diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 308a2620..cfa4c1f7 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -77,7 +77,8 @@ jobs:
         runs-on: ubuntu-24.04
         timeout-minutes: 20
         permissions:
-          contents: read # Required to clone the repo.
+            contents: read # Required to clone the repo.
+            id-token: write
         strategy:
             matrix:
                 php:
@@ -136,7 +137,14 @@ jobs:
             - name: Composer install
               run: |
                 rm composer.lock || true # We need to install fresh.
-                npm run composer install
+                # The composer.json platform override (php: 7.2.24) installs PHPUnit 8.5, which does
+                # not support code coverage on PHP 8. Use --ignore-platform-req=php on PHP 8+ so
+                # Composer installs PHPUnit 9.6, which supports coverage on PHP 8.x.
+                if [[ "${WP_ENV_PHP_VERSION}" == 8.* ]]; then
+                  npm run composer -- install --ignore-platform-req=php
+                else
+                  npm run composer install
+                fi
 
             - name: Versions
               run: |
@@ -144,13 +152,16 @@ jobs:
                 npm run env run cli wp core version
 
             - name: Test
-              run: npm run test
+              run: |
+                npm run env run tests-cli --env-cwd=wp-content/plugins/two-factor -- mkdir -p tests/logs
+                npm run test
 
             - name: Upload code coverage report
-              if: ${{ matrix.php == '8.3' && matrix.wp == 'latest' }}
+              if: ${{ matrix.php == '8.3' && matrix.wp == 'latest' && hashFiles('tests/logs/clover.xml') != '' }}
               uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de
               with:
-                file: tests/logs/clover.xml
+                use_oidc: true
+                files: tests/logs/clover.xml
                 flags: phpunit
                 fail_ci_if_error: false