diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml
index 8a0e90f..7337f26 100644
--- a/.github/workflows/semgrep.yml
+++ b/.github/workflows/semgrep.yml
@@ -1,7 +1,7 @@
 name: semgrep
 
 on:
-  pull_request_target: {}
+  pull_request: {}
 
   push:
     branches: [master]
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index f86d152..e58c20f 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -27,8 +27,9 @@ jobs:
         run: make test
 
       - name: upload coverage to codecov
-        uses: codecov/codecov-action@4fe8c5f003fae66aa5ebb77cfd3e7bfbbda0b6b0 # pin@3.1.5
+        uses: codecov/codecov-action@e28ff129e5465c2c0dcc6f003fc735cb6ae0c673 # pin@4.5.0
         with:
+          token: ${{ secrets.CODECOV_TOKEN }}
           files: coverage.out
           fail_ci_if_error: false
           verbose: true