diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index bf75164..eecdee2 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -40,6 +40,37 @@ jobs:
           --features=${{ matrix.feature }} \
           //...
 
+  coverage:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v3
+
+    - name: mount bazel cache
+      uses: actions/cache@v3
+      with:
+        path: "~/.cache/bazel"
+        key: bazel-coverage
+
+    - name: install libtinfo5
+      # clang tools load libtinfo5 for color diagnostics but `ubuntu-latest`
+      # runners already have `libtinfo.so.6` installed. We just create a
+      # symlink since it's faster than installing libtinfo5.
+      # https://github.com/circleci/circleci-images/issues/430#issuecomment-522602495
+      run: |
+        sudo ln -s /lib/x86_64-linux-gnu/libtinfo.so.6 /lib/x86_64-linux-gnu/libtinfo.so.5
+
+    - run: |
+        bazel \
+          --bazelrc=.github/workflows/ci.bazelrc \
+          coverage \
+          //...
+
+    - uses: codecov/codecov-action@v3
+      with:
+        token: ${{ secrets.CODECOV_TOKEN }}
+        files: ./bazel-out/_coverage/_coverage_report.dat
+        fail_ci_if_error: true
+
   build:
     runs-on: ubuntu-latest
     strategy:
diff --git a/.github/workflows/ci.bazelrc b/.github/workflows/ci.bazelrc
index 5af51c3..1cbc97a 100644
--- a/.github/workflows/ci.bazelrc
+++ b/.github/workflows/ci.bazelrc
@@ -9,3 +9,15 @@ build --remote_download_minimal
 
 test --test_output=all
 test --test_verbose_timeout_warnings
+
+coverage --combined_report=lcov
+coverage --strategy=CoverageReport=local
+# At least some of this is needed for the coverage tool to work.
+coverage --experimental_split_coverage_postprocessing
+coverage --experimental_fetch_all_coverage_outputs
+coverage --remote_download_outputs=all
+coverage --experimental_remote_download_regex=.*/((testlogs/.*/_coverage/.*)|coverage.dat$|_coverage/_coverage_report.dat$)
+# Not sure why it doesn't work with clang. Should be possible.
+coverage --extra_toolchains=//toolchain:gcc
+# Needed because our tests are in a different package than the code they test.
+coverage --instrumentation_filter='//.*'