diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 06ad616..f999146 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -8,6 +8,7 @@ on:
 
 permissions:
   contents: read
+  id-token: write
 
 jobs:
   build:
@@ -191,11 +192,29 @@ jobs:
       - name: Coverage report
         if: matrix.build_type == 'cov'
         run: |
-          set -x
+          set -eux
           cd build
           echo "function main() return 0 end" > test.lua
           ./bin/flua --repeat=2 test.lua
-          lcov --directory ./ --capture --output-file coverage.info --ignore-errors source --ignore-errors mismatch
+          cd "$GITHUB_WORKSPACE"
+          # Only this repo's sources. Uploading Boost/CPM/usr headers makes Codecov
+          # drop file-level reports because paths cannot be matched to GitHub.
+          lcov --directory build --capture --output-file coverage.info \
+            --base-directory "$GITHUB_WORKSPACE" --no-external \
+            --ignore-errors source,mismatch
+          lcov --extract coverage.info \
+            "$GITHUB_WORKSPACE/src/*" \
+            "$GITHUB_WORKSPACE/include/*" \
+            --output-file coverage.info
           ls -l coverage.info
           lcov --list coverage.info
-          bash <(curl -s https://codecov.io/bash) -t ${{ secrets.CODECOV }} -f coverage.info || echo "Codecov did not collect coverage reports"
+
+      - name: Upload coverage to Codecov
+        if: matrix.build_type == 'cov'
+        uses: codecov/codecov-action@v5
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}
+          files: coverage.info
+          disable_search: true
+          fail_ci_if_error: true
+          verbose: true