diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 3dbea5c10a..fbae80384f 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -139,7 +139,14 @@ jobs:
           echo "---" >> $GITHUB_STEP_SUMMARY
 
       # https://github.com/codecov/codecov-action
+      # This fork has no CODECOV_TOKEN, and Codecov rejects tokenless uploads from private
+      # repositories ("Token required - not valid tokenless upload"). With
+      # fail_ci_if_error: true that failed the whole job *after* the tests had passed, so
+      # skip the upload unless a token is configured. Adding the secret re-enables it.
       - name: ☂️ Upload coverage reports to codecov
+        if: env.CODECOV_TOKEN != ''
+        env:
+          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
         uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
           fail_ci_if_error: true