diff --git a/.github/workflows/tox-tests.yml b/.github/workflows/tox-tests.yml
index 6c9422c..536897f 100644
--- a/.github/workflows/tox-tests.yml
+++ b/.github/workflows/tox-tests.yml
@@ -21,6 +21,8 @@ jobs:
         run: tox -e docs
   coverage:
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
     steps:
       - uses: actions/checkout@v2
       - name: Setup Python
@@ -35,6 +37,14 @@ jobs:
         run: pip install tox
       - name: Run Tox
         run: tox -e cov
+      - name: Upload coverage to Codecov
+        if: github.event_name == 'pull_request' || (github.event_name == 'push' && github.ref =='refs/heads/main')
+        uses: codecov/codecov-action@v5
+        with:
+          use_oidc: true
+          flags: unit-tests
+          files: coverage.xml
+          fail_ci_if_error: false
   bandit-exitzero:
     runs-on: ubuntu-latest
     steps:
@@ -83,4 +93,3 @@ jobs:
         run: pip install tox
       - name: Run Tox
         run: tox -e py39
-
diff --git a/requirements-docs.in b/requirements-docs.in
index 387d8df..fb4f1ea 100644
--- a/requirements-docs.in
+++ b/requirements-docs.in
@@ -1,5 +1,6 @@
 sphinx
 alabaster
+setuptools < 82.0.0
 
 # RPM bindings are needed below but this is not directly in the
 # dependency tree.
diff --git a/requirements-docs.txt b/requirements-docs.txt
index c968c43..ca05d81 100644
--- a/requirements-docs.txt
+++ b/requirements-docs.txt
@@ -2,7 +2,7 @@
 # This file is autogenerated by pip-compile with Python 3.10
 # by the following command:
 #
-#    pip-compile --generate-hashes requirements-docs.in
+#    pip-compile --allow-unsafe --generate-hashes requirements-docs.in
 #
 alabaster==1.0.0 \
     --hash=sha256:c00dca57bca26fa62a6d7d0a9fcce65f3e026e9bfe33e9c538fd3fbb2144fd9e \
@@ -1219,7 +1219,13 @@ zipp==3.21.0 \
     --hash=sha256:ac1bbe05fd2991f160ebce24ffbac5f6d11d83dc90891255885223d42b3cd931
     # via importlib-metadata
 
-# WARNING: The following packages were not pinned, but pip requires them to be
-# pinned when the requirements file includes hashes and the requirement is not
-# satisfied by a package already installed. Consider using the --allow-unsafe flag.
-# setuptools
+# The following packages are considered to be unsafe in a requirements file:
+setuptools==81.0.0 \
+    --hash=sha256:487b53915f52501f0a79ccfd0c02c165ffe06631443a886740b91af4b7a5845a \
+    --hash=sha256:fdd925d5c5d9f62e4b74b30d6dd7828ce236fd6ed998a08d81de62ce5a6310d6
+    # via
+    #   -r requirements-docs.in
+    #   pubtools
+    #   pubtools-iib
+    #   pubtools-pyxis
+    #   pubtools-quay
diff --git a/test-requirements.txt b/test-requirements.txt
index 5827af0..80a2c72 100644
--- a/test-requirements.txt
+++ b/test-requirements.txt
@@ -2,7 +2,7 @@
 # This file is autogenerated by pip-compile with Python 3.10
 # by the following command:
 #
-#    pip-compile --generate-hashes --output-file=test-requirements.txt requirements-dev.in requirements-docs.in test-requirements.in
+#    pip-compile --allow-unsafe --generate-hashes --output-file=test-requirements.txt requirements-dev.in requirements-docs.in test-requirements.in
 #
 alabaster==1.0.0 \
     --hash=sha256:c00dca57bca26fa62a6d7d0a9fcce65f3e026e9bfe33e9c538fd3fbb2144fd9e \
@@ -1343,7 +1343,13 @@ zipp==3.21.0 \
     --hash=sha256:ac1bbe05fd2991f160ebce24ffbac5f6d11d83dc90891255885223d42b3cd931
     # via importlib-metadata
 
-# WARNING: The following packages were not pinned, but pip requires them to be
-# pinned when the requirements file includes hashes and the requirement is not
-# satisfied by a package already installed. Consider using the --allow-unsafe flag.
-# setuptools
+# The following packages are considered to be unsafe in a requirements file:
+setuptools==81.0.0 \
+    --hash=sha256:487b53915f52501f0a79ccfd0c02c165ffe06631443a886740b91af4b7a5845a \
+    --hash=sha256:fdd925d5c5d9f62e4b74b30d6dd7828ce236fd6ed998a08d81de62ce5a6310d6
+    # via
+    #   -r requirements-docs.in
+    #   pubtools
+    #   pubtools-iib
+    #   pubtools-pyxis
+    #   pubtools-quay
diff --git a/tox.ini b/tox.ini
index 9a8f1b5..95ac22e 100644
--- a/tox.ini
+++ b/tox.ini
@@ -12,7 +12,7 @@ deps=-rtest-requirements.in
 [testenv:cov]
 usedevelop=true
 commands=
-	pytest --cov-report=term --cov=src/pubtools --cov-fail-under=100 {posargs}
+	pytest --cov-report=term --cov-report=xml --cov=src/pubtools --cov-fail-under=100 {posargs}
 
 [testenv:docs]
 deps=