diff --git a/.github/workflows/border_router.yml b/.github/workflows/border_router.yml
index 3c2ecb1bd2f..86d484ce95c 100644
--- a/.github/workflows/border_router.yml
+++ b/.github/workflows/border_router.yml
@@ -184,7 +184,7 @@ jobs:
           third_party/openthread/repo/*.log
     - name: Codecov
       if: ${{ success() && steps.check_cache_result.outputs.cache-hit != 'true' }}
-      uses: codecov/codecov-action@v3
+      uses: codecov/codecov-action@v4
     - name: Cache test result
       if: ${{ success() && steps.check_cache_result.outputs.cache-hit != 'true' }}
       run: |
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index f90ced17792..cbd4e17f106 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -73,7 +73,7 @@ jobs:
     - name: Run
       run: script/test build check
     - name: Codecov
-      uses: codecov/codecov-action@v3
+      uses: codecov/codecov-action@v4
 
   rest-check:
     runs-on: ubuntu-20.04
@@ -96,7 +96,7 @@ jobs:
     - name: Run
       run: script/test build check
     - name: Codecov
-      uses: codecov/codecov-action@v3
+      uses: codecov/codecov-action@v4
 
   script-check:
     runs-on: ubuntu-20.04
@@ -112,7 +112,7 @@ jobs:
     - name: Run
       run: tests/scripts/check-scripts
     - name: Codecov
-      uses: codecov/codecov-action@v3
+      uses: codecov/codecov-action@v4
 
   scan-build:
     runs-on: ubuntu-20.04
diff --git a/.github/workflows/meshcop.yml b/.github/workflows/meshcop.yml
index e3aaae56982..6bbc8503ada 100644
--- a/.github/workflows/meshcop.yml
+++ b/.github/workflows/meshcop.yml
@@ -80,4 +80,4 @@ jobs:
         OTBR_USE_WEB_COMMISSIONER: 1
       run: OTBR_VERBOSE=${RUNNER_DEBUG:-0} script/test meshcop
     - name: Codecov
-      uses: codecov/codecov-action@v3
+      uses: codecov/codecov-action@v4