diff --git a/.github/actions/upload-codescene-coverage/CHANGELOG.md b/.github/actions/upload-codescene-coverage/CHANGELOG.md
index 607e6cbc..f9a3d815 100644
--- a/.github/actions/upload-codescene-coverage/CHANGELOG.md
+++ b/.github/actions/upload-codescene-coverage/CHANGELOG.md
@@ -40,3 +40,7 @@
 - Ensure `CS_ACCESS_TOKEN` and `CODESCENE_CLI_SHA256` environment variables are
   derived from the corresponding inputs. This prevents action load failures
   caused by unsupported `secrets` or `vars` expressions.
+
+## v1.5.2
+- Remove unsupported `env` block from the `runs` section.
+- Export `CS_ACCESS_TOKEN` and `CODESCENE_CLI_SHA256` via a setup step.
diff --git a/.github/actions/upload-codescene-coverage/README.md b/.github/actions/upload-codescene-coverage/README.md
index 9ef846a9..8aa7067b 100644
--- a/.github/actions/upload-codescene-coverage/README.md
+++ b/.github/actions/upload-codescene-coverage/README.md
@@ -18,9 +18,8 @@ installer script. If the optional `installer-checksum` input is set,
 the installer is validated before execution. Any other value for
 `format` results in an error.
 
-The provided `access-token` and `installer-checksum` inputs become the
-`CS_ACCESS_TOKEN` and `CODESCENE_CLI_SHA256` environment variables
-available to steps within the action.
+The action exports the `access-token` and `installer-checksum` inputs as
+`CS_ACCESS_TOKEN` and `CODESCENE_CLI_SHA256` for use by later steps.
 
 ## Environment variables
 
diff --git a/.github/actions/upload-codescene-coverage/action.yml b/.github/actions/upload-codescene-coverage/action.yml
index b0541ab0..43427756 100644
--- a/.github/actions/upload-codescene-coverage/action.yml
+++ b/.github/actions/upload-codescene-coverage/action.yml
@@ -18,11 +18,12 @@ inputs:
     required: false
 runs:
   using: composite
-  # derive environment from inputs; actions cannot access `secrets` or `vars`
-  env:
-    CS_ACCESS_TOKEN: ${{ inputs.access-token }}
-    CODESCENE_CLI_SHA256: ${{ inputs.installer-checksum }}
   steps:
+    - name: Export env for later steps
+      run: |
+        printf 'CS_ACCESS_TOKEN=%s\n' "${{ inputs.access-token }}" >>"${GITHUB_ENV}"
+        printf 'CODESCENE_CLI_SHA256=%s\n' "${{ inputs.installer-checksum }}" >>"${GITHUB_ENV}"
+      shell: bash
     - name: Validate inputs
       run: |
         case "${{ inputs.format }}" in