diff --git a/.github/workflows/CI.yml b/.github/workflows/CI.yml
index 5145915..de61974 100644
--- a/.github/workflows/CI.yml
+++ b/.github/workflows/CI.yml
@@ -44,5 +44,6 @@ jobs:
           cargo llvm-cov report --lcov --output-path coverage.lcov
       - uses: codecov/codecov-action@v5
         with:
+          token: ${{ secrets.CODECOV_TOKEN }}
           files: coverage.lcov,coverage.xml
           name: ${{ matrix.os }}
diff --git a/README.md b/README.md
index 95b879c..c5265a0 100644
--- a/README.md
+++ b/README.md
@@ -99,6 +99,11 @@ The last step of this process happens in the CI, where we upload both coverage
 files to CodeCov. [Merging reports](https://docs.codecov.com/docs/merging-reports)
 is an automatic feature of CodeCov, so the final view shows the combined view.
 
+**Note:** Starting with `codecov-action@v4`, a `CODECOV_TOKEN` is required for
+uploading coverage reports. Add your token to GitHub repository secrets (see
+[Adding the Codecov token](https://docs.codecov.com/docs/adding-the-codecov-token))
+and reference it in the workflow with `token: ${{ secrets.CODECOV_TOKEN }}`.
+
 # Excluding code from coverage
 
 The `#[pymodule]` initialization function in `src/lib.rs` is surrounded by