diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index 642097f..20ee219 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -101,12 +101,18 @@ jobs:
           || github.event.pull_request.head.repo.full_name == 'NyanKiyoshi/pytest-django-queries'
       }}
     runs-on: ubuntu-latest
-    permissions: {}
     environment: codecov
+    permissions:
+      contents: read
 
     needs: test
 
     steps:
+      # Codecov needs to be able to map the coverage against local files,
+      # thus we need to checkout.
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
       - name: Download Reports
         uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
         with:
@@ -132,11 +138,17 @@ jobs:
         )
       }}
     runs-on: ubuntu-latest
-    permissions: {}
+    permissions:
+      contents: read
 
     needs: test
 
     steps:
+      # Codecov needs to be able to map the coverage against local files,
+      # thus we need to checkout.
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
       - name: Download Reports
         uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
         with:
diff --git a/pyproject.toml b/pyproject.toml
index d5f9920..1298503 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -59,7 +59,6 @@ dev = [
     "sphinx-rtd-theme",
 ]
 test = [
-    "codecov",
     "coverage",
     "pytest-xdist",
 ]
diff --git a/uv.lock b/uv.lock
index 16cbf26..967442b 100644
--- a/uv.lock
+++ b/uv.lock
@@ -187,19 +187,6 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/98/78/01c019cdb5d6498122777c1a43056ebb3ebfeef2076d9d026bfe15583b2b/click-8.3.1-py3-none-any.whl", hash = "sha256:981153a64e25f12d547d3426c367a4857371575ee7ad18df2a6183ab0545b2a6", size = 108274, upload-time = "2025-11-15T20:45:41.139Z" },
 ]
 
-[[package]]
-name = "codecov"
-version = "2.1.13"
-source = { registry = "https://pypi.org/simple" }
-dependencies = [
-    { name = "coverage" },
-    { name = "requests" },
-]
-sdist = { url = "https://files.pythonhosted.org/packages/2c/bb/594b26d2c85616be6195a64289c578662678afa4910cef2d3ce8417cf73e/codecov-2.1.13.tar.gz", hash = "sha256:2362b685633caeaf45b9951a9b76ce359cd3581dd515b430c6c3f5dfb4d92a8c", size = 21416, upload-time = "2023-04-17T23:11:39.779Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/af/02/18785edcdf6266cdd6c6dc7635f1cbeefd9a5b4c3bb8aff8bd681e9dd095/codecov-2.1.13-py2.py3-none-any.whl", hash = "sha256:c2ca5e51bba9ebb43644c43d0690148a55086f7f5e6fd36170858fa4206744d5", size = 16512, upload-time = "2023-04-17T23:11:37.344Z" },
-]
-
 [[package]]
 name = "colorama"
 version = "0.4.6"
@@ -422,7 +409,7 @@ name = "exceptiongroup"
 version = "1.3.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
-    { name = "typing-extensions", marker = "python_full_version < '3.12'" },
+    { name = "typing-extensions", marker = "python_full_version < '3.11'" },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/50/79/66800aadf48771f6b62f7eb014e352e5d06856655206165d775e675a02c9/exceptiongroup-1.3.1.tar.gz", hash = "sha256:8b412432c6055b0b7d14c310000ae93352ed6754f70fa8f7c34141f91c4e3219", size = 30371, upload-time = "2025-11-21T23:01:54.787Z" }
 wheels = [
@@ -830,7 +817,6 @@ dev = [
     { name = "sphinx-rtd-theme" },
 ]
 test = [
-    { name = "codecov" },
     { name = "coverage" },
     { name = "pytest-xdist" },
 ]
@@ -855,7 +841,6 @@ dev = [
     { name = "sphinx-rtd-theme" },
 ]
 test = [
-    { name = "codecov" },
     { name = "coverage" },
     { name = "pytest-xdist" },
 ]