diff --git a/.github/workflows/CI.yml b/.github/workflows/CI.yml
index 0eef947b2..a7da7541f 100644
--- a/.github/workflows/CI.yml
+++ b/.github/workflows/CI.yml
@@ -91,6 +91,7 @@ jobs:
           name: coverage-data-${{ matrix.python-version }}
           path: .coverage
           if-no-files-found: ignore
+          include-hidden-files: true
 
   # Only run accessibility tests on the latest Python version (3.12) and Ubuntu
   a11y-tests:
@@ -178,9 +179,11 @@ jobs:
           runs: 3 # Multiple runs to reduce variance
 
   coverage:
-    name: "check coverage"
+    name: "Check coverage"
     needs: run-pytest
     runs-on: ubuntu-latest
+    # avoid running this on schedule, releases, or workflow_call
+    if: github.event.workflow_run.event != 'schedule' && github.event.workflow_run.event != 'release' && github.event.workflow_run.event != 'workflow_call'
     permissions:
       contents: write
       pull-requests: write
@@ -221,8 +224,6 @@ jobs:
       - name: "Coverage comment 💬"
         uses: py-cov-action/python-coverage-comment-action@v3
         id: coverage_comment
-        # avoid running this on schedule or releases
-        if: github.event.workflow_run.event != 'schedule' && github.event.workflow_run.event != 'release'
         with:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index f0f2999bc..edfbfc440 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -20,6 +20,10 @@ jobs:
   # calls our general CI workflow (tests, build docs, etc.)
   tests:
     uses: ./.github/workflows/CI.yml
+    # needed for the coverage action
+    permissions:
+      contents: write
+      pull-requests: write
 
   build-package:
     name: "Build & verify PST package"