflows/rust.yaml
index 62c3c18..d3ad533 100644
--- a/.github/workflows/rust.yaml
+++ b/.github/workflows/rust.yaml
@@ -106,7 +106,7 @@ jobs:
       #   fork PR: secrets are withheld, so the empty token makes codecov-action
       #   fall back to tokenless upload (public repo; v4+ prefixes the branch).
       - name: Upload coverage reports to Codecov
-        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v6.0.2
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
           files: codecov.json
           token: ${{ secrets.CODECOV_TOKEN }}