diff --git a/.github/codecov.yml b/.github/codecov.yml
new file mode 100644
index 0000000..3a0035f
--- /dev/null
+++ b/.github/codecov.yml
@@ -0,0 +1,15 @@
+comment: false
+
+github_checks:
+  annotations: false
+
+coverage:
+  status:
+    patch: false
+    # project will give us the diff in the total code coverage between a commit
+    # and its parent
+    project:
+      default:
+        target: auto
+        threshold: "15%"
+    changes: false
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 50e4ae7..0e12eaa 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -44,6 +44,11 @@ jobs:
       run: |
         uname -a
         make test
+    - name: Send to Codecov
+      uses: codecov/codecov-action@v5
+      with:
+        token: ${{ secrets.CODECOV_TOKEN }}  # used to upload coverage reports: https://github.com/moby/buildkit/pull/4660#issue-2142122533
+        files: capability/coverage.txt,mount/coverage.txt,mountinfo/coverage.txt,reexec/coverage.txt,sequential/coverage.txt,signal/coverage.txt,symlink/coverage.txt,user/coverage.txt,userns/coverage.txt
 
   codespell:
     runs-on: ubuntu-24.04
diff --git a/.gitignore b/.gitignore
index 58ef1e4..573b0a9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,3 @@
 /_build/
 /mount/go-local.*
+coverage.txt
diff --git a/Makefile b/Makefile
index 22ad5d9..bc0c124 100644
--- a/Makefile
+++ b/Makefile
@@ -11,6 +11,7 @@ all: clean lint test cross
 .PHONY: clean
 clean:
 	$(RM) mount/go-local.*
+	$(RM) */coverage.txt
 
 .PHONY: foreach
 foreach: ## Run $(CMD) for every package.
@@ -25,7 +26,7 @@ foreach: ## Run $(CMD) for every package.
 
 .PHONY: test
 test: test-local
-test: CMD=go test $(RUN_VIA_SUDO) -v .
+test: CMD=go test $(RUN_VIA_SUDO) -v -coverprofile=coverage.txt -covermode=atomic .
 test: foreach
 
 # Test the mount module against the local mountinfo source code instead of the