diff --git a/.github/workflows/codecov.yml b/.github/workflows/codecov.yml
index 9fe2b9ccf..cad7149f8 100644
--- a/.github/workflows/codecov.yml
+++ b/.github/workflows/codecov.yml
@@ -4,7 +4,6 @@ on: [push, pull_request]
 
 jobs:
   build:
-    if: ${{ github.repository == 'checkpoint-restore/go-criu' }}
     runs-on: ubuntu-latest
     name: Code coverage
     steps:
@@ -47,10 +46,23 @@ jobs:
         # Run actual test as root as it uses CRIU.
         sudo -E make coverage
 
+# PRs from forked repos don't need tokens for reports to be upload to codecov.
+# PRs from the base, need a token.
+# https://github.com/codecov/codecov-action/issues/1431
+
+    - name: Upload coverage reports to Codecov (tokenless)
+      uses: codecov/codecov-action@v4
+      with:
+        fail_ci_if_error: true
+        file: test/.coverage/coverage.out
+        verbose: true
+      if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository
+
     - name: Upload coverage reports to Codecov
-      uses: codecov/codecov-action@v3
+      uses: codecov/codecov-action@v4
       with:
         fail_ci_if_error: true
         file: test/.coverage/coverage.out
         token: ${{ secrets.CODECOV_TOKEN }}
         verbose: true
+      if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.repository