diff --git a/.github/workflows/UploadCoverageReport.yml b/.github/workflows/UploadCoverageReport.yml
index 4dcad584bf..e293a59359 100644
--- a/.github/workflows/UploadCoverageReport.yml
+++ b/.github/workflows/UploadCoverageReport.yml
@@ -8,6 +8,9 @@ name: UploadCoverageReport
       - master
   pull_request:
 
+env:
+  REPORT_PATH: "coverage/coverage-final.json"
+
 jobs:
   UploadCoverageReport:
     runs-on: ubuntu-latest
@@ -25,9 +28,18 @@ jobs:
       - name: Generate coverage report
         run: npm test -- --coverage
 
-      - name: Upload coverage to codecov
-        uses: codecov/codecov-action@v3
+      - name: Upload coverage to codecov (tokenless)
+        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository
+        uses: codecov/codecov-action@v4
+        with:
+          files: "${{ env.REPORT_PATH }}"
+          fail_ci_if_error: true
+
+      - name: Upload coverage to codecov (with token)
+        if: "! github.event.pull_request.head.repo.fork "
+        uses: codecov/codecov-action@v4
         with:
-          files: "coverage/coverage-final.json"
+          token: ${{ secrets.CODECOV_TOKEN }}
+          files: "${{ env.REPORT_PATH }}"
           fail_ci_if_error: true
 ...