diff --git a/.github/workflows/completion_tests.yaml b/.github/workflows/completion_tests.yaml
index cbccf5a76..3a6fd0818 100644
--- a/.github/workflows/completion_tests.yaml
+++ b/.github/workflows/completion_tests.yaml
@@ -2,10 +2,13 @@ name: completion-tests
 
 on:
   push:
-    branches-ignore:
-      - c-main
-      - c-3.2
+    branches:
+      - main
+      - v*.*.x
   pull_request:
+    branches:
+      - main
+      - v*.*.x
 
 permissions:
   contents: read
diff --git a/.github/workflows/easybuild_tests.yaml b/.github/workflows/easybuild_tests.yaml
index 45f620f03..382560a40 100644
--- a/.github/workflows/easybuild_tests.yaml
+++ b/.github/workflows/easybuild_tests.yaml
@@ -2,10 +2,13 @@ name: easybuild-tests
 
 on:
   push:
-    branches-ignore:
-      - c-main
-      - c-3.2
+    branches:
+      - main
+      - v*.*.x
   pull_request:
+    branches:
+      - main
+      - v*.*.x
 
 permissions:
   contents: read
diff --git a/.github/workflows/lint_tests.yaml b/.github/workflows/lint_tests.yaml
index ee3a63696..7748be70f 100644
--- a/.github/workflows/lint_tests.yaml
+++ b/.github/workflows/lint_tests.yaml
@@ -2,10 +2,13 @@ name: lint-tests
 
 on:
   push:
-    branches-ignore:
-      - c-main
-      - c-3.2
+    branches:
+      - main
+      - v*.*.x
   pull_request:
+    branches:
+      - main
+      - v*.*.x
 
 permissions:
   contents: read
diff --git a/.github/workflows/linux_tests.yaml b/.github/workflows/linux_tests.yaml
index adf0625c9..ba4c0c859 100644
--- a/.github/workflows/linux_tests.yaml
+++ b/.github/workflows/linux_tests.yaml
@@ -2,10 +2,13 @@ name: linux-tests
 
 on:
   push:
-    branches-ignore:
-      - c-main
-      - c-3.2
+    branches:
+      - main
+      - v*.*.x
   pull_request:
+    branches:
+      - main
+      - v*.*.x
 
 permissions:
   contents: read
@@ -67,10 +70,10 @@ jobs:
       - name: Uninstall Modules
         run: |
           make uninstall
-      # no token needed: public repo uses Codecov's tokenless upload via
-      # GitHub OIDC, which also works for pull requests coming from forks
-      # (base repo secrets are never exposed to fork-triggered PR runs)
       - uses: codecov/codecov-action@v7
+        with:
+          verbose: true
+          token: ${{ secrets.CODECOV_TOKEN }}
       - uses: actions/upload-artifact@v7
         if: failure()
         with:
@@ -155,10 +158,10 @@ jobs:
       - name: Uninstall Modules
         run: |
           make uninstall
-      # no token needed: public repo uses Codecov's tokenless upload via
-      # GitHub OIDC, which also works for pull requests coming from forks
-      # (base repo secrets are never exposed to fork-triggered PR runs)
       - uses: codecov/codecov-action@v7
+        with:
+          verbose: true
+          token: ${{ secrets.CODECOV_TOKEN }}
       - uses: actions/upload-artifact@v7
         if: failure()
         with:
@@ -239,10 +242,10 @@ jobs:
       - name: Uninstall Modules
         run: |
           make uninstall
-      # no token needed: public repo uses Codecov's tokenless upload via
-      # GitHub OIDC, which also works for pull requests coming from forks
-      # (base repo secrets are never exposed to fork-triggered PR runs)
       - uses: codecov/codecov-action@v7
+        with:
+          verbose: true
+          token: ${{ secrets.CODECOV_TOKEN }}
       - uses: actions/upload-artifact@v7
         if: failure()
         with:
@@ -308,10 +311,10 @@ jobs:
       - name: Uninstall Modules
         run: |
           make uninstall
-      # no token needed: public repo uses Codecov's tokenless upload via
-      # GitHub OIDC, which also works for pull requests coming from forks
-      # (base repo secrets are never exposed to fork-triggered PR runs)
       - uses: codecov/codecov-action@v7
+        with:
+          verbose: true
+          token: ${{ secrets.CODECOV_TOKEN }}
       - uses: actions/upload-artifact@v7
         if: failure()
         with:
@@ -379,10 +382,10 @@ jobs:
       - name: Uninstall Modules
         run: |
           make uninstall
-      # no token needed: public repo uses Codecov's tokenless upload via
-      # GitHub OIDC, which also works for pull requests coming from forks
-      # (base repo secrets are never exposed to fork-triggered PR runs)
       - uses: codecov/codecov-action@v7
+        with:
+          verbose: true
+          token: ${{ secrets.CODECOV_TOKEN }}
       - uses: actions/upload-artifact@v7
         if: failure()
         with:
@@ -525,10 +528,10 @@ jobs:
       - name: Uninstall Modules
         run: |
           make uninstall
-      # no token needed: public repo uses Codecov's tokenless upload via
-      # GitHub OIDC, which also works for pull requests coming from forks
-      # (base repo secrets are never exposed to fork-triggered PR runs)
       - uses: codecov/codecov-action@v7
+        with:
+          verbose: true
+          token: ${{ secrets.CODECOV_TOKEN }}
       - uses: actions/upload-artifact@v7
         if: failure()
         with:
diff --git a/.github/workflows/macos_tests.yaml b/.github/workflows/macos_tests.yaml
index 02660c30c..0f99370b1 100644
--- a/.github/workflows/macos_tests.yaml
+++ b/.github/workflows/macos_tests.yaml
@@ -2,10 +2,13 @@ name: macos-tests
 
 on:
   push:
-    branches-ignore:
-      - c-main
-      - c-3.2
+    branches:
+      - main
+      - v*.*.x
   pull_request:
+    branches:
+      - main
+      - v*.*.x
 
 permissions:
   contents: read
@@ -62,10 +65,10 @@ jobs:
       - name: Uninstall Modules
         run: |
           make uninstall
-      # no token needed: public repo uses Codecov's tokenless upload via
-      # GitHub OIDC, which also works for pull requests coming from forks
-      # (base repo secrets are never exposed to fork-triggered PR runs)
       - uses: codecov/codecov-action@v7
+        with:
+          verbose: true
+          token: ${{ secrets.CODECOV_TOKEN }}
       - uses: actions/upload-artifact@v7
         if: failure()
         with:
diff --git a/.github/workflows/windows_tests.yaml b/.github/workflows/windows_tests.yaml
index c26f15db7..7f281e2fc 100644
--- a/.github/workflows/windows_tests.yaml
+++ b/.github/workflows/windows_tests.yaml
@@ -2,10 +2,13 @@ name: windows-tests
 
 on:
   push:
-    branches-ignore:
-      - c-main
-      - c-3.2
+    branches:
+      - main
+      - v*.*.x
   pull_request:
+    branches:
+      - main
+      - v*.*.x
 
 permissions:
   contents: read
diff --git a/doc/source/devel/ci.rst b/doc/source/devel/ci.rst
index cc4dcf3c8..de0feca02 100644
--- a/doc/source/devel/ci.rst
+++ b/doc/source/devel/ci.rst
@@ -50,9 +50,8 @@ All of the above live under :file:`.github/workflows/`.
 .. _ClusterFuzzLite: https://google.github.io/clusterfuzzlite/
 
 Every build/test workflow (all except :file:`differential_shellcheck.yml`,
-:file:`scorecard.yml` and :file:`cflite.yml`) triggers on ``push`` to any
-branch except ``c-main`` and ``c-3.2`` (legacy imported-history branches
-that are not active development targets) and on every ``pull_request``.
+:file:`scorecard.yml` and :file:`cflite.yml`) triggers on ``push`` and
+``pull_request``, both restricted to ``main`` and ``v*.*.x`` branches.
 
 Build/test workflows
 ---------------------