diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5e42465a..d9c8d31d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,5 +1,9 @@
+---
 name: Workflow for Codecov example-python
-on: [push, pull_request]
+on: [push, pull_request, pull_request_target]
+permissions:
+  id-token: write # This is required for requesting the JWT
+  contents: read
 jobs:
   run:
     runs-on: ubuntu-latest
@@ -15,10 +19,14 @@ jobs:
       - name: Install dependencies
         run: pip install -r requirements.txt
       - name: Run tests and collect coverage
-        run: pytest --cov app ${{ env.CODECOV_ATS_TESTS }}
-      - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v4
+        run: pytest --cov app
+      - name: Upload coverage to Codecov (token)
+        uses: codecov/codecov-action@th/fix-head-repo-for-tokenless
         with:
           verbose: true
         env:
           CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
+      - name: Upload coverage to Codecov (no token)
+        uses: codecov/codecov-action@th/fix-head-repo-for-tokenless
+        with:
+          verbose: true