diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index 3cda251e..0296238f 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -1,15 +1,26 @@
-# internal coverage PR comment and badge v0.0.2
+# internal coverage PR comment and badge v0.0.3
+# needs separate jobs for coverage checkout/run and PR coverage report comment
 # badge and comment job logic should be tuned for personal vs org use
 # (see badge job comments below)
 name: Coverage
 
 on:
   workflow_dispatch:
-  pull_request:
+  pull_request_target:
+    types:
+      - opened
+      - synchronize
+      - reopened
   push:
     branches:
       - master
 
+## This workflow needs the `pull-request` permissions to work
+## Refs: https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#permissions
+permissions:
+  pull-requests: write
+  contents: read
+
 jobs:
   pre_ci:
     name: Prepare CI environment
@@ -22,8 +33,8 @@ jobs:
     - name: Checkout Project
       uses: actions/checkout@v2
       with:
-        # We need to fetch with a depth of 2 for pull_request so we can do HEAD^2
-        fetch-depth: 2
+        ref: ${{ github.event.pull_request.head.ref }}
+        repository: ${{ github.event.pull_request.head.repo.full_name }}
 
     - name: Environment
       run: |
@@ -34,7 +45,7 @@ jobs:
       env:
         COMMIT_PUSH: ${{ github.event.head_commit.message }}
       run: |
-        COMMIT_MESSAGE="${COMMIT_PUSH:-$(git log --format=%B -n 1 HEAD^2)}"
+        COMMIT_MESSAGE="${COMMIT_PUSH:-$(git log --format=%B -n 1 HEAD)}"
         echo "::set-output name=commit_message::${COMMIT_MESSAGE}"
 
     - name: Extract branch name
@@ -130,7 +141,9 @@ jobs:
     steps:
     - uses: actions/checkout@v2
       with:
-        fetch-depth: 0
+        ref: ${{ github.event.pull_request.head.ref }}
+        repository: ${{ github.event.pull_request.head.repo.full_name }}
+
 
     - uses: actions/setup-python@v2
       with:
@@ -143,7 +156,7 @@ jobs:
 
     - name: Generate coverage and fix pkg name
       run: |
-        tox
+        tox -e py39-linux
 
     - name: Code Coverage Summary Report (Text & Value)
       uses: irongut/CodeCoverageSummary@v1.0.5
@@ -168,13 +181,30 @@ jobs:
         format: 'markdown'
         output: 'both'
 
+    - name: Upload coverage results for comment
+      uses: actions/upload-artifact@v2
+      with:
+        name: pr-coverage
+        path: code-coverage-results.md
+        retention-days: 1
+
+  comment_cov_report:
+    name: Comment on PR with coverage summary report
+    runs-on: ubuntu-20.04
+    needs: [cov_data, base]
+
+    steps:
+    # artifact downloaded to directory: (upload)name/file
+    - uses: actions/download-artifact@v2
+
     - name: Add Coverage PR Comment
-      uses: marocchino/sticky-pull-request-comment@v2.1.1
+      uses: marocchino/sticky-pull-request-comment@v2.2.0
       if: ${{ github.event_name == 'pull_request' }}
       with:
         header: coverage
-        recreate: true
-        path: code-coverage-results.md
+        path: pr-coverage/code-coverage-results.md
+        hide_and_recreate: true
+        hide_classify: "OUTDATED"
 
   test:
     name: Coverage check
@@ -258,12 +288,13 @@ jobs:
         fi
 
     - name: Comment PR with test coverage delta
-      uses: marocchino/sticky-pull-request-comment@v2.1.1
+      uses: marocchino/sticky-pull-request-comment@v2.2.0
       if: env.HAVE_BASE_COVERAGE == 'true'
       with:
         header: delta
-        recreate: true
         path: coverage-delta.md
+        hide_and_recreate: true
+        hide_classify: "OUTDATED"
 
   badge:
     # Only generate and publish if these conditions are met: