diff --git a/.github/workflows/completion_tests.yaml b/.github/workflows/completion_tests.yaml
index cbccf5a76..3a6fd0818 100644
--- a/.github/workflows/completion_tests.yaml
+++ b/.github/workflows/completion_tests.yaml
@@ -2,10 +2,13 @@ name: completion-tests
 
 on:
   push:
-    branches-ignore:
-      - c-main
-      - c-3.2
+    branches:
+      - main
+      - v*.*.x
   pull_request:
+    branches:
+      - main
+      - v*.*.x
 
 permissions:
   contents: read
diff --git a/.github/workflows/easybuild_tests.yaml b/.github/workflows/easybuild_tests.yaml
index 45f620f03..382560a40 100644
--- a/.github/workflows/easybuild_tests.yaml
+++ b/.github/workflows/easybuild_tests.yaml
@@ -2,10 +2,13 @@ name: easybuild-tests
 
 on:
   push:
-    branches-ignore:
-      - c-main
-      - c-3.2
+    branches:
+      - main
+      - v*.*.x
   pull_request:
+    branches:
+      - main
+      - v*.*.x
 
 permissions:
   contents: read
diff --git a/.github/workflows/lint_tests.yaml b/.github/workflows/lint_tests.yaml
index ee3a63696..7748be70f 100644
--- a/.github/workflows/lint_tests.yaml
+++ b/.github/workflows/lint_tests.yaml
@@ -2,10 +2,13 @@ name: lint-tests
 
 on:
   push:
-    branches-ignore:
-      - c-main
-      - c-3.2
+    branches:
+      - main
+      - v*.*.x
   pull_request:
+    branches:
+      - main
+      - v*.*.x
 
 permissions:
   contents: read
diff --git a/.github/workflows/linux_tests.yaml b/.github/workflows/linux_tests.yaml
index adf0625c9..29c9eb1a7 100644
--- a/.github/workflows/linux_tests.yaml
+++ b/.github/workflows/linux_tests.yaml
@@ -2,17 +2,19 @@ name: linux-tests
 
 on:
   push:
-    branches-ignore:
-      - c-main
-      - c-3.2
+    branches:
+      - main
+      - v*.*.x
   pull_request:
-
-permissions:
-  contents: read
+    branches:
+      - main
+      - v*.*.x
 
 jobs:
   tcl86-nolibtclenvmodules:
     runs-on: ubuntu-22.04
+    permissions:
+      id-token: write
     env:
       CONFIGURE_OPTS: |
         --with-tclsh=tclsh8.6
@@ -67,10 +69,13 @@ jobs:
       - name: Uninstall Modules
         run: |
           make uninstall
-      # no token needed: public repo uses Codecov's tokenless upload via
-      # GitHub OIDC, which also works for pull requests coming from forks
-      # (base repo secrets are never exposed to fork-triggered PR runs)
+      # no token needed: id-token permission above lets Codecov verify
+      # this public repo via GitHub OIDC, which also works for pull
+      # requests from forks (base repo secrets are never exposed there)
       - uses: codecov/codecov-action@v7
+        with:
+          verbose: true
+          use_oidc: true
       - uses: actions/upload-artifact@v7
         if: failure()
         with:
@@ -82,6 +87,8 @@ jobs:
 
   tcl85-nolibtclenvmodules:
     runs-on: ubuntu-22.04
+    permissions:
+      id-token: write
     env:
       CONFIGURE_OPTS: |
         --with-tclsh=tclsh8.5
@@ -155,10 +162,13 @@ jobs:
       - name: Uninstall Modules
         run: |
           make uninstall
-      # no token needed: public repo uses Codecov's tokenless upload via
-      # GitHub OIDC, which also works for pull requests coming from forks
-      # (base repo secrets are never exposed to fork-triggered PR runs)
+      # no token needed: id-token permission above lets Codecov verify
+      # this public repo via GitHub OIDC, which also works for pull
+      # requests from forks (base repo secrets are never exposed there)
       - uses: codecov/codecov-action@v7
+        with:
+          verbose: true
+          use_oidc: true
       - uses: actions/upload-artifact@v7
         if: failure()
         with:
@@ -170,6 +180,8 @@ jobs:
 
   tcl85-2:
     runs-on: ubuntu-22.04
+    permissions:
+      id-token: write
     env:
       CONFIGURE_OPTS: |
         --with-tclsh=tclsh8.5
@@ -239,10 +251,13 @@ jobs:
       - name: Uninstall Modules
         run: |
           make uninstall
-      # no token needed: public repo uses Codecov's tokenless upload via
-      # GitHub OIDC, which also works for pull requests coming from forks
-      # (base repo secrets are never exposed to fork-triggered PR runs)
+      # no token needed: id-token permission above lets Codecov verify
+      # this public repo via GitHub OIDC, which also works for pull
+      # requests from forks (base repo secrets are never exposed there)
       - uses: codecov/codecov-action@v7
+        with:
+          verbose: true
+          use_oidc: true
       - uses: actions/upload-artifact@v7
         if: failure()
         with:
@@ -254,6 +269,8 @@ jobs:
 
   tcl86:
     runs-on: ubuntu-22.04
+    permissions:
+      id-token: write
     env:
       CONFIGURE_OPTS: |
         --with-tclsh=tclsh8.6
@@ -308,10 +325,13 @@ jobs:
       - name: Uninstall Modules
         run: |
           make uninstall
-      # no token needed: public repo uses Codecov's tokenless upload via
-      # GitHub OIDC, which also works for pull requests coming from forks
-      # (base repo secrets are never exposed to fork-triggered PR runs)
+      # no token needed: id-token permission above lets Codecov verify
+      # this public repo via GitHub OIDC, which also works for pull
+      # requests from forks (base repo secrets are never exposed there)
       - uses: codecov/codecov-action@v7
+        with:
+          verbose: true
+          use_oidc: true
       - uses: actions/upload-artifact@v7
         if: failure()
         with:
@@ -323,6 +343,8 @@ jobs:
 
   tcl85:
     runs-on: ubuntu-22.04
+    permissions:
+      id-token: write
     env:
       CONFIGURE_OPTS: |
         --with-tclsh=tclsh8.5
@@ -379,10 +401,13 @@ jobs:
       - name: Uninstall Modules
         run: |
           make uninstall
-      # no token needed: public repo uses Codecov's tokenless upload via
-      # GitHub OIDC, which also works for pull requests coming from forks
-      # (base repo secrets are never exposed to fork-triggered PR runs)
+      # no token needed: id-token permission above lets Codecov verify
+      # this public repo via GitHub OIDC, which also works for pull
+      # requests from forks (base repo secrets are never exposed there)
       - uses: codecov/codecov-action@v7
+        with:
+          verbose: true
+          use_oidc: true
       - uses: actions/upload-artifact@v7
         if: failure()
         with:
@@ -475,6 +500,8 @@ jobs:
 
   tcl90:
     runs-on: ubuntu-22.04
+    permissions:
+      id-token: write
     env:
       CONFIGURE_OPTS: |
         --with-tclsh=tclsh9.0
@@ -525,10 +552,13 @@ jobs:
       - name: Uninstall Modules
         run: |
           make uninstall
-      # no token needed: public repo uses Codecov's tokenless upload via
-      # GitHub OIDC, which also works for pull requests coming from forks
-      # (base repo secrets are never exposed to fork-triggered PR runs)
+      # no token needed: id-token permission above lets Codecov verify
+      # this public repo via GitHub OIDC, which also works for pull
+      # requests from forks (base repo secrets are never exposed there)
       - uses: codecov/codecov-action@v7
+        with:
+          verbose: true
+          use_oidc: true
       - uses: actions/upload-artifact@v7
         if: failure()
         with:
diff --git a/.github/workflows/macos_tests.yaml b/.github/workflows/macos_tests.yaml
index 02660c30c..52b1adf28 100644
--- a/.github/workflows/macos_tests.yaml
+++ b/.github/workflows/macos_tests.yaml
@@ -2,17 +2,19 @@ name: macos-tests
 
 on:
   push:
-    branches-ignore:
-      - c-main
-      - c-3.2
+    branches:
+      - main
+      - v*.*.x
   pull_request:
-
-permissions:
-  contents: read
+    branches:
+      - main
+      - v*.*.x
 
 jobs:
   macos:
     runs-on: macos-15
+    permissions:
+      id-token: write
     env:
       CONFIGURE_OPTS: |
         --prefix=/tmp/modules
@@ -62,10 +64,13 @@ jobs:
       - name: Uninstall Modules
         run: |
           make uninstall
-      # no token needed: public repo uses Codecov's tokenless upload via
-      # GitHub OIDC, which also works for pull requests coming from forks
-      # (base repo secrets are never exposed to fork-triggered PR runs)
+      # no token needed: id-token permission above lets Codecov verify
+      # this public repo via GitHub OIDC, which also works for pull
+      # requests from forks (base repo secrets are never exposed there)
       - uses: codecov/codecov-action@v7
+        with:
+          verbose: true
+          use_oidc: true
       - uses: actions/upload-artifact@v7
         if: failure()
         with:
diff --git a/.github/workflows/windows_tests.yaml b/.github/workflows/windows_tests.yaml
index c26f15db7..7f281e2fc 100644
--- a/.github/workflows/windows_tests.yaml
+++ b/.github/workflows/windows_tests.yaml
@@ -2,10 +2,13 @@ name: windows-tests
 
 on:
   push:
-    branches-ignore:
-      - c-main
-      - c-3.2
+    branches:
+      - main
+      - v*.*.x
   pull_request:
+    branches:
+      - main
+      - v*.*.x
 
 permissions:
   contents: read