diff --git a/.github/workflows/build-tag.yaml b/.github/workflows/build-tag.yaml
index da80191b..64ef7ab1 100644
--- a/.github/workflows/build-tag.yaml
+++ b/.github/workflows/build-tag.yaml
@@ -50,6 +50,9 @@ jobs:
   build:
     needs: lint
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write  # codecov OIDC upload auth
     strategy:
       fail-fast: false
       matrix:
@@ -72,6 +75,11 @@ jobs:
         uv run coverage xml
     - name: Upload test coverage
       uses: codecov/codecov-action@v7
+      with:
+        # Tokenless uploads are rejected outside fork PRs; OIDC authenticates
+        # tag builds. fail_ci_if_error stays off here: a codecov outage must
+        # not block a release (publish depends on this job).
+        use_oidc: true
   publish:
     needs: build
     if: github.event_name != 'pull_request'
diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 6fdca071..05365d06 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -51,6 +51,9 @@ jobs:
   build:
     needs: lint
     runs-on: ${{ matrix.os }}
+    permissions:
+      contents: read
+      id-token: write  # codecov OIDC upload auth
     strategy:
       fail-fast: false
       matrix:
@@ -100,3 +103,13 @@ jobs:
         uv run coverage xml
     - name: Upload test coverage
       uses: codecov/codecov-action@v7
+      with:
+        # Tokenless uploads are rejected on the protected main branch ("Token
+        # required because branch is protected"), which left codecov comparing
+        # PRs against a stale base. OIDC authenticates uploads from this repo;
+        # fork PRs still fall back to tokenless.
+        use_oidc: true
+        # Surface upload failures on branch pushes so the main base report
+        # can't silently go stale again, without letting codecov outages
+        # block PRs or the merge queue.
+        fail_ci_if_error: ${{ github.event_name == 'push' }}
diff --git a/pyproject.toml b/pyproject.toml
index 58fb50d0..3ff07491 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -210,3 +210,12 @@ markers = [
 ]
 pythonpath = ["."]
 asyncio_mode = "auto"
+
+[tool.coverage.run]
+# Without `source`, files never imported by the test run are invisible to
+# coverage and silently inflate the total reported to codecov.
+source = ['dapr', 'flask_dapr']
+# Leading ** keeps the pattern cwd-independent: coverage absolutizes
+# non-wildcard patterns against the invocation directory, so a bare
+# 'dapr/proto/**' only matches when run from the repo root.
+omit = ['**/dapr/proto/**']