diff --git a/.github/workflows/sonarqube.yml b/.github/workflows/sonarqube.yml
index ea31162..3ae793e 100644
--- a/.github/workflows/sonarqube.yml
+++ b/.github/workflows/sonarqube.yml
@@ -8,6 +8,10 @@ jobs:
   sonarcloud:
     name: SonarCloud
     runs-on: ubuntu-latest
+    # At job level so the scan step's `if` can see it: a step cannot test an
+    # environment variable it defines itself.
+    env:
+      SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
     steps:
       - uses: actions/checkout@v7
         with:
@@ -24,7 +28,12 @@ jobs:
         # nosemgrep: generic.secrets.security.detected-sonarqube-docs-api-key
         # The hex string is this action's pinned commit SHA, not a key. Pinning
         # is what SonarCloud's githubactions:S7637 asks for.
+        #
+        # Skipped when SONAR_TOKEN is absent, which is the case on dependabot
+        # pull requests: they run without repository secrets, and a scan that
+        # cannot authenticate would fail the check for a reason unrelated to
+        # the change.
+        if: env.SONAR_TOKEN != ''
         uses: SonarSource/sonarqube-scan-action@22918119ff8e1ca75a623e15c8296b6ea4fbe28f # v8
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 05e0ba7..da6dfa4 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -53,6 +53,10 @@ jobs:
         with:
           coverage-reports: cover.out
           force-coverage-parser: go
+        # Uploading coverage is best-effort. Dependabot pull requests run
+        # without repository secrets, so CODACY_PROJECT_TOKEN is empty there
+        # and the action fails; that should not turn a passing test run red.
+        continue-on-error: true
         if: runner.os != 'Windows'
         env:
           CODACY_PROJECT_TOKEN: ${{ secrets.CODACY_PROJECT_TOKEN }}