diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index cf05bb9..6106b64 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -40,6 +40,10 @@ jobs:
         run: go test -race -count=1 -coverprofile=coverage.out ./...
 
       - name: Upload coverage
+        # No token: Codecov accepts tokenless uploads from public repositories
+        # once the repository is activated on their side. Adding a secret would
+        # be a credential to store, rotate, and leak for no gain.
+        #
         # continue-on-error because coverage reporting is not a correctness
         # signal. Codecov being down, rate-limiting, or rejecting an upload
         # must not turn a PR red when the tests themselves passed.
@@ -47,7 +51,6 @@ jobs:
         uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
           files: coverage.out
-          token: ${{ secrets.CODECOV_TOKEN }}
           fail_ci_if_error: false
 
   lint: