diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
new file mode 100644
index 0000000..72478fe
--- /dev/null
+++ b/.github/workflows/coverage.yml
@@ -0,0 +1,72 @@
+name: Code Coverage
+
+on:
+  push:
+    branches: [ main, develop ]
+    paths:
+      - 'release-manager/**'
+      - 'mina-bench-upload/**'
+      - 'buildkite-cache-manager/**'
+      - '.github/workflows/coverage.yml'
+  pull_request:
+    branches: [ main ]
+    paths:
+      - 'release-manager/**'
+      - 'mina-bench-upload/**'
+      - 'buildkite-cache-manager/**'
+      - '.github/workflows/coverage.yml'
+
+env:
+  CARGO_TERM_COLOR: always
+  RUST_BACKTRACE: 1
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  coverage:
+    name: ${{ matrix.crate }} coverage
+    runs-on: ubuntu-latest
+    strategy:
+      # Run each crate as its own job so a single crate's failure
+      # doesn't poison the others, and so Codecov gets per-flag reports.
+      fail-fast: false
+      matrix:
+        crate: [release-manager, mina-bench-upload, buildkite-cache-manager]
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install Rust + llvm-tools-preview
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          components: llvm-tools-preview
+
+      - name: Cache cargo
+        uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: ${{ matrix.crate }}
+          key: coverage-${{ matrix.crate }}
+
+      - name: Install cargo-llvm-cov
+        uses: taiki-e/install-action@cargo-llvm-cov
+
+      - name: Run coverage
+        working-directory: ${{ matrix.crate }}
+        run: |
+          cargo llvm-cov --all-features --workspace --lcov \
+            --output-path lcov.info
+
+      - name: Upload to Codecov
+        uses: codecov/codecov-action@v4
+        with:
+          files: ${{ matrix.crate }}/lcov.info
+          flags: ${{ matrix.crate }}
+          name: ${{ matrix.crate }}
+          # Codecov accepts uploads from public-repo PRs without a token
+          # but a token avoids rate limits. Set CODECOV_TOKEN in repo
+          # secrets if uploads start being throttled.
+          token: ${{ secrets.CODECOV_TOKEN }}
+          fail_ci_if_error: false
diff --git a/codecov.yml b/codecov.yml
new file mode 100644
index 0000000..b2f4e3a
--- /dev/null
+++ b/codecov.yml
@@ -0,0 +1,67 @@
+# Codecov configuration for mina-release-toolkit.
+#
+# Coverage is gathered per in-tree Rust crate (release-manager,
+# mina-bench-upload, buildkite-cache-manager) by `.github/workflows/coverage.yml`
+# and uploaded under matching Codecov flags. The submodules
+# (deb-toolkit, deb-s3, dhall-buildkite) report coverage from their
+# own repos.
+
+coverage:
+  # Reasonable defaults — informational only at first.  Tighten the
+  # thresholds once we have a few weeks of trend data and know what
+  # baseline each crate naturally sits at.
+  status:
+    project:
+      default:
+        target: auto
+        # Allow PRs to drop project-wide coverage by up to 1% without
+        # failing — covers the noise floor of small refactors.
+        threshold: 1%
+        if_ci_failed: ignore
+    patch:
+      default:
+        # New code in a PR should be at least 70% covered.  Soft target;
+        # `if_ci_failed: ignore` keeps the build green even if the patch
+        # check is red, while still surfacing the warning on the PR.
+        target: 70%
+        if_ci_failed: ignore
+
+  # Flag definitions — one per in-tree crate.  Codecov uses these to
+  # produce separate coverage reports per crate even though they live
+  # in the same repo.
+  flags:
+    release-manager:
+      paths:
+        - release-manager/
+      carryforward: true
+    mina-bench-upload:
+      paths:
+        - mina-bench-upload/
+      carryforward: true
+    buildkite-cache-manager:
+      paths:
+        - buildkite-cache-manager/
+      carryforward: true
+
+# Don't fail uploads when CI is yellow — coverage is observation, not a
+# gate, until we set explicit thresholds above.
+codecov:
+  require_ci_to_pass: false
+  notify:
+    wait_for_ci: true
+
+# Ignore submodules (their coverage lives in their own repos) and
+# generated / boilerplate files.
+ignore:
+  - "deb-toolkit/"
+  - "deb-s3/"
+  - "dhall-buildkite/"
+  - "rust-buildkite/"
+  - "debian/"
+  - "**/tests/fixtures/**"
+  - "**/target/**"
+
+comment:
+  layout: "reach, diff, flags, files"
+  behavior: default
+  require_changes: false