diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index a8df55a86..e92f00171 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -99,6 +99,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4.2.2
+        with:
+          submodules: 'true'
       - name: Install deps
         run: |
           apt-get install git
diff --git a/dist/codecov.sh b/dist/codecov.sh
index 5aa8c6b16..82264727f 100755
--- a/dist/codecov.sh
+++ b/dist/codecov.sh
@@ -102,6 +102,11 @@ CC_PUBLIC_PGP_KEY=$(curl https://keybase.io/codecovsecurity/pgp_keys.asc)
   then
     exit_if_error "Could not verify SHASUM. Please contact security@codecov.io if problem continues"
   fi
+  if ! (shasum -a 256 -c "${cc_filename}.SHA256SUM" || \
+    sha256sum -c "${cc_filename}.SHA256SUM");
+  then
+    exit_if_error "Could not verify SHASUM. Please contact Codecov if problem continues"
+  fi
   say "$g==>$x CLI integrity verified"
   say
 fi