diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f47e7ab07..87e26e938 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -217,14 +217,13 @@ jobs:
           LSP: '${{ matrix.lsp }}'
           LSP_EXTRACT_FILE: '${{ matrix.lsp_extract_file }}'
       - if: always()
-        uses: codecov/codecov-action@v3
+        uses: codecov/codecov-action@v5
         with:
-          directory: empty
           name: Windows (${{ matrix.python }}, ${{ matrix.arch }}${{ matrix.extra_name }})
           # multiple flags is marked as an error in codecov UI, but is actually fine
           # https://github.com/codecov/feedback/issues/567
           flags: Windows,${{ matrix.python }}
-          fail_ci_if_error: false  # change to true when using codecov action v5
+          fail_ci_if_error: true
 
   Ubuntu:
     name: 'Ubuntu (${{ matrix.python }}${{ matrix.extra_name }})'
@@ -293,12 +292,11 @@ jobs:
       - if: >-
           always()
           && matrix.check_formatting != '1'
-        uses: codecov/codecov-action@v3
+        uses: codecov/codecov-action@v5
         with:
-          directory: empty
           name: Ubuntu (${{ matrix.python }}${{ matrix.extra_name }})
           flags: Ubuntu,${{ matrix.python }}
-          fail_ci_if_error: false
+          fail_ci_if_error: true
 
   macOS:
     name: 'macOS (${{ matrix.python }})'
@@ -336,12 +334,11 @@ jobs:
       - name: Run tests
         run: ./ci.sh
       - if: always()
-        uses: codecov/codecov-action@v3
+        uses: codecov/codecov-action@v5
         with:
-          directory: empty
           name: macOS (${{ matrix.python }})
           flags: macOS,${{ matrix.python }}
-          fail_ci_if_error: false
+          fail_ci_if_error: true
 
   # run CI on a musl linux
   Alpine:
@@ -355,9 +352,10 @@ jobs:
       - name: Install necessary packages
         # can't use setup-python because that python doesn't seem to work;
         # `python3-dev` (rather than `python:alpine`) for some ctypes reason,
+        # `curl`, `gpg`, `git` for codecov-action v4/v5 to work (https://github.com/codecov/codecov-action/issues/1320).
         # `nodejs` for pyright (`node-env` pulls in nodejs but that takes a while and can time out the test).
         # `perl` for a platform independent `sed -i` alternative
-        run: apk update && apk add python3-dev bash nodejs perl
+        run: apk update && apk add python3-dev bash curl gpg git nodejs perl
 
       - name: Retrieve the project source from an sdist inside the GHA artifact
         # must be after `apk add` because it relies on `bash` existing
@@ -382,12 +380,11 @@ jobs:
             f.write("\n")
 
       - if: always()
-        uses: codecov/codecov-action@v3
+        uses: codecov/codecov-action@v5
         with:
-          directory: empty
           name: Alpine
           flags: Alpine,${{ steps.get-version.outputs.version }}
-          fail_ci_if_error: false
+          fail_ci_if_error: true
 
   Cython:
     name: "Cython"
@@ -455,7 +452,7 @@ jobs:
         with:
           name: Cython
           flags: Cython,${{ steps.get-version.outputs.version }}
-          fail_ci_if_error: false
+          fail_ci_if_error: true
 
   # https://github.com/marketplace/actions/alls-green#why
   check:  # This job does nothing and is only used for the branch protection
diff --git a/ci.sh b/ci.sh
index 8b23ad279..07797937e 100755
--- a/ci.sh
+++ b/ci.sh
@@ -137,8 +137,10 @@ echo "::endgroup::"
 echo "::group::Coverage"
 
 coverage combine --rcfile ../pyproject.toml
-coverage report -m --rcfile ../pyproject.toml
-coverage xml --rcfile ../pyproject.toml
+cd ..  # coverage needs to be in the folder containing src/trio
+cp empty/.coverage .
+coverage report -m --rcfile ./pyproject.toml
+coverage xml --rcfile ./pyproject.toml
 
 # Remove the LSP again; again we want to do this ASAP to avoid
 # accidentally breaking other stuff.
diff --git a/pyproject.toml b/pyproject.toml
index f0ba3610c..bec87cfef 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -292,18 +292,10 @@ show_contexts = true
 skip_covered = false
 
 [tool.coverage.paths]
-_site-packages-to-src-mapping = [
-  "src",
-  "*/src",
-  '*\src',
-  "*/lib/pypy*/site-packages",
-  "*/lib/python*/site-packages",
-  '*\Lib\site-packages',
-]
+source = ["src", "**/site-packages"]
 
 [tool.coverage.run]
 branch = true
-source_pkgs = ["trio"]
 omit = [
     # Omit the generated files in trio/_core starting with _generated_
     "*/trio/_core/_generated_*",
@@ -319,7 +311,7 @@ omit = [
 parallel = true
 plugins = []
 relative_files = true
-source = ["."]
+source = ["trio"]
 
 [tool.coverage.report]
 precision = 1