diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index fd5bc1f0..62a7ac4a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -122,7 +122,7 @@ jobs:
 
       - name: Upload coverage to Codecov (Linux only)
         if: runner.os == 'Linux'
-        uses: codecov/codecov-action@v4
+        uses: codecov/codecov-action@v7.0.0
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: coverage/cobertura.xml
diff --git a/.github/workflows/e2e-coverage.yml b/.github/workflows/e2e-coverage.yml
index b5f755d9..ce92a7a4 100644
--- a/.github/workflows/e2e-coverage.yml
+++ b/.github/workflows/e2e-coverage.yml
@@ -47,7 +47,7 @@ jobs:
         run: cargo tarpaulin --package sanctifier-cli --package sanctifier-core --package amm-pool --out Xml
 
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@ab904c41d6ece82784817410c45d8b8c02684457 # v3
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
           file: cobertura.xml
           fail_ci_if_error: false
diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
index f55108c3..c0d3c6eb 100644
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -120,14 +120,14 @@ jobs:
             --ignore-filename-regex '(_tests\.rs|/tests/|/benches/)'
 
       - name: Upload coverage to Codecov (sanctifier-core)
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@v7.0.0
         with:
           files: lcov-core.info
           flags: sanctifier-core
           fail_ci_if_error: false
 
       - name: Upload coverage to Codecov (sanctifier-cli)
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@v7.0.0
         with:
           files: lcov-cli.info
           flags: sanctifier-cli