diff --git a/scripts/install.sh b/scripts/install.sh
index e37fd33a9..c142370de 100755
--- a/scripts/install.sh
+++ b/scripts/install.sh
@@ -78,7 +78,24 @@ retry sudo "${TIMEOUT[@]}" apt-get "${APT_OPTIONS[@]}" install -y \
     software-properties-common || exit 1
 
 retry "${TIMEOUT[@]}" python3 -m pip install --retries 3 --timeout 30 --upgrade pip || exit 1
-retry "${TIMEOUT[@]}" pip3 install --retries 3 --timeout 30 gcovr==4.1 || exit 1
+# gcovr was pinned to 4.1, released in 2018. That version cannot do what merging
+# the coverage of several build configurations needs: it has no --json and no
+# --add-tracefile, both of which arrived later. The pin is exact rather than
+# floating so the coverage percentage stays comparable between runs -- the
+# denominator is a property of the tool as much as of the tree -- and it is moved
+# by hand, because it lives in a shell script that Dependabot cannot parse.
+#
+# Measured before bumping, on the default_build_coverage tree of test/tx, over
+# the same gcda with the same gcov, varying only the gcovr version: 4.1, 7.0,
+# 8.3 and 8.6 all report lines-valid 3827 across 177 files and branches-valid
+# 1994. The denominator does not move with the tool, so this bump moves no
+# number and any movement in a later run belongs to a later change.
+#
+# The numerator does move, but not because of gcovr: tx_thread_system_resume.c
+# line 529 is executed on some runs of the suite and not others, so the same
+# tree reports 3826 or 3827 covered lines with every test passing either way.
+# That is a property of the suite, not of this pin.
+retry "${TIMEOUT[@]}" pip3 install --retries 3 --timeout 30 gcovr==8.6 || exit 1
 
 # Upgrade cmake to the latest version.
 retry "${TIMEOUT[@]}" pip install --retries 3 --timeout 30 --upgrade cmake || exit 1