diff --git a/.github/workflows/backend.yml b/.github/workflows/backend.yml
index 3b91c38672..566dbc4f2a 100644
--- a/.github/workflows/backend.yml
+++ b/.github/workflows/backend.yml
@@ -73,12 +73,10 @@ jobs:
           egress-policy: block
           allowed-endpoints: >
             api.github.com:443
-            api.codecov.io:443
             cli.codecov.io:443
-            codecov.io:443
             github.com:443
+            ingest.codecov.io:443
             storage.googleapis.com:443
-            uploader.codecov.io:443
       - name: Checkout repository
         uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
       - name: Download coverage artifact
diff --git a/.github/workflows/frontend.yml b/.github/workflows/frontend.yml
index edc2ad94fc..fbadef978a 100644
--- a/.github/workflows/frontend.yml
+++ b/.github/workflows/frontend.yml
@@ -89,12 +89,10 @@ jobs:
           egress-policy: block
           allowed-endpoints: >
             api.github.com:443
-            api.codecov.io:443
             cli.codecov.io:443
-            codecov.io:443
             github.com:443
+            ingest.codecov.io:443
             storage.googleapis.com:443
-            uploader.codecov.io:443
       - name: Checkout repository
         uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
       - name: Download coverage artifact
diff --git a/deploy/scripts/app_release.py b/deploy/scripts/app_release.py
index d2b34a9d05..8851cf48ad 100755
--- a/deploy/scripts/app_release.py
+++ b/deploy/scripts/app_release.py
@@ -31,7 +31,7 @@ def get_release() -> str:
                 num_commits = match[2]
             # Get the branch name
             result = run_cmd(["git", "branch", "--show-current"], chomp=True)
-            branch_name = re.sub("[/_]+", "-", result.stdout)
+            branch_name = re.sub("[/_]+", "-", result.stdout) or "HEADLESS"
             return f"{release_string}-{branch_name}.{num_commits}"
     message = f"Unrecognized release value in tag: {result.stdout}"
     raise ValueError(message)