diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e9d8892..a12d941 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -5,8 +5,11 @@ on:
     branches: [main]
   pull_request:
 
+# id-token lets the Codecov upload authenticate over GitHub OIDC, so a
+# public-repo upload needs no CODECOV_TOKEN secret.
 permissions:
   contents: read
+  id-token: write
 
 jobs:
   checks:
@@ -35,7 +38,15 @@ jobs:
       # of both `lint` and `test`, and a single invocation runs it once where
       # two separate steps built the frontend twice.
       - name: Lint and test
-        run: make lint test
+        run: make lint test GOTESTFLAGS="-coverprofile=coverage.out -covermode=atomic"
+
+      # fail_ci_if_error stays at its default (false): a Codecov outage must
+      # not fail the build, the same bar the shellcheck guard below holds.
+      - name: Upload coverage to Codecov
+        uses: codecov/codecov-action@v5
+        with:
+          files: coverage.out
+          use_oidc: true
 
       # ubuntu-latest images ship shellcheck, so this step normally does
       # nothing. The guard is what keeps it honest: the unconditional
diff --git a/.gitignore b/.gitignore
index 28d187c..5ec8bd2 100644
--- a/.gitignore
+++ b/.gitignore
@@ -24,3 +24,6 @@ flued
 /site/.wrangler/
 # tsc --noEmit with incremental drops this beside web/tsconfig.json.
 web/tsconfig.tsbuildinfo
+# `make test-go GOTESTFLAGS=-coverprofile=coverage.out` drops this at the
+# root; CI uploads it to Codecov.
+coverage.out
diff --git a/Makefile b/Makefile
index d1e08fa..f15290a 100644
--- a/Makefile
+++ b/Makefile
@@ -57,7 +57,7 @@ web-dev:
 test: test-go test-web test-relay
 
 test-go: web relay
-	go test ./...
+	go test $(GOTESTFLAGS) ./...
 
 test-web:
 	cd web && pnpm test
diff --git a/README.md b/README.md
index f5ad50c..0f8556c 100644
--- a/README.md
+++ b/README.md
@@ -4,6 +4,7 @@
 
 <p align="center">
   <a href="https://github.com/karnstack/flue/actions/workflows/ci.yml"><img src="https://img.shields.io/github/actions/workflow/status/karnstack/flue/ci.yml?branch=main&label=ci" alt="CI status"></a>
+  <a href="https://codecov.io/gh/karnstack/flue"><img src="https://codecov.io/gh/karnstack/flue/graph/badge.svg" alt="Coverage"></a>
   <a href="https://github.com/karnstack/flue/releases/latest"><img src="https://img.shields.io/github/v/release/karnstack/flue?label=release" alt="Latest release"></a>
   <a href="LICENSE"><img src="https://img.shields.io/badge/license-MIT-blue" alt="MIT license"></a>
 </p>