diff --git a/CHANGES b/CHANGES
index 10138363ba..57701eb337 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,14 @@
+7.0.0-dev.407 | 2024-06-26 13:16:10 +0200
+
+  * coverage/lcov_html: Allow missing coveralls token (Arne Welzel, Corelight)
+
+    This is a fixup for 0cd023b83919fca7bfac55e75a41f724e820fd26 which
+    currently causes ASAN coverage builds to fail for non-master branches
+    when due to a missing COVERALLS_REPO_TOKEN.
+
+    Instead of bailing out for non-master branches, pass `--dry-run` to the
+    coveralls-lcov invocation to test more of the script.
+
 7.0.0-dev.405 | 2024-06-25 13:35:41 +0200
 
   * Bump auxil/spicy to latest development snapshot (Benjamin Bannier, Corelight)
diff --git a/VERSION b/VERSION
index bfb56ee720..afb0ffe7c4 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-7.0.0-dev.405
+7.0.0-dev.407
diff --git a/testing/coverage/lcov_html.sh b/testing/coverage/lcov_html.sh
index 18898048b4..ba8c8a37df 100755
--- a/testing/coverage/lcov_html.sh
+++ b/testing/coverage/lcov_html.sh
@@ -36,14 +36,14 @@ Usage: $0 <options>
   repo.
 
   Options:
-    --help             Display this output.
-    --html DIR         This is the default mode, but this argument can be passed
-                       to make it explicit. It also can be used to pass an optional
-                       destination directory for the HTML output.
-    --coveralls TOKEN  Report coverage data to Coveralls.io using the specified
-                       repo token. Enabling this option disables the HTML report.
-                       This option requires the coveralls-lcov Ruby gem to be
-                       installed.
+    --help              Display this output.
+    --html DIR          This is the default mode, but this argument can be passed
+                        to make it explicit. It also can be used to pass an optional
+                         destination directory for the HTML output.
+    --coveralls [TOKEN] Report coverage data to Coveralls.io using the specified
+                        repo token. Enabling this option disables the HTML report.
+                        This option requires the coveralls-lcov Ruby gem to be
+                        installed. If TOKEN is empty, uses --dry-run mode.
 "
 
     echo "${usage}"
@@ -63,15 +63,14 @@ while (("$#")); do
             fi
             ;;
         --coveralls)
-            if [ ${#2} -eq 0 ]; then
-                echo "ERROR: Coveralls repo token must be passed with --coveralls argument."
-                echo
-                usage
-            fi
-
             HTML_REPORT=0
-            COVERALLS_REPO_TOKEN=$2
-            shift 2
+            if [ ${#2} -eq 0 ]; then
+                echo "WARN: No coveralls token, running coveralls-lcov --dry-run."
+                shift 1
+            else
+                COVERALLS_REPO_TOKEN=$2
+                shift 2
+            fi
             ;;
         --help)
             usage
@@ -131,19 +130,19 @@ if [ $HTML_REPORT -eq 1 ]; then
     echo -n "Creating HTML files... "
     verify_run "genhtml --ignore-errors empty -o $COVERAGE_HTML_DIR $COVERAGE_FILE"
 else
-    if [ "${CIRRUS_BRANCH}" != "master" ]; then
-        echo "Coverage upload skipped for non-master branches"
-        exit 0
-    fi
-
     # The data we send to coveralls has a lot of duplicate files in it because of the
     # zeek symlink in the src directory. Run a script that cleans that up.
     echo -n "Cleaning coverage data for Coveralls..."
     COVERAGE_FILE_CLEAN="${COVERAGE_FILE}.clean"
     verify_run "testing/coverage/coverage_cleanup.py ${COVERAGE_FILE} > ${COVERAGE_FILE_CLEAN} 2>&1"
 
-    echo -n "Reporting to Coveralls..."
-    coveralls_cmd="coveralls-lcov -t ${COVERALLS_REPO_TOKEN}"
+    if [ "${CIRRUS_BRANCH}" == "master" ] && [ -n "${COVERALLS_REPO_TOKEN}" ]; then
+        echo -n "Reporting to Coveralls..."
+        coveralls_cmd="coveralls-lcov -t ${COVERALLS_REPO_TOKEN}"
+    else
+        echo "Reporting to Coveralls in --dry-run mode"
+        coveralls_cmd="coveralls-lcov --dry-run"
+    fi
 
     # If we're being called by Cirrus, add some additional information to the output.
     if [ -n "${CIRRUS_BUILD_ID}" ]; then