diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index bbe174f..307ba33 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -47,6 +47,9 @@ jobs:
 
   test:
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: read
     steps:
       - uses: actions/checkout@v7
       - uses: actions/setup-go@v7
@@ -60,7 +63,11 @@ jobs:
         run: sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
       - name: Run tests with coverage
         run: make test-coverage
-
+      - name: Upload results to Codecov
+        uses: codecov/codecov-action@v7
+        with:
+          use_oidc: true
+          files: .coverdata/unit.out,.coverdata/integration.out
   test-fedora:
     runs-on: ubuntu-latest
     container:
diff --git a/Makefile b/Makefile
index 5a3ddc3..a9ee2c6 100644
--- a/Makefile
+++ b/Makefile
@@ -30,7 +30,8 @@ test-coverage:
 	go test -cover ./... -args -test.gocoverdir=$(COVERDIR)/unit
 	GOCOVERDIR=$(COVERDIR)/integration python3 tests/test-synthetic.py
 	GOCOVERDIR=$(COVERDIR)/integration tests/integration-test.sh
-	go tool covdata percent -i $(COVERDIR)/unit,$(COVERDIR)/integration
+	go tool covdata textfmt -i=$(COVERDIR)/unit -o=$(COVERDIR)/unit.out
+	go tool covdata textfmt -i=$(COVERDIR)/integration -o=$(COVERDIR)/integration.out
 
 test-e2e: build
 	@echo "Running E2E tests (requires KVM for full coverage, falls back to container mode)"
diff --git a/README.md b/README.md
index 3857cbc..248e7e0 100644
--- a/README.md
+++ b/README.md
@@ -1,3 +1,5 @@
+[![codecov](https://codecov.io/gh/containers/oci-delta/branch/main/graph/badge.svg)](https://codecov.io/gh/containers/oci-delta)
+
 # oci-delta
 
 oci-delta is a tool to take two oci archive files, called the "old" and "new" image below,