diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index 1fa0edd1..0a943c07 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -105,7 +105,7 @@ jobs:
 
             - name: Upload E2E JS Coverage to Codecov
               if: always() && hashFiles('./coverage/e2e/lcov.info') != ''
-              uses: codecov/codecov-action@1af58845a975a7985b0beb0cbe6fbbb71a41dbad # v5.5.3
+              uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0
               with:
                   token: ${{ secrets.CODECOV_TOKEN }}
                   files: ./coverage/e2e/lcov.info
@@ -116,7 +116,7 @@ jobs:
 
             - name: Upload E2E PHP Coverage to Codecov
               if: always() && hashFiles('./coverage/php-e2e/lcov.info') != ''
-              uses: codecov/codecov-action@1af58845a975a7985b0beb0cbe6fbbb71a41dbad # v5.5.3
+              uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0
               with:
                   token: ${{ secrets.CODECOV_TOKEN }}
                   files: ./coverage/php-e2e/lcov.info
diff --git a/.github/workflows/phpunit.yml b/.github/workflows/phpunit.yml
index ae849a06..11c828e0 100644
--- a/.github/workflows/phpunit.yml
+++ b/.github/workflows/phpunit.yml
@@ -50,7 +50,7 @@ jobs:
         run: mkdir -p coverage/phpunit && vendor/bin/phpunit --coverage-clover=coverage/phpunit/coverage.xml
 
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@1af58845a975a7985b0beb0cbe6fbbb71a41dbad # v5.5.3
+        uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           slug: WordPress/secure-custom-fields
diff --git a/.github/workflows/unit-tests.yml b/.github/workflows/unit-tests.yml
index 14fed03b..43d2aa57 100644
--- a/.github/workflows/unit-tests.yml
+++ b/.github/workflows/unit-tests.yml
@@ -55,7 +55,7 @@ jobs:
 
             - name: Upload coverage to Codecov
               if: always()
-              uses: codecov/codecov-action@1af58845a975a7985b0beb0cbe6fbbb71a41dbad # v5.5.3
+              uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0
               with:
                   token: ${{ secrets.CODECOV_TOKEN }}
                   files: ./coverage/unit/lcov.info