diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ea3f8cdebc..3c4aa8374b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -907,7 +907,7 @@ jobs:
       # (if-no-files-found: warn) — Sonar consumes the same file.
       - name: Upload coverage to Codecov (informational)
         if: always()
-        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
           files: coverage/lcov.info
           token: ${{ secrets.CODECOV_TOKEN }}