diff --git a/.github/workflows/ci-rust.yml b/.github/workflows/ci-rust.yml
index 10cb94ec29..dcc1f35bf5 100644
--- a/.github/workflows/ci-rust.yml
+++ b/.github/workflows/ci-rust.yml
@@ -1,5 +1,6 @@
 name: CI - Rust
-
+permissions:
+  contents: read
 on:
   push:
     paths:
@@ -38,6 +39,8 @@ on:
 
 jobs:
   rust_ci:
+    # the default timeout is 6 hours, that's too much if the job gets stuck
+    timeout-minutes: 60
     runs-on: ubuntu-latest
     env:
       COVERAGE: 1
@@ -60,6 +63,9 @@ jobs:
     - name: Git Checkout
       uses: actions/checkout@v4
 
+    - name: Configure git
+      run:  git config --global --add safe.directory "$GITHUB_WORKSPACE"
+
     - name: Configure and refresh repositories
       # disable unused repositories to have faster refresh
       run: zypper modifyrepo -d repo-non-oss repo-openh264 repo-update && ( zypper ref || zypper ref || zypper ref )
@@ -108,12 +114,38 @@ jobs:
         cargo xtask openapi
         openapi-spec-validator out/openapi/*
 
+    - name: Upload coverage result
+      uses: actions/upload-artifact@v4
+      with:
+        name: coverage_rust
+        if-no-files-found: error
+        path: rust/cobertura.xml
+
+  # The coveralls action for some unknown reason gets stuck when running inside
+  # a container. As a workaround save the coverage data and send it in a
+  # separate job running directly in the Ubuntu host, that works fine.
+  # See https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/storing-and-sharing-data-from-a-workflow#passing-data-between-jobs-in-a-workflow
+  coveralls:
+    # the default timeout is 6 hours, this should take just few seconds
+    timeout-minutes: 20
+    runs-on: ubuntu-latest
+    needs: rust_ci
+    defaults:
+      run:
+        working-directory: ./rust
+
+    steps:
+    - name: Git Checkout
+      uses: actions/checkout@v4
+
+    - name: Download coverage result
+      uses: actions/download-artifact@v4
+      with:
+        name: coverage_rust
+
     # send the code coverage for the Rust part to the coveralls.io
     - name: Coveralls GitHub Action
-      # ignore errors in this step
-      continue-on-error: true
       uses: coverallsapp/github-action@v2
-      # ignore errors in this step
       with:
         base-path: ./rust
         format: cobertura
@@ -124,10 +156,7 @@ jobs:
     # Web parts (it needs a separate step, the "carryforward" flag can be used
     # only with the "parallel-finished: true" option)
     - name: Coveralls Finished
-      # ignore errors in this step
-      continue-on-error: true
       uses: coverallsapp/github-action@v2
-      # ignore errors in this step
       with:
         parallel-finished: true
-        carryforward: "service,web"
+        carryforward: "rust,service,web"
diff --git a/.github/workflows/ci-service.yml b/.github/workflows/ci-service.yml
index 34a2bc8cd9..63fcd141f3 100644
--- a/.github/workflows/ci-service.yml
+++ b/.github/workflows/ci-service.yml
@@ -1,5 +1,6 @@
 name: CI - Service
-
+permissions:
+  contents: read
 on:
   push:
     paths:
@@ -38,6 +39,8 @@ on:
 
 jobs:
   ruby_tests:
+    # the default timeout is 6 hours, that's too much if the job gets stuck
+    timeout-minutes: 60
     runs-on: ubuntu-latest
     env:
       COVERAGE: 1
@@ -59,6 +62,9 @@ jobs:
     - name: Git Checkout
       uses: actions/checkout@v4
 
+    - name: Configure git
+      run:  git config --global --add safe.directory "$GITHUB_WORKSPACE"
+
     - name: Configure and refresh repositories
       # disable unused repositories to have faster refresh
       run: zypper modifyrepo -d repo-non-oss repo-openh264 repo-update && zypper ref
@@ -94,10 +100,37 @@ jobs:
     - name: Run the tests and generate coverage report
       run: bundle exec rspec
 
+    - name: Upload coverage result
+      uses: actions/upload-artifact@v4
+      with:
+        name: coverage_service
+        if-no-files-found: error
+        path: service/coverage/lcov.info
+
+  # The coveralls action for some unknown reason gets stuck when running inside
+  # a container. As a workaround save the coverage data and send it in a
+  # separate job running directly in the Ubuntu host, that works fine.
+  # See https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/storing-and-sharing-data-from-a-workflow#passing-data-between-jobs-in-a-workflow
+  coveralls:
+    # the default timeout is 6 hours, this should take just few seconds
+    timeout-minutes: 20
+    runs-on: ubuntu-latest
+    needs: ruby_tests
+    defaults:
+      run:
+        working-directory: ./service
+
+    steps:
+    - name: Git Checkout
+      uses: actions/checkout@v4
+
+    - name: Download coverage result
+      uses: actions/download-artifact@v4
+      with:
+        name: coverage_service
+
     # send the code coverage for the Ruby part to the coveralls.io
     - name: Coveralls GitHub Action
-      # ignore errors in this step
-      continue-on-error: true
       uses: coverallsapp/github-action@v2
       with:
         base-path: ./service
@@ -108,9 +141,7 @@ jobs:
     # Rust parts (it needs a separate step, the "carryforward" flag can be used
     # only with the "parallel-finished: true" option)
     - name: Coveralls Finished
-      # ignore errors in this step
-      continue-on-error: true
       uses: coverallsapp/github-action@v2
       with:
         parallel-finished: true
-        carryforward: "rust,web"
+        carryforward: "rust,service,web"
diff --git a/.github/workflows/ci-web.yml b/.github/workflows/ci-web.yml
index 3aa9301ca3..0dfb604941 100644
--- a/.github/workflows/ci-web.yml
+++ b/.github/workflows/ci-web.yml
@@ -1,5 +1,6 @@
 name: CI - Web
-
+permissions:
+  contents: read
 on:
   push:
     paths:
@@ -34,6 +35,8 @@ on:
 
 jobs:
   frontend_build:
+    # the default timeout is 6 hours, that's too much if the job gets stuck
+    timeout-minutes: 60
     runs-on: ubuntu-latest
 
     defaults:
@@ -72,20 +75,20 @@ jobs:
 
     - name: Run the tests and generate coverage report
       run: npm test -- --coverage --silent
-#
-#    # send the code coverage for the web part to the coveralls.io
-#    - name: Coveralls GitHub Action
-#      uses: coverallsapp/github-action@v2
-#      with:
-#        base-path: ./web
-#        flag-name: web
-#        parallel: true
-#
-#    # close the code coverage and inherit the previous coverage for the Ruby and
-#    # Rust parts (it needs a separate step, the "carryforward" flag can be used
-#    # only with the "parallel-finished: true" option)
-#    - name: Coveralls Finished
-#      uses: coverallsapp/github-action@v2
-#      with:
-#        parallel-finished: true
-#        carryforward: "service,rust"
+
+    # send the code coverage for the web part to the coveralls.io
+    - name: Coveralls GitHub Action
+      uses: coverallsapp/github-action@v2
+      with:
+        base-path: ./web
+        flag-name: web
+        parallel: true
+
+    # close the code coverage and inherit the previous coverage for the Ruby and
+    # Rust parts (it needs a separate step, the "carryforward" flag can be used
+    # only with the "parallel-finished: true" option)
+    - name: Coveralls Finished
+      uses: coverallsapp/github-action@v2
+      with:
+        parallel-finished: true
+        carryforward: "rust,service,web"