diff --git a/.github/workflows/coverage.yaml b/.github/workflows/coverage.yaml
index cef90c2..22b7822 100644
--- a/.github/workflows/coverage.yaml
+++ b/.github/workflows/coverage.yaml
@@ -11,7 +11,7 @@ on:
       - 'go.sum'
       - 'vendor/**'
       - 'makefile'
-      - 'scripts/publish-coverage-badge.sh'
+      - '.scripts/publish-coverage-badge.sh'
       - '.github/workflows/coverage.yaml'
   workflow_dispatch:
 
@@ -59,4 +59,4 @@ jobs:
           PCT: ${{ steps.cov.outputs.pct }}
           # checkout keeps no credentials, so the push is given the token here
           GH_TOKEN: ${{ github.token }}
-        run: bash ./scripts/publish-coverage-badge.sh
+        run: bash ./.scripts/publish-coverage-badge.sh
diff --git a/scripts/publish-coverage-badge.sh b/.scripts/publish-coverage-badge.sh
similarity index 96%
rename from scripts/publish-coverage-badge.sh
rename to .scripts/publish-coverage-badge.sh
index 7fd59a8..763724f 100755
--- a/scripts/publish-coverage-badge.sh
+++ b/.scripts/publish-coverage-badge.sh
@@ -4,7 +4,7 @@
 # README badge needs no third-party coverage service and no token beyond the
 # workflow's own GITHUB_TOKEN, which the workflow passes in as GH_TOKEN.
 #
-# Usage: PCT=81.0 GH_TOKEN=... ./scripts/publish-coverage-badge.sh
+# Usage: PCT=81.0 GH_TOKEN=... ./.scripts/publish-coverage-badge.sh
 set -euo pipefail
 
 PCT="${PCT:?set PCT to the coverage percentage, e.g. 81.0}"