diff --git a/.github/workflows/build-and-test.yml b/.github/workflows/build-and-test.yml
index 624cdab7d10..85c10202598 100644
--- a/.github/workflows/build-and-test.yml
+++ b/.github/workflows/build-and-test.yml
@@ -13,6 +13,7 @@ jobs:
     uses: ./.github/workflows/reusable_test.yml
     with:
       pinned_botorch: false
+    secrets: inherit
 
   lint:
 
diff --git a/.github/workflows/cron.yml b/.github/workflows/cron.yml
index c8fe85c579a..64dfc99e4ac 100644
--- a/.github/workflows/cron.yml
+++ b/.github/workflows/cron.yml
@@ -19,6 +19,7 @@ jobs:
     with:
       pinned_botorch: false
       minimal_dependencies: true
+    secrets: inherit
 
   tests-and-coverage-full:
     name: Tests with latest BoTorch & full dependencies
@@ -26,6 +27,7 @@ jobs:
     with:
       pinned_botorch: false
       minimal_dependencies: false
+    secrets: inherit
 
   build-tutorials:
     name: Build tutorials with latest BoTorch
diff --git a/.github/workflows/cron_pinned.yml b/.github/workflows/cron_pinned.yml
index 63a6ea8d879..ac62b3640cf 100644
--- a/.github/workflows/cron_pinned.yml
+++ b/.github/workflows/cron_pinned.yml
@@ -12,6 +12,7 @@ jobs:
     with:
       pinned_botorch: true
       minimal_dependencies: true
+    secrets: inherit
 
   tests-and-coverage-full:
     name: Tests with pinned BoTorch & full dependencies
@@ -19,6 +20,7 @@ jobs:
     with:
       pinned_botorch: true
       minimal_dependencies: false
+    secrets: inherit
 
   build-tutorials:
     name: Build tutorials with pinned BoTorch
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index b499baa8334..a53c44efa63 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -13,12 +13,14 @@ jobs:
     uses: ./.github/workflows/reusable_test.yml
     with:
       pinned_botorch: false
+    secrets: inherit
 
   tests-and-coverage-pinned:
     name: Tests with pinned BoTorch
     uses: ./.github/workflows/reusable_test.yml
     with:
       pinned_botorch: true
+    secrets: inherit
 
   publish-stable-website:
 
diff --git a/.github/workflows/reusable_test.yml b/.github/workflows/reusable_test.yml
index 743ba964f8c..195f6068c6f 100644
--- a/.github/workflows/reusable_test.yml
+++ b/.github/workflows/reusable_test.yml
@@ -61,8 +61,10 @@ jobs:
       name: Tests and coverage
       run: |
         pytest -ra --cov=ax
-    - if: ${{ !inputs.minimal_dependencies }}
-      # Using same condition as above since we need the coverage report for upload.
+    - if: ${{ !inputs.minimal_dependencies && matrix.python-version == 3.10 }}
+      # Only upload codecov once per workflow.
       name: Upload coverage
-      run: |
-        bash <(curl -s https://codecov.io/bash)
+      uses: codecov/codecov-action@v4
+      with:
+        fail_ci_if_error: true
+        token: ${{ secrets.CODECOV_TOKEN }}