diff --git a/.github/workflows/completion_tests.yaml b/.github/workflows/completion_tests.yaml
index cbccf5a76..3a6fd0818 100644
--- a/.github/workflows/completion_tests.yaml
+++ b/.github/workflows/completion_tests.yaml
@@ -2,10 +2,13 @@ name: completion-tests
 
 on:
   push:
-    branches-ignore:
-      - c-main
-      - c-3.2
+    branches:
+      - main
+      - v*.*.x
   pull_request:
+    branches:
+      - main
+      - v*.*.x
 
 permissions:
   contents: read
diff --git a/.github/workflows/easybuild_tests.yaml b/.github/workflows/easybuild_tests.yaml
index 45f620f03..382560a40 100644
--- a/.github/workflows/easybuild_tests.yaml
+++ b/.github/workflows/easybuild_tests.yaml
@@ -2,10 +2,13 @@ name: easybuild-tests
 
 on:
   push:
-    branches-ignore:
-      - c-main
-      - c-3.2
+    branches:
+      - main
+      - v*.*.x
   pull_request:
+    branches:
+      - main
+      - v*.*.x
 
 permissions:
   contents: read
diff --git a/.github/workflows/lint_tests.yaml b/.github/workflows/lint_tests.yaml
index ee3a63696..7748be70f 100644
--- a/.github/workflows/lint_tests.yaml
+++ b/.github/workflows/lint_tests.yaml
@@ -2,10 +2,13 @@ name: lint-tests
 
 on:
   push:
-    branches-ignore:
-      - c-main
-      - c-3.2
+    branches:
+      - main
+      - v*.*.x
   pull_request:
+    branches:
+      - main
+      - v*.*.x
 
 permissions:
   contents: read
diff --git a/.github/workflows/linux_tests.yaml b/.github/workflows/linux_tests.yaml
index adf0625c9..07bdc43b7 100644
--- a/.github/workflows/linux_tests.yaml
+++ b/.github/workflows/linux_tests.yaml
@@ -2,13 +2,13 @@ name: linux-tests
 
 on:
   push:
-    branches-ignore:
-      - c-main
-      - c-3.2
+    branches:
+      - main
+      - v*.*.x
   pull_request:
-
-permissions:
-  contents: read
+    branches:
+      - main
+      - v*.*.x
 
 jobs:
   tcl86-nolibtclenvmodules:
@@ -67,10 +67,10 @@ jobs:
       - name: Uninstall Modules
         run: |
           make uninstall
-      # no token needed: public repo uses Codecov's tokenless upload via
-      # GitHub OIDC, which also works for pull requests coming from forks
-      # (base repo secrets are never exposed to fork-triggered PR runs)
       - uses: codecov/codecov-action@v7
+        with:
+          verbose: true
+          token: ${{ secrets.CODECOV_TOKEN }}
       - uses: actions/upload-artifact@v7
         if: failure()
         with:
@@ -155,10 +155,10 @@ jobs:
       - name: Uninstall Modules
         run: |
           make uninstall
-      # no token needed: public repo uses Codecov's tokenless upload via
-      # GitHub OIDC, which also works for pull requests coming from forks
-      # (base repo secrets are never exposed to fork-triggered PR runs)
       - uses: codecov/codecov-action@v7
+        with:
+          verbose: true
+          token: ${{ secrets.CODECOV_TOKEN }}
       - uses: actions/upload-artifact@v7
         if: failure()
         with:
@@ -239,10 +239,10 @@ jobs:
       - name: Uninstall Modules
         run: |
           make uninstall
-      # no token needed: public repo uses Codecov's tokenless upload via
-      # GitHub OIDC, which also works for pull requests coming from forks
-      # (base repo secrets are never exposed to fork-triggered PR runs)
       - uses: codecov/codecov-action@v7
+        with:
+          verbose: true
+          token: ${{ secrets.CODECOV_TOKEN }}
       - uses: actions/upload-artifact@v7
         if: failure()
         with:
@@ -308,10 +308,10 @@ jobs:
       - name: Uninstall Modules
         run: |
           make uninstall
-      # no token needed: public repo uses Codecov's tokenless upload via
-      # GitHub OIDC, which also works for pull requests coming from forks
-      # (base repo secrets are never exposed to fork-triggered PR runs)
       - uses: codecov/codecov-action@v7
+        with:
+          verbose: true
+          token: ${{ secrets.CODECOV_TOKEN }}
       - uses: actions/upload-artifact@v7
         if: failure()
         with:
@@ -379,10 +379,10 @@ jobs:
       - name: Uninstall Modules
         run: |
           make uninstall
-      # no token needed: public repo uses Codecov's tokenless upload via
-      # GitHub OIDC, which also works for pull requests coming from forks
-      # (base repo secrets are never exposed to fork-triggered PR runs)
       - uses: codecov/codecov-action@v7
+        with:
+          verbose: true
+          token: ${{ secrets.CODECOV_TOKEN }}
       - uses: actions/upload-artifact@v7
         if: failure()
         with:
@@ -525,10 +525,10 @@ jobs:
       - name: Uninstall Modules
         run: |
           make uninstall
-      # no token needed: public repo uses Codecov's tokenless upload via
-      # GitHub OIDC, which also works for pull requests coming from forks
-      # (base repo secrets are never exposed to fork-triggered PR runs)
       - uses: codecov/codecov-action@v7
+        with:
+          verbose: true
+          token: ${{ secrets.CODECOV_TOKEN }}
       - uses: actions/upload-artifact@v7
         if: failure()
         with:
diff --git a/.github/workflows/macos_tests.yaml b/.github/workflows/macos_tests.yaml
index 02660c30c..01c31575c 100644
--- a/.github/workflows/macos_tests.yaml
+++ b/.github/workflows/macos_tests.yaml
@@ -2,13 +2,13 @@ name: macos-tests
 
 on:
   push:
-    branches-ignore:
-      - c-main
-      - c-3.2
+    branches:
+      - main
+      - v*.*.x
   pull_request:
-
-permissions:
-  contents: read
+    branches:
+      - main
+      - v*.*.x
 
 jobs:
   macos:
@@ -46,26 +46,18 @@ jobs:
           done
           eval $EXTRA_SCRIPT_PRETEST
           make test-deps
-          script/mt
+          script/mt quick
           eval $EXTRA_SCRIPT_POSTTEST
       - name: Install Modules
         run: |
           make install
-      - name: Test Modules installation
-        run: |
-          script/mt install
-          for f in tcl/*.tcl; do
-            script/nglfar2ccov $f
-          done
-          cd lib
-          gcov envmodules
       - name: Uninstall Modules
         run: |
           make uninstall
-      # no token needed: public repo uses Codecov's tokenless upload via
-      # GitHub OIDC, which also works for pull requests coming from forks
-      # (base repo secrets are never exposed to fork-triggered PR runs)
       - uses: codecov/codecov-action@v7
+        with:
+          verbose: true
+          token: ${{ secrets.CODECOV_TOKEN }}
       - uses: actions/upload-artifact@v7
         if: failure()
         with:
diff --git a/.github/workflows/windows_tests.yaml b/.github/workflows/windows_tests.yaml
index c26f15db7..7f281e2fc 100644
--- a/.github/workflows/windows_tests.yaml
+++ b/.github/workflows/windows_tests.yaml
@@ -2,10 +2,13 @@ name: windows-tests
 
 on:
   push:
-    branches-ignore:
-      - c-main
-      - c-3.2
+    branches:
+      - main
+      - v*.*.x
   pull_request:
+    branches:
+      - main
+      - v*.*.x
 
 permissions:
   contents: read