diff --git a/.codecov.yml b/.codecov.yml
index 060b2685e..a9ab1c2d7 100644
--- a/.codecov.yml
+++ b/.codecov.yml
@@ -6,8 +6,6 @@ codecov:
   # https://docs.codecov.io/docs/comparing-commits
   allow_coverage_offsets: true
 
-  token: 6dafc396-e7f5-4221-a38a-8b07a49fbdae
-
 comment: off
 
 # Matches 'omit:' in .coveragerc
diff --git a/.github/codecov-upstream.yml b/.github/codecov-upstream.yml
new file mode 100644
index 000000000..060b2685e
--- /dev/null
+++ b/.github/codecov-upstream.yml
@@ -0,0 +1,18 @@
+# Documentation: https://docs.codecov.io/docs/codecov-yaml
+
+codecov:
+  # Avoid "Missing base report" due to committing CHANGES.rst with "[CI skip]"
+  # https://github.com/codecov/support/issues/363
+  # https://docs.codecov.io/docs/comparing-commits
+  allow_coverage_offsets: true
+
+  token: 6dafc396-e7f5-4221-a38a-8b07a49fbdae
+
+comment: off
+
+# Matches 'omit:' in .coveragerc
+ignore:
+  - "Tests/32bit_segfault_check.py"
+  - "Tests/bench_cffi_access.py"
+  - "Tests/check_*.py"
+  - "Tests/createfontdatachunk.py"
diff --git a/.github/workflows/test-windows.yml b/.github/workflows/test-windows.yml
index e0c55bc1a..e97db30c4 100644
--- a/.github/workflows/test-windows.yml
+++ b/.github/workflows/test-windows.yml
@@ -364,12 +364,16 @@ jobs:
         name: errors
         path: Tests/errors
 
+    - name: Prepare coverage token
+      if: success() && github.repository == 'python-pillow/Pillow'
+      run: cp .github/codecov-upstream.yml .codecov.yml
+
     - name: Upload coverage
       if: success()
       uses: codecov/codecov-action@v1
       with:
-        token: ${{ secrets.CODECOV_TOKEN }}
-        name: ${{ runner.os }} Python ${{ matrix.python-version }}
+          token: ${{ secrets.CODECOV_TOKEN }}
+          name: ${{ runner.os }} Python ${{ matrix.python-version }}
 
     - name: Build wheel
       id: wheel
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 0a4dcc544..8c80bcd71 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -89,9 +89,12 @@ jobs:
         .travis/after_success.sh
       env:
         MATRIX_OS: ${{ matrix.os }}
-        CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
         COVERALLS_REPO_TOKEN: ${{ secrets.COVERALLS_REPO_TOKEN }}
 
+    - name: Prepare coverage token
+      if: success() && github.repository == 'python-pillow/Pillow'
+      run: cp .github/codecov-upstream.yml .codecov.yml
+
     - name: Upload coverage
       if: success()
       uses: codecov/codecov-action@v1