diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 5b084f5..218cb1c 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -1,5 +1,7 @@
 name: build
 
+permissions: read-all
+
 on:
   push:
   pull_request:
@@ -13,7 +15,7 @@ jobs:
       fail-fast: false
       matrix:
         os: [ubuntu-latest]
-        python-version: ["3.12"]
+        python-version: ["3.13"]
     runs-on: ${{ matrix.os }}
 
     steps:
@@ -37,6 +39,6 @@ jobs:
         make
         ./setup_environment.sh pytest --cov=.. --cov-branch --cov-report=xml -v -k 'not test_protobuf_installed and not add_test_sites' ../test/test_*.py ../test/medium_test_*.py test/*/*.py
         flake8 ../pyext/src/
-    - uses: codecov/codecov-action@v4
+    - uses: codecov/codecov-action@v5
       env:
         CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}