diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml
index 056c4ed3581b..b8713f193078 100644
--- a/.github/workflows/benchmark.yml
+++ b/.github/workflows/benchmark.yml
@@ -94,7 +94,8 @@ jobs:
           FIXTURE: ${{ matrix.fixture }}
         with:
           run: cargo codspeed run
-          token: ${{ secrets.CODSPEED_TOKEN }}
+          # Dummy token for tokenless runs, to suppress logging hash of metadata JSON (see `upload.mjs`)
+          token: ${{ secrets.CODSPEED_TOKEN || 'dummy' }}
           upload-url: http://localhost:${{ env.INTERCEPT_PORT }}/upload
 
       - name: Upload bench data artefact
diff --git a/tasks/benchmark/codspeed/upload.mjs b/tasks/benchmark/codspeed/upload.mjs
index d132c87d1b52..3831d236e596 100644
--- a/tasks/benchmark/codspeed/upload.mjs
+++ b/tasks/benchmark/codspeed/upload.mjs
@@ -110,13 +110,28 @@ const metadata = JSON.parse(
 );
 metadata.profileMd5 = md5;
 
+// If no token, set `metadata.tokenless`, and log hash of metadata JSON.
+// For tokenless runs (PRs from forks), `codspeed-runner` logs SHA256 hash of metadata JSON.
+// CodSpeed then reads the job logs to find a line matching `CodSpeed Run Hash: "..."`.
+// So we used a dummy token for `CodSpeedHQ/action` to prevent it logging the hash,
+// so can log the correct hash ourselves here instead.
+if (!token) metadata.tokenless = true;
+const metadataJson = JSON.stringify(metadata);
+if (!token) {
+    const metadataHash = createHash('sha256').update(metadataJson).digest('hex');
+    console.log(`CodSpeed Run Hash: "${metadataHash}"`);
+}
+
 // Upload metadata to CodSpeed
 console.log('Uploading metadata to CodSpeed');
 const {data} = await axios({
     method: 'post',
     url: CODSPEED_UPLOAD_URL,
-    data: metadata,
-    headers: {Authorization: token},
+    data: metadataJson,
+    headers: {
+        'Content-Type': 'application/json',
+        ...(token ? {Authorization: token} : null),
+    },
 });
 assert(data?.status === 'success', 'Failed to upload metadata to Codspeed');
 const {uploadUrl} = data;