diff --git a/.circleci/config.yml b/.circleci/config.yml
index 3f138798..cda9b07b 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -101,7 +101,15 @@ jobs:
     - &report_code_coverage
       run:
         name: Report code coverage
-        command: bash <(curl -s https://codecov.io/bash) -F "$(basename $PWD | sed s/[^a-z]/_/g)"
+        command: |
+          curl https://keybase.io/codecovsecurity/pgp_keys.asc | gpg --no-default-keyring --keyring trustedkeys.gpg --import
+          curl -Os https://uploader.codecov.io/latest/linux/codecov
+          curl -Os https://uploader.codecov.io/latest/linux/codecov.SHA256SUM
+          curl -Os https://uploader.codecov.io/latest/linux/codecov.SHA256SUM.sig
+          gpgv codecov.SHA256SUM.sig codecov.SHA256SUM
+          shasum -a 256 -c codecov.SHA256SUM
+          chmod +x codecov
+          ./codecov -F "$(basename $PWD | sed s/[^a-z]/_/g)"
     - save_cache:
         paths:
         - ingestion-edge/venv/
diff --git a/codecov.yml b/codecov.yml
new file mode 100644
index 00000000..a11a7f6e
--- /dev/null
+++ b/codecov.yml
@@ -0,0 +1,19 @@
+flags:
+  ingestion_beam:
+    paths:
+    - ingestion-beam/.*
+    - ingestion-core/.*
+    carryforward: true
+  ingestion_core:
+    paths:
+    - ingestion-core/.*
+    carryforward: true
+  ingestion_edge:
+    paths:
+    - ingestion-edge/.*
+    carryforward: true
+  ingestion_sink:
+    paths:
+    - ingestion-core/.*
+    - ingestion-sink/.*
+    carryforward: true