diff --git a/.github/workflows/.test-unit.yml b/.github/workflows/.test-unit.yml
index c6e6816913..880fad77a8 100644
--- a/.github/workflows/.test-unit.yml
+++ b/.github/workflows/.test-unit.yml
@@ -17,9 +17,6 @@ on:
         required: false
         type: string
         default: ""
-    secrets:
-      CODECOV_TOKEN:
-        required: false
 
 env:
   GO_VERSION: "1.26.10"
@@ -30,6 +27,9 @@ env:
 
 jobs:
   unit:
+    permissions:
+      contents: read
+      id-token: write # needed for CodeCov; https://github.com/codecov/codecov-action/blob/v7.1.1/README.md#using-oidc
     runs-on: ubuntu-26.04${{ inputs.runnerSuffix }}
     timeout-minutes: 120 # guardrails timeout for the whole job
     continue-on-error: ${{ github.event_name != 'pull_request' }}
@@ -93,7 +93,7 @@ jobs:
           directory: ./bundles
           env_vars: RUNNER_OS
           flags: unit,${{ inputs.arch }}
-          token: ${{ secrets.CODECOV_TOKEN }}  # used to upload coverage reports: https://github.com/moby/buildkit/pull/4660#issue-2142122533
+          use_oidc: true
       -
         name: Upload reports
         if: always()
diff --git a/.github/workflows/.test.yml b/.github/workflows/.test.yml
index 7d6fa9ed33..5a077260cf 100644
--- a/.github/workflows/.test.yml
+++ b/.github/workflows/.test.yml
@@ -25,9 +25,6 @@ on:
         required: true
         type: string
         default: "graphdriver"
-    secrets:
-      CODECOV_TOKEN:
-        required: false
 
 env:
   GO_VERSION: "1.26.10"
@@ -172,6 +169,9 @@ jobs:
             });
 
   integration:
+    permissions:
+      contents: read
+      id-token: write # needed for CodeCov; https://github.com/codecov/codecov-action/blob/v7.1.1/README.md#using-oidc
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 120 # guardrails timeout for the whole job
     continue-on-error: ${{ github.event_name != 'pull_request' }}
@@ -282,7 +282,7 @@ jobs:
           directory: ./bundles/test-integration
           env_vars: RUNNER_OS
           flags: integration,${{ inputs.arch }},${{ matrix.mode }}
-          token: ${{ secrets.CODECOV_TOKEN }}  # used to upload coverage reports: https://github.com/moby/buildkit/pull/4660#issue-2142122533
+          use_oidc: true
       -
         name: Test daemon logs
         if: always()
@@ -425,6 +425,9 @@ jobs:
             });
 
   integration-cli:
+    permissions:
+      contents: read
+      id-token: write # needed for CodeCov; https://github.com/codecov/codecov-action/blob/v7.1.1/README.md#using-oidc
     runs-on: ubuntu-26.04${{ inputs.runnerSuffix }}
     timeout-minutes: 120 # guardrails timeout for the whole job
     continue-on-error: ${{ github.event_name != 'pull_request' }}
@@ -506,7 +509,7 @@ jobs:
           directory: ./bundles/test-integration
           env_vars: RUNNER_OS
           flags: integration-cli,${{ inputs.arch }}
-          token: ${{ secrets.CODECOV_TOKEN }}  # used to upload coverage reports: https://github.com/moby/buildkit/pull/4660#issue-2142122533
+          use_oidc: true
       -
         name: Test daemon logs
         if: always()
diff --git a/.github/workflows/.windows.yml b/.github/workflows/.windows.yml
index f26e7fc135..7df22e1f7f 100644
--- a/.github/workflows/.windows.yml
+++ b/.github/workflows/.windows.yml
@@ -24,9 +24,6 @@ on:
         required: false
         type: string
         default: external
-    secrets:
-      CODECOV_TOKEN:
-        required: false
 
 env:
   GO_VERSION: "1.26.10"
@@ -105,6 +102,9 @@ jobs:
           retention-days: 2
 
   unit-test:
+    permissions:
+      contents: read
+      id-token: write # needed for CodeCov; https://github.com/codecov/codecov-action/blob/v7.1.1/README.md#using-oidc
     runs-on: ${{ inputs.os }}
     timeout-minutes: 120 # guardrails timeout for the whole job
     env:
@@ -156,7 +156,7 @@ jobs:
           directory: bundles
           env_vars: RUNNER_OS
           flags: unit
-          token: ${{ secrets.CODECOV_TOKEN }}  # used to upload coverage reports: https://github.com/moby/buildkit/pull/4660#issue-2142122533
+          use_oidc: true
       -
         name: Upload reports
         if: always()
@@ -229,6 +229,9 @@ jobs:
           echo "$matrix"
 
   integration-test:
+    permissions:
+      contents: read
+      id-token: write # needed for CodeCov; https://github.com/codecov/codecov-action/blob/v7.1.1/README.md#using-oidc
     runs-on: ${{ inputs.os }}
     timeout-minutes: 120 # guardrails timeout for the whole job
     continue-on-error: ${{ inputs.storage == 'snapshotter' && github.event_name != 'pull_request' }}
@@ -375,7 +378,7 @@ jobs:
           directory: bundles
           env_vars: RUNNER_OS
           flags: integration,${{ matrix.runtime }}
-          token: ${{ secrets.CODECOV_TOKEN }}  # used to upload coverage reports: https://github.com/moby/buildkit/pull/4660#issue-2142122533
+          use_oidc: true
       -
         name: Docker info
         run: |
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index f634866236..38a58a74ff 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -80,6 +80,9 @@ jobs:
           path: /tmp/dev-image-${{ matrix.arch }}.tar
 
   test:
+    permissions:
+      contents: read
+      id-token: write # needed for CodeCov; https://github.com/codecov/codecov-action/blob/v7.1.1/README.md#using-oidc
     name: test (${{ matrix.arch }}, ${{ matrix.storage }})
     if: ${{ github.event_name != 'pull_request' || !contains(github.event.pull_request.labels.*.name, 'ci/validate-only') }}
     needs:
@@ -108,10 +111,11 @@ jobs:
       storage: ${{ matrix.storage }}
       runnerSuffix: ${{ matrix.runnerSuffix }}
       extraModes: ${{ matrix.extraModes }}
-    secrets:
-      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
 
   test-unit:
+    permissions:
+      contents: read
+      id-token: write # needed for CodeCov; https://github.com/codecov/codecov-action/blob/v7.1.1/README.md#using-oidc
     if: ${{ github.event_name != 'pull_request' || !contains(github.event.pull_request.labels.*.name, 'ci/validate-only') }}
     needs:
       - build-dev
@@ -128,8 +132,6 @@ jobs:
     with:
       arch: ${{ matrix.arch }}
       runnerSuffix: ${{ matrix.runnerSuffix }}
-    secrets:
-      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
 
   validate-prepare:
     runs-on: ubuntu-26.04
diff --git a/.github/workflows/windows-2022.yml b/.github/workflows/windows-2022.yml
index efe5bc4fe0..91e5115739 100644
--- a/.github/workflows/windows-2022.yml
+++ b/.github/workflows/windows-2022.yml
@@ -20,6 +20,9 @@ jobs:
       pull-requests: read
     uses: ./.github/workflows/.dco.yml
   run:
+    permissions:
+      contents: read
+      id-token: write # needed for CodeCov; https://github.com/codecov/codecov-action/blob/v7.1.1/README.md#using-oidc
     needs: validate-dco
     if: ${{ github.event_name != 'pull_request' || !contains(github.event.pull_request.labels.*.name, 'ci/validate-only') }}
     uses: ./.github/workflows/.windows.yml
@@ -38,5 +41,3 @@ jobs:
       storage: ${{ matrix.storage }}
       containerd: ${{ matrix.containerd }}
       send_coverage: true
-    secrets:
-      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
diff --git a/.github/workflows/windows-2025.yml b/.github/workflows/windows-2025.yml
index d2573a4e93..911b45cd41 100644
--- a/.github/workflows/windows-2025.yml
+++ b/.github/workflows/windows-2025.yml
@@ -25,6 +25,9 @@ jobs:
     uses: ./.github/workflows/.dco.yml
 
   run:
+    permissions:
+      contents: read
+      id-token: write # needed for CodeCov; https://github.com/codecov/codecov-action/blob/v7.1.1/README.md#using-oidc
     needs: validate-dco
     if: ${{ github.event_name != 'pull_request' || !contains(github.event.pull_request.labels.*.name, 'ci/validate-only') }}
     uses: ./.github/workflows/.windows.yml
@@ -43,5 +46,3 @@ jobs:
       storage: ${{ matrix.storage }}
       containerd: ${{ matrix.containerd }}
       send_coverage: false
-    secrets:
-      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}