diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index 84cf208..594cc4e 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -74,7 +74,7 @@ jobs:
       # skip it too; guarding here avoids spinning the step up at all).
       - name: Upload coverage report
         if: hashFiles('scripts/test.mjs') != '' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
-        uses: actions/upload-code-coverage@1c15be36fc3733ba839b1dd643bd9556e4426dc1 # v1
+        uses: actions/upload-code-coverage@d8e329117199404bba6fc81efe8093dc7c015e34 # v1
         with:
           file: coverage/cobertura.xml
           language: JavaScript