diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml
index ad46d5c74..dc1301932 100644
--- a/.github/workflows/linux.yml
+++ b/.github/workflows/linux.yml
@@ -76,7 +76,12 @@ jobs:
       - uses: ./.github/actions/default
       - run: ccache -s
       - if: ${{ success() && matrix.test == 'coverage' }}
-        run: bash <(curl -s https://codecov.io/bash)
+        uses: codecov/codecov-action@v4
+        with:
+          fail_ci_if_error: true
+          file: coverage/coverage.cleaned.info
+          token: ${{ secrets.CODECOV_TOKEN }}
+          verbose: true
       - if: ${{ failure() }}
         uses: actions/upload-artifact@v4
         with:
diff --git a/scripts/test.sh b/scripts/test.sh
index c4ffa2422..72707a63f 100755
--- a/scripts/test.sh
+++ b/scripts/test.sh
@@ -285,8 +285,8 @@ all|alpine|codeql|coverage|sonarcloud|no-dbg)
 	if test "$TEST" != "coverage"; then
 		CONFIG="$CONFIG --disable-coverage"
 	else
-		# not actually required but configure checks for it
 		DEPS="$DEPS lcov"
+		TARGET="coverage"
 	fi
 	DEPS="$DEPS libcurl4-gnutls-dev libsoup2.4-dev libunbound-dev libldns-dev
 		  libmysqlclient-dev libsqlite3-dev clearsilver-dev libfcgi-dev