diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 1602a890..4dd291ba 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -115,7 +115,7 @@ jobs:
               with:
                 timeout_minutes: 10
                 max_attempts: 3
-                command: npm run env start
+                command: npm run env start -- --xdebug=coverage
 
             - name: Composer install
               run: |
@@ -130,6 +130,14 @@ jobs:
             - name: Test
               run: npm run test
 
+            - name: Upload code coverage report
+              if: ${{ matrix.php == '8.3' && matrix.wp == 'latest' }}
+              uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de
+              with:
+                file: tests/logs/clover.xml
+                flags: phpunit
+                fail_ci_if_error: false
+
     build:
         name: Build
         runs-on: ubuntu-24.04
diff --git a/codecov.yml b/codecov.yml
new file mode 100644
index 00000000..84c66a69
--- /dev/null
+++ b/codecov.yml
@@ -0,0 +1,36 @@
+# Overall settings for PR integration via codecov.io
+# See https://docs.codecov.com/docs/codecovyml-reference
+
+# Separate PR statuses for project-level and patch-level coverage
+# See https://docs.codecov.com/docs/commit-status
+coverage:
+  status:
+    # Project-level coverage
+    project:
+      default:
+        base: auto
+        # Disable once code base is more mature.
+        informational: true
+        only_pulls: true
+        target: auto
+        threshold: 5%
+
+    # Patch-level coverage (how well is the PR tested)
+    patch:
+      default:
+        base: auto
+        informational: true
+        only_pulls: true
+        target: auto
+        threshold: 50%
+
+# Pull request comments
+# See https://docs.codecov.com/docs/pull-request-comments
+comment: false
+
+# See https://docs.codecov.com/docs/ignoring-paths
+ignore:
+- tests
+- vendor
+- node_modules
+- dist
diff --git a/readme.md b/readme.md
index ba89985d..dd2b1606 100644
--- a/readme.md
+++ b/readme.md
@@ -5,7 +5,7 @@
 
 ![WordPress.org Rating](https://img.shields.io/wordpress/plugin/rating/two-factor?label=WP.org%20Rating) ![WordPress Plugin Downloads](https://img.shields.io/wordpress/plugin/dt/two-factor?label=WP.org%20Downloads) ![WordPress Plugin Active Installs](https://img.shields.io/wordpress/plugin/installs/two-factor?label=WP.org%20Active%20Installs) [![WordPress Playground Demo](https://img.shields.io/wordpress/plugin/v/two-factor?logo=wordpress&logoColor=FFFFFF&label=Live%20Demo&labelColor=3858E9&color=3858E9)](https://playground.wordpress.net/?blueprint-url=https://raw.githubusercontent.com/WordPress/two-factor/master/.wordpress-org/blueprints/blueprint.json)
 
-[![Test](https://github.com/WordPress/two-factor/actions/workflows/test.yml/badge.svg)](https://github.com/WordPress/two-factor/actions/workflows/test.yml) [![Deploy](https://github.com/WordPress/two-factor/actions/workflows/deploy.yml/badge.svg)](https://github.com/WordPress/two-factor/actions/workflows/deploy.yml)
+[![Test](https://github.com/WordPress/two-factor/actions/workflows/test.yml/badge.svg)](https://github.com/WordPress/two-factor/actions/workflows/test.yml) [![Deploy](https://github.com/WordPress/two-factor/actions/workflows/deploy.yml/badge.svg)](https://github.com/WordPress/two-factor/actions/workflows/deploy.yml) [![codecov](https://codecov.io/gh/WordPress/two-factor/graph/badge.svg)](https://codecov.io/gh/WordPress/two-factor)
 
 > Two-Factor plugin for WordPress. [View on WordPress.org →](https://wordpress.org/plugins/two-factor/)