diff --git a/.codecov.yml b/.codecov.yml
index 1b6a5955..68324d4e 100644
--- a/.codecov.yml
+++ b/.codecov.yml
@@ -3,21 +3,25 @@ codecov:
     require_ci_to_pass: yes
 
 coverage:
+  range: 70..100
   precision: 2
   round: down
-  range: "70...100"
-  ignore: Tests
-  status:
-    project:
-      default:
-        target: auto
-        threshold: 0%
-    patch:
-      default:
-        target: 97%
+  ignore:
+    - "tests/**"
+    - "**/_version.py"
+    - "**/__init__.py"
+
+status:
+  project: # overall coverage
+    default:
+      target: auto # fail on any drop
+      threshold: 0% # or 0.5 % if you want slack
+  patch: # changed lines
+    default:
+      target: 97%
 
 comment:
-  layout: "header, changes, diff"
+  layout: header, changes, diff
   behavior: default
   require_changes: false
   branches: null
diff --git a/.github/workflows/ci-test.yml b/.github/workflows/ci-test.yml
index a4cfd86c..9be4d3e8 100644
--- a/.github/workflows/ci-test.yml
+++ b/.github/workflows/ci-test.yml
@@ -144,15 +144,26 @@ jobs:
         if: matrix.backend == 'redis'
         run: pytest -m redis --cov=cachier --cov-report=term --cov-report=xml:cov.xml
 
-      - name: Upload coverage to Codecov
+      - name: Upload coverage to Codecov (non-PRs)
+        if: github.event_name != 'pull_request' # pushes, scheduled, etc.
         continue-on-error: true
         uses: codecov/codecov-action@v5
         with:
           fail_ci_if_error: true
-          name: codecov-umbrella
           token: ${{ secrets.CODECOV_TOKEN }} # required
           flags: ${{ matrix.backend }}
 
+      # We need a separate step for PRs because PRs do not have access to
+      # secrets; hence, provide the token will give it an empty value,
+      # resulting in an authentication error.
+      - name: Upload coverage to Codecov (PRs)
+        if: github.event_name == 'pull_request' # PRs only
+        continue-on-error: true
+        uses: codecov/codecov-action@v5
+        with:
+          fail_ci_if_error: true
+          flags: ${{ matrix.backend }}
+
   testing-guardian:
     runs-on: ubuntu-latest
     needs: pytester